Alarm method, device and equipment based on the integration of IT equipment and OT equipment

Abstract

The present application discloses an alarm method, device and equipment based on the integration of IT equipment and OT equipment, the method comprising: obtaining the equipment data of IT equipment and OT equipment; when the equipment data meets the alarm triggering condition corresponding to the root node in the preset binary tree, outputting the alarm information corresponding to the leaf node of the root node; when the equipment data does not meet the alarm triggering condition, taking the first intermediate node of the preset binary tree as the current intermediate node, and when the current intermediate node is the first node, searching the equipment data for data that meets the equipment technical indicator query condition corresponding to the first node; when the search is successful, outputting the alarm information corresponding to the leaf node of the current intermediate node, and continuing to search when the search is unsuccessful and the next node is the first node. Among them, by automatically analyzing the equipment data of IT equipment and OT equipment using the binary tree structure, the troubleshooting efficiency is improved.

Description

Technical Field

[0001] The present application belongs to the field of equipment safety technology, and in particular, relates to an alarm method, device and equipment based on the integration of IT equipment and OT equipment. Background Art

[0002] In order to achieve intelligent management, some companies will establish a security monitoring and operation and maintenance platform, which will collect data from various types of equipment, monitor the collected data manually, and troubleshoot equipment failures when the data is abnormal.

[0003] Taking coal mining enterprises as an example, the safety monitoring and operation and maintenance platform can support the collection of data from safety equipment, network equipment, automation systems, monitoring systems, key business systems, coal mining machines, chutes, main lane belts, main inclined belts, mine ventilation, raw coal bins, air compressor rooms, product storage locations, central pump rooms and other equipment. When the data is abnormal, manual troubleshooting of equipment failures is required, resulting in slow response to equipment failures and low troubleshooting efficiency. Summary of the invention

[0004] The embodiments of the present application provide an alarm method, apparatus, and equipment based on the integration of IT equipment and OT equipment, which can timely warn of equipment failures to at least a certain extent and improve the efficiency of troubleshooting.

[0005] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0006] According to a first aspect of an embodiment of the present application, an alarm method based on the integration of IT equipment and OT equipment is provided, including: obtaining equipment data of IT equipment and OT equipment; when the equipment data meets the alarm trigger condition corresponding to the root node in a preset binary tree, outputting the alarm information corresponding to the leaf node of the root node, wherein the alarm trigger condition includes the alarm event of the IT equipment and / or the OT equipment; when the equipment data does not meet the alarm trigger condition, taking the first intermediate node of the preset binary tree as the current intermediate node, and when the current intermediate node is the first node, searching the equipment data for data that meets the equipment technical indicator query condition corresponding to the first node; when the search is successful, outputting the alarm information corresponding to the leaf node of the current intermediate node; when the search is unsuccessful, taking the next intermediate node as the current intermediate node, and returning to the step of searching the equipment data for data that meets the equipment technical indicator query condition corresponding to the first node when the current intermediate node is the first node.

[0007] In some embodiments of the present application, based on the aforementioned scheme, the alarm method based on the integration of IT equipment and OT equipment also includes: when the device data does not meet the alarm trigger condition and the current intermediate node is the second node, outputting a manual handling work order corresponding to the second node; in response to a first handling result returned externally based on the manual handling work order, when the next intermediate node is the first node, taking the next intermediate node as the current intermediate node, and returning the step of searching the device data for data that meets the equipment technical indicator query condition corresponding to the first node when the current intermediate node is the first node; in response to the second handling result returned externally based on the manual handling work order, outputting the alarm information corresponding to the leaf node of the current intermediate node.

[0008] In some embodiments of the present application, based on the aforementioned scheme, the intermediate nodes in the preset binary tree include the first node and the second node, and the alarm method based on the integration of IT equipment and OT equipment also includes: respectively setting the alarm trigger conditions corresponding to the root node in the binary tree, the equipment technical indicator query conditions corresponding to each first node, the manual handling work order corresponding to each second node, and the alarm information corresponding to each leaf node to obtain the preset binary tree.

[0009] In some embodiments of the present application, based on the aforementioned scheme, the alarm trigger condition includes multiple alarm events, and the logical relationship between the multiple alarm events is OR logic, and / or, and AND logic. The alarm method based on the integration of IT equipment and OT equipment also includes: when the logical relationship is OR logic and the device data satisfies any one of the alarm events, determining that the device data satisfies the alarm trigger condition corresponding to the root node in the preset binary tree; when the logical relationship is AND logic and the device data satisfies all the alarm events, or when the logical relationship is AND logic and it is not determined whether the device data satisfies all the alarm events within a preset time period, determining that the device data satisfies the alarm trigger condition corresponding to the root node in the preset binary tree; when the logical relationship is AND logic and the device data satisfies some of the alarm events, determining that the device data does not satisfy the alarm trigger condition.

