Risk intelligent prediction method based on process mining

Abstract

The present invention discloses a risk intelligent prediction method based on process mining, and the method comprises the following steps: step 1, reading the real-time monitoring data of the sensor and performing preprocessing; step 2, determining whether the real-time monitoring data is abnormal and the abnormal level; step 3, determining whether the abnormality is a false alarm; step 4, generating a candidate set of process models according to the abnormal type; step 5, screening the process models in the candidate set according to the abnormal classification; step 6, calculating the probability that the screened emergency management process model is applicable to the current abnormality; step 7, sorting the prediction results and issuing a prediction warning. The method can not only issue a warning through the abnormal situation of the monitoring data, but also obtain the possible future events, dangerous situations, sensor value changes and their probability of occurrence by using the process model library and the emergency management knowledge base, and even the historical processing method and its effect of the specific situation, as decision support information output.

Description

Technical Field

[0001] The present invention belongs to the technical field of safe production and emergency management, and relates to a risk prediction method, and specifically to a risk intelligent prediction method based on process mining with a chemical park as the core. Background Art

[0002] As of the end of 2020, there were 616 key chemical parks or industrial parks with petroleum and chemical as the leading industries in China. Taking traditional parks as an example, once a public emergency occurs in the park, most of the work, from the formulation of the overall emergency plan to the management mechanism and personnel control, still relies on manpower to complete, making it difficult to achieve rapid management response and data statistics, and unable to ensure timely and accurate information collection. The construction of the overall event impact assessment, reconstruction, and recovery of production capacity is not perfect enough, and the allocation of various emergency resources is unreasonable, and the emergency rescue capacity is not strong. Although my country has established its own legal system for the safety supervision of hazardous chemicals, and has issued a series of management regulations and standards for hazardous chemicals, which has played a positive role in effectively controlling and preventing the hazards of hazardous chemicals, the current safety supervision system of hazardous chemicals in my country can no longer meet the needs of the market economy. The system construction itself has outstanding problems such as legislative lag, contradictions in system standards, and non-conformity with international standards. Secondly, enterprises have weak prevention awareness and imperfect early warning and monitoring systems. Moreover, when hazardous chemical accidents occur, they are still in a hurry to face the phenomenon, causing unnecessary losses.

[0003] Risk refers to the possibility of a certain loss occurring in a certain environment and within a certain period of time. Risk is composed of risk factors, risk accidents and risk losses. There are two definitions of risk: one definition emphasizes that risk manifests as uncertainty; the other definition emphasizes that risk manifests as uncertainty of loss. Specifically speaking, the risks in chemical parks include both the uncertainty of risk and the uncertainty of loss caused by risk. For example, excessive organic phosphorus in chemical wastewater will cause serious negative ecological / economic impacts on the surrounding environment, but it is uncertain when this excess will occur and the severity of the harm. If risks can be predicted, specific measures to reduce the probability of risk occurrence can be implemented according to specific circumstances to reduce negative impacts and seek better safety levels and economic benefits.

[0004] Intelligent risk prediction is a method that combines advanced technical means such as process mining to process data and then output decision support. Based on the real-time information on major emergency incidents collected by monitoring and surveillance and historical data of the same period, intelligent analysis and risk identification are carried out to make a scientific and comprehensive assessment of the possible scope of harm and disaster derivatives of potential risks. At the same time, more accurate prediction and early warning results are provided through graphical display functions to gain an advantage in emergency response. This intelligent prediction method needs to be combined with modules such as process model library and emergency management knowledge base, and finally output in the form of decision support information.

[0005] The process model library refers to a data warehouse that stores emergency management plan process models mined from the historical emergency handling event logs of the chemical park, describing the treatment measures, configuration of emergency resources, and treatment effects during the treatment process. In the process model library, emergency management processes of different abnormal types (such as SO2 leakage / high pipeline temperature) can be retrieved. After determining the type, the process model that meets the current abnormality can be further retrieved according to the severity of the abnormality, such as the deviation value of the excessive concentration. According to several screening conditions, one or several possible emergency management processes that meet certain requirements can be finally determined in the process model library. The emergency management knowledge base refers to a data warehouse that stores knowledge such as abnormality identification and correlation of abnormal events in the chemical park. Knowledge of emergency management can be obtained from the emergency management knowledge base, such as how to judge whether the real-time monitoring data is abnormal, the severity of the data abnormality, the probability that a certain emergency management process is suitable for a certain abnormality, and other information that supports decision-making.

