Alarm analysis and reasoning methods, devices, electronic equipment, media, and program products

Abstract

The present disclosure provides an alarm analysis and reasoning method, device, electronic device, medium, and program product. The method includes: constructing a system model according to the operating status data of the detection points of the industrial system; each node contained in the system model represents a detection point, and the connection relationship between the nodes represents the data propagation relationship between the detection points; finding the upstream abnormal nodes of each abnormal node in the system model to obtain an abnormal node set corresponding to each abnormal node; in order from the number of abnormal nodes contained in the abnormal node set to the number of abnormal nodes, determining the cause alarm node from the abnormal nodes contained in each abnormal node set; wherein, the abnormal node in the abnormal node set that meets the root condition is determined as the cause alarm node. The present disclosure can improve the rate of identification of cause alarm nodes while ensuring accuracy.

Description

Technical Field

[0001] The present disclosure relates to the field of alarm analysis and reasoning technology, and in particular to an alarm analysis and reasoning method, device, electronic equipment, medium, and program product. Background Art

[0002] With the development of modern industry and science and technology and the further improvement of automation, production units in industrial systems are developing towards large-scale, high-speed, continuous, centralized and automated directions. Their main characteristics are that there are many equipment links and each equipment link is interrelated, and the connection between equipment is becoming closer and closer. Once a device fails, the system will pass the fault to another device through material flow, energy flow and information flow. The alarm system of the industrial system will generate a large number of alarms in a short period of time, and even cause the whole production process to be paralyzed. If the fault cannot be diagnosed and eliminated in time, it will cause a major accident.

[0003] The alarm system generates a large number of alarms in a short period of time, which will interfere with the operator's judgment. That is, alarm flooding has become the most difficult problem of the current industrial alarm system. The first task to deal with alarm flooding is to determine the cause alarm node and identify the root cause in time. Only in this way can we formulate countermeasures in time according to the cause alarm node, locate the fault, and eliminate the alarm, so as to avoid the operator spending a lot of time dealing with minor alarms and ignoring key alarms. How to assist operators to quickly and accurately determine the cause alarm node is an urgent problem to be solved. Summary of the invention

[0004] The technical problem to be solved by the present disclosure is to overcome the above-mentioned defects in the prior art and to provide an alarm analysis and reasoning method, device, electronic device, medium, and program product.

[0005] The present invention solves the above technical problems through the following technical solutions:

[0006] In a first aspect, an alarm analysis and reasoning method is provided, comprising:

[0007] A system model is constructed based on the operating status data of the detection points of the industrial system; each node included in the system model represents a detection point, and the connection relationship between the nodes represents the data propagation relationship between the detection points;

[0008] Finding the upstream abnormal nodes of each abnormal node in the system model to obtain an abnormal node set corresponding to each abnormal node;

[0009] According to the order of the number of abnormal nodes included in the abnormal node set from small to large, the cause alarm nodes are determined from the abnormal nodes included in each abnormal node set in turn; wherein the abnormal nodes in the abnormal node set that meet the root cause conditions are determined as the cause alarm nodes; the root cause conditions include that the abnormal node set contains 1 abnormal node, the abnormal node set contains at least 2 abnormal nodes and the alarm occurs earliest.

[0010] Optionally, searching for an upstream abnormal node of each abnormal node in the system model includes:

[0011] Removing normal nodes and unmonitorable nodes without downstream abnormal nodes in the system model to obtain an alarm reasoning model;

[0012] Determine the abnormal node and its upstream abnormal node in the alarm reasoning model.

[0013] Optionally, determining an abnormal node and an upstream abnormal node in the alarm reasoning model includes:

[0014] In the process of searching all upstream nodes of the abnormal node in the alarm reasoning model, determining whether the upstream node of the abnormal node is an unmonitorable node;

[0015] In response to the upstream node of the abnormal node being an unmonitorable node, removing the unmonitorable node;

[0016] In response to the upstream node of the abnormal node not being an unmonitorable node, the upstream node of the abnormal node is determined as the upstream abnormal node.

[0017] Optionally, determining the cause alarm node from the abnormal nodes included in each abnormal node set in turn includes:

[0018] Remove the first abnormal node determined to be a cause alarm node and the downstream abnormal nodes of the first abnormal node included in the abnormal node set;

[0019] The cause alarm node is determined from the abnormal nodes included in the abnormal node set after the abnormal node is removed.

[0020] Optionally, determining the cause alarm node from the abnormal nodes included in each abnormal node set in order of the number of abnormal nodes included in the abnormal node set from small to large includes:

[0021] According to the order of the number of abnormal nodes included in the abnormal node set from small to large and the order in which the abnormal nodes included in the abnormal node set generate alarms, the abnormal nodes included in the abnormal node set are sorted to obtain an abnormal node list;

[0022] Determine in sequence whether the abnormal node set to which the abnormal node in the abnormal node list belongs contains one abnormal node;

[0023] In response to the abnormal node set including one abnormal node, determining the abnormal node in the abnormal node set as a cause alarm node; in response to the abnormal node set including at least two abnormal nodes, determining the abnormal node that generates an alarm earliest among the at least two abnormal nodes as a cause alarm node;

[0024] Remove the causal alarm node and its downstream abnormal nodes from the abnormal node list;

[0025] In response to the number of abnormal nodes included in the abnormal node list being greater than 1, returning to the step of sequentially determining whether the abnormal node set to which the abnormal nodes in the abnormal node list belong includes 1 abnormal node.

[0026] Optionally, determining the cause alarm node from the abnormal nodes included in each abnormal node set in turn includes:

[0027] When the abnormal node set to which the abnormal node in the abnormal node list belongs contains at least two nodes and the nodes in the abnormal node set do not form a ring, the abnormal node in the abnormal node set without an upstream node is determined as a cause alarm node;

[0028] When the abnormal node set to which the abnormal node in the abnormal node list belongs contains at least two nodes and there is a first ring composed of nodes in the abnormal node set, determining whether there is an upstream abnormal node in the first ring;

[0029] In response to the presence of an upstream abnormal node in the first ring, determining a cause alarm node according to the upstream abnormal node;

[0030] In response to the fact that there is no upstream abnormal node in the first ring, the abnormal node in the first ring where an alarm occurs earliest is determined as a causal alarm node.

[0031] Optionally, in response to the existence of an upstream abnormal node in the first ring, determining a cause alarm node according to the upstream abnormal node includes:

[0032] In response to the fact that the upstream abnormal node of the first ring has no other upstream abnormal nodes, and the upstream abnormal node of the first ring and other nodes form a second ring, determining the abnormal node in the second ring that generates an alarm earliest as a cause alarm node;

[0033] In response to the fact that the upstream abnormal node of the first ring has no other upstream abnormal nodes and the upstream abnormal node of the first ring does not form a second ring with other nodes, the upstream abnormal node of the first ring is determined as a causal alarm node.

[0034] Optionally, a system model is constructed based on the operating status data of the detection points included in the industrial system, including:

[0035] The operating state data is processed by using a multi-layer flow modeling method to obtain the system model;

[0036] And / or, the alarm analysis and reasoning method further comprises: determining a causal graph of each causal alarm node according to the data propagation relationship, wherein the causal graph comprises unmonitorable nodes and abnormal nodes having a data propagation relationship with the abnormal node;

[0037] And / or, the alarm analysis and reasoning method further includes: determining each downstream connection path of each abnormal node in the system model according to the data propagation relationship, and determining the first normal node of the second abnormal node in each downstream connection path as a predicted node with alarm risk; the second abnormal node is an abnormal node without downstream abnormal nodes;

[0038] And / or, the alarm analysis and reasoning method also includes: determining a prediction graph based on the data propagation relationship; the prediction graph includes a connection path between the prediction node and the second abnormal node.