[0010] In some embodiments of the present application, based on the aforementioned scheme, the device technical indicator query conditions include the name of the target device, the name of the technical indicator of the target device, the value range of the technical indicator, and the device relationship between the device corresponding to the alarm trigger condition and the target device.

[0011] In some embodiments of the present application, based on the aforementioned scheme, the device relationship includes preamble, same group and linkage, and the alarm method based on the integration of IT equipment and OT equipment also includes: when the target device is the same as the device corresponding to the alarm trigger condition, determining that the device relationship is a preamble; when the target device and the device corresponding to the alarm trigger condition belong to the same group of devices, determining that the device relationship is the same group; when the target device and the device corresponding to the alarm trigger condition have a locked relationship, determining that the device relationship is linkage.

[0012] In some embodiments of the present application, based on the aforementioned solution, the alarm information includes the alarm name, the alarm level, the name of the target device, and image information captured by an image capture device in the same group as the target device.

[0013] In some embodiments of the present application, based on the aforementioned scheme, after obtaining the preset binary tree, the alarm method based on the integration of IT equipment and OT equipment also includes: determining the operation authority of the rule administrator user on the preset binary tree according to whether the device corresponding to the preset binary tree is within the management authority of the rule administrator user.

[0014] According to the second aspect of the embodiment of the present application, an alarm device based on the integration of IT equipment and OT equipment is provided, including: a data acquisition module, used to acquire equipment data of information technology IT equipment and operational technology OT equipment; a root node execution module, used to output the alarm information corresponding to the leaf node of the root node when the equipment data meets the alarm trigger condition corresponding to the root node in the preset binary tree, wherein the alarm trigger condition includes the alarm event of the IT equipment and / or the OT equipment; an intermediate node execution module, used to take the first intermediate node of the preset binary tree as the current intermediate node when the equipment data does not meet the alarm trigger condition, and when the current intermediate node is the first node, search the equipment data for data that meets the equipment technical indicator query condition corresponding to the first node; a leaf node execution module, used to output the alarm information corresponding to the leaf node of the current intermediate node when the search is successful.

[0015] According to a third aspect of an embodiment of the present application, there is provided an alarm device based on the integration of IT equipment and OT equipment, including a processor and a memory, wherein the memory stores computer program instructions that can be executed by the processor, and when the processor executes the computer program instructions, the steps of the method described in any one of the first aspects above are implemented.

[0016] In this application, by obtaining the equipment data of information technology IT equipment and operational technology OT equipment;

[0017] When the device data meets the alarm trigger condition corresponding to the root node in the preset binary tree, the alarm information corresponding to the leaf node of the root node is output, wherein the alarm trigger condition includes the alarm event of the IT device and / or the OT device; when the device data does not meet the alarm trigger condition, the first intermediate node of the preset binary tree is used as the current intermediate node, and when the current intermediate node is the first node, the data that meets the device technical indicator query condition corresponding to the first node is searched in the device data; when the search is successful, the alarm information corresponding to the leaf node of the current intermediate node is output; when the search is unsuccessful, the next intermediate node is used as the current intermediate node, and the step of searching the device data for the data that meets the device technical indicator query condition corresponding to the first node when the current intermediate node is the first node is returned. Among them, by using the binary tree structure to automatically analyze the equipment data of IT equipment and OT equipment, the alarm information can be output in time when the equipment data meets the alarm trigger conditions. When the equipment data does not meet the alarm trigger conditions because it does not meet some alarm events, the cause of the alarm event is further discovered by searching the equipment technical indicators in the equipment data and outputting the alarm information, thereby achieving accurate tracing of the alarm event, providing support for intelligent operation and maintenance decision-making, accelerating the maintenance process, reducing maintenance costs, and improving troubleshooting efficiency and operation and maintenance efficiency.

[0018] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0020] Figure 1 A schematic diagram of a process of an alarm method based on the integration of IT equipment and OT equipment in one embodiment is shown;

[0021] Figure 2 A schematic diagram of the structure of a binary tree in one embodiment is shown;

[0022] Figure 3 Shows Figure 1 Schematic diagram of the rule interface corresponding to the preset binary tree;

[0023] Figure 4 Shows Figure 1Schematic diagram of the root node setting interface;

[0024] Figure 5 Shows Figure 1 Schematic diagram of the setting interface of the intermediate node and leaf node;

[0025] Figure 6 A schematic diagram showing the configuration of each node of a preset binary tree in one embodiment is shown;

[0026] Figure 7 A block diagram of an alarm device based on the integration of IT equipment and OT equipment in one embodiment is shown;

[0027] Figure 8 A schematic diagram of the structure of an alarm device based on the integration of IT equipment and OT equipment in an embodiment is shown. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0029] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0030] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0031] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0032] It should also be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the objects used in this way can be interchanged where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those shown or described.

[0033] Figure 1 FIG. 1 is a flow chart of an alarm method based on the integration of IT equipment and OT equipment in one embodiment. Figure 1 As shown, an alarm method based on the integration of IT equipment and OT equipment is provided, and the method may include the following steps 101 to 105.