[0006] Process mining refers to the technology of obtaining process knowledge from the data of actual business execution collected by information systems and extracting structured process models, which can discover, monitor and improve actual system behaviors. The α algorithm is a milestone algorithm for process mining. It constructs a process model represented by a Petri net by finding out the activities in the process and mining the four basic relationships in the log, namely, follow-up, concurrency, causality and irrelevant relationships. However, since the α algorithm cannot solve the noise problem and identify anomalies, researchers have proposed a series of new algorithms from different angles to solve these problems, such as inductive mining algorithms, heuristic mining algorithms, etc.

[0007] Multi-source heterogeneous data fusion and analysis refers to the emergency management of chemical parks, which involves data with different attributes / dimensions from many sources such as meteorology, sensors, RFID, cameras, edge servers, etc.

[0008] Although these technologies have been widely used in practical scenarios, considering the characteristics and needs of the emergency management field, it is necessary to expand the application scenarios of process mining technology and propose new risk intelligent prediction methods that are suitable for emergency management. Summary of the invention

[0009] In view of the frequent accidents in the chemical industry that cause losses of life, property and materials, and the fact that the means of risk prediction of enterprises are in the primary stage and the emergency handling management is imperfect, how to use advanced technology and existing domain knowledge to achieve risk prediction, the present invention provides a risk intelligent prediction method based on process mining. The method is based on the data of the process model library and emergency knowledge library based on the Internet of Things and big data, and is used to analyze the safety risks of the park from the real-time data generated by the park. It can not only issue warnings through abnormal conditions of monitoring data, but also obtain possible future events, dangerous conditions, changes in sensor values ​​and their probability of occurrence by using the process model library and emergency management knowledge library, and even the historical processing methods and effects of specific situations, as decision support information output.

[0010] The objective of the present invention is achieved through the following technical solutions:

[0011] A risk intelligent prediction method based on process mining includes the following steps:

[0012] Step 1: Read the real-time monitoring data of the sensor and perform preprocessing

[0013] Read real-time monitoring data from sensors in the chemical park, fuse and analyze the multi-source heterogeneous data of sensors, and obtain standardized and formatted data D (Type i ,Monitor j ), indicating the data of monitoring subject sensor j monitoring abnormality type i;

[0014] Step 2: Determine whether the real-time monitoring data is abnormal and the abnormal level

[0015] Query the emergency management knowledge base EMKB to retrieve the abnormal data judgment knowledge with abnormal type i and sensor j, and retrieve D (Type i ,Monitor j )∈K(Type i ,Monitor j ,Level k ), then the current exception is determined to be Level k If it is Level 0, there is no abnormality, and return to step 1 for continuous monitoring;

[0016] Step 3: Determine whether the abnormality is a false alarm

[0017] Query the emergency management knowledge base EMKB to retrieve the alarm nature judgment knowledge K (Type i ,Monitor j ,Monitor else )=T(D(Type i,Monitor j )&&D(Type i ,Monitor elses )|t∈[0,5s]), that is, within 5 seconds, D(Type i ,Monitor j ) and D(Type i ,Monitor elses ) has an abnormality value of Level 0, then K(Type i ,Monitor j ,Monitor else ) is false, it is judged as a false alarm and returns to step 1 for continuous monitoring; otherwise K (Type i ,Monitor j ,Monitor else ) is true;

[0018] Step 4: Generate process model candidate sets based on exception types

[0019] According to Type i 、Monitor j Access the emergency management process model EMPM with abnormal type i and monitoring subject sensor j, and add these process models to the candidate set S i ={EMPM(Type i ,Monitor j )|EMPM∈PML};

[0020] Step 5: Filter the process models in the candidate set based on anomaly classification

[0021] Query the emergency management knowledge base EMKB to retrieve the abnormal data judgment knowledge with abnormal type i and sensor j, and retrieve D (Type i ,Monitor j )∈K(Type i ,Monitor j ,Level k ), in the candidate set S i The exception level is kept as Level k , delete the process models of other abnormal levels, and get the updated candidate set S i ={EMPM(Type i ,Monitor j ,Level k )|EMPM∈PML};

[0022] Step 6: Calculate the probability that the selected emergency management process model is applicable to the current anomaly

[0023] According to the candidate set S i The total number of process instances N in each model and the number of process instances n in each model EMPMi , respectively calculate the emergency management model EMPM i Applicable to abnormal data D(Type i ,Monitor j The probability P of the situation EMPMi , P EMPMi =n EMPMi / N×100%;

[0024] Step 7: Sort the prediction results and issue a prediction warning

[0025] According to the final candidate set S i The probability P of each process model being applicable EMPMi Sort by largest to smallest and issue a prediction as the result.

