Exploring challenges of alarm root-cause analysis across varying production process types

1 Introduction

The need for highly efficient production has led to an extensive use of automated production systems [1], which are managed by supervisory and control systems. As a constituent, alarm management systems (AMS) raise alarms whenever a process deviation or a fault is detected [2]. They inform the operator about sensor and actuator values exceeding or falling below a certain threshold or if some internal system conditions, like pre- and postconditions in a process chain, are violated [3]. In undesirable conditions, an initial disturbance or fault might propagate throughout the plant causing additional deviations in other components, worsening the existing abnormal situation and possibly leading to emergency shutdowns [3, 4]. To avoid such a shutdown, a quick reaction to abnormal behavior is crucial. This generally requires manual intervention by the plant operator [2], which becomes a bottleneck if alarm floods (AF) appear.

AF pose a major obstacle in AMS design [5, 6]. They occur when a large number of alarms are activated within a short period of time (e.g., more than 10 alarms in 10 min) [3, 5]. During AF, operators struggle to accurately determine the underlying reasons for the issue and respond to faults effectively [6], e.g. by identifying and addressing the root-cause, which is the underlying fault or trigger leading to an AF. Missing crucial alarms can yield costly downtimes and industrial accidents [3]. Often, a straightforward handling of successively occurring alarms, called an alarm sequence, may not be feasible, since the root-cause alarms are not necessarily first in the sequence [7, 8]. Thus, AMS employ advanced methods and tools to enhance the operator’s decision-making process and situational awareness [3, 5] by preprocessing raw alarm data and outputting easy-to-interpret information about the ongoing situation [6]. Alarm flood root-cause analysis (AF-RCA) methods determine the cause-and-effect relationships between disturbed process variables and help to identify the most likely root-cause [4, 5, 9].

Given the significance and benefits of AF-RCA, this paper examines existing approaches. Research to date focuses mostly on continuous processes within the process industry and has limited transferability to discrete ones found in manufacturing and intralogistics. However, also in discrete processes, a vast number of alarms caused by a single root-cause can be a challenge for the plant operator. For instance, a stuck workpiece or carrier can block subsequent parts causing a chain of building up alarms with changing order depending on the desired transport route [9].

To bridge this gap between industries, we aim to provide a first contribution to the development of comprehensive AF-RCA methods applicable to a wide range of process types and use cases. Four exemplary plants covering discrete, continuous, and hybrid processes are presented and compared to derive a set of requirements for AF-RCA development based on their commonalities and differences. Furthermore, relevant engineering knowledge and documents for the respective process types to validate potential dependencies between alarms in a sequence are suggested. Knowing the root-cause alarm and dependencies between alarms, unnecessary ones can be filtered to reduce the operator’s workload [5, 9, 10].

Related work in data-driven and knowledge-based AF-RCA for different process types is examined in Section 2, showing the limitations of purely data-driven methods. Section 3 presents and compares four illustrative plants with distinct characteristics. Therefore, suitable requirements for a comprehensive AF-RCA in those plants are derived in Section 4. In Section 5, the AF-RCA methods, which incorporate additional knowledge and overcome limits of purely data-driven ones, are assessed against the requirements from Section 4. In Section 6, engineering documents and expert knowledge useful for the advancement of AF-RCA are proposed. Section 7 concludes with a summary and an outlook on future research.

2 Related work in alarm flood root-cause analysis for varying production process types

Automated production systems are grouped into four categories based on their type of production process [11]. Continuous processes are characterized by a continuous product stream and consistent output [12]. In contrast, discrete ones [13] have production steps with defined start and endpoints, which are repeated for each individually traceable product [14]. Additionally, batch processes are continuous sub-processes that are completed before being reinitialized [14]. If a process is composed of more than one type, it is a hybrid process [15].

The following subsections analyze AF-RCA approaches, regarding their suitability for the previously mentioned process types. They are categorized by data-driven methods that solely rely on alarm data and methods incorporating further engineering knowledge, representing any knowledge about the process and its dependencies. This comprehensive examination aims to uncover shared characteristics and distinctions among the various approaches.

3 Plants for varying production process types

Highly variable production process types are presented below: continuous chemical production, discrete manufacturing with buffers, discrete intralogistics, and hybrid timber particle board production, which includes batch, continuous, and discrete processes. These examples were chosen to identify and illustrate different production processes’ characteristics and their effects on alarm sequences (Section 3.5 and Table 5). This forms the base for deriving interdisciplinary AF-RCA requirements in Section 4.

