Sriram Karthik Badam, University of Maryland College Park, sbadam@umd.edu PRIMARY
Christoph Kinkeldey, Inria, christoph.kinkeldey@inria.fr
Petra Isenberg, Inria, petra.isenberg@inria.fr
Student Team: NO
Approximately how many hours were spent working on this submission in total?
30
May we post your submission in the Visual Analytics Benchmark Repository after VAST Challenge 2016 is complete?
YES
Video
https://dl.dropboxusercontent.com/u/110166980/vast2016-mc2.mp4
Glossary
P-zone: Proximity zone --- value written as "floor.zone" (e.g., 1.2 for floor 1, zone 2)
E-zone: Energy zone
What are the typical patterns visible in the prox card data? What does a typical day look like for GAStech employees?
To answer this question we first made a few assumptions:
A typical day for starts between 7 and 8:00 and ends between 17:00 and 18:00.
Average time of the first and last logins of the day for the departments with relatively consistent workweek arrivals and departures: administration, engineering, executive, HR, security.
Facilities members tend to start work in one of the three shifts shown below while Information Technology members work either in shift a) or b).
a) 7/8:00 to 17:00/18:00
b) 16:00-midnight
c) midnight-7/8:00am
Average time of first and last login of the day for sub-groups within the Facilities and Information Technology Departments.
The typical movement pattern on weekdays looks as follows:
The employees enter the building through the main entrance (floor.zone 1.1) between 7:00 and 8:00am and use the elevators or stairs (floor.zone 1.4) to get to their offices. At noon, many have lunch at the Deli on the first floor (floor.zone 1.2) and then return to their offices. In between, it is common that employees move to the zones with meeting rooms such as zone 2.6. Around 17:00 they leave their floor via the elevator / stairs again and the building via the main entrance. Figure shows example movement of Walton Reynoso (yellow) in Engineering (office 2450) and Lise Carrara in Administration (office 3420), against the overall movement patterns of all employees (blue).
Some members in Facilities and Information Technology enter the building through the main entrance (floor.zone 1.1) in the evening between 4:00 and 6:00pm. They use the break room (floor.zone 2.1) a few times and return to their offices. Around midnight, they leave their floor via the elevator / stairs again and the building via the main entrance. Figure shows an example movement of Effie Davies in Facilities (office 2655).
Jae Unger (junger), Lucas Alcazar (lalcazar), or Twana Quiroz (tquiroz) use their first badge until a certain point and then switch to a new one. Employee Geneviere Florez (gflorez) from Administration even has the fifth badge in use (‘gflorez005’).
The reason for badge switching could be that employees lost, forgot, or broke their badge and obtained a new one as their badges are not reused again.
Employee Unger switching to a new badge (junger002) on June 9 (area marked in red). The chart shows location data from the fixed sensor (blue) and the mobile sensor (orange). The x-axis represents time (June 8 to 10) and the y-axis the proximity zones (labeled as “floor.zone”) categorized by badge (junger001, junger002).
In other cases an old badge is reused again. For example, Valeria Morlun (morlunv) from Facilities uses the badge ‘morlunv002’ only on June 2 and uses the first one again from June 3. This may be because she had left her badge at home and got a temporary one for this day.
Temporary use of a badge (morlunv002) on June 2 (area marked in red).
Clemencia Whaley in Engineering (office 2560) did not check the badge when leaving the building (or forgot the badge in her office) on multiple days (May 31, June 1, 8, 9, 10). Isak Baza in Information Technology (office 2145) did not use his badge when leaving the building on May 31. Adan Morlun, Valeria Morlun and Dante Coginian in Facilities do not check their badges when leaving on a couple of days.
Employees forgetting to swipe/check their badges when leaving the building (or leaving their badge in the building) highlighted with arrows. Figure shows the movement patterns of Adan Morlun (orange), Valeria Morlun (red) and Dante Coginian (purple).
Describe up to ten of the most interesting patterns you observe in the building data. Describe what is notable about the pattern and explain what you can about the significance of the pattern.
Limit your response to no more than 10 images and 1000 words.
Grounding Assumptions:
Outline of the Island of Kronos from the VAST 2014 dataset
Temperature set points for cooling (blue) and heating (orange). The gray bar indicates a recommended office temperature range for locations with the climate of Kronos.
In addition to the temperature setpoints being set to a relatively warm temperature, the data shows that Floors 1 and 2 seem to be controlled using the same or very similar settings. Several zones on Floor 3 differ slightly but Room 3000 has a completely different pattern. This room is notable as it contains the Hazium sensor.
