Method of monitoring disturbances apt to occur at random or in bursts

• US 6,421,632 B1
• Filed: 04/20/1999
• Issued: 07/16/2002
• Est. Priority Date: 10/22/1996
• Status: Expired due to Term

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: LeCorney, David C.
• Primary Examiner(s): Hoff, Marc S.
• Assistant Examiner(s): Charioui, Mohamed
• Application Number:
  US09/294,437
• Time in Patent Office: 1,183 Days
• Field of Search: 702/185, 702/75, 702/76, 702/193, 702/189, 702/190, 714/704, 370/234, 340/500, 340/506, 340/800, 700/90, 700/91
• US Class Current: 702/185
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/88 Monitoring involving counting
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 43/0847 Transmission error
• CPC Class Codes: H04M 3/08 Indicating faults in circuits or apparatus
• CPC Class Codes: H04M 3/10 Providing fault- or trouble-signals
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks

Abstract

A method using an algorithm-controlled monitoring of disturbances apt to occur at random or in bursts. Counting values are used for counting the disturbances. An abnormal event regarded to be a disturbance is first definded. Then, a base against which disturbances are to be counted is defined, followed by defining a unit to be used as a measure of a disturbance frequency. Values of the disturbance frequency are determined in a variety of circumstances, the values including a critical value fC of the disturbance frequency where the monitoring nominally issues an alarm. At the critical value there is determined a peakedness factor F that is a measure of how bursty the disturbances are. An inertia value J is chosen that is a measure of how fast or slowly the algorithm is desired to react to changes in the disturbance frequency, so as to achieve an acceptable compromise between speed and reliability of the monitoring.

Claims

1. A method for performing, in a computer-controlled process, an algorithm-controlled monitoring of disturbances which may occur at random or in bursts in the process, said monitoring using counting values obtained from a counter for counting said disturbances, said method comprising:

i) defining an abnormal event regarded to be a disturbance,

ii) defining a base against which disturbances are to be counted, comprising determining whether the base should be a unit of time, a base event, or an artificial base, the outcome being a random variable able to take a value indicating normal event or disturbance,

iii) defining a unit to be used as a measure of a disturbance frequency,

iv) determining values of the disturbance frequency in circumstances that can be expected in operation of a process generating the disturbance to be monitored, said values including a critical value fC of the disturbance frequency where the monitoring nominally issues an alarm,

v) determining for the process, at said critical value, a peakedness factor F, being a measure of how bursty the disturbances are, as the ratio of the variance to the mean of occurrences of disturbances in the process,

vi) choosing for the algorithm an inertia value J being a measure of how fast or slowly the algorithm is desired to react to changes in the disturbance frequency, so as to achieve an acceptable compromise between speed and reliability of the monitoring,

vii) calculating parameters for the monitoring based upon the disturbance frequency value fC, the peakedness factor F and the inertia value J, and using said parameters to calculate according to 1/fC*J*F a threshold value T of the counter considered to be unacceptable,

iix) designing the algorithm for the monitoring with said parameters,

ix) initiating the monitoring and waiting for results thereof,

x) evaluating the results and, if necessary, adjusting the parameters.

2. A method according to claim 1, comprising using as a condition that the disturbance frequency measured against all base events is not different by more than a predetermined amount from the frequency measured just against normal events.

3. A method according to claim 2, wherein the evaluating step includes a step of determining the probability of obtaining a false result in the monitoring, based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b< 0 implying a false positive result obtained when alarm is given, and b>

0 implying a false negative result obtained when no alarm is given,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process.

4. A method according to claim 2, using the Leaky Bucky algorithm, wherein the value for the inertia is used as a multiplier on the size of the leaky bucket.