[0026] Compared with the prior art, the present invention has the following advantages:

[0027] 1. The present invention combines the needs of emergency management in chemical parks, studies multi-source heterogeneous data fusion and analysis technology, builds a data fusion bus with the emergency management business process as the core, filters, cleans, analyzes and standardizes the collected data, thereby not only linking the physical world with the computer world, but also connecting the hardware, embedded software and middleware at the edge of the network with the enterprise system, so that the data generated by distributed physical events can be uniformly transmitted to the emergency management platform, laying the foundation for subsequent data utilization.

[0028] 2. The present invention takes the potential risks of chemical parks as the background, uses the data of sensors in the chemical park information system to obtain real-time data, and combines the emergency management knowledge base to judge the abnormal situation of the data and the nature of the alarm when abnormal, avoiding the delay and inaccuracy of manual judgment of risk situations and manual selection of emergency processes. At the same time, it can help chemical parks to accurately identify risks, intelligently predict and deal with risks, and provide solutions for emergency management plans, describe the emergency management plans recommended for current risks and their probability of adapting to the current situation, improve the response efficiency and processing effect of chemical parks in dealing with safety risks, and help the parks better deal with emergencies and reduce losses.

[0029] 3. When judging data anomalies and alarm properties, the present invention proposes "false alarms" to identify situations where certain data anomalies are actually risk-free, which can help the park reduce unnecessary risks and safety processing processes. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is an architecture diagram of the risk intelligent prediction method based on process mining of the present invention;

[0031] Figure 2 is a schematic diagram of step (3);

[0032] Figure 3 It is a schematic diagram of step (4) and step (5). DETAILED DESCRIPTION

[0033] The technical solution of the present invention is further described below in conjunction with the accompanying drawings, but is not limited thereto. Any modification or equivalent replacement of the technical solution of the present invention without departing from the spirit and scope of the technical solution of the present invention should be included in the protection scope of the present invention.

[0034] In order to more clearly show the specific implementation method of the present invention, some related concepts are first described:

[0035] A large number of event logs are collected in the emergency management platform based on the Internet of Things, which include the executed emergency handling process instances Trace. The Trace consists of a series of events Event that occur in time sequence.

[0036] Event E is the basic element of Trace, represented by E s / E c =(eName, t, actor, attrVal), where: 1) E s and E c Represents different life cycle states of the same event E. Each event has two states: start and end. s Indicates the starting state of event E, E c Indicates the end state of event E, E s and E c eName, t, actor, and attrVal are all the same; 2) eName is the name of event E, and E(eName) can be used to represent event E; 3) t is the timestamp of event E, indicating the time when the event occurred; 4) actor is a person, organization, or automation resource involved in event E. An actor can be represented as actor = {service provider, partner, customer, automation resource}, and an automation resource can be an external entity such as a sensor, software system, etc. 5) attrVal = {(attr1,val1),...,(attr n ,val n )} is a collection of attributes and values ​​of event E, attr i is the i-th attribute of event E, val i Is the attribute attr i The value of .

[0037] An emergency handling process instance T consists of a series of events arranged in chronological order, which can be expressed as T(tName)= <E(1) (s / c) ,E(2) (s / c) ,...,E(m) (s / c) >, where: 1) tName is the unique identifier of process instance T; 2) E(i) is the i-th event in process instance T.

[0038] A value arc represents the flow of value between an activity and a participant. When an activity is performed by a participant, there is a value arc between them, represented by va = (a, ar, v in ,v out ), where: 1) a is an activity; 2) ar is the actor that executes a; 3) v in is the value or cost entered into activity a by ar; 4)v out It is the output value obtained after ar completes activity a.

[0039] The emergency management process model EMPM in the process model library PML is a value-oriented business process BPMN model, defined as EMPM = (A, Actor, VA, Edge, GXOR, GAND, start, end), where: 1) A is a set of service activities; 2) Edge = {(head, tail)} is a set of sequence flows, where (head, tail) represents the sequence flow from head to tail, head∈{A, GXOR, GAND, start}, tail∈{A, GXOR, GAND, end}; 3) GXOR and GAND represent exclusive and parallel gateways, respectively; 4) start and end represent the start event and end event of the process, respectively. 5) Actor is the set of participants in the service process model; 6) VA is the set of value arcs between A and Actor. The process model library PML stores emergency management processes of different exception types in partitions. For example, all emergency management processes for handling SO2 leaks are stored in the set S 二氧化硫 In the formula, PML = {S typei |typei is each abnormal type}. A process model of an abnormal type is classified and stored according to the degree of abnormality. For example, the concentration of sulfur dioxide leakage within 10%, 50%, and 100% of the standard value corresponds to different emergency management process models, represented by S 二氧化硫 ={EMPM(SO2,[i,j])|i,j are the lower and upper limits of sulfur dioxide concentration}.

