This paper sketches an interdisciplinary doctoral research. The main contribution is amongst others the combination of existing approaches for realtime monitoring and long-term analysis. This includes data stream management, event condition action rules, complex event processing as well as data mining technologies. As a practical use case we introduce briefly a scenario related to the failure management system of the International Space Station Columbus Module. Our research is based on three main assumptions and we identify five monitoring requirements. Furthermore, we describe a system model that is known as the state space. Here, the state space represents the knowledge about the monitored target system. Additionally, we present a cyclic monitoring process chain that represents a dynamic and flexible monitoring approach. Our proposed monitoring architecture respects the complexity of system monitoring as well as today's and future monitoring requirements.
Embedded systems are widely used in today’s products such as cars, trains, airplanes or
spacecrafts, where they are often used for controlling and monitoring purposes. In most
of cases, these products are subject to real-time requirements and reliability. Nowadays,
monitoring technical systems is a widespread research area and it is applied in many
heterogeneous application domains. While monitoring solutions are often designed,
developed and implemented for specific applications, production costs increases and at
the same time, flexibility of the monitoring solution is getting more and more lost
because of increasing complexity. Significant applications can be found, for instance, in
the area of spacecraft monitoring ([
Because of the increasing complexity of today’s products improved monitoring
approaches are needed that respect today’s and future requirements. This paper sketches
an interdisciplinary doctoral research. We aim to research on the combination of
existing, well known and well applied approaches that can be adequately used for combining
real-time monitoring and long-term analysis of events by means of embedded systems
[19]. Due to the use of existing approaches it is consequently possible to reduce
production costs. Our research includes data stream management [
Our monitoring approach is based on the following three assumptions: 1. Across different application domains the underling monitoring methodologies and algorithms are similar. 2. It is impossible to exclude any occurrence of errors during run-time. Thus, any change of the system behaviour must be adequately followed by an appropriate action. 3. The monitoring process is semi-automatic. Information technologies are used to facilitate the monitoring process.
The rest of the paper is organized as follows. In Section 2 we describe briefly a use case that is related to the failure management system of the ISS Columbus Module. Section 3 defines the term embedded system as we intend to use it in our research. Section 4 summarizes monitoring requirements and based on this, Section 5 delineates our research questions. Section 6 describes the system model that we intend to use for the suggested monitoring approach. Section 7 details our approach. Our contribution is amongst others the combination of existing, well known and well applied approaches for the combination of real-time monitoring and long-term analysis. Section 8 summarizes existing solutions and finally, a conclusion is given in section 9. 2
The ISS Columbus Inter Module Ventilation Return Fan Assembly (IRFA) [
12−Feb 22−Feb 03−Mar 13−Mar 23−Mar 02−Apr Time [Day−Month]
II. IRFA Irregularities ] A [ t n e r r u C t u p n I − ]aP 2 k [re1.5 Input Current [A] u sse 1 r P0.5 0
15:07 15:14
15:21 15:28 Time [Hour:Minute] 15:36 15:43
Fig. 1. Increasing Input Current (I.) and Irregularities (II.) of ISS Columbus IRFA
According to the presented use case and considering the abstract architecture of an embedded System it is possible to describe monitoring requirements. This involves the following five dimensions: time, locality, knowledge, system resources and sharpness. Figure 3 depicts the mentioned requirements.
Time: This requirement refers to the temporal and continual changing of the system components.
– Short-Term: Abrupt changes can occur (e.g. collision). It is needed to detect such abrupt changes in real-time. – Long-Term: In order to detect long-term influencing factors and changes (e.g. wear and tear) long-term analysis is required.
Locality: This requirement refers to interrelation effects of influencing factors and the spatial location of monitoring.
– Local: Failures that relate on few system components must be detected by means of local monitoring. – Global: Because of the rising complexity of today’s products the correlation of influencing factors increases. Thus, complex interrelations arise between system components. It is needed to gather and to detect such complex interrelations by the use of global analysis.
Knowledge: This requirement refers to the available information about the embedded system, the product and its environment.
– Known: It is necessary to employ knowledge about the embedded system, the product and its environment as comprehensive and goal-oriented as possible for the monitoring process. – Unknown: Because of unknown and unforeseeable conditions a dynamic, flexible and adaptable monitoring process is needed.
System Resources: This requirement refers to all available resources for the monitoring process.