5. A method according to claim 2, wherein the step of evaluating the results comprises

a first substep of investigating whether measurements can be regarded as reliable, and, if yes, ending by taking no further action,

a second substep that, if the first substep reveals that measurements are not reliable, comprises investigating three possible sources of error, namely whether 1) there are more than a predetermined number of false alarms, 2) faulty equipment stays in service, or 3) the time to get results is more than a predetermined period of time, and

on a third substep level,

performing either of the following three steps,

(i) if there are more than a predetermined number of false alarms, increasing the value of fC, or increasing the value of J or F, by recalculating d and T and returning to first substep,

(ii) if faulty equipment stays in service without raising an alarm, reducing fC, or reducing J or F, recalculating d and T and returning to the first substep,

(iii) if the time to get results is more than a predetermined period of time, reducing the value of J or F, recalculating d and T and returning to the first substep.

6. A method according to claim 2, including the step of producing a risk table including a number of columns, of which four columns contain, in turn, level of disturbance frequency, bias, being expected change of a counter value after a base event, value of the disturbance frequency, and risk of false result, respectively, by selecting a suitable set of values of the bias, calculating values of the disturbance frequency by adjusting the critical frequency with the respective values of the bias, and setting values for risks based upon measurements, economic analysis, experience, judgement or intuition.

7. A method according to claim 2, comprising determining, besides the value of the critical frequency, the values of one or more of the following further levels of the disturbance frequency:

fN=normal frequency in operation;

fR=raised frequency in operation, but one that is still acceptable,

fE=excessive frequency, at which the working of the equipment is degraded,

fU=unacceptable frequency, where there are too many disturbances for normal operation.

8. A method according to claim 2, wherein the bursty behavior is considered solely on the basis of the peakedness factor, together with the disturbance frequency.

9. A method according to claim 1, comprising determining, besides the value of the critical frequency, the values of one or more of the following further levels of the disturbance frequency:

fN=normal frequency in operation,

fR=raised frequency in operation, but one that is still acceptable,

fE=excessive frequency, at which the working of the equipment is degraded,

fU=unacceptable frequency, where there are too many disturbances for normal operation.

10. A method according to claim 9, wherein the step of evaluating the results comprises

a first substep of investigating whether measurements can be regarded as reliable, and, if yes, ending by taking no further action,

a second substep that, if the first substep reveals that measurements are not reliable, comprises investigating three possible sources of error, namely whether 1) there are more than a predetermined number of false alarms, 2) faulty equipment stays in service, or 3) the time to get results is more than a predetermined period of time, and

on a third substep level,

performing either of the following three steps,

(i) if there are more than a predetermined number of false alarms, increasing the value of fC, or increasing the value of J or F, by recalculating d and T and returning to first substep,

(ii) if faulty equipment stays in service without raising an alarm, reducing fC, or reducing J or F, recalculating d and T and returning to the first substep,

(iii) if the time to get results is more than a predetermined period of time, reducing the value of J or F, recalculating d and T and returning to the first substep.

11. A method according to claim 9, using the Leaky Bucky algorithm, wherein the value for the inertia is used as a multiplier on the size of the leaky bucket.

12. A method according to claim 9, including the step of producing a risk table including a number of columns, of which four columns contain, in turn, level of disturbance frequency, bias, being expected change of a counter value after a base event, value of the disturbance frequency, and risk of false result, respectively, by selecting a suitable set of values of the bias, calculating values of the disturbance frequency by adjusting the critical frequency with the respective values of the bias, and setting values for risks based upon measurements, economic analysis, experience, judgement or intuition.

13. A method according to claim 9, wherein the evaluating step includes a step of determining the probability of obtaining a false result in the monitoring, based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<

0 implying a false positive result obtained when alarm is given, and b>

0 implying a false negative result obtained when no alarm is given,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process.

14. A method according to claim 9, wherein the bursty behavior is considered solely on the basis of the peakedness factor, together with the disturbance frequency.

15. A method according to claim 1, wherein the bursty behaviour is considered solely on the basis of the peakedness factor, together with the disturbance frequency.

16. A method according to claim 15, wherein the step of evaluating the results comprises

a first substep of investigating whether measurements can be regarded as reliable, and, if yes, ending by taking no further action,

a second substep that, if the first substep reveals that measurements are not reliable, comprises investigating three possible sources of error, namely whether 1) there are more than a predetermined number of false alarms, 2) faulty equipment stays in service, or 3) the time to get results is more than a predetermined period of time, and

on a third substep level,

performing either of the following three steps,

(i) if there are more than a predetermined number of false alarms, increasing the value of fC, or increasing the value of J or F, by recalculating d and T and returning to first substep,

(ii) if faulty equipment stays in service without raising an alarm, reducing fC, or reducing J or F, recalculating d and T and returning to the first substep,

(iii) if the time to get results is more than a predetermined period of time, reducing the value of J or F, recalculating d and T and returning to the first substep.