[0034] Step 101, obtaining device data of IT devices and OT devices;

[0035] Step 102: when the device data satisfies the alarm triggering condition corresponding to the root node in the preset binary tree, output the alarm information corresponding to the leaf node of the root node, wherein the alarm triggering condition includes the alarm event of the IT device and / or the OT device;

[0036] Step 103: when the device data does not meet the alarm triggering condition, the first intermediate node of the preset binary tree is used as the current intermediate node, and when the current intermediate node is the first node, the device data is searched for data that meets the device technical indicator query condition corresponding to the first node;

[0037] Step 104: if the search is successful, output the warning information corresponding to the leaf node of the current intermediate node;

[0038] Step 105, when the search is unsuccessful, the next intermediate node is used as the current intermediate node, and when the current intermediate node is the first node, the step of searching the device data for data that meets the device technical indicator query condition corresponding to the first node is returned.

[0039] It is understandable that OT (Operational Technology) equipment can include automated equipment that monitors and controls the production process. By collecting data from OT equipment, the equipment data of OT equipment can be obtained. By collecting data from IT (Information Technology) equipment (such as network equipment, servers, etc.), the equipment data of IT equipment can be obtained. By integrating and analyzing the equipment data of the two types of equipment, comprehensive data management and utilization are achieved.

[0040] Figure 2 FIG. 2 shows a schematic diagram of the structure of a binary tree in an embodiment. Figure 2 As shown, the structure of the binary tree includes a root node Root, an intermediate node Node, and a leaf node Leaf. In the embodiment of the present application, it is necessary to match the device data with the conditions corresponding to the root node and the intermediate node (for example, determine whether the device data meets the alarm triggering condition corresponding to the root node in the preset binary tree, determine whether the data that meets the device technical indicator query condition corresponding to the first node can be found in the device data). When the device data does not match the conditions corresponding to the root node or the intermediate node, the left-order (Left) subsequent node of the node is matched, otherwise it points to the right-order (Right) subsequent node (that is, the leaf node Leaf of the node), and outputs the alarm information, to determine whether the device data meets the alarm triggering condition corresponding to the root node in the preset binary tree, for example, if it does not meet, the left-order intermediate node is matched, and if it meets, the alarm information corresponding to the right-order leaf node is output.

[0041] The intermediate node may include a first node and a second node. The first node is an automatically executed node, and the second node is a manual inspection node that requires manual intervention. There may be multiple intermediate nodes, which may be just the first node or the second node, or may include both the first node and the second node.

[0042] In some embodiments, a preset binary tree can be obtained by respectively setting the alarm trigger conditions corresponding to the root node in the binary tree, the equipment technical indicator query conditions corresponding to each first node, the manual handling work order corresponding to each second node, and the alarm information corresponding to each leaf node.

[0043] The alarm triggering conditions include alarm events of IT equipment and / or OT equipment, that is, it can be an alarm event of IT equipment, such as an alarm on a switch port; it can be an alarm event of OT equipment, such as an overvoltage alarm on a transformer box; it can also be an alarm event of IT equipment and OT equipment, such as an alarm on a switch port and an overvoltage alarm on a transformer box.

[0044] The alarm trigger condition can arrange multiple alarm events in a logical relationship. The logical relationship between alarm events can be OR logic, AND logic, or can include OR logic and AND logic. For example, the alarm trigger condition can be expressed in the form of alarm event 1 AND alarm event 2 AND alarm event 3, (alarm event 1 OR alarm event 2) AND alarm event 3. In the implementation process, each alarm event can include parameters such as logical relationship, business system name, device name, device component name, and alarm name. For details, please refer to Table 1:

[0045] Table 1

[0046] Logical Relationship Business Type Business System equipment part Alarm Name Eight major security Temperature and humidity sensor temperature Temperature is too high AND( electricity Transformer Box Voltage ANY OR) switch port ANY

[0047] As shown in Table 1, the alarm triggering condition is that the temperature and humidity sensor issues an over-temperature alarm and any alarm occurs on the voltage of the transformer box, or the temperature and humidity sensor issues an over-temperature alarm and any alarm occurs on the port of the switch.

[0048] When setting the alarm trigger conditions, in addition to setting the various parameters in the above alarm events, you can also set a preset duration to limit the matching time between device data and the alarm trigger conditions.

[0049] In some embodiments, the alarm trigger condition includes multiple alarm events. When the logical relationship is an OR logic and the device data satisfies any one of the multiple alarm events, it is determined that the device data satisfies the alarm trigger condition corresponding to the root node in the preset binary tree; when the logical relationship is an AND logic and the device data satisfies all alarm events, or the logical relationship is an AND logic and it is not determined whether the device data satisfies all alarm events within a preset time period, it is determined that the device data satisfies the alarm trigger condition corresponding to the root node in the preset binary tree; when the logical relationship is an AND logic and the device data satisfies some alarm events, it is determined that the device data does not satisfy the alarm trigger condition.

