Methods and systems for alarm correlation and fault localization in communication networks

• US 5,309,448 A
• Filed: 01/03/1992
• Issued: 05/03/1994
• Est. Priority Date: 01/03/1992
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Calo, Seraphin B., Bouloutas, Anastasios T., Finkel, Allan J.
• Primary Examiner(s): ATKINSON, CHARLES
• Application Number:
  US07/817,011
• Time in Patent Office: 851 Days
• Field of Search: 371/29.1, 371/20.1, 370/13, 340/825.16
• US Class Current: 714/25
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0677 Localisation of faults

Abstract

An approach for modeling and solving the problem of fault localization and alarm correlation in large communication networks is presented. Specifically, a new alarm structure is presented along with a general model for representing a communications network. Several specific processing algorithms are provided for solving alarm correlation and fault localization problems in the presence of one or more faults. These algorithms differ in the degree of accuracy achieved in locating a fault, and in the degree of complexity required for implementation.

Claims

1. In a communications network having a plurality of devices connected therein, at least some of said devices responding to a perceived fault in said system by presenting an alarm, a method for identifying a fault in said communications network, said identifying method comprising the steps of:

(a) identifying at least one activated alarm in said network, each said alarm being emitted by a corresponding one of said alarm emitting devices o connected within said communications network, and each said alarm indicating knowledge of the corresponding device state or the corresponding device interface state;

(b) assigning to each identified alarm at least one primitive from a plurality of predefined primitives, each said assigned primitive indicating a relative fault location within the network with respect to the corresponding device;

(c) mapping each said alarm with said at least one assigned primitive to a representative portion of said network, said portion corresponding to the relative fault location indicated by said at least one assigned primitive, wherein a set of possible faulted device locations is defined for each alarm; and

(d) using the defined fault location set to determine a possible location of an actual fault in said network.

2. The fault identifying method of claim 1, wherein multiple activated alarms are identified in said network, and wherein said determining step (d) includes using the corresponding possible fault location sets to correlate at least some of said multiple activated alarms, said at least some correlated alarms comprising an incident, said incident being used in said step (d) to determine the location of said actual fault in said network.

3. The fault identifying method of claim 2, wherein said determining step (d) includes correlating multiple activated alarms into multiple incidents, said multiple incidents being used to determine the possible locations of multiple faults in said network.

4. The fault identifying method of claim 3, wherein said step (d) further includes constructing a minimum number of incidents such that all correlated alarms within an incident share a common intersection and such that all identified alarms are assigned to one of said incidents.

5. The fault identifying method of claim 1, wherein multiple faults in said communications network are possible and wherein said step (d) of said method identifies a most likely location for each of said faults in said network.

6. The fault identifying method of claim 5, further including the step of pre-associating each device connected in said communications network with a first information cost, each associated first information cost being dependent upon the likelihood of failure of said device.

7. The fault identifying method of claim 6, wherein multiple activated alarms are identified in said network, and wherein said determining step (d) includes correlating related alarms to define multiple sets of incidents, said step (d) further comprising associating with each defined incident a single possible device fault, the first information cost associated with the single possible device fault, and any alarm which contains the possible faulted device within its corresponding set of possible fault locations defined in said mapping step (c).

8. The fault identifying method of claim 7, wherein said determining step (d) includes identifying the most likely location of an actual fault in said network by defining the sets of incidents such that for each incident set the sum of the first information costs of the possible device faults within each incident is minimized and such that all alarms are associated with one of said incidents in said incident sets.

9. The fault identifying method of claim 8, wherein said determining step (d) includes identifying the fault contained within each alarm'"'"'s fault localization field most probably occurring using said associated first information costs.

10. The fault identifying method of claim 6, further comprising pre-associating with each possible device fault in the communications network the alarms which should be presented upon faulting thereof.

11. The fault identifying method of claim 10, further comprising pre-associating with each alarm a second information cost dependent upon the probability that the particular alarm is accidentally lost and a third information cost dependent upon the probability that the alarm is accidentally emitted.

12. The fault identifying method of claim 11, wherein said determining step (d) further includes using each of said first information cost, second information cost, third information cost, and pre-associated alarms which should be presented to identify the possible actual faults which best explain the identified alarms.

13. The fault identifying method of claim 1, wherein said plurality of predefined primitives includes an upstream primitive, a downstream primitive, and an interface primitive, said upstream primitive indicating that an actual fault is located in a communications layer above the communications layer of the device emitting the alarm, said downstream primitive indicating that an actual fault is located in a communications layer below the communications layer of the device emitting the alarm, and said interface primitive indicating whether the fault is in the interface to the device emitting the alarm.

14. The fault identifying method of claim 1, further comprising the step of displaying the possible location of an actual fault in said network.

15. A system for identifying a fault in a communications network having a plurality of devices connected therein, at least some of said devices responding to a perceived fault in said system by presenting an alarm, said system comprising:

means for identifying multiple activated alarms in said network, each said alarm being emitted by a corresponding one of said alarm emitting devices connected within said communications network, and each alarm indicating knowledge of the corresponding device state or the corresponding device interface state;

means for assigning to each identified alarm at least one primitive from a plurality of predefined primitives, each assigned primitive indicating a relative fault location within the network with respect to the corresponding device;

means for mapping each alarm with its assigned primitive to a representative portion of said network, said representative portion corresponding to the relative fault location indicated by said at least one assigned primitive, wherein a set of possible fault locations is defined for each alarm; and

means for determining a possible location of an actual fault in said network using said defined fault location sets produced by said mapping means.

16. The identifying system of claim 15, wherein said system is capable of identifying multiple faults within said communications network, and wherein said determining means includes means for determining possible locations for each fault in said network using said predefined fault location sets produced by said mapping means.

17. The identifying system of claim 15, wherein said determining means includes means for correlating multiple activated alarms into multiple incidents, said multiple incidents being used to determine the possible locations of said actual fault in said network, said determining means further including means for constructing a minimum number of incidents such that all correlated alarms within an incident share a common intersection and such that all identified alarms are assigned to one of said incidents.

18. The identifying system of claim 17, wherein said determining means includes means for determining a possible location of an actual fault in said network through consideration of the proportional likelihood of failure of each of said devices within said network.

19. The identifying system of claim 15, further comprising display means for presenting to an operator said possible location of an actual fault in said network.

20. A system for identifying a fault in a communications network having a plurality of devices connected therein, at least some of said devices responding to a perceived fault in said system by presenting an alarm, said fault identifying system comprising:

an alarm recognizer for recognizing each device presented alarm and translating said alarm into a normalized form, said normalized alarm form including a relative indication of the fault location within the network with respect to the corresponding device; and

an alarm manager coupled to said alarm recognizer for receiving said normalized alarms, said alarm manager having access to the topology of said communications network for producing a set of possible fault locations for each normalized alarm, said alarm manager further including means for determining a possible location of an actual fault in said network using said defined fault location sets.

21. The fault identifying system of claim 20, wherein multiple activated alarms are identified in said network, and wherein said alarm manager uses the corresponding possible fault location sets to correlate at least some of said multiple activated alarms, each grouping of said correlated alarms comprising an incident, said alarm manager using said incidents to determine the location of said actual fault in said network.

22. The fault identifying method of claim 21, wherein said alarm manager includes means for constructing a minimum number of incidents such that all correlated alarms within an incident share a common intersection and such that all identified alarms are assigned to one of said incidents.