An industrial internet device real-time monitoring method, device, equipment and medium

Abstract

The application discloses an industrial internet equipment real-time monitoring method, comprising: comparing the real-time data stream corresponding to the equipment point position identifier with the preset condition through the leaf node of the multi-layer rule tree, and generating an alarm event when the real-time data stream meets the preset condition; aggregating all alarm events in the leaf node grouping through the rule group node to generate an aggregated event; integrating the aggregated events of the rule group node through the root node to generate a trigger event; generating a three-dimensional topological feature vector based on the trigger event, inputting the three-dimensional topological feature vector into a pre-trained Bayesian network, and outputting a root cause event with a confidence from the Bayesian network; and performing a multi-modal response based on the confidence of the root cause event. The application realizes accurate identification and rapid response of equipment abnormal events, solves the misjudgment problem in a multi-device collaborative scene, and has the advantages of improving real-time response efficiency, enhancing fault positioning accuracy, and optimizing resource utilization.

Description

Technical Field

[0001] This invention relates to the field of industrial internet data monitoring technology, specifically to a method, device, equipment, and medium for real-time monitoring of industrial internet devices. Background Technology

[0002] In modern industry, Operational Technology (OT) data plays a crucial role. This type of data primarily originates from industrial control systems and various operational equipment, used for real-time monitoring and precise control of a company's physical facilities and production processes. Its data sources are broad, encompassing industrial components such as sensors, controllers, and programmable logic controllers (PLCs), and the collected information includes core elements such as equipment operating status, production progress, and surrounding environmental parameters. For intelligent manufacturing, equipment production data, as the foundational information for the entire manufacturing process, is irreplaceable. This data not only directly reflects the real-time status of production facilities but is also closely linked to product quality, production efficiency, and the optimization of the overall manufacturing process. Therefore, close monitoring of equipment production data and real-time monitoring of abnormal conditions have significant practical value for improving the level of intelligence and production efficiency in industrial manufacturing.

[0003] However, current technologies still face significant bottlenecks in monitoring equipment production data: rule configuration heavily relies on scripts or programming, requiring operators to possess professional coding skills, significantly increasing the barrier to entry and the risk of human error; alarm storms continue to worsen, with low-priority alarms overwhelming core fault events, leading to severe delays in maintenance response; real-time deficiencies are particularly prominent, with traditional centralized architectures introducing latency exceeding 500 milliseconds due to database polling mechanisms, failing to meet the millisecond-level response requirements of industrial control loops. Resource inefficiency is also significant, with full data subscription resulting in continuous waste of bandwidth and storage resources. More critically, in multi-device collaborative scenarios, the increased misjudgment rate of rule engines due to asynchronous data triggering leads to insufficient reliability of equipment linkage, directly impacting the stability of the production system. These problems severely restrict the practical application of industrial internet technology in critical production scenarios. Summary of the Invention

[0004] In view of the shortcomings of the prior art described above, the present invention provides a method, apparatus, device and medium for real-time monitoring of industrial Internet devices, which is used to solve at least one defect in the prior art.

[0005] This invention provides a method for real-time monitoring of industrial internet devices, comprising: Collect real-time data streams from industrial equipment; Load a multi-level rule tree; wherein the multi-level rule tree includes leaf nodes, rule group nodes and root nodes, the leaf nodes are configured to bind the equipment location identifiers and preset conditions of industrial equipment, the rule group nodes are configured to combine the leaf nodes through logical operations to obtain leaf point groups, and the root node is configured to integrate the aggregate events of the rule group nodes to generate trigger events. The leaf nodes compare the real-time data stream corresponding to the device location identifier with the preset conditions, and generate an alarm event when the real-time data stream meets the preset conditions; the rule group nodes aggregate all alarm events in the leaf node group to generate an aggregated event; the root node integrates the aggregated events of the rule group nodes to generate a trigger event. A three-dimensional topological feature vector is generated for each trigger event within a preset configurable time window based on the trigger event, and the three-dimensional topological feature vector is input into a pre-trained Bayesian network, which outputs the root cause event with confidence. Multimodal response is performed based on the confidence level of the root cause event.

[0006] In one embodiment of the present invention, the multi-layer rule tree is parsed to obtain the device location identifiers bound to the leaf nodes; Based on a subscription approach, the real-time data stream corresponding to the device location identifier bound to the leaf node is obtained; wherein, each referenced device location identifier maintains a global reference counter; when the value of the global reference counter reaches zero, the subscription to the real-time data stream of the corresponding device location identifier is canceled.

