Detecting Temporally Related Arithmetical Patterns

An Extension of Complex Event Processing

Ronald de Haan

and Mikhail Roshchin

Technische Universit¨at Dresden, Dresden, Germany

Siemens Corporate Technologies, M¨unchen, Germany

eywords:

Complex Event Processing, Diagnostic Knowledge, Temporal Relations, Arithmetical Patterns.

Abstract:

When modelling diagnostic knowledge on technical systems it is often important to be able to capture com-

plex events with a temporal structure, based on arithmetical patterns in (preprocessed) sensor data. With the

current methods, such a combination is not easily possible. To solve this problem, we devise an extension of

complex event processing methods, by designing a declarative language to specify the generation of events

with a complex temporal structure that are based on arithmetical patterns in numerical data. This extension

furthermore makes complex event processing methods more easily accessible for users that have no experience

with complex event processing.

1 INTRODUCTION

In the modelling of diagnostic knowledge of large

technical systems, it is important to be able to rep-

resent certain patterns in the sensor data observed in

such a system. For instance, it can often be predicted

on the basis of patterns in the temperature and pres-

sure observations in a system such as a gas turbine

that an expensive malfunction is about to take place.

Often the patterns that are relevant for making such

predictions are complex patterns, consisting of sim-

pler patterns occurring in a particular temporal rela-

tion. There are several different existing methods to

approach the problem of automatically detecting such

patterns.

The method of complex event processing (CEP)

(Luckham, 2001) is one way to handle complex tem-

poral patterns of observations. Central to this method

is the processing of events. An event is a message that

a particular situation has occurred at a certain time

point. On the one hand, events can be based on sim-

ple observations. On the other hand, complex events

can be based on the occurrence of simpler events in

a particular temporal structure. Complex event pro-

cessing allows engineers to ﬂexibly and declaratively

specify the deﬁnition of such complex events.

Another approach to process observations, par-

ticularly in numerical data, is to deploy arithmetical

methods to detect patterns in the data. This often in-

volves preprocessing and normalization. Arithmetical

methods can then be used on the preprocessed data

to detect situations such as increasing or decreasing

trends, or the exceedance of a threshold. The prepro-

cessing allows us to detect such situations in the data

itself, but also in derived data such as the average or

standard deviation over a given time period.

1.1 Problem Statement

For expressing diagnostic knowledge of technical sys-

tems often the most meaningful patterns are com-

plex temporally related occurrences of observations

in (preprocessed) data. CEP allows us to ﬂexibly de-

tect the complex temporal structure, while arithmeti-

cal knowledge discovery methods allow us to detect

the basic arithmetical patterns in the (preprocessed)

data. However, an approach that allows us to combine

the advantages of both methods is not yet available.

In this paper, we will develop a method that

makes it possible to conveniently and ﬂexibly specify

complex temporally structured events based on basic

arithmetical patterns in preprocessed data.

2 APPROACH

We develop a system that combines the ability of

complex event processing to specify complex tempo-

rally structured events with the possibility to specify

arithmetical patterns in preprocessed data.

329

de Haan R. and Roshchin M..

Detecting Temporally Related Arithmetical Patterns - An Extension of Complex Event Processing.

DOI: 10.5220/0004135603290332

In Proceedings of the International Conference on Knowledge Discovery and Information Retrieval (KDIR-2012), pages 329-332

ISBN: 978-989-8565-29-7

 2012 SCITEPRESS (Science and Technology Publications, Lda.)

We design our system as an extension of complex

event processing. We will develop a declarative lan-

guage that allows engineers to express complex tem-

porally structured patterns based on basic arithmeti-

cal patterns in the preprocessed data. Our system will

then interpret expressions in this declarative language

as CEP rules, that automatically generate the speci-

ﬁed events. This allows us to leverage the existing

CEP technologies.

The aim of this paper is to make it possible to

specify complex events that have a temporal structure

and that are based on arithmetical patterns in prepro-

cessed, numerical data, and to do so in a declarative

manner.

3 LANGUAGE EXTENSION FOR

COMPLEX EVENT

PROCESSING

We formally deﬁne the syntax and semantics of the

language we propose. The syntax of the language is

described in Figure 1. Categories in this context-free

syntax are written in boldface. Note that terms of cat-

egory N denote a natural number. We consider a term

of category user event as an event deﬁnition.

Let X and D be two disjoint sets of variables and

data variables, respectively. We interpret terms x(n)

as variables x

∈ X and we interpret terms d(n) as

data variables d

∈ D .

An event deﬁnition speciﬁes a complex event and

the conditions under which it is generated. Consider

an event deﬁnition hname, expr, constri. The string

name represents the user-deﬁned name of the event.

The conditions under which this eventis generated are

speciﬁed by expr and constr. The term expr of cate-

gory expression is a speciﬁcation of the nature of the

event. This expression may contain variables of the

form x

, and data variables of the form d

, for n ∈ N.

