Dynamic reconstruction method and system for control loop of abnormal event flow causal inference

Abstract

The invention relates to the technical field of industrial automation and safety control, and particularly discloses a control loop dynamic reconstruction method and system for abnormal event flow causal inference. According to the method, multi-source abnormal events are collected in real time, a driving propagation path is found and recognized through lightweight causality, and the comprehensive causality intensity is calculated according to the path length, the confidence coefficient and the time coupling. And a four-layer nested judgment mechanism is adopted to ensure that only the continuous high threat path is triggered and reconstructed. The system is based on an atomic action library combination reconstruction strategy, after digital twinborn rehearsal verification, smooth migration of a new control structure and an old control structure is achieved through an S-type function, and in the process, continuous monitoring is conducted, and abnormal freezing and rollback are supported. According to the method, closed-loop autonomy from abnormal perception and causal diagnosis to safe reconstruction is realized, and the system toughness is remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of industrial automation and safety control technology, specifically to a method and system for dynamic reconstruction of control loops for causal inference of abnormal event flows. Background Technology

[0002] As the core of critical infrastructure, the stable and secure operation of industrial control systems is of paramount importance. During operation, these systems are continuously generating massive and heterogeneous streams of abnormal events due to factors such as equipment aging, complex operating conditions, cyberattacks, or human error. Traditional mainstream anomaly handling methods mainly rely on alarm systems based on fixed thresholds and diagnostic rules based on expert experience. Traditional methods have significant drawbacks: First, they are essentially a passive response mode from perception to alarm, with diagnosis and decision-making lagging behind the occurrence of anomalies, making it difficult to meet the real-time requirements of highly dynamic industrial scenarios; second, the rule systems are rigid and inflexible, and when faced with unknown, coupled, or evolving anomaly patterns, the diagnostic accuracy drops sharply, leading to frequent false alarms and missed alarms; more importantly, even when anomalies are identified, current technologies generally lack the ability to automatically and safely translate diagnostic conclusions into corrective actions such as control system structural adjustments or parameter optimizations, heavily relying on manual intervention, resulting in low efficiency and poor consistency.

[0003] In recent years, data-driven causal inference techniques have been introduced into the industrial field to improve the ability to locate the root causes of faults. However, existing solutions based on causal graphs, Granger causality, and other methods mostly focus on offline, post-event historical data analysis, and cannot perform lightweight and rapid online inference on real-time event streams, thus failing to provide immediate decision support for dynamic control. More importantly, even if potential causal paths can be identified online, how to assess the threat of these paths and design safe, reliable, and smooth control loop reconfiguration strategies accordingly remains an unsolved problem. Blind or aggressive online reconfiguration can easily lead to system oscillations, secondary faults, or even safety accidents due to model mismatch, constraint overruns, or switching shocks. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a method and system for dynamic reconstruction of control loops for causal inference of abnormal event flows. This method can process multi-source abnormal event flows in real time, identify driving causal paths online, and achieve safe, dynamic, and adaptive reconstruction of industrial control loops through multi-layered security judgment, virtual pre-simulation, constraint transfer, and adaptive learning mechanisms, thereby improving the system's resilience and autonomous recovery capabilities.

[0005] The specific technical solution of this application is as follows: According to one aspect of this application, a method for dynamically reconstructing control loops for causal inference of abnormal event flows is provided, comprising: Real-time acquisition of multi-source abnormal event streams generated during the operation of industrial control systems; online lightweight causal inference of event sequences of multi-source abnormal event streams; identification of driving causal paths ending with controller input or output variables. For the identified driving causal path, a four-layer nested judgment mechanism is initiated. The reconstruction preparation state is activated only when all four judgments are true. The first-level judgment mechanism is to screen the key causal path of the endpoint-related controlled variable. The second-level judgment mechanism is to calculate the comprehensive causal strength of each path; The third-level judgment mechanism is to determine whether the path strength exceeds a preset safety threshold. The fourth-layer judgment mechanism is to verify whether the path exceeding the threshold has been repeated twice or more within a consecutive number of cycles; In the pre-reconstruction state, based on the structure, variables and temporal characteristics of the current driving causal path, multiple basic reconstruction actions are matched and combined from the pre-set atomic action library to form a reconstruction strategy package; pre-rehearsal verification is performed in the virtual environment, and execution is approved only if the verification is successful; Set safety boundary constraints for each action in the reconstructed strategy package, and deploy the strategy package to the real control loop under the constraints; the old and new control structures are gradually migrated over multiple cycles using an S-shaped function; if a new high-intensity (exceeding the safety threshold) driving causal path is detected during the migration, the transition migration is immediately frozen and returned to the four-layer nested judgment mechanism for re-evaluation; After refactoring and deployment, monitor the abnormal event flow within a predetermined time scale; if the abnormal event flow disappears, mark the verified refactoring strategy package as steady state, and incorporate it into the atomic action library after scenario labeling; if the abnormality still exists or a new abnormal pattern appears, trigger strategy rollback, restart the causal inference and evaluation loop, and form an adaptive refactoring mechanism.

[0006] As a further option of the method of the present invention, the online lightweight causal inference performed on the event sequence of the multi-source abnormal event stream includes: Deploy data acquisition agents at key locations in the system to collect controller process variables, setpoints, control outputs, network packets, and system log data; Based on preset rules or models, the collected data is anomaly detected, and a uniformly formatted anomaly event triplet is generated; the anomaly event triplet includes a timestamp, variable identifier, and confidence level; The abnormal event stream is pushed to the central processing engine. Within the sliding time window, the continuous time axis is discretized into equally spaced time slots, and the confidence scores of multiple events for each variable within the time slots are aggregated to form a multivariate time series. The multivariate time series was analyzed using a causal discovery algorithm to generate a directed causal graph, and all candidate sets of driving causal paths ending with key control variables were extracted from it.

[0007] As a further option of the method of the present invention, the first-layer judgment mechanism specifically includes: Define and maintain a list of key controlled variables based on process safety information, key product quality parameters, and equipment protection interlock lists; For each path in the set of driving causal paths, obtain the endpoint variable; If the endpoint variable is a controller output variable, then query the control loop configuration library to determine whether the final execution object manipulated by the controller output variable is used to call a variable in the list of key controlled variables. If the endpoint variable is a process variable, trace the control loop to which the endpoint variable belongs and determine whether the controller output of the control loop is ultimately used to adjust the variables in the list of key controlled variables. The first-level judgment mechanism filters the paths into a subset of key causal paths.

