Wisdom park operation monitoring abnormity alarm method based on digital twinning

Abstract

The invention discloses a smart park operation monitoring abnormity alarm method based on digital twinning, and the method comprises the steps: constructing a unified twinning object mapping table through introducing three-layer mapping modeling of a space twinning body, an equipment twinning body and a business process twinning body, and enabling the table to be used for driving the state updating and data synchronization between the twinning bodies; the method comprises the following steps: acquiring multi-source operation monitoring data of park Internet of Things equipment, a sensor and a service system, and executing preprocessing to form a structured real-time data set; the method comprises the following steps: associating real-time data with a twinborn mapping table, generating a real-time feature sequence bound with a twinborn body, inputting an abnormality diagnosis model based on Copula modeling, obtaining an abnormality score at a current moment, executing sliding aggregation on the scores at multiple moments, obtaining an aggregation score of hierarchical alarm, and finally, binding with three grades of threshold values to trigger multi-level linkage control. The technical problems in modeling integrity, data expression ability and response mechanism refinement in the prior art are solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of smart park operation monitoring and intelligent alarm, and particularly relates to a smart park operation monitoring abnormal alarm method based on digital twinning. BACKGROUND

[0002] With the wide promotion of digital twinning technology in the field of new smart city, park operation and maintenance and intelligent control, its advantages in space modeling, device digital mirroring, business simulation and real-time monitoring are increasingly prominent. In the smart park scene, by integrating BIM / GIS modeling technology, Internet of Things devices, video sensing systems and business information systems, real-time mapping of physical and digital spaces can be realized, thereby supporting dynamic perception and visualized control of multiple factors such as park space layout, device operation status, security and energy consumption. The current common park digital twinning system is mostly based on a three-dimensional visualization platform, combined with data streams collected by the Internet of Things, and performs modeling, linkage, early warning and control in a unified data platform, which preliminarily has a system framework of "twinning + perception + operation and maintenance". However, the existing smart park operation monitoring scheme still has significant deficiencies in abnormal detection and linkage disposal capabilities, mainly in the following aspects: first, the twinning model organizational structure is mostly "space + device" double mapping, lacking integrated modeling support for business process scenes, resulting in separation of space behavior and business logic, and inability to realize cross-dimension fault tracing; second, multi-source monitoring data lack structured coding and time sequence consistency, which cannot efficiently drive real-time linkage update of the twinning model; third, the existing abnormal detection mostly uses methods based on fixed thresholds or simple statistical indicators, which are difficult to capture complex dependency structures among multi-dimensional data; fourth, the current alarm linkage mechanism lacks multi-level evaluation and differentiated response strategies, and lacks a closed-loop control chain from score determination to linkage disposal.

[0003] CN113793234A discloses a smart park platform based on digital twinning technology. The system realizes three-dimensional situational awareness and operation and maintenance response capability of park equipment through park BIM modeling, device information integration and sensor data fusion, and has strong space model organization and visualized operation and maintenance capability. However, this scheme does not introduce "business process twin" as a model element, lacks mapping modeling of business behavior and scene procedures, and cannot realize integrated twinning linkage of "space-device-business". Moreover, it does not form a unified twinning object mapping table structure, relies on platform logic hard coding for data driving path, does not have flexible data correlation and state synchronization mechanism, and does not involve complex dependency modeling and multi-level determination alarm strategies.

[0004] CN113110221A discloses a comprehensive intelligent monitoring method and system for pipe gallery system, which realizes relatively complete "abnormal-response" chain through GIS+BIM modeling technology to visually monitor the equipment state in the pipe gallery, and triggers the pre-plan control module when an abnormal event occurs; however, this method only focuses on single equipment monitoring in linear space scene, and does not consider unified management of multiple types of twin body structures under complex structure of the park, and the abnormal detection process does not disclose using Copula modeling method to process multi-dimensional correlation problem, lacking modeling means for complex time sequence data structure; at the same time, the alarm response strategy is mainly driven by fixed rules, lacking of differentiated linkage action binding for different levels.

[0005] Therefore, the existing smart park digital twin monitoring technology has the problems of incomplete model dimension, loose data driving link, weak abnormal identification capability and coarse response mechanism; the present application provides a smart park operation monitoring abnormal alarm method based on digital twin, which introduces three-layer mapping modeling of spatial twin body, equipment twin body and business process twin body to solve the above problems, constructs a unified twin object mapping table to drive state update and data synchronization between twin bodies; by collecting multi-source operation monitoring data of park Internet of Things devices, sensors and business systems, pre-processing is performed to form a structured real-time data set; the real-time data is associated with the twin mapping table to generate real-time feature sequences bound to the twin bodies, which are input into the abnormal diagnosis model based on Copula modeling to obtain the abnormal score at the current time, and the sliding aggregation of multi-time scores is performed to obtain the aggregated score of hierarchical alarm, which is finally bound to trigger multi-level linkage control with three threshold values, solving the technical problems of modeling integrity, data expression capability and response mechanism refinement in the prior art. SUMMARY

[0006] This part aims to summarize some aspects of the embodiments of the present application and briefly introduce some preferred embodiments, which may be simplified or omitted in this part, the abstract and the title of the present application to avoid obscuring the purpose of this part, the abstract and the title of the present application, and such simplification or omission cannot be used to limit the scope of the present application.

