DATA RELATED TO AN INCIDENT

Technical field

The present disclosure relates generally to a control server, a wireless device and methods therein, for handling data related to an incident such as an accident, a criminal action, a riot, or other abnormal event that has occurred.

Background

In the field of wireless communication, it is becoming increasingly common to employ so-called Machine-to-Machine, M2M, devices, also known as Machine Type Communication, MTC, devices, for monitoring an area or a component by performing various measurements and observations. The M2M devices typically report their measurements and observations over a wireless network, to be processed by some central control server or the like which may be operating in a cloud environment. An M2M device may for example be configured to measure and report some metric or parameter of potential interest, such as temperature, pressure, light, movements, sound, air or water pollution, to mention a few illustrative examples. M2M devices are sometimes also referred to as Internet of Things, loT, devices.

It is not uncommon that M2M devices are configured to operate automatically and autonomously by reporting considerable amounts of data on a regular basis. This data is maintained in the control server for a time before the data is considered to be out-of-date and is therefore discarded. Even though M2M devices are mentioned in some examples, the description is also valid for other types of wireless devices such as smart phones, tablets and laptops or any devices that send data to a control server over a wireless network. The more generic term

"wireless device" will therefore be used herein.

When an incident with "negative" or harmful consequences is detected, such as an accident, a criminal action, a riot, or other abnormal event, data that has been reported prior to the incident by wireless devices potentially affected by the incident can be analyzed in order to evaluate the incident and acquire knowledge about what has caused or otherwise influenced it. This knowledge may be useful for dealing with similar incidents in the future, and even to prevent that they occur. For example, if a rise in temperature of a certain machine component has been reported, this component may be identified as the cause for a fire that broke out shortly afterwards. In another example, detection of sudden movements at a certain location may be helpful for investigating a subsequent burglary.

The collection of such data that has been registered and reported by wireless devices is typically made in a sliding window-based manner. This means that the data that has been reported within a time window of a certain predefined size is maintained by the control server while other data that becomes old enough to fall outside the sliding time window is discarded so that the amount of maintained data is fairly constant and does not grow endlessly.

It is nevertheless a problem that huge amounts of data reported by numerous wireless devices on a regular basis must be stored and processed until it falls outside the sliding time window. The amount of maintained data can be reduced by choosing a shorter time window but then some relevant and useful data may be missing once an incident occurs. The choice of window size is thus a tradeoff between the amount of maintained data and usefulness of the data. A technique for using adaptive window size depending on how fast the reported data changes and becomes out-of-date is described in the article "Learning from Time-Changing Data with Adaptive Windowing" by Bifet & Gavalda of Universitat Politecnica de Catalunya, published 17 October 2006.

It is also a problem that large amounts of data are reported on a regular basis just in case it will be needed for evaluating some incident that has occurred. As a result, a large majority of the reported data will never be used for any evaluation or analysis when no incident occurs that needs to be investigated, by being discarded when becoming out-of-date, i.e. when falling outside the sliding time window. The reporting of data by transmission from wireless devices thus causes load on the wireless networks used while precious radio resources and processing and storing resources are used in the network, often to no avail. A certain amount of control signaling is also required each time a report is transmitted, thus causing further load on the network. Another problem is that the regular reporting of data consumes much energy in the wireless devices, thus draining their batteries rapidly.

Summary

It is an object of embodiments described herein to address at least some of the problems and issues outlined above. It is possible to achieve this object and others by using methods a control server and a wireless device as defined in the attached independent claims.

According to one aspect, a method is performed by a control server for handling data related to an incident. In this method when detecting that the incident has occurred, the control server identifies one or more wireless devices that are potentially affected by the incident. The control server then sends to the identified one or more wireless devices requests for data obtained by measurements and/or observations made within a time window before the incident has occurred. When receiving data from said one or more wireless devices in response to said requests, the control server provides the received data as a basis for evaluation of the incident.

