Tibco Cep Whitepaper

7/28/2019 Tibco Cep Whitepaper

1/14

Complex EventProcessing

Framework for OperationalVisibility and Decisions


2/14

COM P LEX EVEN T P ROCESS IN G2

TABLE OF CONTENTS

1 IntroductIon .........................................................................3

2 cEP: concEPts .........................................................................4

3 cEP: challEngEs ......................................................................7

4 tIBco BusInEssEvEnts: cEP softwarE...............................8

5 rElatIonshIP to othEr tEchnology InvEstmEnts ....11

6 conclusIon ...........................................................................13

7 aBout tIBco ...........................................................................14


3/14


1. Introductionspie i e i i bie. tke k e e pie

from the last ve years: the Enron scandal, the Worldcom bankruptcy, restatement

of revenues from multinational corporations, massive nancial fraud, earnings

shortfalls, the iPod success and the list goes on and on. These unexpected

developments range in effect from inconvenient to disastrous or, in the case

of pleasant surprises, opportunities. As a result of these developments, there

is an increased emphasis on corporate governance and regulatory compliance

requirements such as the Sarbanes-Oxley Act of 2002, the Patriot Act, the Basel II

or the Container Security Initiative (CSI).

Now more than ever, CEOs, CFOs and other decision makers must be connected

to the everyday events and occurrences throughout their enterprises. These

enterprises, in turn, require real-time insight and a reporting infrastructure for all

decision makers and/or decision enablers. There are at least two challenges in

meeting this requirement. First, most IT infrastructures cannot handle the volume

of events generated as part of daily operations in real-time. Second, most IT

infrastructures are incapable of maintaining relationships among discrete granular

events from various IT and business layers across the enterprise and correlating

those events with historical context.

The rst challenge is addressed by using TIBCOs industry-leading real-time

infrastructure. Since the late 1980s, TIBCO has pioneered real-time business,

starting with the integration and delivery of market data on the trading oors of

large banks and nancial services institutions.

The second challenge is addressed by complex event processing (CEP). TIBCO

BusinessEvents provides comprehensive CEP capabilities for real-time

operational insight enabling timely, well-informed decisions.

This technology lets organizations manage risk more effectively and prevents

industry dissonance when market realities outpace corporate strategies by

making smarter, well-informed operational decisions every minute of every day.

This paper reveals the concepts, applications and technology behind TIBCOs CEP

ei.


4/14


2. CEP: ConceptsComplex event processing (CEP) is by no means a revolutionary concept. In

our lives, we apply CEP to many facets of our routine, whether it is driving to

work where we are reacting to trafc ow changes or at work where we are

accommodating changing project deadlines and dealing with unexpected

circumstances. In each case, we attempt to interpret the events of everyday life

in the context of our current understanding of the way things should be. This

concept of should be is really a conscious attempt to pattern an acceptable

scenario where we avoid unpleasant surprises or take advantage of fortuitous

opportunities. The constant evaluation of singular or multiple occurrences (events)

in the context of expected behavior and acceptable parameters is the basis of real-

time decision-making and scenario prediction. This correlation of events, current

and past, is an essential decision analysis component of the human brain. CEP

introduces this same mechanism to electronically capture known event patterns for

automating part of the decision making process in an enterprise.

Prior to introducing the concepts of CEP, it would be worthwhile to illustrate a few

examples of what CEP can do:

A technician is dispatched to a customer location and the customer cancels

the order. At the same time, another customer in a nearby location places an

order. The technician is dynamically re-routed to the new customer.

A frequent traveler, who almost always requests hotel room upgrades, checks

into a hotel and forgets to ask for an upgrade. At the registration desk, the

manager says I see that you typically stay in our suites, we have an upgrade

to an executive suite available for $20 additional charge.

Web site users are proactively provided with shopping and auction menus

based on previous navigation events that constitute their specic web site

and content behaviors.

