Event analysis device and event analysis method

Abstract

This invention provides an event analysis device and method that can accurately extract correlations between events and accurately calculate time lags between events. [Solution] An event analysis device 10 for analyzing multiple different types of events that occur in plant systems such as those in the chemical or water supply fields, generates time-series data for each event at predetermined time intervals based on event occurrence time information which includes at least identification information and occurrence time for all events that occurred in the system during a predetermined period, for each event, extracts chains by applying multiple time lags to the time-series data of each event for each event pair and calculates the number of chains, performs a correction process on all extracted chains so that there is no overlap in the occurrence times of the events, and calculates the number of corrected chains for each time lag, which is the number of chains after the correction process.

Description

Technical Field

[0001] The present invention relates to an event analysis apparatus and an event analysis method for analyzing events related to alarms and operations output by a plant system in the chemical field, water supply field, etc.

Background Art

[0002] In plants (such as chemical plants and water treatment plants) in the chemical field and water supply field, for a plurality of events related to alarms output from installed systems and operations on systems, etc., regarding the order of occurrence, time difference between occurrences, etc., as a technology for analysis, Patent Document 1 discloses an "alarm information storage unit that stores alarm information associating the content of an alarm and the occurrence time in a plant, a numerical sequence conversion unit that converts the occurrence time of each alarm into a numerical sequence, and an event pair consisting of a first event and a second event different from the first event among the alarms whose occurrence times are converted into numerical sequences is extracted, and the order of occurrence is calculated for the event pair" alarm analysis apparatus.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Conventional techniques calculate correlation values ​​for each amount of shift by slightly shifting the bit sequences of two events (which indicate whether an event occurs per unit time within a given period) (increasing the amount of time shift) and determining whether the two events occur simultaneously or with a time delay (the number of times the events overlap). Furthermore, conventional techniques calculate the independence probability between the two events based on the maximum correlation value and determine whether there is a correlation between the events. Thus, conventional techniques have the problem that the probability is not calculated with high accuracy because they only use the maximum value of the correlation value to calculate the independence probability. In addition, conventional techniques determine the amount of time shift at which the correlation value is maximum as the time difference between the occurrence of the two events. Although the time difference is actually thought to take the form of a distribution, conventional techniques have the problem of calculating it as a fixed value. Furthermore, the meaning of the correlation between events may differ depending on whether the time difference is positive or negative. Ideally, correlations should be extracted separately for positive and negative events. However, conventional techniques determine correlations based on the highest correlation value, meaning that correlations can only be found in either the positive or negative region, potentially leading to missed correlations.

[0005] This invention has been made in view of these problems, and aims to provide an event analysis device and an event analysis method that can accurately extract correlations between events and calculate time lags between events with high accuracy. [Means for solving the problem]

[0006] This invention includes several means to solve at least some of the above problems, one example of which is as follows. In other words, an event analysis device for analyzing multiple different types of events occurring in a system, comprising a database, a time series generation unit, a chain count calculation unit, and a corrected chain count calculation unit, wherein the database stores event details including identification information and attribute information for each of the events, and event occurrence time information including at least the identification information and occurrence time of all the events that occurred in the system during a predetermined period, the time series generation unit generates time series data for each event at predetermined time intervals based at least on the event occurrence time information, the chain count calculation unit calculates the chain count by assigning multiple time lags to the time series data of each event in the event pair, which is a combination of two types of events, for each time lag, and extracting chains for each time lag, and the corrected chain count calculation unit performs a correction process on all the extracted chains for each event pair so that there is no overlap in the occurrence times of the events, and calculates the corrected chain count, which is the number of chains after the correction process, for each time lag. [Effects of the Invention]

[0007] According to the present invention, it is possible to provide an event analysis device and an event analysis method that can accurately extract correlations between events and calculate time lags between events with high accuracy.

[0008] Other issues, configurations, and effects not mentioned above will be clarified by the following description of the embodiments. [Brief explanation of the drawing]

[0009] [Figure 1] This figure shows an example of the overall configuration of the event analysis device according to the embodiment. [Figure 2] This figure shows an example of the functional configuration of the event analysis device according to the embodiment. [Figure 3]It is a diagram showing an example of event detail information in this embodiment. [Figure 4] It is a diagram showing an example of event occurrence time information in this embodiment. [Figure 5] It is a flowchart showing an example of the processing content of the time series generation unit in this embodiment. [Figure 6] It is a diagram showing an example of time series data for each event in this embodiment. [Figure 7] It is an explanatory diagram showing a calculation method for the number of chain occurrences for each event pair. [Figure 8] It is a flowchart showing an example of the processing content of the chain count calculation unit in this embodiment. [Figure 9A] It is a diagram showing an example of the calculation result of the number of chain occurrences of an event pair. [Figure 9B] It is a diagram showing an example of the calculation result of the number of chain occurrences of an event pair. [Figure 10] It is an explanatory diagram showing problems and solutions during the calculation of the number of chain occurrences. [Figure 11] It is a flowchart showing an example of the processing content of the corrected chain count calculation unit in this embodiment. [Figure 12] It is a flowchart showing an example of the detailed processing content of the corrected chain count calculation of the corrected chain count calculation unit in this embodiment. [Figure 13] It is a diagram showing an example of decomposing the number of chain occurrences when the time lag m = 0 in the chain count data of this embodiment. [Figure 14] It is a diagram showing an example of the calculation result of the event occurrence time by the corrected chain count calculation unit in this embodiment. [Figure 15A] It is a diagram showing an example of the calculation result of the corrected chain count by the corrected chain count calculation unit in this embodiment. [Figure 15B] It is a diagram showing an example of the calculation result of the corrected chain count by the corrected chain count calculation unit in this embodiment. [Figure 16] It is an explanatory diagram showing a calculation method for the independence probability for an event pair by the independence probability calculation unit in this embodiment. [Figure 17]It is a flowchart showing an example of the processing content of the independence probability calculation unit of the present embodiment. [Figure 18] It is a diagram showing an example of the list data in the present embodiment. [Figure 19] It is a diagram showing an example of the GUI screen displayed on the output unit included in the event analysis device of the present embodiment. [Figure 20] It is a diagram showing another example of the GUI screen displayed on the output unit included in the event analysis device of the present embodiment.

Mode for Carrying Out the Invention

[0010] Hereinafter, embodiments of the present invention will be described with reference to the drawings. The embodiments are examples for explaining the present invention, and for the sake of clarity of explanation, appropriate omissions and simplifications have been made. The present invention can be implemented in various other forms. Unless otherwise particularly limited, each component may be singular or plural.

[0011] In the drawings, the positions, sizes, shapes, ranges, etc. of the respective components shown may not represent the actual positions, sizes, shapes, ranges, etc. in order to facilitate understanding of the invention. Therefore, the present invention is not necessarily limited to the positions, sizes, shapes, ranges, etc. disclosed in the drawings. When there are a plurality of components having the same or similar functions, they may be described with the same reference numeral and different subscripts. Also, when it is not necessary to distinguish these plurality of components, the subscripts may be omitted in the description.

[0012] In the embodiment, the processing performed by executing a program may be described. Here, the computer executes the program by a processor (for example, CPU, GPU), and performs the processing defined by the program while using storage resources (for example, memory) and interface devices (for example, communication ports). Therefore, the subject of the processing performed by executing the program may be the processor. Similarly, the subject of the processing performed by executing the program may be a controller, device, system, computer, or node having a processor.