[0039] In a second aspect, an alarm analysis and reasoning device is provided, comprising:

[0040] A model building module is used to build a system model based on the operating status data of the detection points of the industrial system; each node included in the system model represents a detection point, and the connection relationship between the nodes represents the data propagation relationship between the detection points;

[0041] A search module, used to search for upstream abnormal nodes of each abnormal node in the system model, and obtain an abnormal node set corresponding to each abnormal node;

[0042] A root cause determination module is used to determine the cause alarm nodes from the abnormal nodes included in each abnormal node set in order from small to large in number of abnormal nodes included in the abnormal node set; wherein the abnormal nodes in the abnormal node set that meet the root cause conditions are determined as the cause alarm nodes; the root cause conditions include that the abnormal node set contains 1 abnormal node, the abnormal node set contains at least 2 abnormal nodes and the alarm occurs earliest.

[0043] Optionally, the search module includes:

[0044] A removal unit, used to remove normal nodes and unmonitorable nodes without downstream abnormal nodes in the system model to obtain an alarm reasoning model;

[0045] The determination unit is used to determine the abnormal node and its upstream abnormal node in the alarm reasoning model.

[0046] Optionally, the determining unit is specifically configured to:

[0047] In the process of searching all upstream nodes of the abnormal node in the alarm reasoning model, determining whether the upstream node of the abnormal node is an unmonitorable node;

[0048] In response to the upstream node of the abnormal node being an unmonitorable node, removing the unmonitorable node;

[0049] In response to the upstream node of the abnormal node not being an unmonitorable node, the upstream node of the abnormal node is determined as the upstream abnormal node.

[0050] Optionally, the root cause determination module includes:

[0051] a removing unit, configured to remove a first abnormal node determined to be a cause alarm node and a downstream abnormal node of the first abnormal node, which is included in the abnormal node set;

[0052] The root cause determination unit is used to determine the cause alarm node from the abnormal nodes included in the abnormal node set after the abnormal nodes are removed.

[0053] Optionally, the root cause determination module includes:

[0054] A sorting unit, configured to sort the abnormal nodes included in the abnormal node set according to the order of the number of abnormal nodes included in the abnormal node set from small to large and the order in which the abnormal nodes included in the abnormal node set generate alarms, so as to obtain an abnormal node list;

[0055] A judging unit, configured to judge in turn whether the abnormal node set to which the abnormal node in the abnormal node list belongs contains one abnormal node;

[0056] a root cause determination unit, configured to, in response to the abnormal node set including one abnormal node, determine the abnormal node in the abnormal node set as a cause alarm node; in response to the abnormal node set including at least two abnormal nodes, determine the abnormal node that generates an alarm earliest among the at least two abnormal nodes as the cause alarm node;

[0057] A removing unit, used to remove the cause alarm node and its downstream abnormal nodes from the abnormal node list;

[0058] The calling unit is configured to call the judging unit in response to the number of abnormal nodes included in the abnormal node list being greater than 1.

[0059] Optionally, when determining the cause alarm node from the abnormal nodes included in each abnormal node set, the root cause determination module is specifically used to:

[0060] When the abnormal node set to which the abnormal node in the abnormal node list belongs contains at least two nodes and the nodes in the abnormal node set do not form a ring, the abnormal node in the abnormal node set without an upstream node is determined as a cause alarm node;

[0061] When the abnormal node set to which the abnormal node in the abnormal node list belongs contains at least two nodes and there is a first ring composed of nodes in the abnormal node set, determining whether there is an upstream abnormal node in the first ring;

[0062] In response to the presence of an upstream abnormal node in the first ring, determining a cause alarm node according to the upstream abnormal node;

[0063] In response to the fact that there is no upstream abnormal node in the first ring, the abnormal node in the first ring where an alarm occurs earliest is determined as a causal alarm node.

[0064] Optionally, when determining the cause alarm node according to the upstream abnormal node, the root cause determination module is specifically used to:

[0065] In response to the fact that the upstream abnormal node of the first ring has no other upstream abnormal nodes, and the upstream abnormal node of the first ring and other nodes form a second ring, determining the abnormal node in the second ring that generates an alarm earliest as a cause alarm node;

[0066] In response to the fact that the upstream abnormal node of the first ring has no other upstream abnormal nodes and the upstream abnormal node of the first ring does not form a second ring with other nodes, the upstream abnormal node of the first ring is determined as a causal alarm node.

[0067] Optionally, the model building module is specifically used to: process the operating status data using a multi-layer flow modeling device to obtain the system model;

[0068] And / or, the alarm analysis and reasoning device further comprises: a causal graph determination module for determining a causal graph of each causal alarm node according to the data propagation relationship; the causal graph comprises an unmonitorable node and an abnormal node having a data propagation relationship with the abnormal node;

[0069] And / or, the search module is further used to: determine each downstream connection path of each abnormal node in the system model according to the data propagation relationship, and determine the first normal node of the second abnormal node in each downstream connection path as a predicted node with an alarm risk; the second abnormal node is an abnormal node without a downstream abnormal node;

[0070] And / or, the alarm analysis and reasoning device also includes: a prediction graph determination module for determining a prediction graph based on the data propagation relationship; the prediction graph includes a connection path between the prediction node and the second abnormal node.

[0071] In a third aspect, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and used to run on the processor, wherein when the processor executes the computer program, the alarm analysis and reasoning method described in any one of the first aspects is implemented.

[0072] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the alarm analysis and reasoning method described in any one of the first aspects is implemented.

[0073] In a fifth aspect, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the alarm analysis and reasoning method described in any one of the first aspects is implemented.

[0074] On the basis of being in accordance with the common sense in the art, the above-mentioned preferred conditions can be arbitrarily combined to obtain the preferred embodiments of the present disclosure.

[0075] The positive progressive effect of the present disclosure lies in that the present disclosure constructs a system model of the industrial system, determines each abnormal node and its upstream abnormal node therefrom, obtains an abnormal node set, and determines the causal alarm nodes of each abnormal node set in order from small to large in the number of abnormal nodes contained in the abnormal node set. The rate of identifying causal alarm nodes can be improved while ensuring accuracy, and the operator of the industrial system can be provided with a reference for alarm analysis and reasoning, so that the alarm can be eliminated in time to ensure the effective operation of the industrial system. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1a A flowchart of an alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0077] Figure 1b A flowchart of another alarm analysis and reasoning method provided for an exemplary embodiment of the present disclosure;

[0078] Figure 2 A schematic diagram of a system model of an application scenario of an alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0079] Figure 3 A schematic diagram of a system model of an application scenario of another alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0080] Figure 4A schematic diagram of a system model of an application scenario adopted by another alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0081] Figure 5 A schematic diagram of an alarm reasoning model used in an alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0082] Figure 6 A schematic diagram of an alarm reasoning model used in another alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0083] Figure 7 A cause-effect diagram of a causal alarm node provided by an exemplary embodiment of the present disclosure;