3.1 Tennessee-Eastman Process (TEP)

The Tennessee-Eastman Process (TEP) has been recognized as a benchmark for chemical plant simulation, in alarm management and for AF-RCA [4, 33, 44], [45], [46]. As a continuous process based on a real-world chemical plant, the TEP’s flat process hierarchy consists of a two-phase chemical reactor, a condenser, a vapor-liquid-separator, a stripper, and a steam reboiler. Pipes, two pumps, and one compressor transport material between above-mentioned components [47]. Necessitated by the TEP’s unstable nature, automatic control valves in 17 control loops are used for process stabilization [48]. A full overview of the process operations and phases is provided in [47, 49]. The considered revised TEP model [47], which enables extended monitoring of process variables, including flow, pressure, temperature, level, and chemical component concentration, is considered within this paper. Among these variables, the chemical component concentration has a deadtime and a delay. As a result, the current value of the concentration is available with a time lag from 10 to 15 min.

Regarding alarm sequences, a sudden variation in at least one variable can propagate throughout the TEP and cause AFs [46]. As an example, two sequences “A” and “B” (Table 1), were generated using some random variations of an identical root-cause, namely a step change in the inlet flow of material feed A, by manipulating “XMV3” and raising alarm “XMV3_H” (XMV: manipulated variable; H: high alarm). The sequences show the activated alarms and their respective timestamps of activation during the first 3 h of the propagating abnormal situation. For better understandability, the start of both sequences is shifted to time zero. The red-marked alarm variable “XMEAS1_L” (XMEAS: process variable, L: low alarm) directly corresponds to the underlying root-cause. As indicated in both sequences, this disturbance propagates and affects numerous other process variables. However, due to set alarm thresholds and random effects on corresponding process values, the alarm variable “XMEAS1_L” is only activated in alarm sequence “A”.

Table 1:

Two TEP alarm sequences “A/B” from [49]. Red-marked variables: correspond to underlying root-cause.

Relevant phenomena are demonstrated: The first alarm does not necessarily represent the underlying root-cause and the real causal alarm is not necessarily included in the sequence. This can lead to ambiguous alarm sequences for the same root-cause.

For example, in sequence “B”, alarm variable “XMEAS10_L” corresponds to a low flow in the TEP’s purge, which is located on the other side of the plant and is sensitive to changes in the reactor’s inlet.

Secondly, despite having the same root-cause, the sequences “A” and “B” have considerable differences in their alarm orders (indicated by black lines connecting pairs of identical alarm variables in Table 1). Thus, data-driven causality analysis methods that solely rely on the alarm order may yield erroneous causal relationships [4].

3.2 Modular manufacturing plant MPS500

The MPS500 is a highly modular, discrete manufacturing plant consisting of seven stations, which can perform independent manufacturing steps (Figure 1). All stations are connected via a conveyor system which transports parts on workpiece carriers. Two product types – thermostats and cylinders – each with multiple subvariants, are made from a cylindrical base part that is processed at the drilling station according to the desired product type. At the assembly station, an industrial robot mounts additional components to the base part. The order of necessary manufacturing steps is planned via a Manufacturing Execution System (MES), which tracks the products using RFID tags on the workpiece carrier.

Figure 1:

Layout of the modular manufacturing plant with seven stations.

Alarms during manufacturing are raised if product characteristics do not meet the expected ones, i.e., product type (thermostat or cylinder) at the assembly station, height, and material (metal or plastic) at the drilling station, and color of the base part at the inspection station. Unlike in the TEP, these alarms are based on discrete events, usually with multiple software conditions using input from binary sensors instead of checks against a limit of a continuous variable. Alarm sequences (Table 2) can occur, for example, if two base parts – one for a thermostat and one for a cylinder – are accidentally swapped. As both parts traverse their manufacturing sequences, alarms are successively raised at different stations. For each base part, the height does not match the expected value (Height Check). If the color differs from the expectation, a color mismatch is detected (Color Check). These two alarms inform the operator about the deviation without aborting the manufacturing process. At the assembly station, the base parts are checked for installation notches, which identify the base part type. If the type does not match, another alarm is activated (Ass. Check) and the production is aborted.

Table 2:

Two exemplary alarm sequences of the MPS500 with the same root-cause (marked red).

