A safety assessment system and method based on data hazard source identification

Abstract

The present invention discloses a safety assessment system and method based on data hazard source identification, which relates to the field of data processing technology, including collecting safety hazard source data, preprocessing, and building a unified safety hazard source data standard; real-time monitoring of key data streams, and short-term safety risk warning; mining risk event patterns from historical data, and outputting medium-term risk condition rules; using association rules to perform long-term risk root cause analysis; integrating short-, medium-, and long-term risk model outputs, establishing a risk matrix, and determining the probability of occurrence and impact of various risks. The present invention outputs risk information of different time scales, integrates these outputs, and maps them into a unified risk matrix model. The matrix intuitively displays the distribution of various risks in the probability-impact coordinate system, providing an objective basis for judging risk levels.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a safety assessment system and method based on data hazard source identification. Background Art

[0002] Modern industrial systems are becoming increasingly complex, with countless equipment and process links and personnel and process links, and safety risks may lurk everywhere. In recent years, with the rapid development of emerging technologies such as big data and machine learning, safety risk assessment methods based on data analysis have gradually become a research hotspot.

[0003] Traditional safety assessment methods mainly rely on manual experience, and have drawbacks such as strong subjectivity and limited scope. Some model-based assessment methods require the establishment of complex causal models, and have high data requirements for the quantification of risk influencing factors and model training. Some assessment methods based on monitoring data focus on real-time monitoring of abnormal conditions, but lack analysis of long-term root causes.

[0004] In general, existing technologies still have shortcomings in terms of comprehensiveness, intelligence, and explainability. Summary of the invention

[0005] In view of the problems existing in the above-mentioned traditional security assessment method, the present invention is proposed.

[0006] Therefore, the problem to be solved by the present invention is how to provide a safety assessment system and method based on data hazard source identification.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] In the first aspect, an embodiment of the present invention provides a safety assessment method based on data hazard source identification, which includes collecting safety hazard source data and preprocessing it to build a unified safety hazard source data standard; real-time monitoring of key data streams to issue short-term safety risk warnings; mining risk event patterns from historical data to output medium-term risk condition rules; using association rules to perform long-term risk root cause analysis; integrating short-, medium- and long-term risk model outputs to establish a risk matrix to determine the probability of occurrence and impact of various risks.

[0009] As a preferred solution of the safety assessment method based on data hazard source identification described in the present invention, the implementation of short-term safety risk warning includes the following steps: identifying the safety hazard source data monitoring objects, and setting an abnormal threshold for each monitored object; dividing the warning into multiple levels, each level corresponding to a different degree of hazard and response measures; for a single monitored object, when the real-time data exceeds the threshold, triggering a warning of the corresponding level; for multiple monitored objects, setting judgment conditions, and triggering the warning only when a certain combination of conditions is met.

[0010] As a preferred solution of the safety assessment method based on data hazard source identification described in the present invention, wherein: the setting of judgment conditions, triggering an early warning only when a certain combination of conditions is met, includes: drawing a monitoring object association diagram according to the process flow, equipment layout and the relationship and influence mechanism between each monitoring object, and identifying different coupling modes; assigning "and" logic to parallel monitoring objects; assigning "or" logic to serial monitoring objects; grading the monitoring objects according to their importance, constructing a hierarchical conditional tree structure, and the abnormal situation of the high-level monitoring object is used as the root node; the leaf node corresponds to the actual monitoring object, and the nodes of each layer are connected by logic gates, progressing from top to bottom, and the corresponding high-level early warning can be triggered only when the conditional path is true; setting a time weight for the abnormality degree of a single monitoring object, and the judgment formula for the abnormality degree of a single monitoring object is:

[0011]

[0012] Among them, T d is the duration of the deviation; V c is the current value of the monitored object; V t is the predetermined threshold; ω t is the time weight coefficient; the trend judgment formula for multiple monitoring objects is:

[0013]

[0014] Among them, ω d is the trend weight coefficient, n is the number of monitored objects; D i is the trend coefficient of the ith monitored object;

[0015] For different working conditions, set a combination of composite conditions, and trigger an early warning when any one of them is met.