[0013] The main component of the processing performed by executing the program can be an arithmetic unit, and may include dedicated circuits for specific processing. Here, dedicated circuits include, for example, FPGAs (Field Programmable Gate Arrays), ASICs (Application Specific Integrated Circuits), and CPLDs (Complex Programmable Logic Devices).

[0014] The program may be installed on the computer from the program source. The program source may be, for example, a program distribution server or a storage medium readable by the computer. If the program source is a program distribution server, the program distribution server includes a processor and storage resources for storing the program to be distributed, and the processor of the program distribution server may distribute the program to other computers. In addition, in some embodiments, two or more programs may be implemented as a single program, or one program may be implemented as two or more programs. [Examples]

[0015] Figure 1 shows an example of the overall configuration of an event analysis device in an embodiment. The event analysis device 10 is a device that analyzes alarm events for a system that is the target of monitoring and control, or events for operations on the said system, and extracts correlations between two or more events. As shown in Figure 1, the event analysis device 10 has a storage unit 11 consisting of RAM (Random Access Memory), a hard disk, etc., a control unit 12 consisting of a CPU (Central Processing Unit), etc., an input unit 13 consisting of a human-machine interface such as a keyboard and mouse, as well as a network interface for acquiring data from an external network, and an output unit 14 consisting of a display for displaying calculation results. The control unit 12 calls and executes a calculation processing program 110 stored in the storage unit 11, and stores the calculation results in a database 120 or displays them on the output unit 14. During the program execution process, data acquired from the input unit 13 and various information stored in the database 120 are referenced as needed and used for calculation processing.

[0016] Figure 2 shows an example of the functional configuration of the event analysis device according to this embodiment. In Figure 2, the event analysis device 10 includes, as a functional configuration, a time series generation unit 21, a chain count calculation unit 22, a corrected chain count calculation unit 23, and an independence probability calculation unit 24. Here, a chain in this embodiment refers to the occurrence of one of two (or more) different events (hereinafter referred to as an event pair) at the same time period or at a specific interval due to the occurrence of the other event. In this embodiment, the number of occurrences of such chains within a predetermined period is called the chain count. Since the chain count also represents the correlation between event pairs, the chain count is also called the cross-correlation value of event pairs.

[0017] In Figure 2, the time series generation unit 21 generates time series data for multiple events, setting the bit for the event occurrence time to 1 and the bits for other times to 0, and stores the generated time series data in the database 120. The chain count calculation unit 22 calculates the chain count of event pairs for each event pair (the number of times two events occur in sync after a time lag) for various time lags based on the time series data, and stores the calculation result as the chain count for each event pair in the database 120. The corrected chain count calculation unit 23 calculates the occurrence times of the two events in which the above chain occurred for each event pair for various time lags, performs a correction process on the chain count so that there is no overlap of event occurrence times for all combinations of time lags, and stores the corrected chain count for each event pair in the database 120. The independence probability calculation unit 24 uses the corrected chain count information to calculate the independence probability and event occurrence probability for each event pair, creates a list data along with the detailed information of the event pair, and stores it in the database 120. Details of the processing content of each function and the data generated or calculated will be described later.

[0018] The database 120 holds event information 31, time-series data 32 for each event saved by each function as described above, chain count data 33 for each event pair, corrected chain count data 34 for each event pair, and list data 35 for each event pair. As will be described later, the event information 31 includes event occurrence time information and event details.

[0019] The calculation processing program 110 for realizing the functions of the time series generation unit 21, the chain count calculation unit 22, the corrected chain count calculation unit 23, and the independence probability calculation unit 24 is stored in the storage unit 11. The calculation processing program 110 may be provided pre-installed in ROM (Read Only Memory) or the like, or it may be provided and distributed as a file in an installable or executable format on a readable recording medium. Furthermore, the calculation processing program 110 may be stored on a computer connected to a network and provided and distributed by allowing downloads via the network.

[0020] Figure 3 shows an example of event details in this embodiment. Figure 4 shows an example of event occurrence time information in this embodiment. As described above, event details and event occurrence time information are stored in the database 120 as event information 31. First, let's explain the event details. Event details summarize the detailed information of all events that are the subject of event analysis. Events include alarms that the system issues when certain measurement information (variable values) exceed upper or lower limits, and information on operator operations (manual setting of system operation values, control value target values, etc.).

[0021] As shown in Figure 3, the event details include the serial number (No.) assigned to each event, the name of each event (event name), the attribute information of each event (event attribute information), and the number of occurrences for each event. Each event is identified by either the serial number or the event name. The event name is represented by an abbreviation (A1, A2, ..., Ope1, Ope2, ...) as shown in Figure 3. In this abbreviation, "A" represents an alarm-related event (hereinafter referred to as an alarm event), and "Ope" represents an operation-related event (hereinafter referred to as an operation event). In the example in Figure 3, serial numbers 1 to 700 are alarm events, with 700 types of alarms, and serial numbers 701 to 1000 are operation events, with 300 types of operations. The number and types of these events vary depending on the system size, the number of alarms set, etc. The event attribute information indicates what kind of abnormality or alarm an alarm event represents, or what kind of operation an operation event represents. Regarding the number of events, no data is recorded in the initial state of the analysis. As will be described later, the number of events calculated by the time series generation unit 21 is recorded for each event.

[0022] Event occurrence time information records all events that occurred in the system during a certain period, including the event name, occurrence time, and end time (event history). However, for operation events, only the time the operation was performed is recorded as the occurrence time; the end time is not recorded. In the example in Figure 4, the event history for one year, from April 2022 to March 2023, is recorded. The number of records (rows) in the event occurrence time information varies depending on the period, but for example, it can be tens of thousands to hundreds of thousands per year, and Figure 4 shows only a small portion of it. Note that the period of event history recorded in the event occurrence time information is not limited to the above one year; it can be any period, such as six months or three months.

[0023] Figure 5 is a flowchart showing an example of the processing content of the time series generation unit in this embodiment, and Figure 6 is a diagram showing an example of time series data for each event generated by the time series generation unit in this embodiment. First, the time series data will be explained. As shown in Figure 6, each time series data is data indicating whether or not a target event has occurred at predetermined intervals (hereinafter referred to as time steps) within a certain period. The value in this data indicating whether or not a target event has occurred at each time step is a bit, and each bit is set to 0 or 1. Therefore, each time series data consists of a bit sequence of 0s or 1s. Each bit in each time series data is set to 1 when some event occurs in the corresponding time step (when an alarm is issued or an operation is performed), and to 0 otherwise (if no event occurs in the time step).

[0024] The period represented by each time series data corresponds to the period of the event occurrence time information shown in Figure 4, such as one year, six months, or three months. Furthermore, various intervals can be used for the time step of each time series data, such as one minute or ten minutes. For example, if the event occurrence time information records a one-year event history and a one-minute time step is used, the time series data will show whether or not the target event occurred at one-minute intervals over the year. In this case, the number of time steps in the year is 525,600, so the number of bits (bit length) of each time series data will be 525,600. Figure 6 shows only a small portion of these bit sequences. If the time series data shows whether an event occurred during a one-year period from January 1, 2023, 0:00 to January 1, 2024, 0:00, in one-minute intervals, the first bit would indicate whether the event occurred during the first interval of that period, January 1, 2023, 0:00 to 0:01; the second bit would indicate the event one minute later; the third bit would indicate the event one minute later; and the last bit would indicate whether the event occurred during the last interval of that period, December 31, 2023, 23:59 to January 1, 2024, 0:00.