[0008] As a further option of the method of the present invention, in the second-layer judgment mechanism, the comprehensive causal strength of each path is calculated. The calculation formula is: ;in: It is the path length factor. , It is the path length; It is the average confidence factor. , It is the initial average confidence level of the path events. It is the time coupling tightness factor. , It is a path The maximum time interval between adjacent events, The attenuation coefficient is... These are the weight coefficients of the corresponding factors, and they satisfy... .

[0009] As a further option of the method of the present invention, the third-level judgment includes: A strength safety threshold is set by analyzing the intensity distribution of causal paths under normal operating conditions in the system's long-term historical operating data. .

[0010] Traverse the subset of key causal paths and select all that satisfy the condition. The paths constitute a subset of high-intensity paths.

[0011] If the high-intensity path subset is empty, it indicates that no path intensity exceeds the safety line, and the system determines that immediate reconstruction is not necessary, and the process continues to monitor. If the high-intensity path subset is not empty, the process proceeds to the fourth level of judgment.

[0012] As a further option of the method of the present invention, the fourth-layer judgment mechanism includes: The system maintains a circular buffer for high-intensity path subsets identified within several control cycles; For each path in the high-intensity path subset of the current period, a match is performed in the historical buffer. The matching criteria include identical variable sequences and the fact that the intensity of each path exceeds the intensity safety threshold in each historical period. ; The number of times a statistical path appears within a consecutive number of periods; If there exists at least one path that appears more than or equal to 2 times, then the fourth-level judgment is valid, the reconstruction preparation state is activated, and the set of paths that meet the condition is recorded as the trigger path set.

[0013] As a further option of the method of the present invention, in the pre-reconstruction state, based on the structure, variables, and temporal characteristics of the current driving causal path, multiple basic reconstruction actions are matched and combined from a pre-set atomic action library to form a reconstruction strategy package, including: Deep feature extraction is performed on the paths in the trigger path set, including identifying the variable types of the start and end points, analyzing the event timestamp sequence to determine the abnormal pattern, and combining the factory information model to analyze the physical equipment and control loop to which the variable belongs; Based on the extracted features, the anomalies are categorized into at least one of the following reconstruction dimensions: signal source correction, control law adjustment, execution path switching, and logical association optimization. From a pre-built library of atomic actions, matching atomic actions are retrieved based on reconstruction dimension labels, semantic similarity, or correlation with historical success cases; the atomic actions are independently executable and reversible control system modification instructions. Based on path strength, scope of influence, and dependencies between actions, multiple atomic actions are combined into an ordered refactoring strategy package, and static conflict and dependency analysis is performed on the refactoring strategy package.

[0014] As a further option of the method of the present invention, the step of performing pre-performance verification in a virtual environment and approving execution only when the verification is successful includes: Call upon a digital twin model that matches the actual control system; Load the current real system state snapshot into the virtual environment as the initial condition; The actions in the reconstruction strategy package are executed sequentially in the virtual environment, and the simulation runs for a predetermined duration at accelerated or real-time speed. During and after the simulation, monitor whether the original abnormal event flow disappears, whether the dynamic response of the key controlled variables meets the standard, whether all process variables are within the safe operating range, and whether new high-intensity abnormal event flows or causal paths are generated. The refactoring strategy package is approved to proceed to the actual deployment phase only if all predefined success criteria are met.

[0015] As a further option of the method of the present invention, a safety boundary constraint is set for each action in the reconstructed strategy package, and the strategy package is deployed to the real control loop under the constraint; the old and new control structures are gradually transitioned over multiple cycles using a S-shaped function, including: Define safety boundary constraints for each atomic action in the refactoring strategy package, including upper and lower limits for parameter adjustment, preconditions for mode switching, execution timeout, number of retries for failure, and rollback trigger conditions, to form a refactoring strategy package with safety constraints; Determine the total number of migration cycles, and calculate the mixing coefficient for each migration cycle based on the sigmoid function. : ,in, For shape parameters; This represents the total number of migration cycles. This is the current migration cycle; Calculate the actual effective control action in each migration cycle. and will When applied to the actual control loop, when hour, , The migration is complete, and the system is now fully operational under the new architecture; among them, ,in The output is from the old control structure. Output for the new control structure; During the migration process, lightweight abnormal event flow monitoring and causal strength calculation are performed in parallel. If the comprehensive causal strength of the new path is detected to exceed the safety threshold, the migration is immediately frozen, the current mixing coefficient and control effect are maintained, and the process returns to the four-layer nested judgment mechanism for re-evaluation.

[0016] As a further option of the method of the present invention, after the reconstruction deployment, the abnormal event flow is monitored within a predetermined time scale; if the abnormal event flow disappears, the verified reconstruction strategy package is marked as steady state, and after scene tagging, it is included in the atomic action library; if the abnormality still exists or a new abnormal mode appears, the strategy rollback is triggered, and the causal inference and evaluation loop is restarted, including: After the migration is successfully completed, the predetermined observation period will be entered to continuously monitor whether the original abnormal event flow disappears, whether new high-intensity paths with the same or similar patterns as the original trigger path set appear, and whether the key controlled variable operating indicators have recovered. If all monitoring conditions are met during the observation period, the reconstruction is considered successful. The topological features of the trigger path set, the variable process semantic labels, and the system steady-state operating points are encoded into scene feature vectors. The successful reconstruction strategy package with safety constraints is associated with the scene feature vectors and stored in the reconstruction case knowledge base. If the original anomaly persists, occurs periodically, or a new high-intensity anomaly pattern appears during the observation period, the reconstruction is deemed to have failed, and an automatic rollback procedure is initiated to restore the control structure to its pre-reconstruction state using a smooth transition curve. After the rollback is completed, a failure log is recorded, and a new round of diagnosis and reconstruction cycle is started from the real-time data collection and causal inference steps. In subsequent action matching, failed strategy combinations are avoided, so as to realize the system's continuous adaptive learning.

[0017] Another aspect of this application provides a dynamic reconstruction system for control loops in causal inference of abnormal event flows, the system comprising: The multi-source event acquisition and causal inference module is used to acquire multi-source abnormal event streams generated during the operation of industrial control systems in real time, perform online lightweight causal inference on event sequences within the most recent time window, and identify driving causal paths ending with controller input or output variables. The multi-layer path evaluation and decision-making module is used to initiate a four-layer nested judgment mechanism for the identified driving causal path. The reconstruction preparation state is activated only when all four judgments are true. The refactoring strategy generation and verification module is used to match and combine multiple basic refactoring actions from a pre-set atomic action library to form a refactoring strategy package based on the structure, variables and temporal characteristics of the current driving causal path in the refactoring preparatory state; it performs pre-rehearsal verification in a virtual environment and approves execution only when the verification is successful; The safe migration deployment module is used to set safe boundary constraints for each action in the refactoring strategy package, and deploy the strategy package to the real control loop under the constraints; control the new and old control structures to migrate slowly over multiple cycles according to an S-shaped function; if a new high-intensity driving causal path is detected during the migration process, the transition migration is immediately frozen, triggering the multi-layer path evaluation and decision module to re-evaluate; The monitoring feedback and knowledge learning module is used to monitor the abnormal event flow within a predetermined time scale after the refactoring deployment. If the abnormal event flow disappears, the verified refactoring strategy package is marked as steady state and included in the atomic action library after scenario tagging. If the abnormality still exists or a new abnormal pattern appears, the strategy rollback is triggered, and the multi-source event collection and causal inference module is restarted to form an adaptive refactoring loop.

