Computer system and method of detecting manufacturing network anomalies

• US 10,169,135 B1
• Filed: 03/02/2018
• Issued: 01/01/2019
• Est. Priority Date: 03/02/2018
• Status: Active Grant

• Current Assignee: Uptake Technologies, Inc.
• Original Assignee: Uptake Technologies, Inc.
• Inventors: Pandey, Aparna, Troy de Fritas, Nelson
• Primary Examiner(s): Nguyen, Tai T
• Application Number:
  US15/910,920
• Time in Patent Office: 305 Days
• Field of Search: 340540, 340541, 340521, 340517, 340660, 706 45, 706 46, 706 47, 706 52, 706 53, 706 62
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 19/058 Safety, monitoring
• CPC Class Codes: G05B 19/4184 characterised by fault tolerance, reliability of production system
• CPC Class Codes: G05B 23/0235 based on a comparison with predetermined threshold or range, e.g. "classical methods", carried out during normal operation; threshold adaptation or choice; when or how to compare with the threshold
• CPC Class Codes: G05B 23/0267 Fault communication, e.g. human machine interface [HMI]
• CPC Class Codes: G05B 23/0283 Predictive maintenance, e.g. involving the monitoring of a system and, based on the monitoring results, taking decisions on the maintenance schedule of the monitored system; Estimating remaining useful life [RUL] preventive maintenance, i.e. planning maintenance according to the available resources without monitoring the system G06Q10/06
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0754 by exceeding limits
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: Y02P 90/02 Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Abstract

A computing system may be configured to monitor the operation of a plurality of nodes in a manufacturing network that comprises a plurality of edge nodes, a plurality of intermediate nodes, and a root node. While monitoring the operation of the plurality of nodes, the computing system may identify a given time at which at least one node in the manufacturing network satisfies node-level threshold criteria indicating anomalous operation of the node and responsively evaluate the operation of the manufacturing network at the given time using one or more of macro-level threshold, micro-level threshold criteria, path-level threshold criteria, and node-level threshold criteria. Based on the evaluation, the computing system may identify an anomaly in the manufacturing network at the given time and then cause a client station to present an alert indicating the anomaly.

Claims

1. A computing system comprising:

a network interface;

at least one processor;

a non-transitory computer-readable medium; and

program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to;

monitor operation of a plurality of nodes in a manufacturing network that comprises a plurality of edge nodes, a plurality of intermediate nodes, and a root node;

while monitoring the operation of the plurality of nodes in the manufacturing network, identify a given time at which at least one node in the manufacturing network satisfies node-level threshold criteria indicating anomalous operation of the node;

in response to identifying the given time at which at least one node satisfies the node-level threshold criteria, evaluate the operation of the manufacturing network at the given time using one or more of (a) macro-level threshold criteria indicating anomalous operation of the manufacturing network as a whole, (b) micro-level threshold criteria indicating anomalous operation of any micro-network in the manufacturing network, (c) path-level threshold criteria indicating anomalous operation of any node path in the manufacturing network, and (d) node-level threshold criteria indicating anomalous operation of any individual node in the manufacturing network;

based on the evaluation, identify at least one anomaly in the manufacturing network at the given time; and

cause a client station to present an alert indicating the at least one anomaly identified in the manufacturing network at the given time.

2. The computing system of claim 1, wherein the program instructions that are executable by the at least one processor to cause the computing system to identify a given time at which at least one node in the manufacturing network satisfies node-level threshold criteria indicating anomalous operation of the node comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to carry out the following functions for each of the plurality of nodes in the manufacturing network:

evaluate the operation of the node during a given window of time prior to the given time to determine a total amount of time that the node was anomalous during the given window of time; and

determine whether the total amount of time that the node was anomalous during the given window of time exceeds a threshold amount of time.

