Online Course on Multi-Dimensional Process Analysis

dfahland

The process mining landscape is evolving rapidly – both in industry and in research. But our education has not kept up. The “(still) very successful “original” Process Mining MOOC Process Mining in Action has been extremely successful in teaching the foundations of Process Mining to a broad audience of practitioners, students, and researchers aiming to get familiar with the field.

Since then, many new courses covering Process Mining have become available, both from vendors and the Covid-enabled video recordings of BPM and Process Mining courses uploaded to Youtube.

What is sorely missing in this landscape however is more structured education around the most recent, fundamental trends in process mining. At the Process Mining Summer School and at the BPM 2022 conference, I gave two lectures that summarized 10 years of research on Multi-Dimensional Process Analysis. The reactions were very positive and enthusiastic. At the same time, a 1.5 hour lecture is not a proper course. It lacks the exercises, tutorials, and longer timeline for learning, which we can offer to students enrolled in Master-level courses on Advanced Process Mining. Spurred by a comment on LinkedIn I chose to do something about this.

While this is an experiment, I think it is worth a try…

Taking the material I have collected and built over the last years, I have started building an Online Course: Multi-Dimensional Process Analysis. Starting today, I am gradually releasing “chapters” covering the following 12 topics in the coming weeks and months:

  • Part 1 – Opening: What are processes and what are we missing with current process analysis techniques?
  • Part 2 – Performance Spectrum: How to visualize event data in a way that we can analyze multiple process executions at once over time?
  • Part 3 – Detecting Emergent Dynamics: How to detect batching, dynamic bottlenecks, and cascades?
  • Part 4 – Convergence and Divergence: What kinds of false information is hidden in sequential event logs for processes over multiple data objects?
  • Part 5 – Event Knowledge Graphs for Object-Centric Process Mining: How to construct Event Knowledge Graphs to correctly represent event data over multiple objects and how to analyze them?
  • Part 6 – Object-Centric Process Analysis with Event Knowledge Graphs: How to infer new information? How to identify causes of delays?
  • Part 7 – Beyond Object-Centric: Actor Behavior – How to model and analyze how actors collaborate in processes using event knowledge graphs?
  • Part 8 – Event Knowledge Graphs: Tool Support and Examples. What insights can we gain on real-life processes using the concepts of object-centric process mining and multi-dimensional process analysis with the Neo4j graph database system?
  • Part 9 – Key Ideas of Multi-Dimensional Process Analysis – What are the fundamental principles of multi-dimensional process analysis?
  • Part 10 – Object-Centric Process Discovery
  • Part 11 – Process-Queue-Resource (PQR) Systems: A case study on how to model and reason across multiple behavioral dimensions
  • Part 12 – Thinking Assistant and Closing: The next step in multi-dimensional process analysis

Each part comes with a video, open access literature, exercises and tutorials. It is aimed at (PhD) students, researchers from other fields, and specifically process mining professionals who want to learn more about one the most important developments in the process mining field.

This course is essentially a hypermedia online textbook. It does not require to enroll on any platform – but there is also no certificate for completing it, except for the knowledge you have gained in becoming a better process mining expert. Interested? Then head over to the course: it’s up and running.

Data Storage vs Data Semantics for Object-Centric Event Data

This post summarizes my talk on “Data Storage vs Data Semantics for Object-Centric Event Data” I gave at the XES symposium at the ICPM 2022 conference.

I first provide a bit of background and the problem we faced, before I turn to the issue of separating data storage from data semantics.

Background

Process Mining analysis starts when someone made event data available in a form that can be directly loaded into a process mining solution. Providing data suitable for analysis is a very labor-intensive process in itself, often taking the lion share of time until the first insights are obtained. Event data exchange formats are supposed to lower the hurdle by providing a common set of semantics concepts that all process analysis problem share.

The existing XES standard suffers from the limitation of pre-grouping events under a single case identifier, which makes it hard to use for analysis questions on many real-life systems. Aware of this problem, the process mining community has started a working group to develop a more versatile event log standard, currently called Object-Centric Event Data (OCED). A first intermediate result of this discussion is a meta-model that illustrates which key concepts we need to consider in data exchange.

OCED Meta-Model circulated in the Process Mining community for feedback.

The OCED meta-model tries to strike a careful balance between having a simple standard and adding more expressivity to event data exchange formats that includes:

  • Not pre-grouping events under a single case identifier.
  • Making events and data both first-class citizens in the data to properly express how a process operated over rich data structures including.
  • Expressing operations at least over the basic entity-relation model (object, relations, attributes) to address a broad range of use cases.
  • Not include all semantic features that are important to a number of specific use cases, but not generic enough to force all other use cases to also deal with them.
  • Be easy to adapt and use by industry to provide data in this form.
  • To be expressive enough to support the fundamental concepts of object-centric process mining or multi-dimensional process mining over multiple entities.

The problem: expressing semantics in data storage make things complicated

Increasing the expressiveness of the data exchange format with concepts to describe how events operated over an entity-relational data model has an undesired consequence: the meta-model to describe all possible ways of how data can be operated on has to suddenly incorporate a large amount of semantic concepts. At the bare minimum, this is creating, reading, updating, deleting objects, attributes, and relations individually and together. At the same time, using just the bare minimum of concepts immediately reveals use cases that cannot be naturally expressed, asking for even more semantic concepts.