[0084] Figure 8 Another cause-effect diagram of a causal alarm node provided by an exemplary embodiment of the present disclosure;

[0085] Fig. 9 A schematic diagram of an alarm reasoning model used in another alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0086] Fig.10 A cause-effect diagram of a causal alarm node provided by an exemplary embodiment of the present disclosure;

[0087] Fig.11 A schematic diagram of an alarm reasoning model used in another alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0088] Fig.12 A schematic diagram of an alarm reasoning model used in another alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0089] Fig.13 A cause-effect diagram of a causal alarm node provided by an exemplary embodiment of the present disclosure;

[0090] Fig.14 A schematic diagram of an alarm reasoning model used in another alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0091] Fig.15 Another cause-effect diagram of a causal alarm node provided by an exemplary embodiment of the present disclosure;

[0092] Fig.16 Another cause-effect diagram of a causal alarm node provided by an exemplary embodiment of the present disclosure;

[0093] Fig.17 A schematic diagram of an alarm reasoning model used in another alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0094] Fig.18 A causal diagram of a risk node provided by an exemplary embodiment of the present disclosure;

[0095] Fig.19 Another cause-effect diagram of a risk node provided by an exemplary embodiment of the present disclosure;

[0096] Fig.20a A flowchart for determining prediction nodes and prediction graphs in an alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0097] Fig.20b A schematic diagram of a system model of an application scenario of an alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure;

[0098] Fig.20c for Fig.20a A prediction graph of

[0099] Fig.20d for Fig.20a Another prediction graph of ;

[0100] Fig.20e for Fig.20a Another prediction graph of ;

[0101] Fig.21 A schematic diagram of a module of an alarm analysis and reasoning device provided by an exemplary embodiment of the present disclosure;

[0102] Fig. 22 The present invention provides a schematic structural diagram of an electronic device according to an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0103] The present disclosure is further described below by way of examples, but the present disclosure is not limited to the scope of the examples.

[0104] Prefixes such as "first" and "second" are used in the embodiments of the present disclosure only to distinguish different description objects, and have no limiting effect on the position, order, priority, quantity or content of the described objects. The use of prefixes such as ordinal numbers to distinguish description objects in the embodiments of the present disclosure does not constitute a limitation on the described objects. For the statement of the described objects, please refer to the description in the context of the claims or embodiments, and no unnecessary limitation should be constituted due to the use of such prefixes. In addition, in the description of the present embodiment, unless otherwise specified, the meaning of "plurality" is two or more.

[0105] Figure 1a A flowchart of an alarm analysis and reasoning method provided by an exemplary embodiment of the present disclosure, the alarm analysis and reasoning method comprises the following steps:

[0106] Step 101: construct a system model based on the operating status data of the detection points of the industrial system.

[0107] The system model is a directed graph that represents the causal relationship between detection points of the industrial system. Each node included in the system model represents a detection point, and the connection relationship between the nodes represents the data propagation relationship between the detection points. The data propagation relationship can be, but is not limited to, the propagation relationship of at least one of the material flow, energy flow, and information flow of the detection point. The operating status data of the detection point includes the operating status data of the equipment included in the industrial system, and / or the operating status data collected by the detection equipment deployed on the industrial system.

[0108] Industrial systems may include, but are not limited to, petrochemical systems, metallurgical systems, papermaking systems, nuclear power systems, etc.

[0109] The operation status data may include, but is not limited to, at least one of the following parameters: temperature, pressure, displacement, and liquid level. The parameters included in the operation status data can be acquired by corresponding detection equipment. Each frame of operation status data may also include a detection point identifier to determine the detection point to which it belongs.

[0110] In one embodiment, the system model is visualized for easy observation by the operator, see Figure 2 ,Each circle in the figure represents a node, corresponding to a detection point, and the number in the circle represents the detection point identification. Figure 2 The industrial system represented in Figure 1 contains at least 23 detection points. The arrows between the nodes represent the data propagation relationship between the detection points. Figure 2 In the Nodes, nodes are divided into monitorable nodes and unmonitorable nodes. The so-called monitorable nodes are nodes that can collect running status data. The so-called unmonitorable nodes are nodes that cannot collect running status data or have no detection equipment deployed, which are risk nodes.

[0111] Step 102: Find the upstream abnormal nodes of each abnormal node in the system model to obtain an abnormal node set corresponding to each abnormal node.

[0112] In one embodiment, the operating status data of each detection point is analyzed. When all parameters included in the operating status data fall within the corresponding normal range, it is determined that the equipment corresponding to the detection point is operating normally and the corresponding node is a normal node. When at least one parameter included in the operating status data does not fall within the corresponding normal range, it is determined that there is a problem with the operation of the equipment corresponding to the detection point and the corresponding node is an abnormal node. The upstream abnormal node of the abnormal node is determined based on the data propagation relationship, and the abnormal node set includes the abnormal node and its upstream abnormal node.

[0113] In one embodiment, the operation status data includes alarm data, and abnormal nodes and normal nodes are distinguished according to the alarm data. An alarm can be set at the detection point, and the alarm generates alarm data by analyzing the operation status data, when at least one parameter included in the operation status data does not fall into the corresponding normal range. For example, alarm data is generated when at least one of the following conditions is met: the temperature does not fall into the normal temperature range, the pressure does not fall into the normal pressure range, the displacement does not fall into the normal displacement range, and the liquid level does not fall into the normal liquid level range.

[0114] In one embodiment, normal nodes and abnormal nodes can be distinguished by color. Figure 3 For example, in the figure, red represents abnormal nodes, blue represents normal nodes, and black represents unmonitored nodes. For abnormal node 12, its upstream abnormal node is node 6, and the abnormal node set is {node 12, node 6}.

[0115] In other implementations, different types of nodes may also be distinguished by identifiers, for example, 00 represents a normal node, 11 represents an abnormal node, and 10 or 01 represents an unmonitorable node, which is not particularly limited in the embodiments of the present disclosure.

[0116] In this embodiment, the unmonitorable nodes that may cause abnormal nodes are used as the analysis basis for alarm analysis and reasoning. The so-called unmonitorable nodes that may cause abnormal nodes are unmonitorable nodes that have downstream abnormal nodes.

[0117] Step 103 : in order from the number of abnormal nodes included in the abnormal node sets to the number of abnormal nodes included in the abnormal node sets, determine the cause alarm nodes from the abnormal nodes included in each abnormal node set.

[0118] Among them, the abnormal nodes that meet the root cause conditions in the abnormal node set are determined as cause alarm nodes. The root cause conditions include that the abnormal node set contains 1 abnormal node, the abnormal node set contains at least 2 abnormal nodes and the alarm occurs earliest. That is, when the abnormal node set contains 1 abnormal node, the abnormal node is determined as the cause alarm node; when the abnormal node set contains multiple abnormal nodes, the node that alarms earliest among the abnormal nodes included in the abnormal node set is determined as the cause alarm node. The so-called cause alarm node is a node that triggers an alarm due to its abnormality and triggers an alarm in other devices or detection points.

[0119] It can be understood that the fewer the number of abnormal nodes contained in the abnormal node set, the higher the possibility that the abnormal node set contains the causal alarm node. By determining the causal alarm nodes of each abnormal node set in order from small to large in the number of abnormal nodes contained in the abnormal node set, the rate of causal alarm node identification can be improved while ensuring accuracy.

