A boiler room inspection log auditing system based on edge computing

Abstract

The application discloses a boiler room inspection log auditing system based on edge computing and relates to the technical field of industrial internet and edge computing.The application converts heterogeneous device data into a unified model by using a protocol adaptation unit, thereby eliminating the data island problem caused by protocol differences.A time reference management unit connects a PTP / NTP time source and maintains device-level offset, thereby establishing a reliable time reference and avoiding time sequence confusion caused by inconsistent clocks.A time sequence alignment unit adopts a sliding window and a dynamic time warping algorithm to perform time offset compensation and out-of-order rearrangement on multi-source data, combines a water line strategy to process late data, significantly reduces distortion risk during data fusion, and ensures the synchronicity of working condition views.A data fusion unit realizes near neighbor matching and weighted fusion in cross-database association by using an adaptive tolerance threshold and a quality weight, thereby enhancing the robustness of multi-index analysis and reducing the false alarm or missed alarm probability.

Description

Technical Field

[0001] This invention relates to the field of industrial internet and edge computing technology, and in particular to a boiler room inspection log auditing system based on edge computing. Background Technology

[0002] In the context of the Industrial Internet, boiler room inspection log auditing systems are gradually adopting multi-protocol device integration to achieve comprehensive monitoring. The system typically connects to heterogeneous devices such as Modbus, OPC UA, and BACnet to collect operating parameters like pressure, temperature, and flow. This data is fused in real-time through edge nodes to support alarm diagnosis and operational condition analysis. However, the data acquisition cycles of different protocol devices vary; for example, some sensors upload data at second-level frequencies, while other devices may respond at minute-level intervals. When this multi-source data stream is joined at the edge, inconsistent timestamp bases can easily lead to timing misalignments. The data fusion process may not accurately reflect the synchronous changes in device status, affecting subsequent analysis and decision-making.

[0003] Existing solutions address timing issues through timestamp alignment or simple interpolation. For example, in edge computing frameworks, fixed window aggregation or linear interpolation algorithms are used to force data of different frequencies to be aligned to a unified timeline. Some systems introduce cloud computing resources to perform post-processing data correction through cloud-based time-series databases. However, these methods have limitations in multi-protocol environments. Interpolation algorithms may ignore dynamic interactions between devices, leading to data distortion in the fused data. Timestamp alignment relies on network clock synchronization, and when the network fluctuates in the boiler room, the accumulated deviation can exacerbate timing chaos. Data distortion may further propagate to the alarm module, triggering false alarms or missed alarms.

[0004] To address timing misalignment, some existing technologies introduce edge-side rule engines and lightweight data preprocessing; by configuring data filtering and caching mechanisms, high-frequency key indicators are prioritized to reduce interference from low-priority data; some solutions combine protocol gateway optimization to perform preliminary time calibration at the acquisition layer; however, these methods are still limited by device heterogeneity and resource competition, and cannot completely eliminate timing deviations in multi-source data fusion; in scenarios with high real-time requirements, such as combustion efficiency analysis or safety interlocking, residual misalignment may slow down response speed and increase operational complexity. Summary of the Invention

[0005] In view of the aforementioned existing problems, the present invention is proposed.

[0006] This invention provides a boiler room inspection log auditing system based on edge computing to solve the problems of data distortion and unreliable alarms caused by time sequence misalignment in the data fusion of multi-protocol equipment in boiler rooms, and the limited effectiveness of existing solutions such as timestamp alignment or cloud processing in heterogeneous environments.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0008] In a first aspect, embodiments of the present invention provide a boiler room inspection log auditing system based on edge computing, comprising:

[0009] The protocol adaptation unit is used to collect boiler operation data from various industrial protocol devices and convert it into a unified data model.

[0010] The time reference management unit, connected to the protocol adaptation unit, is used to establish a unified time reference and maintain device-level clock offset.

[0011] The time alignment unit is connected to the time base management unit and is used to perform time alignment and disordered rearrangement of multi-source data based on event time, so as to output the aligned data sequence.

[0012] The data fusion unit, connected to the time-series alignment unit, is used to perform cross-database association queries on the aligned data sequence to generate a boiler operating condition view.

[0013] The audit log unit is connected to the data fusion unit and is used to trigger alarms and generate inspection audit records based on the working condition view, and to associate information with the video and access control system through the peripheral adapter interface;

[0014] The cloud-edge collaboration unit is connected to the audit log unit and is used to securely synchronize audit log summaries to the cloud platform under the condition of disconnection and availability.

[0015] The security authentication unit is used to perform national cryptographic algorithm authentication and device fingerprint binding on access devices.

[0016] As a preferred embodiment of the boiler room inspection log auditing system based on edge computing described in this invention, the protocol adaptation unit supports Modbus, OPC UA and BACnet, and the unified data model includes at least: device identifier, measurement point identifier, event time, server time, value, unit, quality identifier, data source and serial number, and provides automatic protocol selection and parsing based on device identifier.

[0017] As a preferred embodiment of the boiler room inspection log auditing system based on edge computing described in this invention, the time reference management unit is used for:

[0018] Connect to PTP and / or NTP time sources to form a unified time reference;

[0019] Estimation and reliability based on equipment maintenance time offset;

[0020] When the time source is abnormal, a local monotonic clock is used for degradation, and the abnormal interval is marked.