[0018] The beneficial effects of this application are as follows: This method significantly improves the accuracy and timeliness of anomaly diagnosis by introducing real-time online causal inference and a multi-layered strength judgment mechanism. Traditional methods rely on fixed rules, making it difficult to handle unknown anomaly patterns, with false alarm rates often exceeding 30% and response delays ranging from minutes to hours. This method employs a sliding time window and online lightweight causal discovery, completing event flow analysis within seconds. Combined with a four-layer judgment mechanism, it effectively filters out sporadic noise, reducing the false alarm rate to below 5%. Simultaneously, it ensures that reconstruction is triggered only for persistent, high-threat anomaly paths, greatly improving diagnostic accuracy and system response speed.

[0019] In terms of control loop reconfiguration, this method achieves safe and disturbance-free online structural adjustment through digital twin pre-simulation verification and an S-shaped smooth migration mechanism. Traditional reconfiguration often relies on manual trial and error, which is prone to secondary faults and carries a high risk of system oscillation. This method achieves a pre-simulation verification success rate of over 90% in a virtual environment and uses an S-shaped transition function to achieve a smooth switch between the old and new control structures over multiple cycles, reducing the rate of change of control output by more than 70% and avoiding step disturbances. In addition, new abnormal paths are monitored in real time during the migration process, and the migration is immediately frozen upon detection, thereby controlling the system risks during the reconfiguration process within an acceptable range and significantly improving the resilience and autonomous recovery capability of the industrial control system. Attached Figure Description

[0020] Figure 1 Overall schematic diagram of the control loop dynamic reconstruction method for causal inference of abnormal event flow; Figure 2 S100 flowchart of the control loop dynamic reconstruction method for causal inference of abnormal event flow; Figure 3 S200 flowchart of the control loop dynamic reconstruction method for causal inference of abnormal event flow; Figure 4 S300 flowchart of the control loop dynamic reconstruction method for causal inference of abnormal event flow; Figure 5 Flowchart of the S400 method for dynamic reconstructing control loops for causal inference of abnormal event flows; Figure 6 S500 flowchart of the control loop dynamic reconstruction method for causal inference of abnormal event flow. Detailed Implementation

[0021] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0022] Industrial control systems, as the core of modern production operations, integrate numerous heterogeneous subsystems and high-frequency interactive control loops, such as process controllers, safety instrumented systems, and equipment management systems. These control loops generate a large number of status and alarm events during operation, and complex causal relationships may exist between these events. Especially when anomalies occur, disturbances can propagate along the control chain, leading to cascading effects. Traditional anomaly diagnosis and handling often rely on expert experience or fixed rules, resulting in delayed responses, poor flexibility, and difficulty in dynamically adjusting the control structure to suppress anomaly propagation during system operation. Existing methods lack systematic, online inference of causal relationships in anomaly event flows and intelligent reconfiguration mechanisms based on causal strength, leading to low operational efficiency and insufficient system resilience.

[0023] The theoretical foundation of this invention is built upon three pillars: the theory of temporal causal discovery, the theory of comprehensive evaluation of path strength, and the theory of safe migration in dynamic systems. By constructing an event flow causal network, implementing multi-layer strength judgment, and designing a controlled, progressive reconfiguration migration, adaptive recovery and continuous learning of industrial control loop anomalies are ultimately achieved.

[0024] The definitions of the core variables and the derivation of the formulas are as follows: 1. Exceptional events and event flow: Defined at time The abnormal event that occurred was a triple. .in, The system variable identifier associated with the abnormal event. It is a confidence level calculated based on predefined rules, model residuals, or statistical process control, representing the probability that an anomalous event is a true anomaly. (The last part, "in length...", appears to be incomplete and requires further context.) Within the time window, all events are sorted by timestamp to form an abnormal event stream. .

[0025] 2. Cause-effect graphs and cause-effect paths: Through the By performing causal discovery, a directed graph is obtained. Vertex set Corresponding to all the variables that have appeared edge set Directed edges in Representing variables For variables There is a statistically significant causal effect. A causal relationship exists from the source variable. To target variable causal path Represented as a vertex sequence Path length Defined as the number of edges on the path, i.e. .

[0026] 3. Path-based comprehensive causal strength calculation model: To quantify the importance of different causal paths in driving anomaly propagation, paths are defined. Comprehensive causal strength Overall causal strength It is a weighted combination of path length, event confidence, and temporal coupling: ;in: This is the path length factor. The shorter the path, the more direct the anomaly propagation; the larger the factor value, the stronger the influence. It is the confidence level of all events along the path. The arithmetic mean of the signals represents the overall credibility of the abnormal signals along the path. It is the time coupling tightness factor. It is the maximum time interval between adjacent events on the path. This is the attenuation coefficient. This factor indicates that the more concentrated the events on the path occur in time, the closer their causal relationship is in time, and the larger the factor value. These are the weight coefficients of the corresponding factors, and they satisfy... .

[0027] Overall causal strength The range of values ​​is The larger the value, the stronger the driving force of the causal path, and the more attention it needs to be paid.

[0028] 4. Path significance decision function: Whether a path is significant enough to trigger a refactoring is determined by whether its strength consistently exceeds a threshold and appears stably. (Define the path.) Significance decision function : ;in: It is a preset safety strength threshold. It is an indicator function that takes the value 1 when the condition is true and 0 otherwise. Indicates the first The set of high-intensity paths identified in each control cycle, i.e. The path. This indicates the current control cycle number.

[0029] This function indicates that only when the path A path is considered significant only when its current intensity exceeds the threshold, and at least two of the last three consecutive control periods have been identified as high-intensity paths. .

[0030] 5. S-shaped transient function for control loop migration: To ensure the control loop transitions from its original structure... Towards a new structure To ensure a smooth transition and avoid abrupt disturbances, a sigmoid function is used to control the migration process. Defined in the total... The first in the cycle Mixing coefficient per migration cycle : ;in, The shape parameter controls the steepness of the S-curve function. This determines the actual control effect during that migration cycle. for: ;when hour, , ;when hour, , The entire migration process was smooth and continuous.