The resulting alarm sequences’ (“A” and “B” in Table 2) different characteristics pose challenges to their interpretation. Although both sequences have the same root-cause, they show variations in their order. The occurrence of some alarms, like the color mismatch, is influenced by statistical effects depending on the (random) color of the base parts. While the order of alarms for a single workpiece is almost completely determined by the fixed order of manufacturing steps, the alarm order can vary considerably across multiple products because the conveyor system allows round trips of a product if a station is busy. Alarm timings are influenced by the possibility to temporarily store the unfinished product in a storage rack. A shortest plausible time span between two alarms, corresponding to a direct, nonstop route from one station to the next, exists. However, deviations from this timespan occur due to wait times at busy stations and storage with no upper time limit.

3.3 Intralogistics small load carrier transport plant

The industrial small load carrier (SLC) transport plant (Figure 2) represents common intralogistics properties, including multiple available material flow paths and a high degree of modularity [13]. The plant can transport SLCs on modular roller conveyors by making use of 35 basic modules organized in two straight (row 100/200) and one curved row (row 300). Determined by a scanned QR code, the SLC is either transported straight down the row 200 or transposed onto the curved section (row 300). The basic modules are of two basic types (Figure 2): The transport modules (102–113, 202–204, 206–209, 211–213, 301–307) can transport SLCs in one spatial direction, the diverting modules (114, 201, 205, 210, 214, 101) can move SLCs in a second spatial direction using an ejection mechanism. Both module types are equipped with three light-barriers (LB_End, LB_Mid, LB_Front) to detect the SLC position and a motor to power movement in the first spatial direction. The diverting module has an additional motor and light-barrier (LB_Gap).

Figure 2:

Layout and basic modules with sensors and actuators of the intralogistics plant.

The transport process of the intralogistics plant is loosely coupled because interfaces between standardized modules are simple with limited signal flow (e.g., just material in/out or conveyor speed). Hardware and software composition follow the ISA-88 standard [50], as the plant is divided into units (rows), equipment modules (e.g., transport and diverting modules), and control modules (actuators and sensors). The basic module names indicate both the location and material flow direction, e.g., 103 and 105 are neighboring modules of 104 in row 100, whereby SLCs pass these modules in ascending or descending numerical order.

Alarm messages are raised by individual hardware modules, rows, or the entire intralogistics plant. Conceptually, an upward and downward propagation of alarms by the control software is observed as, e.g., a module shutdown is followed by a row shutdown and vice versa.

Alarm sequence “A” (Table 3) is caused by lubricant placed on the rolls at module 205 (e.g., after maintenance work). The reduced friction leads to the first alarm of “Motor Rolls 205 Torque Low”, which corresponds to the underlying root-cause. If the remaining friction is too low, the SLC does not move, resulting in subsequent alarms after software-defined wait times (LB_205_end not reached, LB_206_front not reached, Module 206 Handover Error, LB_205_mid permanently interrupted, and Modul 205: SLC jammed). Finally, the control software recognizes a non-recoverable failure in row 200, leading to a complete shutdown of the respective row (FG200: “Shutting down”), which triggers the automated removal of all remaining SLCs on this row. However, due to the stuck SLC at module 205, the automatic shutdown fails (“Shutting Down” error, SLC in Lightbarrier). The respective row is now in an error state waiting for operator response. In the case of sequence “B”, the ejection mechanism of module 205 is activated to transport the SLC to the curved section (module 301). The modular plant structure with variable routes, however, leads to similar alarm sequences raised by varying modules for the same root-cause. High modularity often results in similar sequences despite differing transport routes.

Table 3:

Two exemplary alarm sequences of the intralogistics plant. Red-marked variables: correspond to underlying root-cause.

3.4 Hybrid timber particle board production

The hybrid timber particle board production process [15] consists of a batch material preparation (drying and glue preparation), a continuous forming and press process with up to 80 press frames for pressure and temperature control, and a discrete board splitting and handling. For simplification, this paper focuses on the batch and the continuous process parts (Figure 3). A time-correct assignment of process data, warnings, and alarms to one specific fiber board segment using the durations of production steps is necessary. In Figure 4 exemplary process parameters and corresponding timestamps of one board are depicted. The material’s density, humidity, and mass depend on its retention time in the buffers. This retention time can be estimated for a known filling level, buffer volume and throughput. The throughput again is indicated by measurements of the outfeed velocity using colored material at the buffer infeed. Understanding these parameter relations, the retention time can be determined for different filling levels, buffer volumes and throughputs. The duration of the batch processes I and II need to be estimated by experts. At the conveyor belt (Figure 3), time-correct assignment depends on the thickness of the board which influences the conveyor speed, i.e., thinner boards are produced with higher velocity. An inline quality assessment continuously measures the thickness at five different positions across the board near the press outfeed. Moreover, a cut of the fiber board is examined using destructive material lab testing. These lab results are obtained with a time delay.