[0021] As a preferred embodiment of the boiler room inspection log auditing system based on edge computing described in this invention, the time alignment unit uses a sliding window to cache multi-source data streams and estimates the time offset and alignment path between multiple streams based on a dynamic time warping algorithm. The dynamic time warping sets an upper limit for the offset and a constraint band, and outputs the alignment confidence level.

[0022] The cost function, constraint band, and complexity control strategy of the dynamic time warping algorithm are set as follows:

[0023] Step A1, within the sliding window... Flow and Pair the stream samples and construct a weighted cost that includes quality penalty and time normalization:

[0024] ,

[0025] in, To make the first indivual Flow samples and the first indivual The local cost of stream sample pairing, dimensionless. , For the corresponding sample values, , The event time for the sample is in seconds. Indicates the source flow. Indicates origin flow, Indicates origin flow, , This is a sample index, dimensionless. The weights for numerical difference and time difference. The power of the numerical difference. The time difference is normalized to a standard scale, with the unit being seconds. For quality penalty weight, As a marker of sample quality;

[0026] Step A2: Based on the in-window offset estimate and jitter statistics provided by the time base management unit, limit the feasible pairing set and adaptively adjust the bandwidth:

[0027] ,

[0028] ,

[0029] in, To allow the set of index pairs to enter the dynamic programming, This is an estimate of the time offset between devices within the window, in seconds. This is the maximum allowed time offset for this window, in seconds. The lower and upper bounds of the local slope constraint are dimensionless. The event time for each of the preceding aligned samples, in seconds. This is a global hard limit, in seconds. This is the bandwidth margin factor, which is dimensionless. This is a statistic of residual time jitter within the window, in seconds;

[0030] when or Or, if the denominator is zero, no slope constraint is applied, only the time offset constraint is applied;

[0031] Step A3, in the set Under the strip clipping, the upper bound of the expected computational cost of dynamic programming is expressed as:

[0032] ,

[0033] in, The computational magnitude after strip clipping is dimensionless. For the window Stream sample size, dimensionless. The expected number of candidates to be compared for each row, dimensionless. for The arrival density of the flow event, in units of 1 / second.

[0034] As a preferred embodiment of the boiler room inspection log auditing system based on edge computing described in this invention, the timing alignment unit further includes a water level generation and allowable late arrival time strategy, which rearranges late data and updates the output records within the allowable time limit, discards or supplements late data that exceeds the time limit, and distinguishes them through quality identifiers.

[0035] As a preferred embodiment of the boiler room inspection log auditing system based on edge computing described in this invention, the data fusion unit performs interval association query based on device identifier and event time, performs nearest neighbor matching within a configurable time tolerance threshold, and performs weighted fusion of multi-source indicators based on quality identifier to generate a boiler operating condition view containing source lineage.

[0036] The adaptive calculation of the time tolerance threshold and quality weight coefficient includes the following steps:

[0037] Step B1, in window number During the cross-database association process, the time tolerance threshold for nearest neighbor matching is updated exponentially with smoothness. The update result is denoted as:

[0038] ,

[0039] in, For the first The time tolerance threshold used for each sliding window is in seconds. The threshold value for the previous window, in seconds. For updating gain, dimensionless, This is the hard upper limit of the tolerance, in seconds. This is the lower tolerance limit, in seconds. The coefficient for the baseline term is expressed in seconds. These are the weighting coefficients for time offset, event jitter, and network jitter, respectively; they are dimensionless. This is an estimate of the time offset between devices, in seconds. This is a statistic of residual event time jitter within the window, in seconds. This is a network jitter statistic within the window, expressed in seconds. Indicates the first A sliding window, where the functions min and max represent the operations of taking the lower limit and the upper limit, respectively;

[0040] The update gain is defined as:

[0041] ,

[0042] in, To update the gain cap, dimensionless. The span of the sliding window is in seconds. This is the end-to-end latency estimate, in seconds;

[0043] Step B2, for the source set entering the fusion Each source in Based on the comprehensive quality indicators, missing detection rate, and alignment residuals, normalized weights are calculated for weighted fusion:

[0044] ,

[0045] in, For source The fusion weights are dimensionless. For the set of sources participating in the fusion, the subscript is... For source indexing, dimensionless. For source The average quality indicator within the window is dimensionless; a higher value indicates higher quality. For source Missing rate, dimensionless. For source The alignment residual variance or mean square, in units of , These are the quality and missing measurement sensitivity indices, respectively, dimensionless. The residual attenuation coefficient is dimensionless. It is an exponential function;

[0046] Step B3, when Increase when tightening or system load increases. and rise When residual statistics When it continues to rise, it adaptively increases. Alternatively, the participation level of the corresponding source could be lowered to mitigate short-term network fluctuations by limiting... The growth rate;

[0047] Step B4, and The data is synchronously sent to the data fusion and audit log unit as the window scrolls. When the alignment confidence decreases or abnormal intervals are marked, the restrictions are temporarily relaxed. But inhibit The upper limit.

