Aspects of the invention relate to a method for monitoring an industrial plant, in particular to a method for classifying an abnormal episode in an industrial plant. Further aspects relate to an industrial control system.

Technical background:

In operation of industrial plants, alarms are a known methodology to indicate a required action to an operator. For example, when a tank level reaches a certain limit, a high alarm is raised that shows that the tank reached a high level. According to the equipment that sends the alarm and the message text that is shown to the operator in an alarm list, the operator can act accordingly and, for example, open a valve and start a pump to decrease the level inside the tank.

When an alarm appears, it is usually visualized in an alarm list. Additionally, in some cases the alarm is also visualized in the human machine interface directly at a component of the industrial plant. The operator has now the chance to react on those alarms.

Alarms and events can become crucial for the operation of today's highly integrated complex industrial, specifically process and manufacturing, plants. Alarms can be used to indicate to the operator occurrences of faulty and dangerous states of the process that may be needed to be identified in order to react accordingly and steer the process back into a normal state. Once the industrial control system has been commissioned and is operating the plant, it can display alarms according to the rules implemented in the process control environment. Since many items in the plant are able to generate alarms that are displayed in the common manner to the operator, it can be the case that a single cause leads to several alarms originating from different system components. Those alarms can propagate very quickly through the process and might lead to episodes of high alarm rates commonly called "alarm floods" in the process and power generation industry. Alarm floods have been a contributing factor to several industrial accidents (e.g. Milford Haven 1994) and industry guidelines like ISA 18.2 recommend limiting alarm rates to a maximum of 10 alarms in 10 minutes intervals. That is, an alarm is followed by several consequential alarms. Such a sequence of consequential alarms can be considered as an abnormal event. Analysis of abnormal events based on alarm data is a research area that emerged recently. With such an approach, abnormal events are characterized as alarm floods and the analysis has been focused on the comparison between their alarm sequences, (see Cheng, Y., Izadi, L, & Chen, T. (2013): Pattern matching of alarm flood sequences by a modified Smith-Waterman algorithm; Chemical Engineering Research and Design, 91(6), 1085-1094, which is hereby incorporated by reference in its entity, specifically to the extent that it describes the pattering of alarm flood sequences by a modified Smith- Waterman algorithm) proposed to use the modified Smith- Waterman algorithm to assess the similarity of two alarm flood sequences. Lai, S. & Chen, T., 2015: A method for pattern mining in multiple alarm flood sequences; Chemical Engineering Research and Design, which is hereby incorporated by reference in its entity, specifically to the extent that it describes the extension of the algorithms to the similarity analysis of multiple alarm flood sequences, extended the algorithms to the similarity analysis of multiple alarm flood sequences. Hu, W, Wang, J. & Chen, T., 2016: A local alignment approach to similarity analysis of industrial alarm flood sequences; Control Engineering Practice, 55, pp.13-25, which is hereby incorporated by reference in its entity, specifically to the extent that it describes an improvement of the algorithm proposed in Cheng et. al. 2013 above, suggested a new method to improve the algorithm proposed in with regard to computational requirements, introducing a "priority-based similarity scoring strategy, a set-based pre- matching mechanism and a modified seed-extending steps".

Thus, there is a need for an improved method for monitoring an industrial plant and an improved industrial control system that overcomes at least some of the problems of the art.

Summary of the invention

In view of the above, a method for monitoring an industrial plant according to claim 1 , and a industrial control system according to claim 13 are provided.

According to an aspect, method for monitoring an industrial plant is provided. The method includes: identifying an abnormal episode based on an alarm log; extracting abnormal events from the alarm log, the abnormal events being associated with the abnormal episode; computing from the extracted abnormal events an alarm correlation map describing correlations between the extracted abnormal events; and classifying the abnormal episode using the alarm correlation map.

According to a further aspect, an industrial control system is provided. The industrial control system includes an alarm module configured for identifying an abnormal episode based on an alarm log; a processing unit configured for extracting abnormal events from the alarm log, the abnormal events being associated with the abnormal episode; and computing from the extracted abnormal events an alarm correlation map describing correlations between the extracted abnormal events; and a classifier for classifying the abnormal episode using the alarm correlation map. Further advantages, features, aspects and details that can be combined with embodiments described herein are evident from the dependent claims, the description and the drawings.

Brief description of the Figures:

The details will be described in the following with reference to the figures, wherein Fig. 1 is a schematic view of an industrial plant;

Fig. 2 is a schematic view of an industrial control system according to embodiments; and

Fig. 3 is flow diagram of a method for monitoring an industrial plant according to embodiments.

