Automated alert recommender for real-time risk assessment and advisory

Abstract

A computer-implemented method including training an artificial intelligence / machine learning (AI / ML) algorithm to generate at least one of alerts and alert rules using a historical data set of an industrial system in an alert generation system. The historical data set includes operational data of the industrial system, at least one alert rule, a set of alerts correlated with operational data, and a set of responses to each alert in the set of alerts. The computer- implemented method receives a set of operational data from an industrial system at the alert generation system and applies the AI / ML algorithm to the set of operational data. The computer-implemented method generates an alert based on the application of the AI / ML algorithm to the set of operational data and provides the generated alert to a user.

Description

71CCS-511078-WO-2_BHI0583PCTAUTOMATED ALERT RECOMMENDER FOR REAL-TIME RISK ASSESSMENT AND ADVISORYCROSS REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of IT Application No. 102024000028932, filed on December 18, 2024, which is incorporated herein by reference in its entirety.BACKGROUND

[0002] Various embodiments supported by aspects of the present disclosure relate to automated risk management with alert detection in association with resource recovery and fluid sequestration industries, and more particularly, to carbon capture, utilization and storage (CCUS) industries.

[0003] In the resource recovery and fluid sequestration industries, some systems are configured for providing alerts related to hazards or conditions that may arise during operations. Existing systems rely on manually determined alert rules and conditions to identify when a user should be alerted. However, the systems lack automated techniques for generating alert rules and related conditions and individual users are unable to consider the full context of interrelated conditions, thus allowing certain combinations of conditions to continue when the combined conditions may be inefficient or otherwise undesirable and / or causing resource intensive reviews when a single parameter exceeds a threshold but the combined conditions do not warrant an alert.SUMMARY

[0004] Embodiments of the present disclosure are directed to a computer- implemented method including training an artificial intelligence / machine learning ( AI / ML) algorithm to generate at least one of alerts and alert rules using a historical data set of an industrial system in an alert generation system. The historical data set includes operational data of the industrial system, at least one alert rule, a set of alerts correlated with operational data, and a set of responses to each alert in the set of alerts. The computer-implemented method receives a set of operational data from an industrial system at the alert generation system and applies the AI / ML algorithm to the set of operational data. The computer- implemented method generates an alert based on the application of the AI / ML algorithm to the set of operational data and provides the generated alert to a user.71CCS-511078-WO-2_BHI0583PCT

[0005] Embodiments of the present disclosure are also directed to a system including analysis equipment having a processor and a memory. The memory includes instructions stored thereon that, when executed by the processor, cause the processor to perform operations including training an artificial intelligence / machine learning (AI / ML) algorithm to generate at least one of alerts and alert rules using a historical data set of an industrial system in an alert generation system. The historical data set includes operational data of the industrial system, at least one alert rule, a set of alerts correlated with operational data, and a set of responses to each alert in the set of alerts. The computer-implemented method receives a set of operational data from an industrial system at the alert generation system and applies the AI / ML algorithm to the set of operational data. The computer-implemented method generates an alert based on the application of the AI / ML algorithm to the set of operational data and provides the generated alert to a user.

[0006] Emobidments of the present disclosure are also directed to a computer program product having a computer readable storage medium with program instructions embodied therewith. The program instructions are executable by a processor to cause the processor to perform operations including training an artificial intelligence / machine learning (AI / ML) algorithm to generate at least one of alerts and alert rules using a historical data set of an industrial system in an alert generation system. The historical data set includes operational data of the industrial system, at least one alert rule, a set of alerts correlated with operational data, and a set of responses to each alert in the set of alerts. The computer- implemented method receives a set of operational data from an industrial system at the alert generation system and applies the AI / ML algorithm to the set of operational data. The computer-implemented method generates an alert based on the application of the AI / ML algorithm to the set of operational data and provides the generated alert to a user.

[0007] Further aspects supported by the present disclosure and features of example embodiments are illustrated in the accompanying drawings and / or described in the following description.BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The following descriptions should not be considered limiting in any way. With reference to the accompanying drawings, like elements are numbered alike:

[0009] Figure 1 is a diagram illustrating an example embodiment of a system for realtime risk assessment and advisory alerts associated with energy industry operations in accordance with aspects of the present disclosure.71CCS-511078-WO-2_BHI0583PCT

[0010] Figure 2 illustrates an example workflow in accordance with one or more embodiments of the present disclosure.

[0011] Figure 3 illustrates an example workflow of a model constructor module of Figure 2.

[0012] Figure 4 illustrates an example flowchart of a method in accordance with one or more embodiments of the present disclosure.DETAILED DESCRIPTION

[0013] A detailed description of one or more embodiments of the disclosed apparatus and method are presented herein by way of exemplification and not limitation with reference to the Figures.

[0014] FIG. 1 is a diagram illustrating an example embodiment of a system 100 for automated risk management with alert detection in association with energy industry operations in accordance with aspects of the present disclosure.

[0015] The system 100 is configured to perform in any suitable energy industry operation, such as, for example, a drilling operation, a stimulation operation, a measurement operation and / or a production operation. In some embodiments, the energy industry operations may include CCUS operations. However, example aspects of the techniques for automated risk management with alert detection as supported by the system 100 as described herein are not limited to energy industry operations and an associated downhole environment.

[0016] According to one or more embodiments of the present disclosure, the systems and techniques described herein support digital solutions for automated risk management with alert detection in CCUS operations. The systems and techniques described herein support real-time risk detection with increased accuracy compared to some other approaches.

[0017] The system 100 includes a borehole 135 in a subsurface formation 130. A borehole string 140 (also referred to herein as a drill string) is disposed in the borehole 135 that penetrates the formation 130. The borehole 135 may be an open hole, a cased hole or a partially cased hole. In one embodiment, the borehole string 140 is a stimulation or injection string that includes a tubular, such as a coiled tubing, pipe (e.g., multiple pipe segments) or wired pipe, that extends from a wellhead at a surface location (e.g., at a drill site or offshore stimulation vessel).

[0018] As described herein, a “string” refers to any structure or carrier suitable for lowering a tool or other component through a borehole or connecting a drill bit to the surface, and is not limited to the structure and configuration described herein. The term "carrier" as71CCS-511078-WO-2_BHI0583PCT used herein means any device, device component, combination of devices, media and / or member that may be used to convey, house, support or otherwise facilitate the use of another device, device component, combination of devices, media and / or member. Example nonlimiting carriers include casing pipes, wirelines, wireline sondes, slickline sondes, drop shots, downhole subs, BHAs and drill strings.