– Unrestricted: Monitoring in particular long-term monitoring requires extremely
many system resources. From this point of view a combination of internal and
external monitoring resources is needed (hybrid monitoring [22]).
– Restricted: Because of restricted system resources of embedded systems it is
necessary to use them adequately and goal-oriented for the internal monitoring process.
Sharpness: This requirement refers to the interpretation respectively the processing of
conditions ([
– Crisp: System states must be detected exactly and reliably by the use of binary processing (Boolean logic). For example, if a threshold value is reached. – Non-Crisp: For particular problems crisp processing is inadequate. From this point of view it necessary to generalize binary processing by means of affiliation degrees between 0 and 1. The value 1 implies full affiliation and the value 0 implies the opposite. There is a gap between real-time monitoring and long-term analysis of events which affect the reliability of the system. Therefore we aim to research on the combination of real-time monitoring and long-term analysis of events. In a first step we consider all requirements excepting sharpness. Figure 4 summarizes the research question. Long-term analysis needs usually a huge amount of processing resources. Hence, it must be processed offline and on an external information system with nearly unrestricted system resources. Furthermore, data mining technologies are semi-automatic. Thus, specialized staff is needed that observes and fosters the data mining process. Data mining technologies are applied here to learn classifiers. These classifiers are represented by means of ECA rules. The persistent stored data gives a global view to the whole system. It can be used to identify relevant interrelations. We use data mining technologies to increase knowledge about the system over time.
With respect to the above-mentioned use case the data is gathered on an external
information system. This persistent stored data is used to learn classifiers that can
distinguish between normal, abnormal and anomalous behaviour of the IRFA, known as
anomaly detection [
Real-time monitoring must be processed on the embedded system that is subject to resource restrictions. Monitoring must be processed automatically, online and without any user interactions. Changes of the system behaviour that require immediate responses must be detected adequately with respect to real-time requirements. Here, the learned classifiers respectively the ECA rules are transferred to the embedded system and afterwards applied for behaviour change and anomaly detection. Here, CEP is a selected tool to utilize the ECA rules onto continuous data streams. ECA rules represent the knowledge about the system. Behaviour that do not fit to this rules might be labelled as anomalous. This is a local point of view because only a subset of attributes is used to define rules for specific behaviour.
With respect to the above-mentioned use case the irregularities of the IRFA has
entailed a significant and abrupt change of the system behaviour. The ECA approach is
described subsequently. Here, an event is the behaviour of the system at a specific time.
The condition refers to the learned classifiers respectively to the rules that are used to
classify the behaviour of the system at a specific time. An action could be a failure
massage or the automatic deactivation of the IRFA to avoid material damage.
A key issue is the understanding of the input data. Sensors produce continuous data.
These continuous sensor data can be construed as data streams. A data stream consists
of a sequence of data items. Often, this sequence is very large. A system that processes
data streams has no a priori control about the order of arriving data items. A renewed
transmission of lost data items is impossible. More information about data streams and
data stream processing can be found amongst others in [
We construe a set of features as a set of attributes A1, ... , An that represent the state variables of the target system. They can be amongst others nominal, ordinal or metrical. Attribute values are functions on time i.e. values of Ai are values of ai : T → R where T is a time representation and R is the set of real numbers.
Therefore, a state at time t is represented as a state vector
~a(t) =
.
The space that is spanned by the attributes is called the state space. The number of
attributes defines the number of dimensions of the state space. A set of state vectors in the
state space that represents similar kinds of states can be geometrically interpreted. This
geometrical interpretation is known as a cluster in the area of data mining technologies
([23], [
Figure 5 depicts the state space in a time frame of a system considering two
attributes A1 and A2. For better clarity, Figure 5 is incomplete and the state vectors are
represented by means of dots. Let S be the set of all possible system states respectively
the state space, let Sk be the set of known system states and let Su be the set of unknown
system states such that Sk S Su = S and Sk T Su = ∅. Hence, unknown system states
are complementary to known system states. The clusters Ck1 and Ck2 of Figure 5 are
representing sets of known system states. The cluster Cu1 and the points pu1 and pu2
are exemplary for unknown system states. In [
As already described, the focus of interest lies in the combination of real-time monitoring and long-term analysis. The aim is to learn a model respectively a system state space that represents the knowledge of the target system that is monitored. In the beginning, this section describes a cyclic monitoring process chain. Then, this monitoring process chain is mapped to an abstract monitoring architecture.