3. The computing system of claim 1,

wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of the manufacturing network at the given time comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

determine an extent of nodes in the manufacturing network that were anomalous at the given time; and

determine that the extent of nodes in the manufacturing network that were anomalous at the given time exceeds a threshold extent of anomalous nodes in a manufacturing network.

4. The computing system of claim 1, wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of the manufacturing network at the given time comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to carry out the following functions for each of a plurality of micro-networks in the manufacturing network:

based on the evaluation of the operation of the manufacturing network at the given time, determine an extent of nodes in the micro-network that were anomalous at the given time; and

determine whether the extent of nodes in the micro-network that were anomalous at the given time exceeds a threshold extent of anomalous nodes in a micro-network.

5. The computing system of claim 4, further comprising program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

for each micro-network identified to be anomalous at the given time, identify the root node of the micro-network as a potential root cause of the anomalous operation of the manufacturing network at the given time.

6. The computing system of claim 1, wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of the manufacturing network at the given time comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to carry out the following functions for each of a plurality of node paths in the manufacturing network:

evaluate the operation of each node in the node path at the given time to determine whether any node in the node path satisfies node-level threshold criteria indicating anomalous operation of a node;

based on the evaluation of the operation of the manufacturing network at the given time, determine an extent of nodes in the node path that were anomalous at the given time; and

determine whether the number of nodes in the node path that were anomalous at the given time exceeds a threshold extent of anomalous nodes in the node path.

7. The computing system of claim 6, further comprising program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

for each node path identified to be anomalous at the given time, identify one or both of a head node and a tail node of the node path as a potential root cause of the anomalous operation of the manufacturing network at the given time.

8. A computing system comprising:

a network interface;

at least one processor;

a non-transitory computer-readable medium; and

program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to;

monitor operation of a manufacturing network that comprises a plurality of edge nodes, a plurality of intermediate nodes, and a root node;

while monitoring the operation of the manufacturing network, identify a given time at which the manufacturing network satisfies macro-level threshold criteria indicating anomalous operation of the manufacturing network;

in response to identifying the given time at which the manufacturing network satisfies the macro-network threshold criteria, evaluate the operation of a plurality of discrete segments of the manufacturing network at the given time to determine whether any of the plurality of discrete segments of the manufacturing network satisfies segment-level threshold criteria indicating anomalous operation of the segment;

based on the evaluation, identify one or more segments of the manufacturing network that were anomalous at the given time; and

cause a client station to present an alert indicating that the identified one or more segments of the manufacturing network were anomalous at the given time.

9. The computing system of claim 8, wherein the program instructions that are executable by the at least one processor to cause the computing system to identify the given time at which the manufacturing network satisfies the macro-level threshold criteria comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

determine an extent of nodes in the manufacturing network that were anomalous at the given time; and

determine that the extent of nodes in the manufacturing network that were anomalous at the given time exceeds a threshold extent of anomalous nodes in a manufacturing network.

10. The computing system of claim 8, wherein the plurality of discrete segments of the manufacturing network comprise a plurality of micro networks in the manufacturing network, and wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of a plurality of discrete segments of the manufacturing network at the given time comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to carry out the following functions for each of the plurality of micro networks in the manufacturing network:

evaluate the operation of each node in the micro network at the given time to determine whether any node in the micro network satisfies node-level threshold criteria indicating anomalous operation of a node;

based on the evaluation, determine an extent of nodes in the micro network that were anomalous at the given time; and

determine whether the extent of nodes in the micro network that were anomalous at the given time exceeds a threshold extent of anomalous nodes in a micro network.

11. The computing system of claim 10, further comprising program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

for each micro network identified to be anomalous at the given time, identify the root node of the micro network as a potential root cause of the anomalous operation of the manufacturing network at the given time.