[0016] As a preferred solution of the safety assessment method based on data hazard source identification of the present invention, the mining of risk event patterns from historical data includes: using the risk event sequence model RESM to extract the safety hazard source time series data stream related to the risk event from the historical time series data stream, and splicing it into a complete risk event data set by time; let S = {s1, s2, ..., s m} is the risk event data set, where s i is an event sequence, let P be a set of prefix patterns, for each prefix pattern The new candidate pattern p'=pe is generated by expansion, where e is an event in the event sequence and p' must meet the minimum support threshold σ; the event importance score based on the entropy value is as follows:

[0017]

[0018] Among them, P(e i ) is the event e i The probability of occurrence, m is the number of values ​​of the event in the risk event data set;

[0019] Dimensionality reduction is performed based on event importance scores; the prefix span projection clustering algorithm is improved, and the formula is as follows:

[0020]

[0021] Among them, support(p') is the support of pattern p'; σ is the minimum support threshold; τ is the importance score threshold; the output of the improved prefix span projection clustering algorithm is the frequent sequence patterns found from the dataset.

[0022] As a preferred solution of the safety assessment method based on data hazard source identification described in the present invention, the output of mid-term risk condition rules includes: constructing the extracted frequent sequence patterns into a sequence pattern tree, the root node of the tree is an empty sequence, the child nodes represent the newly added events based on the parent node, and the nodes at the same level are encoded in the order of events entering the tree to form a unique sequence pattern identifier; performing statistical information measurement on the sequence pattern tree; converting nodes with high risk and support exceeding a threshold into IF-THEN risk rules, the conditional part is the rule path code, and the conclusion is the conditional probability estimate of the risk occurrence.

[0023] As a preferred solution of the safety assessment method based on data hazard source identification of the present invention, the IF-THEN risk rule includes: let R be the rule path code, and the rule path code formula of the condition part is:

[0024] R={N1,N2,...,N j}

[0025] Among them, N i represents the i-th node on the path; under the support threshold condition, the formula of the IF-THEN risk rule is:

[0026] IF R AND Support(R)≥σTHEN Risk=R(Risk|R)

[0027] Among them, Support(R) is the support of path R, and Risk(R) is the estimated value of the conditional probability of risk occurrence of path R.

[0028] As a preferred solution of the safety assessment method based on data hazard source identification described in the present invention, the establishment of a risk matrix includes: the rows and columns of the risk matrix respectively represent the type of safety hazard source and the level of hazard degree; the probability of occurrence of each type of safety hazard source is calculated: for short-term warnings, the probability of occurrence = warning occurrence frequency / given time window; for medium-term modes, the probability of occurrence = Risk (R); for long-term root causes, the probability of occurrence = 1-(1-historical occurrence rate)^(expected occurrence cycle); according to the risk type, its probability of occurrence and the degree of impact, each risk item is placed in the corresponding cell of the matrix.

[0029] Secondly, in order to further solve the safety problems existing in traditional safety assessment methods, the present invention provides a safety assessment system based on data hazard source identification, which includes: an acquisition module, which is used to collect safety hazard sources, perform preprocessing, and build a unified safety hazard source data standard; a short-term warning module, which is used to monitor the data flow of key safety hazard sources in real time, trigger warnings in time when abnormalities are found, and realize short-term safety risk warnings; a medium-term risk pattern mining module, which is used to mine risk event patterns from historical data of hazard sources and output medium-term risk condition rules; a long-term risk root cause analysis module, which is used to analyze long-term risk root causes using association rules; a risk assessment and decision-making module, which is used to integrate the outputs of short-, medium- and long-term risk models, establish a risk matrix, and determine the probability of occurrence and impact of various risk sources.

[0030] In a third aspect, an embodiment of the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the safety assessment method based on data hazard source identification as described in the first aspect of the present invention.

[0031] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the safety assessment method based on data hazard source identification as described in the first aspect of the present invention.

[0032] The beneficial effect of the present invention is that the present invention outputs risk information at different time scales respectively, integrates these outputs, and maps them into a unified risk matrix model. The matrix intuitively displays the distribution of various risks in the probability-impact coordinate system, providing an objective basis for judging the risk level. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0034] Figure 1 This is a flow chart of the safety assessment method based on data hazard source identification in Example 1.

[0035] Figure 2 This is a structural diagram of the safety assessment system based on data hazard source identification in Example 1. DETAILED DESCRIPTION

[0036] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0037] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0038] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0039] Example 1

[0040] Reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a safety assessment method based on data hazard source identification, comprising the following steps:

[0041] S1: Collect various safety hazards that may cause safety risks, perform pre-processing, and build a unified safety hazard data standard.