Figure 3:

Highly simplified schematics for hybrid timber particle board production (not to scale). Units based on ISO3511.

Figure 4:

Exemplary times and process parameters for hybrid timber particle board production to project lab quality (inspired by [15]).

For time-correct assignment of the material weight measured by the scales w _B1 and w _B2 (Figure 3) to one fiber board at the outfeed, knowledge about the distances and velocities of the conveyor belt is required. The weights at w _B1 and w _B2 in turn depend on storage processes in the buffers, material properties, and the weight measured at w _II. This results in the following dependencies:

(1) w B i = f f f B i ρ B i t buff,i , f M blend , w I I d w I I − B i v I I − B i

with i = 1, 2 and

(2) t buff,i = f V ̇ buff,i

denoting the estimated retention time of the material in the buffer based on the throughput. These dependencies must be considered for time-correct assignment between w _II and w _B1 or w _B2. Finally, the weight w _II is a function of dryer infeed parameters, the durations of batch process I and II, which depend on the Moisture (M _I,in) of the infeed:

(3) w I I = f t I I , d I , o u t − w I I v I , o u t − w I I , t I ( M I , i n ) , T I , i n , t I , i n , w I , i n .

The influences in (3) have to be taken into account for time-correct assignment in the batch processes an exemplary alarm sequence “A” of a faulty product segment traversing through the plant is shown in Table 4. A weight above the tolerated range is first recognized by the scale w _B2, raising an alarm (Weight w _B2 too high). Through time-correct assignment as described above, previously raised alarms are mapped to the faulty product segment, identifying a too-high moisture at the dryer inlet (Moisture M _I,in too high) as a possible root-cause.

Table 4:

Two exemplary alarm sequences of hybrid timber particle board production with the same root-cause (marked red).

After a varying duration of the batch process I in the dryer, the scale w _II indicates an exceeding weight (Weight w _II too high). Due to material transport to buffer 1 and 2 respectively, alarms indicating an elevated density in each buffer are raised (Density ρ _B1/2 too high). After a varying retention time in the buffers 1 and 2 (formula (2)), the scales w _B1 and w _B2 recognize a weight (Weight w _B1/2 too high) above the threshold as well. Alarm messages in and after the buffers highly depend on the filling level and furnish material properties in the buffer. The alarm sequences “A” and “B” (Table 4) show that the alarm order of buffers and scales w _B1 or w _B2 may differ within sequences having the same root-cause and are thus ambiguous.

Within the continuous press itself, process parameters at the press frames depend on pressure and distances of any preceding and succeeding frame [15], leading to a tightly coupled process with high interconnection of process parameters.

Within one frame, material properties are recorded by analog sensors transverse to the working direction. Due to locally varying material properties (e.g., higher, inhomogeneous moisture caused by a short-time malfunction of the dryer motor, interrupting the tumble dry process) faulty particle board segments might remain undetected. No alarm during production is raised, because the averaged material properties (e.g., weight) of the segment stay closely below the alarm raising threshold in the subsequent process. The fault is, however, detected in the lab cut. In this case large non-constant timespans between related alarms (e.g., lab cut and alarm of the dryer motor) make AF-RCA a challenging task.

4 Requirements for AF-RCA for varying production process types

Based on the previously identified influencing properties on alarm sequences (Table 5), this section derives relevant requirements for interdisciplinary AF-RCA methods. A summary of the requirements is shown in Table 6.

R _hierarchy : Alarms from closely related plant components are more likely to be causally related [10]. Thus, the multi-level hierarchical composition of the structure of a plant (see column ‘Modularity & Hierarchy’ in Table 5) can provide valuable information for alarm propagation and should be considered in AF-RCA. All sensors of the TEP and the particle board production are individual units that together comprise the full plant [50] and consequently form a flat hierarchy. The hierarchy of the MPS500 and the intralogistics plant is further divided, as both comprise process cells incorporating fully separable modules that again entail sensors.

