Decision-making and response strategies in interaction with alarms: the impact of alarm reliability,availability of alarm validity information and workload

Responding to alarm systems which usually commit a number of false alarms and/or misses involves decision-making under uncertainty. Four laboratory experiments including a total of 256 participants were conducted to gain comprehensive insight into humans' dealing with this uncertainty. Specifically, it was investigated how responses to alarms/non-alarms are affected by the predictive validities of these events, and to what extent response strategies depend on whether or not the validity of alarms/non-alarms can be cross-checked against other data. Among others, the results suggest that, without cross-check possibility (experiment 1), low levels of predictive validity of alarms ( ≤ 0.5) led most participants to use one of two different strategies which both involved non-responding to a significant number of alarms (cry-wolf effect). Yet, providing access to alarm validity information reduced this effect dramatically (experiment 2). This latter result emerged independent of the effort needed for cross-checkings of alarms (experiment 3), but was affected by the workload imposed by concurrent tasks (experiment 4). Theoretical and practical consequences of these results for decision-making and response selection in interaction with alarm systems, as well as the design of effective alarm systems, are discussed.     

Learning three sets of alarms for the same medical functions: A perspective on the difficulty of learning alarms specified in an international standard

Three sets of eight alarms supporting eight functions specified in an international medical equipment standard (IEC 60601-1-8) were tested for learnability using non-anaesthetist participants. One set consisted of the tonal alarms specified in the standard. A second set consisted of a set of abstract alarms randomly selected from a database of abstract alarm sounds held by the authors. A third set of alarms was designed as indirect metaphors of the functions. Participants were presented with the alarms and then asked to identify them across ten blocks of eight trials. The results indicated a significant difference in learnability across the three sets of alarms. The indirect metaphors were learned significantly better than both other sets of alarms, and the randomly selected abstract alarms were learned significantly better than the alarms specified in the standard. The results suggest therefore that there are more readily learnable possible designs than those proposed in the standard. The use of auditory icons in particular should be given serious consideration as potential alarms for this application.     

Alarm management practices in natural gas processing plants

In industrial data sets, groups of variables often move together. Monitoring all these variables may result in many nuisance alarms. However, it is possible to take advantage of redundant information to design and reduce the size of alarm sets. The present work reports the application of an alarm management protocol based on alarm priorization to three large Natural Gas Processing Plants, during a three year period, and also investigates the use of different correlation analyses techniques as tools to assist in the further reduction of the number of alarms. The results show that the adopted practices enable the reduction of alarms.     

A combined analysis of plant connectivity and alarm logs to reduce the number of alerts in an automation system

A process alarm arises when normal operation limits are exceeded and an alarm management system alerts the operator of a process plant. Due to the material, energy and information flow in a plant, single disturbances can cause multiple consequent alarm messages, and the alarm messages may overload the operator by presenting many redundant alarms. This undesired situation is called an ‘alarm flood’. In such situations, the operator might not be able to fulfil his required tasks to keep the plant within safe operation limits and to find the root cause of the disturbance. The aim of the work presented in this paper is to reduce the number of alerts presented to the operator. If alarms are related to one another, those alarms should be grouped and presented as one alarm problem. For the implementation of the concept, a software prototype has been developed to perform this reduction automatically. The analysis process starts with the alarm history which is a log containing all past alarm messages. This is combined with the plant topology of the controlled system and a set of rules. The rules describe typical interrelations between alarm messages which have a common cause. The combination of these three elements yields an effective alarm management strategy that can help plant owners and operators to comply with standards for alarm management such as ANSI/ISA 18.2 (2009) and EEMUA 191 (2007) which set limits on the number of alarms per unit time for an operator. The effectiveness of the approach is illustrated by two industrial examples where a significant reduction of alarms has been achieved.     

A weighted dissimilarity index to isolate faults during alarm floods

A fault-isolation method based on pattern matching using the alarm lists raised by the SCADA system during an alarm flood is proposed. A training set composed of faults is used to create fault templates. Alarm vectors generated by unknown faults are classified by comparing them with the fault templates using an original weighted dissimilarity index that increases the influence of the few alarms relevant to diagnose the fault. Different decision strategies are proposed to support the operator in his decision making. The performances are evaluated on two sets of data: an artificial set and a set obtained from a highly realistic simulator of the CERN Large Hadron Collider process connected to the real CERN SCADA system.     