The conditions in the list constr specify constraints

on the instantiation of such (data) variables in expr.

More formally, a term expr of category expression

speciﬁes event generation conditions for each instan-

tiation θ of variables and data variables in expr that

satisﬁes the conditions in constr.

In the following, we deﬁne the conditions on in-

stantiations θ speciﬁed by a term constr, and we re-

cursively deﬁne the event generation conditions spec-

iﬁed by a term expr and an instantiation θ.

3.1 Constraints on Instantiations

An instantiation θ for a term expr assigns each vari-

able x

to a natural number, and each data variable

to a sensor name sensorname of an existing sensor.

This means that in the term expr multiple occurrences

of variables x

or data variables d

are assigned to the

same number or sensor, respectively. Furthermore,

we say that an assignment θ satisﬁes the conditions

given by constr if it satisﬁes each constraint in the list

constr. Such constraints get the straightforward in-

terpretation. For instance, an assignment θ satisﬁes a

constraint x

≤ m iff θ(x

) ≤ m holds.

3.2 Recursive Deﬁnition of Events

We recursively specify the event generation condi-

tions given by a term expr of category expression,

and an instantiation θ of the (data) variables in expr.

We can roughly divide the recursion in two parts:

the deﬁnition of data events (speciﬁed by terms of

category num data) and the deﬁnition of intentional

events (speciﬁed by terms of categories atomic and

expression).

Data events represent values of (preprocessed)

data. Occurrences of such events thus have a particu-

lar value, in addition to information about the nature

of the event. Furthermore, data events have no dura-

tion, only a time point.

Terms of the form data(sensorname) specify data

events that directly represent observations of the sen-

sor with name sensorname. In other words, when-

ever an observation for the sensor is made, such a

data event should be generated. These events contain

information about the observed value, the time point

at which the value was observed, and the sensor for

which the observation was made.

Terms of the form d

specify similar data events

for the sensor with name θ(d

). Terms of the form

avg(data term, time term) specify data events as fol-

lows. For each time window of length time term, we

consider all occurrences of data events speciﬁed by

data term. Then, a data event is generated at the

end of the time window, whose value is the arith-

metic mean of the values of all considered data events.

Terms of the form sd(data term,time term) specify

similar data events, where instead of the arithmetic

mean, the standard deviation is taken as value. Terms

of the form (data term1− data term2) specify data

events in the following manner. For any time point in

which both a data event e

speciﬁed by data term1

and a data event e

speciﬁed by data term2 occur,

a data event is generated whose value is the value

of e

minus the value of e

. Data events are gener-

ated analogously for terms of the form (data term1+

data term2), for addition instead of subtraction.

Intentional events represent (possibly complex)

KDIR2012-InternationalConferenceonKnowledgeDiscoveryandInformationRetrieval

330

time → N ;

var → x(N) ;

var time → time | var ;

data var → d(N) ;

num data → data(string) | data var

| sd(num data,time) | avg(num data,time)

| (num data - num data) | (num data + num data) ;

trend dir → up | down ;

threshold value → num data | N ;

atomic → trend(trend dir, num data, var time)

| less than(threshold value, threshold value, var time)

| less than or equal(threshold value, threshold value, var time) ;

temporal operator → after(time, time) | after

| during(time, time) | during

| meets(time) | meets

| overlaps(time, time) | overlaps

| starts(time) | starts

| ﬁnishes(time) | ﬁnishes ;

expression → atomic

| (expression temporal operator expression)

| (not expression temporal operator expression)

| (expression temporal operator not expression) ;

condition list → condition :: condition list

| [] ;

condition → var ≤ N

| var < N

| var ≥ N

| var > N ;

user event → h string, expression, condition list i ;

Figure 1: Grammar for the speciﬁcation language.

patterns that are observed in the (preprocessed) data.

Occurrences of such events thus have no particular

value, but they do contain information about the na-

ture of the event. Also, intentional events are interval

events, i.e., they have a time point and a duration.

Terms of the form trend(dir, data term,

var time term) specify the generation of inten-

tional events as follows. For each time window

whose length equals θ(var time term), we consider

all occurrences of data events speciﬁed by data term.

If the values of all these occurrences of data events

are (chronologically) increasing, in case dir = up, or

(chronologically) decreasing, in case dir = down, an

event is generated for the whole time span.

A term of the form less than(value term1,

value term2, var time term) speciﬁed the generation

of intentional events as follows. We distinguish sev-

eral cases:

• If both value term1 and value term2 specify data

events (as opposed to a natural number), the fol-

lowing generation conditions hold. For each time

window whose length equals θ(var time term),

we consider all moments such that both a data

event e

speciﬁed by value term1 and a data event

speciﬁed by value term2 occur. If for each

such moment in the time window, the value of e

is strictly less than the value of e

, we generate an

intentional event during the whole time span.