According to another aspect, a control server is arranged to handle data related to an incident. The control server is configured to detect that the incident has occurred, and to identify one or more wireless devices that are potentially affected by the incident. The control server is also configured to send to the identified one or more wireless devices requests for data obtained by measurements and/or observations made within a time window before the incident has occurred. The control server is further configured to receive data from said one or more wireless devices in response to said requests, and to provide the received data as a basis for evaluation of the incident.

In the above control server and method therein, it is an advantage that a limited amount of relevant and useful data is sent from the one or more wireless devices since only data recorded within the time window is sent. Thereby, it can be avoided that excessive amounts of irrelevant and useless data are reported from the wireless devices to no avail, which in turn reduces the energy consumption, the usage of radio and network resources, and the amount of data to analyze in the evaluation.

According to another aspect, a method is performed by a wireless device for handling recorded data. In this method the wireless device receives from a control server a request for data obtained by measurements and/or observations and recorded within a training time window prior to an incident. The wireless device further detects anomaly of data recorded in successive candidate time intervals within said training time window if the data recorded in the respective candidate time intervals deviates from a normal range. Then the wireless device sends a response to the control server including the recorded data and an anomaly indication for each candidate time interval indicating whether the data recorded in said candidate time interval deviates from the normal range or not.

According to another aspect, a wireless device is arranged to handle recorded data. The wireless device is configured to receive from a control server a request for data obtained by measurements and/or observations and recorded within a training time window prior to an incident. The wireless device is also configured to detect anomaly of data recorded in successive candidate time intervals within said training time window if the data recorded in the respective candidate time intervals deviates from a normal range. The wireless device is further configured to send a response to the control server including the recorded data and an anomaly indication for each candidate time interval indicating whether the data recorded in said candidate time interval deviates from the normal range or not.

In the above wireless device and method therein, it is an advantage that the control server is able to determine the size of a time window based on the anomaly indications in the response sent from the wireless device, so that the time window can be used effectively for obtaining a limited amount of relevant and useful data from wireless devices recorded prior to any further incidents. Thereby, it can be avoided that excessive amounts of irrelevant and useless data are reported from the wireless devices to no avail, which in turn reduces the energy consumption, the usage of radio and network resources, and the amount of data to analyze when the incident is to be evaluated.

The above methods, control server and wireless device may be configured and implemented according to different optional embodiments to accomplish further features and benefits, to be described below.

A computer program storage product is also provided comprising instructions which, when executed on at least one processor, cause the at least one processor to carry out either of the methods described above.

Brief description of drawings

The solution will now be described in more detail by means of exemplary embodiments and with reference to the accompanying drawings, in which:

Fig. 1 is a communication scenario illustrating an example of how the solution may be employed, according to some example embodiments.

Fig. 2 is a flow chart illustrating an example procedure in a control server, according to further possible embodiments.

Fig. 3 is a signaling diagram illustrating an example of how the solution may be carried out, according to further possible embodiments.

Fig. 4 is a flow chart illustrating another example procedure in a control server, according to further possible embodiments. Fig. 5 is a flow chart illustrating an example procedure in a wireless device, according to further possible embodiments.

Fig. 6 is a communication scenario illustrating another example of how the solution may involve a training phase, according to some example embodiments.

Fig. 7 is a time diagram illustrating an example of how a training time window could be defined, according to further possible embodiments. Fig. 8A is an example scenario where wireless devices in different areas report data and anomalies prior to an incident, according to further possible

embodiments.

Fig. 8B is an example table with information reported by the wireless devices in Fig. 8A, according to further possible embodiments.

Fig. 9 is a block diagram illustrating a control server and a wireless device in more detail, according to further possible embodiments.

Detailed description

Briefly described, a solution is provided to enable efficient usage of relevant data when evaluating an incident that has occurred which may be an accident, a burglary or other criminal action, a riot, or any other abnormal event that is of interest to investigate so as to understand which circumstances have caused or contributed to the incident. This can be accomplished by obtaining and using only data that has been recorded during a limited time window prior to the incident, which data is of potential interest for the evaluation by deviating from "normal" data, while other data that is within a normal, i.e. expected range is not used. The time window may have a default duration or it may be determined by means of a training procedure or training phase, to be described below.