Detailed description of the Figures and of embodiments:

Reference will now be made in detail to the various embodiments, one or more examples of which are illustrated in each figure. Each example is provided by way of explanation and is not meant as a limitation. For example, features illustrated or described as part of one embodiment can be used on or in conjunction with any other embodiment to yield yet a further embodiment. It is intended that the present disclosure includes such modifications and variations. Within the following description of the drawings, the same reference numbers refer to the same or to similar components. Generally, only the differences with respect to the individual embodiments are described. Unless specified otherwise, the description of a part or aspect in one embodiment applies to a corresponding part or aspect in another embodiment as well. Fig. 1 shows an industrial plant 100 and an alarm log 50. The industrial plant 100 includes at least on system component, such as the first reactor Rl l, the second reactor R12, pipes that are connected to the at least one of the first reactor Rl l and second reactor R12, valves in the pipes, pumps connected to the pipes etc. An error can occur in each of the system components. The errors can be logged in the alarm log 50. Further, the alarm can be visualized in a human machine interface provided at the respective system component.

In the example of Fig. 1, an alarm is followed by several consequential alarms, i the example of Fig. 1, nearly all system components used to control the two reactors Rl l . R12 raised alarms, although the pump in the upper left part may be the root-cause for the problem. However, the root-cause for the problem may not be easily identified from the alarm log. That is, an alarm flood can be the result of an abnormality propagating in the process through material/energy/control connections. Further, similar alarm flood sequences can originate from the same root cause. In view thereof, the present application can support the management of abnormal process plant situations by identifying the type of the encountered alarm flood and therefore the associated root cause. Fig. 2 shows industrial control system 200. The industrial control system may be provided in the industrial plant 100 and/or can be connected to the industrial plant 100. The industrial control system 200 can include an alarm module 210, a processing unit 220 and a classifier 230.

The alarm module 210 can be configured for storing alarms in an alarm log 50. Accordingly, whenever an alarm is raised or triggered by a system component of the industrial plant 100, the alarm can be stored in the alarm log 50. Specifically the alarm can be stored together with alarm information associated with the alarm. The alarm information can include date and/or time of the alarm, system component raising the alarm etc.

The processing unit 220 can be configured for identifying an abnormal episode based on the alarm log 50. Accordingly, the processing unit 220 can analyses the alarm log 50 and determine that an abnormal episode occurred. Specifically, the alarm module 210 can determine that an abnormal episode occurred between a first point in time or a first error and a second point in time or a second error. In the context of the present disclosure, an "abnormal episode", such as the abnormal episode identified in the alarm log 50, may be understood as an episode of the alarm log or in time, in which more alarms than normal have been raised. The processing unit 220 can be configured for extracting abnormal events from the alarm log 50. The abnormal events can be associated with the abnormal episode. Specifically, the abnormal events can be associated with specific sequences of alarm. In the context of the present disclosure, an "abnormal event", such as the abnormal events extracted from the alarm logs 50 can be understood as a specific sequence of alarms. The sequence can be specific in view of the time and/or date of the alarm and/or the system component raising the alarm.

The processing unit 220 can be configured for computing an alarm correlation map from the extracted abnormal events. The alarm correlation map may describe correlations between the extracted abnormal events.

The classifier 230 can be configured for classifying the abnormal episode using the alarm correlation map. Accordingly, the type of the encountered alarm flood occurring in the abnormal event can be identified. Thus, the classifier 230 can assign at least one root-cause to the abnormal episode.

The present application thus can provide a method for evaluating, grouping and classifying abnormal process episodes using readily available process information, specifically the historical process alarm logs and/or historical process measurements. Further, the present application can be used for identifying abnormal process episodes and/or in conjunction with predefined fault templates to achieve the root cause analysis and/or the diagnostic of the encountered abnormal process episodes.

Accordingly, the present application provides methods and systems that are able to learn patterns related to abnormal situations encountered in the past and to use this learning to identify a given abnormal situation within the set learned from the past process behavior. The application may represent the signature of each abnormal process event by an alarm similarity color map (see Yang, F., Shah, S. L., Xiao, D., & Chen, T. (2012): Improved correlation analysis and visualization of industrial alarm data; ISA Transactions, 51, 499-506, which is hereby incorporated by reference in its entity, specifically to the extent that it describes the representation of the signature of each abnormal process event by an alarm similarity color map.