[0007] In view of the above existing problems, the present application is proposed.

[0008] To solve the above technical problems, the present application provides the following technical solutions: based on the three-dimensional space model of the park, the equipment archives and the business processes, the spatial twin body, the equipment twin body and the business process twin body corresponding to the physical objects in the park are established, and the twin object mapping table is generated; The multi-source operation monitoring data of the park Internet of Things devices, sensors and business systems are collected, and the data preprocessing is performed on the multi-source operation monitoring data to form a structured real-time data set; correlate the real-time data set with the twin object mapping table, real-time drive the running state and target parameter update of the space twin, device twin and business process twin, generate a real-time feature sequence bound to each twin; input the real-time feature sequence into an anomaly diagnosis model constructed based on a Copula-based anomaly detection algorithm, obtain an anomaly score at the current time, and perform sliding aggregation on anomaly scores at a plurality of consecutive sampling times to obtain an aggregated score for hierarchical judgment; compare the aggregated score with preset first, second and third thresholds in a hierarchical manner: when the aggregated score is lower than the first threshold, it is a normal state; when the aggregated score exceeds the first threshold and does not exceed the second threshold, it is a mild abnormality alarm, and corresponding alarm information is generated and pushed to the digital twin operation and maintenance platform for prompting; when the aggregated score exceeds the second threshold and does not exceed the third threshold, it is a moderate abnormality alarm, which triggers platform alarm, mobile terminal alarm and sound and light alarm and automatically generates a disposal work order; when the aggregated score is higher than the third threshold, it is a serious abnormality alarm, and at the same time as performing all behaviors of the moderate abnormality alarm, a control instruction to switch to a safe operation strategy is issued to a preset safety control interface.

[0009] As a preferred scheme of the intelligent park operation monitoring abnormality alarm method based on digital twinning, the twin object mapping table is generated, comprising: based on the park three-dimensional space model, read the spatial coordinates, geometric boundaries and unique number information of each building, floor and functional area, and store them in the space index table; call the device archive to obtain the installation position coordinates, system type, running parameter type and communication interface identifier of each device; spatially match the device position coordinates with the space index table to establish a one-to-one binding relationship between the device and the space area; extract the node object and its associated device, space, trigger condition field information from the business process; integrate the binding relationship, device information and node field to generate mapping entries corresponding to the space, device and business three layers in turn, and write and generate the twin object mapping table.

[0010] As a preferred scheme of the intelligent park operation monitoring abnormality alarm method based on digital twinning, the method for establishing space twins, device twins and business process twins corresponding to one-to-one physical objects in the park, specifically comprising: The twin object mapping table is invoked to generate spatial twin model nodes corresponding to the geometric attributes of each spatial region; Based on the equipment file information, create equipment twin instances according to equipment type, and configure operating parameters, control interfaces and monitoring point attributes for them; Based on the business process description document, generate a business process twin object for each process node, and set its input conditions, execution strategy and output results; Using the binding entries in the twin object mapping table, spatial twins, device twins, and business process twins are associated in the hierarchical order of region, device, and process to form a set of twins that can interact synchronously.

[0011] As a preferred embodiment of the intelligent park operation monitoring anomaly alarm method based on digital twins described in this invention, the formation of a structured real-time dataset includes: The raw data stream from the sensors is collected in real time from the park's IoT platform, and the data is temporarily buffered according to the sampling time. Extract event logs and operation records from each business system, and perform preliminary alignment based on timestamps and device numbers; Perform unified field mapping on the collected multi-source data to convert data labels from different sources into unified data fields; Perform outlier removal and linear imputation of missing values ​​based on the value range of each data type; The cleaned data is sorted according to timestamps, aggregated by twin IDs to form time series samples, and a structured real-time dataset is generated.

[0012] As a preferred embodiment of the intelligent park operation monitoring anomaly alarm method based on digital twins described in this invention, the multi-source operation monitoring data includes at least temperature and humidity, voltage and current, equipment operating status, space occupancy density, personnel positioning trajectory, ventilation system start / stop status, access control card swipe records, video image event tags, business process execution time and operation step sequence, environmental PM2.5 and carbon dioxide concentration, and security alarm records.

