WO2023132972A1

WO2023132972A1 - Sequence of events analyzer

Info

Publication number: WO2023132972A1
Application number: PCT/US2022/070006
Authority: WO
Inventors: Hamid JAHANIAN
Original assignee: Siemens Energy Inc
Current assignee: Siemens Energy Inc
Priority date: 2022-01-04
Filing date: 2022-01-04
Publication date: 2023-07-13
Anticipated expiration: 2024-07-04

Abstract

A method of determining the cause of a main event includes gathering system operational data from a sequence of events datastore, the operational data including a plurality of events, each event including a value and a time stamp. The method also includes identifying the main event from the plurality of events, the main event including a main value and a main time stamp, copying a system control system's program to create an offline control system, and using the offline control system, detecting within the operational data, precursor events, each precursor event including a precursor value and a precursor time stamp that indicates that the precursor event occurred prior to the main event, each precursor event being capable of contributing to the occurrence of the main event, and determining which precursor event caused the main event.

Description

SEQUENCE OF EVENTS ANALYZER

BACKGROUND

[0001] In industry, when operating a system, events such as emergency shutdown of the system, generally undergo post-event analyses. System operators review available data archived in a plant historian or control system in an effort to define the root cause of the shutdown. However, the volume of data and complex system interactions make these analyses very difficult.

BRIEF SUMMARY

[0002] In one aspect, a method of determining the cause of a main event includes gathering system operational data from a sequence of events datastore, the operational data including a plurality of events, each event including a value and a time stamp. The method also includes identifying the main event from the plurality of events, the main event including a main value and a main time stamp, copying a system control system’s program to create an offline control system, and using the offline control system, detecting within the operational data, precursor events, each precursor event including a precursor value and a precursor time stamp that indicates that the precursor event occurred prior to the main event, each precursor event being capable of contributing to the occurrence of the main event, and determining which precursor event caused the main event.

[0003] In one aspect, a method of determining the cause of a main event includes gathering operational data from a system, the operational data including a plurality of discreate Boolean data points, storing the operational data in a sequence of events datastore that is separate from a system controller, and generating events in response to a state change of any of the discrete Boolean data points, each event including a value and a time stamp. The method also includes identifying the main event from the generated events, the main event including a main value and a main time stamp, copying the system controller’s program to create an offline control system, the offline control system separate and independent from the system controller, using the offline control system to detect within the generated events, precursor events, each precursor event including a precursor value and a precursor time stamp that indicates that the precursor event occurred prior to the main event, and determining which precursor event or combination of precursor events caused the main event.

[0004] The foregoing has broadly outlined some of the technical features of the present disclosure so that those skilled in the art may better understand the detailed description that follows. Additional features and advantages of the disclosure will be described hereinafter that form the subject of the claims. Those skilled in the art will appreciate that they may readily use the conception and the specific embodiments disclosed as a basis for modifying or designing other structures for carrying out the same purposes of the present disclosure. Those skilled in the art will also realize that such equivalent constructions do not depart from the spirit and scope of the disclosure in its broadest form.

[0005] Also, before undertaking the Detailed Description below, it should be understood that various definitions for certain words and phrases are provided throughout this patent document, and those of ordinary skill in the art will understand that such definitions apply in many, if not most, instances to prior as well as future uses of such defined words and phrases. While some terms may include a wide variety of embodiments, the appended claims may expressly limit these terms to specific embodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

[0006] To easily identify the discussion of any particular element or act, the most significant digit or digits in a reference number refer to the figure number in which that element is first introduced.

[0007] FIG. l is a flow chart broadly illustrating a sequence of events analyzer.

[0008] FIG. 2A is a flow chart illustrating a search portion of the sequence of events analyzer of FIG. 1. [0009] FIG. 2B is a flow chart illustrating an analysis portion of the sequence of events analyzer of FIG. 1.

[0010] FIG. 3 schematically illustrates a physical arrangement of the programs and hardware that make-up the sequence of events analyzer of FIG. 1.

[0011] FIG. 4 illustrates a functional block diagram of an example computer system.

[0012] FIG. 5 illustrates a block diagram of a data processing system in which an embodiment of the virtual flow meter may be implemented.

DETAILED DESCRIPTION

[0013] Before any embodiments of the invention are explained in detail, it is to be understood that the invention is not limited in its application to the details of construction and the arrangement of components set forth in this description or illustrated in the following drawings. The invention is capable of other embodiments and of being practiced or of being carried out in various ways. Also, it is to be understood that the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting.

