Event correlation in telecommunications networks

• US 5,646,864 A
• Filed: 11/16/1995
• Issued: 07/08/1997
• Est. Priority Date: 02/23/1993
• Status: Expired due to Fees

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Whitney, Christopher
• Primary Examiner(s): Ramirez, Ellis B.
• Application Number:
  US08/507,255
• Time in Patent Office: 600 Days
• Field of Search: 364/514 B, 364/514 R, 395/182.01, 395/181, 395/185.01, 395/183.02, 395/183.21, 395/200.11, 340/825.1
• US Class Current: 714/47.2
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04Q 2213/13503 object-oriented systems
• CPC Class Codes: H04Q 2213/13521 fault management
• CPC Class Codes: H04Q 3/0075 Fault management techniques

Abstract

A telecommunication network is monitored for fault conditions. In order to correlate the alarms to established which alarms have a common cause, a logical connectivity model is used in which a logical property is transferred between related logical elements in response to the element being alarmed. If as a result of such transfer the value of the logical property exceeds a threshold value for any element a correlation is established and the element highlighted as the probable cause of the alarms.

Claims

1. A method of correlating events occurring in a telecommunications network formed from individual network elements, at least some of the network elements being represented in a computer by individual program modules, each program module having a set of data relating to the network elements which it represents and, in the case of at least some of said program modules, the data set of the module including

a) a list of network elements having incoming associations with the network element represented by the module in respect to event correlation,

b) a list of network elements having outgoing associations with the network element represented by the module with respect to event correlation, and

c) a parameter indicating the state of activation of the program module at a point at which events can be correlated,

said method comprising the steps of increasing the value of the activation parameter of a program module when an event occurs in the network element represented by the program module, varying the value of the activation parameter of the modules in accordance with the lists of associations between the network elements in a predetermined manner, and producing a positive correlation report in respect of an individual program module when the level of its activation parameter exceeds a predetermined threshold.

2. A method as claimed in claim 1, in which a change in the activation parameter of a program module causes a proportionally smaller change in the activation parameters of the program modules which represent higher order network elements.

3. A method as claimed in claim 1, in which a change the activation parameter of a module causes a proportionally smaller change in the activation parameters of the program modules which have not yet activated and which represent lower order network elements.

4. A method as claimed in claim 1, including the step of causing the activation parameter in the program modules to vary with time in a predetermined manner in addition to the variations in the activation parameters made in response to events in the network elements.

5. A method as claimed in claim 4, wherein the variation with time of the activation parameter of at least one module is a monotonic decay.

6. A method as claimed in claim 4, wherein the activation parameter of at least one module initially rises, and then decays monotonically.

7. A method as claimed in claim 5, where the decay in at Least one module is exponential.

8. A method as claimed in claim 5, wherein the decay in at least one module comprises one or more discrete steps.

9. A method as claimed in claim 1, in which at least some of the program modules represent physical circuits.

10. A method as claimed in claim 1 wherein the events occurring in the network are alarm signals indicating fault conditions detected at the corresponding network elements.

11. A method as claimed in claim 10, wherein a positive correlation report identifies the network element in which lies the fault that has caused the alarm signals.

12. A method as claimed in claim 10, wherein a positive correlation report identifies all network elements affected by the fault causing the alarm signals.