[0120] When the abnormal node set contains one abnormal node, the abnormal node has no upstream abnormal node, and its alarm can only be caused by itself, so it is determined to be a cause alarm node. When the abnormal node set contains at least two abnormal nodes, the abnormal node that alarmed the earliest is most likely to be a cause alarm node, so it is determined to be a cause alarm node.

[0121] In this embodiment, by constructing a system model of the industrial system, each abnormal node and its upstream abnormal node are determined to obtain an abnormal node set, and the causal alarm nodes of each abnormal node set are determined in order from small to large in the number of abnormal nodes contained in the abnormal node set. The rate of identifying causal alarm nodes can be improved while ensuring accuracy, providing alarm analysis and reasoning references for operators of the industrial system, eliminating alarms in a timely manner, and ensuring the effective operation of the industrial system.

[0122] In one embodiment, each determined cause alarm node can be output for the operator of the industrial system to know, so as to remind the operator to promptly check the cause of the alarm and eliminate the alarm. When there is no alarm detection point in the industrial system, the identification of the cause alarm node is stopped to save energy.

[0123] In one embodiment, step 102 and step 103 may be repeatedly performed until there is no alarm in the industrial system.

[0124] In one embodiment, see Figure 1b , step 102 includes: removing normal nodes and unmonitorable nodes without downstream abnormal nodes in the system model, obtaining an alarm reasoning model, and determining abnormal nodes in the alarm reasoning model and their upstream abnormal nodes.

[0125] by Figure 3 , Figure 4 For example, the normal nodes in the figure include node 9, node 15 and node 16, which are removed from the system model. It should be noted that after removing a node, it is necessary to establish a data transmission relationship between the upstream node and the downstream node of the removed node. Taking the removal of normal node 9 as an example, after removing node 8, node 4 establishes a connection relationship with node 14, that is, node 4 points to node 14.

[0126] The unmonitored nodes without downstream abnormal nodes include unmonitored node 14, unmonitored node 19, and unmonitored node 22. After removing unmonitored node 14, unmonitored node 19, and unmonitored node 22 from the system model, unmonitored node 23 and unmonitored node 10 become unmonitored nodes without downstream abnormal nodes and are removed from the system model.

[0127] Repeat the above steps until all normal nodes in the system model and unmonitored nodes without downstream abnormal nodes are removed, and the Figure 5 The alarm reasoning model shown retains abnormal nodes and unmonitored nodes that may cause abnormal nodes.

[0128] It can be understood that normal nodes and unmonitored nodes without downstream abnormal nodes cannot be causal alarm nodes. In this embodiment, normal nodes and unmonitored nodes without downstream abnormal nodes in the system model are removed, which can eliminate interference factors in the identification of causal alarm nodes. The alarm reasoning model after eliminating interference factors is used as the basis for identifying causal alarm nodes, which can further improve the rate of causal alarm node identification.

[0129] The alarm reasoning model includes abnormal nodes and unmonitorable nodes. In one embodiment, see Figure 1b The step of determining the abnormal node and its upstream abnormal node in the alarm reasoning model specifically includes: in the process of searching all upstream nodes of the abnormal node in the alarm reasoning model, determining whether the upstream node of the abnormal node is an unmonitorable node. In response to the upstream node of the abnormal node being an unmonitorable node, eliminating the unmonitorable node. In response to the upstream node of the abnormal node not being an unmonitorable node, determining the upstream node of the abnormal node as an upstream abnormal node.

[0130] by Figure 5 Taking the alarm reasoning model shown as an example, the upstream nodes of abnormal node 18 include node 4, which is an unmonitorable node. Node 4 is removed, that is, node 4 is not used as the upstream abnormal node of abnormal node 18. Continue to traverse the alarm reasoning model. The upstream nodes of abnormal node 18 include node 17. Node 17 is an unmonitorable node. Node 7 is removed, that is, node 7 is not used as the upstream abnormal node of abnormal node 18. Continue to traverse the alarm reasoning model. The upstream nodes of abnormal node 18 include node 17. Node 17 is an unmonitorable node. Node 7 is removed, that is, node 7 is not used as the upstream abnormal node of abnormal node 18. Continue to traverse the alarm reasoning model. The upstream nodes of node 17 are node 12 and node 13. It is determined whether node 12 and node 13 are unmonitorable nodes respectively. Node 12 and node 13 are not unmonitorable nodes, and they are used as the upstream abnormal nodes of abnormal node 18. Continue to traverse the alarm reasoning model until all upstream abnormal nodes of abnormal node 18 are found, and obtain the abnormal node set of abnormal node 18 {node 3, node 6, node 12, node 13, node 18}.

[0131] Before introducing the specific implementation method of identifying the cause alarm node, several possible situations in practical applications are first introduced.

[0132] Situation 1: Figure 6Taking the acyclic graph shown as an example, it is assumed that the cause alarm nodes are node 3 and node 6.

[0133] Node 3 has no upstream abnormal nodes. Node 3 can be connected to nodes 13 and 18. The corresponding causal diagram can be found in Figure 7 .

[0134] Node 6 has no upstream abnormal nodes. Node 6 can be connected to nodes 12, 13, and 18. The corresponding causal diagram can be found in Figure 8 :

[0135] It can be inferred from this that nodes without upstream abnormal nodes can be determined as causal alarm nodes.

[0136] Case 2: Fig. 9 Take the non-rooted graph of the ring as an example, assuming that the cause alarm node is node 3, based on the alarm reasoning model of case 1, if node 17 is connected downward to node 6, two nested rings will appear in the graph, namely the ring formed by (node ​​6, node 12, node 17) and the ring formed by (node ​​6, node 7, node 8, node 13, node 17). (node ​​6, node 12, node 17) are considered as a whole, and (node ​​6, node 7, node 8, node 13, node 17) are considered as a whole. At this time, node 3 has no upstream abnormal node, and node 3 is the upstream abnormal node of the ring. It is determined as the cause alarm node, and its causal graph can be seen in Fig.10 shown.

[0137] A ring is a closed path, that is, each node is connected by an edge (connection relationship), and the starting point and end point of the path are the same node.

[0138] Situation 3: Fig.11 Taking the ring as the root graph shown as an example, assuming that the cause alarm node is node 18, on the basis of the alarm reasoning model of case one, node 3 is changed to an "unmonitorable point", and the situation of "ring as the root cause" will appear. Further, let node 18 connect downward to node 17 to form an external adjacent ring, and the cause alarm node is at least one of the nodes forming the ring.

[0139] Fig.11 Three rings are formed: a small ring (node ​​6, node 12, node 17), a large ring (node ​​6, node 7, node 8, node 13, node 17), and an adjacent ring (node ​​17, node 18). Since any of the nodes will be connected to other nodes downward, the ring is treated as a whole.

[0140] The ring is the upstream abnormal node, and the abnormal node that generates the alarm earliest in the ring is selected as the cause alarm node.

[0141] Situation 4: Fig.12 Taking the non-adjacent ring graph shown as an example, on the basis of the alarm reasoning graph of situation three, an abnormal node No. 0 is added and formed into a ring with node No. 3.

[0142] According to the previous reasoning process, the root cause is node 0 or node 3. If the alarm time of node 3 is earlier than the alarm time of node 0, node 0 is determined to be the cause alarm node. The causal diagram is shown in Fig.13 .