[0013] As a preferred embodiment of the intelligent park operation monitoring anomaly alarm method based on digital twins described in this invention, the real-time dataset is associated with the twin object mapping table, including: Read the device ID, space number, and event type fields for each record from the real-time dataset; Search the twin object mapping table for the mapping entry corresponding to the device ID, and obtain the associated spatial twin and business process twin numbers; If the same device has multiple service binding relationships, the twin that is currently running is selected according to the priority label set in the twin object mapping table; The matched twin ID is bound to the real-time data record to generate a pair of associations between the twin and the real-time data.

[0014] As a preferred embodiment of the intelligent park operation monitoring anomaly alarm method based on digital twins described in this invention, the generation of real-time feature sequences bound to each twin includes: Read the associated pairs from the memory data bus and write them into their respective runtime parameter fields according to twin type; For each device twin, determine whether the operating threshold has been exceeded based on the input data, and update its operating status identifier accordingly; Based on the updated device twin state, recalculate the node execution state of the business process twin; Statistical calculations are performed on the status of multiple devices aggregated in the space twin to obtain the comprehensive operational status index of the space region; The status indicators of the space, equipment and business process twins are sampled at the same time point and combined into a feature vector, and then a real-time feature sequence is generated in chronological order.

[0015] As a preferred embodiment of the intelligent park operation monitoring anomaly alarm method based on digital twins described in this invention, the real-time feature sequence is input into an anomaly diagnosis model constructed based on the Copula anomaly detection algorithm to obtain the anomaly score at the current moment, including: The real-time feature sequence is invoked to extract all feature vectors at the current time point; Standardization and marginal distribution estimation are performed on each dimension of the feature vector; The standardized results are input into the anomaly diagnosis model built based on the Copula function for joint probability evaluation; The anomaly score for the current moment is calculated using the following formula: in, Assess the anomaly score for the current moment. , Let Copula be the integral variable. It is the inverse function of the standard normal distribution. For the first The probability density function of a dimensional feature. Here, N represents the current feature value, and N represents the total dimension of the features. The range of the current time anomaly score is non-negative real numbers. A higher value indicates a stronger degree of abnormality in the current state.

[0016] As a preferred scheme of the intelligent park operation monitoring abnormal alarm method based on digital twinning, the abnormal scores of continuous multiple sampling time points are slidingly aggregated to obtain an aggregated score for hierarchical judgment, including: Set the sliding window size W and the time step From the abnormal score sequence, W consecutive score values are extracted in turn; The extracted score values are weighted and averaged according to the time decay weight, and the aggregated value in the window is calculated; The aggregated value is normalized to stabilize the distribution interval in the range [0, 1], and the aggregated score of the current window is output.

[0017] As a preferred scheme of the intelligent park operation monitoring abnormal alarm method based on digital twinning, the safe operation strategy includes: After detecting that the serious abnormal alarm trigger condition is met, immediately switch the current park operation mode to the safe control mode; Turn off all non-critical energy-consuming devices and air conditioning systems in the safe control mode; Maintain the independent operation channel of the security and fire fighting system to ensure the availability of the key safety facilities; Automatically freeze the running state of each business process twin and record the abnormal point position; The safe control command is sent to the physical control layer through the interface, and a safe operation report is generated synchronously for manual review.

[0018] The present application has the following advantages: by establishing a unified three-type twin mapping model, introducing a Copula joint dependence modeling mechanism, and constructing a hierarchical aggregation score and response action binding mechanism, the present application solves the problems of incomplete modeling dimension, open data driving chain, low abnormal recognition accuracy and extensive response mechanism in the prior art, and achieves the technical goals of park operation state full-dimensional modeling, real-time monitoring, accurate early warning and intelligent linkage, significantly enhancing the real-time, intelligence and safety of intelligent park operation management. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor. Among them: Figure 1 The flowchart of the intelligent park operation monitoring abnormal alarm method based on digital twinning shown in the present application. DETAILED DESCRIPTION

[0020] In order to make the above objectives, characteristics and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments.

[0021] All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative labor should belong to the protection scope of the present application.

[0022] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application. However, the present application can be practiced in other manners different from those described herein, and those skilled in the art can make similar generalizations without departing from the spirit and scope of the present application. Therefore, the present application is not limited to the specific embodiments disclosed below.