[0025] Next, the processing details of the time series generation unit 21 will be explained using the flowchart shown in Figure 5. In the explanation from Figure 5 onward, the case in which a 1-minute time step is adopted will be used as an example. In step S501, the time series generation unit 21 reads the event details shown in Figure 3 from the database 120, and then in step S502, it reads the event occurrence time information shown in Figure 4 from the database 120. Next, in step S503, the time series generation unit 21 assigns 1 to the variable I. Variable I is an integer representing the serial number in the event details. After that, in step S504, the time series generation unit 21 determines whether I is greater than Sx (Sx indicates the maximum value of the serial number, which is set to 1000, the total number of events, in the example of Figure 3), and if it determines that it is greater, it considers that the generation process of time series data for all events is complete and terminates the process. On the other hand, if I is determined to be less than or equal to Sx, in step S505, the time series generation unit 21 generates time series data for the first event (the event with serial number I) shown in Figure 3 and stores it in the database 120 in pairs with serial number I.

[0026] The time series data is generated by identifying the time at which the first event occurred by referring to the event occurrence time information shown in Figure 4, and setting the bit corresponding to that time in the time step to 1. Then, in step S506, the time series generation unit 21 calculates the sum of the bits in the time series data of the generated first event, that is, the total number of bits set to 1 (hereinafter referred to as bit 1), and in step S507, writes and saves this as the number of occurrences of the first event in the event details shown in Figure 3. Note that if there are multiple events with very close occurrence times (i.e., multiple events occur in one time step), they will be aggregated into one bit (the bit will be set to 1 regardless of the number of events that occurred), but this does not pose any particular problem in data analysis processing. Next, in step S508, the time series generation unit 21 increments the variable I by 1 and returns to the processing in step S504. The time series generation unit 21 repeats the above process (S504~S508) to generate time series data for all events in the format shown in Figure 6, and saves it to the database 120.

[0027] Figure 7 is an explanatory diagram illustrating the method for calculating the number of chain events for each event pair by the chain count calculation unit of this embodiment. Figure 7 shows an example of calculating the number of chain events using the time series data 701 of event AI and the time series data 702 of event OpeJ, where the event pair consists of the Ith event (here, an alarm event, referred to as event AI) and the Jth event (J, like I, is an integer representing a sequential number) (here, an operation event, referred to as event OpeJ). As mentioned above, the time series data 701 and 702 in Figure 7 are examples of data with a time step of 1 minute.

[0028] The time lag shown in Figure 7 refers to the interval in a chain of event pairs (the time between the occurrence of one event and the occurrence of the other event). For example, if one is an alarm event and the other is an operation event, the operation event occurs as a result of the alarm event, i.e., the operation is performed, so the time lag is also called the response time between events. The chain count calculation unit 22 assumes various values ​​for this time lag and calculates the chain count by extracting chains from two time-series data for each assumed value. Specifically, first, the chain count calculation unit 22 assumes a value for the time lag. For example, if the time lag is m and it is assumed that event OpeJ occurs 1 minute after event AI occurs, the chain count calculation unit 22 sets the time lag m = 1 (assuming the time lag value is 1). Conversely, if it is assumed that event AI occurs 1 minute after event OpeJ occurs, the chain count calculation unit 22 sets the time lag m = -1 (assuming the time lag value is -1). Thus, the chain count calculation unit 22 assumes (sets) a value for the time lag m, assuming that event OpeJ occurs with a delay and a negative value if event AI occurs with a delay. The chain count calculation unit 22 sets the value of the time lag m to a positive or negative value in the units of the above time step (i.e., 1-minute intervals if the time step is 1 minute, 10-minute intervals if it is 10 minutes, and 1-hour intervals if it is 1 hour).

[0029] Next, the chain count calculation unit 22 applies the assumed time lag m to the two time series data. Specifically, it shifts the two time series data by the same number of time increments as the assumed time lag m. For example, in the example shown in Figure 7, assuming a time lag m = 2, i.e., event OpeJ occurs 2 minutes after event AI occurs, time series data 702 is delayed by 2 time increments relative to time series data 701 (shifted to the left in Figure 7). Similarly, if a time lag m = -1, i.e., event AI occurs 1 minute after event OpeJ occurs, time series data 702 is advanced by 1 time increment relative to time series data 701 (shifted to the right in Figure 7). Thus, the time lag m corresponds to the amount of shift in time increments between the two time series data.

[0030] When two time series data are given a time lag m, the time domain in which the two time series data overlap (hereinafter referred to as the pair overlap time domain) is, for example, the entire time domain (the entire period mentioned above) if m=0, but if the time lag m=1, it is the time domain from the 2nd (1+mth) bit onwards in time series data 702, and if the time lag m=2 as shown in Figure 7, it is the time domain from the 3rd bit onwards. In this pair overlap time domain, the bits from the 1st bit onwards in one time series data and the bits from the 1+mth bit onwards in the other time series data will overlap (the bit positions will be the same). For example, if the time lag m=2, the 1st, 2nd, ... bits of time series data 701 will overlap with the 3rd, 4th, ... bits of time series data 702.

[0031] The chain count calculation unit 22 calculates the chain count of an event pair by using the values ​​of each bit of each time series data in the pair overlap time domain, when various time lags m are given to each time series data 701 and 702 of the event pair. If the chain count when the time lag m = T is C(T), then C(T) can be obtained by the following formula.

[0032] The number of chained items C(T) at a time lag m=T. =A vector V1 whose components are each bit value of the time series data 701 in the paired overlapping time domain, The inner product of a vector V2 whose components are each bit value of the time series data 702 in the paired overlapping time domain. The number of chained events C(T) is calculated by considering the case where the overlapping bits of the time series data 701 and 702 in the overlapping time domain, given a time lag m=T, are bit 1, and determining the number of such chains (the number of cases where two events occur in sync after a time lag m=T).

[0033] Figure 8 is a flowchart showing an example of the processing content of the chain count calculation unit in this embodiment. Note that the definitions of variables I, J, and Sx in the explanation from Figure 8 onward are the same as above. First, in step S801, the chain count calculation unit 22 assigns 1 to variable I. Next, in step S802, the chain count calculation unit 22 determines whether I is greater than or equal to Sx-1. If it determines that I is greater, it considers that the calculation of the chain count has been completed for all event pairs and terminates the process. On the other hand, if it is determined that I is less than or equal to Sx-1, in step S803, the chain count calculation unit 22 assigns I+1 to variable J. Then, in step S804, the chain count calculation unit 22 determines whether variable J is greater than or equal to Sx. If it determines that J is greater, it proceeds to step S807, increases the value of variable I by 1, and returns to the processing in step S802.

[0034] On the other hand, if the variable J is determined to be less than or equal to Sx, the process proceeds to step S805, where the chain count calculation unit 22 reads the time-series data for each of the event pairs (I, J) from the database 120, treating the Ith and Jth events as an event pair, and calculates the number of chained events for the event pair based on the two time-series data for various time lags m. In step S805, the chain count calculation unit 22 calculates the number of chains in the overlapping time domain of the two time-series data pairs (the number of times the occurrence of two events synchronizes after a time lag m) for each time lag m set using the calculation method described above, thereby determining the number of chains for multiple time lags m. The chain count calculation unit 22 then stores the calculated chain count data 33 in the database 120, paired with the event pair (I, J) (the order of I, J is significant). Next, in step S806, the variable J is incremented by 1, and the process returns to step S804.