17. A method according to claim 15, using the Leaky Bucky algorithm, wherein the value for the inertia is used as a multiplier on the size of the leaky bucket.

18. A method according to claim 15, wherein the evaluating step includes a step of determining the probability of obtaining a false result in the monitoring, based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<

0 implying a false positive result obtained when alarm is given, and b>

0 implying a false negative result obtained when no alarm is given,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process.

19. A method according to claim 15, including the step of producing a risk table including a number of columns, of which four columns contain, in turn, level of disturbance frequency, bias, being expected change of a counter value after a base event, value of the disturbance frequency, and risk of false result, respectively, by selecting a suitable set of values of the bias, calculating values of the disturbance frequency by adjusting the critical frequency with the respective values of the bias, and setting values for risks based upon measurements, economic analysis, experience, judgement or intuition.

20. A method according to claim 1, using the Leaky Bucket algorithm, wherein the value for the inertia is used as a multiplier on the size of the leaky bucket.

21. A method according to claim 20, including the step of producing a risk table including a number of columns, of which four columns contain, in turn, level of disturbance frequency, bias, being expected change of a counter value after a base event, value of the disturbance frequency, and risk of false result, respectively, by selecting a suitable set of values of the bias, calculating values of the disturbance frequency by adjusting the critical frequency with the respective values of the bias, and setting values for risks based upon measurements, economic analysis, experience, judgement or intuition.

22. A method according to claim 20, wherein the step of evaluating the results comprises

a first substep of investigating whether measurements can be regarded as reliable, and, if yes, ending by taking no further action,

a second substep that, if the first substep reveals that measurements are not reliable, comprises investigating three possible sources of error, namely whether 1) there are more than a predetermined number of false alarms, 2) faulty equipment stays in service, or 3) the time to get results is more than a predetermined period of time, and

on a third substep level,

performing either of the following three steps,

(i) if there are more than a predetermined number of false alarms, increasing the value of fC, or increasing the value of J or F, by recalculating d and T and returning to first substep,

(ii) if faulty equipment stays in service without raising an alarm, reducing fC, or reducing J or F, recalculating d and T and returning to the first substep,

(iii) if the time to get results is more than a predetermined period of time, reducing the value of J or F, recalculating d and T and returning to the first substep.

23. A method according to claim 20, wherein the evaluating step includes a step of determining the probability of obtaining a false result in the monitoring, based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<

0 implying a false positive result obtained when alarm is given, and b>

0 implying a false negative result obtained when no alarm is given,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process.

24. A method according to claim 1, including the step of producing a risk table including a number of columns, of which four columns contain, in turn, level of disturbance frequency, bias, being expected change of a counter value after a base event, value of the disturbance frequency, and risk of false result, respectively, by selecting a suitable set of values of the bias, calculating values of the disturbance frequency by adjusting the critical frequency with the respective values of the bias, and setting values for risks based upon measurements, economic analysis, experience, judgement or intuition.

25. A method according to claim 24, wherein the evaluating step includes a step of determining the probability of obtaining a false result in the monitoring, based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<

0 implying a false positive result obtained when alarm is given, and b>

0 implying a false negative result obtained when no alarm is given,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process.

26. A method according to claim 24, wherein the step of evaluating the results comprises

a first substep of investigating whether measurements can be regarded as reliable, and, if yes, ending by taking no further action,

a second substep that, if the first substep reveals that measurements are not reliable, comprises investigating three possible sources of error, namely whether 1) there are more than a predetermined number of false alarms, 2) faulty equipment stays in service, or 3) the time to get results is more than a predetermined period of time, and

on a third substep level,

performing either of the following three steps,

(i) if there are more than a predetermined number of false alarms, increasing the value of fC, or increasing the value of J or F, by recalculating d and T and returning to first substep,

(ii) if faulty equipment stays in service without raising an alarm, reducing fC, or reducing J or F, recalculating d and T and returning to the first substep,

(iii) if the time to get results is more than a predetermined period of time, reducing the value of J or F, recalculating d and T and returning to the first substep.