[0042] First, determine the standard data types of safety hazard source data that need to be collected, such as equipment operating status data, environmental parameter data, personnel violation operation data, etc. Check the available safety hazard sources, including databases, log files, monitoring sensors, etc., and collect relevant data.

[0043] The collected raw data is cleaned, including filling in missing values, removing duplicates, and eliminating outliers, and data in different formats are converted into a standardized format to ensure consistency in data fields, types, and encodings.

[0044] Establish unified data standards to standardize data formats, coding methods, naming conventions, etc. All safety hazard source data shall be collected and converted according to this standard, such as: numerical types use floating point format, environmental parameters use international system units, etc.

[0045] It should be noted that through standardization, heterogeneous safety hazard source data can be integrated to lay a data foundation for subsequent safety risk analysis, and standards can be managed throughout the entire life cycle to ensure long-term applicability.

[0046] S2: Monitor key data flows in real time, trigger warnings promptly when anomalies are detected, and implement short-term security risk warnings.

[0047] S2.1: Specifically, identify the safety hazard source data monitoring objects, such as equipment operating parameters, environmental indicators exceeding standards, illegal operating behaviors, etc., whose abnormalities may lead to safety risks.

[0048] An abnormal threshold is set for each monitored object, and the threshold setting takes into account factors such as design specifications and historical data.

[0049] S2.2: Divide warnings into multiple levels, each level corresponding to different degrees of hazard and response measures.

[0050] The warning is divided into multiple levels, such as three levels, each level corresponds to different degrees of harm and response measures. The judgment of the warning level is determined based on the deviation degree between the current value of the monitored object and the threshold, the duration and other factors, as follows:

[0051]

[0052] Among them, T d is the duration of the deviation; k1 and k2 are weight coefficients used to balance the degree of deviation and duration; V c is the current value of the monitored object; V t is a predetermined threshold.

[0053] S2.3: For a single monitored object, when the real-time data exceeds the threshold, an early warning of the corresponding level is triggered.

[0054] Specifically, for a single monitored object, when real-time data exceeds the threshold, an alert of the corresponding level is triggered, such as yellow, orange, or red alert.

[0055] S2.4: For multiple monitoring objects, set complex conditions such as judgment logic and or not, and trigger the warning only when a certain combination of conditions is met.

[0056] S2.4.1: Establish a monitoring object association model.

[0057] Preferably, according to the process flow and equipment layout, a monitoring object association diagram is drawn according to the mutual relationship and influence mechanism between each monitoring object, and different coupling modes such as parallel, serial, and feedback are identified; "AND" logic is assigned to parallel monitoring objects, that is, an early warning is triggered only when all monitoring objects are abnormal; "OR" logic is assigned to serial monitoring objects, that is, an abnormality of any monitoring object may cause an abnormality of subsequent monitoring objects.

[0058] S2.4.2: Create a hierarchical condition tree.

[0059] The monitoring objects are graded according to their importance and a hierarchical condition tree structure is constructed. The abnormal conditions of the high-level monitoring objects are used as root nodes, which may involve condition combinations of multiple lower-level monitoring objects.

[0060] The leaf nodes correspond to the actual monitored objects, and the nodes at each layer are connected through logic gates such as "AND", "OR", and "NOT". From top to bottom, the corresponding high-level warning can only be triggered when the conditional path is true.

[0061] S2.4.3: Set a time weight for the abnormality of a single monitored object. That is, the longer the abnormality lasts, the higher the weight. Introduce trend judgment for multiple monitored objects. If the abnormal value continues to change in the same direction, the trend weight increases. Specifically:

[0062] The abnormality degree of a single monitored object is:

[0063]

[0064] Among them, (1+ω t ×T d ) is a weighting factor that takes into account the duration of the deviation, i.e., the longer the time, the higher the weight.

[0065] That is, the judgment formula for the abnormality degree of a single monitored object is:

[0066]

[0067] Trend judgment of multiple monitoring objects includes:

[0068] To accumulate the abnormality levels of all monitored objects;

[0069] Among them, (1+ω d ×D i ) is the trend weighting factor for each monitored object, that is, the more obvious the trend of change in the same direction, the higher the weight.