How to escape this dilemma was the topic of my talk, which I developed over many discussion with Marco Montali.

Separating Data Storage and Data Semantics

The fundamental point I am making is that the meta-model for data exchange in process mining has to separate the data storage from the data semantics.

Which problem are we solving with data exchange?

We want to help an analyst solve an analysis task for a real process. The analysis fundamentally is to understand the “ground truth” of the dynamics in the real world and to map it to an analysis artifact (digital image, shadow, twin, …) that is consistent with reality for the specific analysis task. A major complication in understanding processes operating on data is that these operations come at different levels of granularity:

  • Basic atomic data operations,
  • grouped into database transactions,
  • organized into process-level actions or activities
  • that are structured by the process.

Because inspecting reality is costly, we pass the data recorded by the underlying IT systems to process mining analysis tools which can reconstruct this digital image of reality. Again, that image has to be consistent with the ground truth of the real process to be of value.

The data exchange format has to allow this – no more, but also no less.

The problem of data provisioning

Unfortunately, the data storage in the underlying systems is optimized for usage: entities and objects are distributed over multiple tables, there are no events, just time-stamped records, relations can be expressed in many ways, activities are materialized in various forms. Moreover, data recording is “lossy” from the perspective of a historic analysis: certain data is never recorded or recorded incorrectly, other data is discarded when it’s no longer needed for operations.

As a consequence, the recorded data may (in parts) be inconsistent with the ground truth:

  • Objects and events may be stored at higher or lower level of granularity that experienced in reality.
  • The scope and semantics of operations on data is vague or ambiguous: which objects, relations, and attributes were involved in a change of data at which point in time?

While these inconsistencies are ideally resolved by improving the data storage of the underlying IT systems, in reality most systems will store inconsistent data. As “consistency with the ground truth” is depending on the analysis task, it is impossible to fully resolve it when exporting the data into the data exchange format.

I therefore argue that the data exchange format should facilitate fast data exchange and rather write out data as-is (as it’s issues and problems are also known). A fundamental property of this data export must be

  • Data that already is consistent with the ground truth also stays consistent with the ground truth.
  • Data that is inconsistent with the ground truth is allowed to stay inconsistent – resolving in consistency requires more information that is better addressed in the analysis phase. But obvious inconsistencies should be resolved through simple data transformations as early as possible.

This doesn’t tell us yet how the exported data should be structured. For this, we should look at what we need to do with the data.

Necessary separation of data semantics for process analysis

Even the most basic, classical process mining analysis already separates data semantics from data storage. Classical process mining starts from building a classical event log. The de-facto standard are CSV files where one column holds a timestamp and other columns essentially hold a number of attribute-value pairs. To turn this CSV file into an event log, the analyst has to pick one attribute that as case identifier and another attribute as activity.

And the analyst has to make this choice in line with the analysis task and what makes the data (more) consistent with the ground truth. This may require to combine multiple attributes to define the right case identifier to refine activities by using multiple attributes.

The space of choices simply becomes larger when we start including dynamics over data in the question.

We now have to make choices for how to model the dynamics of various entities (data objects, actors, equipment, …), relations, and attributes over various levels of granularity (from basic data operations via transactions to actions and entire processes). Each real-world process has its own, specific data structures. The analysis fundamentally has to reconstruct relevant aspects of these data structures (consistency with domain knowledge) in line with the analysis task. This requires flexibility during the import – specifically because different analyses may focus on different aspects.

This suggests that we should generalize the choice of activity and case identifier we do in the classical case to a description of how the recorded and provisioned data maps to the domain knowledge. This would provide the analyst with the design space to build their analysis.

Proposal: A Semantic Header for Event Data

We can create a separate semantic header that is separate from the raw exported data exported. This header has to how the stored data maps to the domain data model of the process.

The storage format for the raw exported data has at least to be:

  • a collection of time-stamped records, where
  • each record holds information about a relevant change to the process and its data – stored in a number of attribute-value pairs.
  • The values can be rich data structures themselves – directly retrieved from the source system.

On top of this, a domain export provides a semantic header that consists of

  • The domain data model over which the process operates
  • A mapping how the attributes and values stored in the data relate to the domain concepts.

This semantic header is not tied to the specific data export. It can be provided beforehand, but also be revised and updated after data export as the analysis evolves or better domain information becomes available. This allows to gain more insights on previously exported data without having to re-export the data again.

To enable process mining over multiple objects, the semantic header has to to express at least which attributes and values describe objects, identifiers, the relevant relations between them – and which attributes belong to an object (are stored somewhere) and which attributes belong to an event (are just observations of a context that is not further stored). This is essentially what the OCED meta-model tries to achieve.

How could demonstrate the feasibility of this semantic header for solving this data exchange problem? The top-part of the above figure sketches how we could specify a mapping from attribute-value pairs of a raw data export to the basic concepts of the OCED meta-model:

  • Some elements of the process data model can grounded in a single attribute, e.g., which attribute holds an object identifier, or which attribute holds an event property.
  • Some elements of the process data model need grounding in multiple attributes, e.g., we need the attribute which holds the identifier id of an object type O and the attribute which holds the value a property x of objects of type O.