• The case where value term1 speciﬁes a data event

and value term2 speciﬁes a natural number (or

vice versa) is handled similarly.

• In the case where both value term1 and

value term2 specify natural numbers, we

generate no events. This would be nonsensical.

Analogous event generation condi-

tions are speciﬁed by terms of the form

less than or equal(value term1, value term2, var

time term), with the only difference that non-strict

comparison is used instead of strict comparison.

Terms of the form (expr1 temporal operator

expr2) specify event generation conditions as fol-

DetectingTemporallyRelatedArithmeticalPatterns-AnExtensionofComplexEventProcessing

331

lows. For any occurrence of an intentional event spec-

iﬁed by expr1 and any occurrence of an intentional

event speciﬁed by expr2, occurring in the temporal

relation speciﬁed by temporal operator, we generate

an intentional event, spanning the minimal time span

in which the occurrences of both events ﬁt.

The possible temporal operators of category tem-

poral operator get the straightforward interpretation

of Allen’s temporal interval operators (Allen, 1983).

Temporal operators can be given extra arguments.

The interpretation of temporal operators with extra ar-

guments is as described for the corresponding opera-

tors in the documentation of Drools Fusion.

Terms of the form (expr1 temporal operator

not expr2) specify event generation conditions as

follows. For any occurrence e of an intentional

event speciﬁed by expr1 such that there is no oc-

currence of an intentional event speciﬁed by expr2,

that occurs in the temporal relation, speciﬁed by

temporal operator, with e, we generate an inten-

tional event, spanning the same interval as e. Terms of

the form (not expr1 temporal operator expr2) spec-

ify event generation conditions analogously.

4 EXAMPLES

In order to demonstrate the working of our method,

and the ﬂexibility it offers, we will give a few exam-

ples of event deﬁnitions and the events they generate.

Consider, for instance, the case of representing

diagnostic knowledge of a technical system that has

several temperature sensors. Assume that we have

some domain speciﬁc knowledge, that the divergence

of values for two temperature sensors, possibly in

combination with other events, can be a predictor for

a particular malfunction in the system. We can auto-

matically generate events corresponding to the diver-

gence of two sensor values, for a period of at least 10

seconds, by means of the following event deﬁnition.

h “distance increases for at least 10s”,

trend(up, (d(1) − d(2)), x(1)), [x(1) ≥ 10] i

Assume now that we have some particular knowl-

edge of the technical system, that a predictor for the

malfunctioning behavior is that the values of two sen-

sors differ by more than 20 units for at least 60 sec-

onds. We can automatically generate corresponding

events with the following event deﬁnition.

h “distance above 20 for at least 60s”,

less than(20, (d(1) − d(2), x(1)), [x(1) ≥ 60] i

We could use (occurrences of) those two events in

a larger complex event processing system to represent

diagnostic knowledge of the system. However, as-

sume now that the sequential occurrence of the above

two events is an even better predictor for the malfunc-

tioning behavior. By means of the following event

deﬁnition, we could generate corresponding events.

h “complex predictor for malfunction m”,

trend(up, (d(1) − d(2)), x(1)) meets

less than(20, (d(1) − d(2), x(2))),

[x(1) ≥ 10, x(2) ≥ 60] i

5 ADVANTAGES

Our approach, extending complex event processing

with a declarative language to specify complex events

based on arithmetical patterns in preprocessed data,

has several advantages. First of all, it makes it pos-

sible to specify (complex) events based on arithmeti-

cal patterns in a declarative fashion, which is not pos-

sible with currently existing methods. This has the

advantage that diagnostic systems dealing with such

patterns become more easily maintainable and modi-

ﬁable. Secondly,it allows users of complex eventpro-

cessing systems to intuitively and straightforwardly

also take into account arithmetical patterns, in addi-

tion to the usual nominal, intentional events.

6 CONCLUSIONS

In this paper, we developed an extension of complex

event processing methods that makes it possible to

specify complex, temporally structured events based

on arithmetical patterns in numerical data. This is

done by means of a declarative language, whose ex-

pressions are interpreted as event generation condi-

tions. This allows the automatic generation and use of

events based on such declarative speciﬁcations only.

Future work would include investigating how the

automatic generation of events speciﬁed with the de-

veloped declarative language could be combined with

other diagnostic knowledge representation methods.

REFERENCES

Allen, J. F. (1983). Maintaining knowledge about temporal

intervals. Commun. ACM, 26(11):832–843.

Luckham, D. C. (2001). The Power of Events: An Intro-

duction to Complex Event Processing in Distributed

Enterprise Systems. Addison-Wesley Longman Pub-

lishing Co., Inc., Boston, MA, USA.

KDIR2012-InternationalConferenceonKnowledgeDiscoveryandInformationRetrieval

332