[0070] That is, the trend judgment formula for multiple monitoring objects is:

[0071]

[0072] Among them, ω t is the time weight coefficient; ω d is the trend weight coefficient, n is the number of monitored objects; D i It is the trend coefficient of the ith monitored object (just like the trend value of directional change, the positive and negative signs can be used to indicate the direction, and the value indicates the magnitude of change).

[0073] Introduce time weight and trend weight into conditional combinations to enhance the dynamics of logical judgment.

[0074] S2.4.4: For different working conditions, set a combination of composite conditions, and a warning can be triggered if any one of them is met.

[0075] Such as "A and B are abnormal and last for a certain period of time" or "C is abnormal and D shows an upward trend".

[0076] Logical conditions can be extended to any nested and combined forms of "and", "or", and "not".

[0077] Send the judged warning information to relevant personnel and systems in a timely manner.

[0078] S3: Mining risk event patterns from historical data of safety hazards and outputting mid-term risk condition rules.

[0079] Specifically, the risk event sequence model RESM is adopted to extract the time series data stream of safety hazard sources related to risk events from the historical time series data stream based on the sequence pattern mining algorithm, and splice them into a complete risk event data set by time.

[0080] The prefix span projection clustering algorithm is used to discover frequent patterns in the risk event data set, and the algorithm is improved to introduce a sequence extension strategy, which enhances the ability to discover long patterns, scores the importance of events based on entropy values, reduces data dimensions, and improves computational efficiency. Specifically:

[0081] Let S = {s1, s2, ..., sm} be the risk event data set, where each s i is an event sequence, let P be the set of prefix patterns, for each prefix pattern The expansion generates a new candidate pattern p'=pe, where e is an event in the event sequence and p' must satisfy the minimum support threshold σ.

[0082] The event importance score based on entropy is as follows:

[0083]

[0084] Among them, P(e i ) is the event e i The probability of occurrence, m is the number of values ​​of the event in the risk event data set.

[0085] Dimensionality reduction is performed based on the event importance scores, and only events with importance scores higher than the importance score threshold τ are retained.

[0086] The prefix span projection clustering algorithm is improved as follows:

[0087]

[0088] Among them, support(p') is the support of pattern p'; σ is the minimum support threshold; τ is the importance score threshold.

[0089] It can be seen that by extending the prefix pattern to discover longer frequent patterns, the ability to discover long patterns is enhanced; and by using entropy values ​​to score events, events with large amounts of information are retained, the data dimension is reduced, and computational efficiency can be improved.

[0090] Furthermore, the extracted frequent sequence patterns are constructed into a sequence pattern tree, where the root node is an empty sequence, the child nodes represent newly added events based on the parent node, and the nodes at the same level are encoded in the order in which the events enter the tree to form a unique sequence pattern identifier.

[0091] The statistical information of the sequence pattern tree is measured to calculate the risk level, probability, confidence level and other indicators of each node.

[0092] Using the rule induction algorithm, nodes with higher risk and support exceeding the threshold are converted into IF-THEN risk rules. The condition part is the rule path encoding, and the conclusion is the conditional probability estimate of the risk occurrence.

[0093] Preferably, let R be the rule path code, and the rule path code formula of the condition part is:

[0094] R={N1,N2,...,N j}

[0095] Among them, N i Represents the i-th node on the path.

[0096] Under the support threshold condition, the formula of the IF-THEN risk rule is:

[0097] IF R AND Support(R)≥σTHEN Risk=R(Risk|R)

[0098] Among them, Support(R) is the support of path R, and Risk(R) is the estimated value of the conditional probability of risk occurrence of path R.

[0099] The above IF-THEN risk rules can transform qualified node paths into specific risk rules, which facilitates analysis and decision-making in risk management.

[0100] The performance indicators of the generated conditional rules and scoring models, such as recall rate, accuracy, etc., are evaluated on the test set, and the model is optimized by adjusting algorithm parameters (such as support threshold, etc.) and rule generation strategies.

[0101] S4: Use association rules to perform long-term risk root cause analysis.

[0102] Specifically, association rule mining algorithms such as the Apriori algorithm or the FP-Growth algorithm are used to mine association rules that meet the support and confidence thresholds in the historical data of safety hazard sources, and to screen rules related to long-term risks, such as root causes involving process defects, equipment selection, management systems, etc.

