Anomaly Detection via Optimal Symbolic Observation of Physical Processes

1
Anomaly Detection via Optimal Symbolic
Observation of Physical Processes
H.E. Garcia and T. YooSensor, Control, and
Decision SystemsHuman Factors and IC
SystemsOn-line Condition Monitoring
MeetingKnoxville, TN, June 27-30, 2005
2
Presentation Outline

• Motivation
• Developed rigorous framework, methodology, and
  tool
• Illustrative uses of developed technology
• Conclusions
• Future RD

3
On-line Condition Monitoring

• Design problem
• Find (optimal) sensor configurations that can
  detect special (e.g., abnormal) events and/or
  behaviors
• Current solution
• Sensors are installed to detect anomalies without
  optimizing information costs and assuming full
  observability of specified events/behaviors
• Proposed solution
• Optimal Symbolic Observation technique
• Design gather information from an optimal
  sensing network configuration
• Formally guarantee observability requirements and
  constraints
• Integrate and analyze process information
  automatically
• Detect concerned anomalies based on both observed
  and recorded data

4
On-line Symbolic Condition Monitoring Technique
5
Symbolic Process Modeling
6
Observability Requirements and Costs

• Requirements (P and S)
• Report the occurrence of specified
  events/behaviors in S while meeting specified
  observability properties/demands P
  (e.g., detection, diagnosis)
• Monitor for operational specifications violations
  
• Detect process/operations anomalies
• Cost functional (C)
• Sensor costs and constraints
• Instrumentation preferences

7
Developed technique Verification
8
Developed technique Design Implementation
9
Optimal Symbolic Observation of Physical Processes
10
Flow chart of developed sensor optimization
framework
11
Rigorous condition monitoring frameworkFormal
definitions of various observability properties

• Illustrative example Uniform 1,
  ?-diagnosability
• A prefix-closed language L(G) is said to be
  uniformly 1, ?-diagnosable with respect to a
  mask function M and ?f on S if the following
  holds
• (? i ? ?f )(? ndi ? N )(? s ? L )(? t ? L/s )
• t ? ndi ? D?
• where N is the set of non-negative integers and
  the diagnosability condition D? is
• D? (? w ? M-1M(st) ? L ) Niw ? Nis

12
Rigorous condition monitoring frameworkDevelopme
nt of mathematical algorithms

• Algorithms for verifying various observability
  properties
• Uniform and non-uniform 1, ?-diagnosability/dete
  ctability
• Supervisory observability
• Algorithms for sensor configuration optimization
• Search sensor set space rather than mask function
  space
• Algorithms for online anomaly detection
• Algorithms for addressing unreliable sensors

13
Example 1 Event anomaly monitoring

• Two types of material
• Blue (e.g., LEU material)
• Red (e.g., TRU material)
• Authorized material flows
• for the given monitored area

• Facility assumptions
• One input port I1
• Two output ports O1, O2
• Four internal stations S1, S2, S3, S4

14
Example 1 Event anomaly monitoring

• Monitoring requirements
• The additional two (2) possible material
  movements (iS, i 1, 2) should not be executed
  and must be detected (with no miss detection, no
  false alarm).

15
Developed technique Design Implementation
16
Example 1 Event anomaly monitoring ad hoc vs.
optimized solution
Ad hoc design
Optimized design
17
Example 1 Event anomaly monitoring different
observability requirements
Diagnosability
Detectability
18
Example 1 Event anomaly monitoring different
observability costs
Diagnosability - C no previous-location sensors
AND minimize inside type sensors
Diagnosability - C no previous-location sensors
19
Example 1 Event anomaly monitoring - unreliable
(motion) sensor
C Reliability of motion sensor in S1 gt 60 P
Detection probability gt 90
C Reliability of motion sensor in S1, O1 40 lt
x lt 60 P Detection probability gt 90
20
Example 2 Specification integrity monitoring

• System Components Pump, Tank, Valve 1, Valve
  2, Components Interaction

21
Example 2 Specification integrity monitoring
ModelingSymbolic component model Valve 1
22
Example 2 Specification integrity monitoring
SpecificationsSpecification 1 (S1) Do not
start Pump when Valve 1 is closedSpecifi
cation 2 (S2) Do not close Valve 1 when Pump is
running
23
Developed technique Design Implementation
24
Summary

• A condition monitoring technique has been
  developed for
• Rigorous assessment of intrinsic observability
  properties
• Objective-driven, model-based, systematic design,
  evaluation, and implementation of optimized
  condition monitoring systems that guarantee
  observational requirements constraints
• Information management optimization
• Reduce instrumentation costs
• Decrease operability intrusiveness
• Increase automation and flexibility
• Generated data analysis algorithms (with
  associated sensors) can be incorporated in
  on-line condition monitoring systems to
  automatically integrate and analyze sensor data
• On-line condition monitoring can be used as a
  complementary process-integrity vigilant to
  improve safeguards effectiveness

25
Benefits of Proposed On-line Condition Monitoring
Technique

• Rich design analysis capability
• Amenable to optimization, sensitivity, what-if,
  and vulnerability analyses
• Different monitoring objectives, such as
  detectability, diagnosability, and supervisory
  observability, can be selected and/or combined
• Theoretical framework to guarantee mathematical
  consistency and intended monitoring performance
• Objective-driven, model-based, systematic
  approach to deal with system complexity (e.g.,
  Rokasho plant 13,000 measurements)
• Enhance decision-making by using available
  knowledge and both observed and recorded data
• Enable portability and standardization

26
Future RD

• Current capabilities
• Certainty in observation (e.g., reliable sensors)
• Design goal no miss-detection, no false alarm
• Uncertainty in observation (e.g., unreliable and
  noisy sensors)
• Design goal meet statistical specification
  regarding detection probability (miss-detection)
• Future capabilities
• Consider statistical specification regarding
  false alarm rates
• Add temporal information (e.g., to detect
  temporal anomalies)
• Add process and operations uncertainties
• Further develop and evaluate the on-line
  condition monitoring technique based on the
  symbolic dynamic analysis of process signals