[0014] Various technologies that pertain to systems and methods will now be described with reference to the drawings, where like reference numerals represent like elements throughout. The drawings discussed below, and the various embodiments used to describe the principles of the present disclosure in this patent document are by way of illustration only and should not be construed in any way to limit the scope of the disclosure. Those skilled in the art will understand that the principles of the present disclosure may be implemented in any suitably arranged apparatus. It is to be understood that functionality that is described as being carried out by certain system elements may be performed by multiple elements. Similarly, for instance, an element may be configured to perform functionality that is described as being carried out by multiple elements. The numerous innovative teachings of the present application will be described with reference to exemplary non-limiting embodiments.

[0015] It should be understood that the words or phrases used herein should be construed broadly, unless expressly limited in some examples. For example, the terms “including,” “having,” and “comprising,” as well as derivatives thereof, mean inclusion without limitation. The singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. Further, the term “and/or” as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. The term “or” is inclusive, meaning and/or, unless the context clearly indicates otherwise. The phrases “associated with” and “associated therewith,” as well as derivatives thereof, may mean to include, be included within, interconnect with, contain, be contained within, connect to or with, couple to or with, be communicable with, cooperate with, interleave, juxtapose, be proximate to, be bound to or with, have, have a property of, or the like. Furthermore, while multiple embodiments or constructions may be described herein, any features, methods, steps, components, etc. described with regard to one embodiment are equally applicable to other embodiments absent a specific statement to the contrary.

[0016] Also, although the terms “first”, “second”, “third” and so forth may be used herein to refer to various elements, information, functions, or acts, these elements, information, functions, or acts should not be limited by these terms. Rather these numeral adjectives are used to distinguish different elements, information, functions or acts from each other. For example, a first element, information, function, or act could be termed a second element, information, function, or act, and, similarly, a second element, information, function, or act could be termed a first element, information, function, or act, without departing from the scope of the present disclosure.

[0017] In addition, the term “adjacent to” may mean that an element is relatively near to but not in contact with a further element or that the element is in contact with the further portion, unless the context clearly indicates otherwise. Further, the phrase “based on” is intended to mean “based, at least in part, on” unless explicitly stated otherwise. Terms “about” or “substantially” or like terms are intended to cover variations in a value that are within normal industry manufacturing tolerances for that dimension. If no industry standard is available, a variation of twenty percent would fall within the meaning of these terms unless otherwise stated.

[0018] FIG. l is a flow chart illustrating the basic operating steps used by a sequence of events analyzer 100 (sometimes abbreviated as SoE analyzer) to determine the cause of a particular event in a system, hereinafter referred to as a main event. [0019] Systems and in particular industrial systems such as process plants, power plants, and the like include a number of machines or systems that operate in unison to produce a desired product or result. In one example, the system is a power plant that operates to generate electricity. The power plant may include a heat source such as a boiler, a reactor, a geothermal source, and the like that are used to produce steam for use in a steam turbine. Other power plants may include a number of gas turbines that combust a flow of fuel to produce electricity and a hot exhaust gas. The exhaust gas may then be used as a heat source for the aforementioned steam turbines. As is known in the art, these systems are complex and require constant control and monitoring. A tremendous number of sensors, encoders, control devices, and the like are employed to monitor and control flow rates, temperatures, pressures, power output and the like. These devices may output Boolean data such as “On” or “Off’, “Alarm” or “Not Alarm”, “on-line” or “off-line” and the like. Each of these sensors, devices, or operational data points can be represented as digital ones or zeros. Other data may be collected as “real” data. This data could include actual temperatures, pressures, voltages, current, or the like as it is measured. Regardless of the data, it is preferred that the value, whether real or Boolean is also associated with a time stamp indicating when the data was collected. In the case of Boolean data, the time stamp may simply be indicative of when the Boolean valuable switched to the measured value (i.e., when the state of the Boolean variable changed).

[0020] For some of the real data it may be desirable to generate a Boolean variable. For example, it may be desirable to know if a particular temperature has exceeded a predetermined value. In this situation, the real data can be converted to Boolean data using an expression or formula. Thus, the Boolean value may be a zero if the temperature is below the predetermined value and may switch to a one when the temperature exceeds the predetermined value. A data collection system collects the binary data and stores the current value of one or zero as well as the time stamp indicative of when the value switched.

[0021] As used herein, an event is a change in the state of an expression at a specific time. An event consists of (at least) the name of an expression, the time at which the change of state occurred, and the new state of the expression.