27. A method according to claim 1, wherein the step of evaluating the results comprises

a first substep of investigating whether measurements can be regarded as reliable, and, if yes, ending by taking no further action,

a second substep that, if the first substep reveals that measurements are not reliable, comprises investigating three possible sources of error, namely whether 1) there are too many false alarms, 2) faulty equipment stays in service, or 3) the time to get results is more than a predetermined period of time, and

on a third substep level,

performing either of the following three steps,

(i) if there are more than a certain number of false alarms, increasing the value of fC, or increasing the value of J or F, by recalculating d and T and returning to first substep,

(ii) if faulty equipment stays in service without raising an alarm, reducing fC, or reducing J or F, recalculating d and T and returning to the first substep,

(iii) if the time to get results is more than a certain period of time, reducing the value of J or F, recalculating d and T and returning to the first substep.

28. A method according to claim 27, wherein the evaluating step includes a step of determining the probability of obtaining a false result in the monitoring, based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<

0 implying a false positive result obtained when alarm is given, and b>

0 implying a false negative result obtained when no alarm is given,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process.

29. A method according to claim 1, wherein the evaluating step includes a step of determining the probability of obtaining a false result in the monitoring, based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<

0 implying a false positive result obtained when alarm is given, even though there is nothing wrong with a supervised object, and b>

0 implying a false negative result obtained when no alarm is given, even though there is something wrong with the supervised object,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process.

30. A method according to claim 29, wherein the step of determining the probability of obtaining a false result includes the substeps of

entering as parameters:

disturbance step d, bias b and size h of bucket, initializing as variables;

r=P{normal event}/P{disturbance}, wherein P{normal event} means probability of a normal event appearing and P{disturbance} means probability of a disturbance appearing,

a=h*d being size of the bucket in units of 1, determining whether bias b=0, <

0 or >

0, calculating, if bias=0, boundaries of probability u(a/2), while using inequality $\frac{\left(a-z\right)}{a}<<br><br>=u<br><br>\left(z\right)<<br><br>=\frac{\left(a+d-z-1\right)}{\left(a+d-1\right)}$

wherein u(z) means probability of hitting the floor of the bucket, given starting point z,

producing upper and lower bounds, and average for the probability u(a/2),

solving with binary search, if bias is not =0, the equation f(s)=r+s**(d+1)−

(r+1)*s=0, in either the range 1<

s<

2 for b<

0, or in the range 0<

s<

1 for b>

0, wherein s is a dummy variable,

calculating boundaries of probability u(a/2) using inequality $\frac{\left(s**a-s**z\right)}{\left(s**a-1\right)}<<br><br>=u<br><br>\left(z\right)<<br><br>=\frac{\left(s**\left(a+d-1\right)-s**z\right)}{\left(s**\left(a+d-1\right)-1\right)}$

producing upper and lower bounds, and average, for probability u(a/2).

31. A method according to claim 30, wherein the step of determining the probability of obtaining a false result includes the substeps of

entering as parameters:

disturbance step d, bias b, peakedness F and size h of bucket,

initializing as variables;

a state transition probability matrix;

32. A method according to claim 1, wherein the step of determining the probability of obtaining a false result includes the substeps of

entering as parameters:

disturbance step d, bias b, peakedness F and size h of bucket,

initializing as variables;

a state transition probability matrix;

base event X(n+1)=01$\begin{array}{ccc}\text{\hspace{1em}<br><br>}& 0& \text{\hspace{1em}<br><br>}\\ \mathrm{base}<br><br>\text{\hspace{1em}<br><br>}<br><br>\mathrm{event}& X<br><br>\left(n\right)=& \text{\hspace{1em}<br><br>}\\ \text{\hspace{1em}<br><br>}& \text{\hspace{1em}<br><br>}& 1\end{array}$

