Computer system and method of detecting manufacturing network anomalies

• US 10,552,248 B2
• Filed: 11/16/2018
• Issued: 02/04/2020
• Est. Priority Date: 03/02/2018
• Status: Active Grant

• Current Assignee: Uptake Technologies, Inc.
• Original Assignee: Uptake Technologies, Inc.
• Inventors: Pandey, Aparna, Troy de Freitas, Nelson
• Primary Examiner(s): Nguyen, Tai T
• Application Number:
  US16/194,027
• Publication Number:
  US 20190272207A1
• Time in Patent Office: 445 Days
• Field of Search: 340540, 340541, 340517, 340521, 340660, 340 10, 340 1032, 340 567, 706 45- 47, 706 53, 706 62, 714 26, 714 27, 714 43, 714 56
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 19/058 Safety, monitoring
• CPC Class Codes: G05B 19/4184 characterised by fault tolerance, reliability of production system
• CPC Class Codes: G05B 23/0235 based on a comparison with predetermined threshold or range, e.g. "classical methods", carried out during normal operation; threshold adaptation or choice; when or how to compare with the threshold
• CPC Class Codes: G05B 23/0267 Fault communication, e.g. human machine interface [HMI]
• CPC Class Codes: G05B 23/0283 Predictive maintenance, e.g. involving the monitoring of a system and, based on the monitoring results, taking decisions on the maintenance schedule of the monitored system; Estimating remaining useful life [RUL] preventive maintenance, i.e. planning maintenance according to the available resources without monitoring the system G06Q10/06
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0754 by exceeding limits
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: Y02P 90/02 Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Abstract

A computing system may evaluate the operation of a manufacturing network using at least two of (a) macro-level threshold criteria indicating anomalous operation of the manufacturing network as a whole, (b) micro-level threshold criteria indicating anomalous operation of any of a plurality of micro-networks in the manufacturing network, (c) path-level threshold criteria indicating anomalous operation of any of a plurality of node paths in the manufacturing network, or (d) node-level threshold criteria indicating anomalous operation of any of a plurality of individual nodes in the manufacturing network. Based on the evaluating, computing system may identify at least one anomaly in the manufacturing network and then trigger at least one action that is directed to resolving the at least one anomaly.

Claims

1. A computing system comprising:

a network interface;

at least one processor;

a non-transitory computer-readable medium; and

program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to;

while monitoring operation of a manufacturing network having a topology that includes a plurality of edge nodes, a plurality of intermediate nodes, and a root node, evaluate the operation of the manufacturing network using at least two of (a) macro-level threshold criteria indicating anomalous operation of the manufacturing network as a whole, (b) micro-level threshold criteria indicating anomalous operation of any of a plurality of micro-networks in the manufacturing network, (c) path-level threshold criteria indicating anomalous operation of any of a plurality of node paths in the manufacturing network, or (d) node-level threshold criteria indicating anomalous operation of any of a plurality of individual nodes in the manufacturing network;

based on the evaluation, identify at least one anomaly in the manufacturing network; and

after identifying the at least one anomaly, trigger at least one action that is directed to resolving the at least one anomaly.

2. The computing system of claim 1, wherein the program instructions that are executable by the at least one processor to cause the computing system to trigger the at least one action comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to (a) send a communication to a client station that causes the client station to present an alert indicating the identified at least one anomaly, (b) send a command to the manufacturing network that causes at least one node in the manufacturing network to be shutdown, disconnected, isolated, or restarted, or (c) send a command to the manufacturing network that causes activation of at least one standby node.

3. The computing system of claim 1, wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of the manufacturing network using at least two of (a) the macro-level threshold criteria, (b) the micro-level threshold criteria, (c) the path-level threshold criteria, or (d) the node-level threshold criteria comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

evaluate the operation of the manufacturing network using first criteria that is selected from (a) the macro-level threshold criteria, (b) the micro-level threshold criteria, (c) the path-level threshold criteria, or (d) the node-level threshold criteria;

based on the evaluation of the operation of the manufacturing network using the first criteria, make a determination that the operation of the manufacturing network satisfies the first criteria at a given time; and

in response to the determination, evaluate the operation of the manufacturing network at the given time using at least second criteria that is selected from (a) the macro-level threshold criteria, (b) the micro-level threshold criteria, (c) the path-level threshold criteria, or (d) the node-level threshold criteria, wherein the second criteria differs from the first criteria.