[0035] The chain count calculation unit 22 repeats the above process to calculate the chain count for all event pairs (I, J), and the chain count data 33 is stored in the database 120. The time lag m in the above explanation is set to a value within a possible time range for the time lag between correlated events. That is, the value of the time lag m is set within a time range that can be considered as the interval between events when a chain occurs in an event pair (when one event occurs as a result of the other event occurring). For example, if an interval of up to 15 minutes is possible (conceivable) between events, then the time lag m is set within a time range of -15 minutes to 15 minutes, using a time step of 1 minute (i.e., m = -15 to 15).

[0036] Figures 9A and 9B show examples of the calculation results of the chain count of an event pair by the chain count calculation unit of this embodiment. In the explanation from Figure 9 onward, the case where the time lag m is set to a time range of -15 minutes to 15 minutes (i.e., m = -15 to 15) will be used as an example. Figure 9A shows an example of the calculation result (numerical value) of the chain count when event AI and event OpeJ are treated as an event pair, similar to Figure 7. In Figure 9A, the calculation result 901 shows the values ​​of the time lag m in the time range of -15 minutes to 15 minutes, with a time step of 1 minute, and the values ​​of the chain count C calculated for each of those values. The chain count calculation unit 22 saves such calculation results as chain count data 33 in the database 120. Figure 9B shows an example of a graph plotting the calculation result 901. In Figure 9B, the horizontal axis is time lag and the vertical axis is chain count, and a line graph 902 plotting the calculation result 901 is shown.

[0037] Figure 10 is an explanatory diagram illustrating the problems and solutions when calculating the number of chained events. In Figure 10, the problem is illustrated in upper Figure 1001, and the solution is illustrated in lower Figure 1002. First, the problem will be explained using upper Figure 1001 of Figure 10. Upper Figure 1001 illustrates an example of the timing of events 1 and 2. In this example, two instances of event 1 occur with a 10-minute interval, and event 2 occurs at the same time as the second instance of event 1. In such a case, when the chained event calculation unit 22 calculates the number of chained events for the event pair (1, 2) as described above, for example, if the time lag m is in the range of -15 minutes to 15 minutes, then when the time lag m = 10, the first instance of event 1 and the occurrence of event 2 are associated, and one chained event is counted. Also, when the time lag m = 0, the second instance of event 1 and the occurrence of event 2 are associated, and one chained event is counted. As shown in Figure 1001 above, the occurrence of one event 2 is used twice in the calculation of the chain count with the occurrence of event 1 (counted as two chain events). In reality, since only one event 2 occurs, it should be associated with one of the two occurrences of event 1 and counted as one chain event. However, the above method of calculating the chain count results in the chain count being counted twice due to the occurrence of one event 2 at different time lags m, which leads to an overestimation of the chain count value for each time lag.

[0038] Figure 1002 below shows a solution to this problem. Specifically, by using the three rules (1) to (3) shown as solutions in Figure 1002 below, it is possible to determine whether Event 2 (occurrence 1) is associated with Event 1 (occurrence 2). Rule (1) is to keep the chain whose time lag is closer to the time lag of the maximum number of chain occurrences. For example, suppose that the result of calculating the number of chain occurrences for the event pair (1, 2) shown in the example in Figure 1001 above is that the maximum number of chain occurrences is 10, and the time lag when that number was calculated was 1 minute (m=1). In this case, as described above, the time lag m=10 that associates the occurrence of Event 2 with the occurrence of the first occurrence of Event 1, and the time lag m=0 that associates the occurrence of Event 2 with the occurrence of the second occurrence of Event 1, the time lag m=0 is closer to m=1, so the chain when the time lag m=0 is kept, that is, the number of chain occurrences is counted as 1 only when the time lag m=0. In this case, there are no chains when the time lag m=10, and the chain count is 0. Rule (2) is to keep the chain with the larger chain count. For example, if the total number of chains when the time lag m=0 is 5, and the total number of chains when the time lag m=10 is 2, the chain when the time lag m=0 is kept and included in the chain count calculation. Rule (3) is to keep the chains whose time lag has the same sign as the time lag of the largest chain.

[0039] The corrected chain count calculation unit 23 of this embodiment performs a chain count correction process by using such a solution to calculate a new chain count (hereinafter referred to as the corrected chain count) that eliminates duplicate counts of chain counts due to the occurrence of a single event from the chain count calculation unit 22. Note that the rules (1) to (3) above alone may not be sufficient to determine which chains to keep. In such cases, the chains to keep can be determined by using rules (1) to (3) in an appropriate combination.

[0040] Figure 11 is a flowchart showing an example of the processing content of the corrected chain count calculation unit in this embodiment. First, in step S1101, the corrected chain count calculation unit 23 assigns 1 to the variable I. Next, in step S1102, the corrected chain count calculation unit 23 determines whether I is greater than or equal to Sx-1. If it is determined to be greater, it considers that the calculation of the corrected chain count has been completed for all event pairs and terminates the process. On the other hand, if it is determined that I is less than or equal to Sx-1, in step S1103, the corrected chain count calculation unit 23 assigns I+1 to the variable J. Then, in step S1104, it determines whether the variable J is greater than or equal to Sx. If it is determined to be greater, it proceeds to step S1107, increases the value of variable I by 1, and returns to the processing in step S1102.

[0041] On the other hand, if the variable J is determined to be less than or equal to Sx, the process proceeds to step S1105, where the corrected chain count calculation unit 23 calculates the corrected chain count for the event pair (I, J) with various time lags m, treating the Ith and Jth events as an event pair. The details of the process in step S1105 will be described later using the flowchart shown in Figure 12. In step S1106, the corrected chain count calculation unit 23 stores the corrected chain count data 34, which is the calculation result of step S1105, in the database 120, paired with the event pair (I, J) (the order of I and J is significant). Next, in step S1107, the variable J is incremented by 1, and the process returns to step S1104. The corrected chain count calculation unit 23 repeats the above process, calculating the corrected chain count for all event pairs (I, J), and the corrected chain count data 34 is stored in the database 120.

[0042] Figure 12 is a flowchart showing an example of the detailed processing of the corrected chain count calculation (S1105 in the flowchart of Figure 11) of the corrected chain count calculation unit of this embodiment. In step S1201, the corrected chain count calculation unit 23 reads chain count data 33 for the event pair (I, J) from the database 120. The chain count data 33 is, for example, the calculation result shown in Figure 9A. Next, in step 1202, if there is a chain count when the time lag m=0 (it is 1 or more), the corrected chain count calculation unit 23 decomposes it into negative and positive sides. The chain count when the time lag m=0 is the number of cases where the difference between the occurrence time of event I and the occurrence time of event J in the event pair (occurrence time of event J - occurrence time of event I) is greater than -1 minute and less than 1 minute. The corrected chain count calculation unit 23 determines whether the above difference in occurrence times between the two events for each chain, which is counted as the chain count when the time lag m=0, is on the negative side (greater than -1 minute and less than 0 minutes) or the positive side (0 minutes or more and less than 1 minute), and calculates the chain counts on the negative side and the positive side, respectively.

[0043] Figure 13 shows an example of how the number of chained events in the chained event data when the time lag m=0 is decomposed as described above. Figure 13 shows an example of how the number of chained events (1) when the time lag m=0 in the calculation result 901 (i.e., chained event data 33) shown in Figure 9A is decomposed into negative and positive sides. In Figure 13, the number of chained events with a time lag m of -0 (1) is the number on the negative side, and the number of chained events with a time lag m of +0 (0) is the number on the positive side. In this example, the above difference in occurrence time between the two events when the time lag m=0 is on the negative side, and the number of chained events with a time lag m of -0 is 1.