[0050] It should be emphasized that if there is only an OR logical relationship between the alarm events in the alarm trigger condition corresponding to the root node, it is only necessary for the device data to meet any one of the alarm events to determine that the device data meets the alarm trigger condition. If the device data does not meet all the alarm events, it means that no alarm event has been generated, and there is no need to match the intermediate nodes, and the step can be exited directly.

[0051] If there is an AND logic relationship between alarm events, it is necessary to wait for a certain period of time to determine whether the device data satisfies other alarm events after determining that the device data satisfies one of the alarm events. When the device data satisfies all alarm events with an AND logic relationship, or if it is not determined whether the device data satisfies all the alarm events within the preset time, it is determined that the device data satisfies the alarm trigger condition. If the logical relationship is AND logic and the device data satisfies some alarm events, it is determined that the device data does not satisfy the alarm trigger condition, and it is necessary to match the intermediate nodes to determine the cause of the alarm event.

[0052] The device technical indicator query condition may include parameters such as the name of the target device, the name of the technical indicator of the target device, the value range of the technical indicator, and the device relationship between the device corresponding to the alarm trigger condition and the target device. For details, please refer to the following Table 2:

[0053] Table 2

[0054] Business Type Business System equipment part Technical indicators Operators value electricity Transformer Box Voltage Working status ＝ Maintenance

[0055] It is understandable that the fields used in the alarm trigger conditions and equipment technical indicator query conditions can be obtained by drilling down layer by layer, including: application type (ten major categories) - business system - equipment - component (optional) - alarm point table information. In combination with user needs, three types of corresponding relationships can be established for equipment, including: preceding, same group and linkage. When the target device is the same as the device corresponding to the alarm trigger condition, the device relationship is determined to be preceding; when the target device and the device corresponding to the alarm trigger condition belong to the same group of devices, the device relationship is determined to be in the same group; when the target device and the device corresponding to the alarm trigger condition have a locked relationship, the device relationship is determined to be linkage.

[0056] Taking the device relationship as the preamble as an example, the alarm trigger condition corresponding to the root node includes the network disconnection alarm of the network device. The first node needs to query the port traffic of the network device. The device technical indicator query condition corresponding to the first node can be set to: preamble.network device.port.traffic>0Kpbs.

[0057] Taking the device relationship as the same group as an example, the alarm trigger condition corresponding to the root node includes the network disconnection alarm of the network device. The first node needs to query whether the network disconnection of the network device is caused by power supply reasons. The device technical indicator query condition corresponding to the first node can be set to: same group. Power equipment. Power supply status = "normal".

[0058] Taking the equipment relationship as linkage as an example, the alarm trigger conditions corresponding to the root node include the tunnel belt alarm of the tunnel boring machine. The first node needs to query whether the belt alarm is caused by the locking condition caused by the failure of the transport belt. The equipment technical indicator query condition corresponding to the first node can be set to: linkage. transport belt. operation status = "closed".

[0059] When setting the equipment technical indicator query conditions, in addition to setting the above parameters in the equipment technical indicator query conditions, you can also set the query time to improve the query efficiency. For example, the equipment technical indicator query conditions can be set as: same group. Network device. Port. Traffic ≧ 0Kpbs AND time between 2023 / 9 / 7 13:00:00 and between 2023 / 9 / 7 14:00:00. Searching for data that meets the equipment technical indicator query conditions in the equipment data can obtain the result set shown in Table 3 below, which can be used as part of the evidence for root cause analysis:

[0060] Table 3

[0061] serial number time flow 1 2023 / 9 / 7 13:00:00 5.24Kpbs 2 2023 / 9 / 7 13:05:00 0 3 2023 / 9 / 7 13:10:00 0 4 2023 / 9 / 7 13:15:00 1.23Kpbs 5 2023 / 9 / 7 13:20:00 0 6 2023 / 9 / 7 13:25:00 0 7 2023 / 9 / 7 13:30:00 0 8 2023 / 9 / 7 13:35:00 0 9 2023 / 9 / 7 13:40:00 45.43Kpbs 10 2023 / 9 / 7 13:45:00 0 11 2023 / 9 / 7 13:50:00 0 12 2023 / 9 / 7 13:55:00 0

[0062] If no data satisfying the equipment technical indicator query conditions corresponding to the first node is found in the equipment data, the matching of the next intermediate node is continued. If the next intermediate node is the first node, data satisfying the equipment technical indicator query conditions corresponding to the first node is searched in the equipment data; if the next intermediate node is the second node, the manual handling work order corresponding to the second node is output.

[0063] For manual handling of work orders, it can include parameters such as the person notified of the work order, the title of the work order notification, and the content of the work order. The work order content will display the information in the context as the basis for manual confirmation.