[0143] Based on the above situation, the specific implementation method of identifying the cause alarm node is introduced below.

[0144] In one embodiment, the steps of determining the causal alarm node from the abnormal nodes included in each abnormal node set in turn include: removing the first abnormal node determined as the causal alarm node and the downstream abnormal nodes of the first abnormal node included in the abnormal node set, and determining the causal alarm node from the abnormal nodes included in the abnormal node set after the abnormal nodes are removed.

[0145] For example, for node 4, the abnormal node set is {node 4}; for node 18, the abnormal node set is {node 0, node 3, node 6, node 12, node 13, node 18, node 4}. The abnormal node set {node 4} is judged, and it is determined that node 4 included in the abnormal node set {node 4} is a cause alarm node, then node 4 (the first abnormal node) and node 18 (the downstream abnormal node of the first abnormal node) are removed from the abnormal node set {node 0, node 3, node 6, node 12, node 13, node 18, node 4}, and the cause alarm node is subsequently identified from the abnormal node set {node 0, node 3, node 6, node 12, node 13}.

[0146] Since the downstream abnormal node of the first abnormal node determined as the causal alarm node generates an alarm with a high probability due to the causal alarm node, that is, the downstream abnormal node is most likely not a causal alarm node, removing it from the abnormal node set can reduce the amount of calculation for subsequent identification of the causal alarm node and further improve the rate.

[0147] In one embodiment, step 103 specifically includes:

[0148] Step 103 - 1 , sort the abnormal nodes included in the abnormal node set according to the order of the number of abnormal nodes included in the abnormal node set from small to large and the order in which the abnormal nodes included in the abnormal node set generate alarms, to obtain an abnormal node list.

[0149] by Fig.14 Taking the alarm reasoning model shown as an example, we can get:

[0150] For node 4, the abnormal node set is {node 4}, which contains 1 node;

[0151] For nodes 0 and 3, since they form a ring, they are treated as a whole. The abnormal node set is {node 0, node 3}, which contains 2 nodes.

[0152] For nodes 6, 12, and 13, since they form a ring, they are treated as a whole. The abnormal node set is {node 0, node 3, node 6, node 12, node 13}, which contains 5 nodes;

[0153] For node 18, the abnormal node set is {node 0, node 3, node 6, node 12, node 13, node 18, node 4}, which contains 7 nodes.

[0154] After sorting, the abnormal node list is obtained: node 4, node 0, node 3, node 6, node 12, node 13, node 18.

[0155] Step 103 - 2 : determine in turn whether the abnormal node set to which the abnormal nodes in the abnormal node list belong contains one abnormal node.

[0156] First, take node 4 in the abnormal node list and determine whether the abnormal node set to which node 4 belongs contains one abnormal node.

[0157] Step 103-3: In response to the abnormal node set including one abnormal node, the abnormal node in the abnormal node set is determined as a cause alarm node; in response to the abnormal node set including at least two abnormal nodes, the abnormal node that generates an alarm earliest among the at least two abnormal nodes is determined as the cause alarm node.

[0158] Since the abnormal node set to which node 4 belongs contains only one abnormal node, node 4 is determined as a causal alarm node.

[0159] In one embodiment, see Figure 1b When the abnormal node set contains at least two abnormal nodes, it is further determined whether the abnormal node set contains nodes forming a ring, and the cause alarm node is determined according to the determination result. Specifically, the step of determining the cause alarm node from the abnormal nodes contained in each abnormal node set includes:

[0160] S0. When the abnormal node set to which the abnormal node in the abnormal node list belongs contains at least two nodes and the nodes in the abnormal node set do not form a ring, the abnormal node in the abnormal node set without an upstream node is determined as a cause alarm node.

[0161] S0 corresponds to the acyclic graph of case 1 above.

[0162] S1. When the abnormal node set to which the abnormal node in the abnormal node list belongs contains at least two nodes and there is a first ring composed of nodes in the abnormal node set, determine whether there is an upstream abnormal node in the first ring.

[0163] S2. In response to the existence of an upstream abnormal node in the first ring, determine a cause alarm node according to the upstream abnormal node.

[0164] In S2, it is further determined whether the upstream abnormal node of the first ring has other upstream abnormal nodes.

[0165] In response to the fact that the upstream abnormal node of the first ring has no other upstream abnormal nodes, and the upstream abnormal node of the first ring and other nodes form a second ring, the abnormal node that first generates an alarm in the second ring is determined as the cause alarm node (corresponding to the non-adjacent ring diagram of the above situation 4). Fig.14 For example, for abnormal node 8, the abnormal node set is {node 0, node 3, node 6, node 12, node 13, node 18, node 4}, among which node 6, node 12, node 13 and unmonitorable node 7 and unmonitorable node 8 constitute the first ring. The nodes contained in the first ring are regarded as a whole. There is an upstream node 3, and the upstream node 3 and the upstream node 0 constitute the second ring. Node 3 and node 0 have no upstream nodes. Then the abnormal node that alarms earliest among node 3 and node 0 is determined as the causal alarm node.

[0166] In response to the fact that the upstream abnormal node of the first ring has no other upstream abnormal nodes, and the upstream abnormal node of the first ring does not form a second ring with other nodes, the upstream abnormal node of the first ring is determined as a cause alarm node (corresponding to the non-root graph of the ring in the above case 2). Fig. 9 For example, there are two nested rings in the figure, namely the first ring formed by (node ​​6, node 12, node 17) and the second ring formed by (node ​​6, node 7, node 8, node 13, node 17). (node ​​6, node 12, node 17) are regarded as a whole, (node ​​6, node 7, node 8, node 13, node 17) are regarded as a whole, and the nodes included in the first ring are regarded as a whole. There is an upstream node 3, and the upstream node 3 does not form a second ring with other nodes. Node 3 has no upstream node, so node 3 is determined as a causal alarm node.

[0167] S3. In response to the fact that there is no upstream abnormal node in the first ring, the abnormal node in the first ring that generates an alarm earliest is determined as a cause alarm node (the ring corresponding to the above situation 3 is the root).

[0168] In this embodiment, when the abnormal node set includes at least two abnormal nodes, different situations are discussed to more accurately identify the cause alarm node.

[0169] Step 103-4: Remove the cause alarm node and its downstream abnormal nodes from the abnormal node list.

[0170] Since node 4 has a downstream abnormal node 18, that is, the abnormal node set to which node 18 belongs contains the abnormal node set to which node 4 belongs, node 18 is removed from the list. Node 4 is a causal alarm node. The reason for the alarm of node 18 is likely to be caused by node 4. Node 18 is not a causal alarm node. Both node 4 and node 18 are removed from the abnormal node list to reduce the amount of calculation, and a new abnormal node list is obtained: node 0, node 3, node 6, node 12, node 13.

[0171] Step 103 - 5 : In response to the number of abnormal nodes included in the abnormal node list being greater than 1, return to the step of sequentially determining whether the abnormal node set to which the abnormal nodes in the abnormal node list belong contains 1 abnormal node.