[0044] Returning to the explanation of Figure 12, in step S1203, the corrected chain count calculation unit 23 refers to the chain count data 33 obtained in S1202 by decomposing the chain count when the time lag m=0 into negative and positive sides, and extracts time lag m values ​​for which the chain count is 1 or more. For example, in the case of the chain count data 33 shown in Figure 13 (i.e., the calculation results 901 and line graph 902 shown in Figures 9A and 9B), the extracted time lag m values ​​are -15, -13, -12, -11, -10, -9, -4, -3, -2, -1, -0, 1, 2, 3, 4, 5, 6, 7, 8, 13, 14, and 15, which is 22 values.

[0045] In step S1204, the corrected chain count calculation unit 23 calculates the occurrence times of two events for each chain counted as chain count when the time lag m is set to each of the extracted values. Specifically, the corrected chain count calculation unit 23 reads time series data 32 related to event pairs (I, J) from the database 120, sets the time lag m to each of the above values, extracts one or more chains for each time lag m, and determines the occurrence time of each chain (the time of the occurrence position of each chain in each time series data 32 (i.e., the start time of the time step in which each chain occurred)), thereby calculating the occurrence times of event I and event J in each chain when the time lag m is set to each of the above values. The corrected chain count calculation unit 23 stores the occurrence times of event I and event J in each chain calculated in this way when the time lag m is set to each of the above values.

[0046] Figure 14 shows an example of the calculation result of event occurrence time by the corrected chain count calculation unit of this embodiment. Figure 14 shows examples of the occurrence times of event pairs (I, J) in each chain when the time lag m = -12 and time lag m = -3 in the chain count data 33 shown in Figure 13. In Figure 14, the upper figure 1401 shows the occurrence times of events (I, J) in the chain when the time lag m = -12, and since there is 1 chain, there is 1 event occurrence time for each. The lower figure 1402 shows the occurrence times of events (I, J) in the chain when the time lag m = -3, and since there are 10 chains, there are 10 event occurrence times for each.

[0047] Returning to the explanation of Figure 12, in step S1205, the corrected chain count calculation unit 23 assigns sequential numbers (1 to Mx) to each value of time lag m extracted in step S1203, in ascending order. In the example of chain count data 33 shown in Figure 13, 22 values ​​are extracted, so Mx = 22. In step S1206, the corrected chain count calculation unit 23 assigns 1 to the variable i. Variable i is an integer representing the sequential number assigned to each value of the extracted time lag m. In step S1207, the corrected chain count calculation unit 23 determines whether i is greater than Mx-1, and if it is, terminates all processing. If i is less than or equal to Mx-1, in step S1208, the corrected chain count calculation unit 23 assigns i+1 to the variable j. Variable j is also an integer representing the sequential number assigned to each value of the extracted time lag m. In step S1209, the corrected chain count calculation unit 23 determines whether j is greater than Mx. If it is, the corrected chain count calculation unit 23 proceeds to step S1214, adds 1 to i, and returns to the process in step S1207.

[0048] If in step S1209 it is determined that j is less than or equal to Mx, then in step S1210 the corrected chain count calculation unit 23 determines whether there is any overlap (same occurrence time) of the occurrence times of event I and event J for the i-th and j-th time lags m. In the example of the occurrence times of events (I, J) in each chain when the time lag m = -12 and the time lag m = -3 shown in Figure 14, it can be seen that there is an overlap in the occurrence time of event J, that is, the same occurrence time. Therefore, in this example, the corrected chain count calculation unit 23 determines that there is an overlap in the occurrence time of event J for the 3rd and 8th time lags m.

[0049] In step S1211, the corrected chain count calculation unit 23 determines which time lag m to delete (whether to delete the chain with the i-th time lag m or the j-th time lag m). In the example shown in Figure 14, there is an overlap in the occurrence times of event J, so it is necessary to delete either the chain with time lag m=-12 or the chain with time lag m=-3. The decision of which to delete is made by applying rules (1) to (3) shown in Figure 1002 below Figure 10. When rule (1) or (2) is applied, the number of chains with time lag m=-3 is 10, which is the maximum value, and is also larger than the number of chains with time lag m=-12, so the chain with time lag m=-3 remains and the chain with time lag m=-12 is deleted. Therefore, in the example shown in Figure 14, the corrected chain count calculation unit 23 determines that the time lag m to delete is -12.

[0050] In step S1212, the corrected chain count calculation unit 23 deletes chains in which the event occurrence times overlap at the time lag m (i-th or j-th time lag m) determined in step S1211. At this time, only the occurrence time of either event I or event J overlaps, but the deletion of the chain also deletes the occurrence time of the other event corresponding to that occurrence time. The corrected chain count calculation unit 23 then newly stores the event occurrence times for each chain at the time lag m after the chain deletion.

[0051] In the example shown in Figure 14, chains with overlapping event occurrence times when the time lag m = -12 are deleted. Since there is only one chain when the time lag m = -12, the deletion of the chain results in a total of 0 chains. Therefore, in this case, the corrected chain count calculation unit 23 newly stores the chains as if they did not exist when the time lag m = -12. If the chains with a time lag m = -3 are deleted, the corrected chain count calculation unit 23 will newly store the event occurrence times of each of the remaining 9 chains after deleting one of the 10 chains as the event occurrence times when the time lag m = -3.

[0052] In step S1213, the corrected chain count calculation unit 23 adds 1 to j to create a new j, and returns to step S1209. In the processing from S1210 to S1212, which is repeated after S1209, the event occurrence times for each chain at each time lag m after chain deletion, which have been stored as described above, are used to determine overlaps and delete chains. In this way, the corrected chain count calculation unit 23 repeats the processing from S1209 to S1213 (or from S1207 to S1213 if it moves from S1209 to S1214), so that the processing from steps S1210 to S1212 is executed for all combinations of i and j set in S1206 or S1214. As a result, there will ultimately be no overlaps in event occurrence times for any combination of time lags. With the overlaps in event occurrence times thus eliminated, the number of remaining event occurrence times for each time lag m is counted, and the final chain count (corrected chain count) is calculated.

[0053] Figures 15A and 15B show examples of the calculation results of the corrected chain count by the corrected chain count calculation unit of this embodiment. Figure 15A shows the results (numerical values) of the calculation process for the corrected chain count (i.e., the process of deleting chains with overlapping event occurrence times and recalculating the chain count) performed on the chain count by time lag shown in Figure 13. In Figure 15A, the calculation result 1501 shows the value of the corrected chain count Cr by time lag. Figure 15B shows an example of a graph plotting the calculation result 1501. Similar to Figure 9B, the horizontal axis is time lag and the vertical axis is the corrected chain count, showing a line graph 1502 plotting the calculation result 1501. As described above, in calculating the corrected chain count, by applying rules (1) to (3) shown in Figure 1002 below Figure 10, chains are not deleted much when the time lag m = -3, which is the maximum chain count, and around that time lag, thus maintaining the chain count. Chains at other time lags m (peripheral chains corresponding to noise) are deleted, and the chain count decreases, as shown in Figures 15A and 15B.