基于关联规则的通信网络告警相关性分析模型

在通信网络运行过程中．每天都会产生大量告警，将数据挖掘中的关联规则发现技术用于分析历史告警数据，可发现告警相关性规则。这些规则可辅助故障定位和告警过滤，以减轻网络管理员的工作强度，提高工作效率。本文分析了通信网络原始告警信息的特点，提出了一个基于关联规则的通信网络告警相关性分析模型，该模型通遏对原始告警数据进行预处理，不仅有效地解决了网络告警时间不同步问题，使得处理后的告警数据可直接用一般的关联规则挖掘工具发现告警相关规则，还大大地压缩了挖掘结果，提高了规则的准确率。初步的实验表明这种分析模型具有实用价值。     

Human probability matching behaviour in response to alarms of varying reliability

The goals of this research were to substantiate the existence of the cry-wolf effect for alarm responses, quantifying its effect on operator performance. A total of 138 undergraduate students performed two blocks of a cognitively demanding psychomotor primary task; at the same time, they were presented with alarms of varying reliabilities (25, 50 and 75% true alarms) and urgencies (green, yellow and red visual alarms presented concurrently with low-, medium- and high-urgency auditory civilian aircraft cockpit alarms). Alarm response frequencies were observed and analysed, and /-tests and repeated-measures MANOVAs were used to assess the effects of increasing alarm reliability on alarm response frequencies, speed and accuracy. The results indicate that most subjects (about 90%) do not respond 10 all alarms but match their response rates to the expected probability of true alarms (probability matching). About 10% of the subjects responded in the extreme, utilizing an all-or-none strategy. Implications of these results for alarm design instruction and further research are discussed.     

一种基于属性哈希的告警日志去重方法

网络安全防护设备产生的告警日志中存在大量重复告警,影响实时的网络威胁态势分析。为解决告警日志的实时准确去重问题,提出了一种基于属性哈希的告警日志去重方法。该方法采用属性哈希实现重复告警的快速检测,并采用哈希表同时解决了大量非重复告警日志的存储问题。在基于Darpa数据集构建的告警日志上进行了实验,结果表明该方法在保证较低时间复杂度的同时,去重准确率可以达到95%以上。     

面向电信行业网络告警系统的告警过滤算法

为了减小电信网络中海量告警数据对的告警根源分析所造成的干扰,提出一种告警过滤算法。首先,基于电信网络告警数据对告警量分布、告警持续时间等特征进行量化分析,提出告警影响力和高频瞬态告警概念。在此基础上,从告警量、平均告警时间、告警影响力以及告警实例持续时间四个维度对告警重要程度进行综合分析,并提出复杂度为O（n）（n为告警记录数）的告警过滤算法。单因素实验分析显示,告警压缩比与特定告警元的告警量、平均告警时间、告警影响力以及告警实例持续时间具有正相关关系。对比实验结果表明,在相似告警压缩比下,所提算法的准确性比FTD（Flexible Transient flapping Determination）算法最多提高18个百分点,可用于电信行业的告警数据样本分析以及在线告警过滤。     

基于时态关联规则的网络故障预报

该文针对网管告警数据库中时间序列存在的连续性、不确定性和模糊性问题,提出了一种基于时态关联规则挖掘告警库的新方法。该方法引入告警数据的时间序列,可预测出一些告警(联合)事件的发生将导致哪些告警(联合)事件的随后产生。通过对某校园网的告警数据库进行规则挖掘实验,表明该方法可以准确、有效的挖掘出隐含在海量网管告警数据库中大量有意义的时态关联规则,规则中的概率参数(置信度和支持度)可作为网络管理的先验知识用来指导网络故障的诊断和预报。     

Estimation of alarm chattering

Chattering alarms (alarms that repeat excessively in a short time interval) create a level of nuisance to the operator. According to industrial alarm standards, no chattering is acceptable. Therefore, reducing the amount of alarm chatter is a primary goal in redesigning alarm parameters. A quantitative measure to assess the degree of chattering for an alarm has recently been proposed. This measure is based on run length distribution which is the distribution of time differences between consecutive alarms. This chattering index is currently calculated empirically based on alarm data. In this paper, we develop a method to estimate the chattering index based on statistical properties of the process variable as well as alarm parameters. The estimation can be used for developing analytical methods to optimally design alarm parameters for minimal chattering.     

A distributed parallel alarm management strategy for alarm reduction in chemical plants

A distributed parallel alarm management strategy based on massive historical alarms and distributed clustering algorithm is proposed to reduce the number of alarms presented to operators in modern chemical plants. Due to the large and growing scale of historical alarms as the basis of analysis, it is difficult for traditional alarm management strategy to store and analyze all alarms efficiently. In this paper, by designing the row key and storage structure in a distributed extensible NoSQL database, the strategy spreads alarm data in a group of commercial machines, which ensures the capacity and scalability of the whole system. Meanwhile, Distributed Parallel Query Model (DPQM) proposed as a unified query model provides efficient query and better integration of distributed platform. Based on the characteristics of alarms and time-delay correlation of alarm occurrence, alarm similarity criteria are proposed to effectively identify repetitive and homologous alarms. In order to group massive alarm data, a new distributed clustering algorithm is designed to work concurrently in MapReduce frameworks. The test results using alarm data from real chemical plants show that the strategy is better than traditional method based on MySQL at system performance, and provides excellent redundant alarm suppression in both normal situation and alarm flooding situation.     