[0023] According to the embodiments of the present application, combined with the flowchart shown in Figure 1 The method for monitoring and alarming of the intelligent park operation based on digital twinning includes the following steps: S1, based on the park three-dimensional space model, equipment archives and business processes, a space twin body, an equipment twin body and a business process twin body corresponding to the park physical object are established, and a twin object mapping table is generated. Among them, it needs to be explained that: The three-dimensional space model database of the park is called to extract the geometric structure information of the physical area including buildings, floors, functional areas, etc., including its space coordinates (X, Y, Z axes), geometric boundary contour (such as polygon point set), unique number (such as space ID) and the like; for the extracted space unit, it is classified according to the hierarchical structure (park→building→floor→functional area), and a space index table is generated; each record in the space index table contains at least unique space number, upper parent node number, geometric boundary description, belonging floor / building and the like fields, and a fast index mechanism is established with space number as the primary key to support subsequent device positioning and space twin body generation.

[0024] On this basis, a graphic engine is called to create a space twin body model node consistent with the geometric form of each space unit, and loaded into the digital twin visualization scene to realize virtual-real corresponding modeling of the park physical space.

[0025] Then the information of various running devices in the park is read from the equipment archives library in batches, including device unique number, device type, installation coordinates, belonging system category, running parameter set, communication interface identifier and the like; for the installation coordinates of each device, its belonging space unit is found in the space index table, and its belonging functional area is determined through geometric inclusion relationship.

[0026] After the matching is completed, the device ID and the space ID are established one-to-one binding relationship, and a device-space binding table is generated as one of the sub-tables of the twin object mapping table; then, according to the device type, a virtual instance of the device twin is created, and sensor properties (such as temperature, pressure, current), control interfaces (such as start-stop instructions, adjustment parameters), and state fields (such as enable state, alarm state) are configured for it, realizing the mapping and control synchronization of the physical device in the virtual environment.

[0027] Further read the business process description file, which defines the key business scenarios in the park operation in the BPMN format, such as security inspection, power dispatching, and environmental monitoring; for each process node, extract the device number, space area number, trigger condition (such as temperature exceeding threshold, device fault alarm), response action (such as issuing a work order, sending an instruction, updating a parameter), and other key fields.

[0028] Based on the above field information, a corresponding business process twin object is generated for each process node; each twin object includes its input condition set, execution strategy, and output response action, and has an independent life cycle state management mechanism; all business process twins are embedded into the twin system as the execution carrier of the process-level operation strategy, and are linked with the space and device twins.

[0029] The twin object mapping table is the core structure that carries the binding relationship between space, device and business process, and is used to support subsequent data correlation, state synchronization and alarm triggering; each mapping record in the table is combined with "space ID-device ID-process node ID" as the key, and records the following fields: Unique key: used to identify the binding record; Hierarchical index field: such as space ID, device ID, and process ID; Data effective time interval: such as start time and end time, supporting historical state rollback of the twin; Version number and priority: used for version control and strategy decision priority; State synchronization flag: indicates whether the device running state needs to be synchronized to the twin; Input field mapping: defines the mapping parameters from physical monitoring data; Output behavior field: defines the action when an exception or response is triggered, such as notification, control instruction, etc.

[0030] Through this mapping table, the method provided in this embodiment can quickly locate the target twin when the real-time data stream arrives and drive it to execute a complete working loop of "input → processing → output". For example, when the temperature uploaded by a device exceeds the threshold, the mapping table is used to match its associated business process node and spatial region, triggering the node twin to execute the corresponding handling strategy, such as generating a work order or issuing an adjustment command, and finally realizing the closed loop of anomaly perception and response.

[0031] After completing the construction of all space, equipment, and business process twins, the binding entries in the twin object mapping table are called to assign each twin object its hierarchical affiliation in the park system. The twin set hierarchy is constructed in the order of "space → equipment → process", so that the space twin can nest the equipment twin, and the equipment twin serves as the input source for the process twin.

[0032] Ultimately, through the twin collection management module, unified lifecycle management, data synchronization, and visualization integration of all twins are achieved, ensuring that the digital twin system can dynamically and accurately restore the physical state and business processes of the park under the drive of multi-source data.

[0033] Specifically, the method for establishing spatial twins, equipment twins, and business process twins that correspond one-to-one with physical objects in the park includes: calling the twin object mapping table to generate spatial twin model nodes corresponding to their geometric attributes for each spatial region; creating equipment twin instances according to equipment type based on equipment file information, and configuring their operating parameters, control interfaces, and monitoring point attributes; generating business process twin objects for each process node based on the business process description file, and setting their input conditions, execution strategies, and output results; and using the binding entries in the twin object mapping table to associate the spatial twins, equipment twins, and business process twins according to the hierarchical order of region, equipment, and process, forming a set of twins that can interact synchronously.