[0022] The event time (i.e., the event time stamp) is the moment in time at which an event has occurred but is not always an exact time value. In some cases, the event time may consist of a start time and an end time. In this case, two different time values indicating the beginning time and end time of the event would be stored. In cases where the exact time of an event is known, the exact time may be stored as a single time value, rather than an interval.

[0023] A sequence of events analyzer 100 continuously gathers data and generates a sequence of events (SoE). The SoE may be a list or report of events extracted from the data collection system. The SoE can be a simple list in chronological order or may be a list that extends chronologically backward from a main event. A main event is simply a selected event for which the sequence of events analyzer 100 will determine the sequence of events and the root causes of the main event. The SoE may include only events that occurred within a predetermined time frame or window that ends with the main event. For example, with some main events, a predetermined time period of five minutes may be sufficient to determine the root cause of the main event while others may require several hours or even days.

[0024] With reference to FIG. 1, following the gather data step 102, the data is defined or organized into events in the define events step 104. Next, the events are analyzed in an event analysis step 106 to determine if one of them is a main event. The analysis could include an actual analysis of the various events or could be as simple as selecting an event or number of events identified by a user or predefined in the sequence of events analyzer 100 as main events (e.g., emergency shutdown, alarms, etc.). If the event is not a main event, the data is simply stored or archived within the data storage system in a store data step 108.

[0025] If an event is a main event, the next step is to identify precursor events in a detect precursor event step 110. Precursor events are events that if they have a certain state, lead to or contribute to the occurrence of the main event. For example, one main event may switch to a one state in response to either of two precursor events changing to a “one” state. One situation may be a minimum level alarm in a tank or vessel. The alarm may switch to an alarm or a “one” state in response to an input valve closing or a drain valve opening. Thus, either of two situations may lead to the state change.

[0026] For each detected precursor event, it is next determined if the precursor event is a basic event in a determine if event is basic step 112. A basic event is an event that cannot be traced to any other preceding events in the SoE. If the precursor event is not a basic event, a time window check 114 is performed to determine if the precursor event occurred outside of the predetermined time period before the main event time stamp. [0027] If the precursor event is a basic event or if it is outside of the predetermined time period than the precursor event collection for that precursor event is complete. However, if the precursor event is not a basic event and is within the predetermined time period, additional levels of precursor events are detected by repeating the detect precursor event step 110, the determine if event is basic step 112, and the time window check 114. This step can be repeated “N” times until all the precursor events detected are basic events or are outside the predetermined time period.

[0028] Once all the precursor events are found or identified, the sequence of events analyzer 100 can determine which of the precursor events or group of events likely led to the main event. This analysis is performed in a determine the cause of the main event step 118.

[0029] This process can be repeated for multiple main events as may be desired. In addition, the sequence of events analyzer 100 can run automatically and continuously or can be initiated periodically either automatically or by a user.

[0030] FIG. 2A and FIG. 2B together include another flow chart that illustrates in greater detail the arrangement of a program (or programs) that implements the sequence of events analyzer 100. The sequence of events analyzer 100 includes two separate pieces or programs with a search portion 202 illustrated in FIG. 2A and an analysis portion 204 shown in FIG. 2B.

[0031] With reference to FIG. 2A, the search portion 202 begins with an event expression 206. The event expression 206 may include a Boolean function of a set of events that occurred within the predefined time period or time window.

[0032] An event check 208 is performed for each event in the set of events to determine if the event is one that might be of possible interest in identifying the cause of a main event within the event expression 206. If the event check 208 returns a “no”, the event is marked as possible, unless the event is already marked “true” and the checks for the event are complete.

[0033] If the event check 208 result is a "yes", the event is compared in a compare step 210 to the events in the event expression to determine if it is present and within the desired time window.

[0034] If the event is not found in the compare step 210, a separation step 212 directs the program to mark the event as false or not of interest in a mark false step 214. If, however, the event is found in the compare step 210 it is first adjusted. Specifically, a time adjustment 216 may be performed to make sure that the time stamp of the event is in conformance with the format desired for additional analysis. For example, a time stamp that indicates a range may be adjusted to indicate only the start time of the event. Once the time stamp is adjusted the event is marked as true or of interest in step 218.

[0035] A determining step 220 is next performed to determine if all the events have been checked. If they have not all been checked, the process for the steps from the event check 208 through the step 218 and step 222 are repeated until all the events in the set of events are checked and classified as true (of interest) or false (not of interest).