4. The computing system of claim 3, wherein the first criteria comprises the node-level threshold criteria, and wherein the at least second criteria comprises at least one of (a) the macro-level threshold criteria, (b) the micro-level threshold criteria, or (c) the path-level threshold criteria.

5. The computing system of claim 3, wherein the first criteria comprises the macro-level threshold criteria, and wherein the at least second criteria comprises at least one of (a) the micro-level threshold criteria, (b) the path-level threshold criteria, or (c) the node-level threshold criteria.

6. The computing system of claim 1, wherein the program instructions that are executable by the at least one processor to cause the computing system to identify the at least one anomaly in the manufacturing network based on the evaluation comprises program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

based on the evaluation, identify one of (a) an anomalous macro network, (b) at least one anomalous micro network in the manufacturing network, (c) at least one anomalous node path in the manufacturing network, or (d) at least one anomalous individual node in the manufacturing network.

7. The computing system of claim 1, wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of the manufacturing network using the macro-level threshold criteria comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

determine a respective health score for each node in the manufacturing network at or before a given time using a recursive process that determines respective health scores for nodes in the manufacturing network on a topology level-by-level basis starting with the plurality of edge nodes of the manufacturing network and ending with the root node of the manufacturing network;

use the respective health scores for the nodes in the manufacturing network at or before the given time as a basis for determining an extent of nodes in the manufacturing network as a whole that are anomalous at the given time; and

determine whether the extent of nodes in the manufacturing network that are anomalous at the given time exceeds a threshold extent of anomalous nodes in a manufacturing network.

8. The computing system of claim 1, wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of the manufacturing network using the micro-level threshold criteria comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to perform the following functions for each respective micro network of the plurality of micro networks of the manufacturing network:

determine a respective health score for each node in the respective micro network at or before a given time using a recursive process that determines respective health scores for nodes in the manufacturing network on a topology level-by-level basis starting with the plurality of edge nodes of the manufacturing network and ending with the root node of the manufacturing network;

use the respective health scores for the nodes in the respective micro network at or before the given time as a basis for determining an extent of nodes in the respective micro network that are anomalous at the given time; and

determine whether the extent of nodes in the respective micro network that are anomalous at the given time exceeds a threshold extent of anomalous nodes in a micro network.

9. The computing system of claim 1, wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of the manufacturing network using the path-level threshold criteria comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to perform the following functions for each respective node path of the plurality of node paths of the manufacturing network:

determine a respective health score for each node in the respective node path at or before a given time using a recursive process that determines respective health scores for nodes in the manufacturing network on a topology level-by-level basis starting with the plurality of edge nodes of the manufacturing network and ending with the root node of the manufacturing network;

use the respective health scores for the nodes in the respective node path at or before the given time as a basis for determining an extent of nodes in the respective node path that are anomalous at the given time; and

determine whether the extent of nodes in the respective node path that are anomalous at the given time exceeds a threshold extent of anomalous nodes in a node path.

10. The computing system of claim 1, wherein the program instructions that are executable by the at least one processor to cause the computing system to evaluate the operation of the manufacturing network using the node-level threshold criteria comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to perform the following functions for each respective node of the plurality of individual nodes of the manufacturing network:

determine a respective health score for the respective node at or before a given time using a recursive process that determines respective health scores for nodes in the manufacturing network on a topology level-by-level basis starting with the plurality of edge nodes of the manufacturing network and ending with the root node of the manufacturing network; and

use the respective health score for the respective node at or before the given time as a basis for determining whether the respective node was anomalous at the given time.

11. The computing system of claim 10, wherein the program instructions that are executable by the at least one processor to cause the computing system to use the respective health score for the respective node at or before the given time as a basis for determining whether the respective node was anomalous at the given time comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

evaluate whether the respective health score for the respective node at the given time is below a health-score threshold that is defined based on a set of health scores for the respective node at times prior to the given time.