[0007] In one embodiment of the present invention, when a new reference to a device location identifier is added to the multi-layer rule tree, the value of the global reference counter corresponding to the device location identifier is increased by 1; When a reference to a device location identifier is deleted from the multi-level rule tree, the value of the global reference counter corresponding to the device location identifier is reduced by 1.

[0008] In one embodiment of the present invention, the method further includes: The leaf nodes in the multi-layer rule tree are distributed and run on the edge gateway. The edge gateway compares the real-time data corresponding to the device location identifier with the preset conditions, and generates an alarm event when the real-time data stream meets the preset conditions. The rule group nodes in the multi-layer rule tree are deployed on a cloud server. The cloud server receives alarm events reported by one or more edge gateways through an asynchronous message pipeline. The cloud server aggregates the received alarm events to generate aggregate events.

[0009] In one embodiment of the present invention, the multimodal response based on the confidence level of the root cause event includes: The confidence level of the root cause event is compared with a preset confidence threshold; When a root cause event has a confidence level higher than a preset confidence threshold, a control command is generated to control the device controller based on the control command. When a root cause event has a confidence level lower than the preset confidence threshold, an alarm message is generated.

[0010] In one embodiment of the present invention, before controlling the device controller based on the control command, the method further includes: The control commands are subjected to conflict detection using a three-level state machine, and a circuit breaker mechanism is triggered when a conflict is detected; wherein, the conflict detection includes at least one of the following: Verify the current operating mode and safety constraints of the equipment; Verify the mutual exclusion relationship between instructions based on the instruction mutual exclusion matrix; Instructions of the same priority are processed according to the first-in, first-out (FIFO) principle.

[0011] In one embodiment of the present invention, the rule group node integrates device spatial topology relationships and cross-device timing calibration mechanisms. The device spatial topology is implemented through a predefined device logical distance matrix. When the rule group node receives an alarm event generated by a device, it automatically adds the preset protection instruction to the execution instruction queue of the associated devices that have a logical proximity relationship with the alarm device corresponding to the alarm event, according to the device logical distance matrix. The cross-device timing calibration mechanism is implemented based on event sequence numbers and dynamic delay windows. The size of the dynamic delay window is dynamically determined by the following formula: size of dynamic delay window = baseline delay × (1 + topology depth coefficient), where the topology depth coefficient is a positive integer.

[0012] In one embodiment of the present invention, the Bayesian network training process includes: Extract the causal relationships between device-triggered events from historical operation and maintenance logs, and construct a directed acyclic graph structure of a Bayesian network based on the causal relationships; The conditional probability of each node in the Bayesian network is calculated using the maximum likelihood estimation method. When performing posterior probabilistic inference, the topology weight coefficient α determined by the device topology relationship is fused, where the formula for calculating α is: α=1 / (1+e^(-β×link hop count)), and β is a preset adjustment parameter.

[0013] This invention provides a real-time monitoring device for industrial internet equipment, comprising: The data acquisition module is used to collect real-time data streams from industrial equipment. A loading module is used to load a multi-level rule tree; wherein the multi-level rule tree includes leaf nodes, rule group nodes and a root node, the leaf nodes are configured to bind the equipment location identifiers and preset conditions of industrial equipment, the rule group nodes are configured to combine the leaf nodes through logical operations to obtain leaf point groups, and the root node is configured to integrate the aggregate events of the rule group nodes to generate trigger events. The event generation module is used to compare the real-time data stream corresponding to the device location identifier with the preset conditions through the leaf nodes, and generate an alarm event when the real-time data stream meets the preset conditions; to aggregate all alarm events in the leaf node group through the rule group node to generate an aggregated event; and to integrate the aggregated events of the rule group node through the root node to generate a trigger event. The root cause event generation module is used to generate a three-dimensional topological feature vector for each trigger event within a preset configurable time window based on the trigger event, and input the three-dimensional topological feature vector into a pre-trained Bayesian network, and output the root cause event with confidence from the Bayesian network. The response execution module is used to perform a multimodal response based on the confidence level of the root cause event.

[0014] This invention provides a real-time monitoring device for industrial internet equipment, comprising: One or more processors; A memory is provided for storing one or more programs, which, when executed by one or more processors, enable the processors to implement the real-time monitoring method for industrial internet devices.

[0015] The present invention provides a machine-readable medium storing instructions that, when executed by one or more processors, cause the processors to perform the aforementioned industrial internet device real-time monitoring method.