[0054] Figure 16 is an explanatory diagram showing the method for calculating the independence probability for an event pair by the independence probability calculation unit of this embodiment. Independence probability is the probability that an event pair is independent of each other, and indicates the dissimilarity (presence or absence of correlation) of the event pair. A method for improving the accuracy of probability calculation will be explained based on Figure 16. Figure 16 shows a graph plotting other examples of the corrected chain count (calculated value by the corrected chain count calculation unit 23) for a given event pair by time lag. When calculating the independence probability, for example, it is possible to calculate the probability using only the maximum value of the chain count, as in the prior art, but the accuracy of the probability calculation can be improved by using the next largest value in addition to the maximum value. Also, the meaning of the correlation between events may differ depending on whether the value of the time lag m is positive or negative, and performing probability calculations in both the positive and negative regions and determining the presence or absence of correlation has the advantage of eliminating the omission (missing) of correlations. Therefore, in this embodiment, probability calculations are performed using the maximum and next largest values ​​of the corrected chain count in the region where the time lag m is negative, enclosed by the dotted circle frame 1601 in the graph of Figure 16, and probability calculations are also performed using the maximum and next largest values ​​of the corrected chain count in the region where the time lag m is positive, enclosed by the dotted circle frame 1602.

[0055] If N1 is the maximum corrected chain count, N2 is the next largest corrected chain count (N1≧N2), P1 is the independence probability calculated using only N1, and P2 is the independence probability calculated using both N1 and N2, then the independence probability P1 is the probability that the chain count is N1 or greater in at least one time lag (m=-15 to 15) within the assumed time lag m, and similarly, the independence probability P2 is the probability that the chain count is N1 or greater in at least one time lag and N2 or greater in at least one other time lag. Specifically, if the number of assumed time lags m is k (k=31 if m=-15 to 15), and Pa(N) is the probability that the chain count is less than N in a given time lag m, then the independence probability P1 is calculated using equation 1 below, and the independence probability P2 is calculated using equation 2 below.

[0056] P1 = 1 - Pa(N1) k ...(Formula 1) P2 = 1 - Pa(N1) k -k·(1-Pa(N1))·Pa(N2) k-1 ...(Formula 2) In addition to N1 and N2, it is also possible to perform probability calculations using the third largest value of the corrected chain count, N3 (N2≧N3). In this case, the probability that the number of chain counts will be greater than or equal to N2 and less than N1 within a certain time lag is Pb(N1, N2), and the independence probability P3 is calculated by the following equation 3.

[0057] P3 = 1 - Pa(N1) k -k·(1-Pa(N1))·Pa(N2) k-1 -k(k-1)(1-Pa(N1)) Pb(N1, N2) Pa(N3) k-2 -k(k-1) / 2·(1-Pa(N1)) 2 · Pa(N3) k-2 ...(Formula 3) In equations 1-3 above, Pa and Pb can both be derived from known mathematical formulas. Similarly, it is possible to perform probability calculations using values ​​from the largest chain size to the L (L≧4)th largest chain size.

[0058] Figure 17 is a flowchart showing an example of the processing content of the independence probability calculation unit in this embodiment. First, in step S1701, the independence probability calculation unit 24 assigns 1 to variable I. In step S1702, it determines whether variable I is greater than or equal to Sx-1. If it determines that it is greater, all processing is terminated. If it is determined that variable I is less than or equal to Sx-1, in step S1703, the independence probability calculation unit 24 assigns variable I+1 to variable J. In step S1704, the independence probability calculation unit 24 determines whether variable J is greater than or equal to Sx. If it determines that it is greater, it proceeds to step S1710, increases the value of variable I by 1, and returns to the processing in step S1702.

[0059] If the variable J is determined to be less than or equal to Sx, the process proceeds to step S1705, where the independence probability calculation unit 24 reads the detailed event information shown in Figure 3 from the database 120, and obtains the number of occurrences for each of the event pairs (I, J), with the Ith and Jth events treated as an event pair. The number of occurrences is used to calculate Pa and Pb, which are included in the formulas when calculating the independence probability using the above formulas 1 to 3. In step S1706, the independence probability calculation unit 24 reads the corrected chain count data 34 for the event pair (I, J) from the database 120. The corrected chain count data 34 is, for example, the corrected chain count (calculated value) for each time lag, as shown in Figure 16. In step S1707, the independence probability calculation unit 24 obtains the maximum value and the second largest value of the corrected chain count in both the positive and negative time lag regions from the corrected chain count data 34, and calculates the independence probability for the event pair (I, J) in both the positive and negative time lag regions using Equation 2 (or Equation 3 if the third largest value is also used). The corrected chain count is used in the calculation of Pa and Pb included in the formula when calculating the independence probability using Equation 2 or Equation 3, similar to the number of occurrences. The independence probability calculation unit 24 may also calculate the independence probability using Equation 1 when calculating the independence probability using Equation 2 or Equation 3. Furthermore, the independence probability calculation unit 24 may calculate the independence probability using both Equation 2 and Equation 3, or it may calculate the independence probability using the values ​​from the maximum value to the Lth value of the corrected chain count.

[0060] In step S1707, the independence probability calculation unit 24 also calculates the probability of event occurrence. The probability of event occurrence is the probability that event 2 occurs after event 1 occurs when the time lag m is positive, and the probability that event 1 occurs after event 2 occurs when the time lag m is negative. The probability of event occurrence when the time lag m is positive is obtained by dividing the total number of corrected chain events by the number of occurrences of event 1, and the probability of event occurrence when the time lag m is negative is obtained by dividing the total number of corrected chain events by the number of occurrences of event 2.

[0061] In step S1708, the independence probability calculation unit 24 writes detailed information about the event pair (I, J), the number of occurrences, the number of chain occurrences, the time lag m, the probability of event occurrence, and the independence probability data to the corresponding row in the list shown in Figure 18. Then, in step S1709, the independence probability calculation unit 24 increments the variable J by 1 and returns to step S1704. The independence probability calculation unit 24 repeats the above process to calculate the independence probability and the probability of event occurrence for all event pairs (I, J). These calculation results are written to the list along with the detailed information of each event pair, creating the list data 35, which is then stored in the database 120.

[0062] Figure 18 shows an example of the list data in this embodiment. As described above, the independence probability calculation unit 24 calculates the independence probability and event occurrence probability for each event pair in the regions where the time lag m is positive and negative. Therefore, the list data may be created in two separate types, one for positive time lag m and one for negative time lag m, or it may be created in only one type without any particular distinction. In the following explanation, the case in which the independence probability calculation unit 24 creates list data separately for positive and negative time lag m will be explained using the case where the time lag m is positive as an example.

[0063] In Figure 18, the list data 1801 includes the following data: Event 1 serial number, Event 2 serial number, Event 1 attribute information, Event 1 occurrence count, Event 2 attribute information, Event 2 occurrence count, chain count, time lag m, average time lag, event occurrence probability, independence probability 1, and independence probability 2. As shown in Figure 18, the Event 1 serial number and Event 2 serial number are pre-registered with the serial numbers of all event pairs for all events included in the event details, with each event pair having its own separate row. The Event 1 attribute information and Event 1 occurrence count are obtained from the event details and written to the Event 1 attribute information and Event 1 occurrence count corresponding to the Event 1 serial number. Similarly, the Event 2 attribute information and Event 2 occurrence count are obtained from the event details and written to the Event 2 attribute information and Event 2 occurrence count corresponding to the Event 2 serial number.

