Knowledge Based Event-Oriented Approach in Control Systems
Vikentiev A.*, Vaguine A.*, Mikheev V**, Poluektov S.***- Moscow Radiotechnical Institute RAS, vaguine@inm.ras.ru**- Altey Ltd, Moscow, altey@inm.ras.ru
1 Introduction
Safety control, alarm system and reliability of the big andcomplicated objects (accelerators, aviation, atomic power
station and railway) is the field where the integrated
knowledge base is importance both for strategic planningand for operative control. The analysis of the big data andinformation packages about the failures and theconsequences for the complex system effective control
takes a lot of time. In modern dialog complexes some partof the failure and incident data is taken from the real time
data collecting system, the other part of this data is fixed inthe inquiry files.
The real time data is usually needed for the on line
control within the complex and practically not used as asource of the reliability and safety knowledge. On the other
hand the inquiry file information about the incident cause
and its consequences and about the following
recommendations is very valuable but this non formal
information is not ready for any statistical processing andgeneralization based on the thousand incidents. In the bigsystems only small part of such unformalised information
is used for the reliability and safety control and is taken
into account in the strategic planning of the control
operations. The paper describes some approach to theformal description of the essential characteristics of thecomplex system comes from the incident inquiry and theevent-oriented analysis technology to fulfill it. The
information system related to existing monitoring systems
to expand the control knowledge base using the formalized
knowledge from inquiry files to plan prophylactic measuresand to predict the situation is briefly discussed.
The basic system was used in practice since 1995.

and used it mostly for some statistics.
From our point of view the most suitable constructive
form for the incident description in most applications is thecause-consequence network in which nods (event classes)
are homogeneous and permitted to have a few possible subclasses of each event (if there is no enough sub-classes todetermine the event - used the class name).
In the case we used cause-consequence network structurewith unified for all the incident scenario and realized as a
joint type tree structure of the unfavorable events,
classified to one of the classes:- unstability factors of the system functioning;- technical means failures;- incorrect stuff actions;- critical (dangerous) events;- final events.
The initial sources of the incidents are inner or outerunstable factors of the functioning system. These factors
lead to a technical means failures and cause an incorrect
stuff actions, which successions and combination could
cause some critical situation. The final failure may happen
as a result of a the <<stored>> functional deviations withinthe system (Fig.1). Of course the final event should follow
a diverge type event-consequences tree structure but theclassifier of this part is not finished in development.

SYSTEM UNSTABILITY FACTORS

2 Formal description of incidents
The main reason preventing on the formal incident
description is the impossibility to point out the level of its
detailization beforehand. From one side, the conditions of
the incident might be rather clear but or completely
muddled from the other side. It is absurd to describe all thedetails of the incident but it is also dangerous to lose anytrifle.
So the structure of the formal incident description should
be logically finished even for the initial description andshould have unlimited possibilities to include many new
details in it.
The analysis of some approaches to formal incident
description (railway, aviation, power station, etc.) showsthat the methods and forms now used restrict the list ofincidents to be described as well as the level ofdetalization. That is why the experts did not use the formal
description as a source of the knowledge to make decision

DANGEROUSEVENS FINAL EVENTSTECHNICALFAULTS ANDSTAFF MISTAKES

Fig. 1. Incident scenario.
The unit of the knowledge (and description) in relationtype data base about the subject is the quality information
about the cause-consequence relations of one or a few
cause-events with consequence-events. All the information
about the cause-consequence relations taken from theincident descriptions is the homogeneous knowledge baseabout the ways of the incident start and progress.
The formal base of incident description in network
structure is two type of classifiers:
classifier of unfavorable events (net peaks);-classifier of cause-consequence relations of event
pairs (net arcs).
From the economical and methodical point it′s very
important both classifiers adopt the content of most of theexisting in many fields classifiers of incidents, cause,factors, conditions and so on.

