Patent Description:
For the purposes of clearly, concisely and exactly describing non-limiting exemplary embodiments of the disclosure, the manner and process of making and using the same, and to enable the practice, making and use of the same, reference will now be made to certain exemplary embodiments, including those illustrated in the figures, and specific language will be used to describe the same. A monitoring method according to the invention is disclosed in claim <NUM> and a monitoring device according to the invention is disclosed in claim <NUM>.

Exemplary embodiments include unique systems, methods, techniques and apparatuses for an alarm management system. Further embodiments, forms, objects, features, advantages, aspects and benefits of the disclosure shall become apparent from the following description and drawings.

With reference to <FIG> there is a box diagram illustrating an exemplary industrial plant <NUM> including an alarm management system (AMS) <NUM>. It shall be appreciated that system <NUM> may be implemented in a variety of applications, including oil refineries, power generation stations, petrochemical facilities, and other industrial facilities, to name but a few examples.

Industrial plant <NUM> includes a plurality of devices <NUM> structured to communicate with AMS <NUM> including control systems <NUM> structured to operate machines or other devices of plant <NUM>, sensors <NUM> structured to measure electrical, chemical, or other physical characteristics of plant <NUM>, and a user interface <NUM>. As described in more detail below, interface <NUM> is structured to display alarm sequences identified by AMS <NUM>. In certain embodiments, interface <NUM> is structured to receive user input corresponding to plant alarms including events such as input corresponding to system operator actions. User interface <NUM> may include a mouse, keyboard, a touch screen display, or a computer monitor, to name but a few examples. In certain embodiments, system <NUM> includes a plurality of user interfaces, including one user interface structured to display alarm sequences identified by AMS <NUM> and another user interface to display alarms in real-time to a user, also known as a system operator.

AMS <NUM> is structured to receive alarm data, identify alarm sequences, and output the identified alarm sequences for alarm management optimization. AMS <NUM> may be a single device or a plurality of devices collectively structured to perform the functions described herein. AMS <NUM> includes an input/output device <NUM>. Input/output device <NUM> allows AMS <NUM> to communicate with a plurality of external devices <NUM> by way of a wired or wireless communication channel. The data transferred between AMS <NUM> and devices <NUM> may be analog or digital. For example, input/output device <NUM> may be a network adapter, network card, interface, or a port (e.g., a USB port, serial port, parallel port, an analog port, a digital port, VGA, DVI, HDMI, FireWire, CAT <NUM>, or any other type of port or interface) to name but a few examples. Input/output device <NUM> may be comprised of hardware, software, and/or firmware. Input/output device <NUM> may include more than one of these adapters, cards, or ports.

AMS <NUM> includes a memory device <NUM>. Memory device <NUM> may be of one or more types, such as solid-state, electromagnetic, optical, or a combination of these forms to name but a few examples. Furthermore, memory device <NUM> may be volatile, nonvolatile, transitory, non-transitory or a combination of these types, and some or all of memory device <NUM> may be portable, such as a disk, tape, memory stick, or cartridge, to name but a few examples. In addition, memory device <NUM> may store data and programming instructions executable using processing device <NUM>. Memory device <NUM> is structured to store an alarm data database <NUM> which includes historical alarm data received by input/output device <NUM>.

AMS <NUM> includes a processing device <NUM>. Processing device <NUM> may be of a programmable type, a dedicated, hardwired state machine, or a combination of these; and may further include multiple processors, Arithmetic-Logic Units (ALUs), Central Processing Units (CPUs), Digital Signal Processors (DSPs), to name a few examples. For forms of processing device <NUM> with multiple processing units, distributed, pipelined, and/or parallel processing may be utilized as appropriate. Processing device <NUM> may be dedicated to performance of just the operations described herein or may be utilized in one or more additional applications. In the depicted form, processing device <NUM> is of a programmable variety that executes algorithms and processes data in accordance with the programming instructions (such as software or firmware) stored in memory device <NUM>. Processing device <NUM> may be comprised of one or more components of any type suitable to process the signals received from input/output device <NUM> or elsewhere, and provide desired output signals. Such components may include digital circuitry, analog circuitry, or a combination of both.

