Complex Event Processing
Event-Driven Computing: An Introduction
Peter Niblett, Senior Technical Staff Member, IBM
Dr. Opher Etzion, Senior Technical Staff Member, IBM
Editor's note: ebizQ readers can save 30% on any version of Event
Processing in Action (print edition or ebook) from www.manning.com.
Simply use the promotion code "ebizq30" when checking out.
Some people say that event processing is the next big thing; some people say
that event processing is old hat and there is nothing really new in it.
Both groups may be right to a certain extent. As with any field that is relatively
new there is some fog around it: some of the fog stems from misconceptions,
some from confusing messages by vendors and analysts, and some arises because
of a lack of standards, a lack of agreement on terms, and a lack of understanding
about some of the basic issues.
Some examples of event-driven computing
Event-driven computing is not new. In the early days of computing, events appeared
in the form of exceptions whose role was to interrupt the regular flow of execution
and cause some alternative processing to happen.
For example, if a program tried to divide by zero, an exception event would
be raised that enabled the programmer to end the program with an error message,
or to perform some corrective action and then continue with the computation
process. Later on, events featured in Graphical User Interface systems (such
as Smalltalk or Java AWT) where UI components ("widgets") are designed
to react to UI events such as mouse clicks or key presses.
In this book we are mainly concerned with computing events that correspond
to events that occur in the "real world." Here are some examples that
also show the benefits of automated event processing; these examples show different
types of processing.
Example 1: A patient is hooked up to multiple monitors that either continuously
or periodically perform various measurements on the patient. The measurements
take the form of events which are then analyzed by an Event Processing system.
A physician can configure this system, on a patient-by-patient basis, so that
a nurse is alerted if certain combinations of measurement are detected within
a certain time period, and so that if other combinations occur then the physician
herself is alerted. This example demonstrates the use of event processing for
Example 2: In an airline luggage handling system an RFID tag is attached
to every piece of luggage. There are RFID readers in various places where the
luggage moves (sorting device, cart going to the aircraft, aircraft's unloading
dock and more).
Events from the RFID readers are analyzed to provide luggage control alerts
such as: luggage is going on the wrong cart; luggage did not arrive at the aircraft;
luggage did not even arrive even at the sorting device; as well as an alert
that the luggage approaching the carousel. This example demonstrates the use
of event processing for detecting and eliminating exceptions within a processing
Example 3: A manufacturing plant with restricted access zones uses RFID
tags to monitor compliance with safety regulations. Each person working or visiting
the plant carries an RFID tag, and an RFID reader in each zone generates an
event when it detects the presence of that person.
These events can then be analyzed to detect safety violations: simple ones
like a person entering a zone where they are not authorized, or more complex
ones like an authorized person working unaccompanied in a zone which requires
the presence of two or more authorized people. This example demonstrates the
use of geospatial event processing for observation about policy violations.
Example 4: A social networking site which starts a multi-party chat
when five people from a group are online. In this case an event occurs when
a person goes online or offline. Event Processing is used to analyze these events
so as to decide when to start a chat session. This example demonstrates the
use of event processing for real-time collaboration.
These examples are somewhat different from one another, but all of them follow
the same pattern: events are reported, sometimes by multiple sources, and some
processing of the events is performed.
This processing can be made up of several phases and at the end it creates
additional events that are consumed by event consumers. The producers of the
events may be different from their consumers -- in Example 2 (he luggage management
system), the check-in process emits an event when luggage is initially deposited
and various RFID readers then emit events about the movement of the luggage
in the system. The consumer could be either the luggage controller or even the
In the next section we provide a classification of event processing systems
according to their business use.
What are the reasons for using event-driven computing systems?
Real-time operational behavior: A common reason for using event-driven
computing systems is to be able to change the behavior of the system dynamically
in order react to react to incoming events. Matching auction buyers and sellers
is an example of this type; the result of the match then determines the subsequent
flow of the system. Another example is automatic re-routing of luggage when
a passenger's itinerary changes.
Observation: Another reason to use event-driven computing systems is
to look for exceptional behavior and generate alerts when such behavior occurs.
In such cases the reaction, if any, is left to the consumer. The job of the
event processing application is just to produce the alerts. Examples of observation
are regulation compliance systems, as well as the patient monitoring system
Information dissemination: A third reason for using event-driven computing
systems is to deliver the right information to the right consumer in the right
granularity at the right time -- in other words, personalized information delivery.
Examples of this type are personalized alerts from banking systems, and the
emergency system sending alerts to first responders.
Active diagnostics: Here the goal of the event processing application
is to diagnose a problem, based on observed symptoms. A mechanical failure case
is such an example; a help-desk system is another example.
Predictive processing: Here the goal is to indentify events before they
have happened, so that they can be eliminated or at least have their affects
mitigated. A fraud detection example is of this kind.
These different classes of use are not exclusive to each other; a specific
application may fall into several of the categories that we have listed.
About the Authors
Peter Niblett is an IBM Senior Technical Staff Member, working on the architecture and design of IBM's Messaging and Event Processing products. He led IBM's participation in the definition of the Java Message Service (JMS) programming interface, and chaired the OASIS Technical Committee that developed the Web Services Notification standard. He is a member of the Event Processing Technical Society, where he is in the process of convening its Interoperability workgroup. Peter has a degree in Mathematics from Oxford University and is a member of the IBM Academy of Technology. In 2004 he was one of the five IBM leaders recognized by the United Kingdom's Royal Academy of Engineering receiving the MacRobert Award for the WebSphere MQ family.More by Peter Niblett
Dr. Opher Etzion is the chair of EPTS (Event Processing Technical Society), an IBM Senior Technical Staff Member, and the Event Processing Scientific Leader in the IBM Haifa Research Lab. Previously he has been lead architect of event processing technology in IBM Websphere, and a Senior Manager in IBM Research; prior to joining IBM he worked as a programmer, system analyst, consultant, researcher and manager in various organizations, specializing in rule-driven applications. He is an adjunct professor at the Technion - Israel Institute of Technology, and has authored or co-authored around 70 papers in refereed journals and conferences, on topics related to: event processing, active databases, temporal databases, rule-base systems, and autonomic computing. He also co-authored the book "Temporal Database - Research and Practice", Springer-Verlag, 1998.More by Dr. Opher Etzion
IBM is the world's largest information technology company, with 80 years of leadership in helping businesses innovate. Drawing on resources from across IBM and key IBM Business Partners, IBM offers a wide range of services, solutions and technologies that enable customers, large and small, to take full advantage of the new era of on demand business. For more information about IBM, visit http://www.ibm.com.