Building security system with user presentation for false alarm reduction

A system for determining and presenting false alarm reduction includes a processing circuit configured to determine addressable false alarms by determining, based on events of building devices of a building and event sequences of one or more false alarm rules, whether the one or more false alarm rules are triggered, where the one or more false alarm rules each include one of the event sequences indicating relationships between the events that are indicative of a situation at the building that causes an addressable false alarm. The processing circuit is configured to generate a plurality of recommendations based the triggered false alarm rules, wherein the recommendations prompt the user to rectify situations at the building that cause the addressable false alarms, generate a user interface comprising an indication of the addressable false alarms and the plurality of recommendations, and cause a display of a user device to display the user interface.

BACKGROUND

The present disclosure relates generally to building security systems of a building. The present disclosure relates more particularly to systems and methods for analyzing data generated by the building security systems to reduce false alarms of the building.

In a building, various building devices provide security monitoring and fire detection and response. A false alarm can be a serious problem for security or fire system. In some cases, the majority of the alarms (e.g., approximately 98%) generated by security or fire systems are false alarms. Responding to false alarms creates a heavy financial burden on customers, police departments, fire departments, and alarm system providers.

False alarms can, in some cases, be attributed to three preventable causes, user error, faulty equipment, and improper equipment installation. Examples of user error may be a user entering an incorrect keypad code into an alarm system, a user leaving a door or window open, or a user leaving objects near motion detectors. In some cases, the equipment itself is faulty. For example, the equipment may be reaching an end of life state and equipment parts may be wearing out or breaking. Regarding improper installation, motion detectors may not be installed in proper areas or placed at the proper heights.

SUMMARY

One implementation of the present disclosure is a system for generating a false alarm rule for preventing a false alarm that occurs at a building. The system includes a communications interface configured to receive building data from a plurality of building devices associated with the building, the building data including events and a processing circuit. The processing circuit is configured to receive, via the communications interface, the building data including the events of the building devices, where the events include a first non-alarm event, a second non-alarm event different than the first non-alarm event, and a false alarm event, generate an event sequence based on the events, where the event sequence includes the first non-alarm event and the second non-alarm event and indicates a relationship between the first non-alarm event and the second non-alarm event that is indicative of a situation at the building that causes the false alarm event to occur, and generate the false alarm rule based on the event sequence, wherein the false alarm rule includes a recommendation for preventing the false alarm event from occurring.

In some embodiments, the processing circuit is configured to provide, via the communications interface, the event sequence to a domain expert device of a domain expert and receive the recommendation for the event sequence from the domain expert via the domain expert device. In some embodiments, the processing circuit is configured to generate the false alarm rule based on the event sequence and further based on the recommendation received from the domain expert.

In some embodiments, the processing circuit is configured to select, via a classifier, the recommendation for the false alarm rule by selecting, based on the event sequence, the recommendation from a plurality of recommendations associated with a plurality of possible classifications of the classifier. In some embodiments, the processing circuit is configured to generate the false alarm rule based on the event sequence and further based on the recommendation selected via the classifier.

In some embodiments, the processing circuit is configured to receive, via the communications interface, second events from the building devices, determine, based on the second events, whether the false alarm rule is triggered, and provide the recommendation of the false alarm rule to a user via a user interface in response to determining that the false alarm rule is triggered.

In some embodiments, the processing circuit is configured to determine whether the false alarm rule is triggered by selecting, via a classifier, the false alarm rule from a plurality of false alarm rules based on the second events.

In some embodiments, the processing circuit is configured to generate the event sequence by performing a parameter search to group the events based on one or more characteristics of the events performing a sequence analysis on the grouped events to generate the event sequence.

In some embodiments, performing the sequence analysis includes performing at least one of a first order Markov chain analysis on the grouped events, a second Markov chain analysis on the grouped events, or a General Sequential Pattern (GSP) mining analysis on the grouped events.

In some embodiments, performing the parameter search to group the events includes at least one of searching the events based on a time window by identifying events that are associated with a time that is within the time window or performing the parameter search to group the events by searching the events based on a spatial distance window by identifying events that are associated with a location that is within the spatial distance window. In some embodiments, performing the parameter search based on the spatial distance window groups events that occur in a predefined area.

In some embodiments, the processing circuit is configured to receive first building data including first events associated with a first period of time, determine a number of times that the false alarm rule triggered during the first period of time based on the first building data, predict a number of times that the alarm rule will trigger in the future during a second period of time after the first period of time based on the number of times that the false alarm rule triggered during the first period of time, and generate an insight based on the predicted number of times the alarm rule will trigger in the future during the second period of time and provide the insight to a user via a user device.

In some embodiments, the processing circuit is configured to predict the number of times that the alarm rule will trigger in the future by performing a Bayesian analysis on the first building data associated with the first period of time.

Another implementation of the present disclosure is a method for generating a false alarm rule for preventing a false alarm that occurs at a building by one or more processing circuits. The method includes receiving, by the processing circuits, building data for building devices of the building, where the building data includes events of the building devices, wherein the events include a first non-alarm event, a second non-alarm event different than the first non-alarm event, and a false alarm event. The method includes generating, by the processing circuits, an event sequence based on the events, where the event sequence includes the first non-alarm event and the second non-alarm event and indicates a relationship between the first non-alarm event and the second non-alarm event that is indicative of a situation at the building that causes the false alarm event to occur. Furthermore, the method includes generating, by the processing circuits, the false alarm rule based on the event sequence, where the false alarm rule includes a recommendation for preventing the false alarm event from occurring.

In some embodiments, the method includes providing, by the one or more processing circuits, the event sequence to a domain expert device of a domain expert and receiving, by the one or more processing circuits, the recommendation for the event sequence from the domain expert via the domain expert device. In some embodiments, generating, by the processing circuits, the false alarm rule based on the event sequence includes generating the false alarm rule further based on the recommendation received from the domain expert.

In some embodiments, the method further includes selecting, by the one or more processing circuits via a classifier, the recommendation for the false alarm rule by selecting, based on the event sequence, the recommendation from a plurality of recommendations associated with a plurality of possible classifications of the classifier. In some embodiments, generating, by the processing circuits, the false alarm rule based on the event sequence includes generating the false alarm rule further based on the recommendation selected via the classifier.

In some embodiments, the method includes receiving, by the processing circuits, second events from the building devices, determining, by the processing circuits, whether the false alarm rule is triggered based on the second events, and providing, by the processing circuits, the recommendation of the false alarm rule to a user via a user interface in response to determining, by the one or more processing circuits, that the false alarm rule is triggered.

In some embodiments, determining, by the processing circuits, whether the false alarm rule is triggered includes selecting, via a classifier, the false alarm rule from a plurality of false alarm rules based on the second events.

In some embodiments, generating, by the processing circuits the event sequence includes performing a parameter search to group the events based on one or more characteristics of the events and performing a sequence analysis on the grouped events to generate the event sequence.

In some embodiments, performing the sequence analysis includes performing at least one of a first order Markov chain analysis on the grouped events, a second Markov chain analysis on the grouped events, or a General Sequential Pattern (GSP) mining analysis on the grouped events.

In some embodiments, performing the parameter search to group the events includes searching the events based on a time window by identifying events that are associated with a time that is within the time window or performing the parameter search to group the events by searching the events based on a spatial distance window by identifying events that are associated with a location that is within the spatial distance window, where performing the parameter search based on the spatial distance window groups events that occur in a predefined area.

Another implementation of the present disclosure is a non-transitory computer readable medium having machine instructions stored therein, the instructions being executable by a processor of a building management system to perform operations including receiving building data for building devices of the building, where the building data includes events of the building devices, where the events include a first non-alarm event, a second non-alarm event different than the first non-alarm event, and a false alarm event, generating an event sequence based on the events, where the event sequence includes the first non-alarm event and the second non-alarm event and indicates a relationship between the first non-alarm event and the second non-alarm event that is indicative of a situation at the building that causes the false alarm event to occur, generating the false alarm rule based on the event sequence, where the false alarm rule includes a recommendation for preventing the false alarm event from occurring, receiving second events from the building devices, determining whether the false alarm rule is triggered based on the second events, and providing the recommendation of the false alarm rule to a user via a user interface in response to determining that the false alarm rule is triggered.

In some embodiments, generating the event sequence includes performing a parameter search to group the events based on characteristics of the events, where performing the parameter search to group the events by searching the events based on a time window by identifying events that are associated with a time that is within the time window or performing the parameter search to group the events by searching the events based on a spatial distance window by identifying events that are associated with a location that is within the spatial distance window, wherein performing the parameter search based on the spatial distance window groups events that occur in a predefined area. In some embodiments, generating the event sequence includes performing a sequence analysis on the grouped events to generate the event sequence wherein performing the sequence analysis includes performing at least one of a first order Markov chain analysis on the grouped events, a second Markov chain analysis on the grouped events, or a General Sequential Pattern (GSP) mining analysis on the grouped events.

Recommendations and Self-Healing

One implementation of the present disclosure is a system for preventing a false alarm that occurs at a building. The system includes a communications interface configured to receive building data from building devices associated with the building, wherein the building data including events and a processing circuit configured to receive, via the communications interface, the building data including the events for the building devices. The processing circuit is configured to determine, based on the events, whether a false alarm rule has triggered, where the false alarm rule indicates relationships between one or more of the events that is indicative of a situation at the building site that causes the false alarm. The processing circuit is configured to generate a parameter update for at least one of the plurality of building devices in response to determining that the false alarm rule has triggered and implement the parameter update by providing, via the communications interface, the parameter update to the at least one of the building devices.

In some embodiments, the false alarm rule is associated with a recommendation for preventing the false alarm from occurring. In some embodiments, the processing circuit is configured to provide the recommendation to a user via a user device in response to determining that the false alarm rule has triggered.

In some embodiments, the building devices include a battery powered device powered by a battery and a main power source, where the false alarm rule is a battery replacement false alarm rule. In some embodiments, the processing circuit is configured to determine, based on the events, whether the battery replacement false alarm rule has triggered for the battery powered device. In some embodiments, the processing circuit is configured to generate, based on historical battery powered device data, a probability distribution identifying a probability for a time length between a main power failure event and a low battery event in response to the battery replacement false alarm rule triggering for the battery powered device, where the battery replacement data indicates a plurality of times between the main power failure event and the low battery event. In some embodiments, the processing circuit is configured to generate the replacement time window based on the probability distribution and cause the recommendation to include an indication of the replacement time window.

In some embodiments, the false alarm rule is a door delay false alarm rule including a sequence of events including a door opening event followed by an alarm event followed by a key code entering event. In some embodiments, the processing circuit is configured to determine whether the door delay false alarm rule has triggered based on the events and the sequence of events of the door delay false alarm rule, generate a probability distribution based on historical door delay data, wherein the probability distribution indicates probabilities of times between the door opening event and the key code entering event, wherein the historical door delay data indicates a plurality of lengths of time between the door opening event and the key code entering event, determine a spread value for the probability distribution and determine whether the spread value is greater than a predefined threshold, generate the parameter update based on the probability distribution in response to determining that the spread value is greater than the predefined threshold, wherein the parameter update is a door delay time and cause the recommendation to include an indication of the door delay time, and cause the recommendation to include an indication to perform maintenance on at least one of the building devices in response to determining that the spread value is less than the predefined threshold.

In some embodiments, the false alarm rule is a hardware failure rule, where the hardware failure rule includes a sequence of events indicative of the one of building devices failing. In some embodiments, the processing circuit is configured to determine whether the one of the building devices will fail based on the events and the sequence of events of the hardware failure rule and cause the recommendation to include an indication to perform maintenance on the one building device in response to determining that the piece of building equipment will fail.

In some embodiments, the false alarm rule is a motion sensor false alarm rule, where the motion sensor rule includes a sequence of events including a burglar alarm event followed by a first motion detection event in a first zone followed by a second motion detection event in a second zone, wherein the first zone and the second zone are successive zones of the building. In some embodiments, the processing circuit is configured to determine whether the motion sensor false alarm rule has triggered based on the events and the sequence of events of the motion sensor rule and cause the recommendation to include an indication to reposition alarm sensors associated with the burglar alarm event in response to the motion sensor false alarm rule triggering.

In some embodiments, the false alarm rule is an employee alarm trip rule, where the employee alarm trip rule includes a sequence of events including a burglar alarm event in a first zone of the building followed by a zone bypass event of the first zone. In some embodiments, the processing circuit is configured to determine whether the employee alarm trip rule has triggered based on the events and the sequence of events of the employee alarm trip rule and cause the recommendation to include an indication that an employee with an incorrect password is opening the building in response to the employee alarm trip rule triggering.

In some embodiments, the processing circuit is configured to generate a ground fault time window and a ground fault threshold based on historical ground fault data for one of the building devices, where the historical ground fault data includes a multiple ground fault events and a time associated with each of the ground fault events. In some embodiments, the processing circuit is configured to determine an actual number of ground fault events that occur within the ground fault time window based on the events of the building data and determine whether the actual number of ground fault events is greater than the ground fault threshold. In some embodiments, the processing circuit is configured to cause the recommendation to include an indication to perform maintenance on the one of the building devices in response to determining that the actual number of ground fault events is greater than the ground fault threshold.

In some embodiments, the building devices include an expansion module and a security panel, where the expansion module is configured to add additional device connections to the security panel, where the false alarm rule is an expansion module false alarm rule. In some embodiments, the processing circuit is configured to generate a restore time period based on historical expansion module data. In some embodiments, the restore time period indicates a time period which the expansion module must generate a restore event. In some embodiments, the historical expansion module data indicates lengths of time between an expansion module failure event and the expansion module restore event. In some embodiments, the processing circuit is configured to determine whether the expansion module generates a restore event within the time period after generating the expansion module failure event and cause the recommendation to include an indication to perform maintenance on the expansion module in response to determining that the expansion module has not generated the restore event within the time period.

In some embodiments, the processing circuit is configured to determine a number of security phone calls to the building and a number of missed security phone calls to the building based on the building data, determine a number of police dispatches associated with a false alarm and the missed security calls, and generate an indication of an improved call tree structure for the building by comparing the call tree structure of the building to call tree structures of other buildings in response to determining that the number of police dispatches associated with the false alarm and the missed security calls is greater than a predefined amount. In some embodiments, the processing circuit is configured to cause the recommendation to include the indication of the improved call tree structure.

In some embodiments, the recommendation indicates the parameter update. In some embodiments, the processing circuit is configured to filter the recommendation based on a set of filter parameters to determine whether the recommendation is approved for automatic implementation or requires manual approval, where the filter parameters indicate a first recommendation list that indicates a first plurality of recommendations that can be automatically implemented without user approval and a second recommendation list that includes a second plurality of recommendations that require user approval. In some embodiments, the processing circuit is configured to automatically implement the recommendation in response to determining that the recommendation is approved for automatic implementation by determining that the recommendation is associated with the first recommendation list and provide, via a user interface, a prompt to a user to approve the recommendation in response to determining that the recommendation requires manual approval by determining that the recommendation is associated with the second recommendation list.

In some embodiments, the processing circuit is configured to receive, via the user interface, an update for the filter parameters from the user, where the update for the filter parameters indicates that the recommendation is approved for automatic implementation and indicates that the recommendation should be associated with the first recommendation list. In some embodiments, the processing circuit is configured to update the filter parameters with the received update for the filter parameters to include the recommendation in the first recommendation list.

Another implementation of the present disclosure is a method for preventing a false alarm that occurs at a building by one or more processing circuits. The method includes receiving, by the one or more processing circuits the building data including the events for the building devices and determining, by the one or processing circuits, based on the events, whether a false alarm rule has triggered, where the false alarm rule indicates relationships between one or more of the events that is indicative of a situation at the building site that causes the false alarm. The method includes generating, by the one or more processing circuits, a parameter update for at least one of the plurality of building devices in response to determining that the false alarm rule has triggered and implementing, by the one or more processing circuits, the parameter update by providing, via the communications interface, the parameter update to the at least one of the building devices.

In some embodiments, the false alarm rule is associated with a recommendation for preventing the false alarm from occurring. In some embodiments, the method includes providing, by the one or more processing circuits, the recommendation to a user via a user device in response to determining that the false alarm rule has triggered.

In some embodiments, the false alarm rule is a hardware failure rule, where the hardware failure rule includes a sequence of events indicative of the one of building devices failing. In some embodiments, the method further includes determining, by the one or more processing circuits, whether the one of the building devices will fail based on the events and the sequence of events of the hardware failure rule and causing, by the one or more processing circuits, the recommendation to include an indication to perform maintenance on the one building device in response to determining that the piece of building equipment will fail.

In some embodiments, the recommendation indicates the parameter update, wherein the method further includes filtering, by the one or more processing circuits, the recommendation based on a set of filter parameters to determine whether the recommendation is approved for automatic implementation or requires manual approval, wherein the filter parameters indicate a first recommendation list that indicates a first plurality of recommendations that can be automatically implemented without user approval and a second recommendation list that includes a second plurality of recommendations that require user approval, automatically implementing, by the one or more processing circuits, the recommendation in response to determining that the recommendation is approved for automatic implementation by determining that the recommendation is associated with the first recommendation list, and providing, by the one or more processing circuits, via a user interface, a prompt to a user to approve the recommendation in response to determining that the recommendation requires manual approval by determining that the recommendation is associated with the second recommendation list.

In some embodiments, the method includes receiving, by the one or more processing circuits, via the user interface, an update for the filter parameters from the user, where the update for the filter parameters indicates that the recommendation is approved for automatic implementation and indicates that the recommendation should be associated with the first recommendation list and updating, by the one or more processing circuits, the filter parameters with the received update for the filter parameters to include the recommendation in the first recommendation list.

Another implementation of the present disclosure is a non-transitory computer readable medium having machine instructions stored therein, the instructions being executable by a processor of a building management system to perform operations including receiving the building data including the events for the building devices. The operations include determining, based on the events, whether a false alarm rule has triggered, where the false alarm rule indicates relationships between one or more of the events that is indicative of a situation at the building site that causes the false alarm, wherein the false alarm rule is associated with a recommendation for preventing the false alarm from occurring. The operations include generating a parameter update for at least one of the plurality of building devices in response to determining that the false alarm rule has triggered, implementing the parameter update by providing, via the communications interface, the parameter update to the at least one of the building devices, and providing the recommendation to a user via a user device in response to determining that the false alarm rule has triggered.