[0103] Analyze these rules and identify the root causes of risks, and build a root cause knowledge base that includes root causes, related events, evaluation indicators, etc.

[0104] According to the knowledge base, corresponding measures are formulated, such as improving process design, evaluating equipment selection standards, improving management systems, etc., to fundamentally eliminate safety hazards.

[0105] S5: Integrate the outputs of short-, medium- and long-term risk models, establish a risk matrix, and determine the probability of occurrence and impact of various risks.

[0106] S5.1: Summarize short-term risk warning outputs, medium-term risk pattern rules, and long-term risk root cause knowledge.

[0107] Specifically, the warning information of various levels triggered by real-time monitoring is obtained from S2, including warning time, monitoring object, warning level, etc., the occurrence frequency of different warning levels in a given time window is counted, and the warning level is mapped to the corresponding potential hazard degree score.

[0108] Obtain the IF-THEN risk rule conditions and scoring models mined by the RESM model from S3, classify and summarize the rules, identify representative risk pattern types, and calculate the distribution of the scoring model output values ​​for each type of risk pattern.

[0109] The long-term risk root cause knowledge base obtained by association rule analysis is obtained from S4, and the root cause knowledge is categorized to distinguish different root cause types such as process, equipment, and management. The number of historical risk events caused by each type of root cause and the degree of impact are counted.

[0110] S5.2: Construct a risk matrix.

[0111] Construct a risk matrix with rows and columns representing the types of safety hazards and the level of hazard severity. Calculate the probability of occurrence of each type of safety hazard and pair them with impact scores. Place risk items in corresponding cells to form a probability-impact coordinate distribution diagram.

[0112] The hazard level is graded using a multi-level scale, such as 1-5 points or three levels of high, medium and low.

[0113] Furthermore, the probability of occurrence is calculated as follows:

[0114] For short-term warnings, probability of occurrence = frequency of warning occurrence / given time window;

[0115] Among them, the frequency of warning occurrence is the number of warnings that occur within a given time window;

[0116] For the mid-term pattern, the probability of occurrence = the output probability distribution of the rule scoring model;

[0117] For long-term root causes, the probability of occurrence = 1-(1-historical occurrence rate)^(expected occurrence period).

[0118] The historical occurrence rate refers to the frequency of occurrence of this type of root cause obtained based on historical data statistics, and the expected occurrence period refers to the number of times the root cause is likely to occur in a future time period of interest.

[0119] The impact scores of different safety hazards are set based on historical data and experts.

[0120] According to the risk type, its probability of occurrence and the degree of impact, each risk item is placed in the corresponding cell of the matrix. The matrix visually displays the distribution of each risk in the probability-impact coordinate system.

[0121] Priority measures should be taken for risk projects in high-risk areas of the matrix. For example, for short-term risks, emergency plans should be formulated; for medium-term risks, risk model management should be improved; and for long-term risks, root causes of hidden dangers should be eliminated.

[0122] Update the matrix regularly to evaluate decision-making effectiveness and continuously optimize risk management strategies.

[0123] This embodiment also provides a safety assessment system based on data hazard source identification, including: a collection module, which is used to collect safety hazard sources, perform preprocessing, and build a unified safety hazard source data standard; a short-term warning module, which is used to monitor the data flow of key safety hazard sources in real time, trigger warnings in time when abnormalities are found, and realize short-term safety risk warnings; a medium-term risk pattern mining module, which is used to mine risk event patterns from historical hazard source data and output medium-term risk condition rules; a long-term risk root cause analysis module, which is used to analyze long-term risk root causes using association rules; a risk assessment and decision-making module, which is used to integrate the outputs of short-, medium- and long-term risk models, establish a risk matrix, and determine the probability of occurrence and impact of various risk sources.

[0124] This embodiment also provides a computer device, which is suitable for the case of a security assessment method based on data hazard source identification, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the security assessment method based on data hazard source identification as proposed in the above embodiment.

[0125] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0126] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements the safety assessment method based on data hazard source identification proposed in the above embodiment; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination of them, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, disk or optical disk.

[0127] In summary, the present invention outputs risk information at different time scales respectively, integrates these outputs, and maps them into a unified risk matrix model. The matrix intuitively displays the distribution of various risks in the probability-impact coordinate system, providing an objective basis for judging the risk level.