[0064] The chain count contains the corrected chain count (corrected chain count when time lag m is positive) for each event pair, indicated by the serial numbers of Event 1 and Event 2, separated by time lag. Additionally, the time lag m contains one or more values ​​for the time lag m at which chaining occurred in that event pair (values ​​when time lag m is positive). For example, in the case of the event pair (1, 2) registered in the second row (the first row is the title row) of list data 1801, the chain count contains "1,1" and the time lag m contains "1,2". This indicates that one chain occurred at time lag m=1 and another chain occurred at time lag m=2. Thus, the time lag m and chain count contain the time lag m values ​​at which chaining occurred in each event pair, and the chain count at those values, separated, for example, by commas or spaces. Note that data is only written to the time lag m and chain count when chaining occurs in an event pair. Furthermore, the average time lag is calculated by writing a weighted average value to the number of consecutive time lag values ​​(one or more) that have been written to time lag m, when data has been written to time lag m.

[0065] The event occurrence probability is written to the event occurrence probability (event occurrence probability when time lag m is positive) calculated by the independence probability calculation unit 24 in step S1707. Independence probability 1 and independence probability 2 are written to the two independence probabilities calculated by the independence probability calculation unit 24 in step S1707 if two or more types of independence probabilities are calculated. For example, independence probability 1 is written to independence probability P1 calculated by the above formula 1, and independence probability 2 is written to independence probability P2 calculated by the formula 2. Note that the independence probability in the list data may be only one type or three or more types.

[0066] As described above, in step S1708, the independence probability calculation unit 24 writes the above data to the rows in the list where the serial numbers for event 1 and event 2 corresponding to the event pair (I, J) are registered. Then, by repeating steps S1702 to S1710, the independence probability calculation unit 24 creates the list data 35 shown in Figure 18, which includes both positive and negative time lags m.

[0067] In the table data 35, independence probabilities 1 and 2 indicate whether or not there is a correlation between event pairs (I and J). The smaller the values ​​of independence probabilities 1 and 2, the stronger the correlation; the larger the values, the weaker or nonexistent the correlation (independence). Therefore, by appropriately setting a probability threshold as a criterion for determining the presence or absence of correlation, and extracting event pairs in the table data where the independence probability (especially independence probability 2) is less than or equal to that probability threshold (e.g., 0.005), it becomes possible to extract event pairs that are judged to be correlated.

[0068] Furthermore, if event I is an alarm event and event J is an operation event in an event pair (I, J), the number of chained events in the list data 35 (where the time lag m shown in Figure 18 is positive) for this event pair (I, J) represents the number of times the operation indicated by the operation event was performed in response to the alarm indicated by the alarm event, the time lag m represents how long it took from the alarm to the operation to be performed, i.e., the history of response times to alarms, the average time lag represents the average response time, and the event occurrence probability represents the frequency with which an operation was performed in response to an alarm, i.e., how often an operation needs to be performed in response to an alarm. Therefore, as a concrete way to utilize the list data 35, by extracting event pairs of correlated alarm events and operation events from the list data, it is possible to understand what the response operation should be when an alarm occurs, how long the response time should be, and how frequently the operation is required. This information can then be used by the event analysis device 10 to guide the operator of the system being monitored and controlled, thereby supporting the operation of the system. Another way to utilize the list data 35 is that if Event 2 is an alarm event, the underlying event that caused Event 2 (an alarm event or an operation event) can be identified from the list data, which has the advantage of making it easier to plan countermeasures when alarm event 2 occurs.

[0069] Figure 19 shows an example of a GUI screen displayed on the output unit (display) of the event analysis device of this embodiment. Figure 19 shows an example of a GUI screen that allows a user operating the event analysis device 10 (to have the event analysis device 10 perform event analysis) to specify calculation conditions and have the event analysis device 10 (specifically, the independence probability calculation unit 24) perform independence probability calculation. In the example screen shown in Figure 19, the "Calculation Conditions" 1901 (specification and input field for calculation conditions) is displayed at the top, and the "Calculation Results (probability list)" 1902 is displayed at the bottom.

[0070] The "Calculation Conditions" section (1901) includes input fields for the time range of the time lag m ("Time Lag Selection"), the range of sequential numbers of the events to be analyzed ("Event Selection Range"), the number of corrected chain counts to be used in calculating the independence probability ("Probability Calculation Specification"), a "Execute Calculation" button, and a "Calculation Status" display field. For example, in "Time Lag Selection," the user enters "-15" and "15" as the time range for the time lag m when the time step is 1 minute, specifying that the time lag m = -15 to 15. In "Event Selection Range," the user enters "1" and "1000" as the sequential numbers of the events, specifying that events with sequential numbers from 1 to 1000 will be analyzed. The user also enters a number greater than or equal to 1 in the "Probability Calculation Specification" field. For example, the user enters "2" to specify that the maximum and second largest corrected chain counts will be used in calculating the independence probability. If "1" is entered, only the maximum value of the corrected chain count will be used. If "3" or "L" (L≧4) is entered, the values ​​up to the 3rd or Lth largest value from the maximum value of the corrected chain count will be used. After entering values ​​in each of the above fields, the user presses the "Execute Calculation" instruction button (for example, by clicking using an input means such as a mouse, or by directly tapping on the screen in the case of a touch panel display). This allows the user to have the independence probability calculation unit 24 execute the probability calculation process shown in Figure 17 according to the specified calculation conditions. At this time, "Calculating" will be displayed in the "Calculation Status" display field.

[0071] When the probability calculation process shown in Figure 17 by the independence probability calculation unit 24 is completed, for example, "Calculation Complete" will be displayed in the "Calculation Status" display field, and the list data 35 calculated and created by the independence probability calculation unit 24 according to the specified calculation conditions will be displayed in "Calculation Results (Probability List)" 1902. If the independence probability calculation unit 24 creates separate list data for cases where the time lag m is positive and cases where it is negative, a field for specifying (inputting) whether the time lag m is positive (plus side) or negative (minus side) will be provided in "Calculation Results (Probability List)" 1902 as "Time Lag Specification". By specifying (inputting) whether the time lag m is positive or negative in "Time Lag Specification", the user can switch the display of list data with a positive or negative time lag m in "Calculation Results (Probability List)" 1902. Furthermore, the list data 35 is saved as a file (text file, Excel file, etc.) in the database 120 within the event analysis device 10, and can be output as a file externally from the event analysis device 10 as needed.

[0072] Figure 20 shows another example of a GUI screen displayed on the output unit (display) of the event analysis device of this embodiment. Figure 20 shows an example of a GUI screen that allows a user to specify a particular event and have the event analysis device 10 search for and display other events correlated with the specified event. In the example screen shown in Figure 20, the "Search Conditions" 2001 (event specification / input field) is displayed at the top, and the "Search Results" 2002 (display field for events correlated with the specified event) is displayed at the bottom.

[0073] The "Search Conditions" 2001 includes an input field for the target event under "Event Specification," an input field for the probability threshold used to determine whether a correlation exists under "Probability Threshold Specification," and a "Execute Search" button. The user specifies the target event by entering the serial number of an arbitrarily selected event (100 in the example in Figure 20) in "Event Specification." The user also specifies the threshold (reference value) for the independence probability (specifically the value of independence probability 2 in the example list data shown in Figure 18) by entering an arbitrary value (0.005 in the example in Figure 20) in "Probability Threshold Specification." After entering the information in each of the above fields, the user presses (clicks, taps, etc.) the "Execute Search" button. This allows the user to have the event analysis device 10 search for one or more other events that are determined to be correlated with the specified event (i.e., the independence probability with the specified event is below the probability threshold).