R _modularity : The level of modularity should also be considered. The degree of modularity defines how encapsulated software and hardware are and thus reconfigurability of the plant layout [1]. Both the MPS500 and the intralogistics plant consist of different modules, while the modules differ in their degree of linkage. For example, knowing the number, type, and sequence of basic modules in the intralogistics plant can assist the justification of found alarm sequences. The TEP and the hybrid particle board production follow a more monolithic design. Modular design, e.g. by using module type packages (MTPs) [51], is growing in importance in the process industry and should be considered in the design of AMS.

R _{material-flow} : Alarms can propagate through the production process, e.g., by a SCL blocking the conveyor in the intralogistics plant. The consideration of material flow can thus support finding causally coherent alarm propagation paths [10]. Applications in intralogistics pose the challenge of bidirectional material flow due to two conveying directions. For the MPS500, the material flow is unidirectional. In discrete applications like manufacturing and intralogistics, alarm sequences are often closely tied to a specific product and its flow through the production process. In the TEP and the hybrid particle board production, most alarms are based on physical material properties exceeding safe operation limits. As the material moves through the pipes to subsequent sensors an alarm propagation is likely. The material flow is therefore relevant in all production processes (see column ‘Material Flow/Coupling’ in Table 5).

R _info-flow : Overcompensation of control loops can cause propagation of alarm sequences leading to a chain reaction in which one controller tries to compensate the overcompensation of the other. The information flow can therefore provide valuable information about the propagation and causal relations of alarms due to the underlying software structure [1]. Both the TEP and the hybrid particle board production feature multiple control loops and corresponding information can enrich AF-RCA methods. The underlying software structure directly influences alarm propagation since an alarm in one module can propagate to a software triggered shutdown of the whole row (Table 3).

R _energy-flow : Especially in process industry, AF-RCA relevant properties are influenced by energy flows caused by spatial proximity or environmental interactions (see column ‘Energy-flow’ in Table 5) [10]. A change in environmental conditions may lead to varying heat transfer between components and their environment. For instance, parts of a plant that are close to an open window or gate are significantly impacted by outside temperature conditions. As heat transfer between components with spatial proximity is more likely than between components that are far apart, the physical component location provides valuable information about energy flows and consequent alarm propagation. In the TEP an exothermic reaction exchanges energy with two cooling water supplies and a steam heater, which makes energy flow without the existence of material flow possible. Regarding hybrid particle board production, a change in environmental temperature may result in a too fast or too slow cooling process of the hybrid particle board production in turn yields to diminished stability causing alarms. Since the different modules of the MPS500 and the intralogistics plant operate independently, energy flow between these modules is limited to common power supply.

R _physical : Alarms can also be related by physical laws [33], i.e., pressure and temperature inside a tank in the TEP (Section 3.1), and the continuous part of the hybrid particle board production (Section 3.4). Furthermore, within the intralogistics plant and the MPS500, physical laws are employed to elucidate the causal relationships of alarms. For example, the input current of the drive and the velocity of the conveyor are directly coupled by a physical equation (see column ‘Physical relations’ in Table 5). Known physical relations should be considered in the AF-RCA directly, as they can reduce the degrees of freedom in alarm analysis and directly coupled alarms.

R _alarm-limit /R _RTN /R _chatter : Alarms in the process industry are usually raised based on the upper or lower limits of process variables. Further alarm types (e.g. high-high alarms) are applied to more extreme values, usually corresponding to a more severe alarm [52]. Recorded RTNs can assist in identifying the process state as well as related alarm messages [5]. Alarm logs thus provide valuable insight into the historic production process. However, for threshold-based alarms, fluctuating variables can cause chattering, hindering the analysis of alarm sequences due to changes in count and order of raised alarms. AF-RCA thus need chattering countermeasures. When analyzing the TEP and the hybrid particle board production, all three requirements should be considered (see columns ‘L/H Alarms’/‘RTN & Chattering’ in Table 5). Abnormal events of the MPS500 and the intralogistics plant are discrete and detected by a logic which is set in the software and triggered by multiple binary sensors. Chattering describes the fluctuation around the threshold and a continuous instability. Discrete processes like the MPS500 and the intralogistics plant are thus not susceptible to continuous alarm chattering. RTN timestamps are not known for the MPS500 and the intralogistics plant.