[0040] The emergency management knowledge base EMKB is the existing domain knowledge. The knowledge in EMKB is divided into two categories: abnormal data judgment knowledge and alarm nature judgment knowledge. Abnormal data judgment knowledge is the abnormal range of the data (state, value, etc.) of each event in the process model, expressed as K (Type i ,Monitor j ,Level k )={t|t∈S i}, where S i It is the judgment range of monitoring subject sensor j monitoring type i at severity level k. For example, K(SO2,M1,III)=[300,+∞] means that if the sulfur dioxide concentration monitored by sensor M1 is greater than or equal to 300 units, it is judged as level 3 abnormality. The alarm nature judgment knowledge is to determine whether some abnormalities of sensor data are errors, mistakes, false alarms or real alarms, which is expressed as K(Type i ,Monitor j )=(Boolean expression), for example, K(SO2,M1)=(75% of the concentration observations within 1 minute are greater than the upper limit of normal && the difference between two adjacent observations does not exceed 100%).

[0041] Real-time monitoring data Ai It is divided into two categories: human-involved activity signals and unmanned sensor data, indicating that A i Real-time monitoring data of activity events. The data value range of real-time monitoring of activity signals with human participation is {true, false}, while the data of unmanned sensor is, for example, D A2 =0.9mol / L.

[0042] In the present invention, the risk intelligent prediction method based on process mining includes the following steps:

[0043] (1) Read the real-time monitoring data from the sensors and perform preprocessing. Read the real-time monitoring data from the sensors in the chemical park. The data types and abnormalities monitored by each sensor are different. Use the existing data fusion analysis technology to analyze the multi-source heterogeneous data of the sensor to obtain standardized and formatted data D (Type i ,Monitor j ), which indicates the data of abnormality type i detected by monitoring subject sensor j.

[0044] (2) Determine whether the real-time monitoring data is abnormal and the abnormality level. Access the emergency management knowledge base EMKB, retrieve the abnormal data determination knowledge with abnormal type i and sensor j, and retrieve D (Type i ,Monitor j )∈K(Typei ,Monitor j ,Level k ), then the current exception is determined to be Level k If it is Level 0, there is no abnormality, and the system returns to (1) to continue monitoring.

[0045] (3) Determine whether the anomaly is a false alarm. Query the emergency management knowledge base EMKB and retrieve the alarm nature judgment knowledge K (Type i ,Monitor j ,Monitor else )=T(D(Type i ,Monitor j )&&D(Type i ,Monitor elses )|t∈[0,5s]), that is, within 5 seconds, D(Type i ,Monitor j ) and D(Type i ,Monitor elses ) has an abnormality value of Level 0, then K(Type i ,Monitor j ,Monitor else ) is false, it is judged as a false alarm and returns to step 1 for continuous monitoring; otherwise K (Type i ,Monitor j ,Monitor else ) is True.

[0046] (4) Generate a candidate set of process models based on the exception type. i 、Monitor j Access the emergency management process model EMPM with abnormal type i and monitoring subject sensor j, and add these process models to the candidate set S i ={EMPM(Type i ,Monitor j )|EMPM∈PML}.

[0047] (5) Filter the process models in the candidate set according to the abnormal classification. Query the emergency management knowledge base EMKB, retrieve the abnormal data judgment knowledge with abnormal type i and sensor j, and retrieve D (Type i ,Monitor j )∈K(Type i ,Monitor j ,Levelk ). In the candidate set S i The exception level is kept as Level k , delete the process models of other abnormal levels, and get the updated candidate set S i ={EMPM(Type i ,Monitor j ,Level k )|EMPM∈PML}.

[0048] (6) Calculate the probability that the selected emergency management process model is applicable to the current anomaly. i The total number of process instances N in each model and the number of process instances n in each model EMPMi , respectively calculate the emergency management model EMPM i Applicable to abnormal data D(Type i ,Monitor j The probability P of the situation EMPMi =n EMPMi / N×100%.

[0049] (7) Sort the prediction results and issue a prediction warning. i The probability P of each process model being applicable EMPMi Sort by largest to smallest and issue a prediction as the result.