The solution involves functionality in a central entity which is termed "control server" herein, although other suitable terms could also be used such as "data collector", "incident evaluation support node", "device controller", or similar. It is assumed that multiple wireless devices, such as the above-described M2M devices although the solution is not limited thereto, may be operable to send data to the control server over a wireless network for evaluation of incidents once they have occurred. The solution thus also involves functionality in a wireless device that sends data to the control server according to the above-mentioned training procedure herein referred to as the "training phase". Once the time window is defined and settled, either by default or by training, the solution uses the time window for obtaining relevant data in a "usage phase". In this solution, the control server sends requests to one or more wireless devices for data collected within the time window prior to the incident. Thereby, the amount of data that is reported by the wireless devices in response to the requests can be reduced considerably by not reporting data of presumably no potential interest, e.g. by routine, thus reducing the traffic load on the wireless network and also reducing the energy consumption in the devices.

By only reporting data within a time window when requested instead of at regular intervals, will in itself reduce the total amount of reported data which is further reduced by only requesting data from devices that are potentially affected by the incident, e.g. by being located in a limited area near the incident spot. The control server also gets much less data to process and/or send to an evaluation function, as compared to conventional procedures, since the data received from the reporting wireless devices has been filtered to contain relevant and useful data within the time window and no presumably irrelevant or useless data collected prior to the time window.

It has been recognized in this solution that it can be assumed that data recorded by wireless devices prior to the incident which data deviates from a normal range is of potential interest for the evaluation since this data may imply that something unusual is happening. For example, an unusual rise in temperature at a machine component may indicate some malfunction of the machine's operation, or a temperature rise in a building space or the like may indicate how and where a fire has started. It is thus this kind of "unusual" data that should be reported by the wireless devices while the "normal" data is typically not necessary to report since it does not indicate that anything abnormal has happened. As indicated above, the time window and other filter parameters may be defined in an "intelligent" way by means of the above-mentioned training phase which can be performed in advance using multiple incidents when data may be reported continually and regularly by wireless devices according to the conventional behavior. When a deviation from the normal range is detected by a wireless device, the recorded data is reported to the control server with an "anomaly indication", which indicates that the reported data deviates from a normal range. For example, a measured temperature above 25C may be considered to be outside a predefined normal range of, say, 15C-25C. Other filter parameters that could be useful to define is the type of wireless device and the type of data collected by the respective device, which may be selected depending on characteristics and circumstances of the incidence.

In the training phase, the wireless device thus sends to the control server its recorded data together with an anomaly indication for different candidate time intervals indicating whether the data recorded in each candidate time interval deviates from a normal range or not. By repeating this procedure for multiple incidents, the control server can learn how large the time window needs to be to essentially encompass potentially interesting and relevant data while excluding the non-relevant data. The control server is thus able to define the time window to extend over the candidate time intervals for which the anomaly indication deviates from the normal range, which implies that the data recorded during those candidate time intervals are of potential interest for the evaluation. An example of how this training phase may be executed will be described in more detail later below.

Fig. 1 illustrates a communication scenario where the solution is utilized involving a control server 100 and a plurality of wireless devices 102 which are configured to collect data based on various measurements and observations, and to send collected data to the control server 100 as follows. A first action 1 :1 indicates that the control server 100 defines filter parameters, e.g. by default or in the training phase to be described below, to be used for controlling the reporting of data in the above-mentioned "usage" phase. The following actions thus occur in the usage phase in which the defined filter parameters are applied. The filter parameters specify at least the above-described time window, e.g. by specifying a start time and a stop time of the time window, and optionally also the type of wireless device and the type of data.

An action 1 :2 then indicates that an incident occurs, which is assumed to be of interest to investigate by evaluation of data recorded prior to the incident. Some examples of incidents have been mentioned above although the solution is not limited to any particular types of incidents. It is also assumed that the incident is somehow "detected" by the control server 100, e.g. by receiving a notification from a wireless device, an alarm function or from a person. How the incident is detected is basically outside this solution. In a next action 1 :3 the control server 100 identifies a number of wireless devices 100A that are potentially affected by the incident, which may include devices of a certain type and/or devices being located within a certain area that is presumably affected by the incident, and/or devices that perform measurements or observations that are likely to be impacted by the incident. For example, all devices located within a predefined distance from the incident may be identified in this action.