With reference to <FIG> there is a flowchart illustrating an exemplary process <NUM> for identifying important alarm sequences. Process <NUM> may be implemented in whole or in part in one or more of the control systems disclosed herein. In certain forms, the alarm data collection and alarm data analysis functionalities may be performed by separate alarm management systems. In certain forms, the alarm data collection and alarm data analysis functionalities may be performed by the same alarm management system. The following description of process <NUM> is made with reference to AMS <NUM> of industrial plant <NUM> in <FIG>.

Process <NUM> begins at start operation <NUM> and proceeds to operation <NUM> where AMS <NUM> receives historical alarm data for a data collection interval from the plurality of devices <NUM>. Alarm data may include alarm identification, alarm priority information, and an alarm initialization timestamp.

Process <NUM> proceeds to operation <NUM> where AMS <NUM> divides the data collection interval into subintervals, also called baskets, using the timestamp associated with each alarm event. Each subinterval includes a grouping of alarms that have occurred within a user-defined time period. All subintervals may be an equal length of time, such as <NUM> minutes. In other embodiments, the length of each interval may be dynamically set based on an alarm rate or user selections.

Process <NUM> proceeds to operation <NUM> where AMS <NUM> uses graph-based analysis to evaluate the subintervals of alarm data. AMS <NUM> identifies all alarm sequences within each subinterval and identifies alarm sequences occurring in multiple subintervals. Alarm sequencing and analysis is performed by first generating a weighted directed graph from the alarm data received in operation <NUM>. Each alarm is represented by a node and each transition is represented by a directed edge connecting two nodes. The graph may exclude certain transitions based on the number of times a transition occurs, also known as a support parameter. For example, any transition occurring less than two times in all subintervals may not be included in the graph. Each directed edge includes a property corresponding to the subinterval in which the associated transition appears. In certain embodiments, each edge also includes a property corresponding to the transition time between the two nodes connected to the edge. Alarm sequences are then identified by identifying sets of alarms connected by transitions. Alarm sequences may include more than two alarms if subsequent alarms in the sequence are connected to more than one transition. Alarm sequences may exclude an alarm occurring within the same subinterval as the alarm sequence, even if the excluded alarm occurred after the first alarm and before the last alarm in the alarm sequence.

As described above, identified alarm sequences must satisfy a support parameter. Alarm sequences sent to the user for analysis must also be limited to useful sequences, also known as togetherness. For example, alarm sequence A-B may have occurred <NUM> times in <NUM> subintervals, but the alarm sequences may not be important from an analysis standpoint if alarm A or alarm B occurred by itself in <NUM> of the <NUM> subintervals. Operation <NUM> thus analyzes the alarms sequences based on togetherness, or the ratio of the number of times individual alarms occur to the number of times the alarm sequence occurs. Togetherness ranges from <NUM> to <NUM> with <NUM> being that the alarms of an alarm sequence always occur in sequence. For example, if the alarm sequence A-B occurs <NUM> times, alarm A occurs by itself <NUM> times, and sequence B-A occurs <NUM> times, the togetherness parameter of sequence A-B would be calculated by dividing the total number of sequence occurrences (<NUM>) by the total number of sequences in which A or B occurred (<NUM>+<NUM>+<NUM>=<NUM>). Therefore, the togetherness parameter for sequence A-B is. In another example, an alarm sequence with a togetherness parameter of <NUM> indicates each of the individual alarm events of the alarm sequence did not occur unless the alarm sequence was observed. Alarm sequences satisfying a togetherness parameter are included in the graph. For example, alarm sequences with a togetherness of. <NUM> or greater may be included in the graph.

With reference to <FIG> there is illustrated a graph transformation <NUM> generated using operation <NUM> of process <NUM>. Graph transformation <NUM> includes a final graph <NUM> and a table <NUM> including a plurality of rows <NUM>-<NUM> corresponding to time intervals. Each time interval is associated with a plurality of alarm sequences that occurred during the time interval. Graph <NUM> is generated using the alarm sequences of table <NUM>. Graph <NUM> includes a plurality of nodes, each representing one alarm, and a plurality of edges, each representing one alarm transition event. Each alarm transition event includes a property indicating the associated time interval identified graph <NUM> within brackets. For example, time interval <NUM> on row <NUM> includes the sequence A-B. Graph <NUM> thus connects node A to node B with a directed edge and adds a basket identifier to the directed edge. Graph <NUM> also connects each alarm to the alarms in the sequence which occur later in the sequence. For example, node A is connected to nodes B, C, and D. Any edge occurring only once is not included in graph <NUM>. For example, sequence B-C occurs only in time interval <NUM>, so the sequence is not included in graph <NUM>.