[0016] The beneficial effects of this invention are: This invention provides a real-time monitoring method for industrial internet devices, comprising: collecting real-time data streams from industrial devices; loading a multi-layer rule tree; wherein the multi-layer rule tree includes leaf nodes, rule group nodes, and a root node; the leaf nodes are configured to bind device location identifiers and preset conditions of the industrial devices; the rule group nodes are configured to combine the leaf nodes through logical operations to obtain leaf point groups; and the root node is configured to integrate the aggregated events of the rule group nodes to generate trigger events; comparing the real-time data streams corresponding to the device location identifiers with the preset conditions through the leaf nodes, and generating alarm events when the real-time data streams meet the preset conditions; aggregating all alarm events in their respective node groups through the rule group nodes to generate aggregated events; integrating the aggregated events of the rule group nodes through the root node to generate trigger events; generating a three-dimensional topological feature vector for each trigger event within a preset configurable time window based on the trigger events, and inputting the three-dimensional topological feature vectors into a pre-trained Bayesian network, which outputs root cause events with confidence scores; and performing multimodal responses based on the confidence scores of the root cause events. This invention enables accurate identification and rapid response to abnormal equipment events, solves the problem of misjudgment in multi-device collaborative scenarios, and has the advantages of improving real-time response efficiency, enhancing fault location accuracy, and optimizing resource utilization. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention. It is obvious that the drawings described below are merely some embodiments of the invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0018] In the attached diagram: Figure 1 This is a flowchart of a real-time monitoring method for industrial internet devices according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a multi-layered rule tree constructed according to an embodiment of the present invention; Figure 3 This is a schematic diagram of a time window compression mechanism according to an embodiment of the present invention; Figure 4 This is a flowchart of the Bayesian network training process according to an embodiment of the present invention; Figure 5 This is a schematic diagram of Bayesian network root cause analysis according to an embodiment of the present invention; Figure 6 This is a Bayesian network root cause analysis diagram according to an embodiment of the present invention; Figure 7This is a schematic diagram of a real-time monitoring device for industrial internet equipment according to an embodiment of the present invention; Figure 8 A schematic diagram of a computer system suitable for implementing an embodiment of the present invention is shown. Detailed Implementation

[0019] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments. Various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0020] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. The accompanying drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the shape, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0021] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0022] Please see Figure 1 , Figure 1 This is a flowchart illustrating a real-time monitoring method for industrial internet devices, as shown in an exemplary embodiment of this application. Figure 1 In China, real-time monitoring methods for industrial internet devices include: Step S110: Collect real-time data streams from industrial equipment; Step S120: Load a multi-level rule tree; wherein the multi-level rule tree includes leaf nodes, rule group nodes and a root node, the leaf nodes are configured to bind the equipment location identifiers and preset conditions of industrial equipment, the rule group nodes are configured to combine the leaf nodes through logical operations to obtain leaf point groups, and the root node is configured to integrate the aggregate events of the rule group nodes to generate trigger events. Figure 2 This is a multi-level rule tree for construction. Logical operations include: AND, OR, and NOT.

[0023] It should be noted that multi-level rule trees can be constructed using a visual rule tree building block. This visual rule tree building block supports drag-and-drop configuration of topology relationships and conflict simulation. It also provides real-time detection and high-level hints for circular dependencies, a logic conflict sandbox testing environment, and a topology update response simulator.

[0024] Step S130: The real-time data stream corresponding to the device location identifier is compared with the preset conditions through the leaf node, and an alarm event is generated when the real-time data stream meets the preset conditions; all alarm events in the leaf node group are aggregated through the rule group node to generate an aggregated event; the aggregated events of the rule group node are integrated through the root node to generate a trigger event. Among them, the preset conditions refer to the alarm triggering conditions that are dynamically adjusted according to the device's operating status and can be adaptively calculated based on historical data. The preset conditions can be modified through a visual interface, and the modified preset conditions are synchronized to the edge gateway memory in real time through the message bus. If the synchronization fails, a degradation alarm is triggered and a security log is recorded. At the same time, the average value of the past 24 hours is used as a temporary threshold.

[0025] Equipment location identifiers are unique codes for industrial equipment, and can be a combination string of equipment number and data type.

[0026] It should be noted that during the generation of alarm events, the alarm is triggered only when the real-time data meets the threshold condition within N consecutive sampling periods, where N≥2 and is configurable.