In some embodiments, the recommendation indicates the parameter update. In some embodiments, the operations further include filtering the recommendation based on a set of filter parameters to determine whether the recommendation is approved for automatic implementation or requires manual approval, where the filter parameters indicate a first recommendation list that indicates a first plurality of recommendations that can be automatically implemented without user approval and a second recommendation list that includes a second plurality of recommendations that require user approval. In some embodiments, the operations include automatically implementing the recommendation in response to determining that the recommendation is approved for automatic implementation by determining that the recommendation is associated with the first recommendation list and providing, via a user interface, a prompt to a user to approve the recommendation in response to determining that the recommendation requires manual approval by determining that the recommendation is associated with the second recommendation list.

In some embodiments, the operations further include receiving, via the user interface, an update for the filter parameters from the user, wherein the update for the filter parameters indicates that the recommendation is approved for automatic implementation and indicates that the recommendation should be associated with the first recommendation list and updating the filter parameters with the received update for the filter parameters to include the recommendation in the first recommendation list.

User Presentation

One implementation of the present disclosure is a system for determining and presenting false alarm reduction information to a user. The system includes a processing circuit configured to determine addressable false alarms by determining, based on events of building devices of a building and event sequences of one or more false alarm rules, whether the one or more false alarm rules are triggered, where the one or more false alarm rules each include at least one of the event sequences, where each of the event sequences indicates a relationship between a first non-alarm event and a second non-alarm event that is indicative of a situation at the building that causes one of the addressable false alarms. The processing circuit is configured to generate recommendations based on the triggered false alarm rules where the recommendations prompt the user to rectify situations at the building that cause the addressable false alarms. The processing circuit is configured to generate a user interface including an indication of the addressable false alarms and the plurality of recommendations and cause a display of a user device to display the user interface.

In some embodiments, the processing circuit is configured to generate a number of recommendations based on the plurality of recommendations, generate a recommendation meter indicating the number of recommendations, and cause the user interface to include the recommendation meter.

In some embodiments, the processing circuit is configured to record a number of the addressable false alarms over a period of time by recording the number of the addressable false alarms at a plurality of points in time over the period of time, generate an addressable false alarm trend including an indication of the number of addressable false alarms at each of the points in time, and cause the user interface to include the addressable false alarm trend.

In some embodiments, the processing circuit is configured to generate a progress window including indications of a first number of work orders for the addressable false alarms, a first number of alarms, and a first number of police dispatches associated with a first time period and a second number of work orders for the addressable false alarms, a second number of alarms, and a second number police dispatches associated with a second time window occurring after the first time window. In some embodiments, the processing circuit is configured to cause the user interface to include the progress window.

In some embodiments, the processing circuit is configured to generate a forecast window indicating a first predicted number of work orders for the addressable false alarms associated with a first future time period, a predicted first number of alarms associated with the first future time period, and a first number of police dispatches associated with the first future time period and a predicted second number of work orders for the addressable false alarms associated with a second future time period following the first future time period, a predicted second number of alarms associated with the second future time period, and a predicted second number of police dispatches associated with the second future time period. In some embodiments, the processing circuit is configured to cause the user interface to include the forecast window.

In some embodiments, the processing circuit is configured to generate a recommendations interface including an indication of each type of recommendation of the recommendations and

An indication of specific recommendations of the recommendations for each type of recommendation. In some embodiments, the processing circuit is configured to cause the display of the user device to display the recommendations interface.

In some embodiments, the processing circuit is configured to generate an alarm heat map interface including an indication of a number of alarms associated with geographic regions, where the number of alarms include a number of alarms for other buildings and a number of alarms for the building, where the building and the buildings are associated with a particular entity. In some embodiments, the processing circuit is configured to cause the display of the user device to display the alarm heat map.

In some embodiments, the processing circuit is configured to receive an interaction with one of the geographic regions of the alarm heat map interface from the user device and responsive to receiving the interaction, generate a scaled alarm map displaying a scaled view of locations of at least one of the plurality of other buildings and the building and a number of addressable alarms associated with the at least one of the plurality of other buildings and the building.

In some embodiments, the processing circuit is configured to generate a group cluster by selecting other buildings with characteristics similar to characteristics of the building, generate a performance metric for the building based on a comparison of a risk score of the other buildings of the group cluster and a risk score of the building, and cause the user interface to include an indication of the performance metric.

In some embodiments, the processing circuit is configured to generate the risk score of the plurality of other buildings of the group cluster by receiving a number of addressable false alarms and a number of total alarms for each of the plurality of other buildings of the group cluster and generate the risk score for the plurality of other buildings of the group cluster based on the number of addressable false alarms and the number of total alarms for each of the plurality of other buildings. In some embodiments, the processing circuit is configured to generate the risk score for the building by: receiving a number of total alarms for the building, determining a number of addressable false alarms for the building based on the addressable false alarms, and generating the risk score for the building based on the number of addressable false alarms for the building and the number of total alarms for the building.

Another implementation of the present disclosure is a method for determining and presenting false alarm reduction information to a user by one or more processing circuits. The method includes determining, by the one or more processing circuits, addressable false alarms by determining, based on events of building devices of a building and event sequences of one or more false alarm rules, whether the one or more false alarm rules are triggered, where the one or more false alarm rules each include at least one of the event sequences, where each of the event sequences indicates a relationship between a first non-alarm event and a second non-alarm event that is indicative of a situation at the building that causes one of the addressable false alarms. The method includes generating, by the one or more processing circuits, recommendations based on the triggered false alarm rules, where the recommendations prompt the user to rectify situations at the building that cause the addressable false alarms. The method includes generating, by the one or more processing circuits, a user interface including an indication of the addressable false alarms and the plurality of recommendations and causing, by the one or more processing circuits, a display of a user device to display the user interface.

In some embodiments, the method includes generating, by the one or more processing circuits, a number of recommendations based on the plurality of recommendations, generating, by the one or more processing circuits, a recommendation meter indicating the number of recommendations, and causing, by the one or more processing circuits, the user interface to include the recommendation meter.

In some embodiments, the method includes recording, by the one or more processing circuits, a number of the addressable false alarms over a period of time by recording the number of the addressable false alarms at a plurality of points in time over the period of time, generating, by the one or more processing circuits, an addressable false alarm trend including an indication of the number of addressable false alarms at each of the points in time, and causing, by the one or more processing circuits, the user interface to include the addressable false alarm trend.

In some embodiments, the method includes generating, by the one or more processing circuits, a recommendations interface including an indication of each type of recommendation of the recommendations and an indication of specific recommendations of the recommendations for each type of recommendation. In some embodiments, the method includes causing, by the one or more processing circuits, the display of the user device to display the recommendations interface.

In some embodiments, the method includes generating, by the one or more processing circuits, an alarm heat map interface including an indication of a number of alarms associated with a plurality of geographic regions, where the number of alarms include a number of alarms for other buildings and a number of alarms for the building, where the building and the plurality of buildings are associated with a particular entity. In some embodiments, the method includes causing, by the one or more processing circuits, the display of the user device to display the alarm heat map.

In some embodiments, the method includes receiving, by the one or more processing circuits, an interaction with one of the plurality of geographic regions of the alarm heat map interface from the user device, responsive to receiving the interaction, generating, by the one or more processing circuits, a scaled alarm map displaying a scaled view of locations of at least one of the plurality of other buildings and the building and a number of addressable alarms associated with the at least one of the plurality of other buildings and the building.

In some embodiments, the method includes generating, by the one or more processing circuits, a group cluster by selecting a plurality of other buildings with characteristics similar to characteristics of the building, generating, by the one or more processing circuits, a performance metric for the building based on a comparison of a risk score of the plurality of other buildings of the group cluster and a risk score of the building, and causing, by the one or more processing circuits, the user interface to include an indication of the performance metric.

In some embodiments, the method includes generating, by the one or more processing circuits, the risk score of the plurality of other buildings of the group cluster by receiving a number of addressable false alarms and a number of total alarms for each of the plurality of other buildings of the group cluster and generating the risk score for the plurality of other buildings of the group cluster based on the number of addressable false alarms and the number of total alarms for each of the plurality of other buildings. In some embodiments, the method includes generating, by the one or more processing circuits, the risk score for the building by receiving a number of total alarms for the building, determining a number of addressable false alarms for the building based on the addressable false alarms, and generating the risk score for the building based on the number of addressable false alarms for the building and the number of total alarms for the building.

Another implementation of the present disclosure is a non-transitory computer readable medium having machine instructions stored therein, the instructions being executable by a processor of a building management system to perform operations including determining addressable false alarms by determining, based on events of building devices of a building and event sequences of one or more false alarm rules, whether the one or more false alarm rules are triggered, where the one or more false alarm rules each include at least one of the event sequences, where each of the event sequences indicates a relationship between a first non-alarm event and a second non-alarm event that is indicative of a situation at the building that causes one of the addressable false alarms. The operations include generating a plurality of recommendations based on the triggered false alarm rules, wherein the recommendations prompt the user to rectify situations at the building that cause the addressable false alarms, generating a user interface including an indication of the addressable false alarms and the plurality of recommendations, and recording a number of the addressable false alarms over a period of time by recording the number of the addressable false alarms at a plurality of points in time over the period of time. The operations further include generating an addressable false alarm trend including an indication of the number of addressable false alarms at each of the points in time, causing the user interface to include the addressable false alarm trend, and causing a display of a user device to display the user interface.

In some embodiments, the operations further include generating a group cluster by selecting a plurality of other buildings with characteristics similar to characteristics of the building. In some embodiments, the operations include generating the risk score of the plurality of other buildings of the group cluster by receiving a number of addressable false alarms and a number of total alarms for each of the plurality of other buildings of the group cluster and generating the risk score for the plurality of other buildings of the group cluster based on the number of addressable false alarms and the number of total alarms for each of the plurality of other buildings. In some embodiments, the operations include generating the risk score for the building by receiving a number of total alarms for the building and determining a number of addressable false alarms for the building based on the addressable false alarms, generating the risk score for the building based on the number of addressable false alarms for the building and the number of total alarms for the building, and generating a performance metric for the building based on a comparison of a risk score of the plurality of other buildings of the group cluster and a risk score of the building. In some embodiments, the operations include causing the user interface to include an indication of the performance metric.

DETAILED DESCRIPTION

Overview

Referring generally to the FIGURES, systems and methods are shown for false alarm reduction for intrusion, fire, and HVAC systems, according to various exemplary embodiments. Building site operators may be unable to distinguish between a true alarm and a false alarm even though the majority of alarms (e.g., approximately 98%) may be false alarms. Operators of a building may be required to react to all alarms as if they are true alarms. However, in reacting to all alarms as if they are true (e.g., calling police, fire, ambulance, etc.), resources may be wasted since the vast majority of the alarms are false.

Various factors can cause false alarms. Some of these factors are system configuration related factors, zone change related factors, users being added or removed to a security system, personal identification codes (PIC) changing, call trees changing, passive infrared (PIR) sensor sensitivity levels, equipment settings or user interactions with equipment, smoke alarms locations (e.g., being located to close to a vent), thermostat locations (e.g., a thermostat being located in a poor location), etc. Furthermore, the particular environment of the building may have active remodeling, floor plan and/or marketing updates, variations in weather, new employees being trained, employee seasonality churn (e.g., temporary and/or seasonal employees) all of which may influence the number of false alarms in a building site. Furthermore, security systems themselves can fail, tolerances be set incorrect, configurations may be incorrect, and security sensors and devices may be at an end of life state.

Data insights provided by the systems and methods discussed herein can help security teams prepare building policies and/or perform maintenance that reduces the number of false alarms at the building. The false alarm reduction as discussed herein, can prevent staff from worrying about false alarms and helps staff respond to alarms with the knowledge that they are true alarms. The systems and methods can provide equipment maintenance and/or replacement recommendations to pre-empt system failures and reduce false alarms that may occur from faulty equipment. Furthermore, the systems and methods can generate recommendations to improve employee training. For example, the systems and methods can determine that employees do not have a PIC for system disarming or are using an incorrect PIC and can generate a recommendation to train employees to use correct PICs. By generating insights into the contributors of false alarms, security teams can optimize their resources, policies, training, and metrics to reduce the number of false alarms that may occur at a building.

The systems and methods discussed herein can aggregate system data in a server to perform false alarm reduction analysis on an aggregate set of system data. The systems and methods discussed herein can be applied to a single site or multiple sites so that data can be collected and analyzed for one or multiple sites. Furthermore, the systems and methods can be implemented either on-premises or off-premises. Since the analysis can be performed off-premises in a cloud server, no additional site level equipment may be required to implement the systems and methods described herein.

Data intelligence e.g., data mining, machine learning, statistics, signal and network theories, can be used to derive actionable insights from raw data of a building to prevent false alarms. The data intelligence systems and methods described herein may start with the signal data, events, emanating from the sensors of intrusion, fire, or HVAC systems. The systems and methods can build upon the events by adding contextual information. The context can include spatial, time based, and/or neighbor based context that can be used to arrive at improved data representations that are robust and amenable for further processing by machine learning/data mining methods. Based on the enhanced data, the systems and methods described herein can employ an ensemble of techniques to derive actionable insights for reducing the number of false alarms that occur at a building.

The systems and methods disclosed herein can assess and reduce false alarms by analyzing event patterns in data collected from a building to identify and resolve situations at a building that are causing false alarms. The systems and methods described herein can continuously monitor and detect event patterns indicative of situations that cause false alarms and help to prevent false alarms by generating recommendations based on the event patterns that indicate various building changes to make to prevent the false alarms from occurring in the future.

In some test implementations of the systems and methods discussed herein, the systems and methods determined updated door entry and/or exit delay times. At some buildings, false alarms were reduced by 2,000 false alarms a week due to reprogramming entry and/or exit delay times. Other buildings experienced a reduction of approximately 850 false alarms per week due to reprogramming entry and/or exit delay times. At some sites, scheduling issues were corrected which resulted in 512 false alarms reduced per week.

Building Management System and HVAC System

Referring now toFIG. 2, a block diagram of a building automation system (BAS)200is shown, according to an exemplary embodiment. BAS200can be implemented in building10to automatically monitor and control various building functions. BAS200is shown to include BAS controller202and a plurality of building subsystems228. Building subsystems228are shown to include a building electrical subsystem234, an information communication technology (ICT) subsystem236, a security subsystem238, a HVAC subsystem240, a lighting subsystem242, a lift/escalators subsystem232, and a fire safety subsystem230. In various embodiments, building subsystems228can include fewer, additional, or alternative subsystems. For example, building subsystems228can also or alternatively include a refrigeration subsystem, an advertising or signage subsystem, a cooking subsystem, a vending subsystem, a printer or copy service subsystem, or any other type of building subsystem that uses controllable equipment and/or sensors to monitor or control building10. In some embodiments, building subsystems228include a waterside system and/or an airside system. A waterside system and an airside system are described with further reference to U.S. patent application Ser. No. 15/631,830 filed Jun. 23, 2017, the entirety of which is incorporated by reference herein.

Each of building subsystems228can include any number of devices, controllers, and connections for completing its individual functions and control activities. HVAC subsystem240can include many of the same components as HVAC system100, as described with reference toFIG. 1. For example, HVAC subsystem240can include a chiller, a boiler, any number of air handling units, economizers, field controllers, supervisory controllers, actuators, temperature sensors, and other devices for controlling the temperature, humidity, airflow, or other variable conditions within building10. Lighting subsystem242can include any number of light fixtures, ballasts, lighting sensors, dimmers, or other devices configured to controllably adjust the amount of light provided to a building space. Security subsystem238can include occupancy sensors, video surveillance cameras, digital video recorders, video processing servers, intrusion detection devices, access control devices and servers, or other security-related devices.

Still referring toFIG. 2, BAS controller266is shown to include a communications interface207and a BAS interface209. Interface207can facilitate communications between BAS controller202and external applications (e.g., monitoring and reporting applications222, enterprise control applications226, remote systems and applications244, applications residing on client devices248, etc.) for allowing user control, monitoring, and adjustment to BAS controller266and/or subsystems228. Interface207can also facilitate communications between BAS controller202and client devices248. BAS interface209can facilitate communications between BAS controller202and building subsystems228(e.g., HVAC, lighting security, lifts, power distribution, business, etc.).

Interfaces207,209can be or include wired or wireless communications interfaces (e.g., jacks, antennas, transmitters, receivers, transceivers, wire terminals, etc.) for conducting data communications with building subsystems228or other external systems or devices. In various embodiments, communications via interfaces207,209can be direct (e.g., local wired or wireless communications) or via a communications network246(e.g., a WAN, the Internet, a cellular network, etc.). For example, interfaces207,209can include an Ethernet card and port for sending and receiving data via an Ethernet-based communications link or network. In another example, interfaces207,209can include a Wi-Fi transceiver for communicating via a wireless communications network. In another example, one or both of interfaces207,209can include cellular or mobile phone communications transceivers. In one embodiment, communications interface207is a power line communications interface and BAS interface209is an Ethernet interface. In other embodiments, both communications interface207and BAS interface209are Ethernet interfaces or are the same Ethernet interface.

Still referring toFIG. 2, BAS controller202is shown to include a processing circuit204including a processor206and memory208. Processing circuit204can be communicably connected to BAS interface209and/or communications interface207such that processing circuit204and the various components thereof can send and receive data via interfaces207,209. Processor206can be implemented as a general purpose processor, an application specific integrated circuit (ASIC), one or more field programmable gate arrays (FPGAs), a group of processing components, or other suitable electronic processing components.

Memory208(e.g., memory, memory unit, storage device, etc.) can include one or more devices (e.g., RAM, ROM, Flash memory, hard disk storage, etc.) for storing data and/or computer code for completing or facilitating the various processes, layers and modules described in the present application. Memory208can be or include volatile memory or non-volatile memory. Memory208can include database components, object code components, script components, or any other type of information structure for supporting the various activities and information structures described in the present application. According to an exemplary embodiment, memory208is communicably connected to processor206via processing circuit402and includes computer code for executing (e.g., by processing circuit204and/or processor206) one or more processes described herein.

In some embodiments, BAS controller202is implemented within a single computer (e.g., one server, one housing, etc.). In various other embodiments BAS controller202can be distributed across multiple servers or computers (e.g., that can exist in distributed locations). Further, whileFIG. 4shows applications222and226as existing outside of BAS controller202, in some embodiments, applications222and226can be hosted within BAS controller202(e.g., within memory208).