 

where;

 

P>

q and Q<

p;

 

p=P{X(n)=normal event, 0 &

X(n+1)=normal event, 0},

 

q=P{X(n)=normal event, 0 &

X(n+1)=disturbance, 1},

 

Q=P{X(n)=disturbance, 1 &

X(n+1)=normal event, 0},

 

P=P{X(n)=disturbance, 1 &

X(n+1)=disturbance, 1};

 

the steady-state probabilities for the two-state model are;

 

x=P{x(n)=O}=Q/(Q+q)

 

y=P{x(n)=1 }=q/(Q+q)

 

probability distribution for time=0,

 

performing in a loop through time t while weight=>

0.000001, weight being the probability of the counter remaining between the boundaries of the bucket, the substeps of

 

calculating probability P{state=0 &

counter=i} at time=t+1,

 

calculating probability P{state=1 &

counter=i} at time=t+1,

 

calculating probability P{counter hitting floor or ceiling} at time=t+1,

 

calculating component of mean and mean square for duration of measurement at time=t+1,

 

calculating weight,

 

preparing for the next iteration of the loop by shifting values, and ending loop,

 

calculating variance and standard deviation of duration for the measurement,

 

producing probability of hitting floor and hitting ceiling,

 

producing mean and standard deviation of duration.

33. A method for performing, in a computer-controlled process, an algorithm-controlled monitoring of disturbances which may occur at random or in bursts in the process, said monitoring using counting values obtained from a counter for counting said disturbances, said method comprising:

i) defining an abnormal event regarded to be a disturbance,

ii) defining a base against which disturbances are to be counted,

iii) defining a unit to be used as a measure of a disturbance frequency,

iv) determining values of the disturbance frequency in circumstances that can be expected in operation of a process generating the disturbance to be monitored, said values including a critical value fC of the disturbance frequency where the monitoring nominally issues an alarm,

v) determining for the process, at said critical value, a peakedness factor F, being a measure of how bursty the disturbances are, as the ratio of the variance to the mean of occurrences of disturbances in the process, wherein the bursty behaviour is considered solely on the basis of the peakedness factor, together with the disturbance frequency,

vi) choosing for the algorithm an inertia value J being a measure of how fast or slowly the algorithm is desired to react to changes in the disturbance frequency, so as to achieve an acceptable compromise between speed and reliability of the monitoring,

vii) calculating parameters for the monitoring based upon the disturbance frequency value fC, the peakedness factor F and the inertia value J, and using said parameters to calculate according to 1/fC*J*F a threshold value T of the counter considered to be unacceptable,

iix) designing the algorithm for the monitoring with said parameters,

ix) initiating the monitoring and waiting for results thereof,

x) evaluating the results and, if necessary, adjusting the parameters.

34. A method according to claim 33, wherein the step ii) of defining a base comprises determining whether the base should be a unit of time, a base event, or an artificial base, the outcome being a random variable able to take a value indicating normal event or disturbance.

35. A method according to claim 34, wherein the bursty behavior is considered solely on the basis of the peakedness factor, together with the disturbance frequency.

36. A method according to claim 34, comprising using as a condition that the disturbance frequency measured against all base events is not different by more than a predetermined amount from the frequency measured just against normal events.

37. A method according to claim 34, wherein the step of evaluating the results comprises

a first substep of investigating whether measurements can be regarded as reliable, and, if yes, ending by taking no further action,

a second substep that, if the first substep reveals that measurements are not reliable, comprises investigating three possible sources of error, namely whether 1) there are more than a predetermined number of false alarms, 2) faulty equipment stays in service, or 3) the time to get results is more than a predetermined period of time, and

on a third substep level,

performing either of the following three steps,

(i) if there are more than a predetermined number of false alarms, increasing the value of fC, or increasing the value of J or F, by recalculating d and T and returning to first substep,

(ii) if faulty equipment stays in service without raising an alarm, reducing fC, or reducing J or F, recalculating d and T and returning to the first substep,

(iii) if the time to get results is more than a predetermined period of time, reducing the value of J or F, recalculating d and T and returning to the first substep.