[0172] The number of nodes included in the new abnormal node list is greater than 1. It is necessary to further determine whether the new abnormal node list also contains cause alarm nodes. Node 0 is taken to determine whether the abnormal node set to which node 0 belongs contains 1 abnormal node. Since the abnormal node set {node 0, node 3} to which node 0 belongs contains 2 nodes, node 3, which has the earliest alarm among nodes 0 and 3, is determined as the cause alarm node. Node 0, node 3, and {node 0, node 3} as a whole downstream abnormal nodes are removed from the abnormal node list: node 6, node 12, and node 13. After the nodes are removed, the number of nodes included in the abnormal node list is 0, and the identification of cause alarm nodes is stopped, or it is further determined whether all alarms in the industrial system are eliminated. If all alarms are eliminated or the number of detection points where alarms occur is less than or equal to the number threshold, the identification of cause alarm nodes is stopped. If the alarms are not eliminated or the number of detection points where alarms occur is greater than the number threshold, steps 102 and 103 are repeated until all alarms in the industrial system are eliminated or the number of detection points where alarms occur is less than or equal to the number threshold.

[0173] The quantity threshold can be set according to actual conditions, for example, it is set to 4. When the number of detection points where alarms occur in the industrial system is less than or equal to 4, the operator can quickly identify the causal alarm node, and the causal alarm node can be identified without using the alarm analysis and reasoning method of the embodiment of the present invention, thereby reducing the amount of calculation and reducing the energy consumption of the industrial system; when the number of detection points where alarms occur in the industrial system is greater than 4, the operator cannot quickly identify the causal alarm node. By executing the alarm analysis and reasoning method of the embodiment of the present invention, the causal alarm node can be quickly and accurately identified, providing a reference for the operator's fault diagnosis and ensuring the effective operation of the industrial system.

[0174] In one embodiment, in step 101, a multi-layer flow modeling method is used to process the operating status data to obtain a system model.

[0175] The modeling method of Multilevel Flow Models (MFM) can establish a model of the relationship between matter, energy, and information in complex industrial systems, providing an effective tool for alarm analysis and reasoning.

[0176] In one embodiment, after step 103, a causal graph of the cause alarm node is further determined. Specifically, all upstream abnormal nodes and downstream abnormal nodes of the cause alarm node are searched from the system model or the alarm reasoning graph according to the data propagation relationship to form a causal graph. The causal graph includes unmonitorable nodes and abnormal nodes that have a data propagation relationship with the abnormal node.

[0177] by Fig.15 Taking node 6 as an example, the cause alarm node shown in the figure has upstream nodes including node 1, node 5, and node 11, and downstream nodes including node 7, node 8, node 12, node 13, node 17, and node 18. The cause and effect diagram of node 6 is shown in Fig.16 shown.

[0178] In one embodiment, the unmonitorable nodes are regarded as risk nodes. Fig.17 This embodiment can also provide a causal graph of risk nodes. Taking nodes 8 and 17 as risk nodes, all upstream nodes and all downstream nodes of the risk nodes are searched in the alarm reasoning model to form a causal graph. Fig.18 is the causal graph corresponding to risk node 8, Fig.19 This is the causal diagram corresponding to risk node 17.

[0179] In one embodiment, the alarm analysis and reasoning method further includes: determining each downstream connection path of each abnormal node in the system model according to the data propagation relationship, and determining the first normal node of the second abnormal node in each downstream connection path as a predicted node with alarm risk; the second abnormal node is an abnormal node without downstream abnormal nodes, that is, the last abnormal node in the downstream connection path. The so-called predicted node is a normal node with at least one upstream abnormal node, which has an alarm risk but has not triggered an alarm.

[0180] For details, see Fig.20a , the steps of determining the prediction node include:

[0181] Step 202: Determine the downstream connection path of each abnormal node in the system model according to the data propagation relationship.

[0182] Step 204: determine the second abnormal node in each downstream communication path, and determine the first normal node of the second abnormal node in the downstream communication path as the predicted node.

[0183] Step 206: Determine whether each abnormal node in the system model has been traversed.

[0184] In step 206, if the judgment result is yes, the traversal is stopped. If the judgment result is no, the process returns to step 202 to judge the next abnormal node.

[0185] It should be noted that the prediction node can be directly connected to the abnormal node, see Fig.20b For abnormal node 3, there is a downstream connection path: abnormal node 3→normal node 2. The first normal node 2 of abnormal node 3 (the second abnormal node) is also the predicted node, and the predicted node 2 is directly connected to abnormal node 3.

[0186] Prediction nodes can also be connected to abnormal nodes through unmonitored nodes, see Fig.20b , there are two downstream connection paths for abnormal node 6: (1) abnormal node 6 → unmonitored node 7-normal node 8, (2) abnormal node 6 → abnormal node 12 → unmonitored node 17-normal node 18. For the first normal node 8 of abnormal node 6 (the second abnormal node) in the downstream connection path (1), that is, the predicted node, the predicted node 8 is connected to abnormal node 6 through the unmonitored node 7. For the downstream connection path (2), abnormal node 12 has no downstream abnormal node, abnormal node 12 is the second abnormal node, and the first normal node 18 of abnormal node 12 is also the predicted node, which is connected to abnormal node 12 through the unmonitored node 17.

[0187] In this embodiment, prediction nodes are provided to operators of the industrial system for reference, so that the operators can be warned in advance and take preventive measures early, further ensuring the effective operation of the industrial system.

[0188] In one embodiment, the alarm analysis and reasoning method also includes: determining a prediction graph of a prediction node based on a data propagation relationship; the prediction graph includes a connection path between the prediction node and the second abnormal node, that is, the starting point of the connection path in the prediction graph is the second abnormal node and the end point is the prediction node.

[0189] For details, see Fig.20a , after step 204, it also includes: step 205, determining a prediction graph according to a connection path between the second abnormal node and the prediction node.

[0190] It should be noted that the prediction graph may be determined after step 204 or after the traversal is stopped, and the embodiment of the present disclosure does not particularly limit the specific order of determining the prediction graph.

[0191] Or Fig.20b For example, for prediction node 2, the first upstream abnormal node connected to prediction node 2 in its connected path is abnormal node 3 (the second abnormal node), see Fig.20c , abnormal node 3→prediction node 2 is determined as the prediction graph of abnormal node 3. For prediction node 8, the first upstream abnormal node connected to prediction node 8 in the connected path is abnormal node 6 (the second abnormal node), and the obtained prediction graph is shown in Fig.20d As shown. For prediction node 18, the first upstream abnormal node connected to prediction node 18 in the connected path (abnormal node 4→prediction node 18) is abnormal node 4 (the second abnormal node), the first upstream abnormal node connected to prediction node 18 in the connected path (abnormal node 13→unmonitored node 17→prediction node 18) is abnormal node 13 (the second abnormal node), and the first upstream abnormal node connected to prediction node 18 in the connected path (abnormal node 6→abnormal node 12→unmonitored node 17→prediction node 18) is abnormal node 12 (the second abnormal node). The obtained prediction graph is shown in Fig.20e shown.

[0192] Corresponding to the aforementioned alarm analysis and reasoning method embodiment, the present disclosure also provides an embodiment of an alarm analysis and reasoning system.