[0048] As a preferred embodiment of the boiler room inspection log auditing system based on edge computing described in this invention, the audit log unit performs conditional judgment on multiple indicators based on a rule engine. When an alarm event is triggered, it retrieves time-aligned video clips through the peripheral adapter interface and associates them with the access control status to generate an audit record containing time range, equipment list, trigger conditions, and peripheral evidence.

[0049] The system does not replace the decision-making and execution of the underlying security interlocks.

[0050] As a preferred embodiment of the boiler room inspection log auditing system based on edge computing described in this invention, the cloud-edge collaboration unit includes a data synchronization agent and cache management module, which compresses and encrypts the audit log summary when the network is available, and implements persistent caching and priority-based retransmission when the connection is lost.

[0051] When concurrent modifications occur, conflict detection and merging are performed based on causal logs, and causal relationships are implemented through logical clocks or vector clocks.

[0052] As a preferred embodiment of the boiler room inspection log auditing system based on edge computing described in this invention, the security authentication unit implements the device network access process, including device broadcast discovery, two-way authentication based on national cryptographic algorithms, and device fingerprint binding; the device fingerprint is generated by combining hardware features and bound to a certificate.

[0053] Secondly, embodiments of the present invention provide a method for auditing boiler room inspection logs based on edge computing, comprising:

[0054] Step S1: Collect data from multiple protocol devices and convert it into a unified data model;

[0055] Step S2: Establish a unified time base and estimate device-level time offset;

[0056] Step S3: Perform time alignment based on sliding window and dynamic time warping, and execute water level and allow late processing to output the aligned sequence;

[0057] Step S4: Based on the device identifier and event time, perform cross-database association within a preset time tolerance and weighted fusion according to quality identifier to form a working condition view;

[0058] Step S5: Trigger alarms according to the rules engine and generate audit records by associating video and access control information;

[0059] Step S6: The audit log summary is synchronized between the cloud and the edge using compression and encryption. It is cached in the disconnected state and retransmitted after reconnection. If a conflict occurs, it is merged based on the causal log.

[0060] The beneficial effects of this invention are as follows: The boiler room inspection log auditing system based on edge computing effectively improves the accuracy and real-time performance of multi-source data processing by integrating units such as protocol adaptation, time base management, time sequence alignment and data fusion.

[0061] This invention utilizes a protocol adaptation unit to convert heterogeneous device data into a unified model, eliminating data silos caused by protocol differences. The time reference management unit establishes a reliable time reference by interfacing with PTP / NTP time sources and maintaining device-level offsets, avoiding timing chaos caused by clock inconsistencies. The timing alignment unit employs a sliding window and dynamic time warping algorithm to compensate for time offsets and rearrange out-of-order data from multiple sources, combined with a waterline strategy to handle late data, significantly reducing the risk of distortion during data fusion and ensuring the synchronization of the operational view. The data fusion unit uses adaptive tolerance thresholds and quality weights to achieve nearest neighbor matching and weighted fusion in cross-database associations, enhancing the robustness of multi-indicator analysis and reducing the probability of false alarms or missed alarms. The audit log unit triggers alarms based on a rule engine and associates with video and access control systems to generate audit records containing peripheral device evidence, improving the traceability and response speed of inspections. The cloud-edge collaboration unit supports disconnection caching and secure synchronization, ensuring the integrity and consistency of audit logs, while the security authentication unit strengthens the security management of access devices through national cryptographic algorithms and device fingerprint binding.

[0062] This invention performs key processing at the edge, reducing reliance on the cloud and improving the system's reliability in weak network environments. At the same time, it adapts to the complex operating conditions of boiler rooms through an adaptive mechanism, providing more reliable data support for operation and maintenance decisions and promoting the deep application of the Industrial Internet in the heating industry. Attached Figure Description

[0063] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation on the scope of this application.

[0064] Figure 1 This is a schematic diagram of the framework of the boiler room inspection log auditing system based on edge computing in the embodiment.

[0065] Figure 2 This is a flowchart illustrating the edge computing-based boiler room inspection log auditing method in this embodiment. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0067] All terms used in this application (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0068] For example, the terms “first” and “second” used in this application are only used to distinguish and describe similar objects, to differentiate the first object from another object, and are not used to describe a specific order or sequence, nor should they be interpreted as indicating or implying relative importance.

[0069] This application proposes a boiler room inspection log auditing system based on edge computing, combined with... Figure 1 As shown, the system includes:

[0070] The protocol adaptation unit is used to collect boiler operation data from various industrial protocol devices and convert it into a unified data model.

[0071] The time base management unit, connected to the protocol adaptation unit, is used to establish a unified time base and maintain device-level clock offset.

[0072] The time alignment unit, connected to the time base management unit, is used to perform time alignment and disordered rearrangement of multi-source data based on event time, so as to output the aligned data sequence;

[0073] The data fusion unit, connected to the time-series alignment unit, is used to perform cross-database association queries on the aligned data sequence to generate a boiler operating condition view.

[0074] The audit log unit, connected to the data fusion unit, is used to trigger alarms and generate inspection audit records based on the working condition view, and to associate information with the video and access control system through the peripheral adapter interface;

[0075] The cloud-edge collaboration unit connects to the audit log unit and is used to securely synchronize audit log summaries to the cloud platform under the condition of disconnection and availability.