38. A method according to claim 34, wherein the evaluating step includes a step of determining the probability of obtaining a false result in the monitoring, based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<

0 implying a false positive result obtained when alarm is given, and b>

0 implying a false negative result obtained when no alarm is given,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process.

39. A method according to claim 34, comprising determining, besides the value of the critical frequency, the values of one or more of the following further levels of the disturbance frequency:

fN=normal frequency in operation;

fR=raised frequency in operation, but one that is still acceptable,

fF=excessive frequency, at which the working of the equipment is degraded,

fU=unacceptable frequency, where there are too many disturbances for normal operation.

40. A method according to claim 34, using the Leaky Bucky algorithm, wherein the value for the inertia is used as a multiplier on the size of the leaky bucket.

41. A method according to claim 34, including the step of producing a risk table including a number of columns, of which four columns contain, in turn, level of disturbance frequency, bias, being expected change of a counter value after a base event, value of the disturbance frequency, and risk of false result, respectively, by selecting a suitable set of values of the bias, calculating values of the disturbance frequency by adjusting the critical frequency with the respective values of the bias, and setting values for risks based upon measurements, economic analysis, experience, judgement or intuition.

42. A method according to claim 33, including the step of producing a risk table including a number of columns, of which four columns contain, in turn, level of disturbance frequency, bias, being expected change of a counter value after a base event, value of the disturbance frequency, and risk of false result, respectively, by selecting a suitable set of values of the bias, calculating values of the disturbance frequency by adjusting the critical frequency with the respective values of the bias, and setting values for risks based upon measurements, economic analysis, experience, judgement or intuition.

43. A method according to claim 33, wherein the evaluating step includes a step of determining the probability of obtaining a false result in the monitoring, based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<

0 implying a false positive result obtained when alarm is given, and b>

0 implying a false negative result obtained when no alarm is given,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process.

44. A method according to claim 33, wherein the step of evaluating the results comprises

a first substep of investigating whether measurements can be regarded as reliable, and, if yes, ending by taking no further action,

a second substep that, if the first substep reveals that measurements are not reliable, comprises investigating three possible sources of error, namely whether 1) there are more than a predetermined number of false alarms, 2) faulty equipment stays in service, or 3) the time to get results is more than a predetermined period of time, and

on a third substep level,

performing either of the following three steps,

(i) if there are more than a predetermined number of false alarms, increasing the value of fC, or increasing the value of J or F, by recalculating d and T and returning to first substep,

(ii) if faulty equipment stays in service without raising an alarm, reducing fC, or reducing J or F, recalculating d and T and returning to the first substep,

(iii) if the time to get results is more than a predetermined period of time, reducing the value of J or F, recalculating d and T and returning to the first substep.

45. A method according to claim 33, comprising determining, besides the value of z the critical frequency, the values of one or more of the following further levels of the disturbance frequency:

fN=normal frequency in operation;

fR=raised frequency in operation, but one that is still acceptable,

fE=excessive frequency, at which the working of the equipment is degraded,

fU=unacceptable frequency, where there are too many disturbances for normal operation.

46. A method according to claim 33, using the Leaky Bucket algorithm, wherein the value for the inertia is used as a multiplier on the size of the leaky bucket.

47. A method for performing, in a computer-controlled process, an algorithm-controlled monitoring of disturbances which may occur at random or in bursts in the process, said monitoring using counting values obtained from a counter for counting said disturbances, said method comprising:

i) defining an abnormal event regarded to be a disturbance,

ii) defining a base against which disturbances are to be counted, comprising determining whether the base should be a unit of time, a base event, or an artificial base, the outcome being a random variable able to take a value indicating normal event or disturbance,

iii) defining a unit to be used as a measure of a disturbance frequency,

iv) determining values of the disturbance frequency in circumstances that can be expected in operation of a process generating the disturbance to be monitored, said values including a critical value fC of the disturbance frequency where the monitoring nominally issues an alarm,

v) determining for the process, at said critical value, a peakedness factor F, being a measure of how bursty the disturbances are, as the ratio of the variance to the mean of occurrences of disturbances in the process,