[0034] Preferably, this step establishes a one-to-one correspondence between physical objects in the park and digital twin models through twin construction and mapping table structure design, and builds a basic support framework that can support subsequent real-time data-driven, state update and response strategy execution, ensuring the scalability, traceability and high real-time performance of the method of the present invention in complex park environments.

[0035] S2. Collect multi-source operational monitoring data from IoT devices, sensors, and business systems within the park, and perform data preprocessing on the multi-source operational monitoring data to form a structured real-time dataset. Note the following in this step: Real-time raw data stream is collected from Internet of Things devices deployed in various places in the smart park, including environmental monitoring sensors, power equipment control units, access control system terminals, video monitoring systems, and personnel positioning devices; to ensure data synchronization and system response timeliness, the collection frequency is uniformly set to once every 30 seconds, and the collection system is provided with a timestamp synchronization module to ensure that all data has a unified standard clock identifier.

[0036] The collected raw data is temporarily buffered and cached, and a preliminary index is established with device number and timestamp as the primary key. On this basis, event logs and operation records generated by various business management systems (such as energy consumption management systems, security systems, and property service systems) are extracted, and business records are preliminarily aligned to corresponding device data streams based on device number and timestamp information carried by them.

[0037] Subsequently, for data fields of different sources, field standardization mapping processing is uniformly performed; specifically, a set of field mapping dictionary table is maintained, and labels (such as Temp, Temperature, temperature value, etc.) output by different device manufacturers or systems are uniformly mapped to standard fields (such as environmental temperature), achieving semantic consistency.

[0038] Next, for the abnormal values and missing values in the collected data, multiple verification and repair strategies are used: for values that are obviously beyond the reasonable physical range, they are directly excluded; for non-continuous missing segments (less than 2 sampling periods), linear interpolation method is used for filling; for data segments with long continuous missing time period, they are marked as "low quality area", and quality labels are added for reference by subsequent analysis modules.

[0039] The cleaned multi-source data is then reordered in timestamp order and aggregated by device number, space number, and business number to form a structured real-time data set; each record in the data set contains complete attribute fields, including: collection time, data source device number, spatial location code, bound business process ID, current sensor measurement value, and confidence score.

[0040] As an example, multi-source operation monitoring data at least includes temperature and humidity, voltage and current, device running status, space occupancy density, personnel positioning trajectory, ventilation system start-stop status, access card swiping record, video image event label, business process execution time and operation step sequence, environmental PM2.5 and carbon dioxide concentration, and security alarm record.

[0041] S3, associate the real-time data set with the twin object mapping table, and update the running state and target parameters of the space twin, device twin, and business process twin in real time to generate real-time feature sequences bound to each twin. It should be noted that this step is: In this embodiment, the structured real-time data set will be dynamically associated with the pre-constructed twin object mapping table to realize the driving of the running state and the construction of the feature sequence of various twins. The processing flow is as follows: The data records in the real-time data set are read one by one, and the device number, space number and business event type fields contained therein are extracted. Then, the mapping entry corresponding to the device number is retrieved in the twin object mapping table to determine the space twin body identifier and the business process twin body identifier corresponding thereto. If there are multiple business processes bound to the device, the business priority set in the mapping table is selected to preferentially select the currently running business process twin body as the binding object, so as to ensure that the mapping relationship between the twins is unique and dynamically effective. After the twin binding is completed, each data record is associated with the selected space twin, device twin and business process twin in one-to-one relationship, and is written into the memory data bus for calling by each sub-module.

[0042] In terms of constructing real-time feature sequences, based on the above association pairs, the running parameter fields of the current sampling period are written into the space, device and business process three-level twins, respectively. For example, the device twin records the current power consumption value and switch state; the space twin records the area temperature and humidity, and personnel density; and the business process twin records the current step and duration of the process.

[0043] Among them, for the device twin, the real-time data is compared with its running threshold value, and if the value is detected to be out of limit, the state identifier is updated to be an abnormal alarm; for the business process twin, based on the state change of the bound device, it is dynamically judged whether the process is normally executed, whether there is a block or delay, etc.; for the space twin, the system aggregates the states of all devices in its jurisdiction to calculate comprehensive indexes such as space health score and environmental load index.

[0044] In order to ensure the consistency and comparability of the feature sequence, a unified sampling period (such as sampling once every 30 seconds) is set, and a synchronization mechanism based on device ID and timestamp is used to time-align all twin state updates; for the interpolated data or data segments marked as low quality, a quality label is added when generating the feature sequence to improve the reliability of the subsequent anomaly detection model.

[0045] Finally, the state data of each twin at a unified time point is combined into a feature vector containing multiple attributes, which is spliced in time sequence to form a multi-level joint real-time feature sequence. Compared with the traditional sequence containing only device dimension or space dimension, the feature sequence can more completely reflect the causal dependence relationship and interaction between the physical state, space environment and business process in the park, so as to be more sensitive and suitable for the subsequent anomaly detection task constructed based on the Copula algorithm.