The influence of alarm timing on driver response to collision warning systems following system failure

This driving simulator study focuses on false and missing alarms produced by a forward collision warning system and estimates the effect of alarm timing on driver response to alarm malfunction from the perspective of driver trust in alarms. The results show that drivers who experience late alarms are reluctant to respond to a false alarm and are not influenced by a missed alarm; however, drivers who experience early alarms tend to respond to a false alarm and suffer a delayed response to critical situations when a missing alarm happens. Furthermore, drivers whose judgement of trust is relatively high, tend to exhibit delayed braking, compared with drivers that have lower levels of trust. Driver behaviour towards false and missed alarms may vary according to alarm timing and its influence on trust in alarms; moreover, impaired system effectiveness caused by alarm malfunction may be mitigated by manipulating alarm timing.     

基于时态关联规则的网络故障预报

该文针对网管告警数据库中时间序列存在的连续性、不确定性和模糊性问题,提出了一种基于时态关联规则挖掘告警库的新方法。该方法引入告警数据的时间序列,可预测出一些告警（联合）事件的发生将导致哪些告警（联合）事件的随后产生。通过对某校园网的告警数据库进行规则挖掘实验,表明该方法可以准确、有效的挖掘出隐含在海量网管告警数据库中大量有意义的时态关联规则,规则中的概率参数（置信度和支持度）可作为网络管理的先验知识用来指导网络故障的诊断和预报。     

The influence of alarm timing on driver response to collision warning systems following system failure

This driving simulator study focuses on false and missing alarms produced by a forward collision warning system and estimates the effect of alarm timing on driver response to alarm malfunction from the perspective of driver trust in alarms. The results show that drivers who experience late alarms are reluctant to respond to a false alarm and are not influenced by a missed alarm; however, drivers who experience early alarms tend to respond to a false alarm and suffer a delayed response to critical situations when a missing alarm happens. Furthermore, drivers whose judgement of trust is relatively high, tend to exhibit delayed braking, compared with drivers that have lower levels of trust. Driver behaviour towards false and missed alarms may vary according to alarm timing and its influence on trust in alarms; moreover, impaired system effectiveness caused by alarm malfunction may be mitigated by manipulating alarm timing.     

Comparing speech versus text displays for alarm handling

The rise of computers in command and control domains has meant that control operations can be performed via desk-based visual display terminals. This trend has also produced the potential to display information to operators in a variety of formats. Of particular interest has been the use of text-based displays for alarm presentation. There are possible limitations to the use of text for alarm presentation, not least of which is the need for a dedicated alarms display screen (or, at least, a display page). Given the capability of computers to synthesize speech, it is possible that speech-based alarms could generate the same information as text-based displays without the need for dedicated screen space. In this paper an experimental comparison of speech-based and text-based displays for presentation of alarms is reported. The findings show that speech leads to longer response times than text displays, but that it has minimal effect on the efficacy of fault handling. The results are discussed within the alarm initiated activities framework and implications for alarm system design are outlined.     

基于模糊聚类的网络故障预报

文章针对网管告警数据库中时间序列存在的连续性、不确定性和模糊性问题,提出了一种基于模糊聚类的时间序列规则挖掘新方法。该方法引入模糊聚类理论,可预测出一些告警(联合)事件的发生将导致哪些告警(联合)事件的随后产生。通过对某校园网的告警数据库进行规则挖掘实验,表明该方法可以准确、有效地挖掘出隐含在海量网管告警数据库中大量有意义的时序规则,规则中的概率参数(置信度和支持度)可作为网络管理的先验知识用来指导网络故障的诊断和预报。     

Anesthesia alarms in context: an observational study

This paper surveys current work on the design of alarms for anesthesia environments and notes some of the problems arising from the need to interpret alarms in context. Anesthetists' responses to audible alarms in the operating room were observed across four types of surgical procedure (laparoscopic, arthroscopic, cardiac, and intracranial) and across three phases of a procedure (induction, maintenance, and emergence). Alarms were classified as (a) requiring a corrective response, (b) being the intended result of a decision, (c) being ignored as a nuisance alarm, or (d) functioning as a reminder. Results revealed strong effects of the type of procedure and phase of procedure on the number and rate of audible alarms. Some alarms were relatively confined to specific phases; others were seen across phases, and responses differed according to phase. These results were interpreted in light of their significance for the development of effective alarm systems. Actual or potential applications of this research include the design of alarm systems that are more informative and more sensitive to operative context than are current systems.     

The median filter as a preprocessor for a patient monitor limit alarm system in intensive care

We studied the effects of removing brief variations in the monitoring data on the quality of limit alarms during the postoperative haemodynamic monitoring of cardiac patients. The variations were removed by median filtering. The false alarm frequency was reduced by more than two-thirds compared with a typical patient monitor. We designed and clinically tested a novel dual-limit alarm system with two median filters. The proportion of true alarms increased from 12% to 49% as compared to a typical patient monitor. The average false alarm frequency was 4.5 alarms per monitored hour. No correct alarms were missed.