[0076] The security authentication unit is used to implement national cryptographic algorithm authentication and device fingerprint binding for access devices. In this embodiment, the event time in the unified data model is the sampling occurrence time obtainable from the device or protocol stack, the server time is the receiving time of the edge node, and the quality identifier is derived from the protocol quality bit or deduced from the parsing and verification results. The peripheral adapter interface is an abstraction for data interaction with the video and access control system, maintaining the input as the time interval of the working condition view and the device list, and the output as aligned segments and status records. The default sampling period for high-frequency measurement points is 1~2 seconds, and the default sampling period for low-frequency or change-reported measurement points is 1 time / 10~60 seconds. The default alignment window is 10 seconds and can be adjusted between 5~30 seconds according to the load. The device timeout is judged as 3 times the expected period. The quality identifier is mapped to three levels: good, suspicious, and invalid, which are high, medium, and low. The server time is only used as a fallback when the event time is missing. Optionally, when the device already has a unified timestamp and it is stable, the protocol adapter unit maintains pass-through and only supplements the quality identifier and source identifier. When an event time is missing or significantly backwards, the server time will be used to fill it in and the quality label will be downgraded to suspicious. When a device times out consecutively within two windows, it will not be included in the fusion process, but audit traceability records will be retained.

[0077] In one embodiment, the protocol adaptation unit supports Modbus, OPC UA, and BACnet. The unified data model includes at least: device identifier, measurement point identifier, event time, server time, numerical value, unit, quality identifier, data source, and sequence number. It provides automatic protocol selection and parsing based on the device identifier. Specifically, automatic protocol selection is based on the driver mapping table associated with the device identifier and handshake capabilities. Modbus completes frame de-framing based on station address, function code, and register range, and backtracks using the server time as the event time. OPC UA subscription prioritizes source time and inherits the quality bit. BACnet parses based on object type and instance number and prioritizes change reporting. The Modbus polling cycle defaults to 500 milliseconds to 2 seconds, the OPC UA publishing cycle defaults to 1 to 5 seconds, and the minimum interval for BACnet change reporting defaults to 5 to 10 seconds. Units are normalized to engineering quantity units by default according to the driver mapping table. The data source field distinguishes between direct collection and gateway forwarding for subsequent weight allocation. Optionally, when automatic selection fails or multiple candidate drivers exist, manual specification of the driver is allowed and the driver is permanently stored in the mapping table. Framing errors, verification failures, and out-of-bounds values ​​are marked as invalid and included in the device's quality statistics.

[0078] In one embodiment, the time base management unit is used for:

[0079] Connect to PTP and / or NTP time sources to form a unified time reference;

[0080] Estimation and reliability based on equipment maintenance time offset;

[0081] When a time source is abnormal, a local monotonic clock is used for degradation, and the abnormal interval is marked. For example, time base management prioritizes high-precision time synchronization based on network conditions; otherwise, it reverts to regular time synchronization. When time synchronization unreachable or jitter suddenly increases, it switches to a local monotonic clock and marks the interval. Time synchronization health checks are performed every 30-60 seconds by default, the offset alarm threshold is 100-200 milliseconds by default, and the jitter threshold is 50-100 milliseconds by default. An abnormal interval must exceed the threshold three times consecutively to trigger marking. Device-level time offset estimation is obtained by combining moving average and median filtering, and its reliability is comprehensively measured by offset stability and packet loss rate. Optionally, in network segments with hardware timestamps, link-layer timestamps are used directly to improve the reliability of event time. When a time rollback is detected, the event time progression speed is frozen to no less than monotonically increasing, and the data quality of that segment is downgraded.

[0082] In one embodiment, the timing alignment unit uses a sliding window to buffer multiple source data streams and estimates the time offset and alignment path between multiple streams based on a dynamic time warping algorithm. The dynamic time warping sets the offset upper limit and constraint band and outputs the alignment confidence for subsequent fusion.

[0083] The cost function, constraint band, and complexity control strategy of the dynamic time warping algorithm are set as follows:

[0084] Step A1, within the sliding window... Flow and Pair the stream samples and construct a weighted cost that includes quality penalty and time normalization:

[0085] ,

[0086] in, To make the first indivual Flow samples and the first indivual The local cost of stream sample pairing, dimensionless. , For the corresponding sample values, , The event time for the sample is in seconds. Indicates the source flow. Indicates origin flow, Indicates origin flow, , This is a sample index, dimensionless. The weights for numerical difference and time difference. The power of the numerical difference. The time difference is normalized to a standard scale, with the unit being seconds. For quality penalty weight, This serves as an indicator of sample quality; a higher value indicates higher quality.

