Redundant Alarms Research Articles

A First-Out Alarm Detection Method via Association Rule Mining and Correlation Analysis.

Alarm systems are commonly deployed in complex industries to monitor the operation status of the production process in real time. Actual alarm systems generally have alarm overloading problems. One of the major factors leading to excessive alarms is the presence of many correlated or redundant alarms. Analyzing alarm correlations will not only be beneficial to the detection of and reduction in redundant alarm configurations, but also help to track the propagation of abnormalities among alarm variables. As a special problem in correlated alarm detection, the research on first-out alarm detection is very scarce. A first-out alarm is known as the first alarm that occurs in a series of alarms. Detection of first-out alarms aims at identifying the first alarm occurrence from a large number of alarms, thus ignoring the subsequent correlated alarms to effectively reduce the number of alarms and prevent alarm overloading. Accordingly, this paper proposes a new first-out alarm detection method based on association rule mining and correlation analysis. The contributions lie in the following aspects: (1) An association rule mining approach is presented to extract alarm association rules from historical sequences based on the FP-Growth algorithm and J-Measure; (2) a first-out alarm determination strategy is proposed to determine the first-out alarms and subsequent alarms through correlation analysis in the form of a hypothesis test on conditional probability; and (3) first-out rule screening criteria are proposed to judge whether the rules are redundant or not and then consolidated results of first-out rules are obtained. The effectiveness of the proposed method is tested based on the alarm data generated by a public simulation platform.

Based on Zabbix-Prometheus Group Classification Alarm System

The efficient operation of the system is the foundation for improving business level in the rapid development of information technology. Based on the data integration of the Zabbix-Prometheus system, it achieves information data storage, data collection, grouping and classification linkage alarm functions. The Zabbix-Prometheus grouping and classification alarm integration system can effectively solve the problems of a large amount of redundant alarm information, no priority of alarm information, and inability to silence. It has established a multi-platform integrated alarm service system. It has implemented linkage alarm functions such as email, SMS, and WeChat.

Reliability Analysis of a Three-Engine Simultaneous Pouring Control System Based on Bayesian Networks Combined with FMEA and FTA

Pouring is an important process in the production of solid propellant rocket engines, and usually, the cost of a solid propellant rocket engine is extremely high. Therefore, pouring production with high reliability is very important. The pouring of three engines of solid propellant rocket engines simultaneously can greatly improve its production efficiency. However, it makes the system more complex and redundant. For a multi-state system, it is difficult to make an accurate evaluation of system reliability. Aiming at the redundancy of multiple engines and acousto-optic combined control in the three-engine simultaneously slurry pouring alarm control system with dissimilar redundant alarm units, a reliability analysis method is proposed based on the combination of Failure Mode Effect Analysis (FMEA) and Fault Tree Analysis (FTA). The control system is divided into several redundant states according to the alarm function, and then the Bayesian Networks method is used for reliability evaluation and calculation. Finally, the reliabilities of systems with dissimilar redundancy degrees are obtained. The tangible results of this research work are as follows: (1) The research results obtained by applying the FMEA method laid a foundation for the establishment of a fault trees model for analyzing the reliability of the control system using the FTA method, in addition, which can guide the maintenance and fault identification of the control system during engineering application. (2) The calculated value of the reliability of the control system is 0.999989, and the mean time between failures is MTBF is 5 × 104 by using the fault tree analysis method, which proves that the designed three-engine simultaneous pouring system is very reliable. (3) Based on the calculation and comparison of the Bayesian Networks of redundant three-engine pouring control systems, the circuit diagram of the improved control system is identified.

Clustering Analysis of Wind Turbine Alarm Sequences Based on Domain Knowledge-Fused Word2vec

The alarm data contain abundant fault information related to almost all components of the wind turbine. Reasonable analysis and utilization of alarm data can assist wind farm maintenance personnel in quickly identifying the types of turbine faults, reducing operation and maintenance costs. This paper proposes a clustering analysis method that groups similar alarm sequences with the same fault type. Firstly, the alarm data are preprocessed, where alarm sequences are segmented, and redundant alarms are removed. Then, a domain knowledge-fused Word2vec (DK-Wrod2vec) method is introduced to transform non-numeric alarm codes into numeric vector representations. Finally, new distance metrics are incorporated into the K-means clustering algorithm to improve clustering performance. The performance of the proposed clustering method is assessed by applying it to labeled alarm sequences. The results demonstrate that the clustering performance is the best when using DK-Word2vec and the word rotator’s distance compared with other methods. Additionally, with the optimal parameter combination, the fault types of unlabeled alarm sequences are also analyzed.