[0064] It can be understood that the binary tree exists in the form of an instance in the memory. When the device data meets the first alarm event in the alarm trigger condition, the system will create an instance. The instance can be uniquely identified by the device and alarm name corresponding to the alarm event in the alarm trigger condition. When the leaf node is executed, the instance will be destroyed. When the second node is executed, the instance will be suspended and resumed after manual confirmation. When the instance is created, the Context will be created synchronously. The Context is used to record all information in the matching process, including: line information, alarm information, matching results, query conditions, query results, device information, technical indicators and other information. When executing to the intermediate node or leaf node, the Context can be output.

[0065] When the system executes to the second node, it means that a manual processing work order needs to be automatically created to facilitate manual confirmation, and the status of this node in the memory is suspended. When the manual confirmation is completed, the manual processing work order is closed, the processing result is returned, and the second node is changed from the suspended state to the executed state for subsequent operations.

[0066] In some embodiments, when the device data does not meet the alarm triggering conditions and the current intermediate node is the second node, a manual handling work order corresponding to the second node is output; in response to the first handling result returned externally based on the manual handling work order, when the next intermediate node is the first node, the next intermediate node is used as the current intermediate node, and the step of searching the device data for data that meets the device technical indicator query conditions corresponding to the first node is returned when the current intermediate node is the first node; in response to the second handling result returned externally based on the manual handling work order, the alarm information corresponding to the leaf node of the current intermediate node is output.

[0067] The alarm information may include parameters such as the alarm name, the alarm level, the name of the target device, and image information collected by the image collection device in the same group as the target device.

[0068] It is understandable that a leaf node can only set an exit action. When the system executes to this node, it means that the matching work of the root node or the intermediate node has been completed and it is necessary to exit the preset binary tree.

[0069] The image information collected by the image acquisition device in the same group as the target device can be a video clip collected by the camera in the same group as the target device, so that the device failure can be visualized, making it easier for operation and maintenance personnel to find the cause of the failure.

[0070] Figure 3 Shows Figure 1 Schematic diagram of the rule interface corresponding to the preset binary tree. Figure 3 As shown, rule administrators can create different rules in the rule library and perform operations such as adding, starting, stopping, modifying, deleting, and uploading rules.

[0071] In some embodiments, the operation authority of the rule administrator user on the preset binary tree may be determined based on whether the device corresponding to the preset binary tree is within the management authority range of the rule administrator user.

[0072] It is understandable that different rule administrator users are responsible for business systems in different areas and therefore have different management authority scopes. Rule administrator users can operate the rules that are effective in the area they are responsible for, thereby managing the devices within their management authority scope.

[0073] Figure 4 Shows Figure 1 Figure 1 shows the root node settings interface. Figure 4 As shown, enter the interface of adding new rules. The interface defaults to a balanced binary tree with three nodes (the left half of the interface). The tree has a root node and two leaf nodes. Each node corresponds to an attribute description (the right half of the page). The root node and leaf nodes correspond to different attribute descriptions. The root node corresponds to the alarm trigger condition, and the leaf node corresponds to the alarm information.

[0074] Figure 5 Shows Figure 1 Schematic diagram of the interface for setting up intermediate nodes and leaf nodes. Figure 5As shown, each intermediate node also corresponds to an attribute description. The first node (for example, node_7) corresponds to the equipment technical indicator query condition, and the second node (for example, node_5) corresponds to the manual handling work order. When adding a node, a leaf node will be added at the same time for each intermediate node added. For example, when adding an intermediate node on the Left line, a right leaf node will be added; when adding an intermediate node on the Right line, a left leaf node will be added to keep the binary tree balanced. When deleting a node, a leaf node will be deleted at the same time for each intermediate node deleted, and all child nodes of the intermediate node will be deleted to keep the binary tree balanced.

[0075] After completing the operation of the binary tree nodes, edit the attribute description of each node. After editing, you can click the Submit button to submit. The system will verify all nodes, including: null value verification, matching condition verification, operator verification, text verification, etc. If the verification fails, the reason for the verification failure will be output, and the rule administrator will be prompted to modify it before submitting.

[0076] After the rule is created, its status is unpublished. Unpublished rules are only effective for devices in the area that the rule administrator is responsible for. The rule administrator can upload unpublished rules to the rule library and wait for approval by the rule approver. After the rule approver approves and publishes the rule, he can select the area where the rule needs to be applied and send the rule to the selected area. If the rule approver believes that the rule cannot be used as a general rule (that is, it cannot be applied to other areas), the rule will be rejected. The rejected rule is only effective for devices in the area that the rule administrator is responsible for.

[0077] The alarm information output according to the rules and the handling of the intermediate nodes are handled by the operation and maintenance administrator. After the operation and maintenance administrator completes the processing, a relevant knowledge base is formed. When the same fault occurs next time, the previously processed process can be called up for reference.