Groups of temperature setpoints for different zones on each floor. The top row groups all setpoints for Floor 1 and 2. The second row shows the different pattern for room 3000 on the third Floor - which likely would make the room very hot (~30C) during the day.
Checking the temperature for room 3000 we can see that it turns very hot during during the afternoons starting on June 2nd. Since the pattern continuous it is likely not an anomaly and that this was done upon request - this has been confirmed by checking the executive’s presence who has been assigned to this office.
Average temperature in room 3000 exceed by far the comfortable range (in grey) during the afternoons after June 1st.
Energy usage in the building is fairly regular in the building with weekends being clearly visible. This indicates that equipment it set to lower power consumption modes when not in use. Floor 3 draws the most power - due to the server room (3440).
Energy usage per floor in the building. The weekends of June 4/5 and 11/12 are clearly visible.
Many zones on Floor 2 have equipment on until late in the evening ~10-11pm every day. This may be due to Floor 2 hosting the offices of Facilities employees working late at night.
Describe up to ten notable anomalies or unusual events you see in the data. Describe when and where the event or anomaly occurs and describe why it is notable. If you have more than ten anomalies to report, prioritize those anomalies that are most likely to represent a danger or serious issue for building operation. Limit your response to no more than 10 images and 1000 words.
The temperature set points for heating and cooling were abnormal on June 7th and 8th. Most zones were set to cool down to 15C until 7am when the cooling setpoint was increased to ~30C on both days. Similarly the heating set point was set to ~12C until 7am and to ~26C during the day while the outside temperature which remained relatively high but regular throughout the analyzed time period (~26-28C). Since the setpoint changes happen at 7am on two days in a row, we can likely exclude malicious tampering with the air conditioning or system malfunction. It is more likely that the set points were changed purposefully to experiment with new settings. Yet, was this change effective?
The building’s inside temperature on all floors exceeded the upper limit of 25.5C recommended for office buildings in high-humidity climate zones shortly after 7am on both days.
Average temperature on each floor of the building. The gray bar indicates acceptable temperature levels. During the day on June 7th and 8th the acceptable temperatures were exceeded dramatically on all floors.
These excess indoor temperatures but affected equipment such as the server room on Floor 3 (E-Zone 9). Interestingly, the server room’s cooling (~30C) and heating (~27C) set points were set to higher than the recommended ranges for data centers (18-27C) during the day - subsequently on June 7th and 8th several cooling cycles were necessary to get the room’s temperature below the cooling setpoint.
Server Room Temperatures were outside of recommended limits on June 7th and 8th.
CO2 levels in our dataset were close to health critical limits of 5000ppm on June 7th and 8th. In particular E-Zones 14 (meeting room 2700) and 11 (corner offices) were affected. In addition, we assume ~1200ppm as the limit before people are bothered by body odors in the air. This critical limit was reached on June 7th and 8th on all floors - in particular Floor 2 Zones, 14,11,10,15,9,5 (in order of decreasing maximum concentration).
CO2 concentration in the building; average for each floor (top image) and the most affected E-zones on Floor 2 (bottom image). The red band indicates ppm rates that pose a health risk while the gray band indicates levels of CO2 that may be experienced as uncomfortable.
Why did the high concentration occur? Perhaps the fans were not working correctly?
The Mass Flow Rate falls rapidly on June 7 and 8 when CO2 levels start to raise. The timeline of changes is as follows:
What remains unclear is WHO changed the settings for the setpoints? As it is unclear where the controls are located and who has access, we cannot attempt to answer this question.
The unknown chemical Hazium has several spikes throughout the period. If they ever reached critical level is unclear. There does not seem to be a clear correlation between Hazium and other sensor values in the respective zones in the data.
Hazium concentration for the four sensors in the building. Each row represents one floor.
Employee Patrick Young (pyoung) from Facilities uses a new badge ‘pyoung002’ starting at June 2 while keeping similar activity patterns as before. At the same time, his old badge ‘pyoung001’ is still in use - but with different patterns. It never seems to leave the building after the new badge was created.
Old badge (pyoung001) still used after new one was created (pyoung002) but showing a different pattern than before (marked in red).
On four days (June 2, 3, 8, and 10) from about 10:20 am, ‘pyoung001’ moves from the second floor via the elevator or the stairs to the third floor, and through P-zones 3.1 and 3.3 to the server room (around 10:21am). After a couple of minutes, the person leaves and returns to the second floor.
Before ‘pyoung001’ is used, ‘pyoung002’ is in P-zone 3.1 and 3.3, and after that, ‘pyoung002’ enters P-zone 3.1 again on June 3 and 10.