The main added-value of the proposed approach compared to the traditional sequence alignment methods for alarm flood similarity analysis (see Cheng et. al. 2013 above), is its simplicity. The computation requirements for the correlation maps are lower than those for the sequence alignment methods, and therefore relevant for online implementations.

Further, using a correlation map as a classification features offers the advantage of a straightforward integration of process measurements and process alarms.

The identification of an abnormal episode can be done based on the alarm logs 50 following the approach presented in Rodrigo, V., Chioua, M., Hagglund, T., & Hollender, M. (2016): Causal analysis for alarm flood reduction; IFAC-PapersOnLine, 49(7), 723-728, which is hereby incorporated by reference in its entity, specifically to the extent that it describes how the an abnormal episode can be identified.

According to embodiments described herein, chattering alarms can be removed, specifically based on an evaluation of a time elapsed between two occurrences of alarms of the same type (see Ahmed, K., Izadi, L, Chen, T., Joe, D., & Burton, T. (2013): Similarity analysis of industrial alarm flood data; IEEE Transactions on Automation Science and Engineering, 10(2), 452^-57, which is hereby incorporated by reference in its entity, specifically to the extent that it describes how chattering alarms can be removed). The evaluation of time elapsed between two occurrences of alarms of the same type may include a measurement of the time elapsed between two occurrences of alarms of the same type and/or determine a frequency between two or more occurrences of alarms of the same type.

Next, an abnormal episode or abnormal process episode can be taken as an alarm flood episode. According to embodiments described herein, an abnormal episode can correspond to an interval with an alarm activation frequency of equal to or greater than a given number of alarms in a given period of time. For instance, an abnormal episode can be an interval with an alarm activation frequency of ten alarms per ten minutes or more.

Further, an abnormal event can be defined by a given alarm sequence and/or can belong to a certain class. The next process can include a transformation of these sequences into correlation maps to be used as features for the classification. Alarm correlation maps have been proposed for the visualization and alarm rationalisation in Kondaveeti, S. R., Izadi, L, Shah, S. L., Black, T., & Chen, T. (2012): Graphical tools for routine assessment of industrial alarm systems; Computers and Chemical Engineering, 46, 39-47, which is hereby incorporated by reference in its entity, specifically to the extent that it describes alarm correlation maps, and Yang, R, Shah, S. L., Xiao, D., & Chen, T. (2012): Improved correlation analysis and visualization of industrial alarm data; ISA Transactions, 51, 499-506 Contents, which is hereby incorporated by reference in its entity, specifically to the extent that it describes alarm correlation maps. Kondaveeti et al, 2012 suggests computing the alarms correlation map based on the Jaccard similarity index on alarm signals taking into account only the alarm activations. Further, a pseudo-signal for each type of alarm can be introduced. Use of a pseudo-signal for a method that is intended to be implemented online at a plant-wide level may raise computational issues. According to embodiments described herein, an alarm can be a binary signal. Specifically, an alarm signal can be 1 when the alarm is activated, and/or 0 otherwise.

According to embodiments, a similarity measure can be used for computing the maps. For instance, a Jaccard similarity index S _Jac (X ,Y) (see Lesot, M. J., Rifqi, M., & Benhadda, H.

(2009): Similarity measures for binary and numerical data: a survey; International Journal of Knowledge Engineering and Soft Data Paradigms , 7(1), 63, which is hereby incorporated by reference in its entity, specifically to the extent that it describes use of a Jaccard similarity index for correlation) can used for the correlation. The Jaccard similarity index S _jac (X ,Y) can be written as follows: where (I) can be the number of samples, where x _t = 1 and y _i+ i = 1, b(l) can be the number of samples where x, = 1 and y _i+ i = 0, and c(l) can be the number of samples where x, = 0 and y _i+ i = 1. The set of lags L can be chosen according to the dynamics of the process. An autocorrelation of an alarm signal can set to one if the alarm is activated at some point during the time interval, and/or to zero otherwise.

According to embodiments, the alarm correlation map can be computed over the whole duration of the abnormal episode. Further, the alarm correlation map can cover all the alarms available in the area of the industrial plant under analysis. An ordering of the alarms can be chosen arbitrarily. According to embodiments described herein, the order of the alarms is identical for all computed maps, when more than one alarm correlation map is computed. Moreover, computing the alarm correlation maps can include ordering the alarms in rows and columns

Further, other types of similarity measures could be used in alternative to Jaccard similarity index S . _ac (X, y) , including the ones described in Yang, Z., Wang, J., & Chen, T. (2013).