[0078] Figure 6 FIG. 1 shows a schematic diagram of setting each node of a preset binary tree in an embodiment. Figure 6As shown, Root represents the root node of the preset binary tree, Node represents the first node, Manual represents the second node, and Leaf represents the leaf node. The alarm triggering condition of Root is that the temperature and humidity sensor issues an alarm of over-temperature and any alarm occurs in the voltage of the transformer box, or the temperature and humidity sensor issues an alarm of over-temperature and any alarm occurs in the port of the switch. When the device data meets the alarm triggering condition, the alarm information corresponding to the leaf node of the root node is output, that is, the fusion alarm name is emergency alarm, the fusion alarm level is high, the fusion alarm notification is the operation and maintenance personnel, the fusion alarm action is none, the fusion alarm associated device is power equipment, and the video clips are taken by the same group of cameras; when the device data does not meet the alarm triggering condition, for example, when only the voltage of the transformer box alarms, the manual handling work order corresponding to the second node Manual is output. If the handling result returned by the user based on the manual handling work order is "true", it indicates that the alarm If it is caused by normal inspection, the system outputs the alarm information corresponding to the leaf node of the second node Manual, that is, the fusion alarm name is normal inspection, the fusion alarm level is low, the fusion alarm notification is none, the fusion alarm action is none, and the fusion alarm associated device is none. If the disposal result returned by the user based on the manual disposal work order is "false", it is necessary to further determine whether the alarm is caused by the same group of devices or linkage devices, that is, to find the data that meets the equipment technical indicator query conditions corresponding to the first node in the equipment data. If the search is successful, it means that the alarm is caused by the same If the gas in the group equipment is locked, the system outputs the alarm information corresponding to the leaf node of the first first node, that is, the fusion alarm name is gas failure, the fusion alarm level is high, the fusion alarm notification is security personnel, the fusion alarm action is none, the fusion alarm associated device is gas, and the video clips taken by the same group of cameras. If the search fails, the data that meets the equipment technical indicator query conditions corresponding to the second first node is searched in the equipment data. If the search is successful, it means that the alarm is caused by the locking of the main belt of the linkage equipment transport belt, and the system outputs the second first node. The alarm information corresponding to the right leaf node of the point, that is, the fusion alarm name is emergency alarm, the fusion alarm level is high, the fusion alarm notification is belt operation and maintenance personnel, the fusion alarm action is none, the fusion alarm associated device is the transport belt, and the video clips taken by the same group of cameras. If the search fails, it means that the alarm is not caused by the linkage device, and the matching is completed. The system outputs the alarm information corresponding to the left leaf node of the second first node, that is, the fusion alarm name is normal inspection, the fusion alarm level is low, the fusion alarm notification is none, the fusion alarm action is none, and the fusion alarm associated device is none.

[0079] The embodiment of the present application automatically analyzes the equipment data of IT equipment and OT equipment by utilizing a binary tree structure, and can output alarm information in a timely manner when the equipment data meets the alarm trigger conditions. When the equipment data does not meet the alarm trigger conditions due to not meeting some alarm events, the cause of the alarm event is further mined by searching the equipment technical indicators in the equipment data and outputting the alarm information, thereby achieving accurate tracing of the alarm event, providing support for intelligent operation and maintenance decision-making, accelerating the maintenance process, reducing maintenance costs, and improving troubleshooting efficiency and operation and maintenance efficiency.

[0080] The following describes an apparatus embodiment of the present application, which can be used to execute the alarm method based on the integration of IT equipment and OT equipment in the above-mentioned embodiment of the present application. For details not disclosed in the apparatus embodiment of the present application, please refer to the above-mentioned embodiment of the alarm method based on the integration of IT equipment and OT equipment in the present application.

[0081] Figure 7 FIG. 1 is a block diagram of an alarm device based on the integration of IT equipment and OT equipment in an embodiment of the present application. Figure 7 As shown, the alarm device based on the integration of IT equipment and OT equipment in an embodiment of the present application includes: a data acquisition module 701, which is used to acquire equipment data of IT equipment and OT equipment; a root node execution module 702, which is used to output the alarm information corresponding to the leaf node of the root node when the equipment data meets the alarm trigger condition corresponding to the root node in the preset binary tree, wherein the alarm trigger condition includes the alarm event of the IT equipment and / or the OT equipment; an intermediate node execution module 703, which is used to use the first intermediate node of the preset binary tree as the current intermediate node when the equipment data does not meet the alarm trigger condition, and when the current intermediate node is the first node, search for data that meets the equipment technical indicator query condition corresponding to the first node in the equipment data; a leaf node execution module 704, which is used to output the alarm information corresponding to the leaf node of the current intermediate node when the search is successful; when the search is unsuccessful, use the next intermediate node as the current intermediate node, and return to the step of searching for data that meets the equipment technical indicator query condition corresponding to the first node in the equipment data when the current intermediate node is the first node.