[0019] In one embodiment, the system 100 is configured as a hydraulic stimulation system. As described herein, “hydraulic stimulation” includes any injection of a fluid into a formation. A fluid may be any flowable substance such as a liquid or a gas, a flowable solid such as sand, and / or a mixture thereof

[0020] In this embodiment, the borehole string 140 includes a stimulation assembly that includes one or more tools 150 or components to facilitate stimulation of the formation 130. Non-limiting examples of the tools 150 included in the borehole string 140 include a fracturing assembly (e.g., a fracture or “frac” sleeve device), a perforation assembly (e.g., shaped charges, torches, projectiles and other devices for perforating the borehole wall and / or casing), and isolation or packer subs.

[0021] The tools 150 may support various processes including formation drilling, geosteering, and formation evaluation (FE) for measuring versus depth and / or time one or more physical quantities in or around a borehole 135. The tools 150 may be included in or embodied as a BHA, drillstring component, or other suitable carrier. A “carrier” as described herein means any device, device component, combination of devices, media and / or member that may be used to convey, house, support or otherwise facilitate the use of another device, device component, combination of devices, media and / or member. Example non-limiting carriers include drill strings of the coiled tubing type, of the jointed pipe type and any combination or portion thereof. Other carriers include, but are not limited to, casing pipes, wirelines, wireline sondes, slickline sondes, drop shots, downhole subs, bottom-hole assemblies, and drill strings.

[0022] One or more of the tools 150 may include suitable electronics or processors configured to communicate with a surface processing unit (e.g., a computing device 105) and / or control the respective tool 150 or assembly.

[0023] The system 100 includes surface equipment 110 for performing various energy industry operations. For example, the surface equipment 110 is configured for injection of fluids into the borehole 135 in order to, e.g., fracture the formation 130. In one or more embodiments, the surface equipment 110 includes an injection device such as a high pressure pump 115 in fluid communication with a fluid tank 120, mixing unit or other fluid source or71CCS-511078-WO-2_BHI0583PCT combination of fluid sources. The pump 115 injects fluid into the borehole string 140 or the borehole 135 to introduce fluid into the formation 130, for example, to stimulate and / or fracture the formation 130. The pump 115 may be located downhole or at a surface location.

[0024] One or more flow rate and / or pressure sensors 125 may be disposed in fluid communication with the pump 115 and the borehole string 140 for measurement of fluid characteristics. The sensors 125 may be positioned at any suitable location, such as proximate to (e.g., at the discharge output) or within the pump 115, at or near the wellhead, or at any other location along the borehole string 140 or the borehole 135. The sensors described herein are exemplary, as various types of sensors may be used to measure various parameters.

[0025] A computing device 105 (e.g., computing device 105-a) may be disposed in operable communication with components such as sensors 125 located above the surface, the pump 115, and / or downhole components. For example, the computing device 105 may be in operable communication with sensors (e.g., pressure sensors, temperature sensors, vibration sensors, gas sensors, and the like) located below the surface and / or in the borehole string 140. In some examples, the computing device 105-a may be in operable communication with a tool 150 (or multiple tools).

[0026] The system 100 supports communication between the computing device 105 and other devices of the system 100 via wired communication protocols, wireless communication protocols (e.g., electromagnetic (EM) signals, WiFi, Bluetooth™, ZigBee™, Ubiquiti™, 3G, 4G, LTE, and the like), and / or combinations including one or more of the foregoing.

[0027] The system 100 supports telemetry techniques capable of transmitting data from components located downhole to the surface and / or surface equipment 110. Nonlimiting examples of the telemetry techniques include acoustic telemetry or mud pulse (MP) telemetry supportive of transmitting information by generating vibrations in fluid in the borehole 135, electromagnetic (EM) telemetry supportive of transmitting information by way of signals that propagate at least in part through the earth (e.g., through formations 130). Other non-limiting examples of telemetry techniques supported by aspects of the present disclosure include the use of hardwired drill pipe, fibre optic cable, or drill collar acoustic telemetry to carry data to the surface and / or surface equipment 110.

[0028] The system 100 may include one or more access nodes 170 supportive of communicating data along the borehole string 140 (e.g., up or down the borehole string 140). In one or more embodiments, the access nodes 170 may be implemented in the borehole 135 or a communication borehole (not illustrated) separate from the borehole 135. In some71CCS-511078-WO-2_BHI0583PCT examples, the one or more access nodes 170 may provide functionality as wireless access nodes for relaying data from a tool 150 to the surface (e.g., to a computing device 105).

[0029] In one or more embodiments, the system 100 may include a chain of access nodes 170 spaced apart along the borehole string 140, and the chain of access nodes 170 may support repeating of data in a unidirectional (e.g. downhole to surface or surface to downhole) or bidirectional manner. For example, an access node 170 (or chain of access nodes 170) may support the communication of data between a computing device 105, a tool 150, and the like.

[0030] Accordingly, for example, the communication protocols and telemetry techniques supported by the system 100 enable communication between computing devices 105 (e.g., computing device 105-a, computing device 105-b, and the like) and downhole components.

[0031] The computing device 105 is configured to receive, store and / or transmit data generated from components (e.g., pump 115, fluid tank 120, sensors 122, sensors 125, sensors 155, sensors 160, and the like) included in the surface equipment 110 and / or downhole components (e.g., a tool 150, downhole sensors 155, and the like). The computing device 105 includes processing components configured to analyze received data (e.g., data received from the pump 115, fluid tank 120, sensors 125, a tool 150, and the like). The computing device 105 includes processing components configured to provide data (and / or control signals to other components of the system 100. The computing device 105 includes any number of suitable components, such as processors, memory, communication devices and power sources.

[0032] The sensors 155 may be configured to measure various parameters of the formation 130 and / or borehole 135. For example, the sensors 155 may include formation evaluation sensors (e.g., resistivity, dielectric constant, water saturation, porosity, density and permeability), sensors for measuring borehole parameters (e.g., borehole size, borehole inclination and azimuth, and borehole roughness), sensors for measuring geophysical parameters (e.g., acoustic velocity, acoustic travel time, electrical resistivity), sensors for measuring borehole fluid parameters (e.g., viscosity, density, clarity, rheology, pH level, and gas, oil and water contents), boundary condition sensors, and sensors for measuring physical and chemical properties of the borehole fluid.

[0033] The system 100 includes sensors 160 for measuring force, operational and / or environmental parameters related to bending or other static and / or dynamic deformation of one or more downhole components. The sensors 160 are described collectively herein as71CCS-511078-WO-2_BHI0583PCT“deformation sensors” and encompass any sensors, located at the surface and / or downhole, that provide measurements relating to bending or other deformation, static or dynamic, of a downhole component. Examples of deformation include deflection, rotation, strain, torsion and bending. Such sensors 160 provide data that is related to forces on the component (e.g., strain sensors, WOB sensors, TOB sensors) and are used to measure deformation or bending that could result in a change in position, alignment and / or orientation of one or more other sensors 160 or one or more sensors 155. In some non-limiting embodiments, the sensors 160 may include one or more of: (i) a strain gauge, (ii) a transmitter oriented at a non-X, non-Z angle, (iii) a receiver oriented at a non-X, non-Z angle, (iv) a differential magnetometer, (v) a differential accelerometer, (vi) an optical sensor, and (vii) an optical fiber sensor.