Still referring toFIG. 2, memory208is shown to include an enterprise integration layer210, an automated measurement and validation (AM&V) layer212, a demand response (DR) layer214, a fault detection and diagnostics (FDD) layer216, an integrated control layer218, and a building subsystem integration later220. Layers210-220can be configured to receive inputs from building subsystems228and other data sources, determine optimal control actions for building subsystems228based on the inputs, generate control signals based on the optimal control actions, and provide the generated control signals to building subsystems228. The following paragraphs describe some of the general functions performed by each of layers210-220in BAS200.

Enterprise integration layer210can be configured to serve clients or local applications with information and services to support a variety of enterprise-level applications. For example, enterprise control applications226can be configured to provide subsystem-spanning control to a graphical user interface (GUI) or to any number of enterprise-level business applications (e.g., accounting systems, user identification systems, etc.). Enterprise control applications226can also or alternatively be configured to provide configuration GUIs for configuring BAS controller202. In yet other embodiments, enterprise control applications226can work with layers210-220to optimize building performance (e.g., efficiency, energy use, comfort, or safety) based on inputs received at interface207and/or BAS interface209.

Building subsystem integration layer220can be configured to manage communications between BAS controller202and building subsystems228. For example, building subsystem integration layer220can receive sensor data and input signals from building subsystems228and provide output data and control signals to building subsystems228. Building subsystem integration layer220can also be configured to manage communications between building subsystems228. Building subsystem integration layer220translate communications (e.g., sensor data, input signals, output signals, etc.) across a plurality of multi-vendor/multi-protocol systems.

Demand response layer214can be configured to optimize resource usage (e.g., electricity use, natural gas use, water use, etc.) and/or the monetary cost of such resource usage in response to satisfy the demand of building10. The optimization can be based on time-of-use prices, curtailment signals, energy availability, or other data received from utility providers, distributed energy generation systems224, from energy storage227, or from other sources. Demand response layer214can receive inputs from other layers of BAS controller202(e.g., building subsystem integration layer220, integrated control layer218, etc.). The inputs received from other layers can include environmental or sensor inputs such as temperature, carbon dioxide levels, relative humidity levels, air quality sensor outputs, occupancy sensor outputs, room schedules, and the like. The inputs can also include inputs such as electrical use (e.g., expressed in kWh), thermal load measurements, pricing information, projected pricing, smoothed pricing, curtailment signals from utilities, and the like.

According to an exemplary embodiment, demand response layer214includes control logic for responding to the data and signals it receives. These responses can include communicating with the control algorithms in integrated control layer218, changing control strategies, changing setpoints, or activating/deactivating building equipment or subsystems in a controlled manner. Demand response layer214can also include control logic configured to determine when to utilize stored energy. For example, demand response layer214can determine to begin using energy from energy storage227just prior to the beginning of a peak use hour.

In some embodiments, demand response layer214includes a control module configured to actively initiate control actions (e.g., automatically changing setpoints) which minimize energy costs based on one or more inputs representative of or based on demand (e.g., price, a curtailment signal, a demand level, etc.). In some embodiments, demand response layer214uses equipment models to determine an optimal set of control actions. The equipment models can include, for example, thermodynamic models describing the inputs, outputs, and/or functions performed by various sets of building equipment. Equipment models can represent collections of building equipment (e.g., subplants, chiller arrays, etc.) or individual devices (e.g., individual chillers, heaters, pumps, etc.).

Integrated control layer218can be configured to use the data input or output of building subsystem integration layer220and/or demand response later214to make control decisions. Due to the subsystem integration provided by building subsystem integration layer220, integrated control layer218can integrate control activities of the subsystems228such that the subsystems228behave as a single integrated supersystem. In an exemplary embodiment, integrated control layer218includes control logic that uses inputs and outputs from a plurality of building subsystems to provide greater comfort and energy savings relative to the comfort and energy savings that separate subsystems could provide alone. For example, integrated control layer218can be configured to use an input from a first subsystem to make an energy-saving control decision for a second subsystem. Results of these decisions can be communicated back to building subsystem integration layer220.

Integrated control layer218is shown to be logically below demand response layer214. Integrated control layer218can be configured to enhance the effectiveness of demand response layer214by enabling building subsystems228and their respective control loops to be controlled in coordination with demand response layer214. This configuration can reduce disruptive demand response behavior relative to conventional systems. For example, integrated control layer218can be configured to assure that a demand response-driven upward adjustment to the setpoint for chilled water temperature (or another component that directly or indirectly affects temperature) does not result in an increase in fan energy (or other energy used to cool a space) that would result in greater total building energy use than was saved at the chiller.

Integrated control layer218can be configured to provide feedback to demand response layer214so that demand response layer214checks that constraints (e.g., temperature, lighting levels, etc.) are properly maintained even while demanded load shedding is in progress. The constraints can also include setpoint or sensed boundaries relating to safety, equipment operating limits and performance, comfort, fire codes, electrical codes, energy codes, and the like. Integrated control layer218is also logically below fault detection and diagnostics layer216and automated measurement and validation layer212. Integrated control layer218can be configured to provide calculated inputs (e.g., aggregations) to these higher levels based on outputs from more than one building subsystem.

Automated measurement and validation (AM&V) layer212can be configured to verify that control strategies commanded by integrated control layer218or demand response layer214are working properly (e.g., using data aggregated by AM&V layer212, integrated control layer218, building subsystem integration layer220, FDD layer216, or otherwise). The calculations made by AM&V layer212can be based on building system energy models and/or equipment models for individual BAS devices or subsystems. For example, AM&V layer212can compare a model-predicted output with an actual output from building subsystems228to determine an accuracy of the model.

Fault detection and diagnostics (FDD) layer216can be configured to provide on-going fault detection for building subsystems228, building subsystem devices (i.e., building equipment), and control algorithms used by demand response layer214and integrated control layer218. FDD layer216can receive data inputs from integrated control layer218, directly from one or more building subsystems or devices, or from another data source. FDD layer216can automatically diagnose and respond to detected faults. The responses to detected or diagnosed faults can include providing an alarm message to a user, a maintenance scheduling system, or a control algorithm configured to attempt to repair the fault or to work-around the fault.

FDD layer216can be configured to output a specific identification of the faulty component or cause of the fault (e.g., loose damper linkage) using detailed subsystem inputs available at building subsystem integration layer220. In other exemplary embodiments, FDD layer216is configured to provide “fault” events to integrated control layer218which executes control strategies and policies in response to the received fault events. According to an exemplary embodiment, FDD layer216(or a policy executed by an integrated control engine or business rules engine) can shut-down systems or direct control activities around faulty devices or systems to reduce energy waste, extend equipment life, or assure proper control response.

FDD layer216can be configured to store or access a variety of different system data stores (or data points for live data). FDD layer216can use some content of the data stores to identify faults at the equipment level (e.g., specific chiller, specific AHU, specific terminal unit, etc.) and other content to identify faults at component or subsystem levels. For example, building subsystems228can generate temporal (i.e., time-series) data indicating the performance of BAS200and the various components thereof. The data generated by building subsystems228can include measured or calculated values that exhibit statistical characteristics and provide information about how the corresponding system or process (e.g., a temperature control process, a flow control process, etc.) is performing in terms of error from its setpoint. These processes can be examined by FDD layer216to expose when the system begins to degrade in performance and alarm a user to repair the fault before it becomes more severe.

False Alarm Reduction Based on Security Data Pattern Analysis

Referring now toFIG. 3, a security system300is shown for multiple buildings, according to an exemplary embodiment. The security system300is shown to include buildings10a-10d. Each of buildings10a-10dis shown to be associated with a security system302a-302d. The buildings10a-10dmay be the same as and/or similar to building10as described with reference toFIG. 1. The security systems302a-302dmay be one or more controllers, servers, and/or computers located in a security panel or part of a central computing system for a building.

The security systems302a-302dmay communicate with various security sensors that are part of the building subsystems228. For example, fire safety subsystems230may include various smoke sensors and alarm devices, carbon monoxide sensors and alarm devices, etc. The security subsystems238are shown to include a surveillance system315, an entry system316, and an intrusion system318. The surveillance system315may include various video cameras, still image cameras, and image and video processing systems for monitoring various rooms, hallways, parking lots, the exterior of a building, the roof of the building, etc. The entry system316can include one or more systems configured to allow users to enter and exit the building (e.g., door sensors, turnstiles, gated entries, badge systems, etc.) The intrusion system318may include one or more sensors configured to identify whether a window or door has been forced open. The intrusion system318can include a keypad module for arming and/or disarming a security system and various motion sensors (e.g., IR, PIR, etc.) configured to detect motion in various zones of the building10a.

Each of buildings10a-10dmay be located in various cities, states, and/or countries across the world. There may be any number of buildings10a-10b. The buildings10a-10bmay be owned and operated by one or more entities. For example, a grocery store entity may own and operate buildings10a-10din a particular geographic state. The security systems302a-302dmay record data from the building subsystems228and communicate collected security system data to the cloud server304.

The cloud server304is shown to include a security system306that receives the security system data from the security systems302a-302dof the buildings10a-10d. The cloud server304may include one or more processing circuits (e.g., memory devices, processors, databases) configured to perform the various functionalities described herein. The processing circuits may be the same and/or similar to the processing circuit204, the processor206, and/or the memory208as described with reference toFIG. 2. The cloud server304may be a private server. In some embodiments, the cloud server304is implemented by a cloud system, examples of which include AMAZON WEB SERVICES® (AWS) and MICROSOFT AZURE®.

In some embodiments, the cloud server304can be located on premises within one of the buildings10a-10d. For example, a user may wish that their security, fire, or HVAC data remain confidential and have a lower risk of being compromised. In such an instance, the cloud server304may be located on-premises instead of within an off-premises cloud platform.

The security system306may implement an interface system308, an alarm analysis system310, and a database storing historical security data312, security system data collected from the security systems302a-302d. The interface system308may provide various interfaces of user devices314for monitoring and/or controlling the security systems302a-302dof the buildings10a-10d. The interfaces may include various maps, alarm information, maintenance ordering systems, etc. Examples of the interfaces that the interface system308can generate are shown inFIGS. 37-51.

Security systems e.g., the security system302a, can protect residential or commercial premises by implementing functionality e.g., intrusion detection, access control, video surveillance, and fire detection. In each case, sensors deployed at various locations in and around the building transmit data back to a central system for analysis, e.g., the security systems302a-302d. In some instances, such data is further transmitted to an offsite location that serves as a monitoring center, e.g., the alarm analysis system310. In either case, the sensor data can be analyzed to determine if a condition exists at the premises that requires attention by a security professional. For example, if a motion sensor detects that someone has entered a building at a time that the intrusion system is armed or if an access control system detects that a door is being forced open, that information is transmitted to the local or remote monitoring center which can deploy security guards or call the police.

Unfortunately, such security systems for detecting alarms (e.g., a fire, an intrusion, etc.) may not be foolproof. If a sensor is going bad or requires maintenance, it may produce spurious data falsely indicating that there has been a security breach. For example, a smoke detector may indicate the presence of smoke in the building when it is simply an accumulation of dust on the device. Likewise, a contact switch on a warehouse door may indicate that the door has been opened when, in fact, the magnetic switch has simply stopped working correctly. Such false alarm situations can be numerous and can cost building owners a substantial amount of money each year in business down-time, security agency response fees, and maintenance personnel truck rolls. In many instances, the purported cause of a false alarm is repaired but other related problems exist with the systems that are not detected until further false alarms events occur.

In some embodiments, the alarm analysis system310is configured to predict conditions that are precursors to a false alarm condition and fix the errors before they occur. In some embodiments, sensor data from commercial security products (e.g., the building subsystems228and/or the security system302a) is monitored by the alarm analysis system310and used to predict false alarms. Based on the predicted false alarms, the alarm analysis system310can be configured to generate preventative maintenance or training recommendations.

The alarm analysis system310can predict and/or identify anomalous behavior by tracking normal security product behavior at the protected premises. This past behavior can set a standard by which the security system can be measured against. When a deviation from that norm is detected in the operation of the security system, the alarm analysis system310can be configured to analyze the type of deviation that occurred, determine whether the behavior is of a type that is a precursor to a false alarm condition, and determine a response that is necessary for preventing the false alarm from occurring.

Moreover, the alarm analysis system310can be configured to predict other related aspects of the security product that may need attention. For example, if a magnetic door sensor is exhibiting aberrant behavior, the alarm analysis system310can be configured to generate a prediction that the magnetic door sensor will fail. Furthermore, the alarm analysis system310can be configured to determine the age of that sensor as well as all similar sensors in the building that are the same type and age as the failing one. The data intelligence system can notify building operators that the magnetic door sensor is failing and can indicate similar door sensors that may require attention.

The alarm analysis system310can be a “self-healing” system configured to automatically pushing parameter updates to the building subsystems228and/or configured to automatically schedule time for maintenance to be conducted. Using such a self-healing system, a building owner does not need to be notified that there was a problem with their security product since the building system can be configured to automatically fix itself. Therefore, when a security issue arises, the building owner can have a high level of confidence that it is an actual security event rather than a false alarm.

The alarm analysis system310can be configured to analyze the historical security data312and determine false alarm rules. The false alarm rules may indicate that particular patterns of events (e.g., alarms occurring, detected motion, etc.) at the security systems302a-302dare indicative of an event or situation at the buildings10a-10dthat causes false events. Furthermore, the false alarm rules may include recommendations and provide a solution to reducing false alarms. For example, a false alarm rule may be indicative of particular event patterns that indicate that building employees are not being properly trained to utilize a security system. The false alarm may include a recommendation indicating that building employees do not understand how to properly perform a particular job duty or operate particular security system devices.

The signals generated by building systems (e.g., from sensors the building subsystems228e.g., intrusion, fire, or HVAC systems) may be discrete events or continuous signals generated in response to certain actions performed either by human beings or based on based on sensor data (e.g., detecting an intrusion event, detecting motion in a zone, etc.). In some embodiments, the events are marked by site, system, date, event type, zone, alarm, and/or can include a comment. An example is Table 1 below,

Based on the event data e.g., the data shown in Table 1, the systems and methods discussed herein can predict if a building site needs attention and alert building users to actionable insights to prevent false alarms. The events can be analyzed to detect patterns that are indicative of a situation that causes false alarms. The “patterns” or “sequences” may be indicative of inherent causality relationships indicative of a situation that causes a false alarm. The alarm analysis system310can be configured to generate the event sequences by performing a parameter search, a general sequential pattern (GSP) algorithm, first and/or second order Markov chains, neural networks, decision trees, Bayesian analysis, and/or any other method that derives patterns of events and identifies potential issues, e.g., false alarm rules. Based on the detection of the presence of a particular false alarm sequence at a building, a situation that causes false alarms can be identified and a recommendation for alleviating the situation can be generated.

Based on the analysis, the alarm analysis system310can provide interfaces to an end user with the results of the analysis. The interfaces may inform a user about the current status of their system, whether maintenance is or will be required, and/or suggested parameter changes for the security system that will result in a reduction in false alarms. The alarm analysis system310can, based on the event data received for the building site and the identified false alarm rules, prepare a recommendation informing an end user of parameter adjustments or maintenance that may be necessary to prevent false alarms from occurring. The insight may be to adjust or update a door delay, to train employees to better understand access systems, replace a battery for a sensor with a low battery, repair electrical equipment where there is a ground fault, etc. The recommendation can be transmitted to the end user via an interface and the user can access the insight via one or more of the user devices314. A subscription server, mobile application, website, or other medium can be used to deliver the insights to the end user via the user devices314. Based on the event data and/or the actions which a user may take to reduce risk, the alarm analysis system310can be configured to generate a risk profile indicating the ranking of a particular building site in terms of safety and comparing the particular building site against other building sites. Risk scores are described with further reference toFIGS. 31-33.

The alarm analysis system310can identify recommendations to use in reducing the number of false alarms reported by the security system302a. In some embodiments, the false alarm rules that the alarm analysis system310can be configured to determine can be surfaced to a domain expert that can review the false alarm rules and the event sequences associated with the false alarm rules and provide recommendations for the false alarm rules. The domain expert may be a Certified Software Asset Manager (CSAM). The CSAM may provide input to the alarm analysis system310for determining the alarms and can further provide contextual information for the rules. For example, the domain expert may provide a title or maintenance directions for each rule determine by the alarm analysis system310. Based on identified false alarm rules, the alarm analysis system310can receive data regarding what is causing false alarms, along with a recommendation for addressing that group or an identifier tag, e.g., a title for the rule.

The alarm analysis system310can further be configured to gather additional event data and apply a second round of analytics on the rules relative to the additional data. This may allow the false alarm rules to be updated or modified based on data that was not considered when the rule was generated. The false alarm rules, and the data used to generate the false alarm rules, may span multiple sites or one particular site. Furthermore, the false alarm rules and the data used to generate the false alarm rules may be associated with particular sites in a vertical. For example, a certain square footage may define a vertical so that similarly sized building sites can be analyzed together. By analyzing data for a particular group of building sites, recommendations can be generated for the building sites of the group based on a large data set. Another example of a vertical may be a market vertical (e.g., law firm buildings may form one vertical, grocery stores may form a vertical, schools may form another vertical, etc.)

Referring now toFIG. 4, a block diagram of the alarm analysis system310as described with reference toFIG. 3is shown, according to an exemplary embodiment. The alarm analysis system310can be configured to identify patterns leading to false alarms based on event data reported by the security system302a. The alarm analysis system310is shown to include a processing circuit502that includes a processor504and a memory506. The memory506can include instructions which, when executed by the processor504, cause the processor504to perform the one or more functions described herein. The processor504may be the same and/or similar to the processor206as described with reference toFIG. 2and the memory506may be the same as and/or similar to the memory208as described with reference toFIG. 2.

In addition to a traditional processor and memory, the processing circuit502may include integrated circuitry for processing and/or control, e.g., one or more processors and/or processor cores (e.g., microprocessor and/or microcontroller) and/or FPGAs (Field Programmable Gate Array) and/or ASICs (Application Specific Integrated Circuitry). The processing circuit502can include and/or be connected to and/or be configured for accessing (e.g., writing to and/or reading from) the memory506, which may include any kind of volatile and/or non-volatile memory, e.g., cache and/or buffer memory and/or RAM (Random Access Memory) and/or ROM (Read-Only Memory) and/or optical memory and/or EPROM (Erasable Programmable Read-Only Memory).

