JPH10171521A - Event notification / suppression method and device - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To enable real-time judgment of occurrence notification and suppression of an event including a plurality of alarms and status changes that occur with the operation and monitoring of a plant. SOLUTION: An inhibition time is added to a master-slave relationship between a plurality of related events and an event correlation is defined in advance as an event correlation.
00 is read to determine whether the event that has occurred is a main event or a subordinate event (steps S1 to S3). If the main event is a main event or a subordinate event, and a related main event has not occurred within the inhibition time. In this case, the operator is notified and the occurrence time is recorded (step S
6).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an operation monitoring of a process state in an industrial field, wherein a plurality of master-slave relationships between a plurality of events (alarms, state changes) to be monitored are generated by utilizing an event correlation table. The present invention relates to an event notification / suppression method and device for efficiently notifying an event.

[0002]

2. Description of the Related Art Conventionally, by utilizing sufficient knowledge about a target process, a plurality of event information is analyzed, and an important event and an unnecessary event are visually distinguished from each other, in addition to the judgment of an operator. Like that.

[0003]

However, in the operation and monitoring of an industrial process, it is very difficult for an operator to visually distinguish important events and less important events from event information that occurs simultaneously. Work. Also, there is a problem that there is an individual difference in knowledge about the target process and it is difficult to perform the process uniformly. Therefore, an object of the present invention is to enable a plurality of event information to be selected in real time.

[0004]

In order to solve such a problem, according to the first aspect of the present invention, a master-slave relationship between events including a plurality of alarms and status changes generated during operation and monitoring of a plant. The event correlation is defined in advance by adding a suppression time, and when a certain event occurs, a process of determining whether to notify the operator of the event or to suppress the event by referring to the event correlation is performed. The feature is to output the result. According to the second aspect of the present invention, input means for inputting event information including a plurality of alarms and status changes generated during operation and monitoring of the plant, and an inhibition time is added to a master-slave relationship between the plurality of events. A predefined event correlation definition table, and processing means for referring to the event correlation definition table for each event that has occurred, and performing a process of notifying the operator of the occurred event or determining whether to suppress the event,
Output means for outputting the result.

According to the third aspect of the invention, with respect to the event notified to the operator by the output means and the suppressed event, the occurrence date and time and the event information indicating whether or not the event is notified are accumulated as the notification history data. Like that. According to the fourth aspect of the present invention, a learning function of automatically generating the event correlation definition table by searching the stored notification history data is provided. In the invention of claim 5, when at least two related events are designated by the operator from a list screen displaying event information that occurred in the past using the notification history data, the occurrence time is the earliest among them. The event correlation definition table is automatically created using the event as the reference event and the events after the occurrence time of the reference event as the suppression target events, and the created event correlation definition table can be edited interactively using the definition screen. Making it possible.

According to the invention of claim 6, the contents of the event notified to the operator of the notification history data and the suppressed event are specified in a designated period and in a group unit summarized in the event correlation definition table. The number of events that occurred and the number of suppressed events are output as a correlation analysis screen. In addition, in the invention of claim 7, when two or more identical sub-events are registered in the event correlation definition table for all the contents of the event correlation definition table, it is checked whether there is any inconsistency in the set suppression time. And output it as a contradiction check screen.

[0007]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A first embodiment of the present invention will be described with reference to the flowchart of FIG.
A description will be given based on a schematic diagram showing an example. First, in the present invention, an event correlation definition table in which a suppression time is added to a master-slave relationship between a plurality of events is created in advance as shown in FIG.
It is stored in the memory or the database 400. In FIG. 2, one event correlation definition table (a group of one main event and several sub-events, ie,
Although one group is shown, a plurality of such tables are prepared. Then, when a certain event including an alarm and a state change occurs (step S in FIG. 1).
1), reads the event correlation definition table from the memory or the database 400 (see table acquisition in S2), determines whether the event that occurred is the main event (see S3), and if the event is the main event, the operator (operator) ) (See S6).

That is, the main event column of the table as shown in FIG. 2 is searched. If the main event column is found, the event that occurred is searched for the main event; if not, the subordinate (subordinate) event column is searched and found there. If the event is a slave event, it is determined that the event is not related to the event. Step S3
If the judgment result is a sub-event, the related main event is searched for based on the table in which the sub-event is defined (see S4), and the main event occurs within the inhibition time and is notified to the operator. It is determined whether or not the notification has been completed (see S5). If the notification has been made, the notification is stopped (suppressed), written as an event history (see S7), and conversely, the relevant main event has occurred within the suppression time. If not, the subsidiary event is notified to the operator and the time at which the event occurred is recorded (see S6).