[0034] For example, the system 100 may include a distributed sensor system (DSS) disposed at the borehole string 140 and tool 150 (e.g., a BHA) and including a plurality of sensors 160. The sensors 160 may perform measurements associated with forces on the borehole string 140 that may result in deformation, and can thereby result in misalignment of one or more sensors 155. Non-limiting example of measurements performed by the sensors 160 include accelerations, velocities, distances, angles, forces, moments, and pressures. Sensors 160 may also be configured to measure environmental parameters such as temperature and pressure. In a non- limiting example, the sensors 160 may be distributed throughout the borehole string 140 and / or at a tool 150 (e.g., a drill bit) at the distal end of borehole string 140. In other embodiments, the sensors 160 may be configured to measure directional characteristics at various locations along the borehole 135. Examples of such directional characteristics include inclination and azimuth, curvature, strain, and bending moment.

[0035] In some examples, the system 100 may include sensors 160 coupled to a downhole component, such as, for example, a drill pipe section or a tool 150 (e.g., a BHA). In some examples, the sensors 160 may be deformation sensors (e.g., strain gauges configured to measure strain).

[0036] An analysis system 101 may include machine learning model(s) 107 which may be trained and / or updated using historical training data provided or accessed by any devices or systems described herein, alongside real-time data generated during operation of certain embodiments disclosed herein and added to the training data. The machine learning model(s) 107 may be built and updated by a computing device 105 (e.g., computing device 105-a, computing device 105-b, or the like) based on the training data (also referred to herein as training data and feedback).71CCS-511078-WO-2_BHI0583PCT

[0037] The machine learning model(s) 107 may be provided in any number of formats or forms. In one or more embodiments, the operations described herein may implement machine learning and / or rule-based systems to generate a mixing instruction. In one or more embodiments, the analysis system 101 may include (e.g., for theoretical and empirical processes) rule -based systems using predefined rules to make decisions or perform tasks, which may operate based on if-then statements.

[0038] In one or more embodiments, the analysis system 101 may include natural language processing (NLP) techniques supportive of the interaction between computers and human language, enabling machines to understand, interpret, and generate human language (e.g., risk descriptions, risk remediation plans, risk mitigation plans, alerts, and the like).

[0039] In one or more embodiments, the analysis system 101 may include computer vision techniques supportive of image processing, object recognition, and image segmentation. In an example, the computer vision techniques may support the integration of sensor data (e.g., from sensors 155, sensors 160, or the like).

[0040] In one or more embodiments, the analysis system 101 may include data mining techniques supportive of discovering patterns and relationships in large datasets (e.g., from database 180, data sources 202 later described herein with reference to FIG. 2, other data later described herein with reference to FIG. 2, and the like) and extract information. For example, the data mining techniques may support the discovery of interdependencies described herein such as, for example, interdependencies between alerts 157, risks 137, plans previously implemented for preventing or mitigating the risks 137, and the like.

[0041] In one or more embodiments, the analysis system 101 may include or implement genetic algorithms supportive of determining approximate solutions to optimization and search problems, expert systems (computer systems) configured to emulate the decision-making ability of a human expert in a specific domain, fuzzy logic techniques supportive of modeling uncertainty and imprecision in data, simulation and modeling, regression analysis, clustering techniques, and dimensionality reduction (e.g., principal component analysis (PCA) or t-SNE).

[0042] Example aspects of the machine learning model(s) 107, such as generating (e.g., building, training) and applying the machine learning model(s) 107, are described with reference to the figure descriptions herein.

[0043] Aspects of the analysis system 101 described herein support reducing operator workload and enhancing the efficiency of mapping of particular risks 137 based on generated alerts 157, and in some aspects, mapping of the risks 137 and / or alerts 157 to71CCS-511078-WO-2_BHI0583PCT recommendation data 187 including risk prevention or risk mitigation plans.Advantageously, the generated alerts 157 can be generated via an alert generation engine 175 using a combination of the machine learning model(s) 107 and gradient boosting provided by applying a real world model including chemical and physical laws and parameters to the historical and incoming data. Gradient boosting the historical data defines maximum and minimum values for parameters within the set of operational data.

[0044] Example aspects of methods, procedures, and processes supported by the analysis system 101 are described herein. The automated alert generation supported by analysis system 101 entails a comprehensive software application design that enables an automated workflow, fostering increased user confidence.

[0045] The analysis system 101 provides a user interface (e.g., at a computing device 105) that enables operators (e.g., field engineers) with the ability to review and receive alerts 157 (e.g., rule-based alerts based on rules generated by the alert generation engine 175) and alerts 190 (e.g., alerts directly generated by the alert generation engine 175). Via the user interface, the analysis system 101 supports user review, confirmation, implementation, or modification of risk prevention or risk mitigation plans provided in recommendation data 187. In an example, once the recommendation data 187 has been reviewed and confirmed (or modified) by an operator, the computing device 105 may dispatch the parameters associated with the recommendation data 187 to an automation solution for execution.

[0046] In one or more embodiments, the analysis system 101 integrates a machine learning algorithm (implemented using one or more trained machine learning models 107) that, based on a risk registry and historical alert data, generates alerts 190 and engages a risk evaluation engine 230 (illustrated in FIG. 2, and described with regards to FIG. 2) to provide a recommendation data 187 to operators for prevention and / or mitigation of risks 137 identified by the analysis system 101.

[0047] In one or more embodiments, aspects of the automation solution may be implemented at computing device 105 (e.g., computing device 105-a), another computing device 105 (e.g., computing device 105-b) in electronic communication with the computing device 105 via a wired and / or wireless communication protocol, surface equipment 110, and / or processing circuitry included in the surface equipment 110. In the example of FIG. 1, computing device 105-a may be located at the drill site, and computing device 105-b may be located at the drill site or at a remote site. In some cases, computing device 105-a and / or computing device 105-b may be a server. In some cases, additional computing devices71CCS-511078-WO-2_BHI0583PCT beyond computing device 105-a and computing device 105-b may be incorporated and function similarly to computing device 105-b.

[0048] According to one or more embodiments of the present disclosure described herein, aspects of the system 100 provide real-time risk assessment and advisory. The system100 supports automated association of risks to alerts generated by an industrial system. The terms “alerts” and “alarms” may be used interchangeably herein and refer broadly to any notifications provided to a user 226 (illustrated in FIG. 2) responsive to one or more conditions or combinations of conditions.

