Why it matters
Treating every reading as an event produces either an alert flood or a missed incident. Transitions are the meaningful unit: entering DANGER is news, remaining in DANGER for the next reading is not.
Monitoring & detection
Risk state machine
A risk state machine models hazard status as a set of discrete states with defined transitions between them, so that events are generated by changes of state rather than by individual readings.
How it works
Readings drive the current state. Crossing from one state to another fires the side effects - creating an incident, raising an alert, changing reporting behaviour - while readings that leave the state unchanged do not.
Example
A node sitting at WARN for twenty minutes produces one incident on entry, not one per reading.
In Alfa HazardX
Incidents and alerts are created on transitions into DANGER and CRITICAL, and the threat timeline merges incidents and analyses into a single feed.
Read further
Related terms
- Risk classificationRisk classification reduces multiple sensor readings to a single ordered state - such as SAFE, MODERATE or CRITICAL - that expresses how dangerous the current situation is.
- Local alarmA local alarm is an audible or visual warning produced by the sensing device itself, without depending on a network, server or remote service.
- Emergency commandEmergency command is the ability to trigger an action on a field device remotely - typically sounding its alarm - from a monitoring interface.