This mapping only grounds the objects in the recorded data. We still need to map out the semantics of the operation on the data, which is represented in the OCED model as qualifiers of the relations between events and objects, attributes, and relations. This could for example be done by rules over the attributes such as: If event has type “Create Order” and refers to an object of type Order, then this object is created by the event.

While these semantic concepts can be grounded in a single event record, other concepts may need grounding in multiple event records, such as: which events together from a batch, which events belong to the same activity (start and end events), or which events modify a relation that was created previously.

Some of these process dynamics will be common among many processes, and also be stored using very similar or identical data structures. Others will differ strongly among processes and be represent very differently. By developing the key concepts for specifying semantic headers of process event data, we give an analyst the flexibility to specify the exact semantic model required for the specific process and analysis – without polluting the data storage format with the specifics of the process.

As a community, we have the obligation to help standardize semantic concepts of process that are shared by many processes. The OCED model is arguably the shared baseline. We should start here and create a few proof-of-concept implementations of semantic headers and functions for OCED that transform basic CSV (or OCEL) files into data analysis structures, specifically for object-centric process mining and event knowledge graphs.

The hidden assumptions and forgotten topics of Process Mining, part 2 (Deviations, Patterns, Features)

Also this year, we are organizing the 3rd International workshop on Event Data and Behavioral Analytics (EdbA’22) at the ICPM’22. Part of our workshop philosophy is to dedicate half of the time to open discussions on the topics of the workshop. The discussion often turns to what makes the problems we are looking at difficult – and it’s usually hidden assumptions and under-researched topics. The second and third session on “Deviation Analysis” and “…beyond Control-Flow” surfaced the following topics (for which I managed to record a few short bullet points and questions).

See also The hidden assumptions and forgotten topics of Process Mining, part 1 (Human Behavior) for my notes on “Human Behavior”.

Conditions in process discovery/conformance checking

  • How can we be sure that data conditions are driving the choice between two options and that we did not miss other confounding variables (in the event log itself or in the analysis) that may have influenced the choice?
  • Are we analyzing something that is specific to the case or something that is affecting all instances in the process?
  • How can we distinguish between process-specific vs case-specific contexts that determine a choice? Do we actually observe when the context relevant for decisions changes? For example, a change in season influences all ongoing cases, or a new compliance rule becomes effective?

Using Frequency for Deviation Analysis

  • We measure frequency of various behavioral features by counting how often activities occur – but this natural frequency may be misleading, e.g., an activity being repeated multiple times after each other may signify something else than than repeating activities with more time in between. Measuring the global frequency cannot capture this.

Analyzing Deviations

Typical structure in deviation analysis: first detect where did something happen we didn’t expect, then explain why this happened. Do we have to separate both steps or should they be combined/integrated?

  • This separating into two sequential tasks is necessary when developing techniques/detectors: first need to identify the patterns that constitute the deviations, then can detect and analyze causes based on these patterns.
  • Deviation patterns are crucial to explain and show to domain experts what the difference/change to the expected behavior is to confirm these deviations are relevant and agree on the analysis goal, to give focus on the next steps.
  • How do we best visualize changes and deviations in processes that make sense to domain experts to reason together about relevance and causes? Process visualizations themselves are already complex, visualizing complex patterns of how the process deviates is not straight forward.

Method selection for deviation analysis

How do we pick the right approach for detecting anomalies?

  • Pattern-based, ML-based, rule-based?
  • Research often only obtained acceptable results by searching for the best performing method among a variety of options. Sometimes even different methods have to be used within the same process and task for different target classes. This need to search for and engineer the most suitable method is a huge hurdle to adoption in industry.

Analyzing processes beyond control-flow

Adding more features to event data and analytics (data attributes/properties) makes the analysis more complex.

  • How do we find which features matter for analysis and prediction? The space of possibilities is exploding as we add related data objects and entities to the event data feature space.
  • There is a lot of domain knowledge available about how objects are related, which attributes are part of which objects, how the systems work (e.g., UML diagrams) – we should use it, but not store it inside the event log.
  • Domain knowledge does not invalidate the use of event logs. Event logs provide additional insights into this kind of domain knowledge: how are the structures used over time? How are the structures described in the domain documentation used in practice differently from their documentation?

The common topic of these above questions is that our standard approaches lack concepts and data structures for modeling the context of a particular behavior that is outside the specific case. The two dimensions of Multi-Dimensional Process Thinking of the inner and the outer scope of a process (analysis) may help to think about these concepts and data structures by taking a different perspective on processes.

The hidden assumptions and forgotten topics of Process Mining, part 1 (Human Behavior)

Also this year, we are organizing the 3rd International workshop on Event Data and Behavioral Analytics (EdbA’22) at the ICPM’22. Part of our workshop philosophy is to dedicate half of the time to open discussions on the topics of the workshop. The discussion often turns to what makes the problems we are looking at difficult – and it’s usually hidden assumptions and under-researched topics. The first session on “Human Behaviors” surfaced the following topics (for which I managed to record a few short bullet points and questions).