Having identified the wireless devices 100A, the control server 100 sends to the devices 100A requests for data obtained by measurements and/or observations made within a time window before the incident has occurred, as shown in another action 1 :4. Each request thus specifies the time window, e.g. in the form of filter parameters. Different devices may get different filter parameters while at least some of them may get the same filter parameters from the control server.

A next action 1 :5 illustrates that the control server 100 receives data from the wireless devices 100A in response to the requests. The reported data has thus been effectively filtered by the wireless devices 100A to contain only the data that has been recorded within the time window specified in the requests. Thereby, the total amount of reported data is considerably smaller than if non-filtered data is continuously reported on a regular basis according to conventional procedures, while the reported data should contain more or less relevant data for evaluating the incident. In a final action 1 :6 illustrates schematically that the control server 100 provides the received data to an evaluation function 104 which may be implemented outside or within the control server 100 itself, and the solution is not limited in this respect.

An example of how the solution may be employed will now be described, with reference to the flow chart in Fig. 2, in terms of actions performed by a control server such as the above-described control server 100, for handling data related to an incident. Some optional example embodiments that could be used in this procedure will also be described. Reference will also be made, without limiting the described features and embodiments, to the example scenario shown in Fig. 1 .

A first action 200 illustrates that the control server 100 detects that the incident has occurred. The control server 100 then identifies one or more wireless devices 100A that are potentially affected by the incident, as shown by a next action 202. In one example embodiment, the incident may be detected when notified by any of the one or more wireless devices 100A. In further example embodiments, the one or more wireless devices 100A may be identified based on at least one of location and type of the wireless devices 100A. For example, if a wireless device is operating in a fixed location, the device's location may have been pre-registered in the control server and it is necessary to be updated only if the device is moved to another location. For a mobile wireless device that is likely to move around when operating, the device's location may be reported by the device on a regular basis, or it may be obtained from a positioning center in the device's mobile network or the like.

In a further action 204, the control server 100 sends to the identified one or more wireless devices 100A requests for data obtained by measurements and/or observations made within a time window before the incident has occurred, which corresponds to the above-described action 1 :4. In further example embodiments, the requests for data may require different types of data and different sizes of the time window for the respective types of data. In this embodiment, one device may be requested to report data of a first type within a time window of a first size, while another device may be requested to report data of a second type within a time window of a different size than the first device. It is also possible to request different types of data and different sizes of the time window from one and the same wireless device.

In another example embodiment, the time window may be defined by filter parameters included in the requests for data, the filter parameters comprising a start time and a stop time of said time window. As mentioned above, the time window may be defined either by default or by performing a training procedure, i.e. the training phase. A training procedure for determining the time window will be described in more detail later below with reference to Figs 4-8A,B.

In a following action 206, the control server 100 receives data from the identified one or more wireless devices 100A in response to said requests, which

corresponds to the above-described action 1 :5. Finally, the control server 100 provides the received data as a basis for evaluation 104 of the incident, as shown by an action 208 which corresponds to the above-described action 1 :6.

It was mentioned above that a possibly moving wireless device may report its location to the control server 100 on a regular basis, so as to enable the control server 100 to identify any potentially affected wireless device(s) 100A when an incident has occurred, as of action 202. An example of how such a procedure may be employed is illustrated in the signalling diagram of Fig. 3 involving the control server 100 and a plurality of wireless devices 102 as also shown in Fig. 1 . Before the incident occurs, the wireless devices 102 report their current location and time to the control server 100 on a regular basis, e.g. once every minute, which is illustrated by actions 3:1 A, B, C, D ... which are thus repeated according to some predefined reporting scheme or the like.

Once an incident is detected as shown by another action 3:2, the control server 100 is able to identify the wireless devices 102A, also denoted D1 -D3, as being located within an area affected by the incident based on their latest location reports as of actions 3: 1 A, B, and C, in a following action 3:3 which corresponds to the above-described actions 1 :3 and 202. The control server 100 then sends requests with filter parameters to the identified wireless devices 102A/D1 -D3, as shown by actions 3:4A, B and C, which correspond to the above-described actions 1 :4 and 204. The filter parameters thus specify the Time Window, TW, required in the reports.