[0082] In some embodiments of the present application, based on the aforementioned scheme, the intermediate node execution module 703 is also used to output a manual handling work order corresponding to the second node when the device data does not meet the alarm triggering conditions and the current intermediate node is the second node; in response to the first handling result returned externally based on the manual handling work order, when the next intermediate node is the first node, the next intermediate node is used as the current intermediate node, and the step of searching the device data for data that meets the device technical indicator query conditions corresponding to the first node is returned when the current intermediate node is the first node; in response to the second handling result returned externally based on the manual handling work order, the alarm information corresponding to the leaf node of the current intermediate node is output.

[0083] In some embodiments of the present application, based on the aforementioned scheme, the intermediate nodes in the preset binary tree include a first node and a second node, and the alarm device based on the integration of IT equipment and OT equipment also includes a binary tree setting module (not shown in the figure), which is used to respectively set the alarm trigger conditions corresponding to the root node in the binary tree, the equipment technical indicator query conditions corresponding to each first node, the manual handling work order corresponding to each second node, and the alarm information corresponding to each leaf node, so as to obtain the preset binary tree.

[0084] In some embodiments of the present application, based on the aforementioned scheme, the alarm trigger condition includes multiple alarm events, and the logical relationship between the multiple alarm events is OR logic, and / or, and AND logic. The root node execution module 702 is also used to determine that the device data satisfies the alarm trigger condition corresponding to the root node in the preset binary tree when the logical relationship is OR logic and the device data satisfies any alarm event; when the logical relationship is AND logic and the device data satisfies all alarm events, or when the logical relationship is AND logic and it is not determined whether the device data satisfies all alarm events within a preset time period, determine that the device data satisfies the alarm trigger condition corresponding to the root node in the preset binary tree; when the logical relationship is AND logic and the device data satisfies some alarm events, determine that the device data does not satisfy the alarm trigger condition.

[0085] In some embodiments of the present application, based on the aforementioned scheme, the device technical indicator query conditions include the name of the target device, the name of the technical indicator of the target device, the value range of the technical indicator, and the device relationship between the device corresponding to the alarm trigger condition and the target device.

[0086] In some embodiments of the present application, based on the aforementioned scheme, the device relationship includes preamble, same group and linkage, and the intermediate node execution module 703 is also used to determine that the device relationship is preamble when the target device is the same as the device corresponding to the alarm trigger condition; when the target device and the device corresponding to the alarm trigger condition belong to the same group of devices, determine that the device relationship is in the same group; when the target device and the device corresponding to the alarm trigger condition have a locked relationship, determine that the device relationship is linkage.

[0087] In some embodiments of the present application, based on the aforementioned solution, the alarm information includes the alarm name, the alarm level, the name of the target device, and the image information captured by the image capture device in the same group as the target device.

[0088] In some embodiments of the present application, based on the aforementioned scheme, the binary tree setting module is also used to determine the rule administrator user's operation authority over the preset binary tree according to whether the device corresponding to the preset binary tree is within the management authority of the rule administrator user.

[0089] Based on the same inventive concept, the embodiment of the present application also provides an alarm device based on the integration of IT equipment and OT equipment, referring to Figure 8 , showing a structural diagram of an alarm device based on the integration of IT equipment and OT equipment in an embodiment of the present application. The alarm device based on the integration of IT equipment and OT equipment includes one or more memories 804, one or more processors 802, and at least one computer program (computer program instruction) stored in the memory 804 and executable on the processor 802. When the processor 802 executes the computer program, the above method is implemented.

[0090] Among them, Figure 8 In the embodiment of the present invention, a bus architecture (represented by bus 800) is shown, which may include any number of interconnected buses and bridges, and bus 800 links various circuits including one or more processors represented by processor 802 and memory represented by memory 804. Bus 800 may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. Bus interface 805 provides an interface between bus 800 and receiver 801 and transmitter 803. Receiver 801 and transmitter 803 may be the same element, namely a transceiver, providing a unit for communicating with various other devices over a transmission medium. Processor 802 is responsible for managing bus 800 and general processing, while memory 804 may be used to store data used by processor 802 when performing operations.

[0091] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, in which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor is prompted to implement the steps of the above method.

[0092] The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions may be stored as one or more instructions or codes on a computer-readable medium or transmitted via a computer-readable medium. Other examples and implementations are within the scope and spirit of the present application and the appended claims. For example, due to the nature of software, the functions described above may be implemented using software executed by a processor, hardware, firmware, hard wiring, or a combination of any of these. In addition, each functional unit may be integrated into a processing unit, each unit may exist physically separately, or two or more units may be integrated into one unit.

[0093] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0094] The units described as separate components may or may not be physically separated, and the components of the control device may or may not be physical units, that is, they may be located in one place or distributed in multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0095] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly or all or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc., which can store computer program instructions.

[0096] The above description is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of the claims of the present application.