[0049] As will be described herein, the analysis system 101 provides a hardware and software platform supportive of end-to-end monitoring of the system 100. For example, the analysis system 101 supports end-to-end monitoring of conditions associated with surface equipment 110, formation 130, borehole 135, borehole string 140, tools 150, and the like).

[0050] For example, the analysis system 101 is capable of generating one or more alerts 157 (e.g., rule-based alerts) in response to a trigger condition, or a combination of conditions, associated with the system 100. In an example, the trigger condition may be the exceeding of a threshold condition associated with the borehole 135 or the borehole string 140. In another example, the threshold condition may be a combination of a threshold force on the borehole string 140 and a threshold environmental parameter (e.g., temperature, pressure, or the like), or the like, where the threshold environmental parameter may have an adverse effect on the system 100 and energy industry operations performed by the system 100. The particular conditions triggering the alerts 157 are generated in whole or in part by applying the machine learning model(s) 107 to continuously updated historical data.

[0051] Through the utilization of an alert generation engine 175, the analysis system101 is capable of generating alerts without predefined rules through machine learning trained forecasting algorithms and generating alert rules that may be proactively applied to subsequent operations allowing for quicker alerts that may shortcut machine learning based analysis.

[0052] In some examples, the combinations of conditions may include variable thresholds (e.g., a threshold force on the borehole string 140, with the value of the threshold force being dependent on an environmental and / or ambient temperature). In other examples, the combinations of conditions may include simultaneous thresholds of variables that may not appear connected, but have a correlation learned via application of the machine learning system(s) 107. The combinations of thresholds and / or variable values may include multiple71CCS-511078-WO-2_BHI0583PCT(e.g. 3 or more) independent variables having a combined impact where the combined impact may not be discernable via conventional analysis techniques.

[0053] In another example, the analysis system 101 may generate an alert 157 (or multiple alerts 157) in response to other trigger conditions (e.g., threshold temperature exceeded, threshold pressure exceeded, or the like), where the trigger condition is defined by a rule generated using the alert generation engine 175 and the machine learning model(s) 107. In a non-limiting example, the analysis system 101 may generate an alert 157 in response to determining that a pressure at the borehole 135 (e.g., as measured by a sensor 125, a sensor 155, or the like) exceeds a threshold pressure value.

[0054] Using the alert generation engine 175 provides a mechanism for forecasting alerts without requiring predefined alerting rules, for new alerting rules to be generated, and for any existing alerting rules to be modified and / or otherwise adjusted based on historical data gathering. The alert generation engine 175 recieves inputs of historic and simulated data (referred to in combination as historical data) and generates a training data set from the historical data. The training data set is then used to train the machine learning module(s) 107 on what conditions and combinations of conditions give rise to alerts.

[0055] In one particular instance, the training data set further includes historical actions in response to the alerts (e.g., system shutdown, manual adjustment of one or more parameter, discount the alert, and the like), thereby allowing the machine learning model(s) 107 to discern under which combinations of conditions the predefined rules provide actionable alerts, a severity of the actionable alert, and under which combinations of conditions the predefined rules do not require any particular actions.

[0056] In addition, the alert generation engine 175 can operate a feedback loop that continuously adds any new alerts and corresponding contextual data to the training data set. Addition of the continuous feedback to the historical data and retraining the machine learning model(s) 107 further refines the alerts provided by the alert generation engine 175 and allows the analysis system 101 to account for equipment changes, degradation due to wear and tear, changing environmental conditions, or any other factors that may adjust over time and impact the particular combinations of conditions that provide an alert or require an action.

[0057] In one example, using alert generation engine 175, the analysis system 101 may autonomously identify a set of conditions (e.g. pressure thresholds, ambient temperatures, and time of day) that historically correlate to one or more risks requiring an operator response and / or an automatic response.71CCS-511078-WO-2_BHI0583PCT

[0058] Example aspects of the alerts 157, the alert generation engine 175, recommendation data 187, and alert 190 will further be described herein with reference to FIG. 2.

[0059] Accordingly, for example, the analysis system 101 supports detecting problems or challenges associated with energy industry operations (e.g., downhole) much earlier compared to some other approaches. For example, some other approaches may involve an operator periodically examining a set of alerts which have been generated by an alarm system over time, for example, through a manual review of the alerts. In some cases, the manual examination of the alerts by some other approaches, even if performed periodically, may result in delayed identification of a root cause (e.g., a problem with surface equipment 110, a problem with the integrity of the borehole 135 or borehole string 140, or the like) associated with the alerts, inaccurate identification of the root cause, and / or delayed mitigation or remediation of the root cause. In some cases, the examination as implemented by some other approaches may result in a delay in identifying (or a failure to identify) adverse effects that the root cause has on the system 100 and energy industry operations performed by the system 100.

[0060] The generation of additional alerts 190 by the analysis system 101 supports improving the response time for reacting to an alarm and mitigating a problem associated with energy industry operations performed by the system 100. Through providing the alerts 190 as an immediate notification in real-time, the analysis system 101 may ensure that corrective actions may be implemented at the system 100 before conditions deteriorate. Furthermore, the generation of the alerts using the machine learning system(s) 107 and the alert generation engine 175 operates to ensure that unnecessary alerting is avoided by eliminating rigid rules based on singular data points.

[0061] It is to be understood that the example aspects described herein of the system 100, analysis system 101, and alert generation engine 175 may be implemented in accordance with energy industry operations such as, for example, CCUS applications and carbon storage, but are not limited thereto. In alternative implementations the analysis system 101, including the alert generation engine 175, may be applied to any industrial process or any similar process, with equally beneficial results. Aspects of the analysis system 101 and alert generation engine 175 support improved maintenance of wellbore integrity, reservoir integrity, and the like. Aspects of the analysis system 101 and alert generation engine 175 support improved prevention of contamination situations (e.g., potential contamination of an aquifer).71CCS-511078-WO-2_BHI0583PCT

[0062] Embodiments of the present disclosure support technical advantages and improvements to the technology. For example, the analysis system 101 supports automated generation of mitigation and remediation recommendations. The analysis system 101 supports implementing (e.g., by alert generation engine 175) a workflow supportive of autonomously recommending data for analysing a risk and autonomously recommending operations for mitigating and remediating the risk, based on an artificial intelligence (Al) approach which evaluates historical data including previously applied mitigations and remediations. In some embodiments, the system 100 supports fully autonomous (e.g., without manual intervention) and / or semi- autonomous generation of mitigation and remediation recommendations .

[0063] The analysis system 101 supports implementing (e.g., at alert generation engine 175) workflows supportive of analysing historical data to identify combinations of factors that contribute to, or influence, risks that should be alerted and the generation of alerting rules that may be implemented to identify those risks. In some aspects, the techniques described herein provide improved accuracy for risk detection. In some examples, the techniques described herein include generating alerts and allowing a user to respond to the alert. In some examples, the techniques described herein include generating alerting rules that can then be applied to generate alerts alongside the machine learning analysis and / or while the machine learning model(s) 107 are offline.