A brokerage notices unusual call option activity from a brokerage customer

who has never traded in options or futures. This unusual activity triggers

trading limits based on velocity and magnitude of trades for the brokerage to

manage risk and alerts customer service so that they can proactively contact

the customer and verify the transaction.


5/14


Program traders need the exibility to execute various strategies to capitalizeon opportunities. For example, If the stock price of X moves above 2% of the

volume weighted average price (VWAP) and stock price of Y moves below 2%

of VWAP, then sell 1000 shares of X and buy 5000 shares of Y. The ability to

capture real-time events and present those events in context gives traders a

better understanding of market changes and the ability to respond quickly to

those changes.

A pallet of pharmaceuticals is in transit within the logistics supply chain

and needs to be recalled for quality control purposes. Radio frequency

identication (RFID) location and pallet identication events are tracked and

the pallet is intercepted prior to breakdown and retail distribution.

A global telecommunications provider is supporting numerous product-

bundle packages that have unique Quote-to-Cash elements and processes

imbedded. As new packages are released, customers dynamically change

their selections, options, installation, terms and conditions (including invoked

Service Level Agreements) in response to their changing needs. Event-driven

processes interactively respond to changed conditions and requirements and

reect appropriate package assembly, deployment and billing to the customer

and the service provider.

An independent power operator notices peak load changes across the powergrid that have the potential to disrupt large portions of the user community.

These operational, real-time events are understood to fall into a pattern that

is recoverable based on dynamic allocation and load management across the

grid. No subsequent outage is experienced.


6/14


The CPU and memory utilization of a cr itical application server has beentrending upwards for the last 10 minutes. These real-time IT events correspond

to potential shutdown of the application server and based on historical context

dynamically allocate additional IT resources to prevent disruption of service.

There is a common pattern behind these varied problems and opportunities from

the business and IT world. These problems represent a new genre of applications:

event-driven applications that make automated decisions based on a pattern of

events and also provide a rich environment for the analysis of real-time events in

combination with the rich historical context from traditional data warehouses.

There is very little argument against the relevance or importance of theseproblems to any enterprise, IT or business. Every business would want to catch or

predict exceptions and detect opportunities at the earliest possible moment. What

is missing from the current infrastructure is a mechanism to dene surprises at

an enterprise level. What is missing is a mechanism to dene event chains that

identify what is normal, compliant or expected. What is missing is a mechanism

to instrument and collect events at a granular level not only within the enterprise

but across the extended value chain. What is missing is the correlation of real-time

event streams with the historical context.

An enterprise-ready CEP solution needs to have the following characteristics:

Integration ready: As the number of event sources and applications grows

with the increased demand for faster execution of processes, organizations are

in dire need of new technologies that can help them manage the complexity

of their environment. The events organizations have access to are not always

tailored to the problems they are trying to solve, said David Luckham,

Stanford University Professor and author of The Power of Events. Integration

technology is a key to success for developing any CEP application.

Scalable: RFID, wireless sensors, web site tracking are all examples of sensor

technologies that are at various stages of deployment. Scalability, horizontal

and vertical, is a critical requirement in order to handle the high throughputevent volumes.

Distributed agent-based architecture: In contrast to the hub-and-spoke

model, this architecture requires edge agents to have local decision making

abilities. In RFID scenarios, the local edge agents correlate the events from


7/14


multiple readers, detect incorrect reads and forward the legitimate events to thenext layer.

Real-time reporting and analysis: CEP is primarily focused on detecting

modeled patterns in an event stream. One of the challenges is the discovery

and evolution of models and patterns. The solution needs to provide a visual

environment for the analysis and mining of events for patterns and root causes.

Automated attendants: In conjunction with real-time reporting and analysis,

the solution should provide an infrastructure to automate decisions once

models and patterns are discovered. This is traditionally addressed by Event-

Condition-Action (ECA) type of rules.

Enterprise worthiness: A solutions ability to support a multi-user

development environment, version control, and lifecycle management, while

often ignored, is the key to success for an enterprise-wide deployment of CEP.

3. CEP: Challenges

EVENTS: ARE THEY AVAILABLE?