[0027] In industrial equipment monitoring scenarios, each leaf node is bound to a specific device location identifier and preset conditions. When one or more data points meet the corresponding preset conditions, the leaf node generates a basic alarm event. Rule group nodes aggregate the alarm events output by the leaf nodes, for example, combining abnormal data from multiple vibration sensors on the same production line into a fault event. The root node integrates the aggregation results from multiple rule group nodes and generates a trigger event when preset conditions are met.

[0028] Step S140: Generate a three-dimensional topological feature vector for each trigger event within a preset configurable time window based on the trigger event, and input the three-dimensional topological feature vector into a pre-trained Bayesian network, and have the Bayesian network output the root cause event with confidence. The 3D topology feature vector includes [event type code, logical topology distance value, and calibrated timing value]. The event type code is a digital label used to classify and identify triggering events. The logical topology distance value is a numerical value that quantifies the degree of logical topological correlation between two devices involved in an alarm event (usually a faulty device and an affected device). The calibrated timing value is a timestamp correction value that accurately reflects the true causal timing relationship between events after being processed by a timing calibration mechanism. It should be noted that the 3D topology feature vector uses a hybrid encoding method, where the event type code is represented by a 2-byte integer, the logical topology distance value is represented by a 4-byte floating-point number, and the calibrated timing value is represented by a 4-byte floating-point number, with a fixed total length of 10 bytes.

[0029] The Bayesian network is trained using historical operation and maintenance data.

[0030] It should be noted that the time window configuration supports two modes: event counting and duration, both of which are set through the web interface. The event counting mode settings interface provides unit time options, including hours, minutes, and seconds; the duration mode settings interface provides time unit options, including hours, minutes, and seconds.

[0031] It should be noted that the real-time data stream needs to be compressed before being input into the Bayesian network. The time window compression mechanism is as follows: Figure 3 As shown.

[0032] Step S150: Perform a multimodal response based on the confidence level of the root cause event.

[0033] This invention enables accurate identification and rapid response to abnormal equipment events, solving the problem of misjudgment in multi-device collaborative scenarios. It has the advantages of improving real-time response efficiency, enhancing fault location accuracy, and optimizing resource utilization. Furthermore, because this invention achieves hierarchical event processing through a multi-layered rule tree, leaf nodes perform basic threshold judgments, rule group nodes realize cross-device alarm association, and the root node completes global event triggering decisions, the complexity of rule configuration is significantly reduced.

[0034] In one embodiment, the method for obtaining real-time data streams using a multi-layer rule tree includes: parsing the multi-layer rule tree to obtain device location identifiers bound to leaf nodes; obtaining the real-time data streams corresponding to the device location identifiers bound to the leaf nodes based on a subscription method; wherein each referenced device location identifier maintains a global reference counter; when the value of the global reference counter reaches zero, the subscription to the real-time data stream of the corresponding device location identifier is canceled. Specifically, when a new reference to a device location identifier is added to the multi-layer rule tree, the value of the global reference counter corresponding to the device location identifier is incremented by 1; when a reference to a device location identifier is deleted from the multi-layer rule tree, the value of the global reference counter corresponding to the device location identifier is decremented by 1.

[0035] It should be noted that the global reference counter is used to record the number of times the device location identifier is referenced by multiple nodes in the rule tree.

[0036] Specifically, when constructing a multi-layered rule tree, the device identifier bound to each leaf node is parsed into a specific data subscription request. When a new reference to a device is added to the multi-layered rule tree, the global reference counter for that device is incremented by 1. If the global reference counter changes from 0 to 1, a subscription to the real-time data stream is automatically established. Conversely, when a reference to a device is deleted from the multi-layered rule tree, the global reference counter is decremented by 1. If the global reference counter returns to 0, the subscription is automatically canceled. For example, when a temperature sensor is referenced by 3 leaf nodes, its global reference counter is 3. When 2 of the leaf nodes are deleted, the counter drops to 1, and the subscription status is maintained. When the last referencing node is deleted, the counter returns to 0, triggering a cancellation operation.

[0037] In one embodiment, the method further includes: The leaf nodes in the multi-layer rule tree are distributed and run on the edge gateway. The edge gateway compares the real-time data corresponding to the device location identifier with the preset conditions, and generates an alarm event when the real-time data stream meets the preset conditions. The rule group nodes in the multi-layer rule tree are deployed on a cloud server. The cloud server receives alarm events reported by one or more edge gateways through an asynchronous message pipeline. The cloud server aggregates the received alarm events to generate aggregate events.