[0064] Aspects of the techniques described herein provide a software digital platform which is cloud agnostic. For example, the alert generation engine 175 may be implemented on premise at a surface location (e.g., at a drill site or offshore stimulation vessel). For example, the computing device 105-a on which the alert generation engine 175 is implemented may be an on-site computing device. Additionally, or alternatively, the risk evaluation engine 175 may be implemented at an on-site server or an off-site server (a remote server) (e.g., implemented at computing device 105-b).

[0065] That is, for example, features of the alert generation engine 175 and associated operations (e.g., root cause analysis 280 later described with reference to FIG. 2) may be implemented via relatively lightweight software services (expressed another way, built on software services) capable of executing the operations in a single step or multiple steps.

[0066] The software digital platform described herein provides user assistance for understanding risks identified by the platform as being associated with a generated alert. The platform may autonomously analyze historical alerts and alert rules previously applied in association with a given asset (e.g., surface equipment 110, borehole 135, tool 150, or the71CCS-511078-WO-2_BHI0583PCT like). The term “asset” used herein may refer to a physical entity (e.g., surface equipment 110, borehole 135, tool 150, or the like) and / or a logical representation of the physical entity.

[0067] The platform may generate alerts and alert rules based on historical occurrence of the risks in correlation to the alerts and / or based on historical alert rules. Additionally, or alternatively, the system 100 may provide a user with data including identified conditions and combinations of conditions that may give rise to an alert and provide recommended actions for risk mitigation and remediation in response to the same, in a format supportive of easy understanding of risks by a user. For example, based on the data, the user may select one or more recommended actions for risk mitigation and remediation. In some examples, the presentation of combinations of conditions that historically give rise to alerts may be presented in a manner allowing the user to discern an interconnection between aspects of the system that is not otherwise discernable. By way of example, the user may have no way of knowing that a time of day correlates to an increased risk associated with exceeding a pressure threshold and there is no reason in the art to connect those two variables.

[0068] Example aspects of features provided by the alert generation engine 175 are later described herein with reference to FIG. 2.

[0069] FIG. 2 illustrates an example workflow 200 in accordance with one or more embodiments of the present disclosure. The workflow 200 may be implemented by system 100 and analysis system 101 of FIG. 1.

[0070] For example, the workflow 200 may be implemented by a computing device 105, a server, surface equipment 110 (e.g., processing circuitry included in the surface equipment 110,), and / or subsurface equipment described herein. Repeated descriptions of like elements are omitted for brevity.

[0071] According to one or more embodiments of the present disclosure described with reference to FIGS. 1 and 2, techniques are described that support generation of real-time risk assessment and advisory alerts associated with energy industry operations. The techniques support automated generation of alerts and alerting rules by an industrial system (e.g., the system 100 of FIG. 1).

[0072] An alert generation system 275 may include aspects of alert generation engine 175 described with reference to FIG. 1. An industrial system 202 corresponds to system 100 of FIG. 1 and includes real time data sources 201, and the real time data sources 201 may include aspects of sensors (e.g., sensors 125, sensors 155, sensors 160, and the like) described with reference to FIG. 1, as well as sensors corresponding to emitters, CO2 capture71CCS-511078-WO-2_BHI0583PCT components, compressors, pipelines, CO2 storage components, and any other relevant sensor systems including environmental sensors.

[0073] Real time data sources 201 may be implemented at a database 180 described with reference to FIG. 1. For example, real time data sources 201 may be external to the computing device 105 described with reference to FIG. 1. In some examples, real time data sources 201 may be associated with product lines associated with energy industry operations (e.g., resource recovery and fluid sequestration, CCUS, and the like). Repeated descriptions of like elements are omitted for brevity.

[0074] Initially, the workflow 200 includes receiving raw data 204 from the real-time data sources 201 within the system 100 at a CCUS cloud 206. As used herein, raw data refers to data in an as generated form, where the data has received minimal if any processing after being generated. The CCUS cloud 206 can be any conventional cloud computing system, and is configured to receive and categorize the raw data 204. The raw data 204 is then provided from the CCUS cloud 206 to a data collector 208 and a historical data training set 214.

[0075] The data collector 208 aggregates and organizes the received raw data 204 in real-time into a current data set and provides the current data set to a model constructure 216 within the alert generation system 275 and to a data normalization module 210.

[0076] The data normalization module 210 uses conventional normalization processes to normalize each aspect of the data from the data collector 208 into a single data type (e.g., normalizing pressure values, temperature values, time of day, etc. into singular numerical representations of the corresponding data element). The normalized data is then used to extract a machine learning feature. The extracted machine learning feature is an individual measurable characteristic represented by a string of values corresponding to the data in the processed data set. The string of values in the feature is a standardized format according to the feature format used by the alert generation system 275. In a practical implementation the standardized format will depend on what data elements are available in the raw data 204 of a given system 202.

[0077] At an initiation of the workflow 200 a historical training data set 214 is provided with an established set of operational data from the system 202 over a period of time. By way of example, the operational data may include raw data generated over a three month period. The historical training data set 214 includes the same data elements as the real time data sources 201. In addition, the historical training data set 214 includes any alerts that occurred based on existing rules based alert systems, and the outcomes of those alerts. As71CCS-511078-WO-2_BHI0583PCT used herein, the outcomes of the alerts can include resultant actions, identified risks, reviews of the alerts resulting in discounting the alert as a false alarm, and the like.

[0078] As the workflow 200 iterates, the historical training data set 214 recieves each instance of newly generated raw data 204, and any resulting alerts as well as the outcomes of those alerts. In some cases, the historical training data set 214 may also receive notification of any errors, inefficiencies, or problems that occur contemporaneously with the generation of the raw data 204, even when no alert is generated.

[0079] In this way, the historical training data set 214 is continuously updated with new data. This in turn allows for the alert generation system 275 to be continuously refined to account for new data and changes within the system (e.g. wear and tear based inefficiencies, updated equipment, and the like) without requiring a complete redesign of the alerting process.

[0080] In some example operations of the workflow 200, an industrial system 100 may be connected to the workflow 200, and begin providing raw data either without any historical data, or without sufficient historical training data, to fully train the alert generation system 275. In such cases, the alert generation system 275 can be provided with a set of provisional rule based alerts, and operate in a supervisory mode using the provisional rules based alerts until a large enough historical training data set 214 has been generated to fully train the alert generation system 275.

[0081] The alert generation system 275 recieves the most up to date historical training data set 214 and a current iteration of the raw data 204 from the data collector 208. The raw data 204 and the historical data are provided to a model constructor 216. With continued reference to FIG. 2, FIG. 3 illustrates a model constructor 216 according to one example implementation.