Overview on future research perspective on human behavior in smart data space presented by Yannis Bertrand

Decisions

  • Identifying decision points matters but is difficult
  • Decision points are needed for example for scoping prediction tasks correctly and identify relevant input features: decision points need to be included as they significantly influence outcomes
  • Decisions are difficult to discern (in human behavior): conscious choice based on clear recorded context conditions vs non-determinism due to lack of clear context
  • decision vs non-determinism: try to find features that could explain a choice (needs a lot of domain knowledge and deep analysis) vs explicitly model uncertainty in the absence of sufficient knowledge/data
  • Decisions in human behavior are also often driven by time-outs
  • Choice to behave differently can also be choice to interrupt work or steps and return later -> this is a different kind of decision
  • Decision support: Decision conditions > may not have enough data -> ask user whether to make decision in particular situation of knowledge is not complete from data

Goals

  • Andrea Burratin mentioned: maybe when analyzing human behavior we should rather focus on sub-goal of composition of bigger goals, as goals drive human behavior
  • this would ask us to shift the focus of process mining from activity-level to goal-level
  • interestingly, human activities and business activities differ in the explicitness and structure of goals —> intention mining is an interesting field to explore here
  • Identifying and understanding goals does need us to explore and capture the larger context of process activities (other processes, behaviors going on need to be mined/discovered as well)
  • this raises an interesting question of how to conceptualize a process: (1) Process = behavior happening toward a specific goal vs (2) Process = behavior happening in a specific context
  • Goals also change and goals are conflicting -> which goals is now the most important, urgent —> but also other factors play a role
  • Human actors make take decision to NOT do something or to NOT to facilitate a particular goal
  • Human actors also take actions also based on motivations not considered goals or goals outside the process/organization context

ERP systems as systems human actor-driven systems

  • Can’t we perceive an ERP system not as a process-oriented system but rather as a system where human actors “move forward” by jointly working on a number of related data objects?
  • Actors are free to behave in ERP systems and do various things, the process is what emerges from this
  • This specific view on the process is supported by event knowledge graphs.

How do Event Graphs help analyzing Event Data over Multiple Entities?

Classical event logs have the fundamental shortcoming of describing process behavior only in isolated process executions from the viewpoint of a single case entity. Most real-life processes involve multiple entities and process executions are not isolated but tightly connected – through actors and entities involved in multiple executions. This post summarizes how event graphs are a better model to describe and query such dynamics. I explain the basic ideas and how to construct a graph from an ordinary event table. By Dirk Fahland.

Classical event logs – the basis for all process mining – use a case identifier attribute to study the behavior in a trace: group all events with the same case identifier value and order them by time. We then can study the temporal ordering of process activities along the sequence of events to get insights into the process. The most basic temporal relation is the directly-follows relation: in a trace <e1,e2,e3,e4,e5,…> event e4 directly follows event e3.

But most real-life event data has more than one case identifier attribute. This forces to either leave out events or directly-follows relations or to squeeze events under a case identifier where they don’t really belong.

Sequential Event Logs over Multiple Entities

Consider the event table shown below. It has the standard event log attributes: action, time(stamp), but lacks a case identifier column that is defined for every event.

Event Tables of IT Servicing Process

Most real-life event data is like this in their source system. The event data above most likely originates from three different tables

  • Component
  • Ticket with a foreign key to Component
  • Change with a foreign key to Component

Creating a classical event log that contains all the events is impossible – unless one is willing to accept false information such as event duplication, or false directly-follows relations. For example, if we engineered a case identifier that separates events according to the horizontal line in the above table,

  • there seems to be rework with Update twice in the second case while the Update events occur on two different Components thus only on Hotspot 36 the activity Update is repeated,
  • there seems to be an Update in the first case after Close Ticket already occurred
  • the Update event in Change C4 at 21-06-2020 11:10 would no longer directly follow the Update event in Change C4 at 20-06-2020 10:40.

All this together makes it hard to answer the following question: Which problems preceded (possibly caused) the final Update on Laptop 24?

In the following, we explain how a graph-based structure based on the concept of Labeled Property Graphs allows to naturally describe this data. With the graph-based model, we can avoid introducing false information and better answer questions like the cause for the final update on Laptop 24.

What is a labeled property graph?

A labeled property graph has nodes and edges (called relationships).

  • Each node has one or more Labels that give the node a type. We will use the labels Event and Entity to model events and entities.
  • Each edge (relationship) has a Label that semantics to the relation between nodes. We will use the labels DF (one Event node directly follows another Event node) and CORR (one Event node is correlated to a specific Entity node).
  • Each node and each relationship can have multiple properties (attribute-value pairs)

By using relationships between nodes in a graph, each Event can be correlated to multiple Entity node and each Event nodes can have multiple preceding and succeeding Event nodes (via DF) allowing model multiple DF-paths (one per entity).

Here is how you can construct such an event graph using these concepts.

Step 1: Import all events

Every event record in the input event table becomes an Event node. Every attribute of the event record becomes a property. We get the following graph of just Event nodes with properties.

