Industrial plant operators regularly observe a high number of alarms generated in a short period of time, a phenomenon which is referred to as alarm flooding. This causes plant downtime, not only because of the repair time but also by the time needed to identify the root cause of machine failurewhich is difficult during an alarm flood. Therefore, diagnosis tools that perform root cause analysis to advise plant operators can help reduce the downtime, which is a crucial issue in industry. We analyse the reproducibility and applicability of an existing approach by Ahmed et al. (2013) which is based on agglomerative hierarchical clustering where raw data in the form of alarm logs is preprocessed, floods are detected, and then clustered. The aim is, that resulting clusters represent floods that originate from the same common root cause. We extend the approach with alternative similarity measures and perform experiments regarding their effectiveness in structuring industrial alarm flood data. In our evaluation we use a real industrial use case which contains more diverse data and a larger amount of data points compared with the original study.

Abstract. The aim of industrial alarm flood analysis is to assist plant operators who face large amounts of alarms, referred to as alarm floods, in their daily work. Many methods used to this end involve some sort of a similarity measure to detect similar alarm sequences. However, multiple similarity measures exist and it is not clear which one is best suited for alarm analysis. In this paper, we perform an analysis of the behaviour of the similarity measures and attempt to validate the results in a semi-formalised way. To do that, we employ synthetically generated floods, based on assumption that synthetic floods that are generated as 'similar' to the original floods should receive similarity scores close to the original floods. Consequently, synthetic floods generated as 'not-similar' to the original floods are expected to receive different similarity scores. Validation of similarity measures is performed by comparing the result of clustering the original and synthetic alarm floods. This comparison is performed with standard clustering validation measures and application-specific measures.

No abstract

No abstract