[0128] Example 2

[0129] Referring to Table 1, which is the second embodiment of the present invention, in order to further verify the beneficial effects of the present invention, experimental simulation of the safety assessment method based on data hazard source identification / comparison data with the prior art are provided.

[0130] In order to verify the effectiveness of the content of the present invention, the following experiments were carried out: First, a set of typical production process data was prepared, including multi-source heterogeneous data such as equipment operating status, environmental parameters, and personnel operation records.

[0131] Specifically, the equipment operation status data comes from the DCS control system, including time series data of 60 parameters such as temperature, pressure, flow, etc.; the environmental parameter data comes from the environmental monitoring site, including 10 parameters such as temperature, humidity, noise, radiation, etc.; the personnel operation data comes from the operation and maintenance log, which records the operator, operation time, operation content, etc. The data covers a period of nearly one year.

[0132] First, the raw data was cleaned and normalized, including filling missing values, removing duplicates, and removing outliers. At the same time, referring to the "Safety Hazard Source Data Standard" formulated by the present invention, all data were uniformly converted into a standardized format, and each parameter followed the agreed data type, unit, and encoding method.

[0133] In order to monitor anomalies in real time and trigger early warnings, online monitoring has been established for 31 key parameters such as equipment temperature and pressure, and multi-level early warning thresholds have been set. The early warning levels are divided into three levels: yellow warning, orange warning, and red warning. The level division is based on a comprehensive consideration of the degree of deviation between the parameter value and the threshold and the duration.

[0134] The specific warning logic is: Yellow warning trigger condition |X-threshold|>threshold offset and duration>5 minutes; Orange warning condition |X-threshold|>2threshold offset and duration>15 minutes; Red warning condition |X-threshold|>3threshold offset and duration>30 minutes.

[0135] In addition, a multi-parameter early warning condition model has been established to target the logical relationship between multiple parameters in local systems or process links. For example, for the "heating furnace" system, a red warning will only be triggered when both the "furnace temperature" and "furnace pressure" parameters exceed the threshold.

[0136] In order to explore the medium- and long-term risk patterns of safety accidents, historical safety accident cases and related monitoring data from the past five years were collected and organized.

[0137] After data preprocessing, the improved RESM model is used to conduct pattern mining on the event data, from which multiple safety risk event sequence rules are identified, such as "equipment overheating" → "pressure exceeding the standard" → "emergency stop" → "fire".

[0138] At the same time, the Apriori algorithm is also used to mine a series of association rules from the event data to reflect the root causes of long-term risks, such as "design process energy imbalance" → "equipment overload", "aging of key equipment" → "increased failure rate", etc.

[0139] For ease of demonstration, the following are some key data results during the implementation process:

[0140] Table 1 Safety risk monitoring and early warning data table

[0141]

[0142] It can be seen from Table 1 that for abnormal situations of a single monitoring parameter, the early warning system can reasonably divide the warning level and respond in time. For example, for temperature abnormality, an orange warning is triggered because it exceeds the threshold value and lasts for a long time. Although the deviation of environmental noise is large, it does not last for too long, so an orange warning is triggered.

[0143] This fully reflects the hierarchical management strategy of the early warning mechanism of the present invention for early warning levels in single-parameter and multi-parameter situations.

[0144] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A safety assessment method based on data hazard source identification, characterized in that: include: Collect safety hazard source data, perform pre-processing, and build a unified safety hazard source data standard; Monitor key data flows in real time and issue short-term security risk warnings; Mining risk event patterns from historical data and outputting mid-term risk condition rules; Use association rules to conduct long-term risk root cause analysis; Integrate the output of short-, medium- and long-term risk models to establish a risk matrix to determine the probability and impact of various risks; The short-term safety risk warning comprises the following steps: Identify the data monitoring objects of safety hazard sources and set abnormal thresholds for each monitoring object; Divide warnings into multiple levels, each corresponding to different degrees of harm and response measures; For a single monitoring object, when the real-time data exceeds the threshold, an alert of the corresponding level is triggered; For multiple monitoring objects, set judgment conditions to trigger an alert only when the combination of conditions is met; The setting of judgment conditions, triggering an alert only when the combination of conditions is met, includes: Draw a monitoring object association diagram based on the process flow, equipment layout and the relationship and influence mechanism between each monitoring object, and identify different coupling modes; Assign "AND" logic to parallel monitoring objects; assign "OR" logic to serial monitoring objects; The monitoring objects are graded according to their importance, and a hierarchical conditional tree structure is constructed. The abnormal conditions of the high-level monitoring objects are used as root nodes; the leaf nodes correspond to the actual monitoring objects, and the nodes at each layer are connected through logic gates, progressing from top to bottom. The corresponding high-level warning is triggered only when the conditional path is true; A time weight is set for the abnormality degree of a single monitored object, and the judgment formula for the abnormality degree is: Among them, T d is the duration of the deviation; V c is the current value of the monitored object; V t is the predetermined threshold; ω t is the time weight coefficient; The trend judgment formula for multiple monitoring objects is: Among them, ω d is the trend weight coefficient, n is the number of monitored objects; D i is the trend coefficient of the ith monitoring object; For different working conditions, set a combination of composite conditions, and trigger an early warning when any one of them is met.