[0038] It should be noted that the edge gateway integrates a time-series synchronization engine with the cloud server. The edge gateway employs memory optimization strategies, including: storing leaf node data in a compact binary format, and verifying the integrity of feature vectors before discarding non-critical fields.

[0039] Specifically, the edge gateway is configured to load and execute the logic of the leaf nodes in a multi-layered rule tree, collect device location data in real time, compare it with a dynamic threshold, and generate an alarm event when the real-time data exceeds the dynamic threshold. The cloud server continuously listens to the message pipeline. When it receives alarm events from different edge gateways, it aggregates the events according to the logical relationships defined by the rule group nodes, generates an aggregated event, and triggers subsequent processing procedures.

[0040] In one embodiment, the multimodal response based on the confidence level of the root cause event includes: comparing the confidence level of the root cause event with a preset confidence threshold; generating a control command for a root cause event with a confidence level higher than the preset confidence threshold, and controlling the device controller based on the control command; and generating an alarm message for a root cause event with a confidence level lower than the preset confidence threshold.

[0041] In one embodiment, before controlling the device controller based on the control command, the method further includes: The control commands are subjected to conflict detection using a three-level state machine, and a circuit breaker mechanism is triggered when a conflict is detected; wherein, the conflict detection includes at least one of the following: Verify the current operating mode and safety constraints of the equipment; Verify the mutual exclusion relationship between instructions based on the instruction mutual exclusion matrix; Instructions of the same priority are processed according to the first-in, first-out (FIFO) principle.

[0042] Among them, verifying the current operating mode of the equipment refers to checking which mode the equipment is currently in; verifying the security constraints means checking whether the basic security conditions of the equipment are met; and the instruction mutual exclusion matrix refers to the mapping table describing the logical exclusion relationship between different control instructions.

[0043] It should be noted that the circuit breaker mechanism is triggered when a risk of conflict in control commands is detected, which automatically terminates the command issuance process as a protective measure.

[0044] Specifically, after the system generates a control command, it reads the real-time data fed back by the device and checks the device's current operating mode based on the real-time data to determine the current operating mode. It then retrieves the command mutual exclusion matrix to verify the logical compatibility of the current command with other commands and determine if a mutual exclusion relationship exists between them. For command pairs with mutual exclusion relationships, a conflict state is marked. After completing the mutual exclusion detection, commands of the same priority are executed in order of their received timestamps to ensure timing consistency. When an irreconcilable conflict is detected at any level, the circuit breaker mechanism immediately terminates the current command processing flow and sends an exception event log to the monitoring system.

[0045] In one embodiment, the rule group node integrates device spatial topology relationships and cross-device timing calibration mechanisms. The device spatial topology relationships are implemented through a predefined device logical distance matrix. When the rule group node receives an alarm event generated by a device, it automatically adds a preset protection instruction to the pending instruction queue of the associated device that has a logical proximity relationship with the alarm device corresponding to the alarm event, according to the device logical distance matrix. The cross-device timing calibration mechanism is implemented based on the event sequence number and a dynamic delay window. The size of the dynamic delay window is dynamically determined by the following formula: Size of dynamic delay window = Base delay × (1 + Topology depth coefficient), where the topology depth coefficient is a positive integer.

[0046] Among them, the dynamic delay window refers to the time window that is dynamically adjusted according to the device topology depth; the event sequence number is a number used to mark the causal order of events across devices.

[0047] The specific method of the cross-device timing calibration mechanism is as follows: First, a strictly incremental event sequence number (with a synchronization timestamp added to the edge gateway) is established for each device event as a logical timing benchmark. Simultaneously, a topology depth coefficient is calculated based on predefined device topology relationships. Then, combined with a benchmark latency value (pre-set data), the calibration window is dynamically determined according to the formula "window size = benchmark latency × (1 + topology depth coefficient)". The specific workflow is as follows: When the rule engine needs to evaluate a cross-device rule such as "device A shutdown AND device B overheating", assuming the overheating event of device B is received first, the system uses the sequence number of that overheating event as a benchmark, backtracks to calculate the dynamically obtained window (for example, when devices A and B are directly connected and the benchmark latency is 500ms, the window size is 500ms), and searches for the shutdown event of device A within this window. Only when a matching event is found is the rule determined to be valid. This complete process, through configurable parameters and a deterministic algorithm, ensures that rule judgment is based on real physical causal relationships rather than unreliable data arrival order, solving the problem of rule misjudgment caused by asynchronous data transmission.