The memory506can be configured to store code executable by control circuitry and/or other data, e.g., data pertaining to communication, e.g., configuration and/or address data of nodes, etc. The processing circuit502can be configured to implement any of the methods described herein and/or to cause such methods to be performed, e.g., by the processor504. Corresponding instructions may be stored in the memory506, which may be readable and/or readably connected to the processing circuit502. It may be considered that the processing circuit502includes or may be connected or connectable to the memory506, which may be configured to be accessible for reading and/or writing by the controller and/or the processing circuit502.

The security system302ais shown to include a communication interface508. The communication interface508can be configured to facilitate communicate with a domain expert device510and/or the security system302a. Furthermore, the communication interface508can be configured to communicate with all of the devices and systems described with reference toFIG. 3.

Via the communication interface508, the historical security database512can be configured to receive (collect) and store security system data from the security system302a. The security system data may be events such as an occurrence detected by a sensor of the security system302a. For example, an intrusion sensor may identify that an individual is trying to force a window open. Another event may be a door being opened or closed. The detection of an occupant walking through the door may also be an event. The events514can further include signals. For example, a signal may be a continuously signal of a door being open and door being closed.

The memory506is shown to include an event analyzer516. The event analyzer516can be configured to generate false alarm rules518that are shown to be stored by the memory506. The event analyzer516can be configured to generate particular sequences of events514and generate rules based on the sequences of events514. Certain sequences of events514can be identified as important by the event analyzer516, these sequences can be used by the event analyzer516to generate the false alarm rules518. The false alarm rules518can be rules identifying that particular sequences of events are and/or lead to false alarms. The false alarm rules518may include a recommendation526which may instruct an end user to perform an action which reduces false alarms (e.g., adjusting a building equipment parameter, training building personal, replacing a piece of building equipment, reducing false alarms related to churn, etc.). For example, an alarm rule518may indicate that a particular sequence of events indicates a poorly positioned door sensor. For this sequence of events, the recommendation526may be to have a technician reposition the door sensor.

The event analyzer516can be configured to perform Markov Chain analysis to determine important sequences of events514. The event analyzer516can be configured to generate a Markov Chain transition matrix which identifies the relationships between events and probabilities of each transition between events. For example, a first order transition matrix may be defined by A, where ai,jis a probability for a particular transition from a state i to a state j.

Furthermore, the event analyzer516can be configured to use a first order Markov Chain to determine important transitions between events. A first order Markov Chain may be a Markov Chain where the probability of a second event occurring after a single first event. The first order Markov Chain may identify important transitions between events514, important sequences.

Furthermore, the event analyzer516can be configured to implement a second order Markov Chain to analyze the events514. A second order transition may be a transition where the probability of a third event occurring after two prior events. The event analyzer516can be configured to analyze the events514with a second order transition to check for accuracy of the first order Markov Chain, e.g., verify that the identified events are important, and further identify additional sequences of events. The event analyzer516can be configured to implement any order of Markov Chain analysis and can be configured to determine an optimal order for the Markov Chain analysis. For example, a user may identify a predefined number of false alarm rules518and the event analyzer516can perform Markov Chain analysis to determine a particular Markov Chain order that results in the predefined number of false alarm rules518.

The transitions between events514may be time based. The transition matrices can be built by the event analyzer516for different time intervals between events. Every event sequence or transition of events determined by the event analyzer516can be considered an issue and can be assigned as a false alarm rule518. An appropriate fix or response can be assigned to the false alarm rule518by the domain expert, e.g., the recommendation526.

The memory506can be configured to store events514and/or sequences of events in a historical security database512. The processing circuit502can be configured to analyze a sequence of events514with Generalized Sequential Pattern (GSP) analysis to generate pattern information for alarm rules518. More specifically, the event analyzer516can be configured to analyze the events514with GSP analysis. This is further described with reference toFIG. 8. The recommendation generator522can be configured to classify events514as triggering a false alarm rule518based on the pattern information of the false alarm rules518. In some embodiments, the Bayesian predictor520can be configured to perform a Bayesian analysis to predict alarms occurring in the future, according to the process described with reference toFIGS. 9A-10C.

The event analyzer516can be configured to perform GSP mining to determine sequences from the events514. By using GSP, the event analyzer516can be configured to empirically determine inherent causality relationships between events. The alarm rules518can be determined from the various sequences of events514determined by the event analyzer516. The false alarm rules518may indicate that a particular sequences of events is indicative of a situation for issue that causes false alarms. For example, a rule may be “Communication Issue” and may be associated with a maintenance activity “Wiring replacement needed.” A particular sequence for this false alarm rule518may be:
CF_COMM_Trouble→BA_Overhead_Door(s)

This false alarm rule518can indicate that a burglar alarm sensor for a door triggers after a communication issue is sensed for the burglar alarm sensor. A recommendation to prevent false alarms occurring for the burglar alarm sensor may be to perform maintenance on the burglar alarm and/or replace the communication wiring for the burglar alarm sensor.

The domain expert device510may be a device that a domain expert uses to access the false alarm rules518. The domain expert device510may be the same and/or similar to the user devices314. A domain expert associated with the domain expert device510can provide the recommendations526for each of the false alarm rules518. For example, the domain expert, via the domain expert device510, can review the false alarm rules518and provide the recommendation526for each false alarm rule518. The domain expert device510can provide recommendation526that indicates a particular cause of a false alarm. For example, for a communication issue, the recommendation526may indicate that communication wires should be replaced or inspected by a technician.

The recommendation generator522can be configured to identify whether an event514and/or sequence of events514are indicative of a situation causing a false alarm or indicating that a false alarm could occur. The recommendation generator522can determine whether an event or sequence of events meet a false alarm rule518. Based on the recommendation526, the recommendation generator522can provide suggestions or insights to a user device314. The suggestion may be to perform maintenance, e.g., inspecting or replacing communication wires. Furthermore, the recommendation may be to change a parameter of a sensor device. For example, a door delay parameter might be increased to prevent a false alarm pertaining to a door.

Table 2 below indicates recommendations that can be provided to an end user to reduce situations or events that cause false alarms. The recommendations may be the same as and/or similar to the recommendations526. In Table 2, each recommendation indicates a title and a recommendation description. In some embodiments, the recommendation names and/or recommendation descriptions are provided by the domain expert of the domain expert device510for particular events and/or event sequences, i.e., for a false alarm rule518. In various embodiments, the alarm analysis system310can classify various events and/or event sequences into one of the recommendations shown in Table 2 below, i.e., the domain expert of the domain expert device510can define the recommendations of Table 2 and then the alarm analysis system310can train a classifier to assign particular event sequences a recommendation name and/or recommendation description from Table 2.

TABLE 2RecommendationsRecommendation NameRecommendation DescriptionInstant Burglar AlarmFire exit door or a perimeter door that has been(BA) Door Alarmprogrammed for instant alarm.Entry/Exit DelayThe amount of time has exceeded the entry/exitparameter programedEmployee AccessEmployee is incorrectly entering or exitingbuilding. Customer education.Bypass ViolationArming event that causes securityvulnerability.Interior Burglar AlarmIt appears a motion sensor is causing alarmsthrough a window, before customer entersperimeter door and cancels. Consider movingsensor or trying to adjust sensitivity.Aborted Burglar AlarmAn alarm with police dispatch was cancelleddue to an authorized employee cancelling thealarm.No CloseMultiple alarms are caused by the site closingoff-schedule. Check or adjust schedule.Irregular Early OpenMultiple alarms are caused by the site openingoff-schedule or wrong authority level. Checkor adjust schedule or authority level.Low BatteryBattery needs to be replaced since buildingdevice has been operating for a long time afteran AC power failure.Low battery is leading to multiple problems.Check or replace battery.Video Verification FailWe see a connection issue with the camera.User ErrorWe have identified that employees needstraining on working with the intrusion system.Expansion ModuleHardware failure issue with accessoryexpansion module that causes a false alarm.Non Aborted BurglarWe have not been able to reach one of theAlarmauthorized people from the call tree.Ground FaultA hardware electrical issue.Glass Break or VibrationA sensor that is causing an alarm from theSensorglass break via internal and/or externalconditions.No Contact-Voice MailKey holder not contactable - voicemail full.FullNo Contact-No VoiceKey holder not contactable - voicemail not set-MailupNo Contact-InvalidKey holder not contactable - number not valid.numberNo Contact-OtherKey holder not contactable - number notcontactable.

The Bayesian predictor520can be configured to predict whether a false alarm rule518will trigger in the future. The Bayesian predictor520can be configured to implement a Bayesian model and/or a hierarchical Bayesian model. Based on a framework for the Bayesian model and the events514, the Bayesian predictor520can be configured to generate a prediction of what rules will fire in the future (what issues will occur in the future). For example, the Bayesian predictor520can be configured to implement a Bayesian model to determine how many door delay alarms will occur one week into the future. The predictions can be provided to the interface system308.

The interface system308can be configured provide a dashboard to the user device314. The interface system308is shown to include a dashboard generator524. The dashboard generator524can be configured to receive the indications of actions to take to reduce or suppress false alarms from the recommendation generator522and predictions from the Bayesian predictor. Examples of the interfaces that can be generated by the dashboard generator524are the interfaces shown inFIGS. 37-51.

The new data scorer527can be the same as and/or similar to the event analyzer516. The new data scorer527can be configured to implement GSP mining or Markov transition analysis. The new data scorer527can be configured to update the false alarm rules518based on new events514received form the security system302a. This second round of analytics may identify new alarm rules518or improve or remove past alarm rules518.

Referring now toFIG. 5, a flow diagram of a process500that can be performed by the alarm analysis system310for generating alarm rules518is shown, according to an exemplary embodiment. The alarm analysis system310can be configured to perform the process500. Furthermore, any one or combination of the computing devices described herein can be configured to perform the process500.

In step550, the alarm analysis system310can receive events514from the security system302a. The events may be doors opening or closing, a window being forced open, movement detected in a particular zone, etc. In step552, the event analyzer516can be configured to analyze the events514to identify various alarm rules518. In some embodiments, analyzing the events514may include performing a first order Markov transition analysis, a second order Markov transition analysis, and/or any order Markov transition analysis. Furthermore, the analysis may include performing a GSP analysis of the events514in addition to various other pattern mining algorithms e.g., Sequential PAttern Discovery Using Equivalence Classes (SPADE), FreeSpan, PrefixSpan, MAPres, etc. Identifying the false alarm rules518is described with further reference toFIGS. 6A and 6B.

In step554, the recommendation generator522can determine whether a false alarm rule has triggered (e.g., determining whether a false alarm has occurred or will occur) based on the events514and the alarm rules518. An indication that a false alarm has or will occur may be indicative of a situation in the building10athat is causing false alarms. Examples of such a situation may be an improperly installed or operated piece of building equipment of the building10a. In some embodiments, certain events514may occur within the building10awhen a false alarm occurs. In some embodiments, the certain events514may occur within the building10aalthough no alarm has yet occurred. Based on the alarm rules518, the recommendation generator522may determine, that based on particular patterns of the events514, that a false alarm has occurred or may occur in the future.

In step556, the Bayesian predictor520can determine a prediction for alarm rules518occurring in the future. The Bayesian predictor520can implement Bayesian modeling to identify whether a false alarm will occur in the future based on the events514and the alarm rules518. More specifically, based on historical data of past alarm rules518triggering, the Bayesian predictor520can predict how many alarm rules will trigger in the future. In step558, based on the identified false alarms and the predictions of future alarms as determined in steps554and558, a recommendation can be generated by the interface system308. The recommendation may be to adjust the installation of sensors, adjust the parameters of the sensors, or order technician service. The maintenance recommendation can help prevent false alarms from occurring in the future. This insight may be based on the recommendation526associated with a triggered alarm rule518.

In step560, the interface system308can provide the recommendation to a user via user device314. In this regard, various dashboards and interfaces can be generated by the dashboard generator524to display the recommendations to the user. The user can review the recommendations via the user device314and take appropriate action. In some embodiments, the user may approve a particular setting change which the alarm analysis system310can implement. In step562, in response to receiving a confirmation to update various sensor or system parameters to avoid false alarms, the alarm analysis system310can implement the various changes.

Referring now toFIGS. 6A and 6B, a process600A is shown to generating alarm rules518with a GSP method and/or Markov Chain analysis with the alarm analysis system310, according to an exemplary embodiment. The alarm analysis system310can be configured to perform the process600A. Furthermore, any one or combination of computing devices described herein can be configured to perform the process600A. By formulating the problem as a GSP mining problem, patterns emanating from signal interactions can be analyzed.

FIG. 6Bis a flow diagram of the process600A.FIG. 6Billustrates the events514and the parameters search of step604and the GSP analysis of step606being performed on the events514to generate the alarm rules518(the top n rules). Furthermore, optional steps608and610are shown for performing first order Markov chain analysis step608and second order Markov chain analysis step610.

Referring more particularly toFIG. 6A, in step602, the alarm analysis system310can receive events from the security system302aof the building10a. Step602may be the same as and/or similar to step550ofFIG. 5B. The alarm analysis system310can receive historical event data from a system, a single building site, or multiple building sites. In step604, the event analyzer516can perform a time-domain parameter search on the received events514.

In step606, the event analyzer516can perform a generalized sequential patterning mining (GSP) method to identify one or more sequences, i.e., causality relationships between events. The GSP method can identify important sequences of events, i.e., sequences which occur frequently.

Steps608and610can be optional steps performed by the event analyzer516to generate the alarm rules518. This can be performed in addition to, or in place of, the GSP analysis. In step608, the event analyzer516can determine sequences, e.g., transitions between events and can determine the importance of the transitions e.g., how often the transition occurs with a first order Markov chain analysis. A first order Markov chain analysis may identify the probability of a future event based on a single previous event.

In step610, the event analyzer516can confirm whether the sequences identified as significant in step608are still significant and can further identify additional sequences with a second order Markov chain analysis. The second order Markov chain analysis may identify sequences of events that occur frequently. The second order Markov chain analysis may identify the probability of a future event based on two past events. The sequences determined by the first order Markov chain analysis can be compared to the sequences determined by the second order Markov chain analysis to verify that the sequences of the first order analysis are determined to be significant under the second order analysis. If the second order analysis determines that the first order sequences are not important, these sequences can be removed. Furthermore, additional sequences can be identified by the event analyzer516via the second order Markov chain analysis.

In step612, the event analyzer516can determine one or more false alarm rules518from the sequences determined by the GSP mining of step606or the Markov chain analysis of steps608and610. In some embodiments, the event analyzer516can determine a top n rules that are significant from both the GSP mining and/or the Markov chain analysis. The top n rules may be the most significant rules for a particular system, a particular building site, and/or for multiple building sites. In some embodiments, the frequency at which the sequences occur is used to select the sequences. For example, the top n most frequently occurring sequences may be selected. The top n sequences can be used to form alarm rules518. In some embodiments, the alarm rules and/or sequences are categorized and adjusted by the domain expert associated with the domain expert device510. For example, the domain expert device510may provide recommendation526for each of the false alarm rules518.

Referring toFIG. 7, an exemplary first order Markov transition diagram700is shown for events514, according to an exemplary embodiment. As can be seen, the first event rows702illustrates a first event while the second event columns704illustrate a subsequent second event. The transition diagram700illustrates the significance of each transition based on the scale706which ranges from −1 to 1. The significance may indicate the probability or rate at which one of the second events of the second event column704occurs after a first event of the first event rows702occurs. As an example, the alarm analysis system310may select any transition with a metric above a predefined amount to be a false alarm rule518. For example, only the red transitions may be selected as false alarm rule518, e.g., all transitions above 0.45.

As described elsewhere herein, the event analyzer516can utilize Markov properties to analyze a sequence of events514received from the security system302a. By only considering the previous signal, i.e., a first order Markov chain (as shown inFIG. 7), the transitions between events514can be analyzed. Before this step, embodiments involve pre-processing the signal data using domain knowledge to remove redundancy in signal definition.

Some embodiments include observation of second order transitions to check for accuracy or new patterns. The transitions may be time based. These observations can be made for different time intervals at definite data granularity, built at a system number level. As an example, patterns that may emanate from first and second order transitions are Equations 8 and 9.
CF_COMM_Trouble→BA_Overhead_Door(s): A false alarm due to a communication issue  (Equation 8)
TR_INVALID_CD_ENTRD→BA-DOOR: A true alarm  (Equation 9)

For the false alarm of Equation 8, an associated recommendation can be linked for reducing false alarms. In some embodiments, the recommendation includes one or multiple actions. For example, the actions may be “replace battery” or “wiring replacement needed.”

Every transition as determined from a first and/or second order Markov analysis can be viewed as a potential issue and an appropriate fix may be assigned to these issues. As described elsewhere herein, a domain expert associated with the domain expert device510can help classify the transition as false alarms (e.g., the transition of Equation 8) or true alarms (e.g., the transition of Equation 9).

The transitions ofFIG. 7can be a proxy of how equipment (e.g., security panels) are operated at the building10a. Faulty use of the building equipment and/or improper maintenance can lead to false alarms and these situations of faulty user and/or improper maintenance can be identified via the transitions. Specific recommendations for responding to each of the transitions and/or the most significant transitions can be implemented by the systems and methods discussed herein to perform preventative maintenance to reduce the number of false alarms that occur for the building.

Referring toFIG. 8, a chart800illustrating alarm rules518determined by the event analyzer516with a GSP algorithm is shown, according to an exemplary embodiment. The chart800indicates sequences of events that are the most “important” or occur the most frequently based on the size of the circle indicators of the chart800. Larger circles may indicate a sequence that occurs more frequently than a smaller circle. By using the GSP method, the event analyzer516can arrive at the sequences illustrated by the chart800. With sequence modeling, inherent causality relationships may be uncovered empirically and rules (e.g., the rules shown inFIG. 8) may be developed for rectifying issues. For example, when communication trouble is followed by a burglar alarm indicating entry via overhead doors, the GSP algorithm may conclude that the alarm is a result of a communication issue and that a wiring replacement is needed.