[0050] In the present invention, the complete risk intelligent prediction steps are as follows: Figure 1 The specific description of the algorithm is shown in Table 1.

[0051] Table 1

[0052]

[0053] In the present invention, a modeling method of an emergency management process model EMPM is provided. The method is based on the chemical park and various event log data collected by various devices and terminal systems of the Internet of Things emergency management platform. After parsing and counting the process instances, the process variants are abstracted into process variants, and the process variants are merged into process models. Value information is extracted from the data, and then the emergency management process model is constructed. The process instance set of each classification subject is repeated to establish a process model library. The specific implementation steps are as follows:

[0054] Step 1: Data preprocessing:

[0055] Clean, filter and classify the event data stored in the emergency management platform to obtain the event log collection log;

[0056] Step 2: Process instance analysis and statistics:

[0057] Take a set of process instances of a classification subject S as a sample, analyze and count the process instances T in it, and obtain the set {(T1,n1),(T2,n2),...,(T k ,n k )}, where T i is a specific process instance, n i is the number of instances of the process. The specific steps are as follows:

[0058] Step 21: Take a set of process instances of a classification subject S as a sample, map the events of the process instance T to corresponding activities a with the same name, and mine the activity sequence relationship and parallel relationship according to the temporal relationship, so as to determine the activities a and their relationships contained in the process instance T;

[0059] Step 22: merge the process instances T containing the same activity a and its relationship, count the number of identical instances, and obtain the set {(T1,n1),(T2,n2),...,(T k ,n k )};

[0060] Step 3: Abstract the process instance into a process variant:

[0061] Determine the process instance set {T1,T2,...,T k}, merge the process instances T with the same loop relationship, and abstract the process instance set into a process variant set {VI1, VI2, ..., VI p};

[0062] Step 4: Merge process variants into process model PM:

[0063] For the variant set {VI1,VI2,...,VI p} are merged in pairs in turn to determine the selection relationship of the variants, thereby obtaining a complete process model PM. The specific steps are as follows:

[0064] Step 41: for the variant set {VI1, VI2, ..., VI p The process variants in} are merged in pairs in turn, integrating and retaining the same parts of the two variants, while the different parts exist in the form of selection relationships, and the process variants with selection relationships are merged;

[0065] Step 42: extract all non-repeated events, activities and gateways in the original process variant, and identify the gateways according to the elements they are connected to;

[0066] Step 43: traverse each edge (head, tail) in all the original process variants and add them to the new process model without duplication. Since there are different parts between the variants, there may be a non-gateway element with multiple outgoing edges in the new process model. It is necessary to add a selection gateway for the element, replace the head in all the outgoing edges of the element with the selection gateway, delete all the outgoing edges of the element, and finally add an edge from the element to the selection gateway to obtain a complete process model PM.

[0067] Step 5: Extract the value arc set VA:

[0068] Based on each activity in the activity set obtained in step 2, extract the corresponding participants ar and input value v from the corresponding event E in and output value v out , thereby obtaining the value arc set VA, the specific steps are as follows:

[0069] Step 51: Based on the activity a obtained in step 2, extract the corresponding participant ar from the corresponding event E, and extract the input value v of ar participating in the activity a from the set of attributes and values ​​of event E attrVal in and output value v out , thus determining the value arc between them va=(a,ar,v in ,v out );

[0070] Step 52: Perform the operation of step 51 on each activity to obtain the value arc set VA;

[0071] Step 6: Construct the emergency management process model EMPM:

[0072] Mark each value arc in the value arc set VA to the corresponding activity a in the process model PM i On the basis of the above, the emergency management process model EMPM is established. The specific steps are as follows:

[0073] Step 61: If the value arc (a i ,ar j ,v in ,v out ) Activity a i and activity a in process model PM i are the same, then annotate the value arc to the corresponding activity a in the process model PM i superior;

[0074] Step 62: Repeat step 61 to establish an emergency management process model EMPM = (A, Actor, VA, Edge, GXOR, GAND, start, end), where: A is a set of service activities; Edge = {(head, tail)} is a set of sequence flows, head∈{A, GXOR, GAND, start}, tail∈{A, GXOR, GAND, end}; GXOR and GAND represent exclusive and parallel gateways, respectively; start and end represent the start event and end event of the process, respectively; Actor is a set of participants in the service process model; VA is a set of value arcs between A and Actor;

[0075] Step 7: Form a process model library:

[0076] The emergency management process model EMPM of the classification subject S is added to the process model library; steps 2 to 6 are repeated for the process instance set of each classification subject, and the emergency management process model corresponding to each classification entity is added to the process model library, thereby obtaining a complete process model library.