[0031] The above theoretical framework provides a solid mathematical foundation for this invention, ensuring the accuracy and reliability of the entire process from anomaly event perception and causal strength quantification to security reconstruction migration.

[0032] The specific embodiments of the present invention will be described in detail below.

[0033] Example 1: Please see Figure 1 This diagram illustrates the overall flowchart of a dynamic reconstruction method for control loops in causal inference of abnormal event flows according to an embodiment of the present invention. The method includes: S100: Real-time acquisition of multi-source abnormal event streams generated during the operation of industrial control systems, online lightweight causal inference of event sequences within the most recent time window, and identification of driving causal paths ending with controller input or output variables.

[0034] S200: For the identified driving causal path, a four-layer nested judgment mechanism is initiated, and the reconstruction preparation state is activated only when all conditions are met.

[0035] S300: In the refactoring preparation state, based on the characteristics of the current driving causal path, match and combine multiple basic refactoring actions from the pre-set atomic action library to form a refactoring strategy package; perform pre-rehearsal verification in the virtual environment, and approve execution only when the verification is successful.

[0036] S400: Sets safety boundary constraints for each action in the reconfiguration strategy package, and deploys the strategy package to the real control loop under the constraints; the old and new control structures migrate slowly over multiple cycles according to an S-shaped function; continuous monitoring is carried out during the migration process, and if a new high-intensity driving causal path is detected, the migration is immediately frozen and returned to S200 for re-evaluation.

[0037] S500: After refactoring deployment, monitor the abnormal event flow within a predetermined time scale; based on the monitoring results, mark successful refactoring strategy packages as steady state and add them to the knowledge base, or trigger strategy rollback and restart the diagnosis and refactoring cycle.

[0038] The specific plan is as follows: In a dynamic reconstruction method for control loops of causal inference of abnormal event streams, S100 realizes the transformation from raw data to preliminary causal diagnosis results through data acquisition and event generation agents deployed on each node of the system and a central stream processing engine.

[0039] Please refer to Figure 2 It illustrates a flowchart of step S100 in an exemplary dynamic reconstruction method for control loops of causal inference of anomaly event flow according to this application, the contents of which include: S110: In this invention, software or hardware acquisition agents are deployed at key locations in the industrial control network. Key locations include, but are not limited to: operator stations and controllers of distributed control systems, CPU modules of programmable logic controllers, intelligent interfaces of key sensors and actuators, and network switches.

[0040] In one possible implementation, the content collected includes: For the controller, process variables PV, setpoint SP, control output OP, operating mode, and internal status words are collected.

[0041] For network traffic, collect packets of specific protocols, their response times, and error codes.

[0042] For system logs, collect event logs from the operating system and applications.

[0043] Based on the collected data, the abnormal event flow is determined according to the designed rules. In one possible implementation, the rule types include: when or When this occurs, it is determined to be an abnormal event stream, with a confidence level of [insert confidence level here]. The limit can be increased as the degree of exceeding the limit increases.

[0044] when When this occurs, it is determined to be an abnormal event stream.

[0045] When the device status changes from running to fault, or the communication quality changes from good to poor, it is identified as an abnormal event stream.

[0046] In one possible implementation, all generated events are formatted into a unified structure based on the collected content and abnormal event stream judgment rules. ,in, For the time of occurrence of the abnormal event stream, The system variable identifier associated with the abnormal event stream. The confidence level of the abnormal event stream calculated based on predefined rules, model residuals, or statistical process control.

[0047] As a possible alternative, events are pushed to the central event stream processing engine in real time via a lightweight message middleware. The time of each node is synchronized via the NTP protocol to ensure global timing consistency.

[0048] S120: In this invention, the central event stream processing engine maintains a fixed length A sliding time window. New events are added to the window as they arrive, and events older than the window's oldest time are removed. The central event stream processing engine processes the event sequence within the window. Execute the causal discovery algorithm.

[0049] In one possible implementation, the execution of online causal discovery includes: To accommodate causal discovery algorithms, the continuous time axis is discretized into equally spaced time slots. For each variable... If multiple events occur within each time slot, their confidence levels are determined. Aggregation as a variable The activity level in that time slot. This ultimately yields a set of values ​​of length [missing information]. Multivariate time series .

[0050] Causal discovery algorithm for analyzing multivariate time series One preferred embodiment employs a PC algorithm based on conditional independence testing. The PC algorithm sequentially tests each pair of variables. Given other subsets of variables Conditional independence. If the independence hypothesis is rejected, then in the causal graph... Add edges or Another preferred implementation uses an algorithm based on transfer entropy to calculate variables. Historical information for predictor variables The future contribution of the contribution exceeding the threshold is considered to have a causal effect.

[0051] From the generated causal graph Extract all variables that end with the key control variable. The path. Here, key control variables refer to the controller inputs or outputs that directly participate in the control law calculation. From each key control variable... Start reverse traversal until the starting variable is found. Or reach the maximum search depth All paths found Constructing the initial candidate set of driving causal paths .

[0052] S130: In this invention, for For each path in the dataset, based on the original event information it contains, the underlying properties used for subsequent intensity assessment are calculated.

[0053] In one possible implementation, path attribute calculation includes: recording path sequences. Calculate path length Extract each event on the path confidence level and timestamp Calculate the initial average confidence level of path events. Calculate the maximum time interval between adjacent events on the path. ,in, , These are the events corresponding to adjacent variables on the path.

[0054] The above information is encapsulated into structured data, and the output is a set of driving causal paths. , as input to S200.

[0055] In a dynamic reconstruction method for control loops of causal inference of abnormal event flows, S200 receives... As input, by sequentially executing four layers of rigorous logical judgments, significant abnormal propagation paths that are truly threatening and require refactoring are filtered out.

[0056] Please refer to Figure 3 It illustrates a flowchart of step S200 in an exemplary dynamic reconstruction method for control loops of causal inference of anomaly event flow according to this application, the contents of which include: S210: In this invention, the first-level judgment is to screen the critical paths associated with the core controlled object at the endpoint. Specifically, the first-level judgment filters out paths where the endpoint variable involves a control loop but does not have a direct impact on the core process safety, quality, or equipment safety, thereby focusing on the most critical risks.

[0057] In one possible implementation, the execution of the first-level judgment includes: Based on process safety information, key product quality parameters, and equipment protection interlock lists, define and maintain a list of key controlled variables. .

[0058] for Each path in Obtain its endpoint variable .

[0059] if If the controller output variable OP is itself, then the control loop configuration library is queried directly to determine whether the final execution object manipulated by the controller output variable OP is used for regulation. A variable in [the system]. If so, then... This is the critical path.