The control server 100 then receives data from the wireless devices 102A in response to said requests, as shown by further actions 3:5A, B and C, which correspond to the above-described actions 1 :5 and 206. The reported data has thus been recorded by the wireless devices 102A within the Time Window, TW as required by the respective requests of actions 3:4A, B and C. Finally, the control server 100 provides the received data as a basis for evaluation 104 of the incident, as shown by an action 3:6 which corresponds to the above-described actions 1 :6 and 208. As mentioned above, the evaluation may be performed within or outside the control server 100 depending on the implementation which is outside the scope of this solution.

It was mentioned above that the time window may be defined by means of a training phase. In one example embodiment, the filter parameters may thus be defined during a training phase involving multiple incidents, based on data recorded by at least one wireless device during a training time window before the respective incidents have occurred. In further example embodiments, the training phase may comprise:

- receiving from the at least one wireless device data recorded in successive candidate time intervals in the training time window after each incident and an anomaly indication for each candidate time interval indicating whether the data recorded in said candidate time interval deviates from a normal range or not, and

- defining the filter parameters based on the anomaly indications for said candidate time intervals.

In another example embodiment, defining the filter parameters may comprise updating said training time window to comprise the candidate time intervals for which the anomaly indication indicates that the data deviates from the normal range. In that case another example embodiment could be that updating the training time window is repeated after each incident until the training time window has been "stabilized" or "saturated", meaning basically that the size of the training time window has converged to a certain value after repeated updating whenever new incidents occur.

An example of executing the training phase will now be described in more detail, firstly in terms of actions performed by the control server 100 as illustrated in the flow chart of Fig. 4 where the control server 100 executes a training phase, A, based on data reports with anomaly indications from a plurality of wireless devices, and then a usage phase, B. The usage phase B corresponds basically to the procedure in Fig. 2 in which the already defined time window is used. In the training phase A, the control server 100 may receive reports continually from wireless devices of their recorded data regardless of whether any incident is detected or not. Some example embodiments of how the training phase A may be performed will also be described.

A first action 400 shows that the control server 100 detects that an incident has occurred. The control server 100 then sends requests to the wireless devices, in an action 402, for data with anomaly indications for successive candidate time intervals indicating whether the data recorded in the respective candidate time intervals deviate from a normal range or not. The successive candidate time intervals may have been predefined to have a size which is suitable for executing the following actions. Further, the wireless devices may be identified as being potentially affected by the incident, e.g. in the manner described above for actions 1 :3, 202 and 3:3.

In a further action 404, the control server 100 receives data recorded in

successive candidate time intervals in the above-mentioned training time window after each incident and an anomaly indication for each candidate time interval. Each anomaly indication thus indicates whether the data in the respective candidate time interval deviates from the normal range or not, which may simply be notated a "yes" or "no". Thereby, the control server 100 is able to determine which candidate time intervals within the training time window have produced abnormal data and which have not before this particular incident and this particular device. The training time window may initially have a relatively large predefined size which will be updated successively after further incidents as follows.

Another action 406 illustrates that the control server 100 updates the training time window to comprise the candidate time intervals for which the anomaly indication indicates that the data deviates from the normal range. For example, if the training time window initially encompasses, say, ten candidate time intervals and the anomaly indications received in action 404 indicate that only seven of them deviate from the normal range, then the training time window may be reduced to encompass the above seven candidate time intervals.

It is then checked in an action 408 whether the training time window has stabilized or not, i.e. whether the window size has virtually stopped changing after the update in action 406. If not, the procedure is repeated by executing actions 400- 408 once more after a next incident has occurred according to action 400. After repeating the training phase a sufficient number of times, it may be detected in action 408 that the training time window has finally become stabilized and the updated time window is then used in filter parameters, in an action 410 which completes the training phase. As mentioned above, different time window sizes may be defined for different types of data and/or for different wireless devices, and the solution is not limited in this respect.

