A First-Out Alarm Detection Method via Association Rule Mining and Correlation Analysis

2.1. Preliminaries of Industrial Alarm System

2.2. Introduction of Industrial Alarm Data

2.3. First-Out Alarm Detection Problem

3.1. Alarm Association Rule Mining Based on FP-Growth and J-Measure

3.2. Determination of First-Out Alarm and Subsequent Alarms

3.3. Screening and Consolidation of First-Out Rules

(1)

Scenario 1: Different alarms $a_x$ and $a_y$ are the first-out alarms of the same alarm set ${S(a}_x)$, i.e.,

$$a_x\Rightarrow {S(a}_x),a_y\Rightarrow {S(a}_x)$$

(11)

(2)

Scenario 2: The first-out alarm $a_y$ is a subsequent alarm of another first-out alarm $a_x$, i.e.,

$$a_x\Rightarrow {S(a}_x),a_y\Rightarrow {S(a}_y),a_y\in {S(a}_x)$$

(12)

(3)

Scenario 3: Alarm $a_x$ is the first alarm of different alarm sets ${S(a}_x)$ and ${S^{\prime }(a}_y)$, but there exists an intersection of alarm sets ${S(a}_x)$ and ${S^{\prime }(a}_x)$, i.e.,

$$a_x\Rightarrow {S(a}_x),a_x\Rightarrow {S^{\prime }(a}_x),{S(a}_x)\cap {S^{\prime }(a}_x)\ne \varnothing$$

(13)

(1)

In Scenario 1, it is known that $a_x\Rightarrow {S(a}_x)$, $a_y\Rightarrow {S(a}_y)$, $a_x\notin {S(a}_y)$, $a_y\notin {S(a}_x)$, ${S(a}_x)={S(a}_y)$. Thus, for $a_z\in {S(a}_x)$, $p(a_x/a_y)\ne 1,$ $p(a_y/a_x)\ne 1,$ $p(a_z/a_y)=1,$ and $p(a_z/a_x)=1$. If $a_x\Rightarrow a_z$ implies $a_y\Rightarrow a_z$ and $a_y\Rightarrow a_z$ implies $a_x\Rightarrow a_z$, then $a_y\Rightarrow a_z$ and $a_x\Rightarrow a_z$ are redundant, and only one rule should be retained. Otherwise, $a_y\Rightarrow a_z$ and $a_x\Rightarrow a_z$ are distinct rules, and should both be preserved. In this scenario, it should be checked whether $a_x$ and $a_y$ are redundant or not, which can be achieved through hypothesis test on $p(a_x,a_y)=p(a_x)$.

(2)

In Scenario 2, it is known that $a_x\Rightarrow {S(a}_x)$, $a_y\Rightarrow {S(a}_y),a_y\in {S(a}_x)$. Then, ${S(a}_x)$ can be extended to ${\tilde{S}(a}_x)={S(a}_x)\cup {S(a}_y)$, and thus we can obtain $a_x\Rightarrow {\tilde{S}(a}_x)$, and it needs to be determined whether to retain $a_y\Rightarrow {S(a}_y)$. If $a_y$ always occurs after $a_x$, then one of the rules is duplicated and $a_y\Rightarrow {S(a}_y)$ should be deleted. Otherwise, $a_y\Rightarrow {S(a}_y)$ should be retained. In this scenario, it should be checked whether $a_x$ and $a_y$ hold a strong causal relation; as $a_y$ must follow $a_x$ as reflected by $a_x\Rightarrow {S(a}_x)$, $a_y\in {S(a}_x)$, it is still necessary to check whether $a_x$ and $a_y$ are redundant.

(3)

In Scenario 3, it is known that $a_x\Rightarrow {S(a}_x)$, $a_x\Rightarrow {S^{\prime }(a}_x)$, ${S(a}_x)\cap {S^{\prime }(a}_x)\ne \mathrm{\varnothing }$. Let ${{\tilde{S}(a}_x)=S(a}_x)\cup {S^{\prime }(a}_x)$; then it needs to be determined whether $a_x\Rightarrow {\tilde{S}(a}_x)$ is valid. If $a_x\Rightarrow {S(a}_x)$ occurs and also $a_x\Rightarrow {S^{\prime }(a}_x)$ occurs, then the two first-out rules can be combined, i.e., $a_x\Rightarrow {\tilde{S}(a}_x)$. Otherwise, both $a_x\Rightarrow {S(a}_x)$ and $a_x\Rightarrow {S(a}_y)$ should be preserved. In this scenario, it should be checked whether all alarms in ${S(a}_x)\cup {S^{\prime }(a}_x)$ always appear together in historical sequences.

3.4. Discussions

(1)

The exploited data types are different. The data for alarm correlation analysis are binary alarm time series over a certain consecutive period. Regarding first-out alarm detection, the required data are essentially a collection of alarm sequences.

(2)

The objectives are different. The proposed method aims at identifying first-out alarms and exporting first-out rules, whereas existing alarm correlation analysis methods measure and export the correlations between alarms.

(3)

The principles are different. The detection of first-out alarms usually involves multiple alarms and requires alarm order information, while existing alarm correlation analysis methods only explore the correlation between two alarms and do not consider orders between alarm occurrences.

(1)

Time stamps of alarm events are key information. Inaccurate or inconsistent time stamps can lead to misinterpretations of the temporal order of alarms.

(2)

Noisy or incomplete historical data may hinder the ability to accurately assess and validate the first-out alarm detection method.

(3)

Transitioning the method from a testing environment to a real-time implementation may pose scalability challenges.

(1)

The data retrieval process can be optimized by using a database indexing system and leveraging efficient data structures such as hash tables or tree structures, to expedite the search for the earliest occurrences of each alarm.

(2)

Data pruning or filtering can be applied first to preprocess the alarm data and eliminate redundant information; thus the computational burden in the subsequent analysis can be reduced.

(3)

The detection task can be portioned into sub-tasks based on the units or groups that alarms belong to, and thus the proposed method can work efficiently for each sub-task.

4.1. Experiment Preparation

(1)

The method in Section 3.1 was applied to extract alarm association rules. The minimum support degree and the minimum confidence level were set to 0.95 and 0.99, respectively. Initially, a total of 673,588 frequent patterns could be obtained. By keeping only closed alarm patterns and then identifying interesting association rules, 3104 rules were reserved from the historical alarm sequences.

(2)

The method in Section 3.2 was exploited to determine first-out rules. In the hypothesis test, the significance level was set to 0.05, and the corresponding ${\chi }^2$ threshold η was 3.84. The satisfaction rate threshold ${\eta }_2$ was set as 0.9. As a result, 1746 first-out rules were identified based on the interesting alarm association rules.

(3)

The method in Section 3.3 was utilized to screen and consolidate first-out rules, so as to reduce the redundancy in the results. Eventually, 204 consolidated first-out rules were received.

4.2. Scenario 1

4.3. Scenario 2

4.4. Scenario 3