Event Graph after importing event records into Event nodes

Step 2: identify and materialize entities

In classical event log construction, we now would pick a unique case identifier column.

In event graph construction, we now identify which attributes refer to entities – and there can be multiple in the data. We pick the ones we are interested in.

  • In our example, we pick Ticket, Component, Change as entity identifier attributes.
  • For each value of an entity identifier attribute, we create an Entity node of this type and id, and
  • For each Event node referring to this entity, we create a CORR edge (relationship) from the Event node to the corresponding Entity node.

This results in the following graph.

Event graph after adding Entity nodes with CORR relationships.

Note how most events are correlated to more than one entity.

Step 3: construct directly-follow edges per entity

In classical event logs, all events related to the same case identifier are ordered by time into a trace.

In an event graph, all events correlated to the same Entity node (via CORR edges) are ordered by time and we create a directly-follows DF edge between any two subsequent events. We store in the DF edge properties for which entity each DF edge holds. Doing this for the Entity node for Ticket = 11 results in the following graph.

Event graph after adding DF edges for Entity Ticket=11

We obtain a DF-path over three events from Problem Report via Investigate to Close Ticket. This DF-path states: “Entity Ticket=11 observed the sequence <Problem Report, Investigate, Close Ticket>”.

We have to do this for each Entity node for which we want to study behavior. The image below shows all resulting DF-paths over all events for all entities, but for readability we show only the CORR edge to the first event of a path.

Event graph after adding all DF-paths for all entities Ticket 11,12, and Component Laptop 24, Hotspot 36, Hotspot 36-2, and Change C2, C4

Done. This graph fully describes the behavioral information contained in the original event table using local DF-relations per entity.

What does the event graph show?

Looking at the DF-paths, we can directly see

  • We have 2 similar Ticket paths <Problem Report, Investigate, Close Ticket> and <Problem Report, Investigate, Investigate, Close Ticket>
  • We have 2 Change paths only involving Update events but differing in the number of Update events.
  • we have 3 separate Component paths following 3 completely different variants <Problem Reported, Investigate, Update, Update, Update>, <Problem Reported, Investigate, Update>, and <Update, Update, Investigate>

The striking difference in complexity of paths for the three different component types can be explained by the very different nature of the entities.

  • A Ticket is what is closest to a classical case entity describing a process execution for a relatively structured process, i.e., it captures the problem analysis process triggered by a user until the problem is solved.
  • A Component is not a typical case entity because it is a persistent object that exists beyond process executions. It typically comes back in many different process executions. Just our example is a bit too short to show another problem, say with Laptop 24. Also actors/resources fall into this category. As a result, their DF-paths will most likely follow more unique variants – requiring other kinds of analysis than typical process discovery.
  • A Change is a bit similar to a process execution entity, but a change behaves differently than a Ticket. It is more unstructured (various kinds of Update events further specified by the Note attribute).

We do see the different natures back in the way the different DF-paths synchronize in the graph.

  • A component is “visited” by Tickets and Changes at various points/moments, e.g., Hotspot 36-2 is first visited by Change and then by a Ticket, while Laptop 24 and Hotspot 36 are first visited by a Ticket followed by a Change.
  • A Ticket path (starting with Problem Reported) leads to a Change path starting two events later on the same Component.
  • Tickets can work on a single Component (11 -> Laptop 24) or on multiple Components (12 -> Hotspot 36, Hotspot 36-2).
  • While the first Change path (C2) only touches a single Component, the second Change path (C4) touches three different Components. Rework happens when a Change path touches the same Component multiple times (in this example even on 2 directly-following events).

There is more behavioral information that can be inferred in this graph, for example the dependency of Close Ticket for Ticket=12 on the final Update event of Laptop 24. Doing so requires to infer relationships between two Entity nodes and to materialize a relationship as a new derived Entity node, say between Ticket 12 and Laptop 24. We then can analyze the behavioral dependencies between two entities. How to do this is explained in this paper: https://doi.org/10.1007/s13740-021-00122-1

Can we query the graph?

Event graphs based on labeled property graphs can be stored in a graph database system such as neo4j, which allows to query the graph using a graph query language.

For example, if we want to answer our earlier question “Which problems preceded (possibly caused) the final Update on Laptop 24?” we can write the following Cypher query

MATCH
(e1:Event {Action:”Problem Reported”})-[:DF*]->(e2:Event {Action:”Update”}),
(e1) -[:CORR]-> (t1:Entity {type:”Ticket”}),
(e1) -[:CORR]-> (c1:Entity {type:”Component”}), 
(e2) -[:CORR]-> (c2:Entity {type:”Component”})

WHERE 

NOT EXISTS (e2) -[:DF]-> (:Event)

RETURN e1,e2,t1,c1,c2

This query matches a DF-path from a Problem Reported event e1 to an Update event e2 where e2 may not have any subsequent event (there is no outgoing DF relationship). It returns e1,e2 and the ticket t1 and component c1 correlated to e1 and the component c2 related to e2.

Applied on our example graph, it will return two matches as highlighted below: e1 matches once with Problem Reported for Ticket 11 and once with Problem Reported for Ticket 12.