[0046] S4. Input the real-time feature sequence into the anomaly diagnosis model constructed based on the Copula anomaly detection algorithm to obtain the anomaly score at the current time, and perform sliding aggregation on the anomaly scores of multiple consecutive sampling times to obtain an aggregated score for classification determination. Note that the following should be noted in this step: Call the real-time feature sequence to extract all feature vectors at the current time point; Standardization and marginal distribution estimation are performed on each dimension of the feature vector; The standardized results are input into the anomaly diagnosis model built based on the Copula function for joint probability evaluation; The anomaly score for the current moment is calculated using the following formula: in, Assess the anomaly score for the current moment. , Let Copula be the integral variable. It is the inverse function of the standard normal distribution. For the first The probability density function of a dimensional feature. Here, N represents the current feature value, and N is the total dimension of the features. The range of anomaly scores at the current moment is non-negative real numbers. A higher value indicates a stronger degree of abnormality in the current state.

[0047] Preferably, in this embodiment, to achieve intelligent diagnosis of abnormal park operation status, the real-time feature sequence bound to the spatial twin, equipment twin, and business process twin is first used as input data to extract all feature vectors corresponding to the current time point. The feature vector consists of multi-dimensional indicators, covering multiple levels such as equipment status values, spatial environment indicators, personnel behavior information, and business execution progress. For each dimension of feature data, the marginal distribution fitting method based on empirical distribution estimation is preferably adopted, and the zero-mean unit variance standardization processing of each dimension feature is performed to eliminate the influence of dimensional differences.

[0048] Subsequently, a joint distribution model is constructed using Copula theory. t-Copula is preferred to adapt to the extreme value correlation characteristics, and the Copula related parameters are estimated using the maximum likelihood estimation method to obtain the joint probability density function. Based on the constructed joint probability model, the joint probability of the standardized feature vector is evaluated to obtain the anomaly score at the current time point. The larger the score, the more the current state tends to be abnormal.

[0049] It should be noted that after obtaining the abnormal rating sequence at consecutive time points, this embodiment extracts a stable rating trend through sliding aggregation, and judges the current operational health status of the park based on this trend, wherein: Setting the size of the sliding window W and the time step , preferably setting W as an integer between 6 and 12, is an interval between 30 seconds and 2 minutes; for example, in the scenario where the device update period is once per minute, W = 6 can be set, = 1 minute, indicating that each sliding window contains abnormal score data of nearly 6 minutes.

[0050] Then, from the abnormal score sequence, W consecutive score values are extracted in a sliding manner according to the set time step to form a score set in each window.

[0051] In order to suppress the interference caused by data fluctuations or short-term abnormalities in the score sequence, a time decay weighting strategy is preferably used for weighting processing of the score set; that is, different time weights are assigned to the score values in the window, so that the score closer to the current time has a higher weight, thereby more accurately reflecting the current abnormal state.

[0052] Exemplarily, the calculation formula of the aggregated value in the window is: wherein, is the aggregated score of the current sliding window; is the th abnormal score value in the window; is the time decay weight corresponding to the th score value; After obtaining the aggregated score, it is preferably normalized to map it stably to the interval [0, 1], in order to enhance the comparability and stability of the score distribution.

[0053] Finally, the aggregated score is compared with the preset multi-level threshold value, divided into four levels of normal, mild abnormality, moderate abnormality and severe abnormality, and the corresponding alarm actions and disposal processes are triggered respectively.

[0054] It also needs to be explained that, in order to improve the deployment efficiency and robustness of the algorithm in the actual park environment, the construction of the Copula model is optimized in this embodiment. Considering that the marginal distribution of different features may differ significantly, an automatic marginal distribution identification mechanism is introduced to adaptively select the optimal fitting distribution from Beta distribution, normal distribution and exponential distribution. In terms of the selection of Copula family, a cross-validation mechanism is designed for the model training stage to select the Copula family with the smallest AIC value as the final modeling function. In the Copula parameter estimation process, a sliding sampling window and a missing value suppression mechanism are introduced to ensure stable joint probability estimation even when some data is missing or sampling is uneven. This Copula model can be deployed on the edge computing node as a microservice, receiving feature vectors through API and returning abnormal scores to ensure low latency and high availability of the scoring process.