[0193] Fig.21 A schematic diagram of a module of an alarm analysis and reasoning device provided by an exemplary embodiment of the present disclosure, the device comprising:

[0194] The model building module 21 is used to build a system model according to the operating status data of the detection points of the industrial system; each node included in the system model represents a detection point, and the connection relationship between the nodes represents the data propagation relationship between the detection points;

[0195] A search module 22, used to search for upstream abnormal nodes of each abnormal node in the system model, and obtain an abnormal node set corresponding to each abnormal node;

[0196] The root cause determination module 23 is used to determine the cause alarm node from the abnormal nodes included in each abnormal node set in the order from small to large in the number of abnormal nodes included in the abnormal node set; wherein the abnormal node in the abnormal node set that meets the root cause condition is determined as the cause alarm node; the root cause condition includes that the abnormal node set contains 1 abnormal node, the abnormal node set contains at least 2 abnormal nodes and the alarm occurs earliest.

[0197] Optionally, the search module includes:

[0198] A removal unit, used to remove normal nodes and unmonitorable nodes without downstream abnormal nodes in the system model to obtain an alarm reasoning model;

[0199] The determination unit is used to determine the abnormal node and its upstream abnormal node in the alarm reasoning model.

[0200] Optionally, the determining unit is specifically configured to:

[0201] In the process of searching all upstream nodes of the abnormal node in the alarm reasoning model, determining whether the upstream node of the abnormal node is an unmonitorable node;

[0202] In response to the upstream node of the abnormal node being an unmonitorable node, removing the unmonitorable node;

[0203] In response to the upstream node of the abnormal node not being an unmonitorable node, the upstream node of the abnormal node is determined as the upstream abnormal node.

[0204] Optionally, the root cause determination module includes:

[0205] A removing unit, configured to remove a first abnormal node corresponding to a causal alarm node included in the abnormal node set and a downstream abnormal node of the first abnormal node;

[0206] The root cause determination unit is used to determine the cause alarm node from the abnormal nodes included in the abnormal node set after the abnormal nodes are removed.

[0207] Optionally, the root cause determination module includes:

[0208] A sorting unit, configured to sort the abnormal nodes included in the abnormal node set according to the order of the number of abnormal nodes included in the abnormal node set from small to large and the order in which the abnormal nodes included in the abnormal node set generate alarms, so as to obtain an abnormal node list;

[0209] A judging unit, configured to judge in turn whether the abnormal node set to which the abnormal node in the abnormal node list belongs contains one abnormal node;

[0210] a root cause determination unit, configured to, in response to the abnormal node set including one abnormal node, determine the abnormal node in the abnormal node set as a cause alarm node; in response to the abnormal node set including at least two abnormal nodes, determine the abnormal node that generates an alarm earliest among the at least two abnormal nodes as the cause alarm node;

[0211] A removing unit, used to remove the cause alarm node and its downstream abnormal nodes from the abnormal node list;

[0212] The calling unit is configured to call the judging unit in response to the number of abnormal nodes included in the abnormal node list being greater than 1.

[0213] Optionally, when determining the cause alarm node from the abnormal nodes included in each abnormal node set, the root cause determination module is specifically used to:

[0214] When the abnormal node set to which the abnormal node in the abnormal node list belongs contains at least two nodes and there is a first ring composed of nodes in the abnormal node set, determining whether there is an upstream abnormal node in the first ring;

[0215] In response to the presence of an upstream abnormal node in the first ring, determining a cause alarm node according to the upstream abnormal node;

[0216] In response to the fact that there is no upstream abnormal node in the first ring, the abnormal node in the first ring where an alarm occurs earliest is determined as a causal alarm node.

[0217] Optionally, when determining the cause alarm node according to the upstream abnormal node, the root cause determination module is specifically used to:

[0218] In response to the fact that the upstream abnormal node of the first ring has no other upstream abnormal nodes, and the upstream abnormal node of the first ring and other nodes form a second ring, determining the abnormal node in the second ring that generates an alarm earliest as a cause alarm node;

[0219] In response to the fact that the upstream abnormal node of the first ring has no other upstream abnormal nodes and the upstream abnormal node of the first ring does not form a second ring with other nodes, the upstream abnormal node of the first ring is determined as a causal alarm node.

[0220] Optionally, the model building module is specifically used to: process the operating status data using a multi-layer flow modeling device to obtain the system model;

[0221] And / or, the alarm analysis and reasoning device further comprises: a causal graph determination module for determining a causal graph of each causal alarm node according to the data propagation relationship; the causal graph comprises an unmonitorable node and an abnormal node having a data propagation relationship with the abnormal node;

[0222] And / or, the search module is further used to: determine each downstream connection path of each abnormal node in the system model according to the data propagation relationship, and determine the first normal node of the second abnormal node in each downstream connection path as a predicted node with an alarm risk; the second abnormal node is an abnormal node without a downstream abnormal node;

[0223] And / or, the alarm analysis and reasoning device also includes: a prediction graph determination module for determining a prediction graph based on the data propagation relationship; the prediction graph includes a connection path between the prediction node and the second abnormal node.

[0224] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only illustrative, wherein the units described as separate components may or may not be physically separated, and the components as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the disclosed solution.

[0225] Fig. 22 This is a structural diagram of an electronic device shown in an example embodiment of the present disclosure, the electronic device includes a memory, a processor, and a computer program stored in the memory and used to run on the processor, and the processor implements the alarm analysis and reasoning method described in any of the above embodiments when executing the computer program. Fig. 22 The electronic device 90 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0226] like Fig. 22 As shown, the electronic device 90 may be in the form of a general-purpose computing device, for example, it may be a server device. The components of the electronic device 90 may include, but are not limited to: at least one processor 91, at least one memory 92, and a bus 93 connecting different system components (including the memory 92 and the processor 91).

[0227] The bus 93 includes a data bus, an address bus, and a control bus.

[0228] The memory 92 may include a volatile memory, such as a random access memory (RAM) 921 and / or a cache memory 922 , and may further include a read only memory (ROM) 923 .

[0229] The memory 92 may also include a program tool 925 (or utility) having a set (at least one) of program modules 924, such program modules 924 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0230] The processor 91 executes various functional applications and data processing by running the computer program stored in the memory 92, such as the alarm analysis and reasoning method provided in any of the above embodiments.

[0231] The electronic device 90 may also communicate with one or more external devices 94 (e.g., keyboards, pointing devices, etc.). Such communication may be performed via an input / output (I / O) interface 95. Furthermore, the electronic device 90 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 96. As shown, the network adapter 96 communicates with other modules of the electronic device 90 via a bus 93. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 90, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID (disk array) systems, tape drives, and data backup storage systems, etc.

[0232] It should be noted that although several units / modules or sub-units / modules of the electronic device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more units / modules described above can be embodied in one unit / module. Conversely, the features and functions of one unit / module described above can be further divided into multiple units / modules to be embodied.

[0233] The embodiments of the present disclosure also provide a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the alarm analysis and reasoning method provided by any of the above embodiments is implemented.

[0234] The readable storage medium may include but is not limited to: a portable disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical storage device, a magnetic storage device or any suitable combination of the above.

[0235] The embodiment of the present disclosure also provides a computer program product, including a computer program, which implements any of the above-mentioned alarm analysis and reasoning methods when executed by a processor.

[0236] Among them, the program code for executing the computer program product of the present disclosure can be written in any combination of one or more programming languages, and the program code can be executed completely on the user device, partially on the user device, as an independent software package, partially on the user device and partially on a remote device, or completely on the remote device.

[0237] Although the specific embodiments of the present disclosure are described above, those skilled in the art should understand that this is only an example, and the protection scope of the present disclosure is defined by the appended claims. Those skilled in the art may make various changes or modifications to these embodiments without departing from the principles and essence of the present disclosure, but these changes and modifications all fall within the protection scope of the present disclosure.