[0077] In the above steps, step 3, step 4 and step 5 are executed in parallel. The specific description of the execution process algorithm of the whole method is shown in Table 2.

[0078]

[0079] In this invention, the definition and determination process of the candidate set of the emergency management process model is proposed: the candidate set is a set of emergency management processes that may be suitable for a certain risk type, denoted as S i ={EMPM(Type i ,Monitor j )|EMPM∈PML}. The determination process is to first screen the abnormal type in the process model library, then screen the sensor subject, and finally screen the abnormal level.

[0080] In the present invention, the risk prediction emergency plan finally output has the following characteristics: first, it matches the current risk anomaly with the targeted risk situation; second, it has the highest probability of being adopted when handling anomalies of the same situation in history; third, it can effectively resolve the risk anomaly when handling anomalies of the same situation in history.

[0081] Example:

[0082] This embodiment uses the monitoring data of an emergency management platform of a chemical park as a sample. Since the platform stores tens of millions of data, the process model library and the emergency management knowledge base are not the focus of the present invention. The data set of an intelligent risk prediction operation process is taken as an example to verify the subsequent steps of the present invention:

[0083] The emergency management platform of this chemical park has a process model library. The process model library stores historical emergency management processes in an orderly manner. Among them, the first-level classification indicator is the abnormality type. For example, sulfur dioxide leakage and nitrogen monoxide leakage are different abnormality types. The emergency management process for handling sulfur dioxide leakage and the emergency management process for handling nitrogen monoxide leakage are stored separately; the second-level classification indicator is the sensor. For example, the emergency management process used for the abnormal data of a sulfur dioxide concentration sensor in the warehouse of the chemical park is different from the emergency management process used for the abnormal data of a sulfur dioxide concentration sensor in the factory. The process model library stores the process models corresponding to different sensors under the same abnormality type separately; the third-level classification indicator is the abnormality level. For example, the data abnormality degree of the same sulfur dioxide concentration sensor in a warehouse in the chemical park is different (such as twice the standard and ten times the standard), and the emergency management processes adopted in history are different. These emergency management processes are also stored separately.

[0084] The emergency management platform of this chemical park has an emergency management knowledge base. The emergency management knowledge base stores the emergency management knowledge required for intelligent risk prediction in an orderly manner. Among them, the emergency management knowledge includes the abnormality judgment knowledge of each sensor and the alarm nature judgment knowledge. The abnormality judgment knowledge refers to the data abnormality range of each risk prediction sensor in the chemical park. The alarm nature judgment knowledge refers to combining the accuracy, stability, and reliability of the sensor, and the characteristics of the risk, to determine whether the real-time data of the sensor indicates that a risk has occurred. The abnormality judgment knowledge is retrieved based on the three parameters of abnormality type, sensor, and abnormality level, and the required real-time input is used to determine whether the alarm is valid.

[0085] As shown in Table 3, the detailed steps are as follows:

[0086] Step 1: Input the real-time monitoring data of the sensor, analyze and integrate it, and obtain the standard formatted data D1(SO2, sensor 1) = 0.1 mol / L.

[0087] Step 2: Access the emergency management knowledge base and retrieve the abnormality judgment knowledge (abnormal data range and level) of D(SO2, sensor 1). D1(SO2, sensor 1) is at [0.05, 0.15] mol / L, which belongs to Level 2 and is a secondary abnormality.

[0088] Step 3: Access the emergency management knowledge base, retrieve the alarm nature judgment knowledge of D(SO2, sensor 1), K1(sulfur dioxide, sensor 1, sensor 2), input the data of sensor 1 and sensor 2 into K1, and the data of both sensors are within the Level 2 range within 5 seconds, which is judged as a valid alarm. The abnormal data D1 of sensor 1 is risky. The specific process is as follows: Figure 2 shown.

[0089] Step 4: Access the process model library, match the process model according to the abnormal type of sulfur dioxide leakage and the sensor of sensor 1, and obtain the process model candidate set S1 = {EMPM (SO2 leakage, sensor 1) | EMPM∈PML}.

[0090] Step 5: In the candidate set obtained in the previous step, according to the abnormal level of Level 2, select the final candidate set S1 = {EMPM (SO2 leakage, sensor 1, Level 2) | EMPM∈PML} that meets the abnormal level. Figure 3 The following is the implementation process of the fourth and fifth steps.