vi) choosing for the algorithm an inertia value J being a measure of how fast or slowly the algorithm is desired to react to changes in the disturbance frequency, so as to achieve an acceptable compromise between speed and reliability of the monitoring,

vii) calculating parameters for the monitoring based upon the disturbance frequency value fC, the peakedness factor F and the inertia value J, and using said parameters to calculate according to 1/fC*J*F a threshold value T of the counter considered to be unacceptable,

iix) designing the algorithm for the monitoring with said parameters,

ix) initiating the monitoring and waiting for results thereof,

x) evaluating the results and, if necessary, adjusting the parameters, comprising

a first substep of investigating whether measurements can be regarded as reliable, and, if yes, ending by taking no further action,

a second substep that, if the first substep reveals that measurements are not reliable, comprises investigating three possible sources of error, namely whether

     1) there are more than a predetermined number of false alarms,

     2) faulty equipment stays in service, or

     3) the time to get results is more than a predetermined period of time, and

on a third substep level,

performing either of the following three steps,

(i) if there are more than a predetermined number of false alarms, increasing the value of fC, or increasing the value of J or F, by recalculating d and T and returning to first substep,

(ii) if faulty equipment stays in service without raising an alarm, reducing fC, or reducing J or F, recalculating d and T and returning to the first substep,

(iii) if the time to get results is too long, reducing the value of J or F, recalculating d and T and returning to the first substep.

48. A method according to claim 47, comprising determining, besides the value of the critical frequency, the values of one or more of the following further levels of the disturbance frequency:

fN=normal frequency in operation;

fR=raised frequency in operation, but one that is still acceptable,

fE=excessive frequency, at which the working of the equipment is degraded,

fU=unacceptable frequency, where there are too many disturbances for normal operation.

49. A method according to claim 47, wherein the evaluating step includes a step of determining the probability of obtaining a false result in the monitoring, based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<

0 implying a false positive result obtained when alarm is given, and b>

0 implying a false negative result obtained when no alarm is given,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process.

50. A method according to claim 47, wherein the step ii) of defining a base comprises determining whether the base should be a unit of time, a base event, or an artificial base, the outcome being a random variable able to take a value indicating normal event or disturbance.

51. A method according to claim 47, wherein the bursty behavior is considered solely on the basis of the peakedness factor, together with the disturbance frequency.

52. A method according to claim 47, using the Leaky Bucky algorithm, wherein the value for the inertia is used as a multiplier on the size of the leaky bucket.

53. A method according to claim 47, including the step of producing a risk table including a number of columns, of which four columns contain, in turn, level of disturbance frequency, bias, being expected change of a counter value after a base event, value of the disturbance frequency, and risk of false result, respectively, by selecting a suitable set of values of the bias, calculating values of the disturbance frequency by adjusting the critical frequency with the respective values of the bias, and setting values for risks based upon measurements, economic analysis, experience, judgement or intuition.

54. A method comprising determining the probability of false results in an algorithm-controlled monitoring of disturbances performed in a computer-controlled process, wherein the disturbances may occur at random or in bursts in the process, said monitoring using counting values obtained from a counter for counting said disturbances, said monitoring comprising the steps of defining an abnormal event regarded to be a disturbance, defining a base against which disturbances are to be counted, and defining a unit to be used as a measure of a disturbance frequency,

the method further comprising:

determining the probability based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<

0 implying a false positive result obtained when alarm is given, even though there is nothing wrong with a supervised object, and b>

0 implying a false negative result obtained when no alarm is given, even though there is something wrong with the supervised object,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process, being a measure of how bursty the disturbances are,

entering d, b and h as parameters

initializing as variables;

 

r=P{normal event}/P{disturbance}, wherein P{normal event} means probability of a normal event appearing and P{ disturbance} means probability of a disturbance appearing,

 

a=h*d being size of the bucket in units of 1,

 

there is determined whether bias b=0, <

0 or >

0.