[0036] Once all the events in the event expression or set of events are checked, the event expression is evaluated based on the results of the analysis of the original event expression. This event expression revision 224 is not required and may not be performed or be necessary in many cases.

[0037] With the event expression revision 224 complete, a basic entity check 226 is performed to determine where in the analysis portion 204 the sequence of events analyzer 100 proceeds. If they are all basic events, the system proceeds to point 1 in FIG. 2B, if they are not all basic events the system proceeds to point 2.

[0038] FIG. 2B illustrates the analysis portion 204 of the sequence of events analyzer 100.

For the analysis, function blocks (sometimes referred to as FB) in the offline control system are employed to relate input events or variables with output events or variables. Thus, for an event, there may be a function block that functions like an OR gate such that any input value of “one” would lead to an output value of “one”.

[0039] Data flows between the search portion 202 and the analysis portion 204. As discussed with regard to FIG. 2A, if the event expression includes only basic events (i.e., result of basic entity check 226 is YES) then much of the analysis portion 204 of FIG. 2B is bypassed as the existing event expression is complete and the process ends at block 228.

[0040] However, when all the events are not basic events, the analysis portion 204 flows into the analysis portion 204 at the top of FIG. 2B. In a locate function block step 230 the analysis portion 204 searches the offline control system for function blocks that have as an output, the event being studied.

[0041] If no function block is located than the particular event being searched likely cannot be expanded further or basic events that lead to that event cannot be identified as noted in block 232. If however, a function block is identified, a decision step 234 is performed to determine if the event should be traced to the inputs of the identified function block. If the answer is no, the process moves to block 232 and no additional tracing for that event is performed. If the answer is YES, the function block and the inputs are analyzed to determine an expression for the function block that would lead to the output. For example, if the function block is an AND function, the expression would indicate that each of the inputs to the function block must be true or yes to lead to the event being true or yes. An OR function block on the other hand would require any one of the inputs to be a true or yes to achieve the same true or yes output for the event.

[0042] This process is repeated until all the events passed from the search portion 202 are analyzed. As with the search portion 202, the need for a second event expression revision 236 is reviewed. If needed, the analysis portion 204 passes the data back to the search portion 202 at point 3 near the top of FIG. 2A.

[0043] If necessary, the expression or expressions produced at the analysis block 238 are simplified at step 240 and the process is complete at block 228.

[0044] FIG. 3 illustrates one possible arrangement of computers and computer programs for implementing the sequence of events analyzer 100. As illustrated, the arrangement includes a main controller 302 that could include one or more software tools that cooperate to operate and control the system. For example, in a power plant setting a Supervisory control and data acquisition (SCAD A) system may be employed to track and control the operation of the entire power generation process.

[0045] Various sensors 304 measure parameters of the system in in some constructions feed that data to a sensor bus 306 where the data is conditioned, digitized, or otherwise adjusted for delivery to the main controller 302. Similar to sensor data, the main controller 302 also collects data and transmits data and control signals to various control device 308 [0046] The data from the sensors 304 as well as data related to the control devices 308 is also delivered, either directly or via the main controller 302 to a sequence of events datastore, referred to herein as a SoE data store 310. The SoE data store 310 stores all the data collected from the sensors as well as data provided by the main controller 302 such as control inputs, control settings, alarm conditions, and the like. Each data point is associated with a time stamp as discussed previously. The data points and the time stamps are stored in the SoE data store 310. It should be noted that FIG. 3 illustrates the SoE data store 310 as being stored separate from the main controller 302. However, this is not a requirement as the SoE data store 310 and the control programs could all be stored and operated from a common computer arrangement such as the main controller 302.

[0047] The arrangement of FIG. 3 also includes an offline control system 312 which is essentially a copy of the programs used by the main controller 302 to control the system. As illustrated in FIG. 3, the offline control system 312 is separate from the main controller 302. However, this separation is not required as the main controller 302 could also contain the programs of the offline control system 312 if desired. The offline control system 312 communicates in a back-and-forth fashion with the SoE data store 310 and together make-up at least part of the sequence of events analyzer 100.

