DSL for event pattern detection

events.hs

-- Construct 1
-- ===========
-- ev1 >- time -< [ ev2
--                , Null
--                ]
-- Means that if ev1 happens then ev2 may happen within time and then [ev2, ev1]
-- is reported. If ev2 does not happen within time, don't wait longer and report
-- [ev1, Null] == [ev1].
--
-- Note: ev1 will always be reported.

-- Construct 2
-- ============
-- ev /-> label
-- Attach a label to all reported events, i.e. report (ev, Label) instead of
-- just ev. This way it is clear in the results which part matched.

-- Construct 3
-- ============
-- ev1 >--> ev2
-- Means that ev1 must be followed by ev2, time difference doesn't matter.

-- Construct 4
-- ============
-- ev1 >- time +> ev2
-- Means that ev1 must be followed by ev2 but no sooner than time.

ffault  = ev Fault .+ ev PrimaryRupture
sfault  = ev Fault .+ ev SecondaryRupture
restore = ev SwitchClosed .+ ev SupplyOn

e1 = ffault >-(mins 2)-< [ restore >-(secs 5)-< [ sfault /-> BothBlown
                                                , Null   /-> SupplyRestored
                                                ]
                         , Null                          /-> OneBlown
                         ]

e2 = ffault >--> restore >-(secs 5)+> sfault             /-> SecondBlown