APM & APM Studio: Complex Event Processing in APM & APM Studio

Complex Event Processing (CEP) is a feature of APM that allows streams of events and alarms to be analysed and correlated to gain an accurate understanding of these event occurrences in real-time. An important capability of CEP is its possibility to reduce the number of events/alarms presented to the user by filtering nuisance alarms and correlating events and alarms to only display pertinent information in such a way that it can be quickly and easily interpreted. Ultimately enhancing the user’s situational awareness of the situation at hand (see Endsley’s Situational Awareness Model).

To achieve this, CEP in APM integrates a powerful rule engine that allows users to configure rules that analyse event data streams and perform actions when the conditions defined by the rules are satisfied. The key components of APM’s CEP engine are:

1. Event Streams: The CEP engine in APM can continuously receive streams of events from various sources such as sensors, applications, databases, and external feeds but can also have APM events/alarms as its source.
2. Event Processing: Events are processed in real-time or near real-time. Each event is typically analysed, and relevant information is extracted from it.
3. Pattern Recognition: The CEP engine in APM is designed to recognize patterns or combinations of events that are significant or meaningful. These patterns can range from simple conditions to complex sequences or correlations. Potential patterns of interest can be derived from event and alarm history offline and validated with users using UReason’s EPDA – Event Pattern Detection Agent.
4. Rules and Queries: The CEP engine in APM provides a rich user interface to define rules/queries to define the patterns or conditions you are looking for. Next to this, when connected to a live or simulated event/alarm stream an intuitive user interface allows you to monitor the findings of patterns.
5. Temporal and Spatial Correlation: The CEP engine in APM can correlate events not only based on their content but also based on their temporal (time-based) or other attributes of the source objects they relate to (e.g.APM CEP engine can correlate events based on their content and temporal (time-based) or other attributes of the source objects they relate to (e.g., location, criticality et cetera).
6. Low Latency: The CEP engine in APM is optimized for low latency processing to ensure timely detection of events and patterns.
7. Event-driven Architecture: The CEP engine in APM uses an event-driven architecture, where processing is triggered by the occurrence of events rather than being driven by a traditional request-response model.

An important aspect of our CEP engine is allowing the user to define pattern detection rules and their associated actions. A CEP Definition in APM consists of a Detection Rule that monitors a stream of events to detect predefined conditions and Actions executed when the Detection Rule conditions are satisfied. Below we see an example of such a definition:

Rule conditions can be a particular sequence or pattern of events, or a predefined number of repetitions of an event within a given time period specified in the rule. The above example screenshot will trigger in time as follows:
When the conditions of a Detection Rule are satisfied, the CEP Definition is said to have been “triggered”. Monitoring of triggering, i.e. execution, is also provided in APM:

As you can see in the above screenshot the actions executed by a CEP Definition are also reported. The default build-in actions APM provides are:

• Subsume: Associate events with a new or existing parent event to indicate relations or hide consequential events.
• New Alarm: Create a new alarm of a specified source.
• Shelve: Set the “shelved” property of an event.
• Modify Severity: Set the severity of an event.
• Run Script: Execute a script -e.g. triggering an external system or action.

Using the action part you can reduce the event/alarm streams presented to operators. This allows you to support required often missing features in your Basic Process Control Systems and reach alarm system performance targets (KPIs) outlined in EEMUA 191, ANSI/ISA-18.2-2016 / IEC62682:2022 and NORSOK YA710/711.

Up Next: APM/APM Studio – Time Series Historian (Coming soon)