 

calculating, if bias=0, boundaries of probability u(a/2), while using inequality $\frac{\left(a-z\right)}{a}<<br><br>=u<br><br>\left(z\right)<<br><br>=\frac{\left(a+d-z-1\right)}{\left(a+d-1\right)}$

 

wherein u(z) means probability of hitting the floor of the bucket, given starting point z,

 

producing upper and lower bounds, and average for the probability u(a/2),

 

solving with binary search, if bias is not=0, the equation f(s)=r+s**(d+1)−

(r+1)*s=0, in either the range 1<

s<

2 for b<

0, or in the range 0 <

s <

1 for b>

0, wherein s is a dummy variable, $\mathrm{calculating}<br><br>\text{\hspace{1em}<br><br>}<br><br>\mathrm{boundaries}<br><br>\text{\hspace{1em}<br><br>}<br><br>\mathrm{of}<br><br>\text{\hspace{1em}<br><br>}<br><br>\mathrm{probability}<br><br>\text{\hspace{1em}<br><br>}<br><br>u<br><br>\left(a/2\right)<br><br>\text{\hspace{1em}<br><br>}<br><br>\mathrm{using}<br><br>\text{\hspace{1em}<br><br>}<br><br>\mathrm{inequality}$$\frac{\left(s**a-s**z\right)}{\left(s**a-1\right)}<<br><br>=u<br><br>\left(z\right)<<br><br>=\frac{\left(s**\left(a+d-1\right)-s**z\right)}{\left(s**\left(a+d-1\right)-1\right)}$

 

producing upper and lower bounds, and average, for probability u(a/2).

55. A method for determining the probability of false results in an algorithm-controlled monitoring of disturbances performed in a computer-controlled process, wherein the disturbances are apt to occur at random or in bursts in the process, said monitoring using counting values obtained from a counter for counting said disturbances, said monitoring comprising the steps of defining an abnormal event regarded to be a disturbance, defining a base against which disturbances are to be counted, and defining a unit to be used as a measure of a disturbance frequency,

the method comprising:

determining the probability based upon using a Leaky Bucket algorithm in which said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter is incremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<

0 implying a false positive result obtained when alarm is given, even though there is nothing wrong with a supervised object, and b>

0 implying a false negative result obtained when no alarm is given, even though there is something wrong with the supervised object,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process, being a measure of how bursty the disturbances are,

entering d, b and h as parameters

initializing as variables;

 

a state transition probability matrix;

$\mathrm{base}<br><br>\text{\hspace{1em}<br><br>}<br><br>\mathrm{event}<br><br>\text{\hspace{1em}<br><br>}<br><br>X<br><br>\left(n+1\right)=0<br><br>\text{\hspace{1em}<br><br>}<br><br>1$$\mathrm{base}<br><br>\text{\hspace{1em}<br><br>}<br><br>\mathrm{event}<br><br>\text{\hspace{1em}<br><br>}<br><br>\underset{1}{X}<br><br>\left(n\right)=\begin{array}{c}0\\ \text{\hspace{1em}<br><br>}\end{array}$

 

where;

 

P>

q and Q<

p;

 

p=P{X(n)=normal event, 0 &

X(n+1)=normal event, 0},

 

q=P{X(n)=normal event, 0 &

X(n+1)=disturbance, 1},

 

Q=P{X(n)=disturbance, 1 &

X(n+1)=normal event, 0},

 

P=P{X(n)=disturbance, 1 &

X(n+1)=disturbance, 1};

 

the steady-state probabilities for the two-state model are;

 

x=P{x(n)=0}=Q/(Q+q)

 

y=P{x(n)=1}=q/(Q+q)

 

probability distribution for time=0,

 

performing in a loop through time t while weight=>

0.000001, weight being the probability of the counter remaining between the boundaries of the bucket, the substeps of

 

calculating probability P{state=0 &

counter=i} at time=t+1,

 

calculating probability P{state=1 &

counter=i} at time=t+1,

 

calculating probability P{counter hitting floor or ceiling} at time=t+1,

 

calculating component of mean and mean square for duration of measurement at time=t+1,

 

calculating weight,

 

preparing for the next iteration of the loop by shifting values, and ending loop,

 

calculating variance and standard deviation of duration for the measurement,

 

producing probability of hitting floor and hitting ceiling,

 

producing mean and standard deviation of duration.