[0048] Specifically, when a device triggers an alarm event, a pre-defined device logical distance matrix is ​​queried to identify associated devices with logical proximity to that device. For example, in a production line, if a robotic arm triggers an overload alarm, a speed reduction command is sent to the adjacent conveyor belt device based on the coupling relationships stored in the device logical distance matrix. Simultaneously, the system assigns consecutive sequence numbers to cross-device events; for example, if the robotic arm failure event is numbered N, the associated conveyor belt anomaly event should be numbered N+1. The process delay window is dynamically adjusted based on the device's hierarchical depth in the device space topology. For example, for a device group at a level three topology depth, its delay window can be extended to four times the baseline delay.

[0049] It should be noted that when the reference delay is unavailable, the default delay value provided by the equipment manufacturer is used, and the automatic calibration process is started after 24 hours of operation.

[0050] Please see Figure 4 , Figure 4 This is a flowchart illustrating the Bayesian network training process according to an embodiment of the present invention. Figure 4 The Bayesian network training process includes: Step S410: Extract the causal relationships between device-triggered events from historical operation and maintenance logs, and construct a directed acyclic graph structure of a Bayesian network based on the causal relationships; Step S420: The conditional probability of each node in the Bayesian network is calculated using the maximum likelihood estimation method. In step S430, when performing posterior probability inference, the topology weight coefficient α determined by the device topology relationship is fused, where the calculation formula of α is: α=1 / (1+e^(-β×link hop count)), and β is a preset adjustment parameter.

[0051] The topological weight coefficient α refers to the weighting parameter used to correct the probability of causal events.

[0052] in, Figure 5 This diagram illustrates the root cause analysis using Bayesian networks, revealing the fusion mechanism between feature vector input and posterior probability. Figure 6 It is a Bayesian network root cause analysis diagram. Through Bayesian networks, the system reverse-engineers the root cause from the surface fault scene and provides accurate handling suggestions.

[0053] Specifically, when constructing the Bayesian network, relationship analysis is performed on historical event data to establish causal relationships. Then, maximum likelihood estimation is used to estimate the historical probability of combinations of statistical events. During fault reasoning, topological weights are calculated based on the hop counts between the faulty device and related devices in the logical distance matrix, and the base probabilities are corrected using an exponential function. For newly connected devices, analysis is initiated through a pre-defined fault causal chain. This pre-defined fault causal chain is generated based on a device type template library. During the first week of operation, A / B testing is used to gradually switch to the real-time model, with the initial value of β set to 0.5.

[0054] In one embodiment, a data access module is configured to receive real-time data streams from industrial equipment. The data access module supports dynamic scaling based on load; it also includes a zero-copy parsing engine for directly mapping raw data to system memory. The data access module receives high-concurrency device data streams through a lock-free circular buffer, employing a two-pointer atomic operation (the duration of the historical data retention window during scaling is max(200ms, current time window value × 1.2)).

[0055] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0056] Please see Figure 7 , Figure 7 This is a schematic diagram of a real-time monitoring device for industrial internet equipment according to an embodiment of the present invention. Figure 7 In China, the real-time monitoring device for industrial internet equipment includes: Data acquisition module 710 is used to acquire real-time data streams from industrial equipment; The loading module 720 is used to load a multi-level rule tree; wherein the multi-level rule tree includes leaf nodes, rule group nodes and root nodes, the leaf nodes are configured to bind the equipment location identifiers and preset conditions of industrial equipment, the rule group nodes are configured to combine the leaf nodes through logical operations to obtain leaf point groups, and the root node is configured to integrate the aggregation events of the rule group nodes to generate trigger events. The trigger event generation module 730 is used to compare the real-time data stream corresponding to the device location identifier with the preset conditions through the leaf node, and generate an alarm event when the real-time data stream meets the preset conditions; to aggregate all alarm events in the leaf node group through the rule group node to generate an aggregated event; and to integrate the aggregated events of the rule group node through the root node to generate a trigger event. The root cause event generation module 740 is used to generate a three-dimensional topological feature vector based on each trigger event within a preset configurable time window, and input the three-dimensional topological feature vector into a pre-trained Bayesian network, from which the Bayesian network outputs a root cause event with confidence. The response execution module 750 is used to perform a multimodal response based on the confidence level of the root cause event.