The time window has now thus been defined, e.g. for one or more wireless devices and/or for one or more types of data, and the control server 100 can execute the usage phase B whenever an incident occurs that is of interest to evaluate. In brief the usage phase B includes, among other things, sending requests for data to potentially affected devices in an action 412, and receiving filtered data from the devices in another action 414 which is used for evaluation of the incident. Secondly, the training phase will now also be described in terms of actions performed by a wireless device as illustrated in the flow chart of Fig. 5 likewise involving the training phase A and the following usage phase B. Fig. 5 thus illustrates an example of how the solution may be employed in terms of actions performed by a wireless device such as the above-described wireless device 102, for handling recorded data. Reference will again also be made, without limiting the described features and embodiments, to the example scenario shown in Fig. 1 .

A first action 500 illustrates that the wireless device more or less continuously records data, e.g. by performing measurements and/or observations in the manner explained above. In a next action 502, the wireless device receives from a control server 100 a request for data obtained by measurements and/or observations and recorded within a training time window prior to an incident, which corresponds to the above action 402. In a further action 504, the wireless device detects anomaly of data recorded in successive candidate time intervals within said training time window if the data recorded in the respective candidate time intervals deviates from a normal range. The training time window and the candidate time intervals therein may have been preconfigured in the wireless device or they may be specified in the received request.

In another action 506, the wireless device sends a response to the control server 100 including the recorded data and an anomaly indication for each candidate time interval indicating whether the data recorded in said candidate time interval deviates from the normal range or not. Action 506 corresponds to action 404 above. The wireless device may then repeat actions 502-506 each time it receives a new request for data with anomaly indications from the control server 100.

Independently of the training phase of actions 500-506, the wireless device may also participate in the usage phase by receiving a data request and filter parameters from the control server 100 in an action 508 and sending a response with data to the control server 100 according to the filter parameters in action 510. Actions 508-510 may be optional in the sense that the wireless device may have been assigned and specifically configured to provide data with anomaly indications according to the training phase only, thus not necessarily performing actions 508- 510 as well, or it may be configured also to provide data according to the filter parameters in the usage phase, thus performing all actions 500-506 and at some point also actions 508-510.

Fig. 6 illustrates an example communication scenario when the training phase is executed, involving the control server 100 and a wireless device 600. In a first action 6:1 the wireless device 600 continuously records data as described above. When an incident occurs in an action 6:2, the control server 100 sends a request for data with anomaly indications to the wireless device 600 in an action 6:3, which may be performed as described above for action 402. The wireless device 600 then detects anomaly in an action 6:4 which may be performed as described above for action 504, and sends a response with data and anomaly indications to the control server 100 in another action 6:5 which corresponds to actions 404 and 506 above. The control server 100 is finally able to define filter parameters including a time window, in an action 6:6, which was basically described above for actions 400-410. Fig. 7 illustrates how a set of candidate time intervals may be defined in terms of time prior to an incident. The incident occurs at a time 700 and the above- described training time window 702 has a certain size extending prior to the incident 700. The training time window 702 is comprised of a number of

successive candidate time intervals 704 within the training time window 702. It is shown that there is a first candidate time interval t1 right before the incident 700 and a second candidate time interval t2 before t1 , and so forth. The "oldest" candidate time interval in the training time window 702 is denoted tn, so that the training time window 702 includes n candidate time intervals in total. When the actions 400-408 are repeated in the training phase A, the number of candidate time intervals n is reduced gradually, until the training time window 702 has stabilized, as explained for action 408 above, and the stabilized training time window 702 can be employed in the usage phase B.

An example of how wireless devices may report anomaly indications for data in the three candidate time intervals t1 -t3 to the control server 100 is illustrated in Figs 8A and 8B. Fig. 8A illustrates that three different types of wireless devices d1 -d3, e.g. performing different types of measurements/observations, may be employed in the above-described training phase A. Further, the devices may be located in different areas a1 -a3 in the vicinity of an incident 800 and devices of the types d1 , d2 and d3, respectively, are located in area a1 and one device of the type d1 is located in each of the areas a2 and a3.