With continuing reference to <FIG>, Process <NUM> proceeds to operation <NUM> where AMS <NUM> displays the alarm sequences. In certain embodiments, alarm sequences satisfying a support parameter and a togetherness parameter may be used by AMS <NUM> to predict future alarm events. With reference to <FIG>, if an alarm management system observes, in real-time, an alarm sequence of C-B, the system may predict alarm event E will occur soon and either alert a system operator to take remedial action or send command signals to control systems <NUM> to prevent or curtail damage to plant <NUM>. In certain embodiments, alarm sequences may be used to determine undetected events. For example, if AMS <NUM> observes alarm event E, AMS <NUM> may determine alarm events C and B have already occurred.

Alarm sequences may also be used to reduce the number of alarms displayed to a system operator. For example, if one alarm sequence A-B-C-D begins to occur but only alarm D is a high priority alarm, AMS <NUM> may operate a user interface so as to only display alarm D to a system operator and ignore alarms A, B, and C. In another example, if sequence A-B-C-D occurs nearly simultaneously or within a short time period, AMS <NUM> may operate a user interface so as to only display one alarm and not display the other alarms.

In certain embodiments, partial sequence A-B-C of sequence A-B-C-D may be used to determine a root cause for D by flagging A-B-C as one potential cause of alarm D. In certain embodiments, alarm sequences are output to a user via a user interface for further analysis and implementation by the user.

With reference to <FIG> there is illustrated a user interface <NUM> for an exemplary alarm management system, such as AMS <NUM> of <FIG>. Interface <NUM> includes an alarm table configured to display an ordered list of alarm sequences identified using a weighted directed graph. The alarm table includes a plurality of rows <NUM>-<NUM>. Each of the plurality of rows displays a togetherness value, a support value, and a graphic illustrating the alarm sequence. Alarms of an alarm sequence occurring within a short period of time may be represented as an alarm cluster. For example, row <NUM> displays an alarm sequence of alarm cluster 321a followed by alarm 321b. In the illustrated embodiment, row <NUM> displays the average transition time between cluster 321a and alarm 321b as <NUM> minutes, <NUM> seconds. Some alarms are labeled 'H' for high priority alarms and other alarms are labeled 'L' for low priority alarms. Alarm priority may be user-defined or one of the devices of plant <NUM> based on the industrial plant event corresponding to the alarm. In certain embodiments, user interface <NUM> may display more information regarding transition times, such as minimum, maximum, median, or standard deviation.

User interface <NUM> includes a user input window <NUM> configured to display changeable elements such as a slider bar in order to allow a user to filter the alarm sequences displayed by table <NUM>. A user may filter the alarm sequences by support, togetherness, or sequence length, to name a few examples.

With continuing reference to <FIG>, Process <NUM> proceeds from operation <NUM> to end operation <NUM>. It shall be further appreciated that a number of variations and modifications to process <NUM> are contemplated including, for example, the omission of one or more aspects of process <NUM>, the addition of further conditionals and operations and/or the reorganization or separation of operations and conditionals into separate processes.

Further written description of a number of exemplary embodiments shall now be provided. One embodiment is a method for monitoring an industrial automation system according to claim <NUM>.