Problem Reported events which are a possible cause for the final update event

Note that the first matching path only uses DF-edges of one entity (Laptop 24) while the second matching path uses DF-edges of two different Entities (Change C4 and Component 36).

The above query is very limited: it works only for one specific Update event, it does not return the actual paths, and it does not collect the different results. All of these limitations can be overcome by extending the Cypher query.

How can I get started? What else can I do?

The following open access paper https://doi.org/10.1007/s13740-021-00122-1

  • Defines the full model of event graphs. It gives precise semantics to the labels Event, Entity, DF, CORR (and several others).
  • Provides Cypher query templates to construct event graphs from ordinary event tables.
  • to query event graphs for behavioral properties and
  • to construct directly-follows models over multiple entities in a graph database.

A complete implementation for importing 5 public event logs into event graphs is available here: https://doi.org/10.5281/zenodo.3865221

Here are 5 fully prepared event graphs from 5 different public event logs, both as Neo4j database dump and as GraphML file to import and analyze.

This paper uses event graphs to identify task patterns in processes by analyzing how DF-paths along cases and DF-paths along resources synchronize. https://doi.org/10.1007/978-3-030-85440-9_13

This paper uses event graphs to model and analyze patient care pathways with multi-morbid patients. https://arxiv.org/abs/2110.00291

Guide to Multi… Process Mining talks at ICPM 2021 workshops

Process Mining over multiple perspectives, dimensions, objects, entities, abstraction levels, etc. is gaining a lot of attention in the process mining field in 2021. If you want to learn more about the emerging topics in Multi… Process Mining, this short guide has you covered for the workshop day (1st Nov 2021) of the 3rd International Conference on Process Mining 2021 in Eindhoven https://icpmconference.org/2021/. By Dirk Fahland

I may have missed a talk. I made this overview is to the best of my understanding of the various announcements or prior knowledge on the presenters’ works. Let me know if I missed your talk that is also related to Multi… Process Mining.

The morning 9:00-10:15

ML4PM http://ml4pm2021.di.unimi.it, 1st Nov 09:00 – 10:15

Mahsa Pourbafrani, Shreya Kar, Wil van der Aalst and Sebastian Kaiser. Remaining Time Prediction for Processes with Inter-Case Dynamics, https://twitter.com/pads_rwth/status/1447848232986480640?s=21

Andrea Chiorrini, Claudia Diamantini, Alex Mircoli and Domenico Potena. Exploiting Instance Graphs and Graph Neural Networks for next activity prediction, https://iris.univpm.it/handle/11566/292094

PODS4H, https://pods4h.com, 1st Nov, 9:00-10:15

“Verifying Guideline Compliance in Clinical Treatment using Multi-Perspective Conformance Checking: a Case Study.” By Joscha Grüger, Tobias Geyer, Martin Kuhn, Ralph Bergmann and Stephan Alexander Braun.

The morning 11:00-12:15

ML4PM http://ml4pm2021.di.unimi.it, 1st Nov 11:00 – 12:15

Mahmoud Shoush and Marlon Dumas. Prescriptive Process Monitoring Under Resource Constraints: A Causal Inference Approach, https://arxiv.org/pdf/2109.02894v1.pdf

EdbA http://edba.science/program/, 1st Nov, 11:00-12:15

Tobias Brockhoff, Merih Seran Uysal, Isabelle Terrier, Heiko Göhner and Wil van der Aalst. Analyzing Multi-level BOM-structured Event Data.

SA4PM https://sa4pm.win.tue.nl/2021/program/ 11:00-11:25

PErrCas: Process Error Cascade Mining in Trace Streams, Anna Wimbauer, Florian Richter, and Thomas Seidl, https://sa4pm.win.tue.nl/2021/wp-content/uploads/sites/3/2021/10/ICPM2021_paper_150.pdf

PODS4H, https://pods4h.com, 1st Nov, 11:00-12:15

“Discovering care pathways for multi-morbid patients using event graphs.” By Milad Naeimaei Aali, Felix Mannhardt and Pieter Jelle Toussaint. https://twitter.com/milad_n_a/status/1446112238759153664?s=21

The afternoon 14:00-15:00

PQMI2021, http://processquerying.com/pqmi2021/, 1st Nov, 14:00-15:00

Celonis PQL: A Query Language for Process Mining, Jessica Ambros

The afternoon 15:45-16:15

PQMI2021, http://processquerying.com/pqmi2021/, 1st Nov, 15:45-16:05

An Event Data Extraction Approach from SAP ERP for Process Mining, Alessandro Berti, Gyunam Park, Majid Rafiei and Wil van der Aalst, https://twitter.com/pads_rwth/status/1447552080831471626?s=21

EdbA http://edba.science/program/, 1st Nov, 15:45 – 17:15

Plenary Workshop Discussion on behavioral analytics and event data beyond classical event logs.

The only problem with this fully packed workshop program is: it’s impossible to follow all talks as a single person.

There is a lot more on Multi… Process Mining coming on the other days of the conference https://icpmconference.org/2021/events/ in research, tool demos, the industry day l, the XES 2.0 workshop, and at the vendor booths.