[0087] Step A2: Based on the in-window offset estimate and jitter statistics provided by the time base management unit, limit the feasible pairing set and adaptively adjust the bandwidth:

[0088] ,

[0089] ,

[0090] in, To allow the set of index pairs to enter the dynamic programming, This is an estimate of the time offset between devices within the window, in seconds. This is the maximum allowed time offset for this window, in seconds. The lower and upper bounds of the local slope constraint are dimensionless. The event time for each of the preceding aligned samples, in seconds. This is a global hard limit, in seconds. This is the bandwidth margin factor, which is dimensionless. This is a statistic of residual time jitter within the window, in seconds;

[0091] when or Or, if the denominator is zero, no slope constraint is applied, only the time offset constraint is applied;

[0092] Step A3, in the set Under the strip pruning, the upper bound of the expected computational cost of dynamic programming can be expressed as:

[0093] ,

[0094] in, The computational magnitude after strip clipping is dimensionless. For the window Stream sample size, dimensionless. The expected number of candidates to be compared for each row, dimensionless. for The arrival density of streaming events is measured in 1 / second. This upper bound is linked to the window length and can be superimposed with a heuristic lower bound for early pruning.

[0095] Desirable , , It can achieve the same order of magnitude of time tolerance as cross-database association. Pick , Pick , Pick ; and The time base management unit makes rolling estimates at the device level and issues them to the timing alignment unit.

[0096] Specifically, numerical difference, time difference, and quality label are unified into the local cost, allowing low-confidence and time-deviation samples to automatically give way in path search. The time difference is expressed using truncated normalization, which can suppress the impact of extreme offsets. The constraint band uses offset estimation and jitter statistics for adaptive convergence, covering both slow drift and suppressing instantaneous jitter. The bandwidth is controlled by two levels: hard upper limit and margin, which facilitates stable operation on edge nodes. The complexity is reduced to a near-linear scale through strip pruning, and can be combined with heuristic lower bounds to terminate invalid branches in advance, balancing late data back-rolling and real-time performance. Similarly, the sliding window length is set according to the target end-to-end delay and arrival density, and is commonly set to 5-15 seconds. The maximum allowable time offset is set to the range of 1-3 seconds, and the local slope constraint is usually set to 0.5-2 to limit excessive stretching. The numerical difference weight in the local cost is preferably around 0.7, the numerical difference exponent is preferably 1 or 2, the time difference normalization scale is on the same order of magnitude as the tolerance in the fusion stage, and the quality penalty weight is preferably 0.1-0.3. Alignment confidence is jointly evaluated by normalized path cost and matching coverage. Optionally, when resources are limited or operating conditions are stable, it degenerates to nearest neighbor matching and uses only time tolerance; when there are sharp fluctuations, the constraint band is appropriately expanded and the window is shortened to reduce backtracking depth. When memory pressure increases, the window length and candidate bandwidth are preferentially reduced; when one side of the flow is missing for a long time, the output is marked as an alignment failure and the path search for that pair is terminated.

[0097] In one embodiment, the timing alignment unit further includes a water level generation and allowable late arrival time strategy. Late data is rearranged and output records are updated within the allowable time limit. Data that exceeds the time limit is discarded or supplemented, and distinguished by a quality identifier. Optionally, the water level is calculated by subtracting the allowable late arrival time from the maximum event time in the current window and updated at a fixed beat. The allowable late arrival time is 3-10 seconds by default, but can also be adaptively set according to the residual jitter multiple. The minimum capacity of the rearrangement buffer is estimated by multiplying the allowable late arrival time by the arrival density and retaining a safety margin. Supplementing data that exceeds the time limit requires participation in statistics with an alignment failure flag and low weight. The arrival density is calculated from the event count and span within the window. If a late arrival surge causes buffer overflow, a time-priority strategy is used to retain the latest data and discard the earliest data, while marking the window as suspicious.

[0098] In one embodiment, the data fusion unit performs an interval association query based on device identifier and event time, performs nearest neighbor matching within a configurable time tolerance threshold, and performs weighted fusion of multi-source indicators based on quality identifier to generate a boiler operating condition view that includes source lineage.

[0099] The adaptive calculation of time tolerance threshold and quality weight coefficient includes the following steps:

[0100] Step B1, in window number During the cross-database association process, to balance event time offset and network jitter, the time tolerance threshold for nearest neighbor matching is updated exponentially with smoothness. The update result is denoted as:

[0101] ,

[0102] in, For the first The time tolerance threshold used for each sliding window is in seconds. The threshold value for the previous window, in seconds. For updating gain, dimensionless, This is the hard upper limit of the tolerance, in seconds. This is the lower tolerance limit, in seconds. The coefficient for the baseline term is expressed in seconds. These are the weighting coefficients for time offset, event jitter, and network jitter, respectively; they are dimensionless. This is an estimate of the time offset between devices, in seconds. This is a statistic of residual event time jitter within the window, in seconds. This is a network jitter statistic within the window, expressed in seconds. Indicates the first A sliding window, where the functions min and max represent the operations of taking the lower limit and the upper limit, respectively;

[0103] To align with timeliness metrics, the update gain is defined as follows:

[0104] ,

[0105] in, To update the gain cap, dimensionless. The span of the sliding window is in seconds. This is the end-to-end latency estimate, in seconds;

[0106] Step B2, for the source set entering the fusion Each source in Based on the comprehensive quality indicators, missing detection rate, and alignment residuals, normalized weights are calculated for weighted fusion:

[0107] ,

[0108] in, For source The fusion weights are dimensionless. For the set of sources participating in the fusion, the subscript is... For source indexing, dimensionless. For source The average quality indicator within the window is dimensionless; a higher value indicates higher quality. For source Missing rate, dimensionless. For source The alignment residual variance or mean square, in units of , These are the quality and missing measurement sensitivity indices, respectively, dimensionless. The residual attenuation coefficient is dimensionless. It is an exponential function;