2. The safety assessment method based on data hazard source identification according to claim 1 is characterized in that: The mining of risk event patterns from historical data includes: The risk event sequence model RESM is used to extract the time series data stream of safety hazards related to risk events from the historical time series data stream, and splice them into a complete risk event data set by time; Let S = {s1,s2,...,s m } is the risk event data set, where s i is an event sequence, let P be a set of prefix patterns, for each prefix pattern Expand and generate a new candidate pattern p'=pe, where e is an event in the event sequence and p' must satisfy the minimum support threshold σ; The event importance score based on entropy is as follows: Among them, P(e i ) is the event e i The probability of occurrence, m is the number of values ​​of the event in the risk event data set; Dimensionality reduction based on event importance scores; The prefix span projection clustering algorithm is improved, and the formula is as follows: Where support(p') is the support of pattern p'; σ is the minimum support threshold; τ is the importance score threshold; The output of the improved prefix span projection clustering algorithm is the frequent sequential patterns discovered from the dataset.

3. The safety assessment method based on data hazard source identification according to claim 2 is characterized in that: The output medium-term risk condition rules include: The extracted frequent sequence patterns are constructed into a sequence pattern tree, where the root node is an empty sequence, and the child nodes represent the newly added events based on the parent node. The nodes at the same level are encoded according to the order in which the events enter the tree to form a unique sequence pattern identifier; Perform statistical information measurement on the sequence pattern tree; Nodes with high risk and support exceeding the threshold are converted into IF-THEN risk rules, the condition part is the rule path encoding, and the conclusion is the conditional probability estimate of the risk occurrence.

4. The safety assessment method based on data hazard source identification according to claim 3 is characterized in that: The IF-THEN risk rules include: Let R be the rule path encoding, and the rule path encoding formula of the conditional part is: R={N1,N2,...,N j } Among them, N i represents the i-th node on the path; Under the support threshold condition, the formula of the IF-THEN risk rule is: IF R AND Support(R)≥σTHEN Risk=R(Risk|R) Among them, Support(R) is the support of path R, and Risk(R) is the estimated value of the conditional probability of risk occurrence of path R.

5. The safety assessment method based on data hazard source identification according to claim 4 is characterized in that: The risk matrix establishment includes: The rows and columns of the risk matrix respectively represent the types of safety hazards and the levels of hazard severity; Calculate the probability of occurrence of each type of safety hazard: For short-term warnings, probability of occurrence = frequency of warning occurrence / given time window; For the medium-term model, the probability of occurrence = Risk(R); For long-term root causes, probability of occurrence = 1-(1-historical occurrence rate)^(expected occurrence period); Place each risk item in the corresponding cell of the matrix according to the risk type, its probability of occurrence and impact.

6. A safety assessment system based on data hazard source identification, based on the safety assessment method based on data hazard source identification according to any one of claims 1 to 5, characterized in that: include: The collection module is used to collect safety hazards, perform preprocessing, and build a unified safety hazard data standard; Short-term warning module, which is used to monitor the data flow of key safety hazards in real time, trigger warnings in time when abnormalities are found, and realize short-term safety risk warnings; The medium-term risk pattern mining module is used to mine risk event patterns from historical data of hazardous sources and output medium-term risk condition rules; Long-term risk root cause analysis module, used to analyze the root causes of long-term risks using association rules; The risk assessment and decision-making module is used to integrate the outputs of short-, medium- and long-term risk models, establish a risk matrix, and determine the probability of occurrence and impact of various risk sources.

Images