Predicting equipment failure with time series alarm data

Question

I am trying to predict machine failures based on alarm data.

The situation:

There is approximately 4000 machine failures per year. These are labelled poorly (it is entered manually and can have multiple names for the same failure). This dataset consists of the timestamp, failure name and failure description in the following way.

timestamp, name, description
01/01/2020 - 08:10, Motor Failure, Motor failed due to overheating 

Also there is approximately 1 million alarms per year showing possible issues (There are 8000 possible alarms in the system but only ~1200 makeup the 1 million that activate). Alarms fire at the point of failure, but also in a large percentage of cases there are multiple related alarms activating for weeks before hand that are unable to be acted upon due to the shear number. This dataset consists of the timestamp, alarm id, and alarm description like the following.

timestamp, alarm id, description
01/01/2020 - 08:10, MFHeatHiHi, Motor temperature critical

Please excuse my ignorance as I am new to data science. I am trying to work out the best way to clean up/modify the data first and then in which directions to go for creating the prediction. Please let me know if I am going about it the wrong way or have the incorrect idea on where to start.

1. Update the 4000 failures with the same name for same events (I estimate there are approximately 600 discrete failures within this). Or I call them all the same name "failure" and test the alarms against only one variable and use the alarm description to give me the issue that may cause the failure.

2. Break the alarms in to time windows proceeding the failure (possibly 30 days or less). Then use the alarm id - description as columns with the number of occurrences as the value.

For example:

Failure timestamp, MFHeatHiHi - Motor temperature critical, FanHeatHiHi - Fan temperature critical,
01/01/2020 - 08:10,                4,                                        3,

Then I was thinking of using random forest with R.

Is this the right way to go about it, should I be making failure just one variable, is removing the time component of the alarm and transforming to number of alarms the correct way to go about it and would that mean I need 8000 columns for every possible alarm.

I am pretty sure I have the wrong method so would really appreciate some guidance so I am heading in the right direction.

Thanks for your help,

Answer 1

I think what you are describing would be called anomaly detection. I suggest trying a different approach. There are several standard solutions to deal with this topic, here are a few.

Main problems to address are:

1. Setting a good threshold to balance false alarms with missed events. Selecting the model will influence this setting (see below for 2 typical models)

2. Correct Labels/responses: If you have enough examples of alarms that are labelled correctly, you might look at clustering methods to determine the correct labels for un-labelled or mis-labelled examples. This will give you a larger dataset to use for training.

3. Selecting the model:

   Model 1: Manual - Multivariate using the Covariance Matrix
   Alarm settings to decrease false alarms: You can use Euclidean (for spherical distributions), or better yet, Mahalanobis (for ellipsoidal distributions) distance and a n Sigma threshold from the centroid to determine what is the normal reading for the machine and then setting a cutoff for what is normal vs what is an anomaly.

   Model 2: Neural Network - Autoencoder
   Train on normal data (filter out alarm data) and test on new data looking at the probability distribution in the re-construction error in the model output (high MAE), and selecting a threshold based on the output

Online reference (may need account to access):
https://towardsdatascience.com/how-to-use-machine-learning-for-anomaly-detection-and-condition-monitoring-6742f82900d7