June 3 and 10: badge ‘pyoung002’ is situated in P-zone 3.3 and not used while ‘pyoung001’ is active.
On June 2 and 8, both badges enter P-zone 3.1 (hallway) at the exact same time, which is at 10:25:12 am. Before and after that, badge ‘pyoung002’ is located in Zone 3.3.
Badges ‘pyoung001’ and ‘pyoung002’ enter P-zone 3.1 at the same time (10:25:12 am).
From June 3, the mobile sensor detects the badge ‘pyoung001’ daily between 9 and 9:30 am in P-zone 6 on Floor 2 in Room 2700 (Mtg/Training). But in the fixed sensor data there is no log for the given time span. We hypothesize that Room 2700 is accessible without swiping in, so there are no traces in the proximity data. For server room on Floor 3, the person has to use the badge in order to get access and thus is registered. On June 3, 8, and 10, after being detected in Room 2700 by the mobile sensor, the person using badge ‘pyoung001’ leaves for the server room on Floor 3 via P-zone 2.4.
The robot detects badge ‘pyoung001’ close to room 2700 every working day from June 3 between 9 and 9:30.
These observations suggest that something suspicious is going on with the badge ‘pyoung001’:
Scenario 1: Patrick Young uses the badge himself to enter the server room on Floor 3. He might be trying to hide his activity by using his old card that is tagged as lost / stolen.
Scenario 2: Another person has Young’s old badge and enters the server room coming from floor 2. Since both old and new badges are located in the hallway (P-zone 3.1) at the same time on two days, it might be that they meet and enter the server room together while Young leaves his badge in his office.
Describe up to five observed relationships between the proximity card data and building data elements. If you find a causal relationship (for example, a building event or condition leading to personnel behavior changes or personnel activity leading to building operations changes), describe your discovered cause and effect, the evidence you found to support it, and your level of confidence in your assessment of the relationship. Limit your response to no more than 10 images and 1000 words.
(Confidence in Assessment: 90%)
Equipment in offices 3400 | 3410 | 3420 | 3430 (E-Zone 10, Floor 3) was turned on, drawing more power on Sunday, June 5 around 1:10pm. According to the proximity data, Lise Carrara (lcarrara001) was the only one working on June 5 between 1 pm until around 3 pm. Her office is 3420, making her the likely source of energy usage.
Equipment were on on the weekend Saturday June 11 at 9:10am and again on Sunday June 12 at 8:10am in E-Zone 8, Floor 3 (offices 3200, 3210, 3220, 3230). According to the proximity data the person entering was Strum (3200, Executive).
In addition E-Zone 2 (offices 3100,3110,3120,3130,3140,3150,3160) saw equipment turned on at 8:40am. Only Bramar (3100, Administration) - 8:30am checked in and accessed rooms in Zone 2.
On the two weekends (green bands) equipment on Floor 3 was turned on in E-Zone 2 (top row), E-Zone 8 (middle row), and E-Zone 10 (bottom row), likely by Bramar,, Strum, and Carrara respectively.
(Confidence in Assessment: 60%, due to missing data and assumptions on comfort levels)
At around 10am, the levels of CO2 in the building had reached the discomfort threshold for most zones on Floor2. At the same time temperatures rose above 26C making the environment quite hot - at least for an office building. Interestingly, the employees did not seem to notice as they keep their regular work patterns and do not - as would be expected - leave the building or go to another floor to work. In particular Floor2, P-Zones 6 and 7 should have been affected but see regular badge check-ins and similar behavior as on any other day.
This unusual lack of effect on the data may mean that the CO2 levels were actually not felt as discomforting as general guidelines would suggest.
Floor2 - P-Zone 6 and 7 were affected the most by high office temperatures and uncomfortable CO2 levels. Yet, employees kept working in these areas throughout both days.
(Confidence in Assessment: 60%, because it is unclear from where the HVAC system is actually controlled)
The (probably) stolen badge ‘pyoung001’ enters the server room on four occasions on
June 2, 10:21, June 3, 10:22, June 8, 10:21, and June 10, 10:22. The sensor data for the server room does not show an immediate regular reaction to these entry times, so it is unlikely that pyoung001 just flipped a switch. However, it is certainly possible that he/she changed future settings or tempered with settings elsewhere - IF the server room also hosts the HVAC controller.
Sensors in the server room on Floor 3 and the suspicious entry times of pyoung001 (red lines). There is no regular clear correlation between the entries and changes in sensors. Possible the damper was modified on June 3rd and 8th but our confidence in this assumption is low.