Alarm reduction and root cause inference based on association mining in communication network

With the growing demand for data computation and communication, the size and complexity of communication networks have grown significantly. However, due to hardware and software problems, in a large-scale communication network (e.g., telecommunication network), the daily alarm events are massive, e.g., millions of alarms occur in a serious failure, which contains crucial information such as the time, content, and device of exceptions. With the expansion of the communication network, the number of components and their interactions become more complex, leading to numerous alarm events and complex alarm propagation. Moreover, these alarm events are redundant and consume much effort to resolve. To reduce alarms and pinpoint root causes from them, we propose a data-driven and unsupervised alarm analysis framework, which can effectively compress massive alarm events and improve the efficiency of root cause localization. In our framework, an offline learning procedure obtains results of association reduction based on a period of historical alarms. Then, an online analysis procedure matches and compresses real-time alarms and generates root cause groups. The evaluation is based on real communication network alarms from telecom operators, and the results show that our method can associate and reduce communication network alarms with an accuracy of more than 91%, reducing more than 62% of redundant alarms. In addition, we validate it on fault data coming from a microservices system, and it achieves an accuracy of 95% in root cause location. Compared with existing methods, the proposed method is more suitable for operation and maintenance analysis in communication networks.

Power Grid Fault Diagnosis Method Based on Inception Network

With the continuous evolution of grid intelligence, the traditional grid fault diagnosis model can not satisfied the development needs of smart grid in terms of accuracy and diagnosis speed, and how to apply the fault information provided by the supervisory control and data acquisition (SCADA) system to achieve fast and accurate grid fault diagnosis is the main problem at present. In this paper, we propose an Inception network-based fault diagnosis method, in which the alarm information of different fault types is filtered and transformed into a grayscale map as model input to avoid the interference of redundant alarm information to the fault diagnosis, and the Inception network with excellent image feature extraction capability is employed to obtain the grayscale map of the alarm information to achieve fast fault diagnosis. This method has been proven to have excellent fault-type discriminatory capability and is effective in achieving fast and accurate fault diagnosis based on deep learning algorithms.

Research on Alarm Reduction of Intrusion Detection System Based on Clustering and Whale Optimization Algorithm

With the frequent occurrence of network security events, the intrusion detection system will generate alarm and log records when monitoring the network environment in which a large number of log and alarm records are redundant, which brings great burden to the server storage and security personnel. How to reduce the redundant alarm records in network intrusion detection has always been the focus of researchers. In this paper, we propose a method using the whale optimization algorithm to deal with massive redundant alarms. Based on the alarm hierarchical clustering, we integrate the whale optimization algorithm into the process of generating alarm hierarchical clustering and optimizing the cluster center and put forward two versions of local hierarchical clustering and global hierarchical clustering, respectively. To verify the feasibility of the algorithm, we conducted experiments on the UNSW-NB15 data set; compared with the previous alarm clustering algorithms, the alarm clustering algorithm based on the whale optimization algorithm can generate higher quality clustering in a shorter time. The results show that the proposed algorithm can effectively reduce redundant alarms and reduce the load of IDS and staff.

Perceptually Discriminating the Highest Priority Alarms Reduces Response Time: A Retrospective Pre-Post Study at Four Hospitals.

Reduce nurse response time for emergency and high-priority alarms by increasing discriminability between emergency and all other alarms and suppressing redundant and likely false high-priority alarms in a secondary alarm notification system (SANS). Emergency alarms are the most urgent, requiring immediate action to address a dangerous situation. They are clinician-triggered and have higher positive predictive value (PPV). High-priority alarms are automatically triggered and have lower PPV. We performed a retrospective pre-post study, analyzing data 15 months before and 25 months after a SANS redesign was implemented in four hospitals. For emergency alarms, we incorporated digitized human speech to distinguish them from automatically triggered alarms, leaving their onset and escalation pathways unchanged. For automatically triggered alarms, we suppressed some by delaying initial onset and escalation by 20 s. We used linear mixed models to assess the change in response time, Fisher's exact test for the proportion of response times longer than 120 s, and control charts for process stability. Response time for emergency alarms decreased at all hospitals (main, from 26.91 s to 22.32 s, p < .001; cardiac, from 127.10 s to 52.43 s, p < .001; cancer, from 18.03 s to 15.39 s, p < .001). Improvements were sustained. Automatically triggered alarms decreased 25.0%. Response time for the three automatically triggered cardiac alarms increased at the four hospitals. Auditory sound disambiguation was associated with a sustained reduced nurse response time for emergency alarms, but suppressing some high-priority automatically triggered alarms was not. Distinguishing and escalating urgent, actionable alarms with higher PPV improves response time.

