2 nd Event Processing Symposium

1. Military Scenario Use Case 7-9 October 2006 Hosted by Oracle 2nd Event Processing Symposium • Dr. Opher Etzion • Greg Porpora

2. Use Case Detailed Description • This Use Case will represent a Defense – Naval Real-time Complex Event Processing flow across the entire Enterprise of a Naval Combatant from Sensors to Command & Control (C2) to Weapons depicting the complex flow of information and events necessary for the ship to sense, track, assess, engage and destroy an incoming missile threat. The scenario will be unclassified, simplistic and representative to only a general/notional sense of actual Naval weapon systems. • The scenario will depict and examine the interacting relationships of events and information across multiple time epochs and systems throughout our imaginary ship.

3. Phased Array RADAR C2 ECM Missile Launcher ss ms µs RT- ESB RT EDA-SOA Detailed Naval Scenario Description This scenario represents a sequence of events necessary for a Naval ship to defend its self against a missile threat. This ship has 10 seconds to react and destroy the missile, in that time our Real-Time Event Driven Architecture must assess, correlate, transform, enrich and route a multitude of complex event streams across three time epochs from sensors to command and control (C2) and finally weapons across its associated Real-time Enterprise Service Bus (ESB). Impact point RAM Silkworm SPD : 820 mph = 1203 ft/sec SPD : 1000 mph = 1467 ft/sec 1000m = .5 NM 6000m = 3 NM T0 + 10 sec T0 T0 + 3 T0 + 1 T0 + 2 T0 + 4 t0 T0 + 5 T0 + 8 T0 + 6 T0 + 7 T0 + 9 Destroy Detection Normal Ops Correlation Classification Tracking Validation Assess Confirm Task Execute COMMAND & CONTROL (C2) SENSORS WEAPONS

4. Sensors Time Epoch: 500us – 2ms Detailed Use Case Event Flow

5. Command & Control (C2) Time Epoch: 2ms – 250ms Detailed Use Case Event Flow

6. Weapons Time Epoch: 1us - 500us Detailed Use Case Event Flow

7. High Level Missile Engagement Flow Command & Control Command and Control Phases 2 - 7 Sensors Total Time Sequence ~ 5000 ms Medium Performance ESB Phased Array RADAR AREPS GCS INTELL Track Manager Medium Performance ESB PC-IMAT High Performance ESB Medium Performance ESB GRS Electronics Counter Measure System NITES II High Performance ESB CADRTS Weapons Phase 1 Threat Engagement Processor Total Time Sequence ~ 1250 ms Missile Control System Vertical Missile Launcher High Performance ESB Phases 6 - 10 Total Time Sequence ~ 750 ms

8. Multiple domains of time-dependent control Non-real time Logistics seconds Command & Control milliseconds Tracking microseconds Radar Weapon

9. Analyser An SCA modellers view Meteo Geospatial Data Geospatial subsystem Nav Intelligence management subsystem Geospatial Collaborator SITU processor Geospatial Replication C2 subsystem Radar subsystem DPE1A Tracking subsystem DPE5 Mission Doctrine Module DPE6 ECM subsystem DPE3 DPE4 DPE2 Fuser Track Module DPE1U DPE8 DPE7 Threat engage WCS Missile launcher Sonar subsystem Weapons subsystem

10. Intelligence Management System Meteorological & Ocean Environment Processed Data Situational Awareness Processor Global Track Federation and Fusion Processor Weapon Engagement Manager Environment Prediction Analysis For Weapons Electronic Counter-Measure System Ships Navigation Data Track & Mission Doctrine/Policy Geo-Spatial Collaboration Processor Multi-Display System Threat Engagement Processor Threat track Analyzer Geo-Spatial Replication Service Underwater Detection Sonar System Weapon Resource Scheduling Multimode Phased Radar Missile Controller Weapon Selector Global Command & Control System Maritime High Level Weapon System Context Diagram Common Operation Picture Filtered Intelligence Non-Organic Inputs All Tracks overlayed on Geo-Spatial Context Track Classification Doctrine Updated as needed Integrated/Fused Geo-Spatial Content Air & Surface Tracks Track Classification Doctrine Updated as needed Air & Surface Tracks Underwater Tracks Selected Threat Tracks Surface Tracks Threat Tracks Prioritized/Selected Threat Tracks Non-Organic Inputs

11. Seconds : Near Real-Time Milliseconds : Soft Real-Time Time Epochs Microseconds : Hard Real-Time C2 Weapons ISR CEP Finder Decider & Connector Shooter The Complex Event Processing engine within an Event Driven system’s Enterprise Service Bus (ESB) must be able to recognize event patterns across the functional and technology gradients of an ecosystem to the lowest level of determinism and route the aggregated results.