Referring toFIGS. 7 and 8, both Markov chains and GSP mining can be employed to determine false alarm rules618. GSP may help provide a general framework for generating patterns. For GSP mining, events514may be modeled as sequences and the data may be prepared in a manner suitable for sequential pattern mining algorithms, e.g., GSP. The parameter search can be a time dimension and/or may be a spatial dimension. The Markov chain method and the GSP can be combined into one pipeline where the Markov chain model and the GSP algorithm are placed into a single framework for generating rules. Every rule may be a potential signature for an issue. The signals associated the rules have a very distinct pattern. Signatures can be correlated signals. Signatures with time series events applied can develop repeatable false alarm patterns. Specific signatures and patterns can be filtered with the help of a domain expert (human being) and can be equated to a user action leading to a critical false alarm at the premise. The input of the domain expert can help form action insights, actions a user should take in response to a rule triggering.

More specifically, the Markov chain model and/or the GSP algorithm can be used to determine a cause (which may be user action, or for example, incorrect installation of equipment) of a sequence of events that leads to an alarm. These can form action insights. For example, suppose the following rule is termed as very significant by the GSP algorithm.
OPEN/CLOSE→BA,BA-IR  (Equation 10)

A database can be consulted by looking at all the events that the rule of Equation 10 satisfies and identifying patterns of the signal giving rise to the alarm. As a result, suppose the following patterns of Table 4 are found, the first pattern and the second pattern, where OPEN is an open window or door event, BA is a burglary alarm event, BA-IR is a burglar alarm event based on infrared detection, BA-DOOR is a burglary alarm event based on an open door, and is a closed door event.

With the help of a domain expert, a rule of Table 3 may be classified and all the patterns under this rule (e.g., the First Pattern and the Second Pattern of Table 4) can be labeled as Motion Sensor Sensitivity. These patterns may be the result of motion sensors being activated before or after the door of interest is either closed or opened. This may lead to numerous of false alarms. A recommended fix may be to reduce the sensitivity of the motion sensors or to move the motion sensors to a different place.

Referring now toFIGS. 9A and 9B, process900is shown for generating a recommendation based on the false alarm rules518and the events514, according to an exemplary embodiment. The alarm analysis system310can be configured to perform the process900. Furthermore, any one or combination of computing devices described herein can be configured to perform the process900.FIG. 9Billustrates a flow diagram of the process900and identifies the steps of the process900and the domain expert devices510and the user device314.

Referring more particularly toFIG. 9A, in step902, the event analyzer516can determine the alarm rules518. The event analyzer516can use Markov chain analysis or GSP mining. These methods are described with further reference toFIGS. 6A-8.

In step904, the alarm analysis system310can receive recommendations526for the determined false alarm rules518. The recommendation526may be a recommended activity that should be performed, e.g., adjusting a parameter value, performing maintenance, adjusting or reinstalling a sensor, etc. The domain expert can also provide a title for the alarm rule518. In some embodiments, the alarm analysis system310provides the recommendations526to the domain expert device510. The domain expert, via the domain expert device510, may remove rules, update rules, filter rules, combine rules, etc. The domain expert may classify some rules as indicative of a false alarm and other rules as indicative of a true alarm.

The recommendation526may be “send a remote tech to the site” and can be provided by the domain expert device510. Furthermore, the recommendation526can be derived from the event data of the alarm rule518. An example of a derived title may be “usage of wrong door.”

In step906, the rules can be applied to new event data received from the security system302a. The new event data may satisfy one of the alarm rules518that is a rule for a false alarm, the recommendation generator522may determine that a false alarm has occurred or may occur in the future based on the event pattern. The recommendation526(e.g., resolution for those causes) associated with the rule that has triggered can be used to generate insights which can be passed to an end user associated with the user device314or to the domain expert associated with the domain expert device510(step908). Some of these recommendations are to remotely program the remote programming the security system302a. In this regard, the alarm analysis system310may automatically adjust one or more operating parameters of the security system302a. In some embodiments, the insight provided to the user prompts the user to approve an automatic adjustment.

In step910, the historical security database512may be updated with new events. The new data scorer527can be configured to perform a second round of analytics to score the alarm rules518(step912). The new data scorer527can determine whether the alarm rules518are accurate and if any changes or updates need to be made to the alarm rules518. Furthermore, the new data may occur in response to parameter changes remotely made for the security system302a. Therefore, new data scorer527can be configured to add new alarm rules518or remove old alarm rules518that are no longer relevant after the remote parameter changes have been made.

The process900can be performed continuously and can allow the complete system to be in a steady state with reduced false alarms. By self-healing, remotely and automatically adjusting parameters for the security system302a, the process900can keep the security system302aworking in the right condition.

Process900relates to what happens at the system, how much did the system drift from the normal operations and what actions we need to take to make it return to normal operating mode with reduced false alarms.FIGS. 10A-10Crelate to performing predictions (e.g., with Markov Chain Monte Carlo (MCMC) methods) to predict what rules are going to trigger in the future (e.g., next week). By determining what rules are going to trigger in the future, recommendations can preemptively be made in terms of programming changes and/or on sight maintenance (e.g., truck roles) in order to suppress false alarms.

FIGS. 7 and 8disclose a method for determining what causes an event sequence and relates different event sequences that arise from similar causes. With these actionable insights in place e.g., the false alarm rules518, prediction of frequency of detected event sequences may be made for a particular building. Making the assumption that conditions remain the same, the prediction model predicts the number of such actionable insights expected. Each set of actionable insights may be modeled separately.

Referring now toFIG. 10A, a process1000A for predicting alarm rules518that will occur in the future by the alarm analysis system310is shown, according to an exemplary embodiment. The process1000A can predict which rules will occur in the future. Based on the historical pattern of the rules, the alarm analysis system310can perform a Bayesian inference to predict how many of the rules are going to fire the following week and subsequently how much the system is going to drift from the normal operations. The alarm analysis system310can be configured to perform the process1000A. Furthermore, any one or combination of computing devices can be configured to perform the process1000A. The process1000A may be performed for a single rule. Therefore, the process1000A can be performed for each of the alarm rules518.

In step1002, the Bayesian predictor520can be configured to generate a Bayesian model specification for a false alarm rule518. The Bayesian model specification may model a likelihood function of the false alarm rule based on one or more priors (e.g., informative priors and/or non-informative priors), hyper-priors (e.g., informative hyper-priors and/or non-informative hyper-priors), parameters, and/or hyper-parameters. An example of a Bayesian model specification and probabilistic programming is shown inFIG. 10Bthat can be used to predict insights for individual building sites or for multiple building sites. Action insights can be predicted for a subsequent week at a site level (single building site) or at a customer level (all building sites of a customer).

In step1004, the Bayesian predictor520can receive historical data for the false alarm rule518. In some embodiments, the Bayesian predictor520receives data indicating when the alarm rule has been triggered and how many times the alarm rule has been triggered in a particular period of time in the past. In step1006, based on the model specification and the historical data of the alarm rule, the Bayesian predictor520can generate a posterior for the alarm rule. The posterior may be a probability distribution for a parameter of the Bayesian model specification based on both prior assumptions for parameter of the Bayesian model specification and the historical data for the parameter.

In step1008, based on the posterior distribution, predictions for the alarm rule can be made for a future period of time. For example, based on the posterior distribution, a frequency of times that the alarm will fire in the future is determined. For example, for a week into the future, the future prediction may indicate a probability distribution may indicate may many times the alarm may occur in the future week.

In step1010, based on the future prediction, the recommendation generator522can generate a recommendation to perform parameter changes, order maintenance, etc. In some embodiments, recommendation generator522may generate an insight based on the recommendation526for the predicted alarm if the alarm is predicted to occur a predefined amount of times in the future. In step1012, the interface system308can provide the insight to the user device314. In some embodiments, the insight may be to adjust parameters or perform maintenance on the security system302a. In some embodiments, if the recommendation for the rule is to update or adjust a parameter, the alarm analysis system310can automatically perform the parameter adjustment.

Referring toFIGS. 10B-10C, Bayesian inference and probabilistic programming for the prediction is shown for predicting outcomes, the outcomes being detected event sequences or, in the alternative, the causes determined from the processes of any ofFIGS. 1-3as giving rise to detected event sequences.

FIG. 10Bshows a model1000B for door delay rules that can be used to model door delay insights. In some embodiment, every false alarm rule518is modeled as a probability distribution. In the example ofFIG. 10B, the door delay rule is modeled as a negative binomial distribution1024. Gamma distributions of prior events (e.g., a gamma priors1020and1022) may be employed for the negative binomial distribution. Uniform distributions1026may be employed as a hyper-priors for parameters of the gamma distributions (hyper-parameters). In one example, when the panels emit signals only during abnormal conditions and there is no insight into what is occurring during normal working hours, based on the data collected, the count of these insights can be modeled as a probability distribution. Using the door delay data1028, arrival at the posterior distribution using Markov Chain Monte Carlo (MCMC) methods is achieved (FIG. 10C). In other words, using the door delay data1028generated according to the methods described herein to obtain information about what cause gives rise to a particular event sequence, one may obtain, from the process depicted inFIGS. 10B-10C, a frequency of such causes to occur in the future1030.

In some embodiments, a Bayesian analysis, e.g., the Bayesian analysis detailed with reference toFIGS. 10A-10C, can be used to perform real-time or post event scoring of alarms. The analysis can identify, based on the false alarm rules518, how many alarms may occur in the future if a recommendation to prevent false alarms is taken by a user and also if the recommendation to prevent false alarms is not taken by the user. In some embodiments, a recommendation can be provided with a confidence score which identifies how likely implementing the recommendation will reduce false alarms.

Referring now toFIG. 11, a block diagram of components of the alarm analysis system310ofFIG. 4are shown configured to determine the false alarm rules518by converting event-series data to enriched time-series data, according to an exemplary embodiment. InFIG. 11, event-series data1102is received from the building subsystems228. The event-series data1102may be events that are generated within the building10by a device of the building subsystems, e.g., an alarm triggering, detecting occupancy in a particular zone, an abnormal temperature fluctuation, a user entering a user ID into a security keypad, a communications error message, and/or any other security, fire, or HVAC related event including those discussed elsewhere herein.

In some embodiments, time searcher1106can be configured to generate the enriched time-series data1112based on a time parameter. The time parameter may act as a time window that filters the event-series data1102to generate the enriched time-series data1112. The time searcher1106can generate the enriched time-series data1112by grouping the event-series data1102by determining events that occur within the time window (e.g., a fifteen minute time window). In some embodiments, the time window is arrived at by performing multiple iterations that testing various value for the time window (e.g., incrementing the time window for each iteration). An example of grouping the event-series data1102based on a time window may be the following. A time window is set to 10 minutes and a first event A that is associated with a time stamp 10:30 A.M. is grouped with a second event B that is associated with a time stamp of 10:35 A.M. However, a third event C associated with a time stamp of 10:57 A.M. is not grouped with the first event A.

The spatial searcher1110can be configured to group the events based on associations between spatial location filter. For example, occupancy detection in a Zone A may be grouped with occupancy detection in a Zone B since the spatial location filter may be configured to group events associated with Zone A and events associated with Zone B. This may be because Zone A and Zone B are located next to each other in the building10. In some embodiments, the spatial searcher1110can include a spatial distance. Events that occur within the spatial distance, i.e., a predefined distance from each other or within a predefined area, can be grouped. However, the value for the spatial window can be iteratively updated until a predefined number of event sequences1118are determined. For example, the spatial distance could start at a low value and be iteratively increased until a predefined number of event sequences1118are determined. Similarly, the time searcher1106could start at a small time window and iteratively increase the time window by a predefined amount until a predefined amount of event sequences1118are determined.

The signature searcher1108can be configured to search the event-series data1102with a signature parameter. The signature parameter can identify events of the event-series data1102that are associated with specific binary patterns. For example, a particular binary pattern may be the signature1114. For example, the signature1114may be used to group particular events together if they fit the pattern of the signature1114.

The enriched time-series data1112can be fed into the sequence analyzer1116. The sequence analyzer1116can be configured to analyze the enriched time-series data1112to generate the event sequences1118. For example, the sequence analyzer1116can be configured to perform a GSP algorithm and/or a Markov Chain Analysis as discussed with further reference toFIGS. 6A and 6B. Furthermore, the sequence analyzer1116can be configured to generate the event sequences1118based on the enriched time-series data1112with various sequence mining algorithms such as Sequential Pattern Discovery Using Equivalence Classes (SPADE), FreeSpan, PrefixSpan, MAPres, etc.

The sequence analyzer1116can be configured to adjust the parameters used by the parameter searcher1104to perform the grouping of the event-series data1102to generate the enriched time-series data1112. The sequence analyzer1116can generate updated search parameters1120and utilize the updated search parameters1120to recursively update the enriched time-series data1112. In this regard, the sequence analyzer1116can iteratively determine the event sequences1118by generating and/or adjusting the updated search parameters1120. The sequence analyzer1116can adjust the update search parameters1120until desired (e.g., optimal) updated search parameters1120are identified by the sequence analyzer1116. For example, the identified search parameters may be search parameters that cause a predefined number of event sequences1118to be identified.

The event sequences1118can be used to generate the false alarm rules518. The alarm analysis system310can present the event sequences1118to the domain expert via the domain expert device510so that the domain expert can accept or reject the event sequences1118as the false alarm rules and provide the recommendation526to each of the false alarm rules518.

Referring now toFIG. 12, a block diagram of components of the alarm analysis system310ofFIG. 4configured to generate parameter updates for building equipment to reduce false alarms is shown, according to an exemplary embodiment. InFIG. 12, historical events1200are shown as inputs to a rule scorer1202. The historical events1200can be events of the building10a, for example, the events may be events of the historical security database512as described with reference toFIG. 4. The historical events1200can be events collected over a day, a month, a year, and/or any other length of time. The rule scorer1202can determine, based on the historical events1200and the false alarm rules518, a recommendation1208. The rule scorer1202can be configured to classify the historical events1200and determine whether a particular false alarm rule of the false alarm rules518applies to the historical events1200. The rule scorer1202can generate the recommendation1208based on the classification.

The recommendation1208may be a recommendation to replace a battery, reposition a sensor, adjust a door delay time, etc. The recommendation1208may be paired with the particular false alarm rule that applies to the historical event1200. An update identifier1212, based on the recommendation1208and the historical events1200, can generate a parameter update1214for the building subsystems of the building10a. The parameter update1214can be an update to a door delay time for an intrusion system, can be an update to a sensitivity level for a vibration sensor which detects intrusions, and/or any other parameter of the building subsystems. The parameter update1214can be pushed to the building equipment for automatic self-healing. In some embodiments, the update identifier1212presents the parameter update1214to an end user for review and approval. In some embodiments, the update identifier1212automatically (e.g., with user pre-approval) pushes the parameter update1214to the building subsystems.

The update identifier1212can be configured to determine an optimal parameter update1214based on the historical events1210and the recommendation1208. The update identifier1212can be configured to perform various statistical and/or machine learning techniques to determine the optimal parameter update214value. Examples of such learning mechanisms may be the metropolitan hasting algorithm, a neural network, a deep neural network, a decision tree, or a Bayesian analysis (e.g., for example the Bayesian analysis described inFIGS. 10A-10C). The recommendation1208may be a recommendation to reprogram a door delay for a particular door. In this regard, the update identifier1212can be configured to generate an updated door delay (the parameter update1214) based on historical events1210associated with the particular door. An example of determining the parameter update1214is shown in further detail with regard toFIGS. 13-14.

Referring now toFIG. 13, three exemplary probability distributions for door delay amounts for a particular door are shown, according to an exemplary embodiment. The probability distributions can be determined by the update identifier1212based on the historical events1200. For example, the probability distributions1300,1302, and1304can be determined as the probability of a user taking a particular amount of time from opening a door to entering in a user identifier (e.g., a personal identifier code (PIC) to cancel an alarm) into a security keypad. As shown inFIG. 13, three different distribution spreads are shown, A, B, and C and medians for each probability distribution1300-1304are shown to be 45 seconds, 32 seconds, and 20 seconds. The update identifier1212can analyze the distribution spread and the median values to identify what value to set the parameter update1214to.

If the distribution spread is less than a predefined amount, the median value of the distribution can be used as the door delay. In distribution1300, the spread A is less than the predefined amount. Therefore, if the update identifier1212determines a distribution such as the distribution1300, the parameter update1214would be the median of the distribution, e.g., 45 seconds as shown the distribution1300.

If the distribution spread is greater than the predefined amount, rather than generating the parameter update1214, the update identifier1212may determine that a parameter update is unnecessary and that user error is responsible for false alarms that may be occurring. For example, users may not be attentive to promptly entering their user ID at the security keypad. Furthermore, this may be indicative of the security access system being poorly located, i.e., it may be too far away from the door or positioned in a location where some users are having a difficult time finding the security keypad when entering the building.

If the distribution is skewed as in the distribution1304, rather than generating the parameter update1214, the update identifier1212may determine that a parameter update is unnecessary and that users are using the wrong door of the building10a. In this regard, the update identifier1212can be configured to generate a recommendation to improve user training. For example, users may not understand which doors they should be entering through.

Referring now toFIG. 14, a process1400for determining the parameter update1214for a door delay is shown, according to an exemplary embodiment. The process1400can be performed by the alarm analysis system310and/or the systems described inFIG. 12(e.g., the update identifier1212). The process1400can be performed after a door delay event sequence has triggered, e.g., a specific false alarm rule518for door delays. Performing the process1400after detecting the false alarm rule518may provide a specific recommendation for reducing false alarms associated with door delays. For example, a sequence of events for a door delay may be a user opening a door at a particular time in the morning motion being detected in a particular zone, an alarm being generated due to a door delay, and a user entering a PIC in a security keypad could be a door delay event sequence.

In step1402, the update identifier1212can be configured to generate a probability distribution for a door delay based on historical event data. Based on the probability distribution, the update identifier1212can generate a spread for the probability distribution. The spread value used to analyze the probability distribution may be a variance or standard deviation.

In step1404, the update identifier1212can compare the spread to a predefined threshold. If the spread is not greater than the predefined threshold, the update identifier1212can perform the step1406. If the spread is greater than the predefined amount, then the update identifier1212can perform the step1408. In step1406, the update identifier1212can generate the parameter update1214to be the median value for the door delay distribution generated at the step1402.