[0055] Preferably, to avoid excessive sensitivity of abnormal scores to sudden data noise or mis-sampling, this embodiment introduces a score robustness control mechanism, which specifically includes: labeling the quality label of each data segment (such as: interpolation, complete, missing, rejection) in the feature extraction process, and performing confidence reduction processing on the scores with interpolation or missing labels; in the sliding aggregation process, if the missing score value in a window exceeds a certain threshold (such as 30%), skip the score calculation of the window to prevent misjudgment; through the above processing method, the reliability of the aggregated score and the accuracy of the alarm judgment can be significantly improved, thereby realizing fine intelligent monitoring of the operation state of the smart park.

[0056] S5, compare the aggregated score with the first threshold, the second threshold and the third threshold. It needs to be explained that this step is: When the aggregated score is lower than the first threshold, it is a normal state; When the aggregated score exceeds the first threshold and does not exceed the second threshold, it is a mild abnormal alarm, and the corresponding alarm information is generated and pushed to the digital twin operation and maintenance platform for prompt; When the aggregated score exceeds the second threshold and does not exceed the third threshold, it is a moderate abnormal alarm, which triggers platform alarm, mobile terminal alarm and sound and light alarm and automatically generates a disposal work order; When the aggregated score is higher than the third threshold, it is a serious abnormal alarm, which executes all the behaviors of the moderate abnormal alarm at the same time, and issues a control instruction to switch to a safe operation strategy to the preset safety control interface.

[0057] The safe operation strategy comprises: after detecting that a serious abnormality alarm trigger condition is met, immediately switching a current park operation mode to a safe control mode; in the safe control mode, shutting down all non-key energy-consuming devices and air conditioning systems; maintaining independent operation channels of security and fire-fighting systems to ensure availability of key safety facilities; automatically freezing running states of each business process twin and recording abnormal points; issuing safe control instructions to a physical control layer through an interface, and synchronously generating a safe operation report for manual review.

[0058] The foregoing executed data preprocessing method can be performed by means and methods in the prior art, which will not be described in detail in this case.

[0059] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and are not limiting. Although the present application has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions of the present application, which should be covered in the scope of the claims of the present application.

Claims

1. A method for anomaly alarm in smart park operation monitoring based on digital twins, characterized in that, include: Based on the park's 3D spatial model, equipment files, and business processes, spatial twins, equipment twins, and business process twins that correspond one-to-one with the park's physical objects are established, and a twin object mapping table is generated. Collect multi-source operation monitoring data from IoT devices, sensors, and business systems in the park, and perform data preprocessing on the multi-source operation monitoring data to form a structured real-time dataset; The real-time dataset is associated with the twin object mapping table to drive the real-time update of the running status and target parameters of the spatial twin, device twin, and business process twin, and generate real-time feature sequences bound to each twin. The real-time feature sequence is input into an anomaly diagnosis model constructed based on the Copula anomaly detection algorithm to obtain the anomaly score at the current time. The anomaly scores at multiple consecutive sampling times are then aggregated to obtain an aggregated score for grade determination. The aggregated score is compared with preset first, second, and third thresholds in a tiered manner: When the aggregate score is lower than the first threshold, it is considered a normal state. When the aggregated score exceeds the first threshold but does not exceed the second threshold, it is a minor anomaly alarm. In this case, the corresponding alarm information is generated and pushed to the digital twin operation and maintenance platform for notification. When the aggregated score exceeds the second threshold but does not exceed the third threshold, it is a moderate abnormal alarm, which triggers platform alarm, mobile terminal alarm and audible and visual alarm and automatically generates a handling work order; When the aggregated score is higher than the third threshold, it is a serious anomaly alarm. At the same time, while executing all the actions of a moderate anomaly alarm, a control command to switch to a safe operation strategy is sent to the preset security control interface.

2. The method for anomaly alarm in smart park operation monitoring based on digital twins according to claim 1, characterized in that, Generating the twin object mapping table includes: Based on the three-dimensional spatial model of the park, the spatial coordinates, geometric boundaries and unique number information of each building, floor and functional area are read and stored in the spatial index table. Access the device database to obtain the installation location coordinates, system type, operating parameter types, and communication interface identifier for each device; The location coordinates of each device are spatially matched with the spatial index table to establish a one-to-one binding relationship between the device and the spatial region. Extract the node objects involved in the business process and their associated fields such as devices, spaces, and trigger conditions; Based on the binding relationship, device information, and node fields, mapping entries corresponding to the three layers of space, device, and business are generated in sequence, and written into and generated in the twin object mapping table.

