Event Verbosity Levels Event Model

SANY D2.3.4 Specification of the Sensor Service Architecture V3 Doc.V3.1 Copyright © 2007-2009 SANY Consortium Page 66 of 233 battery-powered sensors, temporarily unavailable components, such as human observers, and high-reliance systems such as emergency warning systems. Basically, event creation is a two-step process. First, the action that is signified by the event needs to be observed; and second the observation must be transformed to a structure that can be processed within IT systems. SensorSA doesn‟t apply any restrictions on the observation process, i.e. the activity can be observed by a sensor, a human, a piece of software that supervises another piece of soft- or hardware, event processing systems that generate events based on other events, or any other entity that is enabled to execute observations. The second step is the transformation of the observation to something that can be dealt with within IT systems, i.e. an event object that reifies the observed happening. - Update of Events Once generated, events can be updated to allow modifying the event content. The update of an event may have major effects on events further down the causal chain of related events. Causal chains and updating of events will be further elaborated in 6.4.2.6. - Deprecation of Events Events shall not be cancelled, i.e. an event exists and continues to be valid until declared void or deprecated. SensorSA calls this approach the Reliant Event Model. The rationale behind this approach can be found in the ambiguous semantics of the term cancellation. Cancelling an event could mean that the signified action never happened e.g. false observation by sensing device, that it had happened but is not valid any longer e.g. a “fire event” after the fire was extinguished, or that it was once true but was modified based on additional observations e.g. reclassification of a storm once more observation data were received. The validity of events shall be reflected in the event content model. Events are valid until they become explicitly deprecated.

6.4.2.4 Event Verbosity Levels

SensorSA differentiates three verbosity levels. Depending on the verbosity level, applications produce different amounts of events. 0. First event is generated when a pre-defined condition is matched. No further event is generated until a pre-defined condition is left, e.g. intrusion detected, observed value above threshold. 1. First event is generated when a pre-defined condition is matched; subsequent events get generated every time the observed values changes and the pre-defined condition is still true. 2. Every observation that matches a pre-defined condition generates event, i.e. first event is generated when pre-defined condition is matched; subsequent events get generated every time at sample intervals as long as the pre-defined condition holds true. SANY D2.3.4 Specification of the Sensor Service Architecture V3 Doc.V3.1 Copyright © 2007-2009 SANY Consortium Page 67 of 233 Figure 6-4 illustrates the different verbosity levels for different phenomena. Figure 6-4: Event generation verbosity levels of type binary upper row and nominal lower row Figure 6-4 illustrates the two extremes of binary and nominal scales. Other scales, such as ordinal or interval, work analogously. The upper row illustrates events generated by an intrusion detection system. This binary system knows only two stati, i.e. “intrusion detected” or “no intrusion detected”. The lower row represents a temperature sensor. The y-axis represents the temperature value and is of type nominal scale. The sampling rate of both systems is identical. In both rows, the x-axis represents time, the y-axis observed values. The bold black line represents the current value. The sampling rate is indicated with vertical black lines. Generated events are labelled with a red “E” above the sampling lines. We see that the number of generated events is considerably higher for the temperature observation system than for the intrusion detection system, because the temperature may change its value above or below the threshold, whereas the intrusion detection system only knows two statuses.

6.4.2.5 Form of Events