At the moment our classifier consists of more then 1000of unfavorable events and there are means to widen its
capability both of the class numbers and of the hierarchyclasses depth. For the time being we need up to 104 types ofthe events to describe the incidents.
4 Cause-consequence relation classifier

3 Unfavorable event classifier
One unit of the incident or breakage and the causes inmost of the classifiers used in many industried branches is
one unfavorable event which took place in one specificstructure element of the system. Practically the classifier ofthe structure elements and the classifier of the types ofunfavorable events could exist separately and in the caseeach unfavorable event will be a function of two dimension
classifier (structure element – type of element). Suchapproach is used in the civil aviation for example. In thecontrary the structure elements and types of events can begathered in one linear type of classifier, which is supposed
to consider all the combinations of the structure elements
and types of events. This type of classifier was used insafety control of Russian railways and came into operation
under the subjective conception of the incident
formalization (the incident – the only one cause). Suchapproach was not possible to use for the development ofcause-consequence networks but some formal points wereused.
According to the incident progress scenario developed
together with the field experts, our unfavorable eventclassifier consists of 5 classes of events regulated in thedirection of the unfavorable event reconstruction from theconsequences to the cause (the first figure of the numberevent) (Fig.2).
Unfavorable event class
Unfavorable event group
Unfavorable event

1230

10Event code
Device breakage
Group of dangerous system's breakages
Class of dangerous events

Fig. 2. Unfavorable event classifier.
Inside the classes the events referred to the kind of events
which joint the events in the independent group(consequently the second and the third figures). Within thebreakage class of technical devices the group collects all
the breakage of certain technical devices, within theincorrect stuff actions the group collects all the incorrect
actions of the certain function of the operators, within theclass of dangerous events the group joints the dangerous
events in connection with the certain source of the danger,in the class of the final events the groups are constructed by
the events with the similar results, in the class of unstability
factors the groups are formed according to the source ofunstability.

The cause-consequence relation classifier is developed asrectangular matrix with the lines and columns
corresponding to the types of events taken from theunfavorable event classifier. The special sign in someelement of the matrix means that there is causeconsequence relation between the type of event in the titleof the line and the type of event in the title of thecolumn(Fig 3).
Possible causes of unfavorable events
Unfavorable events-----

231401234102231403231404231405----------012310
012311012312012400012401012402012403012404012405------

Fig. 3. Cause-consequence relation classifier.
The very event is not connected to itself, but there is noother restrictions to fulfill the matrix. The places of signs in
the matrix are determined by the algorithm of the control
system and are fixing the elementary knowledge of thecontrol system about the incident initialization andprogress. For the classifier size mentioned above we haveabout 106 element of matrix and need up to 108 for fullsystem. For that reason we developed the special interface
for experts to minimize the time and to simplify theprocedure. But the main problem here is to develop an
information technology to collect knowledge throng theusing the complex and capacious filters (patterns).
5 Knowledge collection and use technology
The main idea of the knowledge collection and use
technology is to use specialized interface to take theknowledge about the structural regularity of incidents eachtime when an inquiry team starts working. An inquiry team
stuff working on the safety control of the big system israther numerous and its working mode is very intensive.
We decided to add to the existing information network
software comparably inexpensive software package toswitch on all the experts to the infrastructure in real time tocollect the data and knowledge of the incident investigation
to the joint knowledge base and through the centralknowledge base give them the knowledge for helping ineveryday work (investigation, prophylactic measuresplanning, etc.). Experts working on the central knowledge
base are following the knowledge base editing andsystematizing the fragment of the knowledge base(Fig.4).
Our final target is to store in the knowledge base theCENTRAL SAFETY CONTROL SYSTEMANALYTICAL CENTER
Complex safety control
KNOWLEDGE BASE

Incident
data baseCause-consequence
relation classifier

Central and local measures prove

Safety criteria system

Event classifier- safety estimate;- safety parameters;- threshold parameters set;
- plan parameters set;- safety parameters control ;Central level recommendation

Statistictree-event dataprocessing- event distribution Wj(x,t);- measure effect estimateDiWj(x,t)/ Dt;- key event search;- complex measure development;- imitation modeling;- forecasting.