Claims

1. An alarm method based on the integration of IT equipment and OT equipment, characterized in that: include: Obtain equipment data of information technology (IT) equipment and operational technology (OT) equipment; When the device data satisfies the alarm trigger condition corresponding to the root node in the preset binary tree, output the alarm information corresponding to the leaf node of the root node, wherein the alarm trigger condition includes the alarm event of the IT device and / or the OT device; When the device data does not satisfy the alarm triggering condition, the first intermediate node of the preset binary tree is used as the current intermediate node, and when the current intermediate node is the first node, the device data is searched for data satisfying the device technical indicator query condition corresponding to the first node; If the search is successful, output the warning information corresponding to the leaf node of the current intermediate node; If the search is unsuccessful, the next intermediate node is used as the current intermediate node, and the process returns to the step of searching the device data for data satisfying the device technical indicator query condition corresponding to the first node when the current intermediate node is the first node.

2. The method according to claim 1, characterized in that Also includes: When the device data does not satisfy the alarm triggering condition and the current intermediate node is the second node, outputting a manual handling work order corresponding to the second node; In response to a first processing result returned externally based on the manual processing work order, when the next intermediate node is the first node, the next intermediate node is used as the current intermediate node, and when the current intermediate node is the first node, the step of searching the device data for data that meets the device technical indicator query condition corresponding to the first node is returned; In response to a second processing result returned externally based on the manual processing work order, alarm information corresponding to the leaf node of the current intermediate node is output.

3. The method according to claim 1, characterized in that The intermediate nodes in the preset binary tree include the first node and the second node, and the method further includes: The alarm triggering conditions corresponding to the root node in the binary tree, the equipment technical indicator query conditions corresponding to each first node, the manual handling work order corresponding to each second node, and the alarm information corresponding to each leaf node are set respectively to obtain the preset binary tree.

4. The method according to claim 3, characterized in that The alarm triggering condition includes a plurality of the alarm events, and the logical relationship between the plurality of the alarm events is OR logic, and / or, and AND logic. The method further includes: In the case where the logical relationship is an OR logic and the device data satisfies any one of the alarm events, determining that the device data satisfies the alarm triggering condition corresponding to the root node in the preset binary tree; When the logical relationship is an AND logic and the device data satisfies all the alarm events, or when the logical relationship is an AND logic and it is not determined within a preset time period whether the device data satisfies all the alarm events, determining that the device data satisfies the alarm triggering condition corresponding to the root node in the preset binary tree; In a case where the logical relationship is an AND logic and the device data satisfies part of the alarm events, it is determined that the device data does not satisfy the alarm triggering condition.

5. The method according to claim 3, characterized in that: The equipment technical indicator query condition includes the name of the target equipment, the name of the technical indicator of the target equipment, the value range of the technical indicator, and the equipment relationship between the equipment corresponding to the alarm triggering condition and the target equipment.

6. The method according to claim 5, characterized in that The device relationship includes preceding order, same group and linkage, and the method further includes: In a case where the target device is the same as the device corresponding to the alarm triggering condition, determining that the device relationship is a preceding order; In a case where the target device and the device corresponding to the alarm triggering condition belong to the same group of devices, determining that the device relationship is in the same group; In the case that there is a blocking relationship between the target device and the device corresponding to the alarm triggering condition, the device relationship is determined to be linkage.

7. The method according to claim 5, characterized in that The alarm information includes an alarm name, an alarm level, a name of the target device, and image information collected by an image collection device in the same group as the target device.

8. The method according to claim 3, characterized in that After obtaining the preset binary tree, the method further includes: The operation authority of the rule administrator user on the preset binary tree is determined according to whether the device corresponding to the preset binary tree is within the management authority range of the rule administrator user.

9. An alarm device based on the integration of IT equipment and OT equipment, characterized in that: include: Data acquisition module, used to acquire equipment data of information technology IT equipment and operational technology OT equipment; A root node execution module, configured to output the alarm information corresponding to the leaf node of the root node when the device data satisfies the alarm trigger condition corresponding to the root node in the preset binary tree, wherein the alarm trigger condition includes the alarm event of the IT device and / or the OT device; an intermediate node execution module, configured to, when the device data does not satisfy the alarm triggering condition, use the first intermediate node of the preset binary tree as the current intermediate node, and, when the current intermediate node is the first node, search the device data for data satisfying the device technical indicator query condition corresponding to the first node; The leaf node execution module is used to output the alarm information corresponding to the leaf node of the current intermediate node when the search is successful, and to use the next intermediate node as the current intermediate node when the search is unsuccessful, and return to the step of searching the device data for data that meets the equipment technical indicator query conditions corresponding to the first node when the current intermediate node is the first node.

10. An alarm device based on the integration of IT equipment and OT equipment, including a processor and a memory, characterized in that: The memory stores computer program instructions that can be executed by the processor, and when the processor executes the computer program instructions, the steps of the method according to any one of claims 1 to 8 are implemented.

Images