[0074] Once the search by the event analysis device 10 is complete, the "Search Results" 2002 displays data on 0 or 1 or more other events whose independence probability from the specified event is below a specified probability threshold. Specifically, if there are no other correlated events (not extracted), for example, "0 events" or "Not found" will be displayed. On the other hand, if there is one or more other correlated events, an excerpt of data from the list data 35, where the specified event is designated as Event 1 and one or more other events as Event 2, will be displayed, along with a graph showing the number of linked events by time lag for those event pairs. The excerpt from the list data 35, for example in the example in Figure 20, includes the serial number and event attribute information of the specified event, the serial number and event attribute information of one or more other events, the average time lag, and the event occurrence probability data. By displaying such data and graphs in the "Search Results" 2002, the user can confirm information on one or more events correlated with the specified event, as well as the number of linked events by time lag.

[0075] In addition, the format for specifying (inputting) values ​​in each field in the GUI screen examples shown in Figures 19 and 20 can be either a format where the user inputs values ​​using a keyboard or other input method, or a format where the user selects the desired value from the items in the drop-down list displayed in each field.

[0076] As described above, the event analysis device of this embodiment performs the following processes based on the history information of alarms and operations that occurred in the system to be monitored and controlled over a predetermined period: generation of time-series data, calculation of the number of chained events and corrected chained events, and calculation of independence probability and event occurrence probability. This makes it possible to extract correlated event pairs, the time lag (occurrence interval, response time, etc.) and occurrence probability (response frequency, etc.) of those event pairs with high accuracy. As a result, it becomes possible to identify the operation content and response time corresponding to the alarm that occurred, or other alarms or operations that caused the alarm that occurred, from the information of the extracted event pairs. Using the identified information, it becomes possible to guide the operator of the system to be monitored and controlled and support the operation of the system.

[0077] Although embodiments of the present invention have been described in detail above, the present invention is not limited to the embodiments described above, and various design modifications can be made without departing from the spirit of the invention as described in the claims. For example, each of the embodiments described above has been described in detail in order to explain the present invention in an easy-to-understand manner, and is not necessarily limited to having all of the described configurations. Furthermore, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Moreover, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations. [Explanation of symbols]

[0078] 1…Event analysis device 11...Storage section 12…Database 13...Input section 14…Output section 21...Time series generation unit 22…Chain number calculation part 23…Corrected chain number calculation unit 24... Independence Probability Calculation Unit 31…Event Information 32…Time-series data 33…Data on the number of linked cases 34…Corrected chain count data 35…List Data 110...Calculation processing program 120... Database

Claims

1. An event analysis device that analyzes multiple different types of events that occur in a system, database and Time series generation unit, Chain count calculation unit, Correction chain count calculation unit, Equipped with, The database stores event details including identification information and attribute information for each of the events, and event occurrence time information including at least the identification information and occurrence time of all events that occurred in the system during a predetermined period. The time series generation unit generates time series data for each event, based at least on the event occurrence time information, indicating whether or not the event occurred during the predetermined period at predetermined time intervals. The chain count calculation unit calculates the chain count by assigning multiple time lags to the time-series data of each event in the event pair, which is a combination of two types of events, for each time lag, and extracting chains for each time lag. The corrected chain count calculation unit performs a correction process on all extracted chains for each event pair so that there is no overlap in the occurrence times of the events, and calculates the number of corrected chains, which is the number of chains after the correction process, for each time lag. Event analysis device.

2. An event analysis device according to claim 1, The aforementioned time-series data consists of a bit sequence in which each of the time steps is a bit, and each bit takes the value 1 if the event occurred in the corresponding time step, and 0 if the event did not occur. The aforementioned chaining refers to the case where the overlapping bits of the two time-series data are both set to 1. In the correction process, the correction chain count calculation unit performs the following: The occurrence time of each event in each of the aforementioned chains is calculated from the time-series data, For each combination of two of the multiple time lags, it is determined whether there is an overlap between the occurrence time of each event in each of the chain extracted during one of the time lags and the occurrence time of each event in each of the chain extracted during the other time lag. If it is determined that there is a duplicate, delete one of the two chains in which the occurrence times of the events overlap. Event analysis device.

3. An event analysis device according to claim 2, When deleting one of the two chains whose occurrence times overlap, the chain is deleted when the time lag in the combination is the one whose value is farther from the time lag that has the largest number of chain occurrences. Event analysis device.

4. An event analysis device according to claim 2, When deleting one of the two chains whose occurrence times overlap, the chain is deleted when the time lag with the smaller number of chain events is selected from the two time lags in the combination. Event analysis device.

5. An event analysis device according to claim 1, It also includes an independence probability calculation unit, The independence probability calculation unit calculates the independence probability for each event pair using at least two values ​​from the corrected chain count. Event analysis device.

6. An event analysis device according to claim 5, The two values ​​mentioned above are the maximum value and the second largest value. Event analysis device.

7. An event analysis device according to claim 5 or claim 6, The multiple time lags include values ​​in the positive and negative ranges. The independence probability calculation unit calculates the independence probability separately for cases where the time lag is a value in the positive region and cases where it is a value in the negative region. Event analysis device.

8. An event analysis device according to claim 5, It also has an output section, The output unit displays, for each event pair, the number of corrected chain events for each time lag and the probability of independence. Event analysis device.

9. An event analysis method for analyzing multiple different types of events that occur in a system, At a minimum, based on event occurrence time information which includes at least the identification information and occurrence time of all events that occurred in the system during a predetermined period, time-series data indicating whether or not an event occurred during the predetermined period is generated for each event at predetermined time intervals. For each event pair, which is a combination of two types of events, multiple time lags are applied to the time-series data of each event in the event pair, and chains are extracted for each time lag to calculate the number of chains. For each event pair, a correction process is performed on all extracted chains so that there is no overlap in the occurrence times of the events, and the number of corrected chains, which is the number of chains after the correction process, is calculated for each time lag. Event analysis methods.

10. The event analysis method according to claim 9, The aforementioned time-series data consists of a bit sequence in which each of the time steps is a bit, and each bit takes the value 1 if the event occurred in the corresponding time step, and 0 if the event did not occur. The aforementioned chaining refers to the case where the overlapping bits of the two time-series data are both set to 1. In the correction process, The occurrence time of each event in each of the aforementioned chains is calculated from the time-series data, For each combination of two of the multiple time lags, it is determined whether there is an overlap between the occurrence time of each event in each of the chain extracted during one of the time lags and the occurrence time of each event in each of the chain extracted during the other time lag. If it is determined that there is a duplicate, delete one of the two chains in which the occurrence times of the events overlap. Event analysis methods.

11. The event analysis method according to claim 10, When deleting one of the two chains whose occurrence times overlap, the chain is deleted when the time lag in the combination is the one whose value is farther from the time lag that has the largest number of chain occurrences. Event analysis methods.

12. The event analysis method according to claim 10, When deleting one of the two chains whose occurrence times overlap, the chain is deleted when the time lag with the smaller number of chain events is selected from the two time lags in the combination. Event analysis methods.

13. The event analysis method according to claim 9, Furthermore, for each event pair, the probability of independence is calculated using at least two values ​​from the corrected chain count. Event analysis methods.

14. The event analysis method according to claim 13, The probability of independence is calculated using at least the maximum value and the second largest value among the aforementioned corrected chain counts. Event analysis methods.

15. An event analysis method according to claim 13 or claim 14, The multiple time lags include values ​​in the positive and negative ranges. The independence probability is calculated by dividing the case into the case where the time lag is a value in the positive region and the case where it is a value in the negative region. Event analysis methods.

Images