Improving Operational Efficiency Through Alarm Management in Water Treatment Processes Using Artificial Intelligence

Water Treatment Plants are controlled by modern industrial process control systems like SCADA or DCS. This facilitates to monitor, control, and troubleshoot water treatment processes and helps in maintaining continuous supply of water with adequate quality. At times and in contrary, these systems hamper process control by generating far too many alarms than needed. Many of the alarms are nuisance in nature and do not indicate any real abnormality. The true alarms which require prompt operator actions to normalize the process are often buried in the pool of nuisance alarms causing significant challenge for operator to take appropriate corrective actions in a timely manner. Many of the past major incidents occurring in the major process industries were attributed to operators’ inability to identify true alarms and take necessary actions. In this paper, we propose an Artificial Intelligence (AI) based pattern mining and advisory system to improve operational efficiency in alarm management. The identified alarm patterns bring out actionable insights in data by (i) identifying nuisance, chattering, redundant alarms, and (ii) Alarm response Pattern. A novel technique for sequential pattern mining in industrial Alarm & Event log data was developed based on State-of-the-art AI based association rule and pattern mining. The efficacy of the proposed method for systematically improving alarm management system in an actual plant environment is currently being studied in a water treatment plant in Singapore.

Aiding Alarm Rationalization by Automatic Identification of various sequential patterns in large volume of Alarm and Event log data

The main problem with modern Industrial Alarm System is that the operators receive far too many alarms than they can handle. Many of the alarms presented to the operators are nuisance in nature such as chattering alarms, redundant alarms, consequential alarms, and alarms with no action. Such alarms superfluously increase the alarm load to an operator, do not essentially indicate any real abnormal situation and more importantly do not require any corrective actions by the operator. Being overwhelmed by large number of nuisance alarms, operators always face tough challenge in identifying the real alarms which demands prompt operator actions and are often buried in the pool of nuisance alarms. It is therefore necessary to reduce the alarms loads of an operator by systematically identifying the nuisance alarms and presenting only the real useful alarms to the operators. Also, there are some alarms which require well defined operator actions to bring them back to normal. When these alarms get triggered operators are supposed to take a well-defined set of corrective action in order to normalize them. Identification of these alarms for which there is a consistent operator action would be of immense help since operators can immediately focus their attention on these alarms whenever they occur and carryout the necessary actions. The main goal of Alarm rationalization is to minimize alarm load to the operators by presenting only the alarms that are relevant and require operator actions. Alarm Rationalization process by and large is carried out manually. It is quite tedious, time consuming and requires a lot of manual efforts. To solve the these challenges and to aid in Alarm Rationalization process, a novel approach has been proposed in this paper for identifying the nuisance alarms by analyzing the large volume of Alarm and Event log data. Several Alarm Rationalization activities (such as: Changing Alarm Configuration settings, Alarm Suppression, Alarm grouping, Alarm removal, Alarm Prediction, Standardization of Alarm response Procedure) can be performed by based on the identified chattering alarms. The proposed approach is illustrated through some examples obtained by analysing the Alarm and Event log data from petrochemical and water treatment plants in Singapore.

Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis.

Anomaly detection systems can accurately identify malicious network traffic, providing network security. With the development of internet technology, network attacks are becoming more and more sourced and complicated, making it difficult for traditional anomaly detection systems to effectively analyze and identify abnormal traffic. At present, deep neural network (DNN) technology achieved great results in terms of anomaly detection, and it can achieve automatic detection. However, there still exists misclassified traffic in the prediction results of deep neural networks, resulting in redundant alarm information. This paper designs a two-level anomaly detection system based on deep neural network and association analysis. We made a comprehensive evaluation of experiments using DNNs and other neural networks based on publicly available datasets. Through the experiments, we chose DNN-4 as an important part of our system, which has high precision and accuracy in identifying malicious traffic. The Apriori algorithm can mine rules between various discretized features and normal labels, which can be used to filter the classified traffic and reduce the false positive rate. Finally, we designed an intrusion detection system based on DNN-4 and association rules. We conducted experiments on the public training set NSL-KDD, which is considered as a modified dataset for the KDDCup 1999. The results show that our detection system has great precision in malicious traffic detection, and it achieves the effect of reducing the number of false alarms.