Fig. 8B is a table with reported anomaly indications for data recorded by the devices in the three candidate time intervals t1 -t3 defined prior to the incident 800. In the area a1 , the device of type d1 indicates anomaly for its data recorded in t1 but not for its data recorded in t2 and t3, while the device of type d2 indicates anomaly for its data recorded in t1 and in t3 but not for its data recorded in t2. In the area a1 , the device of type d3 further indicates no anomaly for its data recorded in any of t1 -t3. Furthermore, the device of type d1 in the area a2 indicates anomaly for its data recorded in t1 but not for its data recorded in t2 and t3, while the device of type d1 in the area a3 indicates anomaly for its data recorded in t1 and in t3 but not for its data recorded in t2. The above reports of anomaly shown in Fig. 8B is thus a simplified example of statistics that the control server 100 may use for defining the time window to be employed in the usage phase, although it should be noted that a much greater amount of anomaly reports may be used in reality. In this example however, it may be deduced from the statistics in Fig. 8B that the time window should encompass the candidate time interval t1 but not time intervals t2-t3 since most of the devices have not indicated any anomaly of data recorded in time intervals t2-t3.

Alternatively, if a "safer" strategy is employed and the amount of data to be received in the usage phase is not anticipated to be too much to communicate and handle, it may be deduced that the time window should encompass the candidate time intervals t1 -t3 since two of the five devices have indicated anomaly in time interval t3. In addition, the device of type d3 in area a1 may not be requested to send data next time the same type of incident occurs since it has not detected any anomalies, and data from the d3 device in area a1 will likely be not useful for updating the training time window. Still, the d3 device may report its recorded data anyway irrespective of whether it has detected any anomaly or not, such that the control server can be kept updated.

Hence, different strategies may be employed for defining the time window based on reported anomalies, depending on the circumstances.

A non-limiting example of how a control server and a wireless device may be structured to bring about the above-described solution and embodiments thereof, will now be described with reference to the block diagram in Fig. 9. In these figures, the control server 900 and the wireless device 902 may be configured to operate according to any of the examples and embodiments of employing the solution as described above, where appropriate, and as follows. Each of the control server 900 and the wireless device 902 is shown to comprise a respective processor 900P, 902P, a respective memory 900M, 902M and a communication circuit denoted "C" with suitable equipment for transmitting and receiving information and messages in the manner described herein.

The communication circuit C in each of the control server 900 and the wireless device 902 thus comprises equipment configured for communication using a suitable protocol depending on the implementation. For example, the Hyper Text Transfer Protocol, HTTP, may be used in the communication described herein. The solution is however not limited to any specific types of messages or protocols. Examples of how the communication may be performed were described above with reference to Figs 1 , 3 and 6.

The actions of Figs 2, 4 and 5 may be performed by means of functional units in the respective processors 900P, 902P in the control server 900 and the wireless device 902. For example, the control server 900 may comprise means configured or arranged to perform at least some of the actions of the flow chart in Figs 2 and 4 in the manner described above. Further, the wireless device 902 may comprise means configured or arranged to perform at least some of the actions of the flow chart in Fig. 5 in the manner described above.

The control server 900 is arranged to handle data related to an incident. The control server 900 thus comprises the processor 900P and the memory 900M, said memory 900M comprising instructions executable by said processor 900P, whereby the control server 900 is configured as follows.

The control server 900 is configured to detect that the incident has occurred. This operation may be performed by a detecting unit 900A in the control server 900, e.g. in the manner described for action 200 above. The control server 900 is also configured to identify one or more wireless devices that are potentially affected by the incident. This operation may be performed by an identifying unit 900B in the control server 900, e.g. in the manner described for action 202 above.

The control server 900 is further configured to send to the identified one or more wireless devices requests for data obtained by measurements and/or observations made within a time window before the incident has occurred. This operation may be performed by a sending unit 900C in the control server 900, e.g. in the manner described for action 204 above.

The control server 900 is further configured to receive data from said one or more wireless devices in response to said requests. This operation may be performed by a receiving unit 900D in the control server 900, e.g. in the manner described for action 206 above.