Multi… Process Mining at ICPM 2020 shown by Industry

By Dirk Fahland.

Here is a list of activites by the Process Mining vendors at ICPM that I have seen in the program that – in my view – will have a relation or show use cases for Multi… Process Mining.

  • ABBYY, Thursday, October 8 – 12:30h: “Logistics – Application of process intelligence beyond one system of record”
  • Celonis, Thursday, October 8 – 13:00 “Language for Processes” (Celonis’ process query language inevitably will touch on looking beyond event data in a trace). 15:45h: “New Teaching Case Studies for Process Mining in Audit and Accounting”. Possibly also Celonis’ Process Query
  • EY, Thursday October 8 12:45 “Process Mining in auditing”, 16:15 “Working Capital Management” (repeated Firday October 9 twice)
  • MyInvenio, Presenting Multi-Level Process Mining throughout their product demos on 7th, 8th, and 9th October
  • UiPath, Thursday Oct 8 13:00-13:30 – Data Transformation & Connectors (data extraction and transformation from complex source systems for process analysis)
  • LanaLabs, Thursday Oct 8, 1.30pm – 1.50pm: Use Case P2P & LANA Connect (data extraction and transformation from complex source systems for process analysis) + Oct 9 on-demand Tool Demos.

It seems that Thursday 9th October 12:30-14:00 is high-noon for Multi…Process Mining of the process mining vendors at ICPM.

I may have missed some relevant events – if I did, let me know in the comments.

Artifact-Centric Process Mining for ERP-Systems with Multiple Case Identifiers

By Dirk Fahland.

Analyzing processes supported by an ERP system such as Order-to-Cash or Purchase-to-Pay are one of the most frequent use cases of process mining. At the same time, they are one of the most challenging, because the processes operate on multiple related data objects such as orders, invoices, and deliveries in n:m relations.

Event log extraction for process mining alays flattens the relational structures into a sequences of events. The top part of the following poster illustrates what goes wrong during this kind of event log extraction: events are duplicated and false behavioral dependencies are introduced.

Poster summarizing process mining on ERP systems

A possible way to prevent this flattening is to extract one event log per object or entity in the process: one log for all orders, one log for all invoices, one log for all deliveries. The result is a so-called artifact-centric process model that shows one “life-cycle model” describing the process activities per data object.

But analyzing the process over all objects also requires to extract event data about how objects “interact”. Technically, this can be done by extracting one event log per relation between two related data objects (or tables). From these, we can learn the flow and behavior dependencies over different data objects.

Decomposing the event data in this way into multiple event logs ensures that event sequences either follow one concrete data object or follow a concrete relation between two related related data objects. The resulting model only contains “valid flows”.

More

Performance Spectrum for Analyzing Business Processes

By Dirk Fahland.

In this post, I show how simple data visualizations help understanding the multi-dimensional nature of processes. Even the most simple classical business processes have important dynamics that cannot be understood by cases in isolation.

The Performance Spectrum was originally designed to deliver a useful process map for analyzing logistics processes over time. When applying the same technique to business process event data, the performance spectrum proves equally useful as it unveils process characteristics that were so far hidden by existing process mining tools:

  • performance of business processes actually varies greatly over time,
  • different cases are much more influencing each other (and are influenced by external mechanisms such as shared resources or policies) that previously shown,
  • processes not only have multiple variants in control-flow but also multiple, overlapping variants in performance,
  • different processes have very different performance spectra, but processes from a similar domain show similar performance spectra.

To support and trigger further research in this area, we released a smaller-scale version of the Performance Spectrum Miner enabling the analysis of business process event logs. The platform independent (requiring JRE8) tool is available as a

Examples of Performance Spectra

Below, we show some performance spectra of publicly available event logs.

Road Traffic Fine Management process

In the figure below, we see the typical process map or model of the Road Traffic Fines Management Process event log on the left. It describes the possible behavior of handling a single case (a traffic ticket). The arc width and annotations tell how long it takes a case to go from one activity to the next.

On the right we see the Performance Spectrum of this process. Each horizontal stripe describes the transition between two activities – called a segment. Each colored diagonal or vertical line is a case passing through this segment over time. The longer and more diagonal the line, the longer the case took.

Performance Spectrum of the main variants of the road traffic fine management process

We can immediately spot very different patterns in each of the segment, clearly showing that the cases are not handled in isolation, but something manages their progress. We can see

  • Payments from traffic offenders happening at various rates, and changing density
  • Multiple incoming cases being batched together during the “Send Fine” step and afterwards being processed individually (non-batched again)
  • While some “Send Fine” steps are being executed immediately
  • Penalty is being added after a fixed delay leading to a FIFO behavior in the process
  • However, cases arrive at the “Add Penalty” step in larger groups at irregular intervals leading to emergent batches of penalty notifications – with different success in the speed of payment
  • Credit collection always happening in larger batches for cases not paid 6 months prior

Looking at a single event log, we can see that even a classical process over a single entity (a traffic ticket) is subject to dynamics beyond the scope of a single case.