[0060] if If it is a process variable PV, then trace the control loop to which the process variable PV belongs and determine whether the controller output variable OP of the control loop is ultimately used for regulation. The variables in. If so, then This is the critical path.

[0061] Based on the above analysis, from Filter out all endpoint associations The paths constitute a subset of key causal paths. Paths that fail the screening will be recorded but will not trigger subsequent refactoring processes.

[0062] S220: In this invention, the second-level judgment is to calculate the comprehensive causal strength of the critical path. Specifically, the second-level judgment... Each path in Calculate the path using the aforementioned formula Comprehensive causal strength This transforms qualitative judgments of causal relationships into comparable quantitative indicators.

[0063] In one possible implementation, the execution of the second-level judgment includes: for Read the path length calculated in S130. Initial average confidence level of path events and path Maximum time interval between adjacent events .

[0064] Calculate each intensity factor, specifically including: Path length factor: ; Average confidence factor, used directly ; Time coupling factor: Attenuation coefficient Set according to the typical system response time; According to preset weights Calculate the overall causal strength .

[0065] for Each path in Add the calculated value.

[0066] S230: In this invention, the third-level judgment is a preliminary strength screening based on a safety threshold. Specifically, the third-level judgment sets a strength safety threshold. ,Will Paths with moderate to high intensity were selected as potential high-risk paths.

[0067] In one possible implementation, the execution of the third-level judgment includes: A strength safety threshold is set by analyzing the intensity distribution of causal paths under normal operating conditions in the system's long-term historical operating data. .

[0068] Traversal Select all that satisfy The paths constitute a subset of high-intensity paths. .

[0069] if If the set is empty, it indicates that no path strength exceeds the safety threshold, the system determines that immediate reconstruction is unnecessary, and the process returns to S100 to continue monitoring. If If it is not empty, proceed to the fourth level of judgment.

[0070] S240: In this invention, the fourth layer of judgment is a recurrence stability verification. Specifically, the fourth layer aims to avoid overreacting to occasional, transient abnormal fluctuations, requiring high-intensity paths to appear stably over multiple consecutive control cycles to confirm their persistence and authenticity.

[0071] In one possible implementation, the execution of the fourth-level judgment includes: The system maintains a circular buffer to record the most recent... Identified within each control cycle Set, denoted as ,in This refers to the current cycle.

[0072] For the current cycle Each path in In the historical buffer zone Matching is performed within this framework. Matching requires not only identical variable sequences but also matching strength. Throughout historical cycles, it has been greater than .

[0073] statistics In continuous Number of occurrences within a period .

[0074] If there is at least one path ,That If the fourth-level judgment is true, then all four nested judgments have passed, the system officially activates the reconstruction preparation state, and records the set of paths that satisfy the repeatability condition as the trigger path set. The system will carry All related path information is entered into S300.

[0075] In a dynamic reconstruction method for control loops of causal inference of abnormal event flows, S300, in the reconstruction preparation state, is based on... The revealed anomaly propagation patterns are intelligently combined with predefined correction operations to form feasible reconstruction schemes, which are then verified for security in a virtual environment.

[0076] Please refer to Figure 4 It illustrates a flowchart of step S300 in an exemplary dynamic reconstruction method for control loops of causal inference of anomaly event flow according to this application, the contents of which include: S310: In this invention, for Multi-dimensional feature extraction is performed on the path to provide a basis for subsequent matching and reconstruction actions.

[0077] In one possible implementation, for Multi-dimensional feature extraction of the path includes: Identify the starting point of the path Type, intermediate transit nodes, and destination The type of anomaly helps determine whether it originates from the measurement, control calculation, or execution stage.

[0078] Analyze the timestamp sequence of events along the path to determine whether it is a sudden anomaly or a gradual drift.

[0079] By combining the factory information model, we can analyze the physical equipment, control loops, and process units to which the variables in the path belong.

[0080] Based on the analysis results, the problems are categorized into one or more reconstruction dimensions, such as: signal source correction, control law adjustment, execution path switching, and logic association optimization.

[0081] S320: In this invention, the system maintains a pre-set library of atomic actions. Each atomic action It is an atomic, independently executable and reversible control system modification instruction, for example: a1:Set_PID_Mode('TIC101','MANUAL'), a2:Switch_Input('FIC202.PV','FT202B'), a3:Adjust_Param('PIC301.Kp',+0.15).

[0082] In one possible implementation, the process of intelligently matching and combining actions from the atomic action library is as follows: Based on the reconstruction dimensions summarized in S310, in Search for candidate actions that match the tags. Searches can be based on keywords, semantic similarity, or relevance to historical success cases.

[0083] according to The strength, scope of influence, and dependencies between actions in the intermediate path are used to combine one or more selected atomic actions into an ordered refactoring strategy package. The strategy refactoring package includes the execution object, parameters, expected effect, and timing or logical constraints between actions for each action.

[0084] right Perform static analysis to check for resource conflicts or missing logical dependencies between actions.

[0085] S330: In this invention, before performing modifications to the real system, it is necessary to perform modifications in a high-fidelity virtual environment. Conduct simulations to evaluate its effectiveness and safety.

[0086] In one possible implementation, the execution of virtual pre-visualization verification includes: Call upon a digital twin model that matches the current real control system.

[0087] Load the current system state snapshot into the virtual environment as the initial condition. Execute sequentially. The actions within. Simulate running the simulation in a virtual environment at accelerated or real-time speed for a sufficiently long period of time.

[0088] During and after the simulation, monitor whether the original abnormal event stream disappears and the key controlled variables. The dynamic response, whether all process variables are always within the safe operating range, and whether new, high-intensity abnormal event flows or causal paths have been generated.

[0089] The system only approves the evaluation if the results meet all predefined success criteria. Proceed to the actual deployment phase. Otherwise, the system will reject the assembled refactoring strategy package and generate a rehearsal failure report, optionally returning to S320 to regenerate the strategy or triggering manual intervention.

[0090] In a dynamic reconfiguration method for control loops based on causal inference of abnormal event flows, the S400 is responsible for safely and smoothly deploying the validated reconfiguration strategy package into the real control system and implementing strict monitoring during the migration process to ensure that the process is under control.

[0091] Please refer to Figure 5 It illustrates a flowchart of step S400 in an exemplary abnormal event flow causal inference control loop dynamic reconstruction method of this application, the contents of which include: S410: In this invention, for Each atomic action in Define clear operational boundaries as hard constraints for its execution in a real system.

[0092] In one possible implementation, the setting of safety boundary constraints includes: For parameter adjustment actions, set upper and lower limits for allowed adjustments.