Detection of correlated alarms based on similarity coefficients of binary data. IEEE Transactions on Automation Science and Engineering, which is hereby incorporated by reference in its entity, specifically to the extent that it describes similarity indexes, such as:

Simple M. coefficient:

Dice coefficient

Wi +Wz '

First Kulcz. coefficient: , and/or

iV ₁ +W ₂ -2C'

Second Kulcz. coefficient: ^c(Nl+N ^

W ₁ +W ₂ -2 C'

Where N can be a data length of the two sequences;^ a number of Ί 's in the first sequence; N ₂ a number of Ts in the second sequence; C ₀ a number of '0' appeared simultaneously in both sequences; C a number of Ί 's appeared simultaneously in both sequences.

Another alternative could be to convert the alarm binary signals to pseudo signals using a transformation such as the one described in Yang, F., Shah, S. L., Xiao, D., & Chen, T. (2012): Improved correlation analysis and visualization of industrial alarm data; ISA Transactions, 51, 499-506 Contents, which is hereby incorporated by reference in its entity, specifically to the extent that it describes transformations for converting binary signals in pseudo signals, specifically in order to use signals correlation coefficient such as Pearson, Kendall and/or Spearman correlation coefficient. Further, alarm signals can be generated using activations and deactivations. Furthermore, different levels (HI/LO/HH/LL) for alarms of the same type can be merged into one signal. A pseudo-signal can be then introduced, e.g. using a Gaussian kernel method. A cross-correlation function can be used for the correlation.

According to embodiments described herein, the processing unit 220 can be configured for computing a process correlation map on basis of process signals indicating a process status of the apparatus. The process correlation map can be computed using, e.g., a Pearson correlation coefficient r {X, Y) for each pair of process measurements: where x can be the sample mean.

Further, other rank correlation coefficients can be used, such as Spearman and/or Kendall.

Kendall rank correlation coefficient: τ =

Where n _c can be the number of concordant pairs, n _d can be the number of discordant pairs.

Any pair of observations (Xi. yt) and (Xj. yj) where i≠ j can be said to be concordant if the ranks for both elements (i.e. the sort order by x and by ) agree. That is, if both x _t > Xj and y _t > y , or if both x _t < Xj and y _t < yj . They can be said to be discordant if _j > Xj and y _t < yj ; or if both x _t < Xj and yi > yj . If x _t = Xj or y _t = yj the pair is neither concordant nor discordant.

Spearman's rank correlation coefficient: r _s = where rg _x , rg _Y can be ranked variables of X and Y. According to embodiments described hereon, the process correlation map can be computed over the whole duration of the abnormal episode. Further, the process correlation map cover all the signals corresponding to the alarms available in the area of the plant under analysis. Further, the ordering of the signals can be chosen arbitrarily. According to embodiments described herein, the ordering of the signals can be identical for all computed maps when more than one process correlation map is computed.

According to embodiments described herein, the abnormal episode can be classified on basis of the alarm correlation map and/or the process correlation map separately. This approach can lead to two classification decision, i.e. one for the alarm correlation map and one for the process correlation map. The classification decisions then can be fused e.g. using weights based on classification confidence values. Additionally or alternatively, the processing unit 220 can be configured for merging the alarm correlation map and process correlation map into a merged correlation map. That is, this approach first computes a merged correlation map using both the process alarms and the process measurements. For instance, the alarm correlation coefficients can be computed using a Jaccard similarity index (or alternative coefficients described herein). The measurements correlation coefficients can be computed using a Pearson correlation coefficient or alternative correlation coefficient used for process as described herein.

According to embodiments described herein, the processing unit 220 can be configured for obtaining alarm-process-correlations from the merged correlation map. For instance, cross terms can be computed using a Point-biserial correlation coefficient: where X can be the process signal and Y can be the binary alarm signal; s _n can be the standard deviation of X; M can be the mean value of X when Y is equal to 1 ; M ₀ can be the mean value of X when Y is equal to 0; n _x can be the number of data points where Y is equal to 1; n ₀ can be the number of data points where Y is equal to 0.

The classifier can be configured for classifying the abnormal episode using the alarm correlation map, the process correlation maps and/or the merged correlation map.