[0109] Step B3, when When tightening or when the system load increases, it can improve and rise To reduce the probability of backtracking, when residual statistics When it continues to rise, it can adaptively increase. Alternatively, the participation level of the corresponding source could be lowered to mitigate short-term network fluctuations by limiting... The growth rate should be optimized to avoid mismatches caused by instantaneous tolerance expansion;

[0110] Step B4, and The data is simultaneously sent to the data fusion and audit log unit as the window scrolls. When the alignment confidence decreases or abnormal intervals are marked, the restrictions can be temporarily relaxed. But inhibit The upper limit is set to reduce the impact of anomalies on the fusion results;

[0111] Specifically, two types of adaptive rules are presented here: First, a linear combination of time offset, event jitter, and network jitter is used as the tolerance kernel, and exponential smoothing and upper and lower bounds are used to control the response speed and steady-state noise, thereby appropriately widening the matching window when jitter increases and gradually converging after the network recovers; Second, quality, missing measurements, and residuals constitute an interpretable weight allocation, with more missing measurements and larger residuals resulting in lower weights, and sources with high quality indicators gaining greater influence; The two work together to ensure that the fusion stage has sufficient temporal robustness without crosstalk accumulation due to individual fluctuation sources, while providing an adjustable operating point for online operation under different latency budgets through the linkage of gain and threshold; Further, the initial time tolerance can be taken as 0.5~1 second and is constrained by upper and lower bounds within 0.1~5 seconds; the tolerance update gain is preferably 0.1~0.5 and is constrained by the end-to-end latency budget; the baseline term is usually set to 0.2~0.5 seconds; the weight coefficients of time offset, event jitter, and network jitter are set according to the on-site network type and timing health experience. Regarding weight allocation, the preferred values ​​for the quality sensitivity index are 1-3, the preferred values ​​for the missing data sensitivity index are 1-2, and the preferred values ​​for the residual decay coefficient are 0.1-1. Alignment residuals are estimated using variance or mean square within the window, and the missing data rate is derived from the ratio of the expected sample size to the actual sample size. Optionally, when only two sources conflict and have similar weights, a high-quality-first or median-based degradation strategy is adopted. When the tolerance shows a rapid expansion trend, its growth rate per window is limited; when the weights converge to a single source, the reason for the source degradation is included in the audit record.

[0112] In one embodiment, the audit log unit performs conditional judgments on multiple indicators based on the rule engine. When an alarm event is triggered, it retrieves time-aligned video clips through the peripheral adapter interface and associates them with the access control status to generate an audit record containing time range, device list, trigger conditions and peripheral evidence.

[0113] The system does not replace the decision-making and execution of underlying security interlocks. In this embodiment, the rule engine is based on multiple indicators, maintaining the input as a time-aligned operational view and optional peripheral status, and outputting alarm events and associated evidence. Video segment retrieval defaults to a 5-10 second interval before and after the alarm time point, and access control status matching defaults to the same time tolerance as the fusion phase; a single indicator peak must have a minimum duration of at least 2 seconds to trigger. Optionally, when a video network segment is unreachable or a segment is missing, the retrieval fingerprint and failure reason are retained without interrupting audit record generation. When a key measurement point on which a rule depends is missing within the window, it is downgraded to a notification-level event and included in the maintenance pending verification list.

[0114] In one embodiment, the cloud-edge collaboration unit includes a data synchronization agent and cache management module, which compresses and encrypts the audit log summary when the network is available, and implements persistent caching and priority-based retransmission when the connection is lost.

[0115] When concurrent modifications occur, conflict detection and merging are performed based on causal logs. Causality is implemented through logical clocks or vector clocks. Specifically, the causal log is a record of event relationships during the synchronization of audit log summaries between different edge nodes and the cloud, including version vectors, write node identifiers, and timestamps, used to determine the order of concurrency and causality. Batch synchronization is triggered by default when the cumulative number of records reaches a fixed threshold or at an interval of 30-60 seconds; the retry backoff interval is 5-60 seconds by default and rolls back exponentially with the number of failures. Optionally, conflict merging under the same audit key prioritizes the highest severity level after concurrent merging, followed by the most recently updated value. If a decision cannot be made, a fixed priority order is used. When cache space is insufficient, priority is given to retaining the highest severity level and the latest record, while the oldest record with a lower severity level can be evicted but its evictation count is retained.

[0116] In one embodiment, the security authentication unit implements the device network access process, including device broadcast discovery, two-way authentication based on national cryptographic algorithms, and device fingerprint binding. The device fingerprint is generated by combining hardware features and bound to a certificate for rapid management and traceability. For example, the device fingerprint can be composed of stable features such as the network card physical address, processor sequence, and read-only memory identifier, normalized and anti-collision digests, and then two-way bound to the national cryptographic certificate to form a unique identity upon network access. The authentication timeout is 3-5 seconds by default, and the binding window is valid for 60 seconds by default; the broadcast discovery period is 10-30 seconds by default. Optionally, when some hardware features are unavailable, a temporary fingerprint can be generated from the available subset and marked as needing improvement, to be completed and bound after the first stable operation. If necessary, when the fingerprint is inconsistent with or duplicates the certificate, the node enters an isolated state and requires manual confirmation before recovery.