[0082] The model constructor 216 includes a real world based analysis (real world model 302) and an artificial intelligence I machine learning (AI / ML) model 304. The real world model 302 includes physics models, chemical models, and other defined real world relationships (e.g. Darcy’s law) to set an initial framework for parameters within the raw data 204 and defines that a model generated by the AI / ML model 304 should operate within the framework. This allows the real world model 302 to operate in a gradient boosting manner.

[0083] The defined parameters from the real world model 302 and the historical training data 214 are then provided to the AI / ML model 304 (such as the machine learning model(s) 107 of FIG. 1), and the AI / ML model 304 trains on the historical data within the parameters defined by the real world model 302. The result of the training is an AI / ML71CCS-511078-WO-2_BHI0583PCT algorithm 306 for detecting and predicting anomalies correlated to a required alert. The AI / ML algorithm 306 includes any number of functions and interrelationships between the data elements, and are sufficiently complex that an individual or team of individuals are not able to construct similarly complex formulas defining the interrelationships.

[0084] Referring again to FIG. 2, the algorithm 306 is output from the model constructor 216 and provided to an alert module 212 within the alert generation system 275.

[0085] The alert module 212 recieves the algorithm 306 generated by the AI / ML model 302, and the normalized current data from the data normalization module 210. In the example of FIG. 2, the alert module 212 includes two operations which are defined by the algorithm 306, an anomaly detection function 218 and an anomaly forecasting function 220.

[0086] The anomaly detection function 218 applies a set of rules within the algorithm 306 and identifies any deviations from expected parameter relationships within the normalized data set. When the rules are violated, the alert module 212 outputs an alert based on the deviation. In some examples, the rules applied are hidden rules applied by an algorithm and are not visible to a user 226. In other examples, one or more of the rules defined by the algorithm 306 may be provided to the user 226 and / or other system engineers, allowing for the rules to be reviewed.

[0087] The anomaly forecasting function 220 applies the relationships from the AI / ML model to the current data to identify expected future anomalies based on current relationships. In some examples, the anomaly forecasting can apply a time series of the current data, and a set number of previous iterations of the normalized data in sequence thereby providing an improved forecast. The forecasting provides alerts when a value or combination of values is expected to present a risk even when the particular values or combination of values do not currently violate any established rules.

[0088] In either event, the alert is output from the alert module 220, and from the alert generation system 275 to the user 226 and to an alert analysis 224. The output to the user 226 notifies the user 226 that an alert has occurred. Simultaneously, the alert analysis 224 generates an automated analysis of the alert based on the parameters triggering the alert and provides information regarding the type of alert to the user 226.

[0089] The information is also provided to a contextual understanding module 232, and the contextual understanding module uses the provided information from the automated analysis to generate a contextual data set defining the context in which the alert occurred. As the contextual data set is provided to a risk evaluation engine 230, the contextual data set is71CCS-511078-WO-2_BHI0583PCT not necessarily arranged in a format that may be easily parsed and / or understood by the end user 226.

[0090] The risk evaluation engine 230 generally interprets and defines the risk based on the alert and the contextual understanding of the alert. In one example, the automated risk evaluation engine 230 evaluates the risk, once a risk has been associated with the alert, the risk evaluation engine 230 provides recommendations to the user based on a root cause analysis performed by the risk evaluation engine 230 and determines a resolution to the identified risks. The recommendations from the root cause analysis are based on the mitigation and remediation plans associated with the identified risk. It is also based on historical learnings of resolution plans applied for similar risks. The user selects a potential cause based on the recommendations and the selected potential cause is provided as a learning data element to the risk evaluation engine 230. Performing the RCA on alerts facilitates a reduction in the probability of an occurrence of the alerts, thereby assisting with the management of the industrial system. This selection process provides a continuous loop, allowing the risk evaluation engine 230 to continuously improve via the RCA.

[0091] The risk evaluation engine 230 then defines the severity of the risk. Every alert that is generated is a result of at least one control parameter broken. Each control parameter broken is associated with a risk, and every identified risk is associated with at least one control parameter broken. Each control parameter has a rank that indicates a severity of the control parameter being broken. Thus, based on the control’s rank in the risk, a severity of the risk is identified. Additionally, the risk evaluation engine 230 provides a risk score based on the occurrence count of the risk.

[0092] The risk score and severity of the risk are provided to the end user 226 and the risk evaluation engine 230 identifies a mitigation and recovery plan for resolving the risk.

[0093] In certain instances, such as where the risk can be resolved via tuning one or more parameters, the risk evaluation engine 230 can automatically implement the mitigation plan through control outputs 231 provided to the system 202. The mitigation and recovery plan can, in alternate examples, be provided to the end user 226, or otherwise provided to an engineer for implementation.

[0094] In either event, the defined plan, is provided to an alert resolution module 234. The alert resolution module 234 defines any mitigation plan, and whether the mitigation plan was implemented and provides corresponding data to the historical data set 214, where the data regarding the mitigation plan, and whether the mitigation plan was implemented, is added to further refine the historical data.71CCS-511078-WO-2_BHI0583PCT

[0095] When presented with the alert, the user 226 can use an alert acknowledgement feature 228 to acknowledge the alert. In some examples the acknowledgment may take the form of either actively accepting a recommendation from the risk evaluation engine 230 and / or performing an action (e.g., clicking an acknowledgement button on a computer system) that acknowledges the alert. When the alert is acknowledged, the acknowledgment is provided to the risk evaluation engine 230, and the acknowledgment is provided along with the data surrounding the alert to the historical data set 214.

[0096] When the alert remains unacknowledged, the lack of acknowledgment, and the data triggering the alert is provided to the historical training data set 214.

[0097] With continued reference to the systems of FIG. 1 and the workflows of FIGS. 2 and 3, FIG. 4 illustrates an example process 400 operated by the systems and workflows.

[0098] Initially a historical data set is received or generated at a receive / generate historical data set step 410. The historical data may be actual data and / or simulation data for the system being analyzed. When historical and simulation data is not available, the process 400 operates the connected system for a period of time (e.g. 3 months) using provisional rules based alerts and generates historical data during this period of time.

[0099] The historical data is then used to train the alert generation system 275 in a train alert generation system step 420. As described with regards to the workflow 200 of FIG. 2, the training includes analyzing the historical data using a real world model to define a parameter framework and providing the historical data and the parameter framework to one or more artificial intelligence I machine learning (AI / ML) model(s). The AI / ML model(s) generate an algorithm that defines interrelationships between sensed values and provides alerts and alert rules based on the interrelationships.