If the spread is greater than the predefined threshold, the process1400can move to step1408. In the step1408, the update identifier1212can generate a recommendation to change a door delay system associated with the door delay distribution. The recommendation may be to relocate the key in pad to be closer to the door or in a more visible location. Furthermore, the recommendation may be to improve the training of users who are punching into the key in pad.

Referring now toFIG. 15A, a block diagram of components of the alarm analysis system310ofFIG. 4configured to generate recommendations for false alarm reduction based on a classifier1508, according to an exemplary embodiment. With the false alarm rules518, a model can be used to determine which alarm rules518have been triggered. The model can be implemented with a classifier1508which can be a neural network, a deep neural network, a decision tree, etc. The model can be formalized as the following equation,
Y=F(x)  (Equation 11)
where Y is an identified false alarm rule of the false alarm rules518, x represents historical events or other data (e.g., the site features1506), and F(⋅) is an n classifier configured to identify the false alarm rule Y.

InFIG. 15A, the classifier1508is shown to take site features1506, real-time events1500, historical events1502, and false alarm rules518as inputs and generate the triggered false alarm rule1510as an output. The triggered false alarm rule1510can be a particular false alarm rule of the false alarm rules518selected by the classifier1508based on the inputs. The triggered false alarm rule1510that can be identified by the classifier1508may be dependent on the false alarm rules518.

The classifier1508can be a trained model configured to take multiple inputs to generate the triggered false alarm rule1510. In some embodiments, the classifier1508is a neural network classifier (e.g., a deep neural network), a Naïve Bayes model, a Logistic Regression, a Decision Tree, a Support Vector Machine (SVM), a Random Forest, and/or any other model or machine learning technique that can be used in classification. The triggered false alarm rule1510can be an identification of one of the false alarm rules518. Based on the identified false alarm rule518, the alarm analysis system310can generate a real-time recommendation1512and/or an offline recommendation1514.

The real-time recommendation may be a recommendation generated based on real-time event data, i.e., the real-time events1500. In this regard, as data is collected for the building10a, the classifier1508can be operated to identify whether false alarm rules518are triggered. This can allow an end user to quickly respond to perform actions that will prevent false alarms before they ever occur. In some embodiments, the classifier1508can determine that three sequential events are indicative of a false alarm occurring. In this regard, if the first event and then the second event occur, or the first event, then the second event, and then the third event occur, the classifier can identify the triggered false alarm rule1510to generate the real-time recommendation1512. Furthermore, instead of analyzing the real-time events1500(or in addition to analyzing the real-time events1500) the classifier1508can analyze historical event sequences1502. The historical event sequences1510can be a database of events that has occurred in a previous predefined amount of time. Based on these historical event sequences1502, one or multiple triggered false alarm rules1510can be determined by the classifier1508for determining the offline recommendation1514.

Referring now toFIG. 15B, a block diagram of components of the alarm analysis system310ofFIG. 4configured to classify event sequences1118as false alarms is shown, according to an exemplary embodiment. InFIG. 11,FIG. 9A, andFIG. 9B, rules are surfaced for a domain expert to classify and provide insight for the particular rule. However, rather than relying on a domain expert to provide contextual information (e.g., a false alarm reduction recommendation) for an identified event sequence1118, the alarm analysis system310can utilize the classifier1508to classify the event sequences1118into particular predefined false alarm rule categories associated with predefined false alarm reduction recommendations.

As shown inFIG. 15B, rather than the classifier1508receiving the false alarm rules518to classify for generating a recommendation, the classifier1508ofFIG. 15Breceives the event sequences1118generated by the sequence analyzer1116. The classifier1508can be a categorical classifier configured to classify the event sequence1118as a particular type of false alarm rule, e.g., one of the false alarm rule518a,518b,518c, and/or518d. Each of the false alarm rules518a-518dmay be a particular false alarm rule that a domain expert may generate and add contextual information for (e.g., the recommendations526a-526d). The false alarm rules518a-518dcan be false alarm rules generated by the process900ofFIGS. 9A-9Bwhere the domain expert device510provides contextual information. However, once these categorical false alarm rules are established, subsequent event sequences1118can be classified under one of the already generated false alarm rules.

In some embodiments, the classifier1508analyzes the particular sequence of events of the event sequences1118to identify which false alarm rule518a-518dthe event sequence1118should be classified as. However, in some embodiments, additional information can be used to perform the classification such as site features1506, real-time events1500, and/or historical event sequences1502.

Referring now toFIG. 16, a false alarm rule sequence for low battery detection rule1600is shown, according to an exemplary embodiment. The false alarm rule1600may be one of the false alarm rules518. The false alarm rule1600can be a sequence of events that describes a false alarm that results from a low battery. The false alarm rule1600includes three specific events for a particular piece of building equipment, an Alternating Current (AC) power failure event, a Low Battery (LB) event, and a Replace Low Battery Event (RELB). The building equipment can include a main AC power source with a supplemental battery backup. The building equipment can be powered via the AC power source when the AC power source is available and via the supplemental battery backup when the AC power source is unavailable.

The first event of the false alarm rule sequence1600is the AC power failure event for the piece of building equipment. After the AC power failure event, the building equipment begins to operate based on the supplemental battery backup. Then, a first predefined amount of time after the AC power failure event, a second event, the LB event occurs. This event may be the building equipment generating a low battery notification. After a second period of time, the RELB event may occur indicating that a low battery needs to be replaced.

After the AC power failure event, the building equipment may be at an increased risk of creating a false alarm event. The battery may be discharged before a user can replace the battery or before a user is aware that the battery needs to be replaced. However, the systems and methods discussed herein can generate a recommendation that notifies an end user that a battery needs to be replaced within a particular time window. Every type of building device and battery may be unique, therefore, there may not be one single time window. Therefore, the systems and methods discussed herein can identify an optimal window for replacing the battery of the building equipment and generate and push a work order to a technician to replace the battery within the optimal window.

Referring now toFIG. 17, a battery replacement window probability distribution1700is shown, according to an exemplary embodiment. The distribution1700can be a distribution which identifies the optimal time from when an AC power failure event occurs that the battery should be replaced. In some embodiments, the probability distribution is generated based on historical data that indicates a time period between the AC power failure event and the LB event. It may be optimal practice to change the battery of the building equipment before the LB event occurs. In some embodiments, the distribution1700is further based on a particular type or characteristics of the battery that needs replacing and/or the install date of the battery.

In some embodiments, the median of the distribution may be the optimal time window to use in replacing the battery. However, since every battery has its own charge amount, discharge rate, and the equipment which the battery powers can cause the battery to discharge at varying amounts, the distribution1700, since generated from historical data specific to the building equipment.

Referring now toFIG. 18, a process1800for detecting a false alarm rule sequence and generating a recommendation to replace the battery is shown, according to an exemplary embodiment. The process1800can be performed by the alarm analysis system310ofFIG. 5A. Furthermore, any computing device described herein can be configured to perform the process1800.

In step1802, the alarm analysis system310can detect a false alarm sequence for battery replacement, e.g., the false alarm rule1600ofFIG. 16based on historical and/or real-time data. In some embodiments, detecting the false alarm rule1600triggering includes identifying that the AC power failure event has occurred for a piece of building equipment.

In step1804, the alarm analysis system310can generate a battery life probability distribution identifying the probability of times between the AC power failure event and the LB event. It may be desirable that the battery be replaced before the LB event following the AC power failure event. In some embodiments, the distribution is a prediction performed with a machine learning technique e.g., Bayesian modeling, Metropolis Hastings Algorithm, etc. In some embodiments, step1804is performed in response to the step1802being performed. In some embodiments, the step1804is performed prior to the step1802occurring such that machine learning can be performed prior to the AC power failure event occurring since the machine learning used to generate the distribution1700may require a predefined amount of time to occur.

In step1806, the alarm analysis system310can select an optimal time window for replacing the battery. In some embodiments, the time window is determined from the distribution1700. For example, the median value of the distribution1700may be used as the time window for replacing the battery. In some embodiments, the time window, A is modified via an offset. For example, the time window A can be offset by a value B, e.g., A±B. In some embodiments, B is a predefined offset. In other embodiments, B is a standard deviation or variance of the distribution1700. In some embodiments, the offset may be applied as A−B to provide an overhead amount of time to account for error and reduce the likelihood that the LB event occurs before the time A expires. In step1808, the alarm analysis system310can generate a recommendation to replace the battery within the identified time window as determined in the step1806.

In some embodiments, the time window is based on parameters of the battery. For example, the alarm analysis system310may consider battery life. Based on an installation date and/or time (or battery replacement date and/or time) and a current date and/or time, the alarm analysis system310can determine the time window. Furthermore, the alarm analysis system310can be configured to utilize characteristics of the equipment to identify the time window. For example, based on a model number, the alarm analysis system310can identify characteristics of the equipment that relate to how quickly the battery of the equipment discharges. For example, power requirements of the equipment can be used to identify the time window that the alarm analysis system310can identify based on the model number of the equipment. In this regard, the time window determined based on historical data can be adjusted based on the age of the battery and/or characteristics of the equipment.

Furthermore, the time window can be based on historical data of similar equipment and/or similar battery age. For example, the alarm analysis system310can select relevant historical equipment battery life data (e.g., data that pertains to batteries of similar capacities as the battery in question, similar equipment characteristics of the equipment in question, etc.) and then identify the time window based on the relevant historical data. The alarm analysis system can be configured to generate a probability distribution for relevant historical data and analyze the probability distribution to generate the time window.

Referring now toFIG. 19, a false alarm rule sequence for motion sensors1900is shown, according to an exemplary embodiment. The false alarm rule1900may be one of the false alarm rules518. The false alarm rule1900can be a sequence of events that describe a false alarm that occurs during the opening and/or closing of a building. The false alarm rule1900includes three specific events, a burglar alarm (BA), followed by motion detected in a first zone (IR1) and motion detected in a second zone (IR2). Such a false alarm rule1900may be indicative of a burglar alarm, e.g., a door being opened, followed by motion being sensed in neighboring zones, i.e., Zone 1 may lead into, or be connected to, Zone 2. This may be an example third order sequence that can be determined by a GSP analysis and/or a third order Markov Chain analysis. If the false alarm rule1900triggers at a particular time of day, e.g., at an opening time of the building, the BA may be a false alarm event since a user may simply be opening up the building and walking through the building to an alarm panel or clock in station. In this regard, the alarm analysis system310can detect the alarm rule sequence1900and generate an appropriate recommendation to reduce false alarms from occurring at an opening or closing time.

Referring now toFIG. 20, a process2000for detecting the false alarm rule sequence1900and generating a recommendation to reposition a BA sensor is shown, according to an exemplary embodiment. The process2000can be performed by the alarm analysis system310ofFIG. 5A. Furthermore, any computing device described herein can be configured to perform the process2000. In step2002, the alarm analysis system310can determine whether the false alarm rule1900has triggered in the past or has occurred in real-time. The alarm analysis system310can analyze historical events to determine whether the events trigger the false alarm rule sequence1900, In some embodiments, the alarm analysis system310stores the opening and/or closing times of the building10a. Therefore, the alarm analysis system310may look for the false alarm sequence1900to occur at the opening and/or closing time. For the opening time, the sequence may be BA Event, IR 1, followed by IR2. However, for the closing time, the sequence may be IR2, IR1, followed by the BA Event.

In step2004, alarm analysis system310can generate a recommendation to reposition the building sensor associated with the BA event. The BA event may be an event that occurs when an occupant opens a building in the morning and, thus, should not have triggered. This may be indicative of the building sensor being improperly installed. Therefore, the recommendation may be to send a technician to reposition the sensor to prevent the false alarm from occurring in the future. In step2006, the generate recommendation of the step2002can be provided to an end user for review. In some embodiments, the alarm analysis system310can automatically generate a work order to cause a technician to reposition the improperly installed sensor.

Referring now toFIG. 21, a false alarm rule anti-sequence for an expansion module2100is shown, according to an exemplary embodiments. The false alarm rule2100illustrates a sequence of two events that indicates an expansion module failing followed by the expansion module recovering within a time window. Therefore, the rule sequence2100is a sequence of events that indicates a time window, that, if the expansion module recovers within, no technician dispatch is required. However, if the expansion module does not recover within the time window, a technician dispatch may be required since the error which the expansion module is experiencing may not be temporary but rather may be that the expansion module is broken. The false alarm rule2100can be considered an “anti-sequence,” i.e., if the expansion module fails and the expansion module does not restore itself within the time window (e.g., 12 hours), a technician needs to perform maintenance on the expansion module. The alarm analysis system310can be configured to determine the time window based on historical data for one or multiple expansion modules. The historical data may be data that forms the pattern of events shown inFIG. 21.

InFIG. 21, a first event, an expansion module failure event, occurs. This event is followed by a no expansion module failure event, i.e., the expansion module2202coming back online automatically. Based on historical data, if the false alarm rule2100is detected, a threshold time window can be determined. If the expansion module does not come back online within the threshold time window, the alarm analysis system310can generate a recommendation to replace or perform maintenance on the expansion module2202.

Referring now toFIG. 22, zones of the building10aand an expansion module2202for servicing zones of the building10athat a security panel2200cannot service, according to an exemplary embodiment. InFIG. 22, the zones 1-6 are shown for the building10a. Each of the zones 1-6 can have various security devices, e.g., motion sensors, alarms, etc. The devices for the zones 1-4 can communicate to the security panel2200. The security panel2200may analyze data received from the devices of the zones 1-4 and further send the data to the alarm analysis system310. The security panel2200may only be able to service a particular number of zones. Therefore, the expansion module2202can be used with the security panel2200to service the systems of additional zones, e.g., zone 5 and zone 6.

Referring now toFIG. 23, a process2300is shown for generating a recommendation to perform maintenance on an expansion module if the expansion module fails to automatically restore itself within a time window is shown, according to an exemplary embodiment. The process2300can be performed by the alarm analysis system310ofFIG. 5A. Furthermore, any computing device described herein can be configured to perform the process2300. In step2302, the alarm analysis system310can detect an expansion module failure event for an expansion module, e.g., the expansion module2202.

In step2304, the alarm analysis system310can determine a time window based on historical data which indicates a period of time that, if the expansion module2202does not automatically restore itself within, requires a technician to perform maintenance on the expansion module2202. In some embodiments, the time window can be provided to the CSAM so that the CSAM can adjusted or override the time window. The historical event data can be used by the alarm analysis system310to identify the time window. The historical data may indicate how long it takes in various instances for the expansion module2202for the expansion module2202to automatically come back online. The historical data may meet the pattern of the false alarm rule anti-sequence2100. In some embodiments, the alarm analysis system310determines a probability distribution of times between which the no expansion module failure event occurs and the expansion module2202automatically recovers. In this regard, the alarm analysis system310can select a median value of the distribution and use the median value (e.g., the median value plus or minus an offset), as the time window within which the expansion module2202must automatically recover or otherwise a recommendation should be generated for a technician to replace or repair the expansion module2202.

In the step2306, the alarm analysis system310can generate a recommendation to repair the expansion module2202(or replace the expansion module2202) if the expansion module2202does not automatically recover within the time window determined in the step2304. In some embodiments, a work order is automatically generated with the recommendation and provided to a service technician who can respond to the recommendation.

Referring now toFIG. 24, a false alarm rule sequence for employee alarm trips2400is shown, according to an exemplary embodiment. The false alarm rule sequence2400may indicate that an Open/Close (O/C) Burglar Alarm (BA) event occurs for a first zone of the building10a. This event may be followed by a zone bypass event for the same first zone. After a predefined amount of time elapses, e.g., 120 seconds, a restore event occurs.

Referring now toFIG. 25, a process2500is shown for detecting the false alarm rule sequence for employee alarm trips sequence2400, according to an exemplary embodiment. The process2500can be performed by the alarm analysis system310ofFIG. 5A. Furthermore, any computing device described herein can be configured to perform the process2500. In step2502, the alarm analysis system310can determine whether the false alarm rule sequence2400has occurred. In some embodiments, the alarm analysis system310determines whether the alarm rule sequence2400occurs within a particular time, e.g., an opening time of the building10a. If the sequence2400occurs during the opening time (e.g., a time window between 8:50 A.M. and 9:10 A.M. on a weekday), this may be indicative of a sequence of events that can cause a false alarm. However, if the sequence of events occurs outside the opening time, the alarm analysis system310may determine that the sequence relates to a true alarm.

In step2504, the alarm analysis system310can generate a recommendation that an employee with an incorrect password is opening the building10aand that better employee training or scheduling needs to be implemented. In step2506, the alarm analysis system310can provide the recommendation to an end user. In some embodiments, the recommendation is provided to a shift manager or other supervisor who can better inform employees or adjust employee opening schedules so that an employee with a correct password is opening the building10a. In some embodiments, the employee schedule may be automatically generated by a computing device, therefore, the alarm analysis system can cause the employee schedule to be generated such that the employee with the incorrect password is not scheduled to open the building. Furthermore, the alarm analysis system310can generate a correct password for the employee and provide the new correct password to the employee.

Referring now toFIG. 26, a block diagram of components of the alarm analysis system310ofFIG. 4configured to generate recommendations for suppressing false alarms is shown, according to an exemplary embodiment. InFIG. 26, a recommendation2600is provided to the recommendation filter2602and/or the approver2604. The recommendation2600can be a recommendation generated by the systems and methods discussed with further reference toFIG. 4andFIG. 11.

The recommendation filter2602can apply one or multiple rules to the recommendation2600to determine whether to implement the recommendation2600automatically, or require user approval for the recommendation. For example, the recommendation filter2602can include a list of recommendations that do not require user approval. For example, a door delay update recommendation2600, a recommendation2600to perform a system self-test may not require user approval (although a warning of the self-test may alert a user of the self-test in advance of the self-test occurring (e.g., a twenty four hour warning)), generating a work order to reposition a system sensor may not require user approval. In some embodiments, the list of allowed user recommendations for automatic implementation is customizable. Therefore, a user can set and update the list so that the rules they would like automatically implemented are automatically implemented but the rule they would like to review before implementing they are able to review. If the recommendation filter2602determines that the recommendation2600does not require user approval, the recommendation filter2602can provide the filtered recommendation, an automatically implemented recommendation, to the work order generator2614and/or the automatic updater2610.