[0117] This application also proposes a boiler room inspection log auditing method based on edge computing, combined with... Figure 2 As shown, the method includes:

[0118] Step S1: Collect data from multiple protocol devices and convert it into a unified data model;

[0119] Step S2: Establish a unified time base and estimate device-level time offset;

[0120] Step S3: Perform time alignment based on sliding window and dynamic time warping, and execute water level and allow late processing to output the aligned sequence;

[0121] Step S4: Based on the device identifier and event time, perform cross-database association within a preset time tolerance and weighted fusion according to quality identifier to form a working condition view;

[0122] Step S5: Trigger alarms according to the rules engine and generate audit records by associating video and access control information;

[0123] Step S6 involves synchronizing the audit log summary between the cloud and edge using compression and encryption. It is cached during disconnection and retransmitted upon reconnection. In case of conflicts, merging is performed based on causal logs. Similarly, the end-to-end latency budget for each method step is configured within the range of 1-3 seconds and is maintained throughout the entire process of collection, alignment, fusion, and auditing. The window rolling cycle and synchronization cycle remain consistent with the system side. The default window rolling step size is 1-2 seconds, and log summary compression and encryption are performed upon each batch trigger. Optionally, when the load increases and alignment calculations approach their limit, the window length and candidate bandwidth are temporarily reduced to meet the budget. When the network remains unstable, the priority of disconnection caching is increased, and the retransmission of non-critical summaries is delayed. If resource shortages occur at any stage of method execution, the minimum executable scope of audit log recording is maintained, recording only the three elements of time, device, and triggering conditions, and supplementing with quality indicators.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0125] Furthermore, those skilled in the art will understand that although some embodiments herein include certain features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of this application and form different embodiments. For example, all the embodiments above can be used in any combination. The information disclosed in this background section is intended only to enhance the understanding of the general background of this application and should not be construed as an admission or in any way implying that such information constitutes prior art known to those skilled in the art.

Claims

1. A boiler room inspection log auditing system based on edge computing, deployed at edge computing nodes in the boiler room, characterized in that, include: The protocol adaptation unit is used to collect boiler operation data from various industrial protocol devices and convert it into a unified data model. The time reference management unit, connected to the protocol adaptation unit, is used to establish a unified time reference and maintain device-level clock offset. The time alignment unit is connected to the time base management unit and is used to perform time alignment and disordered rearrangement of multi-source data based on event time, so as to output the aligned data sequence. The data fusion unit, connected to the time-series alignment unit, is used to perform cross-database association queries on the aligned data sequence to generate a boiler operating condition view. The audit log unit is connected to the data fusion unit and is used to trigger alarms and generate inspection audit records based on the working condition view, and to associate information with the video and access control system through the peripheral adapter interface; The cloud-edge collaboration unit is connected to the audit log unit and is used to securely synchronize audit log summaries and perform caching and retransmission in the event of disconnection. The security authentication unit is used to perform national cryptographic algorithm authentication and device fingerprint binding on access devices; The data fusion unit performs interval association queries based on device identifiers and event times, performs nearest neighbor matching within a configurable time tolerance threshold, and performs weighted fusion of multi-source indicators based on quality identifiers to generate a boiler operating condition view that includes source lineage. The adaptive calculation of the time tolerance threshold and quality weight coefficient includes the following steps: Step B1, in window number During the cross-database association process, the time tolerance threshold for nearest neighbor matching is updated exponentially with smoothness. The update result is denoted as: ， in, For the first The time tolerance threshold used for each sliding window is in seconds. The threshold value for the previous window, in seconds. For updating gain, dimensionless, This is the hard upper limit of the tolerance, in seconds. This is the lower tolerance limit, in seconds. The coefficient for the baseline term is expressed in seconds. These are the weighting coefficients for time offset, event jitter, and network jitter, respectively; they are dimensionless. This is an estimate of the time offset between devices, in seconds. This is a statistic of residual event time jitter within the window, in seconds. This is a network jitter statistic within the window, expressed in seconds. Indicates the first A sliding window, where the functions min and max represent the operations of taking the lower limit and the upper limit, respectively; The update gain is defined as: ， in, To update the gain cap, dimensionless. The span of the sliding window is in seconds. This is the end-to-end latency estimate, in seconds; Step B2, for the source set entering the fusion Each source in Based on the comprehensive quality indicators, missing detection rate, and alignment residuals, normalized weights are calculated for weighted fusion: ， in, For source The fusion weights are dimensionless. For the set of sources participating in the fusion, the subscript is... For source indexing, dimensionless. For source The average quality indicator within the window is dimensionless; a higher value indicates higher quality. For source Missing rate, dimensionless. For source The alignment residual variance or mean square, in units of , These are the quality and missing measurement sensitivity indices, respectively, dimensionless. The residual attenuation coefficient is dimensionless. It is an exponential function; Step B3, when Increase when tightening or system load increases. and rise When residual statistics When it continues to rise, it adaptively increases. Alternatively, the participation level of the corresponding source could be lowered to mitigate short-term network fluctuations by limiting... The growth rate; Step B4, and The data is synchronously sent to the data fusion and audit log unit as the window scrolls. When the alignment confidence decreases or abnormal intervals are marked, the restrictions are temporarily relaxed. But inhibit The upper limit.

