technology / correlation_engine

AMI Operational Correlation Engine

Eight classes of source system, one ordered timeline per device — and cause derived from sequence rather than assumed from symptom.

the_problem

A dozen dialects, none of them comparable

A smart metering estate produces events in a dozen incompatible dialects. A meter reports a power-fail with its own timestamp and clock drift. A head-end reports a communication failure minutes later, after its retry policy is exhausted. A network operator reports a cell sector degradation on a different clock entirely. MDMS reports an estimated read the following day. None of them are wrong, and none of them are comparable.

The correlation engine is the layer that makes them comparable. It ingests events from every source, normalises identity, time and severity, orders them into a single sequence per device and per group of devices, and then derives cause from that sequence — which event preceded which, across which boundary, affecting how many devices in the same place.

ingested_sources

What the engine correlates

Operational evidence is only conclusive when it spans every boundary a fault can hide behind.

Source
01MetersReads, registers, load profiles, power-fail and tamper events, clock status, firmware state — across DLMS/COSEM and vendor-specific behaviour.
02Head-end systemsJob outcomes, retry sequences, queue depth and latency, per-device session history, from any number of concurrent HES platforms.
03Communications networksCellular, RF mesh, PLC, satellite and hybrid telemetry — signal quality, sector and concentrator state, SIM and bearer status.
04MDMSValidated, estimated and edited reads, VEE outcomes, and the settlement consequences of missing data.
05GISLocation, feeder and topology context, so a cluster of failures becomes a geographic and electrical fact rather than a list.
06ADMSNetwork operations context — planned work, switching, outages — that explains metering symptoms without a fault.
07SIEMSecurity events correlated against operational ones, so an access anomaly and a command failure are visible on one timeline.
08BillingThe commercial consequence of unresolved data: which accounts, which value, which regulatory exposure.
correlation_pipeline

Six stages from raw event to retained evidence

Each stage is deterministic and auditable, so a conclusion drawn today can be re-examined and defended months later.

11 — Identity resolution

The same device is known by different identifiers in each system: meter serial, device ID, SIM ICCID, MPAN/MPRN, asset number. The engine resolves them to one canonical device so evidence from eight systems lands on one object.

22 — Temporal normalisation

Timestamps are reconciled across source clocks, time zones, drift and reporting delay, separating when something happened from when a system noticed. Ordering survives late-arriving data.

33 — Semantic normalisation

Vendor event codes and severities are mapped onto common operational meaning, so a comparable fault from two manufacturers is genuinely comparable.

44 — Spatial and logical grouping

Devices are grouped by concentrator, cell sector, feeder, site and tenant, turning individual symptoms into population-level signals.

55 — Causality chaining

Ordered, grouped, normalised events are chained into a cause hypothesis with the supporting evidence attached — not a score without a reason.

66 — Evidence retention

The chain is retained as an auditable record, so the conclusion can be reviewed months later by an operator, an auditor or a supplier.

operational_outcome

What correlation changes in the operations console

The engine exists to change what happens next, not to produce a richer report.

02 / 04

Remote-first resolution

Because cause is established before dispatch, the remote diagnostic and remote action path is exhausted first and the truck roll becomes the residual case, not the default.

next_layer

Correlation needs consistent meaning

Ordering events is only half the problem. The semantic information model is what makes a register or an event code from one vendor genuinely comparable to another's.

Information model
next_step

See your estate in smoc.cloud.

A demo walks through your utility types, your vendors and your compliance obligations — not a generic slide deck.