[0093] For mode switching actions, set the prerequisite states that allow switching.

[0094] Set the maximum waiting time and the number of retries for each action. Predefine the action-level rollback trigger conditions.

[0095] Attach the above constraints to This forms a refactoring strategy package with safety constraints. .

[0096] S420: In this invention, in order to avoid the impact of control output jumps on the production process, the switching between the old and new control structures is controlled by an S-shaped (Sigmoid) function and is completed smoothly over multiple cycles.

[0097] In one possible implementation, the migration between the old and new control structures includes: Determine the total number of migration cycles . It depends on the main time constant of the process. Set the shape parameters of the sigmoid function. ,Pick To make the migration smooth.

[0098] During the migration control initialization phase, the migration cycle counter is set. The current control structure is the old structure. .

[0099] For each from 1 to migration cycle : a. Calculate the current mixing coefficient .

[0100] b. Obtain The expected new control structure after all actions take effect .

[0101] c. Calculate the actual control action to be applied in the current period. .

[0102] d. will Apply to the actual control loop.

[0103] e. Wait for one migration cycle duration.

[0104] f. According to the migration cycle The execution migration cycle of the AE program. .

[0105] when hour, , The migration is complete, and the system is now fully operational under the new architecture.

[0106] S430: In this invention, during the entire migration process, the system performs lightweight anomaly stream monitoring and causal strength calculation in parallel to determine in real time whether the migration has introduced new risks.

[0107] In one possible implementation, a separate monitoring thread operates concurrently with the migration cycle. At a considerable frequency, execute the S100 and S230 logic, namely, collect events, perform rapid causal inference, and calculate the strength of emerging paths. .

[0108] In one possible implementation, the freezing condition is: whether a new path exists. Newborn Path Overall causal strength Exceeding the safety threshold .

[0109] Once the freeze condition is triggered, the system immediately freezes the migration process. In one possible implementation, the freeze operation includes: stopping the migration cycle counter. Increase; maintain the current mixing coefficient This keeps the control action stable in the current intermediate state. ;pause Further implementation of actions that have not yet fully taken effect.

[0110] After freezing, the system immediately jumps to S200 with all current state information and restarts the four-layer nested judgment process. This judgment will also consider the original triggering path. And new student pathways.

[0111] In a dynamic reconstruction method for control loops of causal inference of abnormal event flow, after the S500 completes the reconstruction migration, it enters the effect confirmation and experience learning stage, forming a complete link of diagnosis, reconstruction and learning.

[0112] Please refer to Figure 6 It illustrates a flowchart of step S500 in an exemplary abnormal event flow causal inference control loop dynamic reconstruction method of this application, the content of which includes: S510: In this invention, after the S-shaped function migration is successfully completed, i.e., no freeze is triggered and the destination is reached smoothly. The system does not immediately terminate the task, but instead enters a predetermined observation period. The observation period should be long enough to cover the main dynamics and possible disturbance cycles of the process.

[0113] In one possible implementation, the effect determination logic is as follows: If throughout the entire predetermined observation period If all of the following conditions are met, the refactoring is considered successful: a. The original triggering event stream has completely disappeared.

[0114] b. No occurrence of the trigger path set New high-intensity (same or similar patterns) ) Causal path.

[0115] 3. Key controlled variables The operating indicators have returned to an acceptable level.

[0116] If throughout the entire predetermined observation period If any of the following conditions occur, the reconstruction is deemed to have failed: a. The original triggering event stream continues or occurs periodically.

[0117] b. A completely new, high-strength ( ) abnormal patterns.

[0118] S520: In this invention, for successfully determined reconstruction cases, their strategy package and scenario information are transformed into reusable knowledge and stored in the system knowledge base.

[0119] Specifically, the complete context of this reconstruction is encoded to generate a scene feature vector. The scene feature vector includes: a set of trigger paths. The topological features, process semantic labels of key variables, and the steady-state operating point of the system before reconfiguration, etc., will be used to validate the reconfiguration strategy package with safety constraints. The scene-policy pair is associated with the scene feature vector and tagged with a success label, timestamp, and performance score. This scene-policy pair is then stored as a new record in the refactoring case library, which is an extension of the atomic action library.

[0120] S530: In this invention, for reconstruction cases where failure is determined, the system automatically executes strategy rollback and learning loop, and uses failure information to optimize subsequent decisions.

[0121] Specifically, the system initiates an automatic rollback procedure. The rollback process employs a smoother transition curve than forward migration, restoring the control structure from its current state to its original state before reconstruction. After the rollback is complete, the system meticulously records the full log of this failure and restarts from step S100 to continue collecting and analyzing the abnormal event stream. At this point, due to the rollback, the system state has largely recovered, but the root cause of the anomaly may still be present. Therefore, a new round of diagnosis will be based on updated information. Simultaneously, in the subsequent step S320, the matching algorithm references this failure case to avoid recommending policy combinations that have proven ineffective or harmful, thereby achieving continuous adaptive learning and optimization of the system.

[0122] Example 2: This invention was deployed and validated over a nine-month period in the main steam temperature control system of a large thermal power plant. The system comprises four boilers, each with main steam temperature control involving cascaded PID loops, multiple desuperheating water regulating valves, and feedforward compensation logic. The monitoring scope covers over 500 relevant variables. The specific configuration used during implementation is as follows: A data acquisition agent is deployed on the DCS engineering station of each boiler to read approximately 3,000 data points in real time via the OPCDA interface, with a sampling period of 1 second. The event generation rule base contains more than 80 rules for situations such as large temperature deviations, frequent valve actions, cascade loop decoupling, and actuator failures.

[0123] The edge computing server uses a time window W=90 seconds and employs a lightweight causal discovery algorithm based on VAR-LiNGAM, performing inference every 30 seconds. The overall causal strength weight is set to... Safety threshold .

[0124] A dedicated atomic action library for the temperature control loop is pre-built, containing 45 actions in 12 categories, such as switching the primary PID controller to the backup parameter group, adjusting the integral time of the secondary PID controller, modifying the upper limit of the desuperheating water valve position, and enabling / disabling a certain feedforward signal. The virtual environment is based on a high-precision boiler-turbine model built with MATLAB / Simulink.

[0125] Total number of migration cycles Based on the large inertia characteristic of the temperature-sensitive object, the S-shaped function parameter is set to 40. Safety boundaries strictly adhere to the temperature and pressure change rate limits specified in the boiler operating procedures.