An embodiment of the second invention will be described with reference to the system configuration diagram of FIG. Reference numeral 100 denotes a processing device including a computer or the like, which executes the event notification / inhibition processing as described in FIG. Reference numeral 400 denotes an event correlation definition table in which a suppression time is added to a master-slave relationship between a plurality of events. 200 is an input device and 300 is an output device. Therefore, when the event information of each process is input from the input device 200, the event correlation definition table 4
It is determined whether or not the event is the main event by referring to the contents of 00, and if it is the main event, the fact is output via the output device 300 and the occurrence time is stored. On the other hand, if the event is a dependent event, a related main event is searched for based on the contents of the table 400. If the main event occurs within the inhibition time and has been output via the output device 300, the relevant event is searched for. Cancel (suppress) notifications. vice versa,
If the relevant main event has not occurred within the inhibition time, the sub-event is output via the output device 300.

An embodiment of the third invention will be described with reference to the system configuration diagram of FIG. This is for accumulating the notification history data, and among the event information input from the input device 200, the output device 300 as described in FIG.
The notification date and time and the event information are output to the memory or the database 500 as the notification history data for the event output via the, and the event suppressed (not output) because the main event has been notified has been notified. The event information indicating the occurrence date and time and whether or not the occurrence has been suppressed is output to the notification history data memory 500.

An embodiment of the fourth invention will be described based on a system configuration diagram of FIG. 5 and an operation conceptual diagram of FIG. This indicates a learning function, in which the notification history data obtained as shown in FIG. 4 is read from the memory 500, and the main event, the suppression time, and the main event are set by the operator from the input device 200 as the main event. When the reference value of the number of occurrences is specified, the processing device 100 searches the notification history data for an event that matches the condition, and executes a learning process of automatically generating the event correlation definition table 400. FIG. 6 conceptually illustrates the operation. Here, for example, the main event is “event 1”, the occurrence period, and the elapsed time (suppression time) from the main event are “2”.
Minutes, the reference value of the number of times “3”, etc., the number of events that occurred within the suppression time from the main event is
Once for Event 2 and Event 5 and 2 for Event 4
In the case of the event 3, the number of occurrences is three, and the event 3 exceeding the reference value of the number of occurrences is adopted as the sub-event, and the table 400 as shown in the drawing is created by this.

An embodiment of the fifth invention will be described with reference to the system configuration diagram of FIG. 7, an explanatory diagram of an event list screen of FIG. 8, and an explanatory diagram of an event correlation definition screen of FIG.
This is read from the notification history data 500 obtained as shown in FIG. 4 and displayed on the event list screen as shown in FIG. Next, when the operator designates an event related to the event list screen as shown in FIG. 8 (for example, by selecting a rectangle or a check box next to the column of occurrence date and time at the left end of the screen), the processing device 100 sets the occurrence time to The earliest event is set as the reference (main event), and the events that occur after that time and specified are set as subordinate events,
The deviation between the occurrence time of the main event (reference) and the occurrence time of the dependent event is output to the event correlation definition table 400 as the suppression time (reference value). Further, the processing device 100 reads the event correlation definition table 400 and outputs it as the event correlation definition screen 900 as shown in FIG. 9, so that the operator can edit this screen 900 in an interactive manner, and It can be output as the event correlation definition table 400. For example, if four items of “main steam pressure control deviation”, “heavy oil burner pre-pressure”, “No. 1 heavy oil pump” and “No. 2 heavy oil pump automatic” are indicated in FIG. Since the lower item is earlier, “No. 2 heavy oil pump automatic” is set as the main event, the other is set as the sub-event, and the time difference from the main event is set as the inhibition time, which is output as the event correlation definition table.

An embodiment of the sixth invention will be described with reference to a system configuration diagram of FIG. 10 and an example of a correlation analysis screen of FIG. This is to analyze correlation (relationship between notification / suppression status for each event, events occurring before the specified event, and events occurring after the specified event). 4, the notification history obtained as shown in FIG. 4 is read from the notification history data 500, and the event correlation definition table 400 is read. The operator uses the correlation analysis screen 700 as shown in FIG. By specifying the event to be performed (“heavy oil pump outlet pressure” in the example of FIG. 11), the processing device 100 determines the contents of the output event and the suppressed event for the specified period and the event correlation definition table ( In FIG. 11, the number of occurrences of the event for the group unit event defined in “No. 1 heavy oil pump”, A sealed number and outputs it to the correlation analysis screen 700. The name of the group of the event correlation definition table as a display unit (in FIG. 11,
If "No. 1 heavy oil pump" is not specified, the same analysis is performed for all events.