[0057] It should be noted that the industrial internet device real-time monitoring device and the industrial internet device real-time monitoring method provided in the above embodiments belong to the same concept. The specific ways in which each module and unit performs operations have been described in detail in the method embodiments, and will not be repeated here. In practical applications, the industrial internet device real-time monitoring device provided in the above embodiments can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above, and this is not a limitation here.

[0058] Embodiments of the present invention also provide an industrial internet device real-time monitoring device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by one or more processors, the memory enables the industrial internet device real-time monitoring method described in the above embodiments.

[0059] Embodiments of the present invention also provide one or more machine-readable media having instructions stored thereon that, when executed by one or more processors, cause the processors to perform the industrial internet device real-time monitoring method described in the above embodiments.

[0060] Figure 8 A schematic diagram of a computer system suitable for implementing an embodiment of the present invention is shown. It should be noted that... Figure 8 The computer system with the memory shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present invention.

[0061] like Figure 8 As shown, the computer system 800 includes a Central Processing Unit (CPU) 801, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on a program stored in Read-Only Memory (ROM) 802 or a program loaded from storage into Random Access Memory (RAM) 803. The RAM also stores various programs and data required for system operation. The CPU 801, ROM 802, and RAM 803 are interconnected via a bus 804. An Input / Output (I / O) interface 805 is also connected to the bus 804.

[0062] The following components are connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 810 as needed so that computer programs read from it can be installed into storage section 808 as needed.

[0063] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing a computer program for performing the aforementioned industrial internet device real-time monitoring method. In such embodiments, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium 811. When the computer program is executed by the central processing unit (CPU) 801, it performs various functions defined in the system of the present invention.

[0064] It should be noted that the computer-readable medium shown in the embodiments of the present invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM) 803, read-only memory (ROM) 802, erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0065] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, program segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block or combination of blocks in a block diagram or flowchart may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0066] The units described in the embodiments of the present invention can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0067] Another aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a computer's processor, causes the computer to perform the aforementioned industrial internet device real-time monitoring method. This computer-readable storage medium may be included in the memory described in the above embodiments, or it may exist independently and not incorporated into that memory.

[0068] Another aspect of the present invention provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the industrial internet device real-time monitoring method provided in the various embodiments described above.

[0069] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. An industrial internet device real-time monitoring method, characterized in that, include: Collect real-time data streams from industrial equipment; Load a multi-level rule tree; wherein the multi-level rule tree includes leaf nodes, rule group nodes and root nodes, the leaf nodes are configured to bind the equipment location identifiers and preset conditions of industrial equipment, the rule group nodes are configured to combine the leaf nodes through logical operations to obtain leaf point groups, and the root node is configured to integrate the aggregate events of the rule group nodes to generate trigger events. The leaf nodes compare the real-time data stream corresponding to the device location identifier with the preset conditions, and generate an alarm event when the real-time data stream meets the preset conditions; the rule group nodes aggregate all alarm events in the leaf node group to generate an aggregated event; the root node integrates the aggregated events of the rule group nodes to generate a trigger event. Based on the triggering event, a three-dimensional topological feature vector is generated for each triggering event within a preset configurable time window. This three-dimensional topological feature vector is then input into a pre-trained Bayesian network, which outputs a root cause event with confidence. The three-dimensional topological feature vector includes [event type code, logical topological distance value, and calibrated time series value]. The event type code is a numerical label used to classify and identify triggering events. The logical topological distance value is a numerical value that quantifies the degree of logical topological correlation between two devices involved in an alarm event. The calibrated time series value is a timestamp correction value that, after processing by a time series calibration mechanism, represents the true causal time series relationship between events. Multimodal response is performed based on the confidence level of the root cause event.

2. The method for real-time monitoring of industrial internet devices according to claim 1, characterized in that, Parse the multi-layer rule tree to obtain the device location identifiers bound to the leaf nodes; Based on a subscription approach, the real-time data stream corresponding to the device location identifier bound to the leaf node is obtained; wherein, each referenced device location identifier maintains a global reference counter; when the value of the global reference counter reaches zero, the subscription to the real-time data stream of the corresponding device location identifier is canceled.

3. The method for real-time monitoring of industrial internet devices according to claim 2, characterized in that, When a new reference to a device location identifier is added to the multi-layer rule tree, the value of the global reference counter corresponding to the device location identifier is increased by 1; When a reference to a device location identifier is deleted from the multi-level rule tree, the value of the global reference counter corresponding to the device location identifier is reduced by 1.