In certain forms of the foregoing method, the method comprises measuring characteristics of the industrial automation system during the plurality of time intervals using a plurality of online sensors; and generating the alarm event database using the measurements from the plurality of online sensors, the alarm event database including the plurality of alarm events and a time stamp associated with each of the plurality of alarm events. In certain forms, the method comprises detecting the first alarm event in real-time using the plurality of online sensors; and forecasting the second alarm event using the ratio between the first count and the third count in response to detecting the first alarm event. In certain forms, the method comprises transmitting an alert to a system operator corresponding to a plant condition indicated by the second alarm event before the occurrence of the plant condition. In certain forms, determining the third count includes determining a time between the occurrence of the first alarm event and the occurrence of the second alarm event does not exceed a time threshold. In certain forms, the first count is the total number of occurrences of the first alarm event during each of the plurality of time intervals. In certain forms, one of the plurality of alarm events is an action event performed by a system operator. In certain forms, displaying the sub-sequence includes displaying statistics related to the time between the occurrence of the first alarm event and the second alarm event.

Another exemplary embodiment is an industrial plant monitoring device according to claim <NUM>.

In certain forms of the foregoing device, the first alarm event is a low priority alarm and the second alarm event is a high priority alarm and the device is configured to predict the second alarm event using the sub-sequence. In certain forms, the device is configured to transmit a command to an industrial plant control system structured to detect the first alarm event in real-time, the command configured to instruct the control signal to ignore the first alarm event and alert a system operator of a future second alarm event in response to detecting the first alarm event. In certain forms, one sequence of alarm events includes the first alarm event followed by a third alarm event followed by the second alarm event, but the subsequence does not include the third alarm event. In certain forms, the sequences of alarm events are determined using graph theory. In certain forms, the togetherness threshold value is.

A further exemplary embodiment is an industrial plant monitoring system comprising: an input device structured to receive alarm events data from a plurality of industrial plant sensors; an output device structured to output a user interface; a non-transitory computer readable medium structured to store a set of instructions; and a processing device structured to execute the set of instructions so as to: retrieve a set of alarm events corresponding to a plurality of alarm events occurring within a time interval, divide the set of alarm events data into groups corresponding to subintervals of the time interval, identify a set of alarm sequences which occurred during at least one of the subintervals, identify a first subset of the alarm sequences based on the number of times each alarm sequence occurs, identify a second subset of the alarm sequences based on the number of times each alarm sequence occurs in relation to the number of times each individual alarm of the alarm sequence occurs, and display a visual representation of the alarm sequences within both the first subset and second subset using the output device.

In certain forms of the foregoing system, one of the alarm sequences includes at least three alarm events. In certain forms, one of the alarm sequences includes at least one non- consecutive alarm event. In certain forms, the system comprises a user interface structured to receive real-time alarm event data, forecast one of the alarm sequences within both the first subset and second subset, and display an alarm event of the forecasted alarm sequence which has not yet occurred using the alarm sequence forecast. In certain forms, the set of alarm sequences, the first subset, and the second subset are identified using a weight directed graph. In certain forms, the length of each subinterval is based on the rate of alarms occurring during the time interval.

It is contemplated that the various aspects, features, processes, and operations from the various embodiments may be used in any of the other embodiments unless expressly stated to the contrary. Certain operations illustrated may be implemented by a computer executing a computer program product on a non-transient computer readable storage medium, where the computer program product includes instructions causing the computer to execute one or more of the operations, or to issue commands to other devices to execute one or more operations.

Claim 1:
A method for monitoring an industrial automation system comprising:
operating the automation system (<NUM>) by executing a plurality of control processes with an electronic controller, each of the plurality of control processes being configured to control one or more physical elements of the automation system;
determining, with the electronic controller:
a sequence (A-B-C-D) of alarm events for each of a plurality of time intervals during execution of the plurality of control processes using an alarm event database (<NUM>), one of the sequences of alarm events including a first alarm event of a plurality of alarm events and a second alarm event of the plurality of alarm events,
a first count of the first alarm event,
a second count of the second alarm event,
whether the first count and the second count each exceed a support threshold value corresponding to a minimum number of alarm event occurrences,
a third count of a sub-sequence of the sequences of alarm events including the first alarm event followed by the second alarm event in response to determining the first count and the second count exceeds the support threshold value,
a ratio of the third count to the sum of the first count, the second count, and the third count, and
whether the ratio exceeds a display threshold value; and
displaying, when the ratio exceeds the display threshold value, the sub-sequence on an operator-perceptual display using a plurality of visual alarm components to represent the first alarm event and the second alarm event.