## 3 Shift Time Clustering on Event Logs  
To the best of our knowledge, clustering shift times based on event logs has not been studied thus far. Although regular event logs may not contain data about resources, the event log in this study is required to include data about resources. Before conducting clustering, we first need to preprocess the event log data. This preprocessing mechanism is based on the assumption that resources, i.e., humans, will have a certain amount of rest time between consecutive shift time working. This assumption is based on data from the International Labor Organization, which released a report and standard guideline for the working times of a worker employed by a company [14]. The guideline states not only the limitations of daily and weekly working times but also the rest period after work [15]. It states that the rest period after work must follow the following rules [15]:  
* After a working day, you may not work for at least 11 consecutive hours. However, this may be reduced once every seven days to eight hours if the nature of the work or the company circumstances make this necessary. * After a working week of five days, you may not work for at least 36 consecutive hours. * \(\bullet\) A longer working week is also possible, provided you have a rest period of at least 72 h once every 14 days. This 72 h period may be split into two separate periods, neither of which may be shorter than 32 h.  
Figure 2: Example of Colored Petri Nets model. We need to find a rest period between the working times of each resource to cluster the shift time of an event log. In the event logs, data are grouped based on case ID. Here, we need to rearrange the event logs so that we can easily map each resource across multiple cases. Based on the rules defined in [15], we preprocess the event log to merge and split the row of each resource in the event logs. First, we group the event log by each resource and sort the row of resources of each group by the start time of the event in ascending order. Subsequently, we calculate the gap between the completion time of the previous event and the starting time of the subsequent event. We split two events if the calculated gap is equal to or longer than eight hours. This split creates another subgroup consisting of rows of events. Subsequently, we take the starting time of the first event, the completion time of the last event, and the distance between the two for each subgroup consisting of rows of events. The data here are not represented by the shift time of the resource directly because the recorded event of each resource may not consist of a complete event from the start to the end of the shift time. Hence, we use clustering for this problem, not only to cluster the resources into a specific group of shift times but also to be more certain of the shift time range. The preprocessing mechanism is shown in Algorithm 1. ```
Input :Event Logs Output :Array of object
1 Read event logs data. 2 Group rows of an event by resource. 3 Order rows in each group by start time attribute ascendingly. 4 Calculate the gap (completion of the first event and starting time of the second event) between two consecutive event. 5 Split two consecutive event if the gap \(\geq\) 8 h. This split will create new subgroup. 6 For each subgroup, take the first event starting time and the last event completion time, calculate the duration between the two. 7 From the previous step, take the only time of the starting time and the completion time of each subgroup without considering the date. 8 Make an object data consist of the starting time (without date info), the completion time (without date info), and the duration. 9 Flatten each object into one collection of array. ```  
**Algorithm 1**Event logs preprocessing. The formalized representation of Algorithm 1 can be described by the following mathematical definitions:  
* Event logs Based on the definition of event logs in the Preliminary section, an event is an atomic representation to an activity instance. It thus contains a single timestamp.