---
title: Operational Support
type: concept
tags: [bpm, process-mining, online, prediction, recommendation, concept-drift, ppm-foundation]
sources: ["[[sources/2011-vanderaalst-process-mining-book]]"]
created: 2026-04-20
updated: 2026-04-20
---

# Operational Support

Online (runtime) process mining, as distinct from offline retrospective analysis ([[sources/2011-vanderaalst-process-mining-book]], Ch. 10). Operational support provides the conceptual foundation for the entire [[concepts/predictive-process-monitoring|PPM]] literature.

## Three runtime activities (§10.3–10.5)

Given a **running (partial) trace** and a reference model:

1. **Detect** — notify the moment a running case violates the model (online conformance). Example: alert when a loan application skips the required credit check.
2. **Predict** — estimate future values for a running case: remaining time, next activity, case outcome, cost. The direct ancestor of the PPM sub-discipline — [[concepts/next-activity-prediction]], [[concepts/remaining-time-prediction]], [[concepts/outcome-prediction]] are all **predict** operations in Van der Aalst's taxonomy.
3. **Recommend** — suggest the action most likely to achieve a goal (minimise time / cost / risk) for a running case. Decision-support layer on top of predict.

## Refined process mining framework (§10.1)

Operational support lives in a 3×2 grid — three activities × two regimes:

|                       | **Offline** (retrospective) | **Online** (at runtime) |
|-----------------------|-----------------------------|-------------------------|
| **Cartography** (build process maps: discovery, enhancement) | Discover a model, annotate with performance | Update maps as new events stream in |
| **Auditing** (compare log and model: conformance) | Retrospective deviation reports | Online conformance checking (**detect**) |
| **Navigation** (use models for action) | Simulation, scenario analysis | **Predict** and **recommend** on live cases |

This 3×2 grid is the **Process Mining Spectrum** — Van der Aalst's refined reframing of the three original mining types (discovery / conformance / enhancement) in terms of the *use* of the model rather than the *direction* of the mining.

## Processes are not in steady state (§10.6)

Operational support must handle:
- **Daily / weekly / seasonal patterns** — arrival rates, resource availability fluctuate.
- **Contextual factors** — exogenous variables (weather, macroeconomy, campaigns) shift behaviour.
- **Concept drift** — the process itself changes over time (new product line, policy, law). Drift can be sudden, gradual, recurring, or incremental. Handling drift is a named sub-problem in the PPM literature (e.g., [[sources/2019-verenich-survey-ppm]] discusses this).

## Relation to PPM

**PPM = operational support narrowed to the Predict activity**. The [[syntheses/ppm-landscape|PPM synthesis]] treats this book's Ch. 10 as the seed of the field: everything in `raw/Predictive process monitoring/` elaborates Van der Aalst's predict mode with richer encoders (LSTMs, transformers, GNNs), richer targets (outcomes, remaining time, next activity), and richer inputs (inter-case features, text, resource data).

## Related
[[methods/process-mining-basics]] · [[concepts/conformance-checking]] · [[concepts/predictive-process-monitoring]] · [[concepts/next-activity-prediction]] · [[concepts/remaining-time-prediction]] · [[concepts/outcome-prediction]] · [[concepts/process-mining-spectrum]] · [[concepts/mape-k-loop]] (the agentic-BPM cousin of detect/predict/recommend)