Data-Driven Event Diagnosis in Transmission Systems With Incomplete and Conflicting Alarms Given Sensor Malfunctions

Accurate fault event diagnosis with incomplete and conflicting alarms given sensor malfunctions is a challenging problem for power system operators. To solve this problem, this study proposes a data-driven approach based on Mixed Integer Linear Programming (MILP) for fast determination of fault event scenarios with uncertainties. The uncertainties include failures and malfunction of relays and circuit breakers (CBs) as well as incomplete/incorrect sensor alarms at the control center. To improve the accuracy for fault event diagnosis, redundant alarms from multiple sources, i.e., Phasor Measurement Units (PMUs), Supervisory Control and Data Acquisition (SCADA), and Sequence of Events Recorders (SERs) are jointly used in this study. The temporal correlation of sensor alarms is incorporated in the constraints of the MILP model. The resulting data-driven algorithm determines the most credible fault scenario that is well supported by the available sensor alarms at the control center. Simulation results of the IEEE 14-bus system, the synthetic South Carolina 500-bus system, and a real-world complex event scenario demonstrate the effectiveness of the proposed approach for accurate and efficient fault event diagnosis.

Clustering analysis of process alarms using word embedding

Industrial alarm systems have evolved significantly over the recent years both in terms of the number of observed alarms and the complexity of their presentation and management, seriously challenging the decision making abilities of the operators. These management challenges often arise from the presence of poorly configured alarms, as well as many nuisance and even flooding alarms. This necessitates better presentation tools to help operators understand the relations among various alarm events so that they can make more informed decisions. Instead of transforming process data into a binary alarm sequence for analysis, as often done in the literature, this paper proposes an alarm clustering method that takes advantage of the information contained in the alarm logs themselves. Using a word embedding technique, a novel clustering scheme and a multi-dimensional scaling method, the new method facilitates the grouping of correlated alarms. Such an approach is expected to further provide insight towards the removal of redundant alarms, and offer a sound basis for a subsequent causality analysis and identification of the alarm root cause. To demonstrate its merits, the proposed method is applied to the alarm events observed in a central heating and cooling plant located at a university campus.

Reducing Redundant Alarms in the Pediatric ICU

Physiologic monitors generate alarms to alert clinicians to signs of instability. However, these monitors also create alarm fatigue that places patients at risk. Redundant alarms have contributed to alarm fatigue without improving patient safety. In this study, our specific aim was to decrease the median percentage of redundant alarms by 50% within 6 months using the Model for Improvement. Our primary outcome was to lower the percentage of redundant alarms. We used the overall alarm rate per patient per day and code blue events as balancing metrics. We completed three Plan-Do-Study-Act cycles and generated run charts using standard industry criteria to determine the special cause. Ultimately, we decreased redundant alarms from a baseline of 6.4% of all alarms to 1.8%, surpassing our aim of a 50% reduction. Our overall alarm rate, one of our balancing metrics, decreased from 137 alarms/patient day to 118 alarms/patient day during the intervention period. No code blue events were determined to be related to incorrect setting of alarms. Decreasing redundant alarms is safe and feasible. Following a reduction in redundant alarms, more intensive alarm reduction methods are needed to continue to reduce alarm fatigue while keeping patients safe.

Research on EMS Alarm Analysis and Secondary Equipment Status Evaluation

The intellectualization level and information level of the secondary equipment in the intelligent substation have been greatly improved, which is of great significance for the normal operation of the power system. However, the secondary equipment will generate a lot of redundant alarms information in the EMS system. These alarms are not conducive to finding equipment faults, and there is a lack of an active maintenance method for secondary equipment. In this paper, an intelligent analysis method of EMS alarm information is proposed. This method can find fault alarm information accurately, and we used the actual data of intelligent substation to verify it. A status evaluation method for the secondary equipment is also proposed. The method can be used for early warning of equipment failure and efficient operation and maintenance.