3. The method for anomaly alarm in smart park operation monitoring based on digital twins according to claim 1 or 2, characterized in that, The method for establishing spatial twins, equipment twins, and business process twins that correspond one-to-one with physical objects in the park specifically includes: The twin object mapping table is invoked to generate spatial twin model nodes corresponding to the geometric attributes of each spatial region; Based on the equipment file information, create equipment twin instances according to equipment type, and configure operating parameters, control interfaces and monitoring point attributes for them; Based on the business process description document, generate a business process twin object for each process node, and set its input conditions, execution strategy and output results; Using the binding entries in the twin object mapping table, spatial twins, device twins, and business process twins are associated in the hierarchical order of region, device, and process to form a set of twins that can interact synchronously.

4. The method for anomaly alarm in smart park operation monitoring based on digital twin as described in claim 1, characterized in that, The formation of the structured real-time dataset includes: The raw data stream from the sensors is collected in real time from the park's IoT platform, and the data is temporarily buffered according to the sampling time. Extract event logs and operation records from each business system, and perform preliminary alignment based on timestamps and device numbers; Perform unified field mapping on the collected multi-source data to convert data labels from different sources into unified data fields; Perform outlier removal and linear imputation of missing values ​​based on the value range of each data type; The cleaned data is sorted according to timestamps, aggregated by twin IDs to form time series samples, and a structured real-time dataset is generated.

5. The method for anomaly alarm in smart park operation monitoring based on digital twins according to claim 1 or 4, characterized in that, The multi-source operation monitoring data includes at least temperature and humidity, voltage and current, equipment operating status, space occupancy density, personnel positioning trajectory, ventilation system start and stop status, access control card swipe records, video image event tags, business process execution time and operation step sequence, environmental PM2.5 and carbon dioxide concentration, and security alarm records.

6. The method for anomaly alarm in smart park operation monitoring based on digital twin as described in claim 2 or 4, characterized in that, Associating the real-time dataset with the twin object mapping table includes: Read the device ID, space number, and event type fields for each record from the real-time dataset; Search the twin object mapping table for the mapping entry corresponding to the device ID, and obtain the associated spatial twin and business process twin numbers; If the same device has multiple service binding relationships, the twin that is currently running is selected according to the priority label set in the twin object mapping table; The matched twin ID is bound to the real-time data record to generate a pair of associations between the twin and the real-time data.

7. The method for anomaly alarm in smart park operation monitoring based on digital twin as described in claim 6, characterized in that, The generation of real-time feature sequences bound to each twin includes: Read the associated pairs from the memory data bus and write them into their respective runtime parameter fields according to twin type; For each device twin, determine whether the operating threshold has been exceeded based on the input data, and update its operating status identifier accordingly; Based on the updated device twin state, recalculate the node execution state of the business process twin; Statistical calculations are performed on the status of multiple devices aggregated in the space twin to obtain the comprehensive operational status index of the space region; The status indicators of the space, equipment and business process twins are sampled at the same time point and combined into a feature vector, and then a real-time feature sequence is generated in chronological order.

8. The method for anomaly alarm in smart park operation monitoring based on digital twins according to claim 7, characterized in that, The real-time feature sequence is input into an anomaly diagnosis model constructed based on the Copula anomaly detection algorithm to obtain the anomaly score at the current moment, including: The real-time feature sequence is invoked to extract all feature vectors at the current time point; Standardization and marginal distribution estimation are performed on each dimension of the feature vector; The standardized results are input into the anomaly diagnosis model built based on the Copula function for joint probability evaluation; The anomaly score for the current moment is calculated using the following formula: in, Assess the anomaly score for the current moment. , Let Copula be the integral variable. It is the inverse function of the standard normal distribution. For the first The probability density function of a dimensional feature. Here, N represents the current feature value, and N represents the total dimension of the features. The range of the current time anomaly score is non-negative real numbers. A higher value indicates a stronger degree of abnormality in the current state.

9. The method for anomaly alarm in smart park operation monitoring based on digital twin as described in claim 8, characterized in that, Anomaly scores from multiple consecutive sampling times are aggregated using a sliding method to obtain an aggregated score for classification determination, including: Set the sliding window size W and time step. Extract W consecutive score values ​​sequentially from the abnormal score sequence; The extracted scores are weighted averaged according to time decay weights, and the aggregated value within the window is calculated. The aggregated values ​​are normalized to stabilize their distribution range within [0,1], and the aggregated score for the current window is output.

10. The method for anomaly alarm in smart park operation monitoring based on digital twin as described in claim 1, characterized in that, The secure operation strategy includes: Once the alarm trigger conditions for a serious anomaly are met, the current park operation mode will be immediately switched to security control mode. In safety control mode, shut down all non-critical energy-consuming equipment and the air conditioning system; Maintain independent operating channels for security and fire protection systems to ensure the availability of critical safety facilities; Automatically freeze the running status of each business process twin and record abnormal points; Security control commands are sent to the physical control layer via an interface, and a security operation report is generated simultaneously for manual review.

Images