R _time-simple /R _time-complex : The MPS500, the intralogistics plant, and the hybrid particle board production, comprise conveyer belts with a set speed, defining the velocity of alarm propagation along with a conveyed product. Thus, the simple and analytically resolvable relationship R t i m e   −   s i mp l e between conveyor speed and the length of the conveyor belt should be considered to exclude alarm sequences with impossible time-deltas [53]. In continuous processes, however, these interrelations are more complex. Since the time of an alarm activation does not necessarily correspond to the point in time of the disturbance, not analytically describable time relations R t i m e − c o mp l e x can occur. For example, material flow is interrupted by batch and buffer processes or wait times, which also cause an interruption to the material-bound alarm propagation. Effects like these are observed in the TEP, the MPS500 and the hybrid particle board production (see columns ‘Timing Influences’ and ‘Buffer’ in Table 5). Additionally, changing process speeds and varying data sampling rates increase the difficulty of time-correct assignment of alarms to process data in the TEP and the hybrid particle board production. While some variables in the TEP are checked once per second, other values are only sampled every 15 min, with an equal measurement delay, and therefore lag significantly behind the current value of the process variable. This phenomenon can also be observed in the hybrid particle board production, considering the assessment of a lab cut. In general, delays due to lab procedures and slow sampling rates are a type of retention time and should be incorporated into time-correct assignment, including the calculation and estimation of complex timing relationships R t i m e − c o mp l e x , which is crucial for AF-RCA methods in continuous and hybrid plants (Section 3.4).

R _{ambiguous-order} : Even equivalent alarm sequences with a common root-cause may exhibit an ambiguous order (see Section 3), which AF-RCA methods must consider during analysis [22]. The mechanisms that cause such order switching differ between the process types. In the process industry, alarm thresholds together with stochastic variations in sensor measurements influence the activation order of alarms [29, 54]. As a result, the root-case alarm may be raised after the subsequent influenced alarm. In a manufacturing plant comprising multiple disjunct subprocesses (like MPS500), product specifications are fulfilled sequentially by the subprocesses. Thus, the specification dictates the order of possible alarms. However, order switching may still occur, if independent or redundant subprocesses are reordered to improve the overall process efficiency. Alarm orders of the hybrid particle board production are ambiguous, especially in the material preparation section, caused by changing material retention times in the buffers.

R _{dynamic-causality} : Propagating abnormal situations can change over time and thus, cause-and-effect relationships do as well [4]. Disturbing influences or state changes may increase, decrease, or even invert the causal impact of certain variables on other process variables. Thus, the dynamically emerging causal behavior must be tracked. Especially for tightly coupled processes changing causality should be considered in AF-RCA.

R _{variable-processes} : While some systems are designed for one specific production task, others allow the production products with varying characteristics. The induced changes in the production process can have an influence on the alarm sequences and timings. While the TEP was designed to perform a single production process, the MPS500, the intralogistics plant and the hybrid particle board production show different behavior based on manufacturing or transport instructions. The effects on the timing and order of the alarm sequences ought to be assessed in AF-RCA.

To fulfill the above-mentioned requirements additional information about the plant is needed. It can originate from the operators running the plant or from engineers who designed it. Operator knowledge is usually compiled in time-consuming expert interviews and is often limited, as even an expert will likely not be aware of every causal relation in a complex production plant [55]. Engineering knowledge, in contrast, is usually already available in the form of engineering documents, with the possibility of their automatic analysis saving time and cost.

5 Assessment of requirements satisfaction by selected AF-RCA methods

In this section, the presented methods for AF-RCA incorporating engineering knowledge (Section 2.2) are evaluated for compliance with the previously defined requirements defined in Section 4. This selection was made to pay tribute to the previously identified need for further knowledge.

R _modularity /R _hierarchy : Information about the plant structure and hierarchy are considered using engineering knowledge of the production process and of the plant’s composition in [41]. That information was used to divide process variables into sub-groups which were evaluated separately.

R _{material-flow} /R _info-flow /R _energy-flow : To incorporate material and information flows, connectivity information is provided in P & IDs or Control Logic Diagrams (CLDs) [33], supporting the assessment of causal relations [29] or grouping alarms with the same root-cause [10]. Manca and Fay [4] assigned knowledge about the material flow to process variables and in [30, 38] this knowledge is included in MFM and a first principle model, respectively. Energy flows were considered as connection type in [30, 33].

R _physical : Physics-based relations between different process variables are established using first order physical principles [33, 38] and included in an MFM [30]. Furthermore, Schleburg et al. [10] define characteristics and limitations of alarm propagations in a plant based on physical effects.

R _alarm-limit : In the presented methods, the incorporation of alarm limits was achieved by considering different alarm types directly [33], by normalizing high and low alarms using known thresholds [4], or by creating directed causal trees including the alarm state [30].