4. The industrial internet device real-time monitoring method of claim 1, wherein, The method further includes: The leaf nodes in the multi-layer rule tree are distributed and run on the edge gateway. The edge gateway compares the real-time data corresponding to the device location identifier with the preset conditions, and generates an alarm event when the real-time data stream meets the preset conditions. The rule group nodes in the multi-layer rule tree are deployed on a cloud server. The cloud server receives alarm events reported by one or more edge gateways through an asynchronous message pipeline. The cloud server aggregates the received alarm events to generate aggregate events.

5. The industrial internet device real-time monitoring method of claim 1, wherein, The multimodal response based on the confidence level of the root cause event includes: The confidence level of the root cause event is compared with a preset confidence threshold; When a root cause event has a confidence level higher than a preset confidence threshold, a control command is generated to control the device controller based on the control command. When a root cause event has a confidence level lower than the preset confidence threshold, an alarm message is generated.

6. The industrial internet device real-time monitoring method of claim 5, wherein, Before controlling the device controller based on the control command, the method further includes: The control commands are subjected to conflict detection using a three-level state machine, and a circuit breaker mechanism is triggered when a conflict is detected; wherein, the conflict detection includes at least one of the following: Verify the current operating mode and safety constraints of the equipment; Verify the mutual exclusion relationship between instructions based on the instruction mutual exclusion matrix; Instructions of the same priority are processed according to the first-in, first-out (FIFO) principle.

7. The method for real-time monitoring of industrial internet devices according to claim 1, characterized in that, The rule group nodes integrate device spatial topology relationships and cross-device timing calibration mechanisms. The device spatial topology is implemented through a predefined device logical distance matrix. When the rule group node receives an alarm event generated by a device, it automatically adds the preset protection instruction to the execution instruction queue of the associated devices that have a logical proximity relationship with the alarm device corresponding to the alarm event, according to the device logical distance matrix. The cross-device timing calibration mechanism is implemented based on event sequence numbers and dynamic delay windows. The size of the dynamic delay window is dynamically determined by the following formula: size of dynamic delay window = baseline delay × (1 + topology depth coefficient), where the topology depth coefficient is a positive integer.

8. The method for real-time monitoring of industrial internet devices according to claim 1, characterized in that, The Bayesian network training process includes: Extract the causal relationships between device-triggered events from historical operation and maintenance logs, and construct a directed acyclic graph structure of a Bayesian network based on the causal relationships; The conditional probability of each node in the Bayesian network is calculated using the maximum likelihood estimation method. When performing posterior probabilistic inference, the topology weight coefficient α determined by the device topology relationship is fused, where the formula for calculating α is: α=1 / (1+e^(-β×link hop count)), and β is a preset adjustment parameter.

9. A real-time monitoring device for industrial internet equipment, characterized in that, include: The data acquisition module is used to collect real-time data streams from industrial equipment. A loading module is used to load a multi-level rule tree; wherein the multi-level rule tree includes leaf nodes, rule group nodes and a root node, the leaf nodes are configured to bind the equipment location identifiers and preset conditions of industrial equipment, the rule group nodes are configured to combine the leaf nodes through logical operations to obtain leaf point groups, and the root node is configured to integrate the aggregate events of the rule group nodes to generate trigger events. The trigger event generation module is used to compare the real-time data stream corresponding to the device location identifier with the preset conditions through the leaf node, and generate an alarm event when the real-time data stream meets the preset conditions; to aggregate all alarm events in the leaf node group through the rule group node to generate an aggregated event; and to integrate the aggregated events of the rule group node through the root node to generate a trigger event. The root cause event generation module is used to generate a three-dimensional topological feature vector for each trigger event within a preset configurable time window based on the trigger event, and input the three-dimensional topological feature vector into a pre-trained Bayesian network, which outputs the root cause event with confidence. The three-dimensional topological feature vector includes [event type code, logical topological distance value, and calibrated time series value]. The event type code is a digital label used to classify and identify trigger events; the logical topological distance value is a numerical value that quantifies the degree of logical topological correlation between two devices involved in an alarm event; and the calibrated time series value is a timestamp correction value that represents the true causal time series relationship between events after processing by a time series calibration mechanism. The response execution module is used to perform a multimodal response based on the confidence level of the root cause event.

10. A machine-readable medium, characterized in that, It stores instructions that, when executed by one or more processors, cause the processors to perform the industrial internet device real-time monitoring method according to any one of claims 1-8.

Images