The Credit Application process of BPIC12

We can see

  • A weekly working pattern where most process steps are concluded on Monday-Friday the same day and mostly in FIFO order, though some work takes place for some steps on Saturdays
  • However several steps also show violations to the FIFO behavior and longer waiting times spanning more than one day
  • Cases and work that is coming in on the weekend and overnight is being processed the very next working day early on

The same Credit Application process 5 years later in BPIC17

  • The weekly working patterns seen in BPIC17 remain, but more steps show
  • violations to the FIFO behavior.
  • In addition, we can observe batching, for example in the O_Accepted step taking place every month, although some cases are not included in the batch and processed immediately.
  • Cancellation after an offer was sent follows mostly a FIFO pattern, but with variable delays
  • The aggregated performance spectrum shows a lot of variability in the workload in the process, with some very unusual peaks in offers being created and later on cancelled over a longer period of time.
  • Towards the end of the dataset, the performance spectrum shows significant improvement in performance of the process across several steps (most cases there are now handled in the bottom quartile than in the top quartile)

The building permit processes of BPI15

  • The performance spectra of the two logs from two different municipalities are very similar to each other, but are very different from the previous logs.
  • The overall throughput per day is much lower.
  • Most cases are processed across the steps in a FIFO manner, though not following a strict working week pattern, and cases are handled on the same day across multiple steps.
  • Processing seems to happen in stages where certain steps are performed for all cases together for a certain period of time, while there is no activity in other steps at the same period.

Your turn!

What can you find in the Performance Spectra of the other public event logs, or your own data? Get the Performance Spectrum Miner from http://www.promtools.org/ or from https://github.com/processmining-in-logistics/psm  and try it out!

The Performance Spectrum

Dirk Fahland

One of the core challenges of process analytics from event data is to enable an analyst to get a comprehensive understanding of the process and where problems reside.

In business process mining such an overview is obtained with a process map. It can be discovered from event data to visualize the flow in the process and highlight deviations and bottlenecks.

Process maps of logistics processes do not give these insights: they are too large to comprehend, the maps do not visualize how processing of materials influences each other, and – as they show an aggregate of all event data – they fail to visualize how performance and processing varies and changes over time.

In the “Process mining in Logistics” project by Eindhoven University of Technology and Vanderlande, we therefore developed a new visual analytics technique which we call the Performance Spectrum:

  • The performance spectrum maps out process dynamics for all steps and all cases over time, by adding a “time axis” to the process map.
  • The performance spectrum visualizes each case and each step over time individually allowing analysis to see how materials and cases of a process are handled together and how they influence each other.
  • The explicit visualization of all cases together reveals how process deviations and short- and long-term performance problems evolve over time and influence each other.

The image below shows the performance spectrum of a baggage handling system along a sequence of check-in lines over time. Bags are put into the system at point a1 and then are moved via conveyor belts to point a2. Each blue or orange line in the top-most segment a1:a2 in the performance spectrum shows the movement of one bag from point a1 to point a2 over time. The angle (and color) of the line indicates its speed.

Performance Spectrum of Check-in Aisles in a Baggage Handling System

As shown on the layout schema below, further bags enter the system from another check-in point a2 and are also moved to point a2, where both flows merge on the segment a2:a3, etc. All bags eventually reach the point “s” from where the bags are routed further into the baggage handling system. In the performance spectrum, we can see the movement of a bag over these segments through the consecutive lines.

Layout of Conveyor Belts in Check-in Area of a Baggage Handling System

As bags cannot overtake each other on a conveyor belt, we can immediately identify in the performance spectrum several behavioural patterns:

  • Normal operations, for example in the left part of the performance spectrum, show how bags flow tougher from the check-in points to point s, each segment having its own speed, and no bags are overtaking each other.
  • Repeated operational problems can be seen in the segment a2:a3 (orange-slanted lines) where the conveyor belts are halted for a certain period, leading to significantly delayed processing, to no flow in segments a3:a4 and a4:a5, and to backwards queuing in segment a1:a2, while segment a5:s is unaffected as the bags coming from a5 can move freely.
  • After the short-term performance problems are resolved, the system shows recovery behaviour under high-load as the system resumes to normal operations, visible by a large number of bags (many lines close together) moving two times slower than normal (light blue).
  • Moreover, the repeated performance problem was already briefly visible in a2:a3 in the initial phase (showing a group of bags moving 3x slower than normal).

The visualization allows process managers and engineers to both quickly locate the cause of the problem to prevent it happening in the future. In particular the briefly-visible performance problem in a2:a3 prior to the halt of the conveyor belt can be identified as an early warning signal to detect possible performance problems in the future, and also to understand and improve system recovery behavior.

We realized this technique in a high-performance visualization tool which we call the Performance Spectrum Miner. It has proven itself reliable to:

  • analyze very large amounts of event data (of over 100 million events),
  • quickly identify temporary process deviations in very large processes,
  • quickly locate short- and long-term performance problems as well as gradual and abrupt changes in process performance,
  • identify the root-cause of performance problems and deviations in logistics processes occurring only under certain conditions.

We released a smaller-scale version of the tool (as a ProM plugin or as standalone tool) together with a manual on  https://github.com/processmining-in-logistics/psm.

More information