[0126] During the trial operation, the system successfully and automatically handled several typical anomalies: 1. Case 1: Temperature sensor drift causes control oscillation; The main steam temperature display value on side A of boiler #5 exhibited low-frequency periodic fluctuations, causing frequent operation of the desuperheating water regulating valve. The system identified a short path originating from the faulty temperature measuring point TT0101.PV, with path strength... This occurred for three consecutive cycles. The matching action switched the input of the master PID controller from TT0101 to the redundant measuring point TT0102 at the same location, and verified in a virtual environment that the switching process would not cause a sudden temperature change. After approval, an S-shaped migration was executed. After the migration was completed, the temperature fluctuation disappeared and the valve action returned to normal frequency after 2 hours of observation. This single-point sensor switching strategy was marked and stored in the case library.

[0127] 2. Case 2: Slight sticking of the desuperheating water regulating valve caused cascade circuit mismatch; A slight jamming occurred in the desuperheating water regulating valve CV0202 on the B side of boiler #2, causing a slow response in the secondary loop and a gradual drift in the main steam temperature. The causal path points to an abnormal relationship between CV0202.OP and CV0202.PV, with path strength... Furthermore, it is strongly correlated with load variation conditions. The system combines two actions: a) temporarily changing the secondary loop PID control mode to manual with dead-zone compensation; b) slightly increasing the output bias of the primary PID controller in the DCS logic to manually compensate for flow. Virtual simulation shows that this combination can stabilize the temperature. After the strategy is deployed, temperature drift is suppressed. The system also generates a maintenance work order prompting the inspection of valve CV0202. This manual compensation + mode switching combination strategy is entered into the database as a composite action.

[0128] 3. Case Study 3: Insufficient feedforward compensation under fuel calorific value fluctuations; During the coal batch replacement, the dynamic response of the main steam temperature of Boiler #3 to load changes deteriorated, and the overshoot increased. The system identified multiple paths originating from boiler main control commands and ending at main steam temperature deviations with significantly increased intensity within specific load ranges, forming a cluster of sensitive operating conditions. The matching action dynamically enhanced the feedforward compensation coefficient related to the main steam flow rate. A virtual environment was used to optimize and pre-simulate the coefficients. During the S-shaped migration to cycle 15, the monitoring thread detected a brief temperature disturbance caused by other reasons, resulting in a new path intensity... The system immediately froze the migration. After returning to S200 for reassessment, it was determined that the new disturbance was caused by a known brief operation, and the disturbance disappeared after 10 minutes. The system unfroze and continued to complete the remaining migration. The migration was finally completed, and under the new fuel conditions, the temperature control quality was improved. This case verifies the effectiveness of the migration monitoring and freezing mechanism.

[0129] Implementation Results Statistics: The accuracy rate of identifying driving abnormal paths reached 96.8%.

[0130] The average time from anomaly salience to the refactoring strategy package being ready is 65 seconds.

[0131] The virtual rehearsal successfully intercepted two aggressive reconstruction strategies that could have caused the boiler metal thermal stress to exceed the limit.

[0132] By employing S-shaped function migration, the maximum instantaneous rate of change of main steam temperature during the reconstruction process is reduced by approximately 70% compared to the traditional direct switching method, significantly improving the unit's operational safety.

[0133] Through the accumulation of case libraries, the system has reduced the time for repeated diagnosis and strategy generation of similar anomalies by more than 50%.

[0134] During the project, three instances of main protection actions or unplanned shutdowns that could have been caused by untimely handling of anomalies were avoided, demonstrating the significant value of this invention in enhancing the resilience and autonomy of industrial control systems.

[0135] In particular, in Case 3, the migration freeze and reassessment mechanism successfully avoided overreaction to transient operational disturbances, demonstrating the robustness and practicality of the method in complex industrial environments. The optimized feedforward coefficient strategy accumulated by the system is automatically recommended and applied when replacing the same batch of coal in subsequent applications, achieving effective knowledge transfer and reuse.

[0136] Example 3: A system for dynamically reconstructing control loops for causal inference of abnormal event flows includes: The multi-source event acquisition and causal inference module is used to acquire multi-source abnormal event streams generated during the operation of industrial control systems in real time, perform online lightweight causal inference on event sequences within the most recent time window, and identify driving causal paths ending with controller input or output variables. The multi-layer path evaluation and decision-making module is used to initiate a four-layer nested judgment mechanism for the identified driving causal path. The reconstruction preparation state is activated only when all four judgments are true. The refactoring strategy generation and verification module is used to match and combine multiple basic refactoring actions from a pre-set atomic action library to form a refactoring strategy package based on the structure, variables and temporal characteristics of the current driving causal path in the refactoring preparatory state; it performs pre-rehearsal verification in a virtual environment and approves execution only when the verification is successful; The safe migration deployment module is used to set safe boundary constraints for each action in the refactoring strategy package, and deploy the strategy package to the real control loop under the constraints; control the new and old control structures to migrate slowly over multiple cycles according to an S-shaped function; if a new high-intensity driving causal path is detected during the migration process, the transition migration is immediately frozen, triggering the multi-layer path evaluation and decision module to re-evaluate; The monitoring feedback and knowledge learning module is used to monitor the abnormal event flow within a predetermined time scale after the refactoring deployment. If the abnormal event flow disappears, the verified refactoring strategy package is marked as steady state and included in the atomic action library after scenario tagging. If the abnormality still exists or a new abnormal pattern appears, the strategy rollback is triggered, and the multi-source event collection and causal inference module is restarted to form an adaptive refactoring loop.

[0137] Those skilled in the art will understand that the embodiments of this application are provided as methods, systems, or computer program products. Therefore, this application takes the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application takes the form of a computer program product implemented on one or more computer storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer program code. The solutions in the embodiments of this application are implemented using various computer languages, exemplified by the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0138] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, are implemented by computer program instructions. These computer program instructions are provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0139] These computer program instructions are also stored in a computer read-memory memory (CROM) that can direct a computer or other programmed data processing device to operate in a specific manner, such that the instructions stored in the CROM produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0140] These computer program instructions are also loaded onto a computer or other programmed data processing device, causing a series of operational steps to be performed on the computer or other programmed device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmed device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0141] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0142] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An abnormal event stream causal inference control loop dynamic reconstruction method, characterized in that, The method comprises the following steps: Real-time acquisition of multi-source abnormal event streams generated during the operation of an industrial control system, online lightweight causal inference on the event sequence of the multi-source abnormal event streams, identification of driving causal paths with controller input or output variables as the terminal point; For the identified driving causal paths, a four-layer nested judgment mechanism is started, and only when the four-layer judgment is established, the reconstruction preparation state is activated; Among them, the first layer judgment mechanism is to screen the key causal paths related to the terminal associated controlled variables; The second layer judgment mechanism is to calculate the comprehensive causal strength of each path; The third layer judgment mechanism is to judge whether there is a path strength exceeding a preset safety threshold; The fourth layer judgment mechanism is to verify whether the path exceeding the threshold value appears twice or more in a continuous number of cycles; In the reconstruction preparation state, according to the structure, variable and time sequence characteristics of the current driving causal path, multiple basic reconstruction actions are matched and combined from the pre-set atomic action library to form a reconstruction strategy package; pre-rehearsal verification is carried out in a virtual environment, and only when the verification is successful, execution is approved; Safety boundary constraints are set for each action in the reconstruction strategy package, and the strategy package is deployed to the real control loop under the constraints; the new and old control structures are changed in a plurality of cycles by using an S-shaped function; if a new high-strength driving causal path is detected during the transition migration, the transition migration is immediately frozen, and the four-layer nested judgment mechanism is restarted for re-evaluation; After the reconstruction and deployment, the abnormal event stream is monitored within a predetermined time scale; if the abnormal event stream disappears, the verified reconstruction strategy package is marked as a steady state, and after being labeled by a scene, it is included in the atomic action library; if the abnormality still exists or a new abnormal pattern appears, the strategy rollback is triggered, and the causal inference and evaluation cycle is restarted to form an adaptive reconstruction mechanism.