[0048] The sequence of events analyzer 100 (sometimes referred to as SoEA) uses the given SoE data store 310 and the offline control system 312 as its main sources of knowledge. The main objective of the sequence of events analyzer 100 is to find the best estimation of basic events (and their relationships) that have led to the occurrence of the main event. This will be presented as a Boolean expression with logical relationships between the constituting basic events. For example, suppose a boiler has tripped at a particular time. A sequence of events report from the SoE data store 310 includes all the recorded events within ten minutes preceding the particular time. The sequence of events analyzer 100 will read the SoE data store 310, access the offline control system 312 as required, and produce a short list of causes (e.g., excessive level of water in drum detected by three transmitters at a time prior to the boiler trip). The sequence of events analyzer 100 constantly switches between the sequence of events analyzer 100 search portion 202 (the SoE data store 310) and the analysis portion 204 (the offline control system 312). The sequence of events analyzer 100 is used to search for events and also to adjust the estimated event times. The offline control system 312 helps navigate through causal relationship between events. In reasoning on causal relationships, the sequence of events analyzer 100 use the reverse functionality of the FBs. As an example, if the output of an OR gate has changed to "one” at time t, that will imply that at least one of the inputs to the OR gate must have changed from 0 to 1 at time t or shortly earlier. A key factor in estimating event times is the way in which the main controller 302 is processed by the CPU and the way time values are stamped on the events. In many control systems, programs are processed on a cyclic basis, with the cycle time being adjustable for each individual FB. As an example, if a FB is set to be processed every 200ms, then at every 200ms the CPU will read the inputs to the FB and update the FB output. If the FB output is set to be archived and the output is changed in that cycle, then a message is produced by the CPU at the end of the processing in that cycle to express the change as an event. Having an FB output event with time stamp t will imply that the FB inputs have changed states within the same processing cycle when the event was recorded, or in the previous processing cycle. The sequence of events analyzer 100 takes into account the time cycle of FBs when estimating the time intervals of an event. Where possible, the estimated time interval is replaced with accurate time values available in the SoE.

[0049] The sequence of events analyzer 100 analyses in a backward fashion, starting at the FB that produces the main event, and continuing through the offline control system 312 to reach a point where all the events in the latest expression are basic events and cannot (or should not) be traced any further. There are however cases where the backward analysis may be breached in order to obtain more useful evidence. Time delays and cycle times are taken into account when we take detours to move forward for archived signals.

[0050] As discussed, the sequence of events analyzer 100 is implemented as a program on one or more computers or controllers. The program or application program runs in a control or safety PLC such as the offline control system 312. The program is typically developed in a graphic editor and in the form of Function Block Diagrams (FBD). A FBD consists of Function Blocks (FBs) and their interconnections.

[0051] With reference to FIG. 4, an example computer system 400 suitable for use with the sequence of events analyzer 100 and processes described herein. The computer system 400 employs at least one data processing system 402. A data processing system may comprise at least one processor 404 (e.g., a microprocessor/CPU, GPU, and the like). The processor 404 may be configured to carry out various processes and functions described herein by executing from a memory 406, computer/processor executable instructions 408 corresponding to one or more applications 410 (e.g., software and/or firmware) or portions thereof that are programmed to cause the at least one processor to carry out the various processes and functions described herein.

[0052] The memory 406 may correspond to an internal or external volatile or nonvolatile processor memory 412 (e.g., main memory, RAM, and/or CPU cache), that is included in the processor and/or in operative connection with the processor. Such a memory may also correspond to non-transitory nonvolatile storage device 414 (e.g., flash drive, SSD, hard drive, ROM, EPROMs, optical discs/drives, or other non-transitory computer readable media) in operative connection with the processor.

[0053] The described data processing system 402 may optionally include at least one display device 416 and at least one input device 418 in operative connection with the processor. The display device, for example, may include an LCD or AMOLED display screen, monitor, VR headset, projector, or any other type of display device capable of displaying outputs from the processor. The input device, for example, may include a mouse, keyboard, touch screen, touch pad, trackball, buttons, keypad, game controller, gamepad, camera, microphone, motion sensing devices that capture motion gestures, operational sensors (e.g., pressure, temperature, flow, etc.), or other type of input device capable of providing user inputs or other information to the processor.

[0054] The data processing system 402 may be configured to execute one or more applications 410 that facilitates the features described herein.

[0055] For example, as illustrated in FIG. 4, the at least one processor 404 may be configured via executable instructions 408 (e.g., included in the one or more applications 410) included in at least one memory 406 to operate all or a portion of the system or process described herein.