An embodiment of the seventh invention will be described based on the system configuration diagram of FIG. 12 and an example of a contradiction check screen of FIG. This is a contradiction check,
The processing apparatus 100 reads the event correlation definition table 400 and checks whether two or more main events of the same sub-event are registered in the same table or whether the set suppression times are different. 13 is output to an inconsistency check screen 800 as shown in FIG. In FIG. 13, the sub-event “alarm 1 occurrence” is defined in the event correlation definition tables “alarm correlation 01” and “alarm correlation 02” with the same main event, and the time (suppression time) is “5” on the other hand.
On the other hand, it is "4", indicating that there is a contradiction.

[0015]

According to the first and second aspects of the present invention, the occurrence of an event can be quickly selected by defining the master-slave relationship between a plurality of related events by adding inhibition time information. be able to. According to the invention of claim 3, the event information can be accumulated as the notification history data. According to the invention of claim 4, the event correlation definition table can be automatically generated by using the notification history data. Further, according to the invention of claim 5, the contents of the event correlation definition table can be edited by the operation of the operator, and according to the invention of claim 6, the notification history data and the contents of the event correlation definition table are analyzed and notified. This is convenient for selecting important events and analyzing a group of events having a close relationship (frequently occurring in pairs).
Furthermore, according to the invention of claim 7, various advantages such as inconsistency of the contents of the generated event correlation definition table can be obtained.

[Brief description of the drawings]

FIG. 1 is a flowchart for explaining an embodiment of the present invention.

FIG. 2 is a schematic diagram illustrating an example of an event correlation definition table.

FIG. 3 is a block diagram showing a system configuration example for implementing FIG. 1;

FIG. 4 is a system configuration diagram showing another embodiment of the present invention.

FIG. 5 is a system configuration diagram showing still another embodiment of the present invention.

FIG. 6 is a conceptual explanatory diagram of the operation in FIG. 5;

FIG. 7 is a system configuration diagram showing another embodiment of the present invention.

FIG. 8 is an explanatory diagram of an event list screen.

FIG. 9 is an explanatory diagram of an event correlation definition screen.

FIG. 10 is a system configuration diagram showing still another embodiment of the present invention.

FIG. 11 is an explanatory diagram of an example of a correlation analysis screen.

FIG. 12 is a system configuration diagram showing still another embodiment of the present invention.

FIG. 13 is an explanatory diagram of an example of a contradiction check screen.

[Explanation of symbols]

100 processing device, 200 input device, 300 output device, 400 event correlation table, 500 notification history data memory (database), 600 event list screen, 700 correlation analysis screen, 800 inconsistency check screen, 900 … Event correlation definition screen.

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Mitsuhiro Watanabe 1st Fuji-Facom Control Co., Ltd., Hino-shi, Tokyo Inside (72) Inventor Masato Sasaki 1st Fuji-cho, Fuji-cho Co., Ltd., Hino-shi, Tokyo

Claims (7)

[Claims] 1. An event correlation is defined in advance by adding an inhibition time to a master-slave relationship between events including a plurality of alarms and status changes that occur with the operation and monitoring of a plant. An event notifying / suppressing method, wherein the process refers to the event correlation to determine whether to notify or suppress the event to an operator and output the result. 2. An input means for inputting event information including a plurality of alarms and status changes generated during operation and monitoring of a plant, and a pre-definition by adding an inhibition time to a master-slave relationship between the plurality of events. Processing means for referring to the event correlation definition table to be performed, the event correlation definition table for each of the generated events, and notifying or suppressing the generated event to the operator, and an output for outputting the result And a means for notifying / suppressing events. 3. An event notified by the output unit to an operator and a suppressed event are stored as notification history data, including an occurrence date and time and event information indicating whether or not the event has been notified. Item 3. The event notification / inhibition device according to Item 2. 4. The event notification / suppression device according to claim 3, further comprising a learning function of automatically generating the event correlation definition table by searching the stored notification history data. 5. When at least two related events are specified by an operator on a list screen on which the notification history data is read and event information that occurred in the past is read, the event with the earliest occurrence time is selected. An event correlation definition table is automatically created using the event correlation definition table as a reference event (main event), and events after the occurrence time of the reference event as suppression target events (subordinate events). 4. The event notification / suppression device according to claim 3, wherein editing by an interactive format is enabled. 6. The number of occurrences of an event in the notification history data for the event notified to the operator and the content of the suppressed event in a specified period and in a group unit grouped in the event correlation definition table. The event notification / inhibition apparatus according to claim 3, wherein the number of inhibited cases is output as a correlation analysis screen. 7. When two or more identical sub-events are registered in the event correlation definition table for all the contents of the event correlation definition table, a check is made to see if there is any inconsistency in the setting suppression time, and a contradiction check screen is displayed. The event notification / inhibition device according to claim 2, wherein the event notification and the suppression are output.