Event analysis apparatus, event analysis method and computer program product

1. An event analysis apparatus configured to analyze events collected from a controller in a distributed system including a plurality of field devices in a plant, the apparatus comprising:

a processor configured to:

calculate an individual occurrence probability of the events based on an event matrix, which represents presence and absence of occurrence of each of the events including an attribute indicating an alarm or an operator's operation in time series;

generate a plurality of event pairs, each of the event pairs formed by combining two events, among the events collected from the controller;

calculate a simultaneous occurrence probability between each of the event pairs based on the event matrix;

calculate, as mutual information amount for each of the event pairs, a degree of association between the events based on the calculated individual occurrence probability of the events and the calculated simultaneous occurrence probability between the events;

extract one or more event pairs, among the event pairs, having the mutual information amount greater than or equal to a reference value after the calculation of the mutual amount;

integrate the extracted one or more event pairs and prepare an associated event group for each of the events, in which a specific event is set as a base point event and the base point event and an associated event having the degree of association greater than or equal to a threshold are grouped;

establish a probabilistic cause-and-effect relationship model by a Bayesian network on the basis of the event matrix, for each of the associated event groups;

receive a setting of improvement candidate patterns from a user, each of the improvement candidate patterns being a pattern in which a condition of an event to be set as an improvement candidate is determined based on an attribute of the base point event, an attribute of the associated event and a conditional probability between the base point event and the associated event; and

extract, as an improvement candidate, the base point event of a probabilistic cause-and-effect relationship model conforming to any one of the improvement candidate patterns, from the established probabilistic cause-and-effect relationship models for each event; and

display the extracted improvement candidate on a display unit.

2. The event analysis apparatus according to claim 1 , wherein the processor is further configured to divide the event matrix into blocks having a predetermined reference time width, to calculate the individual occurrence probability of the events and the simultaneous occurrence probability between the events.

3. The event analysis apparatus according to claim 1 , wherein the improvement candidate pattern distinguishes the associated event into a cause-side event and an effect-side event in relation to the base point event, and an attribute and a condition of a conditional probability are determined for each of the cause-side event and the effect-side event.

4. The event analysis apparatus according to claim 1 , wherein one of the associated event groups does not have an associated event.

5. The event analysis apparatus according to claim 1 , wherein the condition of the event to be set as the improvement candidate is set as any condition.

6. An event analysis method of analyzing events collected from a controller in a distributed system including a plurality of field devices in a plant, the method comprising:

calculating an individual occurrence probability of the events based on an event matrix, which represents presence and absence of occurrence of each of the events including an attribute indicating an alarm or an operator's operation in time series;

generating a plurality of event pairs, each of the event pairs formed by combining two events, among the events collected from the controller;

calculating a simultaneous occurrence probability between each of the event pairs based on the event matrix;

calculating, as mutual information amount for each of the event pairs, a degree of association between the events based on the calculated individual occurrence probability of the events and the calculated simultaneous occurrence probability between the events;

extracting one or more event pairs, among the event pairs, having the mutual information amount greater than or equal to a reference value after the calculation of the mutual amount;

integrating the extracted one or more event pairs and preparing an associated event group for each of the events, in which a specific event is set as a base point event and the base point event and an associated event having the degree of association greater than or equal to a threshold are grouped;

establishing a probabilistic cause-and-effect relationship model by a Bayesian network on the basis of the event matrix, for each of the associated event groups;

receiving a setting of improvement candidate patterns from a user, each of the improvement candidate patterns being a pattern in which a condition of an event to be set as an improvement candidate is determined based on an attribute of the base point event, an attribute of the associated event and a conditional probability between the base point event and the associated event; and

extracting, as an improvement candidate, the base point event of a probabilistic cause-and-effect relationship model conforming to any one of the improvement candidate patterns, from the established probabilistic cause-and-effect relationship models for each event; and

displaying the extracted improvement candidate on a display unit.

7. A computer program product, comprising: a non-transitory computer-readable medium comprising code for causing an information processing apparatus to execute a method for analyzing events collected from a controller in a distributed system including a plurality of field devices in a plant, the method comprising:

calculating an individual occurrence probability of the events based on an event matrix, which represents presence and absence of occurrence of each of the events including an attribute indicating an alarm or an operator's operation in time series;

generating a plurality of event pairs, each of the event pairs formed by combining two events, among the events collected from the controller;

calculating a simultaneous occurrence probability between each of the event pairs based on the event matrix;

calculating, as mutual information amount for each of the event pairs, a degree of association between the events based on the calculated individual occurrence probability of the events and the calculated simultaneous occurrence probability between the events;

extracting one or more event pairs, among the event pairs, having the mutual information amount greater than or equal to a reference value after the calculation of the mutual amount;

integrating the extracted one or more event pairs and preparing an associated event group for each of the events, in which a specific event is set as a base point event and the base point event and an associated event having the degree of association greater than or equal to a threshold are grouped;

establishing a probabilistic cause-and-effect relationship model by a Bayesian network on the basis of the event matrix, for each of the associated event groups;

receiving a setting of improvement candidate patterns from a user, each of the improvement candidate patterns being a pattern in which a condition of an event to be set as an improvement candidate is determined based on an attribute of the base point event, an attribute of the associated event and a conditional probability between the base point event and the associated event; and

extracting, as an improvement candidate, the base point event of a probabilistic cause-and-effect relationship model conforming to any one of the improvement candidate patterns, from the established probabilistic cause-and-effect relationship models for each event; and

displaying the extracted improvement candidate on a display unit.