[0056] Referring now to FIG. 5, a methodology is illustrated that facilitates operation of a portion of, or all the system or process described herein. While the methodology is described as being a series of acts that are performed in a sequence, it is to be understood that the methodology may not be limited by the order of the sequence. For instance, unless stated otherwise, some acts may occur in a different order than what is described herein. In addition, in some cases, an act may occur concurrently with another act. Furthermore, in some instances, not all acts may be required to implement a methodology described herein.

[0057] It should be appreciated that this described methodology may include additional acts and/or alternative acts corresponding to the features described previously with respect to the data processing computer system 400.

[0058] It is also important to note that while the disclosure includes a description in the context of a fully functional system and/or a series of acts, those skilled in the art will appreciate that at least portions of the mechanism of the present disclosure and/or described acts may be capable of being distributed in the form of computer/processor executable instructions 408 (e.g., software/firmware applications 410) contained within a storage device 414 that corresponds to a non-transitory machine-usable, computer-usable, or computer- readable medium in any of a variety of forms. The computer/processor executable instructions 408 may include a routine, a sub-routine, programs, applications, modules, libraries, and/or the like. Further, it should be appreciated that computer/processor executable instructions may correspond to and/or may be generated from source code, byte code, runtime code, machine code, assembly language, Java, JavaScript, Python, Julia, C, C#, C++ or any other form of code that can be programmed/configured to cause at least one processor to carry out the acts and features described herein. Still further, results of the described/claimed processes or functions may be stored in a computer-readable medium, displayed on a display device, and/or the like.

[0059] It should be appreciated that acts associated with the above-described methodologies, features, and functions (other than any described manual acts) may be carried out by one or more data processing systems 402 via operation of one or more of the processors 404. Thus, it is to be understood that when referring to a data processing system, such a system may be implemented across several data processing systems organized in a distributed system in communication with each other directly or via a network.

[0060] As used herein a processor corresponds to any electronic device that is configured via hardware circuits, software, and/or firmware to process data. For example, processors described herein may correspond to one or more (or a combination) of a microprocessor, CPU, GPU, or any other integrated circuit (IC) or other type of circuit that is capable of processing data in a data processing system 402. As discuss previously, the processor 404 that is described or claimed as being configured to carry out a particular described/claimed process or function may correspond to a CPU that executes computer/processor executable instructions 408 stored in a memory 406 in the form of software to carry out such a described/claimed process or function. However, it should also be appreciated that such a processor may correspond to an IC that is hardwired with processing circuitry (e.g., an FPGA or ASIC IC) to carry out such a described/claimed process or function. Also, it should be understood, that reference to a processor may include multiple physical processors or cores that are configured to carry out the functions described herein. In addition, it should be appreciated that a data processing system and/or a processor may correspond to a controller that is operative to control at least one operation.

[0061] In addition, it should also be understood that a processor that is described or claimed as being configured to carry out a particular described/claimed process or function may correspond to the combination of the processor 404 with the executable instructions 408 (e.g., software/firmware applications 410) loaded/installed into the described memory 406 (volatile and/or non-volatile), which are currently being executed and/or are available to be executed by the processor to cause the processor to carry out the described/claimed process or function. Thus, a processor that is powered off or is executing other software, but has the described software loaded/stored in a storage device 414 in operative connection therewith (such as on a hard drive or SSD) in a manner that is available to be executed by the processor (when started by a user, hardware and/or other software), may also correspond to the described/claimed processor that is configured to carry out the particular processes and functions described/claimed herein.

[0062] FIG. 5 illustrates a further example of a data processing system 500 with which one or more embodiments of the data processing system 402 described herein may be implemented. For example, in some embodiments, the at least one processor 404 (e.g., a CPU or GPU) may be connected to one or more bridges/buses/controllers 502 (e.g., a north bridge, a south bridge). One of the buses for example, may include one or more I/O buses such as a PCI Express bus. Also connected to various buses in the depicted example may include the processor memory 412 (e.g., RAM) and a graphics controller 504. The graphics controller 504 may generate a video signal that drives the display device 416. It should also be noted that the processor 404 in the form of a CPU may include a memory therein such as a CPU cache memory. Further, in some embodiments one or more controllers (e.g., graphics, south bridge) may be integrated with the CPU (on the same chip or die). Examples of CPU architectures include IA-32, x86-64, and ARM processor architectures.