[0100] The trained alert generation engine is then provided with current operational data in an evaluate current data step 430. The current operational data is evaluated using the algorithm, and any required alerts are generated by applying the algorithm to the operational data in a generate alert step 440. The alert is provided to an end user who can acknowledge the alert and act on the alert or can leave the alert unacknowledged in a respond to alert step 450. In either case, the alert and the current data giving rise to the alert is added to the historical data from step 410 and the alert generation engine is retrained at a new step 420. In some implementations, the alert and the current data provided for retraining further includes the detailed root cause analysis (RCA) of the alert.71CCS-511078-WO-2_BHI0583PCT

[0101] In some examples, the retraining may occur every time an alert happens. In other cases the retraining may occur periodically (e.g. at the end of every day, once a week, etc.) or once a predefined number of alerts have been added to the historical data set.

[0102] In the descriptions of the flowcharts herein, the operations may be performed in a different order than the order shown, or the operations may be performed in different orders or at different times. Certain operations may also be left out of the flowcharts, one or more operations may be repeated, or other operations may be added to the flowcharts.

[0103] In the descriptions of the flowcharts herein, the operations may be performed in a different order than the order shown, or the operations may be performed in different orders or at different times. Certain operations may also be left out of the flowcharts, one or more operations may be repeated, or other operations may be added to the flowcharts.

[0104] Set forth below are some embodiments of the foregoing disclosure:

[0105] Embodiment 1. A computer-implemented method characterized by training an artificial intelligence / machine learning (AI / ML) algorithm to generate at least one of alerts and alert rules using a historical data set of an industrial system in an alert generation system, the historical data set includes operational data of the industrial system, at least one alert rule, a set of alerts correlated with operational data, and a set of responses to each alert in the set of alerts, receiving a set of operational data from an industrial system at the alert generation system and applying the AI / ML algorithm to the set of operational data, generating an alert based on the application of the AI / ML algorithm to the set of operational data, and providing the generated alert to a user.

[0106] Embodiment 2. A computer-implemented method as in any prior embodiment, wherein training the artificial AI / ML algorithm comprises gradient boosting the historical data by applying the historical data to a real world model.

[0107] Embodiment 3. A computer-implemented method as in any prior embodiment, wherein the real world model defines a parameter framework by applying the historical data to chemical laws and physical laws.

[0108] Embodiment 4. A computer-implemented method as in any prior embodiment, wherein gradient boosting the historical data defines maximum and minimum values for parameters within the set of operational data.

[0109] Embodiment 5. A computer-implemented method as in any prior embodiment, wherein generating the alert based on the application of the AI / ML algorithm to the set of operational data comprises forecasting a probability of at least one value of the operational data exceeding an acceptable parameter.71CCS-511078-WO-2_BHI0583PCT

[0110] Embodiment 6. A computer-implemented method as in any prior embodiment, wherein the computer-implemented method further includes generating updated historical data by performing a root cause analysis of the alert using a risk evaluation engine and adding the generated alert, the set of operational data and an output of the risk evaluation engine to the historical data, and retraining the AI / ML model using the updated historical data.

[0111] Embodiment 7. A computer-implemented method as in any prior embodiment, wherein the computer-implemented method further includes generating the historical data by operating the industrial system under a rules based alert system for a predefined period of time and storing operational data of the industrial system during the period of time, at least one alert rule, a set of alerts correlated with operational data during the period of time, and a set of responses to each alert in the set of alerts during the period of time.

[0112] Embodiment 8. A computer-implemented method as in any prior embodiment, wherein the AI / ML algorithm includes at least one alert rule based on the historical data and wherein the application of the AI / ML algorithm to the set of operational data includes comparing the historical data to the at least one alert rule.

[0113] Embodiment 9. A computer-implemented method as in any prior embodiment, wherein after providing the generated alert to a user, the end user can acknowledge the alert and act on the alert or can leave the alert unacknowledged in a respond to alert step.

[0114] Embodiment 10. A system characterized by analysis equipment comprising a processor and a memory, wherein the memory comprises instructions stored thereon that, when executed by the processor, cause the processor to perform operations comprising training an artificial intelligence / machine learning (AI / ML) algorithm to generate at least one of alerts and alert rules using a historical data set of an industrial system in an alert generation system, the historical data set includes operational data of the industrial system, at least one alert rule, a set of alerts correlated with operational data, and a set of responses to each alert in the set of alerts, receiving a set of operational data from an industrial system at the alert generation system and applying the AI / ML algorithm to the set of operational data, generating an alert based on the application of the AI / ML algorithm to the set of operational data, and providing the generated alert to a user.

[0115] Embodiment 11. A system as in any prior embodiment, wherein training the artificial AI / ML algorithm comprises gradient boosting the historical data by applying the historical data to a real world model.71CCS-511078-WO-2_BHI0583PCT

[0116] Embodiment 12. A system as in any prior embodiment, wherein the real world model defines a parameter framework by applying the historical data to chemical laws and physical laws.

[0117] Embodiment 13. A system as in any prior embodiment, wherein gradient boosting the historical data defines maximum and minimum values for parameters within the set of operational data.

[0118] Embodiment 14. A system as in any prior embodiment, wherein generating the alert based on the application of the AI / ML algorithm to the set of operational data comprises forecasting a probability of at least one value of the operational data exceeding an acceptable parameter.Embodiment 10. A system as in any prior embodiment, wherein

[0119] Embodiment 15. A system as in any prior embodiment, wherein the operations further comprise generating updated historical data by adding the generated alert and the set of operational data to the historical data and retraining the AI / ML model using the updated historical data.

[0120] Embodiment 16. A system as in any prior embodiment, wherein the operations further comprising generating the historical data by operating the industrial system under a rules based alert system for a predefined period of time and storing operational data of the industrial system during the period of time, at least one alert rule, a set of alerts correlated with operational data during the period of time, and a set of responses to each alert in the set of alerts during the period of time.

[0121] Embodiment 17. A system as in any prior embodiment, wherein the AI / ML algorithm includes at least one alert rule based on the historical data and wherein the application of the AI / ML algorithm to the set of operational data includes comparing the historical data to the at least one alert rule.

[0122] Embodiment 18. A system as in any prior embodiment, wherein after providing the generated alert to a user, the end user can acknowledge the alert and act on the alert or can leave the alert unacknowledged in a respond to alert step.

[0123] Embodiment 19. A computer program product characterized by: a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising: training an artificial intelligence / machine learning (AI / ML) algorithm to generate at least one of alerts and alert rules using a historical data set of an industrial system in an alert generation system, the historical data set includes operational data of the industrial system, at least one alert rule, a set of alerts correlated with operational data, and a set of71CCS-511078-WO-2_BHI0583PCT responses to each alert in the set of alerts, receiving a set of operational data from an industrial system at the alert generation system and applying the AI / ML algorithm to the set of operational data, generating an alert based on the application of the AI / ML algorithm to the set of operational data, and providing the generated alert to a user.