Claims

1. An alarm analysis and reasoning method, characterized in that: include: Build a system model based on the operating status data of the detection points of the industrial system; Each node included in the system model represents a detection point, and the connection relationship between the nodes represents the data propagation relationship between the detection points; Finding the upstream abnormal nodes of each abnormal node in the system model to obtain an abnormal node set corresponding to each abnormal node; According to the order of the number of abnormal nodes included in the abnormal node set from small to large, the cause alarm node is determined from the abnormal nodes included in each abnormal node set in turn; wherein the abnormal node in the abnormal node set that meets the root cause condition is determined as the cause alarm node; the root cause condition includes that the abnormal node set includes 1 abnormal node, the abnormal node set includes at least 2 abnormal nodes and the alarm occurs earliest; Determine the cause alarm node from the abnormal nodes included in each abnormal node set, including: When the abnormal node set to which the abnormal node in the abnormal node list belongs contains at least two nodes and the nodes in the abnormal node set do not form a ring, the abnormal node in the abnormal node set without an upstream node is determined as a cause alarm node; When the abnormal node set to which the abnormal node in the abnormal node list belongs contains at least two nodes and there is a first ring composed of nodes in the abnormal node set, determining whether there is an upstream abnormal node in the first ring; In response to the presence of an upstream abnormal node in the first ring, determining a cause alarm node according to the upstream abnormal node; In response to the fact that there is no upstream abnormal node in the first ring, the abnormal node in the first ring where an alarm occurs earliest is determined as a causal alarm node.

2. The alarm analysis and reasoning method according to claim 1 is characterized in that: Finding the upstream abnormal nodes of each abnormal node in the system model includes: Removing normal nodes and unmonitorable nodes without downstream abnormal nodes in the system model to obtain an alarm reasoning model; Determine the abnormal node and its upstream abnormal node in the alarm reasoning model.

3. The alarm analysis and reasoning method according to claim 2 is characterized in that: Determining an abnormal node and its upstream abnormal node in the alarm reasoning model includes: In the process of searching all upstream nodes of the abnormal node in the alarm reasoning model, determining whether the upstream node of the abnormal node is an unmonitorable node; In response to the upstream node of the abnormal node being an unmonitorable node, removing the unmonitorable node; In response to the upstream node of the abnormal node not being an unmonitorable node, the upstream node of the abnormal node is determined as the upstream abnormal node.

4. The alarm analysis and reasoning method according to claim 1 is characterized in that: The cause alarm nodes are determined from the abnormal nodes included in each abnormal node set in turn, including: Remove the first abnormal node determined to be a cause alarm node and the downstream abnormal nodes of the first abnormal node included in the abnormal node set; The cause alarm node is determined from the abnormal nodes included in the abnormal node set after the abnormal node is removed.

5. The alarm analysis and reasoning method according to claim 1 is characterized in that: According to the order of the number of abnormal nodes included in the abnormal node set from small to large, the cause alarm node is determined from the abnormal nodes included in each abnormal node set, including: According to the order of the number of abnormal nodes included in the abnormal node set from small to large and the order in which the abnormal nodes included in the abnormal node set generate alarms, the abnormal nodes included in the abnormal node set are sorted to obtain an abnormal node list; Determine in sequence whether the abnormal node set to which the abnormal node in the abnormal node list belongs contains one abnormal node; In response to the abnormal node set including one abnormal node, determining the abnormal node in the abnormal node set as a cause alarm node; in response to the abnormal node set including at least two abnormal nodes, determining the abnormal node that generates an alarm earliest among the at least two abnormal nodes as a cause alarm node; Remove the causal alarm node and its downstream abnormal nodes from the abnormal node list; In response to the number of abnormal nodes included in the abnormal node list being greater than 1, returning to the step of sequentially determining whether the abnormal node set to which the abnormal nodes in the abnormal node list belong includes 1 abnormal node.

6. The alarm analysis and reasoning method according to claim 1 is characterized in that: In response to the presence of an upstream abnormal node in the first ring, determining a cause alarm node according to the upstream abnormal node includes: In response to the fact that the upstream abnormal node of the first ring has no other upstream abnormal nodes, and the upstream abnormal node of the first ring and other nodes form a second ring, determining the abnormal node in the second ring that generates an alarm earliest as a cause alarm node; In response to the fact that the upstream abnormal node of the first ring has no other upstream abnormal nodes and the upstream abnormal node of the first ring does not form a second ring with other nodes, the upstream abnormal node of the first ring is determined as a causal alarm node.

7. The alarm analysis and reasoning method according to any one of claims 1 to 6, characterized in that: Based on the operating status data of the detection points of the industrial system, a system model is constructed, including: The operating state data is processed by using a multi-layer flow modeling method to obtain the system model; And / or, the alarm analysis and reasoning method further includes: determining a causal graph of each causal alarm node according to the data propagation relationship; the causal graph includes unmonitorable nodes and abnormal nodes that have a data propagation relationship with the abnormal node; And / or, the alarm analysis and reasoning method further includes: determining each downstream connection path of each abnormal node in the system model according to the data propagation relationship, and determining the first normal node of the second abnormal node in each downstream connection path as a predicted node with alarm risk; the second abnormal node is an abnormal node without downstream abnormal nodes; And / or, the alarm analysis and reasoning method also includes: determining a prediction graph based on the data propagation relationship; the prediction graph includes a connection path between the prediction node and the second abnormal node.

8. An alarm analysis and reasoning device, characterized in that: Used to implement the alarm analysis and reasoning method described in any one of claims 1 to 7, the alarm analysis and reasoning device comprises: A model building module is used to build a system model based on the operating status data of the detection points of the industrial system; each node included in the system model represents a detection point, and the connection relationship between the nodes represents the data propagation relationship between the detection points; A search module, used to search for upstream abnormal nodes of each abnormal node in the system model, and obtain an abnormal node set corresponding to each abnormal node; A root cause determination module, used to determine the cause alarm node from the abnormal nodes included in each abnormal node set in order from small to large in number of abnormal nodes included in the abnormal node set; wherein the abnormal node in the abnormal node set that meets the root cause condition is determined as the cause alarm node; the root cause condition includes that the abnormal node set includes 1 abnormal node, the abnormal node set includes at least 2 abnormal nodes and the alarm occurs earliest; When determining the cause alarm node from the abnormal nodes included in each abnormal node set, the root cause determination module is specifically used to: When the abnormal node set to which the abnormal node in the abnormal node list belongs contains at least two nodes and the nodes in the abnormal node set do not form a ring, the abnormal node in the abnormal node set without an upstream node is determined as a cause alarm node; When the abnormal node set to which the abnormal node in the abnormal node list belongs contains at least two nodes and there is a first ring composed of nodes in the abnormal node set, determining whether there is an upstream abnormal node in the first ring; In response to the presence of an upstream abnormal node in the first ring, determining a cause alarm node according to the upstream abnormal node; In response to the fact that there is no upstream abnormal node in the first ring, the abnormal node in the first ring where an alarm occurs earliest is determined as a causal alarm node.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and used to run on the processor, characterized in that: When the processor executes the computer program, the alarm analysis and reasoning method described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the alarm analysis and reasoning method according to any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the alarm analysis and reasoning method as described in any one of claims 1 to 7 is implemented.

Images