[0063] Other peripherals connected to one or more buses may include communication controllers 506 (Ethernet controllers, WiFi controllers, cellular controllers) operative to connect to a network 508 such as a local area network (LAN), Wide Area Network (WAN), the Internet, a cellular network, and/or any other wired or wireless networks or communication equipment. The data processing system 500 may be operative to communicate with one or more servers 510, and/or any other type of device or other data processing system that is connected to the network 508. For example, in some embodiments, the data processing system 500 may be operative to communicate with a memory 406. Examples of a database may include a relational database (e.g., Oracle, Microsoft SQL Server). Also, it should be appreciated that is some embodiments, such a database may be executed by the processor 404.

[0064] Further components connected to various busses may include one or more I/O controllers 512 such as USB controllers, Bluetooth controllers, and/or dedicated audio controllers (connected to speakers and/or microphones). It should also be appreciated that various peripherals may be connected to the I/O controller(s) (via various ports and connections) including the input devices 418, and an output devices 514 (e.g., printers, speakers) or any other type of device that is operative to provide inputs to and/or receive outputs from the data processing system.

[0065] Also, it should be appreciated that many devices referred to as input devices 418 or output devices 514 may both provide inputs and receive outputs of communications with the data processing system 500. For example, the processor 404 may be integrated into a housing (such as a tablet) that includes a touch screen that serves as both an input and display device. Further, it should be appreciated that some input devices (such as a laptop) may include a plurality of different types of input devices 418 (e.g., touch screen, touch pad, and keyboard). Also, it should be appreciated that other hardware 516 connected to the I/O controllers 512 may include any type of device, machine, sensor, or component that is configured to communicate with a data processing system. [0066] Additional components connected to various busses may include one or more storage controllers 518 (e.g., SATA). A storage controller 518 may be connected to a storage device 414 such as one or more storage drives and/or any associated removable media. Also, in some examples, a storage device 414 such as an NVMe M.2 SSD may be connected directly to a bus (e.g., bridges/buses/controllers 502) such as a PCI Express bus.

[0067] It should be understood that the data processing system 500 may directly or over the network 508 be connected with one or more other data processing systems such as a server 510 (which may in combination correspond to a larger data processing system). For example, a larger data processing system may correspond to a plurality of smaller data processing systems implemented as part of a distributed system in which processors associated with several smaller data processing systems may be in communication by way of one or more network connections and may collectively perform tasks described as being performed by a single larger data processing system.

[0068] A data processing system in accordance with an embodiment of the present disclosure may include an operating system 520. Such an operating system may employ a command line interface (CLI) shell and/or a graphical user interface (GUI) shell. The GUI shell permits multiple display windows to be presented in the graphical user interface simultaneously, with each display window providing an interface to a different application or to a different instance of the same application. A cursor or pointer in the graphical user interface may be manipulated by a user through a pointing device such as a mouse or touch screen. The position of the cursor/pointer may be changed and/or an event, such as clicking a mouse button or touching a touch screen, may be generated to actuate a desired response. Examples of operating systems that may be used in a data processing system may include Microsoft Windows, Linux, UNIX, iOS, macOS, and Android operating systems.

[0069] As used herein, the processor memory 412, storage device 414, and memory 406 may all correspond to the previously described memory 406. Also, the previously described applications 410, operating system 520, and data 522 may be stored in one more of these memories or any other type of memory or data store. Thus, the processor 404 may be configured to manage, retrieve, generate, use, revise, and/or store applications 410, data 522 and/or other information described herein from/in the processor memory 412, storage device 414, and/or memory 406. [0070] In addition, it should be appreciated that data processing systems may include virtual machines in a virtual machine architecture or cloud environment that execute the executable instructions. For example, the processor and associated components may correspond to the combination of one or more virtual machine processors of a virtual machine operating in one or more physical processors of a physical data processing system 500. Examples of virtual machine architectures include VMware ESCi, Microsoft Hyper -V, Xen, and KVM. Further, the described executable instructions 408 may be bundled as a container that is executable in a containerization environment such as Docker executed by the processor 404.

[0071] Also, it should be noted that the processor 404 described herein may correspond to a remote processor located in a data processing system such as a server that is remote from the display and input devices described herein. In such an example, the described display device and input device may be included in a client data processing system (which may have its own processor) that communicates with the server (which includes the remote processor) through a wired or wireless network (which may include the Internet). In some embodiments, such a client data processing system, for example, may execute a remote desktop application or may correspond to a portal device that carries out a remote desktop protocol with the server in order to send inputs from an input device to the server and receive visual information from the server to display through a display device. Examples of such remote desktop protocols include Teradici's PCoIP, Microsoft's RDP, and the RFB protocol. In another example, such a client data processing system may execute a web browser or thin client application. Inputs from the user may be transmitted from the web browser or thin client application to be evaluated on the server, rendered by the server, and an image (or series of images) sent back to the client data processing system to be displayed by the web browser or thin client application. Also, in some examples, the remote processor described herein may correspond to a combination of a virtual processor of a virtual machine executing in a physical processor of the server.