R _RTN /R _chatter : The approaches in [4, 30, 37] contemplate the active time of alarms, by keeping track of the alarm types and/or the active alarm periods. Disruption in AF-RCA by chattering alarms are avoided by removing them out of the alarm log as a preprocessing step [29, 33], by using other data-sources instead of the alarm log [4], or by comparing causal relations on currently active alarms [30].

R _time-simple /R _time-complex : Time relations were considered by setting expected delays between alarms depending on the process type in [33, 41]. Schleburg et al. [10] considered a maximum possible time between alarms during grouping. Besides, inconsistent timing behavior is described by an uncertainty score when matching alarm patterns [37]. Based on Taken’s delay embedding theorem, which provides a way to reconstruct the underlying dynamics of a system, the AF-RCA method by Manca and Fay [4] dynamically adjusts for varying time delays in order to account for complex time dependencies between pairs of process variables.

R _{ambiguous-order} /R _{dynamic-causality} : Some of the presented methods are robust to changes in the alarm order [4, 30]. The approach in [4] determines whether the prediction of an alarm improves with the knowledge about past alarms and thus does not rely on the specific alarm order. Kirchhübel et al. [30] use MFM of different operating situations in the plant to investigate alternative behaviors.

Kottre et al. [37] compare sequences with the same root-cause applying a decision function which allows order switching of alarms. Rodrigo et al. [29] allow small differences in the alarm order. However, only the methods in [4, 30, 37] keep track of dynamical changes in causality, using sliding windows for change tracking, dynamic generation of propagation paths, and adaptive decision functions, respectively.

R _{variable-processes} : Varying production processes were considered by multiple predefined states in an MFM [30], and by use of preselected pattern descriptions matching the current process [37].

Altogether, no method fulfills all formulated requirements (see lower part of Table 6). Most methods were designed towards a certain process type without consideration of transferability.

6 Engineering knowledge for AF-RCA methods in varying production process types

To meet the requirements (Section 4), AF-RCA methods need to be enriched with additional process information. Therefore, this section provides useful engineering knowledge and corresponding domain-specific documents (Table 7) – without claim to completeness.

Information about the modularity (R _modularity ) of the intralogistics plant and the MPS500, which includes the number and types of basic building modules as well as their arrangement next to each other, is obtained from a layout plan. The hierarchy description (R _hierarchy ) should describe the different hardware modules and submodules. The hardware hierarchy is extracted from a CAD model. Such information for continuous processes like the TEP, as well as the association of sensors to units of machinery, is structured in the P & IDs.

Predecessor-successor relations of components result directly from the material flow directions (R _{material-flow} ). From equipment labeling according to classification schemes with defined object classes, as standardized in ISO/IEC 81346-2 [56], material flow relations of a system’s components are derived (e.g., module 102 is a neighboring module of module 103 in the intralogistics plant). Limits of labeling conventions (like information about the cross-row connections at the diverting modules in the intralogistics plant) are overcome by examining a layout plan. Furthermore, P & IDs are used for hybrid and continuous processes to find material flow connections and differentiate between different piping systems, e.g., material and cooling water systems in the TEP [57], as well as branching paths of material flow in the buffers (Figure 3).

To fulfill the requirement R _info-flow an analysis of call sequences and implemented control loops in PLC source code can display information about the information flow [1]. Furthermore, P & IDs often show the information flow as a dashed line [10].

Closely located components or components interacting with the environment are influenced by energy flows (R _energy-flow ). The exact location, including distances, are extracted from a CAD file, where for example close components might exchange thermal energy. Layout plans may provide a rough location and allow to distinguish between components near and far apart while thermal contact equipment like condensors in P & IDs indicate possible energy transfer between connected pipes. To distinguish material transporting connections from purely thermal connections, e.g., cooling water pipes connected to the reactor, CAD files are evaluated.

Physical relations (R _physical ) can either be described as an analytical formula, obtained by expert knowledge in form of known heuristics, or can be learned using process data. In P & IDs, the type of sensor gives information about the type of physical relation. The type can be retrieved from standardized naming conventions [58, 59], e.g., TIR100 being a temperature sensor.

Information on whether alarm limits ( R alarm−limit ) exist and if alarm deactivations (R _RTN ) are tracked can either be obtained directly from the alarm log, or from the AMS documentation. Furthermore, the number of implemented alarm limits and their thresholds can be obtained from PLC software. Moreover, instrument abbreviations in P & IDs may provide knowledge about the type of alarms implemented for a sensor, e.g., high, or high-high.

