Defining and validating similarity measures for industrial alarm flood analysis

Industrial plant operators regularly observe a high number of alarms generated in a short period of time, a phenomenon which is referred to as alarm flooding. This causes plant downtime, not only because of the repair time but also by the time needed to identify the root cause of machine failure - which is difficult during an alarm flood. Therefore, diagnosis tools that perform root cause analysis to advise plant operators can help reduce the downtime, which is a crucial issue in industry. We analyse the reproducibility and applicability of an existing approach by Ahmed et al. (2013) which is based on agglomerative hierarchical clustering where raw data in the form of alarm logs is preprocessed, floods are detected, and then clustered. The aim is, that resulting clusters represent floods that originate from the same common root cause. We extend the approach with alternative similarity measures and perform experiments regarding their effectiveness in structuring industrial alarm flood data. In our evaluation we use a real industrial use case which contains more diverse data and a larger amount of data points compared with the original study.