The control server 900 is further configured to provide the received data as a basis for evaluation of the incident. This operation may be performed by a providing unit 900E in the control server 900, e.g. in the manner described for action 208 above.

The wireless device 902 is arranged to handle recorded data. The wireless device 902 thus comprises the processor 902P and the memory 902M, said memory 902M comprising instructions executable by said processor 902P whereby the wireless device 902 is operative as follows.

The wireless device 902 may be configured to record data by performing measurements and/or observations. This operation may be performed by a recording unit 902A in the wireless device 902, e.g. in the manner described for action 500 above. The wireless device 902 is further configured to receive from a control server a request for data obtained by measurements and/or observations and recorded within a training time window prior to an incident. This operation may be performed by a receiving unit 902B in the wireless device 902, e.g. in the manner described for action 502 above.

The wireless device 902 is also configured to detect anomaly of data recorded in successive candidate time intervals within said training time window if the data recorded in the respective candidate time intervals deviates from a normal range. This operation may be performed by a detecting unit 902C in the wireless device 902, e.g. in the manner described for action 504 above. The wireless device 902 is also configured to send a response to the control server including the recorded data and an anomaly indication for each candidate time interval indicating whether the data recorded in said candidate time interval deviates from the normal range or not. This operation may be performed by a sending unit 902D in the wireless device 902, e.g. in the manner described for action 506 above. It should be noted that Fig. 9 illustrates various functional units in the control server 900 and the wireless device 902, respectively, and the skilled person is able to implement these functional units in practice using suitable software and hardware. Thus, the solution is generally not limited to the shown structures of the control server 900 and the wireless device 902, and the functional units 900A-E and 902A-D therein may be configured to operate according to any of the features and embodiments described in this disclosure, where appropriate.

The functional units 900A-E and 902A-D described above may be implemented in the respective control server 900 and wireless device 902 by means of a

respective computer program comprising code means which, when run by the processor 900P, 902P causes the respective control server 900 and the wireless device 902 to perform the above-described actions and procedures. Each processor 900P, 902P may comprise a single Central Processing Unit (CPU), or could comprise two or more processing units. For example, each processor 900P, 902P may include a general purpose microprocessor, an instruction set processor and/or related chips sets and/or a special purpose microprocessor such as an Application Specific Integrated Circuit (ASIC). In other words, the mentioned functional units may be implemented in pure hardware. Each processor 900P, 902P may also comprise a storage for caching purposes.

Each computer program may be carried by a computer program storage product in each of the control server 900 and the wireless device 902 in the form of a memory having a computer readable medium and being connectable to the respective processor 900P, 902P. The computer program storage product in each of the control server 900 and the wireless device 902 may thus comprise a computer readable medium on which the respective computer program is stored e.g. in the form of computer program modules or the like. For example, the memory 900M, 902M in each node may be a flash memory, a Random-Access Memory (RAM), a Read-Only Memory (ROM) or an Electrically Erasable

Programmable ROM (EEPROM), and the program modules could in alternative embodiments be distributed on different computer program storage products in the form of memories within the respective control server 900 and wireless device 902.

The solution described herein may thus be implemented in each of the control server 900 and the wireless device 902 by a computer program comprising instructions which, when executed on the control server 900 and the wireless device 902, cause the control server 900 and the wireless device 902 to carry out the actions according to the above respective embodiments, where appropriate. The solution may also be implemented at each of the control server 900 and the wireless device 902 in a computer program storage product comprising

instructions which, when executed on the control server 900 and the wireless device 902, cause the control server 900 and the wireless device 902 to carry out the actions according to the above respective embodiments, where appropriate.

While the solution has been described with reference to specific exemplifying embodiments, the description is generally only intended to illustrate the inventive concept and should not be taken as limiting the scope of the solution. For example, the terms "control server", "wireless device", "time window", "filter parameters", "training time window" and "candidate time interval" have been used throughout this disclosure, although any other corresponding entities, functions, and/or parameters could also be used having the features and characteristics described here. The solution is defined by the appended claims.