The monitoring process chain is depicted in Figure 6. It is divided into real-time monitoring that takes place on the embedded system and in long-term analysis that takes place on an external information system.
The monitoring process chain starts with events. From the CEP point of view each
state vector is construed as an event. Pre-processing is the second step. It can be used
amongst others for noise reduction, relevant event selection and for windowing to
minimize processing efforts. Rule execution is the third step and it is used to perform
previously defined rules onto the pre-processed events. The fourth step can be used to send
messages to actuators. The fifth step is used for temporal storage mechanisms. This
involves data aggregation to minimize data volume as well as selected storage strategies
such as ring buffers or embedded databases. The smaller cyclic arrow indicates that
these steps are separated from long-term analysis that starts with the following step.
The sixth step is the data transmission to the external information system. Because of
uncertainty of the external network data can only be transmitted from time to time when
the communication path is available. Each part of these steps should be interchangeable
and configurable (like plug-ins) to provide a dynamic and flexible monitoring solution.
From this point of view it is possible to tailor the CEP engine by means of plug-ins to the
underling hardware and to the intended monitored approach. The seventh step is loading
of the received data into a persistent storage like a data warehouse (DWH). The eighth
step is used for rule generation by means of data mining technologies. Presently, this
includes the following classification respectively supervised learning strategies: rule
induction, support vector machine and nearest neighbour. Mostly, these selected data
mining technologies must also be combined for appropriate classification ([
The proposed monitoring architecture is depicted in Figure 7. It is based on the mentioned monitoring process chain. Sensors produce continuous data streams that are transmitted via the internal network. These events respectively the state vectors need to be computed continuously and with respect to real-time requirements by means of the CEP engine. The CEP engine has to produce according to the action part of the applied ECA rules actions. Furthermore, the data stream is aggregated and temporarily stored before it is transmitted to the external information system. The external information system is used for long-term analysis to derive new rules and for refinement of existing rules. Afterwards, these rules have to be evaluated and need to be transferred to the embedded system. 8
Data stream management systems (DSMS) such as STREAM [
VEDAS [
Odysseus [
There is a need for new monitoring solutions that respect today’s and future requirements. This paper sketches an interdisciplinary doctoral research. The main contribution is amongst others the combination of real-time monitoring and long-term analysis by means of embedded systems, data stream management, data mining technologies, ECA rules and CEP. The suggested approach is based on three assumptions. Additionally, five monitoring requirements were identified here. The analysis of existing solutions pointed out that the identified monitoring requirements are not reflected by existing monitoring approaches. Upon this, a dynamic, flexible and adaptable monitoring approach was suggested here. It is based on an mathematical system model the state space. The state space represents the knowledge about the target system that is monitored during run-time. Furthermore, a cyclic monitoring process chain was suggested that improves and strengthens the knowledge respectively the state space over time. This state space is mapped by means of data mining technologies respectively supervised learning into ECA rule sets. These rule sets are used to classify continuously arriving state vectors as normal, abnormal or anomalous. To achieve a dynamic and flexible monitoring solution we suggested a plug-in based approach. 10
We wish to thank and acknowledge DLR, ESA and ASTRIUM Space Transportation for their insights and support, with special thanks to Enrico Noack. 18. Noack, E., Noack, T., Patel, V., Schmitt, I., Richters, M., Stamminger, J., Sievi, S.: Failure Management for Cost-Effective and Efficient Spacecraft Operation. In: Proceedings of the 2011 NASA/ESA Conference on Adaptive Hardware and Systems. AHS ’11, IEEE Computer Society (2011), to appear 19. Noack, T.: Echtzeitberwachung und Langzeitanalyse mittels eingebetteter Systeme. In: Proceedings of the 23nd GI-Workshop on Foundations of Databases (2011), to appear 20. Peckol, J.K.: Embedded Systems: A Contemporary Design Tool. John Wiley & Sons (2007) 21. Schmitt, I.: QQL: A DB&IR Query Language. The VLDB Journal 17, 39–56 (2008) 22. Tsai, J.J.P., Yang, S.J.H.: Monitoring and Debugging of Distributed Real-Time Systems.
IEEE Computer Society Press (1995) 23. Witten, I.H., Frank, E., Hall, M.A.: Data Mining: Practical Machine Learning Tools and
Techniques. Elsevier (2011) 24. Wolf, F.: Behavioral Intervals in Embedded Software: Timing and Power Analysis of Embedded Real-Time Software Processes. Kluwer Academic Publishers (2002)