2. The boiler room inspection log auditing system based on edge computing as described in claim 1, characterized in that, The protocol adaptation unit supports Modbus, OPC UA, and BACnet. The unified data model includes at least: device identifier, measurement point identifier, event time, server time, value, unit, quality identifier, data source, and serial number, and provides automatic protocol selection and parsing based on the device identifier.

3. The boiler room inspection log auditing system based on edge computing as described in claim 1, characterized in that, The time base management unit is used for: Connect to PTP and / or NTP time sources to form a unified time reference; Estimation and reliability based on equipment maintenance time offset; When the time source is abnormal, a local monotonic clock is used for degradation, and the abnormal interval is marked.

4. The boiler room inspection log auditing system based on edge computing as described in claim 1, characterized in that, The timing alignment unit uses a sliding window to buffer multiple source data streams and estimates the time offset and alignment path between multiple streams based on a dynamic time warping algorithm. The dynamic time warping sets an upper limit for the offset and a constraint band, and outputs the alignment confidence score. The cost function, constraint band, and complexity control strategy of the dynamic time warping algorithm are set as follows: Step A1, within the sliding window... Flow and Pair the stream samples and construct a weighted cost that includes quality penalty and time normalization: ， in, To make the first indivual Flow samples and the first indivual The local cost of stream sample pairing, dimensionless. , For the corresponding sample values, , The event time for the sample is in seconds. Indicates the source flow. Indicates origin flow, Indicates origin flow, , This is a sample index, dimensionless. The weights for numerical difference and time difference. The power of the numerical difference. The time difference is normalized to a standard scale, with the unit being seconds. For quality penalty weight, As a marker of sample quality; Step A2: Based on the in-window offset estimate and jitter statistics provided by the time base management unit, limit the feasible pairing set and adaptively adjust the bandwidth: ， ， in, To allow the set of index pairs to enter the dynamic programming, This is an estimate of the time offset between devices within the window, in seconds. This is the maximum allowed time offset for this window, in seconds. The lower and upper bounds of the local slope constraint are dimensionless. The event time for each of the preceding aligned samples, in seconds. This is a global hard limit, in seconds. This is the bandwidth margin factor, which is dimensionless. This is a statistic of residual time jitter within the window, in seconds; when or Or, if the denominator is zero, no slope constraint is applied, only the time offset constraint is applied; Step A3, in the set Under the strip clipping, the upper bound of the expected computational cost of dynamic programming is expressed as: ， in, The computational magnitude after strip clipping is dimensionless. For the window Stream sample size, dimensionless. The expected number of candidates to be compared for each row, dimensionless. for The arrival density of the flow event, in units of 1 / second.

5. The boiler room inspection log auditing system based on edge computing as described in claim 1, characterized in that, The timing alignment unit also includes a water level generation and allowable late arrival time strategy, which rearranges late data and updates the output records within the allowable time limit, discards or supplements late data that exceeds the time limit, and distinguishes them by quality identifier.

6. The boiler room inspection log auditing system based on edge computing as described in claim 1, characterized in that, The audit log unit performs conditional judgments on multiple indicators based on the rule engine. When an alarm event is triggered, it retrieves time-aligned video clips through the peripheral device adaptation interface and associates them with the access control status to generate an audit record containing time range, device list, trigger conditions and peripheral device evidence. The system does not replace the decision-making and execution of the underlying security interlocks.

7. The boiler room inspection log auditing system based on edge computing as described in claim 1, characterized in that, The cloud-edge collaboration unit includes a data synchronization agent and cache management module, which compresses and encrypts the audit log summary when the network is available, and implements persistent caching and priority-based retransmission when the connection is lost. When concurrent modifications occur, conflict detection and merging are performed based on causal logs, and causal relationships are implemented through logical clocks or vector clocks.

8. The boiler room inspection log auditing system based on edge computing as described in claim 1, characterized in that, The security authentication unit implements the device network access process, including device broadcast discovery, two-way authentication based on national cryptographic algorithms, and device fingerprint binding; the device fingerprint is generated by combining hardware features and bound to the certificate.

9. A method for auditing boiler room inspection logs based on edge computing, based on the boiler room inspection log auditing system based on edge computing as described in any one of claims 1 to 8, characterized in that, include: Step S1: Collect data from multiple protocol devices and convert it into a unified data model; Step S2: Establish a unified time base and estimate device-level time offset; Step S3: Perform time alignment based on sliding window and dynamic time warping, and execute water level and allow late processing to output the aligned sequence; Step S4: Based on the device identifier and event time, perform cross-database association within a preset time tolerance and weighted fusion according to quality identifier to form a working condition view; Step S5: Trigger alarms according to the rules engine and generate audit records by associating video and access control information; Step S6: The audit log summary is synchronized between the cloud and the edge using compression and encryption. It is cached in the disconnected state and retransmitted after reconnection. If a conflict occurs, it is merged based on the causal log.

Images