[0091] Step 6: Calculate the appropriate probability of each process model in S1. Based on the number of occurrences of process instances of each process model in history, as the frequency of each process model, calculate the frequency of each emergency management process being adopted, as the probability of the appropriate emergency management process being adopted to handle the current abnormal risk. EMPM1 =70%, P EMPM2 =20%, P EMPM3 =10%.

[0092] Step 7: Sort the probability of each emergency management process in step 6 from large to small, P EMPM1 As a risk intelligent prediction solution and emergency management solution, the prediction results are given in the form of decision support suggestions.

[0093] Table 3

[0094]

[0095] According to the characteristics of process data and existing structural functions in the chemical park emergency management platform, the present invention proposes a risk intelligent prediction method based on process mining. Through this method, not only can an early warning be issued through abnormal conditions of monitoring data, but also possible future events, dangerous situations, sensor value changes and their probability of occurrence can be obtained by using the process model library and the emergency management knowledge base, and even the historical processing methods and effects of specific situations can be output as decision support information. The risk intelligent prediction method is a comprehensive application of the emergency management platform, the process model library, and the emergency management knowledge base. The method includes the identification and determination of risks and the prediction of emergency plans. The perfect process model library is conducive to helping enterprises better deal with emergencies.

Claims

1. A risk intelligent prediction method based on process mining, characterized by The method comprises the following steps: Step 1: Read the real-time monitoring data of the sensor and perform preprocessing Read real-time monitoring data from sensors in the chemical park, analyze the multi-source heterogeneous data of sensors, and obtain standardized and formatted data D (Type i ,Monitor j ), indicating the data of monitoring subject sensor j monitoring abnormality type i; Step 2: Determine whether the real-time monitoring data is abnormal and the abnormal level Query the emergency management knowledge base EMKB to retrieve the abnormal data judgment knowledge with abnormal type i and sensor j, and retrieve D (Type i ,Monitor j )∈K(Type i ,Monitor j ,Level k ), then the current exception is determined to be Level k If it is Level 0, there is no abnormality, and return to step 1 for continuous monitoring; Step 3: Determine whether the abnormality is a false alarm Query the emergency management knowledge base EMKB to retrieve the alarm nature judgment knowledge K (Type i ,Monitor j ,Monitor else )=T(D(Type i ,Monitor j )&&D(Type i ,Monitor elses )|t∈[0,5s]), that is, within 5 seconds, D(Type i ,Monitor j ) and D(Type i ,Monitor elses ) has an abnormality value of Level 0, then K(Type i ,Monitor j ,Monitor else ) is false, it is judged as a false alarm and returns to step 1 for continuous monitoring; otherwise K(Type i ,Monitor j ,Monitor else ) is true; Step 4: Generate process model candidate sets based on exception types According to Type i 、Monitor j Access the emergency management process model EMPM with abnormal type i and monitoring subject sensor j, and add these process models to the candidate set S i ={EMPM(Type i ,Monitor j )|EMPM∈PML}; Step 5: Filter the process models in the candidate set based on anomaly classification Query the emergency management knowledge base EMKB to retrieve the abnormal data judgment knowledge with abnormal type i and sensor j, and retrieve D (Type i ,Monitor j )∈K(Type i ,Monitor j ,Level k ), in the candidate set S i The exception level is kept as Level k , delete the process models of other abnormal levels, and get the updated candidate set S i ={EMPM(Type i ,Monitor j ,Level k )|EMPM∈PML}; Step 6: Calculate the probability that the selected emergency management process model is applicable to the current anomaly According to the candidate set S i The total number of process instances N in each model and the number of process instances n in each model EMPMi , respectively calculate the emergency management model EMPM i Applicable to abnormal data D(Type i ,Monitor j The probability P of the situation EMPMi ; Step 7: Sort the prediction results and issue a prediction warning According to the final candidate set S i The probability P of each process model being applicable EMPMi Sort by largest to smallest and issue a prediction as the result.

2. The risk intelligent prediction method based on process mining according to claim 1 is characterized in that The emergency management process model EMPM = (A, Actor, VA, Edge, GXOR, GAND, start, end), where: A is a set of service activities; Edge = {(head, tail)} is a set of sequence flows, (head, tail) represents the sequence flow from head to tail, head∈{A, GXOR, GAND, start}, tail∈{A, GXOR, GAND, end}; GXOR and GAND represent exclusive and parallel gateways respectively; start and end represent the start event and end event of the process respectively; Actor is a set of participants in the service process model; 6) VA is a set of value arcs between A and Actor.