Network threat detection based on correlation analysis of multi-platform multi-source alert data

It is difficult for security administrators to detect attacks well when they are faced with large amounts of multi-platform multi-source alert data. However, most attack events are not isolated and has a certain number of steps. With the help of alert correlation, attacks can be revealed well. In our paper, we propose a PMASP (Purpose-oriented Maximum Attack Sequence Patterns) algorithm for threat detection based on alert correlation. Firstly, we format alarm records and reduce redundant alarms. Then, with the help of attack classification, we generate initial attack sequences through clustering. Later, PMASP is employed to dig out frequent sequences set. Finally, we use xml language to construct rules for detection. These rules represent some attack patterns which are helpful for security administrators. We simulate several attacks and use some rules to detect. The detection rate shows that the rule is reasonable and effectively.

An Analytic Model for Fault Diagnosis in Power Systems Utilizing Redundancy and Temporal Information of Alarm Messages

In modern transmission systems, duplicated protections are widely employed to enhance reliability, and global positioning system (GPS) substation clocks are set up to deliver a higher degree of synchronization. Thus, redundant alarms tagged with synchronized timestamps would be received during a fault. Both redundancy and timestamps of alarms consist of rich and useful information. Given this background, an effort is made to develop a novel analytic model for power system fault diagnosis so as to well utilize redundancy and temporal information of alarms. An alarm preprocessing procedure is proposed to preserve such properties without impairing diagnosis accuracy and efficiency. A new fault hypothesis is established to systematically take account of malfunctions of protective devices, missing and distorted alarm messages, and timestamp errors in the proposed model. An objective function is developed for fault diagnosis, and could accommodate various protection schemes and bus configurations. Based on the presented fault diagnosis method, a software package is developed. Several fault scenarios occurred in an actual power system in China are served for demonstrating the correctness and efficiency of the developed software package.

Association rules mining based analysis of consequential alarm sequences in chemical processes

In the context of industrial alarm rationalization, the analysis of consequential alarms is helpful for finding out root alarms so as to avoid alarm flooding. Motivated by this idea, this paper introduces a weighted fuzzy association rules mining approach to discovering correlated alarm sequences. Combining fuzzy sets, Apriori algorithms and alarm time series analysis, the algorithm does not search the entire item sets to find out root causes of consequential alarms. Furthermore, by transforming the association rules into fuzzy-driven causal knowledge bases and establishing the compatible fuzzy inference mechanism, a rationalized alarm topology is eventually created. Experimental results of a chemical plant show that the novel approach taking advantage of fuzzy inferences and data mining strategies is potentially effective to remove redundant alarm sequences.

A two-level intelligent alarm management framework for process safety

Alarm management, which alerts process operators to deviations of variables from designed limits, has been a key safety issue in a petrochemical plant. Petrochemical processes frequently operate upon a multitude of steady states, transitions and states in abnormal events. Some single-fault scenarios producing similar symptoms usually cause false alarms, while fault propagation scenarios produce alarm floods which will overwhelm critical alarms. A two-level intelligent alarm management framework (IAMF) is proposed considering fault interdependence in plant operation, including alarm filtering first and root-cause diagnosis second. The two-level IAMF with different strategies are applicable to various hazard scenarios involving multi-fault with similar symptoms and propagation scenarios. Two cases are studied applying the IAMF to FCCU, in which the root causes of alarm floods can be identified. Redundant alarms, false alarms and alarm failures cut down effectively, thus ensuring the safety of the petrochemical process and reducing economic losses caused by improper alarms.

Comprehensive alarm information processing technology with application in petrochemical plant

During the abnormal plant conditions, too much information is produced due to momentary plant excursions above alarm limits. This flood of information impedes correct interpretation and correction of plant conditions by the operator. Existing techniques for the design of alarm systems mostly have weak ability to handle complex hazard scenarios and increase the probability of larger safety issues. In this paper, a comprehensive alarm information processing (AIP) technology is introduced, called multi-round alarm management system (MRAMS), including several processing strategies: AIP based on single sensor, AIP based on sensor group, root cause diagnosis based on Bayesian network, sensor fault judgment method and false alarm inhibition method. In case studies, both simulation experiment and pilot application on a real petrochemical plant are presented. Results indicate the MRAMS is helpful in improving the accuracy of correctly diagnosing the root causes and hence avoiding false and redundant alarms. By adopting this new technology, the safe and reliable operation of the plant can be achieved, and the economic loss brought by improper alarms can be reduced.