12. Complex Event Processor Complex Event Processing and Event-based Architecture Support Event Source Filtering; Temporal and causality constraints Validate Aggregation; event-data join Enrich Transform Create “complex event” Intelligent routing; content-based routing; event-driven flows Route Service invocation; alert; dynamic flows Operate Event Consumer Summary of activity over 1 hour

13. eF2 eF2 eF1 eF1 CEP Action CEP Action CEP Action CEP Action Node: Sn Node: S3 Node: S2 Node: S1 eF3 eF3 Node: ISR1 Node: ISRn eS1 eSn eS2 eD1 eS3 eD1 Node: C21 Node: C22 FINDERS • Intelligence • Surveillance • Reconnaissance DECIDERS • Command & Control SHOOTERS • Weapons Connector Infrastructure Deep Sensor and Historical data Reach Near Real-Time Hard Real-Time Soft Real-Time

14. High level Event Processing Flow for Naval Use Case (FINDERS) (SHOOTER) (DECIDER) Second(s) ESB Millisecond ESB Microsecond ESB EP 1 EP 3 EP 5 Sensor 1 E[Alert Confirm] E[Alert Track] Track Data Compute Intercept Point Assign asset Sensor 2 Sensor 3 Fire Intercept Missile E[Alert trigger (Ax)] E[Alert Track] IFF(AT) Trigger Sensor 1 ASSET 1 Alert Trigger A1orA2orA3 Sensor 2 Assets That can Intercept ASSET 2 Sensor 3 E[Intercept Asset (Asn)] EP 2 ASSET n EP 4 Total Time from Detect to Engage = 10 seconds

15. Problem Space • Inability to manage Latency and Determinism • Lack of tools • Large Data ingest • High message traffic • Large Legacy Domain • Lack of temporal interlock • Complexity or perception • Ability to abstract • Domains for determinism is a relative term • Reactive versus proactive • Take RT Event and compare against massive amount of history • Simple patterns • Making incremental change based on incremental pieces of data • Must think of the problem at different levels of the stack (Vertical versus Horizontal)

16. Problem Domain at a High level - Continued • With these three key parameters (Bandwidth/Communication, Memory, CPU processing) how do we architect an EDA IT infrastructure that can meet the Deterministic latencies required to intercept the Missile. • However, if we examine the end to end Missile engagement process it is a very large Stochastic Process whereby there is only a probability of achieving RT Determinism • The most critical constraint is provision in the face of either high data ingest or faults • How do we degrade gracefully in this situation…. How do we trade off Urgency of processing versus importance • How will your system perform in the presence of overload and resource starvation ( Shed Load, lockup, etc.) • It is not good enough to just reduce priorities or make something a higher priorities, Resource management and provisioning play crucial role here this goes for memory, CPU and BW). Also not all processes can be arbitrarily stopped some provide critical admin and support services that must continue to execute otherwise we run the risk of catastrophic system collapse • This problem is not unlike a futures market whereby you ensure against risk by over provisioning • We work well on a per single node bases but when executing multiple JVM’s on a single CPU resource provision and scheduling become more complex.

17. Value of Using RT Event Processing • In specific Domain Spaces i.e. DoD can not meet 2010 Mission Requirements without RT CEP • Address the latency Gap • Become more proactive to predict future events • Modelling based on historical data and current understanding of event cloud to predict near term outcomes with updating for continuous learning • Real-time is relative term depending on required predicted outcome • Extract to higher levels of abstraction for inference

18. Market Drivers, Motivators, Challenges and Entry Points • Drivers • Predictability • Adaptability • Dynamic • Latency and Determinism management • Motivators • Tactical as well as strategic information advantage • Get inside competitive decision loop • Challenges • Legacy Integration • Cost • Complexity • Entry Points • Start small

19. Where do we go from Here ? • Better understanding of respective Domain space requirements and constraints • Standards • Tools • Modelling • Development • Trace and Monitoring