In some embodiments, the recommendation filter2602only allows recommendations to make parameter changes within a predefined range. For example, the recommendation filter2602may cause a door delay to remain within an upper and lower bound. The upper and lower bound may be defined by a regulatory requirement. Furthermore, the recommendation filter2602may have a user approved range. If the recommendation is to make a parameter change outside the user approved range, the recommendation, even though automatically allowed by the user, may require the end user to review the recommendation if the parameter change is outside the user approved range.

The recommendation filter2602can be configured to provide the recommendation2600to the user device314in response to determining that the recommendation2600requires user approval. The approver2604can generate an interface prompting the user of the user device314to either accept or reject the recommendation2600. For example, the interface may be the same and/or similar to the interface shown and described inFIG. 27. The user can accept the recommendation2600and in response to the user accepting the recommendation2600, the approver2604can cause the recommendation filter2602to provide the recommendation2600, a user approved recommendation, to the work order generator2614and/or the automatic updater2610.

Some types of recommendations2600the recommendation filter2602can provide to the automatic updater2610. These type of recommendations may include a recommendation to make a parameter or programming change to the building subsystems228. However, other recommendations may require a maintenance technician to implement the recommended change. These types of recommendations the recommendation filter2602can provide to the work order generator2614so that a work order2616can be generated and provided to the technician device2618.

The work order2616may be a work order to service the building subsystems228. The work order2616can identify the change that should be made to the building subsystems228, what parts should be brought along to the site etc. The parts that need to be brought along to the site may be based on the recommendation2600. For example, if the recommendation2600is to change batteries for a sensor, the work order2616may indicate the type of batteries that the sensor takes. If the recommendation2600is a recommendation to reposition a ceiling mounted sensor, the work order2616can include a reminder to bring a ladder to the building10a. In this regard, the work order generator2614can be configured to analyze the recommendation600and identify any required material that is required for performing the maintenance on the building subsystems228.

In some embodiments, the work order generator2614is configured to assign the work order2616to a technician group based on the recommendation2600. The work order generator2614can be configured to assign the work order based on technology specialty. For example, the work order generator2614can be configured to classify the recommendation2600as a recommendation to perform maintenance on HVAC devices, security devices, or building network services. In this regard, based on the classification of the recommendation2600, the work order generator2614can automatically assign the work order2616to the appropriate technician group and push the work order2616to a technician device2618associated with the technician group.

In some embodiments, the work order generator2614receives a truck location signal from one or more technician trucks identifying the location of each of the technicians. The work order generator2614can determine, based on the recommendation2600, whether special skill is required for performing the maintenance. For example, special skill may not be required to replace a battery on a security sensor. Therefore, a technician who specializes in HVAC might be assigned the work order2616instead of a technician who specializes in security systems if the HVAC technician is determined, by the work order generator2614, to be located a predefined amount closer to the building10athan the security technician.

The automatic updater2610is shown to receive the recommendation2600from the recommendation filter2602. The recommendation filter2602can be configured to determine whether the recommendation2600can be implemented automatically, i.e., by the building subsystems228themselves, and provide the recommendation2600to the automatic updater2610instead of (or in addition to), the work order generator2614. The automatic updater2610can be configured to interface with the building subsystems228and communicate implementation details of the recommendation2600to the building subsystems228. For example, if the recommendation2600is to perform a system restart on a piece of equipment of the building subsystems228, the automatic updater2610can be configured to communicate to the specific piece of building equipment (or to the devices that control the specific piece of building equipment), and cause the specific piece of building equipment to perform the restart. Furthermore, for a parameter change, the automatic updater2610can be configured to determine that the recommendation2600is a recommendation to change a parameter and includes the new parameter value. The automatic updater2610can push the new parameter value to the building subsystems228and cause the building subsystems228to operate with the new parameter value.

The parameter update interface2700is shown to include a description window2702describing a particular recommendation. In the interface2700the recommendation is a recommendation to reprogram a door delay value for a specific door of the building10a. The end user can review the recommendation and select the yes button2704, the no button2706, or a button to add the specific recommendation to an approved automatic update list. The approved automatic update list may be one of the filter parameters of the recommendation filter2602by which the recommendation filter2602determines whether user review and approval is required from the user device314to implement the recommendation600. The add to automatic update list button2708can cause the recommendation2600, or a brief description of the recommendation2600to be added the approved automatic update list2710. The approved automatic update list2710can be a list including one or multiple types of recommendations that the user has granted pre-approval so that the user does not need to respond manually to each new recommendation2600.

Referring now toFIG. 28, a process2800is shown for analyzing hardware failures for the building10a, according to an exemplary embodiment. The process2800can be performed by the alarm analysis system310ofFIG. 4. Furthermore, any computing device described herein can be configured to perform the process2800. In step2802, the alarm analysis system310can analyze historical data for the building10aand determine whether there are any sequences of events within the historical data that correlate to sequences of events indicative of a piece of building equipment failing or potentially failing in the future.

In step2804, the alarm analysis system310can generate a maintenance recommendation indicating that the building component has failed or will fail. The maintenance recommendation may be a recommendation indicated by a particular sequence of events. In step2806, the alarm analysis system310can generate a work order for the maintenance recommendation and provide the work order to a technician based on a technician skill area, a technician schedule, and/or a technician location. In this regard, the work order can be assigned to a technician who is skilled in the technology necessary for performing the maintenance. Furthermore, the technician schedule may be taken into account. In some embodiments, a criticality level of the maintenance is analyzed with the technician schedule such that for a highly critical maintenance task, the most available technician is assigned the work order. For a low priority maintenance task, a technician who has an availability in the future, but not immediate availability, may be selected. Furthermore, location can be utilized in selecting the technician so that a technician who is nearby can be assigned the work order instead of a technician that is far away.

In some embodiments, the selection of a technician is formalized as an optimization problem by the alarm analysis system310. For example, an objective function which describes assigning the work order to each of the technicians can be used. Various constraints, e.g., equality constraints or inequality constraints can be used to optimize the objective function. An equality constraint could be that for a particular work order, the sum of participation of each of multiple technicians is one where the participation of each technician is indicated by a one or a zero. This may cause the optimization to select only one of the technicians. An inequality constraint might be, that for a particular work order, a technician that can respond within a predefined amount of time is selected. This may verify that the most optimal technician is selected to perform the work order.

In step2808, in some embodiments, the alarm analysis system310can send feedback to the building component manufacturer. The feedback may indicate that certain events cause the building components to fail or particular groups of building components to fail. In this regard an insight could be that a group of building components all fail together so that if one of the building components of the group fails, all of the components of the group should be replaced. This may aid the manufacturer is generating maintenance recommendations and instructions for performing maintenance and service on the building components that the produce.

Referring now toFIG. 29, a process2900for reducing the number of unnecessary police dispatches for the building10ais shown, according to an exemplary embodiment. The process2900can be performed by the alarm analysis system310ofFIG. 5A. Furthermore, any computing device described herein can be configured to perform the process2900.

In step2902, the alarm analysis system310can receive historical data indicating security calls from a security operator to the building10. The historical data may indicate which calls were missed calls and which missed calls resulted in a police dispatch. When a building alarm occurs, a security operator may place a call to a building site to determine whether to send a police dispatch to the building. If no building occupants pick up the phone of the building10aand speak with the security operator to indicate that there is no emergency, the security operator may initiate a police dispatch of a police officer to the building10a.

In step2904, the alarm analysis system310can determine how many police dispatches occurred in response to a false alarm and no occupant of the building10aanswering a call from the security operator. If the number is greater than a predefined amount, in step2906, the alarm analysis system310can generate a recommendation to train building personal to properly answer calls from a security operator and, in step2908, can provide the recommendation to an end user for review. In some embodiments, the recommendation may include statistics e.g., the rate at which security calls are being missed, a trend of the number of security calls missed over time, etc.

In some embodiments, the alarm analysis system310can perform a historical data analysis to identify call tree changes. A call tree may be a sequence of calls that are placed between various security personal, building managers, police departments, etc. that occur in response to an alarm being detected. In some embodiments, alarm analysis system310can generate a recommendation to adjust a call tree. For example, the alarm analysis system310can analyze historical data for various call trees of various buildings (e.g., the buildings10a-d) and identify how the performance of the particular building and its particular call tree compares to buildings with different call trees or buildings with similar call trees.

For example, if the performance of the particular call tree of the particular building is poor but for other buildings using the same call tree, the performance is good (e.g., not resulting in a predefined amount of police dispatches for a false alarm), the alarm analysis system310may generate a recommendation to train personal since there may not be a problem with a call tree structure but rather with the training of particular personnel of the call tree. However, in some embodiments, the comparison may indicate that that other call trees of other buildings may work better than the call tree for the particular building. In this regard, the alarm analysis system310can generate a recommendation to adjust the call tree structure to be similar to the other buildings.

For example, the call tree structure of the particular building may be that remote security personnel calls on-premises security personnel in response to an alarm occurring at the building. This call tree structure may perform poorly for the building. However, another call tree structure for a different building may be that remote security personnel calls a building manager in response to the alarm occurring at the different building. This call tree may perform well for the other building. The alarm analysis system310can recommend that the particular building adopt the call tree structure of the other building.

Referring now toFIG. 30, a process3000for detecting ground faults for building components of the building10aand generating a recommendation to perform maintenance on the building components based on the detected ground faults is shown, according to an exemplary embodiment. The process3000can be performed by the alarm analysis system310ofFIG. 4. Furthermore, any computing device described herein can be configured to perform the process3000.

In step3002, the alarm analysis system310can generate a ground fault time window based on historical data for the building10. In some embodiments, the alarm analysis system310can analyze historical data to identify that a predefined number of ground faults occurring within a predefined period of time indicates that a particular piece of building equipment associated with the ground fault has failed and requires maintenance. The predefined number of ground faults may be used by the alarm analysis system310as a ground fault threshold.

In step3004, the alarm analysis system310can analyze data, e.g., either historical data or real-time data, to determine a number of actual ground faults occurring for a building component of the building10. In step3006, the alarm analysis system can determine whether the number of actual ground faults is the same as or greater than the ground fault threshold and whether the actual ground faults occurred within the ground fault time window. In response to determining that the actual ground faults is greater than or equal to the ground fault threshold and have occurred within the time window, the alarm analysis system310can generate a recommendation to perform maintenance on the building component (step3008). In some embodiments, the recommendation can be used to generate a work order and automatically dispatch the work order to a technician to perform maintenance on the building component (step3008).

Referring now toFIG. 31, the dashboard generator524ofFIG. 4is shown in greater detail, according to an exemplary embodiment. The dashboard generator524can be configured to generate the interfaces ofFIGS. 37-51and the various components shown within the interfaces ofFIGS. 37-51. The dashboard generator524is shown to include an executive summary generator3104, a forecast generator3118, a recommendation generator3112, a work order generator3110, a profile score generator3108, an alarm generator3114, a heat map generator3116, a trend generator3106, and an interfacer3120.

The executive summary generator3104can be configured to generate an executive summary interface. The executive summary interface may be an interface e.g., the interface3700ofFIG. 37and/or the interface4200ofFIGS. 42-43. The executive summary generator3104can generate a “todo” meter indicative of the current number of false alarm reduction recommendations for the building10a. Furthermore, the executive summary generator3104can be configured to generate the executive summary interface to include an alarm trend indicating the alarms (e.g., alarms addressable by the false alarm rules518) for the building10aor other buildings over time. The trend can be generated by the trend generator3106.

In some embodiments, the alarm trend indicates a number of addressable false alarms or a number of false alarms. For example, the trend may indicate a number of addressable false alarms that the trend generator3106can be configured to determine the number of addressable false by determining a number of triggered false alarm rules518and indicating the number and type of the triggered false alarm rules518. In this regard, if five false alarms were determined that could be prevented based on door delay updates as can be determined via the false alarm rules518, the trend could indicate the five false alarms that can be prevented via door delay updates.

In some embodiments, an addressable false alarm is a triggered false alarm rule518. In some embodiments, an addressable false alarm is an alarm attributable to a triggered false alarm rule518. For some types of false alarm rules518, the false alarm rule518triggering indicates an addressable false alarm. For other types of false alarm rules518, the false alarm rule518triggering may indicate that there is a group of false alarms that have occurred that are associated with the triggered false alarm rule518and are addressable.

The work order generator3110can be configured to generate and present work orders to an end user and/or technician. The work order generator3110can be configured to maintain a list of work orders and provide work order details to a user upon user request. The work order generator can be configured to generate the work orders window4302and/or the work order interface4800. In some embodiments, the work order generator3110can be configured to generate a work order for each of the addressable false alarms. For example, for every false alarm rule518that triggers, a false alarm may be addressable. Based on a recommendation526for the false alarm rule518, the work order generator3110can be configured to generate a corresponding recommendation. In some embodiments, the work order generator3110only generates for orders for recommendations526that cannot be automatically implemented, i.e., for recommendations that require manual maintenance or repair of building equipment.

The recommendation generator3112can be configured to generate interfaces presenting a user with false alarm reduction recommendations for reducing false alarms in the building10a. The recommendation generator3112can be configured to generate the parameter update interface2700and/or the recommendation interface4600ofFIG. 46. The alarm generator3114can be configured to generate an alarm interface e.g., the alarm interface4400ofFIG. 44. The alarm generator can be configured to record alarms and generate a list of alarms and a potential recommendation for preventing the alarm from occurring in the future if the alarm is a false alarm.

The heat map generator3116can be configured to generate a heat map indicating where alarms for a particular building of an entity are occurring. For example, the heat map generator3116can generate the interface4900ofFIG. 49where particular geographic areas are colored different colors based on the number and severity of alarms that are occurring at particular building sites of the entity. The map generator3116can be configured to allow a user to view zoomed in map view, e.g., the interfaces2400and2500ofFIGS. 24-25, where a user can view the alarms occurring at particular building sites.

The forecast generator3118can be configured to generate a forecast of the number and type of alarms that will occur in the future. The forecast generator3118can be configured to generate a predicted number of false alarm events that will occur in the future if a particular recommendation for preventing false alarms is implemented. Furthermore, a predicted number of false alarm events that will occur in the future if the particular recommendation is not implemented can be generated. The forecast generator3118can be configured to generate the forecast4304indicating predicted work orders, alarms, and/or police dispatches that may occur a predefined amount of time into the future (e.g., a week, a month, a year, etc.).

The interfacer3120can be configured to communicate the interfaces generated by the dashboard generator524to the user device314. In some embodiments, the interfacer3120is a backend system for a mobile application installed and run on the user device314. In some embodiments, the interfacer3120can generate a web based interface for a user of the user device314to log into via a web browser application of the user device314. The interfacer3120can generate the interfaces for display on mobile devices, e.g., cell phones and/or tablets, in addition to desktop computers and laptops.

The profile score generator3108can be configured to generate a profile score for the building10aand surrounding buildings, geographic regions (e.g., east coast, west coast, etc.), states (e.g., New York, Massachusetts, Ontario, Nova Scotia, Centre-Val de Loire, etc.), cities (e.g., Chicago, Las Angeles, etc.) and/or any other area or building. Profile score generator3108can be configured to generate a risk score for the building10a. This risk score can allow an owner or operator of the building10ato determine how well false alarms are being managed in the building10a.

For a particular building10aor for a group of buildings10a-10downed and operated by a particular entity, a risk score can be generated. The risk score may be that for a particular period of time, the total number of addressable alarms divided by the total number of alarms in the particular period is the risk score. For example, for a building10aor a particular entity, the addressable alarms that can be addressed via the recommendations generated by the alarm analysis system310, if the addressable alarms during a particular period is 30% of the total alarms, then the building10aor the entity is managing 30% of their risk.

For a particular building that is not addressing alarms via the alarm analysis system310, the risk score for that building would be 1. The profile score generator3108can be configured to generate risk scores for individual sites, can develop a risk index for countries, states, and/or geographic regions (e.g., eastern, central, mid-west, pacific), can compare a risk score for a particular site (e.g., the building10a) with the risk index, identifying neighboring building sites and compare the risk scores of the building sites, and/or compare risk scores for any and all building sites and/or entities.

The profile score generator3108can receive system data from the system data3100database and use the system data to determine the risk scores and risk profiles. The system data can include a number of alarms raised of the particular building state during a particular time period, a number of addressable alarms during the particular time period. The risk score generated by the profile score generator3108can be based singularly on the system data3100, e.g., based on the addressable alarms and the total alarms but can, in some embodiments, be based on area of crime statistics associated with the area of operation of a system. The number of addressable alarms that occur within a particular period of time can be broken can be broken into various categories as defined by the alarm rules518.

The profile score generator3108can compare a score for the building10aagainst neighboring buildings and/or further against risk indices for countries, states, and/or regions. However, the profile score generator3108can be configured to determine to compare building site against each other based on their size or business category (e.g., grocery store, cell phone store, jewelry store, etc.) so that like sites are compared. To identify related sites, the profile score generator3108can be configured to analyze business type, site latitude, site longitude, system type, number of ones in the building (can be derived from a user_id events table), number of users in the building, number of doors in the building (e.g., can be derived from open/close events and zone IDs from an events table), and/or the hours of operation of the building.

In some embodiments, the similarity score can analyze distance between sites to determine whether the sites are related. Based on a latitude and longitude values for the two sites, both a Euclidean distance and an arc distance can be determined (e.g., via GeoDistance function of Mathematica, R, or Python). In some embodiments, the arc distance and/or Euclidean distance are scaled (e.g., scaled by 10, 100, 1,000, etc.). For example,

A final distance for identifying related sites can be,
Final Distance=Arc Distance+Normalized Euclidean Distance  (Equation 13)
where the Normalized Euclidean Distance is a vector scaled to a unit norm.

System types can be compared for the systems via a system type function which takes in a categorical variable for a particular system and identifies whether it matches the relevant system type. For example,
Related Variable(0 or 1)=System Type Function(Categorical VariableSystemi)  (Equation 14)

The score generator3108can determine whether the systems are related based on the final distance, the arc distance, the Euclidean distance, the normalized Euclidean distance, the system types, the number of zones in each site, the number of users in each site, and the number of doors in each site, the score generator3108can determine whether the sites are related.