3. The risk intelligent prediction method based on process mining according to claim 2 is characterized in that The emergency management process model EMPM is modeled according to the following method: Step 1: Data preprocessing: Clean, filter and classify the event data stored in the emergency management platform to obtain the event log collection log; Step 2: Process instance analysis and statistics: Take a set of process instances of a classification subject S as a sample, analyze and count the process instances T in it, and obtain the set {(T1,n1),(T2,n2),...,(T k ,n k )}, where T i is a specific process instance, n i is the number of instances of the process; Step 3: Abstract the process instance into a process variant: Determine the process instance set {T1,T2,...,T k }, merge the process instances T with the same loop relationship, and abstract the process instance set into a process variant set {VI1, VI2, ..., VI p }; Step 4: Merge process variants into process model PM: For the variant set {VI1,VI2,...,VI p The process variants in} are merged in pairs in turn to determine the selection relationship of the variants, thereby obtaining a complete process model PM; Step 5: Extract the value arc set VA: Based on each activity in the activity set obtained in step 2, extract the corresponding participants ar and input value v from the corresponding event E in and output value v out , thus obtaining the value arc set VA; Step 6: Construct the emergency management process model EMPM: Mark each value arc in the value arc set VA to the corresponding activity a in the process model PM i On the other hand, establish the emergency management process model EMPM; Step 7: Form a process model library: The emergency management process model EMPM of the classification subject S is added to the process model library; steps 2 to 6 are repeated for the process instance set of each classification subject, and the emergency management process model corresponding to each classification entity is added to the process model library, thereby obtaining a complete process model library.

4. The risk intelligent prediction method based on process mining according to claim 3 is characterized in that The specific steps of step 2 are as follows: Step 21: Take a set of process instances of a classification subject S as a sample, map the events of the process instance T to corresponding activities a with the same name, and mine the activity sequence relationship and parallel relationship according to the temporal relationship, so as to determine the activities a and their relationships contained in the process instance T; Step 22: merge the process instances T containing the same activity a and its relationship, count the number of identical instances, and obtain the set {(T1,n1),(T2,n2),...,(T k ,n k )}.

5. The risk intelligent prediction method based on process mining according to claim 3 is characterized in that The specific steps of step 4 are as follows: Step 41: for the variant set {VI1, VI2, ..., VI p The process variants in} are merged in pairs in turn, integrating and retaining the same parts of the two variants, while the different parts exist in the form of selection relationships, and the process variants with selection relationships are merged; Step 42: extract all non-repeated events, activities and gateways in the original process variant, and identify the gateways according to the elements they are connected to; Step 43, traverse each edge (head, tail) in all the original process variants and add them to the new process model without duplication. Since there are different parts between the variants, there may be a non-gateway element with multiple outgoing edges in the new process model. It is necessary to add a selection gateway for the element, replace the head in all the outgoing edges of the element with the selection gateway, delete all the outgoing edges of the element, and finally add an edge from the element to the selection gateway to obtain a complete process model PM.

6. The risk intelligent prediction method based on process mining according to claim 3 is characterized in that The specific steps of step 5 are as follows: Step 51: Based on the activity a obtained in step 2, extract the corresponding participant ar from the corresponding event E, and extract the input value v of ar participating in the activity a from the set of attributes and values ​​of event E attrVal in and output value v out , thus determining the value arc between them va=(a,ar,v in ,v out ); Step 52: Perform the operation of step 51 for each activity to obtain the value arc set VA.

7. The risk intelligent prediction method based on process mining according to claim 3 is characterized in that The specific steps of step 6 are as follows: Step 61: If the value arc (a i ,ar j ,v in ,v out ) Activity a i and activity a in process model PM i are the same, then annotate the value arc to the corresponding activity a in the process model PM i superior; Step 62. Repeat step 61 to establish the emergency management process model EMPM = (A, Actor, VA, Edge, GXOR, GAND, start, end), where: A is a set of service activities; Edge = {(head, tail)} is a set of sequence flows, head∈{A, GXOR, GAND, start}, tail∈{A, GXOR, GAND, end}; GXOR and GAND represent exclusive and parallel gateways respectively; start and end represent the start event and end event of the process respectively; Actor is a set of participants in the service process model; VA is a set of value arcs between A and Actor.

8. The risk intelligent prediction method based on process mining according to claim 1 is characterized in that The P EMPMi The calculation formula is: EMPMi =n EMPMi / N×100%.

Images