12. The computing system of claim 10, wherein the program instructions that are executable by the at least one processor to cause the computing system to use the respective health score for the respective node at or before the given time as a basis for determining whether the respective node was anomalous at the given time comprise program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

determine an extent of a given window of time preceding the given time during which the respective health score of the respective node was below a health-score threshold; and

evaluate whether the determined extent is above a threshold extent.

13. The computing system of claim 1, wherein the at least one anomaly comprises an anomalous micro network having a micro-network root node, and wherein the computing system further comprises program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

identify the micro-network root node of the anomalous micro network as a potential root cause of the at least one anomaly.

14. The computing system of claim 1, wherein the at least one anomaly comprises an anomalous node path having a given head node and a given tail node, and wherein the computing system further comprises program instructions stored on the non-transitory computer-readable medium that are executable by the at least one processor to cause the computing system to:

identify one or both of the given head node or the given tail node of the anomalous node path as a potential root cause of the at least one anomaly.

15. A computer-implemented method comprising:

while monitoring operation of a manufacturing network having a topology that includes a plurality of edge nodes, a plurality of intermediate nodes, and a root node, evaluating the operation of the manufacturing network using at least two of (a) macro-level threshold criteria indicating anomalous operation of the manufacturing network as a whole, (b) micro-level threshold criteria indicating anomalous operation of any of a plurality of micro-networks in the manufacturing network, (c) path-level threshold criteria indicating anomalous operation of any of a plurality of node paths in the manufacturing network, or (d) node-level threshold criteria indicating anomalous operation of any of a plurality of individual nodes in the manufacturing network;

based on the evaluating, identifying at least one anomaly in the manufacturing network; and

after identifying the at least one anomaly, triggering at least one action that is directed to resolving the at least one anomaly.

16. The computer-implemented method of claim 15, wherein triggering the at least one action comprises one of (a) sending a communication to a client station that causes the client station to present an alert indicating the identified at least one anomaly, (b) sending a command to the manufacturing network that causes at least one node in the manufacturing network to be shutdown, disconnected, isolated, or restarted, or (c) sending a command to the manufacturing network that causes activation of at least one standby node.

17. The computer-implemented method of claim 16, wherein evaluating the operation of the manufacturing network using at least two of (a) the macro-level threshold criteria, (b) the micro-level threshold criteria, (c) the path-level threshold criteria, or (d) the node-level threshold criteria comprises:

evaluating the operation of the manufacturing network using first criteria that is selected from (a) the macro-level threshold criteria, (b) the micro-level threshold criteria, (c) the path-level threshold criteria, or (d) the node-level threshold criteria;

based on the evaluating of the operation of the manufacturing network using the first criteria, determining that the operation of the manufacturing network satisfies the first criteria at a given time; and

in response to the determining, evaluating the operation of the manufacturing network at the given time using at least second criteria that is selected from (a) the macro-level threshold criteria, (b) the micro-level threshold criteria, (c) the path-level threshold criteria, or (d) the node-level threshold criteria, wherein the second criteria differs from the first criteria.

18. The computer-implemented method of claim 17, wherein the first criteria comprises the node-level threshold criteria, and wherein the at least second criteria comprises at least one of (a) the macro-level threshold criteria, (b) the micro-level threshold criteria, or (c) the path-level threshold criteria.

19. The computer-implemented method of claim 17, wherein the first criteria comprises the macro-level threshold criteria, and wherein the at least second criteria comprises at least one of (a) the micro-level threshold criteria, (b) the path-level threshold criteria, or (c) the node-level threshold criteria.

20. A non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium is provisioned with software that is executable to cause a computing system to perform functions including:

while monitoring operation of a manufacturing network having a topology that includes a plurality of edge nodes, a plurality of intermediate nodes, and a root node, evaluating the operation of the manufacturing network using at least two of (a) macro-level threshold criteria indicating anomalous operation of the manufacturing network as a whole, (b) micro-level threshold criteria indicating anomalous operation of any of a plurality of micro-networks in the manufacturing network, (c) path-level threshold criteria indicating anomalous operation of any of a plurality of node paths in the manufacturing network, or (d) node-level threshold criteria indicating anomalous operation of any of a plurality of individual nodes in the manufacturing network;

based on the evaluating, identifying at least one anomaly in the manufacturing network; and

after identifying the at least one anomaly, triggering at least one action that is directed to resolving the at least one anomaly.