[0124] Embodiment 20. A computer program product as in any prior embodiment, wherein training the artificial AI / ML algorithm comprises gradient boosting the historical data by applying the historical data to a real world model and the real world model defines a parameter framework by applying the historical data to chemical laws and physical laws.

[0125] The use of the terms “a” and “an” and “the” and similar referents in the context of describing the invention (especially in the context of the following claims) are to be construed to cover both the singular and the plural, unless otherwise indicated herein or clearly contradicted by context. Further, it should be noted that the terms “first,” “second,” and the like herein do not denote any order, quantity, or importance, but rather are used to distinguish one element from another. The terms “about”, “substantially” and “generally” are intended to include the degree of error associated with measurement of the particular quantity based upon the equipment available at the time of filing the application. For example, “about” and / or “substantially” and / or “generally” can include a range of ± 8% of a given value.

[0126] The teachings of the present disclosure may be used in a variety of well operations. These operations may involve using one or more treatment agents to treat a formation, the fluids resident in a formation, a borehole, and I or equipment in the borehole, such as production tubing. The treatment agents may be in the form of liquids, gases, solids, semi-solids, and mixtures thereof. Illustrative treatment agents include, but are not limited to, fracturing fluids, acids, steam, water, brine, anti-corrosion agents, cement, permeability modifiers, drilling muds, emulsifiers, demulsifiers, tracers, flow improvers etc. Illustrative well operations include, but are not limited to, hydraulic fracturing, stimulation, tracer injection, cleaning, acidizing, steam injection, water flooding, cementing, etc.

[0127] While the invention has been described with reference to an exemplary embodiment or embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted for elements thereof without departing from the scope of the invention. In addition, many modifications may be made to adapt a particular situation or material to the teachings of the invention without departing from the essential scope thereof. Therefore, it is intended that the invention not be limited to the particular embodiment disclosed as the best mode contemplated for carrying out this71CCS-511078-WO-2_BHI0583PCT invention, but that the invention will include all embodiments falling within the scope of the claims. Also, in the drawings and the description, there have been disclosed exemplary embodiments of the invention and, although specific terms may have been employed, they are unless otherwise stated used in a generic and descriptive sense only and not for purposes of limitation, the scope of the invention therefore not being so limited.

Claims

71CCS-511078-WO-2_BHI0583PCTCLAIMSWhat is claimed is:

1. A computer- implemented method characterized by: training an artificial intelligence / machine learning ( AI / ML) algorithm (306) to generate at least one of alerts and alert rules using a historical data (214) set of an industrial system in an alert generation system (175), the historical data set (214) includes operational data of the industrial system (100), at least one alert rule, a set of alerts correlated with operational data, and a set of responses to each alert in the set of alerts (157); receiving a set of operational data from an industrial system (100) at the alert generation system (220) and applying the AI / ML algorithm to the set of operational data; generating an alert based on the application of the AI / ML algorithm (306) to the set of operational data; and providing the generated alert to a user.

2. The computer-implemented method of claim 1, wherein training the artificial AI / ML algorithm (306) comprises gradient boosting the historical data (214) by applying the historical data (214) to a real world model (302), and optionally wherein gradient boosting the historical data (214) defines maximum and minimum values for parameters within the set of operational data.

3. The computer-implemented method of claim 2, wherein the real world model (302) defines a parameter framework by applying the historical data (214) to chemical laws and physical laws.

4. The computer-implemented method of claim 1 wherein generating the alert based on the application of the AI / ML algorithm (306) to the set of operational data comprises forecasting a probability of at least one value of the operational data exceeding an acceptable parameter.

5. The computer-implemented method of claim 1, further comprising generating updated historical data (214) by performing a root cause analysis of the alert using a risk evaluation engine (230) and adding the generated alert (157), the set of operational data and an output of the risk evaluation engine (230) to the historical data (214), and retraining the AI / ML model (304) using the updated historical data.

6. The computer-implemented method of claim 1, further comprising generating the historical data by operating the industrial system (100) under a rules based alert system for a predefined period of time and storing operational data of the industrial system during the period of time, at least one alert rule, a set of alerts correlated with operational data during the2571CCS-511078-WO-2_BHI0583PCT period of time, and a set of responses to each alert in the set of alerts (157) during the period of time.

7. The computer- implemented method of claim 1, wherein the AI / ML algorithm (306) includes at least one alert rule based on the historical data (214) and wherein the application of the AI / ML algorithm (306) to the set of operational data includes comparing the historical data (214) to the at least one alert rule.

8. The computer-implemented method of claim 1, wherein after providing the generated alert to a user, the end user can acknowledge the alert and act on the alert or can leave the alert unacknowledged in a respond to alert step (450).

9. A system characterized by: analysis equipment characterized by a processor and a memory, wherein the memory comprises instructions stored thereon that, when executed by the processor, cause the processor to perform operations characterized by: training an artificial intelligence / machine learning (AI / ML) algorithm (306) to generate at least one of alerts (157) and alert rules using a historical data set (214) of an industrial system in an alert generation system (175), the historical data set (214) includes operational data of the industrial system, at least one alert rule, a set of alerts correlated with operational data, and a set of responses to each alert in the set of alerts (157); receiving a set of operational data from an industrial system (100) at the alert generation system (107) and applying the AI / ML algorithm to the set of operational data; generating an alert based on the application of the AI / ML algorithm (306) to the set of operational data; and providing the generated alert to a user.

10. The system of claim 9, wherein training the artificial AI / ML algorithm (306) comprises gradient boosting the historical data by applying the historical data to a real world model (302), wherein the real world model (302) defines a parameter framework by applying the historical data to chemical laws and physical laws, and wherein gradient boosting the historical data defines maximum and minimum values for parameters within the set of operational data.

11. The system of claim 8 wherein generating the alert (157) based on the application of the AI / ML algorithm (306) to the set of operational data comprises forecasting a probability of at least one value of the operational data exceeding an acceptable parameter.71CCS-511078-WO-2_BHI0583PCT12. The system of claim 9, further comprising generating updated historical data (214) by adding the generated alert (157) and the set of operational data to the historical data (214) and retraining the AI / ML model (306) using the updated historical data (214).

13. The system of claim 9, further comprising generating the historical data by operating the industrial system under a rules based alert system for a predefined period of time and storing operational data of the industrial system during the period of time, at least one alert rule, a set of alerts correlated with operational data during the period of time, and a set of responses to each alert in the set of alerts during the period of time.

14. The system of claim 9, wherein the AI / ML algorithm (306) includes at least one alert rule based on the historical data (214) and wherein the application of the AI / ML algorithm (306) to the set of operational data includes comparing the historical data to the at least one alert rule.

15. The system of claim 9, wherein after providing the generated alert (157) to a user, the end user can acknowledge the alert and act on the alert (157) or can leave the alert unacknowledged in a respond to alert step (450).

Images