**3.5 Detailed algorithms description**

The system at runtime is fast and accurate in identifying possible anomalous situations of a machine tool. It consists of a pre-processing step (to be performed only once, when the program starts) which has the purpose of building the entire data structure (the dictionary of all messages with their relative alert level) and an actual processing step.

The system is independent on the dictionary size. It reads the input text, consisting of one or more messages, one character at a time and scrolls through a finite automaton; when it encounters a final state (corresponding to the end of a message), it emits the alert level associated with that message. The number of state transitions is proportional to the number of characters read in input.

The steps are:

**Pre-processing**. The system builds the data structure that the algorithms will use when running. Pre-processing only needs to be done once, at startup. In particular, the system constructs, in the central memory, a finite state automaton from all the elements of the dictionary, and its behavior is completely determined by a (small) set of states and by some simple functions.

**Matching**. The finite state automaton continuously reads the messages from the input log file, character by character. When it reaches a final state, the automaton shows the alert level of the message corresponding to this state. The algorithm is able to identify all occurrences of all messages, even if they were partially or totally overlapping. Lines with no messages (i.e. with "blank" content) are ignored.

**Analysis**. In this step, the system analyzes a set of alert levels identified in the previous phase. Normally, it analyzes a group of alarms, usually those issued in a period; then, based on the frequency and "severity" of the alerts extracted, it makes a classification of the health of the machine. The system warns if the analysis of the message cluster indicates a possible future malfunction of the machine tool. The system can also provide an immediate response if a single alert is very critical.