It is often mentioned that events needed to anticipate surprises or catch

opportunities do not exist. As recently as ten years ago this may have been apartially valid objection. The current reality, however, is that the events are there,

although they are often not in the hands of the right person. Because of the vast

investment in business process reengineering, business process management

(BPM) and enterprise application integration (EAI), many organizations know more

than ever about their own workows. They know what each individual is doing in

the business process, be it taking an order, compiling a report or driving a rivet.

The constant ux of RFID events requires real-time analysis to optimize these

processes by using an intelligence layer. In addition, with the advent of RFID-based

intelligent sensor networks, the events can be captured with the semantics of time

and location at a granular level. The presence of these events, if utilized well, can

be used to optimize the business processes at a local and/or a global level.

EVENTS: ARE THERE WARNINGS?

More often than not, warnings precede threats or opportunities. The important

rst step is instrumentation of the enterprise to collect and correlate the events

with the respective business processes. An application server exhibiting a

constantly increasing CPU and/or memory utilization can be interpreted as a


8/14


warning for the server shutdown. The fact is that this is a known patternone veryrarely detected as a warning but more commonly used in an after-the-fact analysis.

4. TIBCO BusinessEvents: CEP Software

TIBCO BusinessEvents provides the following sophisticated CEP capabilities:

A model to capture expected outcomes

A way of detecting variances using a combination of the presence and/or

absence of events

A model for responding to the detected variances

CONTEXTUAL MODEL FOR CAPTURING EXPECTED OUTCOMES

In order to meet or exceed service levels, all of the service participants are

expected to operate within known tolerances. A deviation in any component can

potentially affect downstream components thus resulting in service disruption.

The business rules and constraints required to govern any service according to the

service levels, required to capture the exceptions in any process ow, required to

dynamically interact with customers based on the known customer behavior are

easily represented and maintained using a model driven approach in contrast toa pure rules driven approach. TIBCO BusinessEvents provides a UML compliant

modeling framework to capture the static and dynamic relationships between the

participants.

CONCEPTUAL MODEL: CAPTURE THE STATIC RELATIONSHIPS

This model is loosely based on UML class-relationship concepts and provides

a mechanism to capture the semantics of static relationships. In a Service Level

Management example, application A composed of services S1 and S2, deployed

on server X can be represented as four concepts A, S1, S2 and X connected by

static relationships is composed of and deployed on. In addition to modeling

the semantics of the relationship, the model can capture the transitivity of certainrelationships such as depends on or composed of. This is extremely useful in

reducing the redundancy of the model.

STATE MODEL: CAPTURE THE DYNAMIC RELATIONSHIPS

This state model is completely based on UML state-charts and provides a

mechanism to capture the semantics of dynamic ows such as a package ow


9/14


across a network of hubs or an order ow through many internal systems andpartners. The state model is a context for modeling the known states and

outcomes in various scenarios. The context is created by specifying correlation

rules that are a function of the presence and/or absence of events.

AGGREGATION MODEL: CAPTURE THE CONTEXT OF RELATED EVENTS

Though the state model provides a r ich context for the event chains leading up to

an exception, an alert or an opportunity, it does not provide the historical context

required for operational decisions. For instance in a nancial trading example, if a

stock dips below its exponential 50-day moving average, then sell the stock. This

example requires TIBCO BusinessEvents to maintain or retrieve the aggregate.

TIBCO BusinessEvents provides two modes for aggregates:

Internal mode: In the internal mode, TIBCO BusinessEvents provides a

mechanism to dene aggregation rules and populate either static scorecards

or dynamically versioned instances. For instance, a rule can be congured to

maintain a 50-second moving average of all the stocks in a portfolio.

External mode: In the external mode, TIBCO BusinessEvents provides a call

out mechanism to external databases and data warehouses as part of the rule

execution. For instance, average orders/day for a certain customer can be

obtained from the data warehouse and a rule such as Orders for the day

Documents

Tibco Cep Whitepaper