12. The computing system of claim 8, wherein the plurality of discrete segments of the manufacturing network comprise a plurality of node paths in the manufacturing network, and wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of a plurality of discrete segments of the manufacturing network at the given time comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to carry out the following functions for each of the plurality of node paths in the manufacturing network:

evaluate the operation of each node in the node path at the given time to determine whether any node in the node path satisfies node-level threshold criteria indicating anomalous operation of a node;

based on the evaluation, determine an extent of nodes in the node path that were anomalous at the given time; and

determine whether the number of nodes in the node path that were anomalous at the given time exceeds a threshold extent of anomalous nodes in a node path.

13. The computing system of claim 10, further comprising program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

for each node path identified to be anomalous at the given time, identify one or both of a head node and a tail node of the node path as a potential root cause of the anomalous operation of the manufacturing network at the given time.

14. The computing system of claim 8, wherein the plurality of discrete segments of the manufacturing network comprise a plurality of individual nodes in the manufacturing network, and wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of a plurality of discrete segments of the manufacturing network at the given time comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to evaluate the operation of each of the plurality of individual nodes at the given time to determine whether the individual node satisfies node-level threshold criteria indicating anomalous operation of a node.

15. The computing system of claim 14, wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of each of the plurality of individual nodes at the given time comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to carry out the following functions for each of the plurality of individual nodes in the manufacturing network:

evaluate the operation of the node during a given window of time prior to the given time to determine a total amount of time that the node was anomalous during the given window of time; and

determine whether the total amount of time that the node was anomalous during the given window of time exceeds a threshold amount of time.

16. A computer-implemented method comprising:

monitoring operation of a plurality of nodes in a manufacturing network that comprises a plurality of edge nodes, a plurality of intermediate nodes, and a root node;

while monitoring the operation of the plurality of nodes in the manufacturing network, identifying a given time at which at least one node in the manufacturing network satisfies node-level threshold criteria indicating anomalous operation of the node;

in response to identifying the given time at which at least one node satisfies the node-level threshold criteria, evaluating the operation of the manufacturing network at the given time using one or more of (a) macro-level threshold criteria indicating anomalous operation of the manufacturing network as a whole, (b) micro-level threshold criteria indicating anomalous operation of any micro-network in the manufacturing network, (c) path-level threshold criteria indicating anomalous operation of any node path in the manufacturing network, and (d) node-level threshold criteria indicating anomalous operation of any individual node in the manufacturing network;

based on the evaluation, identifying at least one anomaly in the manufacturing network at the given time; and

causing a client station to present an alert indicating the at least one anomaly identified in the manufacturing network at the given time.

17. The computer-implemented method of claim 16, wherein the at least one anomaly comprises a micro-network anomaly, the method further comprising:

identifying the root node of the micro-network as a potential root cause of the anomalous operation of the manufacturing network at the given time.

18. The computer-implemented method of claim 16, wherein the at least one anomaly comprises a node-path anomaly, the method further comprising:

identifying one or both of a head node and a tail node of the node path as a potential root cause of the anomalous operation of the manufacturing network at the given time.

19. A computer-implemented method comprising:

monitoring the operation of a manufacturing network that comprises a plurality of edge nodes, a plurality of intermediate nodes, and a root node;

while monitoring operation of the manufacturing network, identifying a given time at which the manufacturing network satisfies macro-level threshold criteria indicating anomalous operation of the manufacturing network;

in response to identifying the given time at which the manufacturing network satisfies the macro-network threshold criteria, evaluating the operation of a plurality of discrete segments of the manufacturing network at the given time to determine whether any of the plurality of discrete segments of the manufacturing network satisfies segment-level threshold criteria indicating anomalous operation of the segment;

based on the evaluation, identifying one or more segments of the manufacturing network that were anomalous at the given time; and

causing a client station to present an alert indicating that the identified one or more segments of the manufacturing network were anomalous at the given time.

20. The computer-implemented method of claim 19, wherein the plurality of discrete segments comprise one or more of a plurality of micro networks in the manufacturing network, a plurality of node paths in the manufacturing network, and a plurality of individual nodes in the manufacturing network.