The detection of chattering alarms (R _chatter ) can be supported by identifying sensor types from alarm data, sensor metadata or process data, to decide if a sensor is prone to cause chattering alarms. For instance, a continuous temperature sensor is more likely to generate chattering than a discrete light barrier on a conveyor.

Simple, analytically resolvable timing relations (R _time-simple ) are calculated using formulae considering e.g., speed, distances, and software-defined timeouts. Distances are given in an accurate CAD model. The material transport speed by PLC variables, process data or the drive device’s documentation.

For complex timing behavior (R _time-complex ), a direct analytic relationship usually cannot be formulated. Timing deviations between the alarm sequences can be high (see Section 3.4). Thus, a combination of documents, like the production recipe, process data, engineering information, expert knowledge, and process data support an accurate estimation of time constraints.

The causes of changing alarm orders (R _{ambiguous-order} ) depend on the process type. For continuous process variables, such changes in order can be understood from process data combined with alarm thresholds. In discrete industries such as manufacturing or intralogistics, this variability can arise due to diverse production recipes or routings. These variations can be identified by leveraging process data or material flow models, like MFM, which provide insights into the currently produced product.

To deal with varying production processes (R _{variable-processes} ) detailed information about the current process is necessary. For manufacturing plants, the bill of processes, which details the production steps and involved machinery, can often be extracted from the MES. For the intralogistics plant and hybrid particle board production, different routing options can be extracted from the PLC software/variables or layout plans.

Dynamic tracking of causal relations (R _{dynamic-causality} ) is not bound to a single document, but rather requires constant reevaluation of existing causal relations. However, access to timing information, e.g., process data, and information about an alarm’s RTN are important for this task. Expert knowledge can help to decide if dynamic relations exists and if so, identify boundary conditions between different dynamics.

Overall, available documents vary in type and information content for different plants and process types. Since those documents contain the necessary knowledge to fulfill each requirement, they can be used to enrich existing AF-RCA methods. To avoid excessive manual work, engineering knowledge should be automatically parsed from the documents, if possible. Intermediary formats may be needed (e.g., export standardized data formats instead of proprietary project files) and manual analysis can serve to verify the automatic procedure.

7 Conclusion and future work

This paper presents challenges of AF-RCA to support the continued improvement of AMS systems, highlighting that most current methods are limited to a single process type. AF-RCA methods for continuous processes have been extensively studied. In contrast, other process types are mostly neglected in AF-RCA research such that their requirements are not yet well-understood. Four comprehensive case studies are conducted to reveal needs for future research: A continuous chemical, a discrete manufacturing, a discrete intralogistics, and a hybrid process. Based on the analysis of distinctive characteristics in the alarm dynamics of these plants, requirements for AF-RCA methods are derived. These requirements can serve as a guideline for the development of novel AF-RCA approaches for varying production process types in future contributions. Notably, AF-RCA methods for hybrid processes must address the requirements of its combined process types. Thus, the development of hybrid AF-RCA methods is an important challenge as such methods are likely to be applicable in both discrete and continuous production processes.

Furthermore, the usage of formalized engineering knowledge in novel AF-RCA methods is suggested to increase their performance and accuracy. However, the integration of such knowledge is still an ongoing challenge, as knowledge extraction, formalization, and usage pose obstacles to overcome. Promising advancements in the domain of engineering knowledge formalization were made in [60, 61]. This paper suggests a selection of relevant knowledge and corresponding documents. Furthermore, engineering information already available in machine readable formats, such as AutomationML, MTPs, or via an Asset Administration Shell in the context of Digital Twins, can also be integrated into the knowledge formalization process by skipping the information extraction step [60]. Thereby, due to the heterogeneity of the considered plants, engineering documents heavily differ in informational content and availability. Since real-world plants can additionally impose the challenge of missing, outdated, and inconsistent information, the combination of different documents is a promising approach. Consequently, methods for AF-RCA should be designed flexibly enough to deal with varying input data and be robust to missing information.

For future contributions towards interdisciplinary AF-RCA using formalized engineering knowledge, novel methods meeting the presented requirements should be developed. Subsequently, the effectiveness of those methods should be assessed in comparison to traditional, highly customized solutions revealing remaining shortcomings. Operator trust in the findings of AF-RCA methods may be increased by presenting excerpts of the engineering knowledge that underly the analysis [62].