Central levelmeasures
Local levelrecommendation

LOCAL LEVEL SAFETY CONTROL SYSTEM
New eventsand causeconsequence
relationscollection
Tree-eventsof incident

Event and causeconsequence relation
classification

Formalisation

Local levelmeasures

Unformal incident
description

Incident investigation

INCIDENTS

Fig. 4. Knowledge collection and use technology.
verity of events and cause-consequence relations to startdescribing the history of each event including the factors
which are not in the list of factors taken into account by thesafety control system. The details of the cause-consequencedescriptions are determined as such a way to describe theprophylactic measure effect in future.
Our estimation of 104 formalized incidents per year andof 10 cause-consequence relation per incident gives us
about 105 cause-consequence relations in the knowledge
base per year.
6 Incident formal description
The software of the operator’s interface for the incident
formal description is included in the normal operator
interface (data transfer, completing and transfer
unformalized descriptions of incidents, operative data etc.)
The operator is given rather very simple case technology tocomplete the unfavorable event tree structure. This
interface is initializing the classifiers mentioned above
offering him the suitable versions of event and relations. So
the formal description of the incidents used earlier in theform of many attributes (place, time, type of incident etc.)
and the cause unformalized description, obstacles, resultsof the incidents is added by the formal description of theincident as the cause-consequence network. The nods ofthe network are positioned in time and space of theunfavorable events, which took place either with thesystem objects or its media (technical means, stuff etc.).
The better developed the classifiers the more detailed andmattered the incident description becomes. The interface
algorithm does not permitted the operator to go through a
few levels of cause-consequence relations to check hisinquiry.
The key point in the new knowledge collecting is theclassifier adding mechanism. If during the investigation
there will be some information absent in the classifiers theoperator is capable to add the new types of events provedby the inquiry team. After this procedure the new types ofevents will be accessible to the other operators.
7 The central expert system
Using the formalized description of the events andmeasures is permitted to process the information in usual
manner to use if for statistics, operative control and so on
and it gives the “portability” of the information, but thenew technology gives much more power in analysis andforecasting of the system functioning.
7.1 Statistical analysis of reliability and safety
The formal description of incident described gives us thepossibility to analyze the statistics of the accompanied
hidden causes and the key events. At the time being in thesystem realized are:automatic seeking of the key events on the wholenumaryty of the cause-consequence structures ofthe incidents;
ranging of unfavorable events on the dangerous
base and its percentage to the total number ofincidents;
determining the risk incident mean value of forany fixed structure on the base of the generalizingof the incident cause-consequence regularity ofthe.
7.2 Safety estimation
For the moment there are a tenth of technical or
economical criteria′s of safety for the complex socialtechnical systems but no one of them is complete. In oursystem an adoptive approach was developed for the safety
estimation. To support an open adaptive criteria it uses
T.Saaty's method of the hierarchic analysis [2]. Within themethod the dialog system was developed within which anexpert creates and adopts the complex criteria as a functionof the collected data and knowledge as well as incombination with some criteria already exist. As a result
there is a new system of hierarchic criteria to control a stateof safety on the base of the threshold and planned meaningof one or a few basic criteria.
7.3 Forecast and measures development
An imitation model is used to forecast the safety of thesystem. The object for imitation is the ties and transitions
between the unfavorable events which leads to theincidents. The model uses the structural regularity from theknowledge base taking into account both the frequency of

the unfavorable events and the probability of the causeconsequence transfers. For that reason the system
calculates in regular manner:- probability of the events;- probability of the cause-consequence transfers;- correlation of probability of different cause complexof the event;- distribution of the types of unfavorable events in timeand space;- effect estimate of the measures as a function of thecause- consequence probability.
The main target of modeling is to estimate the influence
inner or outer parameters of the safety state and an estimateof the prophylactic measures.
8 Conclusion
The approach described in the paper was put into
operation for the Russian railway safety control system toanalyze more then 104 incidents per year. The information
technology in combination with the advanced mathematicalanalytical methods and the three level classifier gave toclear the dangerous situations and to pick up the parametersof the safety system.
References
[1]

[2]

M. Beharrell, G. Benincasa, J.M. Bouché, J. Cuperus,
M. Lelaizant, L. Merard, Model based, detailed fault
analysis in the CERN PS complex equipment,
ICALEPCS’95, FERMILAB, Proc. 1995, p.474.
Thomas L. Saaty, Kevin P. Kearns Analytical
Planning. The organization of Systems, Pergamon
Press, New York, 1985.