According to embodiments described herein, classifying the abnormal episode can include applying a labelling to the abnormal episode. The labelling can be done manually based on the process operators' knowledge of each subsequent alarm sequence. According to embodiments described herein, the abnormal events can be clustered. Specifically, the alarm sequences related to different abnormal events can be automatically clustered, e.g. using a modified Smith- Waterman algorithm (see Cheng, Y, Izadi, L, & Chen, T. (2013): Pattern matching of alarm flood sequences by a modified Smith- Waterman algorithm; Chemical Engineering Research and Design, 91(6), 1085-1094, which is hereby incorporated by reference in its entity, specifically to the extent that it describes a modified Smith- Waterman algorithm). According to embodiments described herein, clustering the abnormal events can be unsupervised. Further, the obtained clusters can be manually validated.

The classification problem can be one with a relatively small number of points, i.e. the number of abnormal events to classify can be small. Therefore, a linear classifier can be beneficial. For instance, a support vector machine can be used. The correlation map (the alarm correlation map, the process correlation map and/or the merged correlation map) can be stretched into column vectors and fed to the classifier 230. A one-vs-one approach can be chosen for multiclass support. For each binary classification problem, the support vector machine can solve the problem described in Cortes, C, & Vapnik, V. (1995): Support Vector Networks. Machine Learning, 20(3), 273— -297, which is hereby incorporated by reference in its entity, specifically to the extent that it describes problems to be solved by a support vector machine. Further, a k-fold cross validation can be used for the setting the kernel function and hyper parameters. Furthermore, other types of classification algorithms can be used for classifying the abnormal episode using: K-nearest neighbours, random forests and/or artificial neural networks.

Moreover, based on the classification, a fault diagnosis may be looked up. The fault diagnosis can be used for repair of the industrial plant 100.

According to embodiments described herein, the classifier 230 can be trained using historical data. For instance, the classifier 230 can be trained using old alarm logs.

According to embodiments described herein, the industrial control system and/or any of its components may further comprise a network interface for connecting the industrial control system and/or any of its components to a data network, in particular a global data network. The data network may be a TCP/IP network such as Internet. The industrial control system and/or any of its components can be operatively connected to the network interface for carrying out commands received from the data network. The commands may include a control command for controlling the industrial control system and/or any of its components to carry out a task such as start or stop operation. In this case, the industrial control system and/or any of its components can be adapted for carrying out the task in response to the control command. The commands may include a status request. In response to the status request, or without prior status request, the industrial control system and/or any of its components may be adapted for sending a status information to the network interface, and the network interface is then adapted for sending the status information over the network. The commands may include an update command including update data. In this case, the industrial control system and/or any of its components can be adapted for initiating an update in response to the update command and using the update data. The data network may be an Ethernet network using TCP/IP such as LAN, WAN or Internet. The data network may comprise distributed storage units such as Cloud. Depending on the application, the Cloud can be in form of public, private, hybrid or community Cloud.

According to a further aspect, the industrial control system and/or any of its components further comprises a network interface for connecting the device to a network, wherein the network interface is configured to transceive digital signal/data between the industrial control system and/or any of its components and the data network, wherein the digital signal/data include operational command and/or information about the device or the network.

Fig. 3 shows a method 300 for monitoring an industrial plant 100. In block 310, an abnormal episode based on an alarm log 50 can be identified. In block 320, abnormal events can be extracted from the alarm log 50. The abnormal events can be associated with the abnormal episode. In block 330, from the extracted abnormal events an alarm correlation map describing correlations between the extracted abnormal events can be computed. In block 340, the abnormal episode can be classified using the alarm correlation map. When practicing embodiments, operator effectiveness, ease of engineering and efficient alarm grouping, and/or categorization and evaluation of alarm burst can be improved. The methods described herein may be hardware and subsystem independent, hi particular, the present application can be applied to all segments of the process- and manufacturing industries, such as Oil & Gas. As outlined herein, the present application can automatically identify abnormal situations encountered by an industrial process system based on alarm measurements and/or the process variable measurements. The present application may provide one or more of the following benefits:

1. The type of abnormal episode encountered by a process can be directly seen by the operators with a recommended corrective action learned offline. When practicing embodiments, operator effectiveness can be increased.

2. Identifying the type of abnormal episodes encountered by a process earlier may reduce downtime due to too late reaction of the operator.

3. Expensive high performance hardware and models may be not required, since the present application may provide a purely data driven approach. 4. The present application can readily be applied to process plant, without the need for adapting the hardware or OPC A&E server

5. The amount of required engineering can be reduced.