In some embodiments, the dashboard generator524can be configured to receive cost and fine information associated with false alarms and generate savings information indicative of the amount of money saved by performing false alarm reduction recommendations and insights. A user may input the cost of a false alarm via a user interface e.g., how much the user will be charged for a police response to a first false alarm, a second false alarm, etc. Based on this information, the dashboard generator524can be configured to identify how many false alarms are prevented by a user performing recommendations generated based on the false alarm rules518. Based on this data, the dashboard generator524can be configured to provide various metrics to an end user indicative of how much money the user has saved by performing the recommendations. In some embodiments, the savings can be generated on an insight basis. For example, the interfaces can provide a user with a notification to perform maintenance and a metric indicating how many false alarms will be reduced by performing the maintenance and how much savings will occur from performing the maintenance.

The dashboard generator524can be configured to generate reports for an account and/or multiple accounts. The dashboard generator524can generate a report that displays information via the interfaces3100-5100and/or can generate an offline report, e.g., a PDF document, a MICROSOFT EXCEL® documents, etc. The report may track alarms, dispatches, site information (e.g., number of systems and/or sites), a number of police dispatches, false alarm rule related police dispatches, holdups, and/or various other metrics. Examples of data that can be included in a report are shown in Tables 5 and 6 below.

Furthermore, the report can include totals for the particular building sites and/or national accounts related to the number of false alarm rules518that have triggered. The false alarm rules, the number of related alarms that have occurred, the number of related police dispatches that have occurred, an alarm percentage, and/or a police dispatch percentage vs the number of alarms can be shown. Furthermore, a weekly report can be generated that indicates false alarm rules that have triggered for particular days of a particular week. An exemplary report is shown below in Tables 7 and 8.

Referring now toFIG. 32, a block diagram is shown illustrating the score generator3108in greater detail, according to an exemplary embodiment. The score generator3108is shown to receive site data3200for the building10and area data3202for a particular geographic area or geographic areas. The score generator3108is shown to include a site risk score generator3204and a cluster generator3206.

The site risk score generator3204can be configured to generate a site risk score for the building10a. In some embodiments, the site risk score generator3204determines a site risk score based on addressable alarms and total alarms received for the building10a. The site risk score generator3204can be configured to utilize the equation,

Risk⁢⁢Score=1-Addressable⁢⁢AlarmsTotal⁢⁢Alarms(Equation⁢⁢11)
to determine the risk score for the building10a. The cluster generator3206can be configured to receive the area data3202and generate a cluster3214. The cluster3214may be a cluster of sites that are associated with the building10a. In some embodiments, the distance between sites, the number of employees in the site, the types of systems that the buildings have, the number of doors and other information can be used to generate the cluster3214. Based on the cluster data for the cluster3214(e.g., addressable alarms and total alarms), the cluster risk score generator3208can generate a cluster risk score for the cluster3214. The cluster risk score can be generated by the Equation 11 and can be based on aggregate data for the clusters, e.g., an aggregate number of addressable alarms and an aggregate number of total alarms.

The score generator3108is shown to include a comparator3210. The comparator3210can be configured to receive the risk score for the building10aand the cluster risk score for the cluster3214. The comparator3210can be configured to compare the site risk score and the cluster risk score to generate the comparison metric3212. The comparison metric3212can be a difference between the risk scores, or a trend of the risk scores. In some embodiments, the comparator3210records and compares the site risk score and the cluster risk score over time so that a trend in the risk score can be determined. An example of such a trend is shown in further detail inFIG. 33.

Referring now toFIG. 33, a cluster risk score trend3300, a site risk score trend3302, and a comparison metric trend3304are shown illustrating the determinations of the score generator3116ofFIG. 32, according to an exemplary embodiment. The cluster risk score trend3300illustrates multiple risk scores generated for the cluster3214over time. The cluster risk score line3306tracks the cluster risk score over minutes, hours, days, months, and/or years. Although the line3306is shown to be continuous, the line3306can in some embodiments, be discrete samples of a risk score determined at particular times. Similarly, the site risk score trend3302illustrates the site risk score trended for the building10a. The site risk score line3308can indicate the risk score of the building10aover minutes, hours, days, months, and/or years. A comparison metric trend3304can be generated by the comparator3210(e.g., the comparison metric3212). The comparison metric may be a trend of the cluster risk score and the site risk score. Therefore, the comparison metric can indicate the trends of the cluster risk scores and the site risk scores. Any one or combination of the trends3300-3304can be provided to an end user for review and tracking of the risk score for their site.

In some embodiments, the score generator3108can be used to negotiate with police departments, fire departments, or other security services based on the comparison metric3212and/or any of the other metrics generated by the score generator3108. For example, the comparison metric3212can be used to negotiate for more frequent patrols and/or better police dispatch response times since the comparison metric3212can indicate that the building10ararely has false alarms. In some embodiments, the score generator3108can present an end user with a dashboard of the graphs ofFIG. 33or can provide the dashboard to a police department or other security provider. In some embodiments, a score generated by the score generator3108can place the building10ain a particular tier in a tiered system which the police or fire departments utilize in determining which areas of a city require the most patrol or fastest response times. The scores can be used in various pricing oriented policies (POP) and/or for municipality credits.

Referring now toFIG. 34, components3400of the alarm analysis system310ofFIG. 4for optimizing the purchasing of replacement parts is shown, according to an exemplary embodiment. In some cases, a service technician may arrive at a job site without having the correct parts to resolve a problem the first time the technician visits the site. On average, it may take approximately 2.6 site visits for a technician to complete a service job. This can reduce customer satisfaction because a fault is not resolved at the first technician visit and the customer wastes time and resources ensuing the technician is escorted to and/or from the equipment within the building and/or has access to the service area. The components3400can be operated to reduce inventory holding costs, prevent part shortages, and be able to apply substitute part lists to reduce excess part purchases. The components3400can predict the correct parts and/or quantities to purchase and/or include in a truck inventory, identify predicted parts that are not utilized, and determine optimal purchase costs for parts. Having the correct parts stored in an inventory and/or service truck can improve the rate at which a technician fixes a problem during a first site visit, increases customer satisfaction, reduces service miles driven by a technician, and overall improves service quality to a job site.

Components3400are shown to include a regression analyzer3402, a recommendation engine3404, an ensemble engine3406, a substitute manager3408, an evaluation manager3410, and an optimizer3412. The components3400can be configured to generate an optimal inventory for a technician vehicle and/or for a parts storage facility. Furthermore, based on a substitute list3414, the substitute manager3408can further minimize the number of purchased parts by identifying building parts that can be substituted for one another. By reducing the number of parts required to be stored in a technician truck and/or warehouse, overhead costs that result from purchasing unnecessary building parts can be lowered.

Furthermore, the components3400can optimize the selection of what parts to buy so that although less parts are purchased, the parts purchased are the parts necessary for technician field maintenance. Reducing the number of components to be purchased and determining which components to purchase can make technician field maintenance trips more efficient since the technicians may have the necessary parts in their truck inventory or in a parts storage facility.

Three different models can be implemented by the components3400. A base model, a quantity model, and a quantity cost model. The base model may have no restrictions on purchasing unique items or in the amount of money in part purchases is available. The quantity model can restrict the number of unique parts but not by item cost. Furthermore, the quantity cost model may restrict the number of unique parts and restrict part purchased by item cost.

Referring now toFIGS. 35-36, graphs3500and3600are shown illustrating the performance of the base model, the quantity model, and the quantity cost model ofFIG. 34. The performance of the three models for truck inventor is shown inFIG. 35by chart3500. Furthermore, the performance of the three models for a parts facility inventor is shown InFIG. 36by chart3600. As can be seen from theFIGS. 35-36, the base model is the most expensive model requiring the highest purchase of parts. Furthermore, the quantity model reduces the parts cost while the quantity cost model reduces the inventor costs even further.

Referring now toFIGS. 37-51, interfaces3700-5100are shown for providing a user with insights and receiving input for controlling the security system302aare shown, according to various exemplary embodiments. The interface system308can be configured to generate, via the dashboard generator524, the interface3700-5100and provide the interfaces to the user device314. Via the user device314, a user can provide input to the alarm analysis system310.

Referring now toFIG. 37, a dashboard interface3700illustrating information for a user regarding one or more buildings associated with the user is shown, according to an exemplary embodiment. The interface3700is shown to include an identifier3704of the number of actionable insights for a current week. The insights may be the insights generated by the alarm analysis system310. Furthermore, if the user is associated with multiple buildings, the number of sites affected in the current week is shown as identified by marker3706.

The executive summary3702indicates the total number of sites affected in the current week and the total number of sites affected by alarms in the previous week. Furthermore, the executive summary3702shows the total number of actionable insights for all sights in the current week and for the previous week. An actionable insight trend3710is shown in interface3700. The actionable insight trend3710indicates the various alarm rules518and the number of times the rule has been triggered in the current week and in the previous week.

An actionable insight trend3712illustrates a trend across multiple weeks of the number of times a rule or alarm has been triggered. There may be various rules or alarms included in the trend. Each rule or alarm may be indicated by a distinct colored line. If a user hovers over the actionable insight trend3712with a mouse cursor or otherwise interact with the actionable insight trend3712, the user may be presented with the triggered rules or false alarms associated with the triggered rules and the number of times each false alarm rule or false alarm was triggered at a particular point in time.

Referring now toFIG. 38, an interface3800is shown illustrating a map indicating the location of multiple buildings (e.g., the buildings10a-10d), according to an exemplary embodiment. The map may indicate the location of multiple buildings associated with a particular entity (e.g., owner, company). Each building may be marked on the map of interface3800. A user may interact with the particular building to review security system status for the building. The interface3800may include a rule filter3802. The rule filter3802may include a particular false alarm rule that a user can select. Only buildings of the entity that are experiencing or have recently experienced the selected rule may then be displayed on the map of interface3800.

Referring now toFIG. 39, an interface3900is shown indicating the performance of various sites associated with an entity, according to an exemplary embodiment. The interface3900may be a “spotlight” interface indicating the worst performing sites. A user may select the worst performing ten sites button3902to view the ten sites that have the highest number of rules or alarms triggered in the current week and further an indication of the number and type of each rule or alarm. If the user selects the worst performing ten sites trend analysis3904, trend analysis for the worst ten sites may be displayed. The trend may be the same as and/or similar to actionable insights trend3710ofFIG. 11. However, each trend may be for a particular site instead of all sights together.

Referring now toFIG. 40, a place order interface4000is shown, according to an exemplary embodiment. The place order interface4000may indicate various sites, the addresses for the sites, the city, the state, and/or the zip code. An alarm count may be displayed for each site. A recommendation for an alarm, e.g., the recommendation526of a particular rule, is displayed in the place order interface4000. A user can review the recommendation and either place an order (accept the recommendation) or forego the order. Accepting the recommendation may cause an on-premises security system to be programmed with recommended parameters. In some embodiments, where a technician is required to go to the site (e.g., to adjust the position of a sensor, to directly implement a parameter change) placing an order may cause a site technician to visit the site and make the change.

Referring now toFIG. 41, an interface4100is shown for a user to login to the interfaces3700-5100. The user may be provided with the login interface4100when the user navigates to a website or opens a mobile application via the user device314. A user may provide a login ID and a password to access the interfaces3700-5100.

Referring now toFIGS. 42 and 43, an executive summary interface4200is shown displaying security information for one or more building sites, according to an exemplary embodiment. The interface4200is shown to include a “todos” meter4202. The todos meter4202can display the heath of one or multiple sites associated with a particular entity. More specifically, the todos meter4202can indicate a number of actionable insights for false alarm reduction that require user review and/or approval. In some embodiments, the meter4202can show a number of rules that have triggered or a number of building alarms (e.g., addressable alarms) that have occurred. The filter4204can be configured to filter the security information displayed in the interface4200to display security information for particular sites, e.g., for one or more states or cities, and/or for a particular date range.

Based on the filter parameters, the number of sites that remain after filtering may be displayed. The trend4206may display the number of different types of alarms that have been occurred. The alarm information of the trend4206may be governed by the filter parameters of the filter4204.

InFIG. 43, the interface4200is shown to include a progress box4300. The progress box4300may display the current number of work orders, alarms, and/or police department calls. The progress box4300may also show a starting number of work orders, alarms, and police department calls. In this regard, a user can track the performance of a building at a first point in time to the current point in time to identify whether the performance of the building is increasing. The work orders box4302may show the current number of pending and accepted work orders. The work orders can be work orders determined based on false alarm rules518triggering. The work orders can be accepted and/or rejected via the work order interface4800. The forecast4304may indicate a predicted or forecasted number of work orders (W.O.), alarms, and police dispatches (P.D.) for multiple months into the future. In this regard, if the current month is February, predictions for the months of March and June can be generated. In some embodiments, the predictions are generated based on past performance. For example, based on the performance of months January and February, the dashboard generator524can be configured to generate predictions for March and June. In some embodiments, the dashboard generator524can be configured to implement a Bayesian model, e.g., the model described with reference toFIGS. 10A-10Cto predict a number of work orders, alarms (e.g., addressable alarms, triggered false alarm rules518), and/or police dispatches.

Referring now toFIG. 44, an interface4400is shown displaying various addressable alarms and recommendations for alarms, according to an exemplary embodiment. The recommendations may be that the recommendations526of the alarm rules518. The interface4400may indicate a particular alarm identifier, an alarm name, an action, the number of ties the alarm has occurred, details on the alarm, the recommendation, an action type, and an explanation for the alarm. The user can accept the recommendation and a work order number may be generated and displayed in the interface4400.

Referring now toFIG. 45, a map interface4500is shown illustrating a map with different colored areas, according to an exemplary embodiment. The various colored areas may indicate that sites within the particular area are experiencing a particular number of alarms. For example, green areas may indicate that there are few or no alarms. However, red may indicate areas where the sites are experiencing a large number of alarms. Yellow regions may indicate a medium number of alarms or the potential that a significant number of alarms will occur in the future.

Referring now toFIG. 46, recommendations interface4600is shown, according to an exemplary embodiment. The recommendations interface4600shows a type of false alarm rule (e.g., door delay, scheduling error, etc.) and a recommendation for the false alarm rule. For the door delay alarms, the recommendation is to program the door delay to sixty seconds. The recommendations interface4600may display work orders and allow a user to generate a work order for a particular alarm.

Referring now toFIG. 47, a reports interface4700is shown, according to an exemplary embodiments. The reports interface4700may show the security information for particular sites. The reports interface4700may include various alarm trends, the number and type of alarms, and various other security information. The interface4700may include a filter4702to filter the reports by particular date ranges, states, cities, alarm types, etc. Based on the filter parameters of the filter4702, the number of sites associated with the filter parameters and the number of recommendations may be shown in the filter4702.

Referring now toFIG. 48, a work order interface4800is shown, according to an exemplary embodiment. The work order interface4800is shown to include a filter4802in which a user can input various filter parameters. The user can input a work order status, a ticket number, an associated police dispatch, a store number, an alarm type, an action type, and/or a request data and filter by one or more of the aforementioned parameters. The work order interface4800is shown to include a work order display4804where the various work orders filtered by the parameters of the filter4802are displayed. For each work order, a ticket number, a status, a site address, a site state, the date the work order was opened, the date the work order was requested, the date the work order was closed, the number of alarms associated with the work order, the details of the alarm, the recommendation, and an action type can be displayed.

Referring now toFIG. 49, a map interface4900is shown, according to an exemplary embodiment. Each state or area in the map may be colored a particular color. The status of the sites in each area may be denoted by color. Green mean that the sites are good, yellow may mean that there are some minor problems or the sites are ok, while red may mean that there is danger. A user can select one of the areas (states) and navigate to another detailed interface, e.g., the interfaces4900and5000as described with reference toFIGS. 49 and 50.

Referring now toFIG. 50, a map interface5000with site markers is shown, according to an exemplary embodiment. On the map interface5000, various sites are located via pins. Each pin may show a site number of otherwise may display the number of alarms triggered at the site. If a user hovers over the pin, a window5002may be displayed indicating additional information for the site. The window5002may display a store number, a door delay alarm count, a low battery alarm count, or the count of any other triggered alarm (e.g., addressable false alarm, triggered false alarm rule518). In some embodiments, the map interface5000is divided into areas based on city, district, site locations, etc. The areas can be colored (e.g., red, green, yellow) based on the number of alarms triggered for the particular area.

Referring now toFIG. 51, a map interface5100with a site cluster5102is shown, according to an exemplary embodiment. The map interface5100may indicate various stores via markers. If multiple stores are located within a predefined distance of each other, a cluster, e.g., the cluster5102, may be displayed on the map interface5100. The cluster may indicate the number of sites in the cluster or the number of alarms triggered for the sites of the cluster. The cluster may be a particular color, red, green, and/or yellow based on the number and/or severity of the alarms triggered for the sites of the cluster5102.

Referring now toFIGS. 52 and 53, exemplary reports of alarm activity and police dispatch activity are shown via charts5200and5300, according to an exemplary embodiment. The charts5200and5300can be generated by dashboard generator524and included in the interfaces3100-5100and/or included in an exported report, e.g., a PDF report, a MICROSOFT® EXCEL report, etc. The dashboard generator524can be configured to record alarm activity and/or police dispatch activity associated with the false alarm rules518. This data can be recorded for a day, a week, a month, a year, and for a particular building site, cluster of building sites, and/or national account. The dashboard generator524can be configured to generate the charts5200and5300to give insight to a user regarding alarm and police dispatch activity that can be prevented.

Referring now toFIG. 54. a set of graphs5400for an exploratory data analysis of unsupervised clustering of building sites by signals is shown, according to an exemplary embodiment. From the graphs5400, it can be seen that how events are recorded can be a good indication of how users operate building equipment (e.g., security panes). From the graphs5400, it can be seen that since events can be indicative of how building equipment is operated, sequences of events can provide further insight into false alarms. Graph5402indicates data of various sites and the number of different events that occur at the sites (e.g., bypass events, fire alarm events, burglar alarm events, low battery events, etc.). These sites can be clustered in various numbers of clusters based on the number and type of events of each site. As shown in graph5404, the greater the number of clusters, the lower the sum of squares for the clusters (e.g., less error). Graph5406indicates the number of events of eight clusters. As can be seen, the number and type of events of each cluster varies. However, as shown in graph5408, although each cluster may have a different number and type of events, the majority of sites fall into the same cluster (cluster 4). Since the majority of sites behave in the same way, this can indicate that events are a good indication of how users are operating the building equipment of a site.

Configuration of Exemplary Embodiments