[0072] Those of ordinary skill in the art will appreciate that the hardware and software depicted for the data processing system may vary for particular implementations. The depicted examples are provided for the purpose of explanation only and is not meant to imply architectural limitations with respect to the present disclosure. Also, those skilled in the art will recognize that, for simplicity and clarity, the full structure and operation of all data processing systems suitable for use with the present disclosure is not being depicted or described herein. Instead, only so much of a data processing system as is unique to the present disclosure or necessary for an understanding of the present disclosure is depicted and described. The remainder of the construction and operation of the data processing system 500 may conform to any of the various current implementations and practices known in the art.

[0073] Although an exemplary embodiment of the present disclosure has been described in detail, those skilled in the art will understand that various changes, substitutions, variations, and improvements disclosed herein may be made without departing from the spirit and scope of the disclosure in its broadest form.

[0074] None of the description in the present application should be read as implying that any particular element, step, act, or function is an essential element, which must be included in the claim scope. The scope of patented subject matter is defined only by the allowed claims. Moreover, none of these claims are intended to invoke a means plus function claim construction unless the exact words "means for" are followed by a participle.

Claims

CLAIMS What is claimed is:

1. A method of determining the cause of a main event, the method comprising: gathering system operational data from a sequence of events datastore, the operational data including a plurality of events, each event including a value and a time stamp; identifying the main event from the plurality of events, the main event including a main value and a main time stamp; copying a system control system’s program to create an offline control system; using the offline control system, detecting within the operational data, precursor events, each precursor event including a precursor value and a precursor time stamp that indicates that the precursor event occurred prior to the main event, each precursor event being capable of contributing to the occurrence of the main event; and determining which precursor event caused the main event.

2. The method of claim 1, wherein the operational data includes values that are one of Boolean and real, the method further comprising using expressions to generate Boolean variables for a portion of the values that are real.

3. The method of claim 1, wherein each event of the plurality of events represents a state change for the operational data being measured.

4. The method of claim 1, wherein the main event is indicative of an alarm condition.

5. The method of claim 1, wherein a state change of at least one precursor event causes a state change indicative of the main event.

6. The method of claim 1, further comprising detecting within the operational data, next level precursor events, each next level precursor event including a next level value and a next level time stamp that indicates that the next level precursor event occurred prior to an associated precursor event, each next level precursor event being capable of contributing to the occurrence of the associated precursor event.

7. The method of claim 6, further comprising repeating the next level precursor event detecting step until an Nth level precursor event is found, wherein each Nth level precursor event is one of a basic event having no precursor events and an event having an event time stamp outside of a predetermined time frame with respect to the main event time stamp.

8. A method of determining the cause of a main event, the method comprising: gathering operational data from a system, the operational data including a plurality of discreate Boolean data points; storing the operational data in a sequence of events datastore that is separate from a system controller; generating events in response to a state change of any of the discrete Boolean data points, each event including a value and a time stamp; identifying the main event from the generated events, the main event including a main value and a main time stamp; copying the system controller’s program to create an offline control system, the offline control system separate and independent from the system controller; using the offline control system to detect within the generated events, precursor events, each precursor event including a precursor value and a precursor time stamp that indicates that the precursor event occurred prior to the main event; and determining which precursor event or combination of precursor events caused the main event.

9. The method of claim 8, wherein the operational data further includes values that are real, the method further comprising using expressions to generate Boolean variables for a portion of the values that are real.

10. The method of claim 8, wherein each event represents a state change for the operational data being measured.

11. The method of claim 8, wherein the main event is indicative of an alarm condition.

12. The method of claim 8, wherein a state change of at least one of the precursor events causes a state change indicative of the main event.

13. The method of claim 8, further comprising detecting within the operational data, next level precursor events, each next level precursor event including a next level value and a next level time stamp that indicates that each next level precursor event occurred prior to an associated precursor event, each next level precursor event being capable of contributing to the associated precursor event.

14. The method of claim 13, further comprising repeating the next level precursor event detecting step until an Nth level precursor event is found, wherein each Nth level precursor event is one of a basic event having no precursor events and an event having an event time stamp outside of a predetermined time frame with respect to the main event time stamp.