2. The control loop dynamic reconfiguration method of abnormal event stream causality inference according to claim 1, characterized in that, The online lightweight causal inference on the event sequence of the multi-source abnormal event streams comprises: Deploying a data acquisition agent at a key position of the system to collect controller process variables, set values, control outputs, network messages and system log data; Based on a preset rule or model, the collected data is determined for abnormality to generate a uniform abnormal event triple; the abnormal event triple comprises a timestamp, a variable identifier and a confidence degree; The abnormal event stream is pushed to a central processing engine, in a sliding time window, a continuous time axis is discretized into equally spaced time slots, and the confidence degrees of multiple events of each variable in the time slots are aggregated to form a multivariate time series; A causal discovery algorithm is used to analyze the multivariate time series, generate a directed causal graph, and extract all driving causal path candidates with key control variables as the terminal point from the directed causal graph.

3. The control loop dynamic reconfiguration method of abnormal event stream causality inference according to claim 1, characterized in that, The first layer judgment mechanism specifically comprises: According to the process safety information, the key product quality parameters and the equipment protection interlocking list, a list of key controlled variables is defined and maintained; For each path in the set of driving causal paths, the terminal variable is obtained; If the terminal variable is a controller output variable, the control loop configuration library is queried to determine whether the final execution object operated by the controller output variable is used to adjust the variables in the list of key controlled variables; If the end-point variable is a process variable, trace back to the control loop to which the end-point variable belongs, and determine whether the output of the controller of the control loop is finally used to adjust a variable in the list of key controlled variables; Screen the paths of the first layer judgment mechanism into a subset of key causal paths.

4. The control loop dynamic reconfiguration method of abnormal event stream causality inference according to claim 3, characterized in that, In the second layer judgment mechanism, the comprehensive causal strength of each path is calculated The calculation formula is: ; wherein is a path length factor, , is a path length; is an average confidence factor, , is an initial average confidence of a path event, is a time coupling tightness factor, , is a path maximum time interval of adjacent events on the path, is a decay coefficient, are weight coefficients of corresponding factors respectively, and satisfy .

5. The control loop dynamic reconfiguration method of abnormal event stream causality inference according to claim 4, characterized in that, The third layer judgment includes: The intensity safety threshold is set by analyzing the intensity distribution of the causal path under normal working conditions in long-term historical operation data of the system ; Traverse the key causal path subset, select all paths that meet The high-strength path subset is composed of the paths that meet If the subset of high-intensity paths is empty, it indicates that there is no path with intensity exceeding the safety line, and the system determines that immediate reconstruction is not needed, and the process continues to monitor. If the subset of high-intensity paths is not empty, the fourth layer judgment is entered.

6. The control loop dynamic reconfiguration method of abnormal event stream causality inference according to claim 5, characterized in that, The fourth layer judgment mechanism includes: The system maintains a ring buffer of the subset of high-intensity paths identified in a number of control cycles; For each path in the high intensity path subset of the current cycle, a match is made in the history buffer, the match condition including the same sequence of variables and their intensity in each history cycle exceeding the intensity safety threshold ; The number of times a path appears in a number of consecutive cycles is counted; If there is at least one path that satisfies the condition that the number of appearances is greater than or equal to 2, the fourth layer judgment is established, the reconstruction preparation state is activated, and the path set that satisfies the condition is recorded as a trigger path set.

7. The control loop dynamic reconfiguration method of abnormal event stream causality inference according to claim 1, characterized in that, In the reconstruction preparation state, a reconstruction strategy package is formed by matching and combining a plurality of basic reconstruction actions from a preset atomic action library according to the structure, variable, and timing characteristics of the current driving causal path, including: Deep feature extraction is performed on the paths in the trigger path set, including identifying the types of start and end point variables, analyzing event timestamp sequences to determine abnormal patterns, and analyzing variables belonging to physical devices and control loops in combination with a factory information model; Based on the extracted features, the abnormality is induced into at least one reconstruction dimension of signal source correction, control law adjustment, execution path switching, and logic association optimization; Based on the reconstruction dimension label, semantic similarity, or historical successful case correlation, a matching atomic action is retrieved from the preset atomic action library; the atomic action is a control system modification instruction that can be independently executed and reversed. According to the path intensity, influence range, and action dependence relationship, a plurality of atomic actions are combined into an ordered reconstruction strategy package, and the reconstruction strategy package is subjected to static conflict and dependence analysis.

8. The control loop dynamic reconfiguration method of abnormal event stream causality inference according to claim 7, characterized in that, The pre-verification is performed in a virtual environment, and execution is approved only when the verification is successful, including: A digital twin model matching the real control system is called; The current real system state snapshot is loaded into the virtual environment as the initial condition; The actions in the reconstruction strategy package are executed in the virtual environment in sequence, and the simulation is run for a predetermined time at an accelerated or real-time speed; It is monitored whether the original abnormal event flow disappears, the dynamic response of the key controlled variable meets the standard, all process variables are in the safe operation interval, new high-intensity abnormal event flows or causal paths are generated during and after the simulation; Only when all the pre-defined success criteria are met, the reconstruction strategy package is approved to enter the real deployment stage.

9. The control loop dynamic reconfiguration method of abnormal event stream causality inference according to claim 1, characterized in that, Safety boundary constraints are set for each action in the reconstruction strategy package, and the strategy package is deployed to the real control loop under the constraints; the new and old control structures are gradually transitioned using an S-shaped function over multiple cycles, including: Safety boundary constraints are defined for each atomic action in the reconstruction strategy package, including parameter adjustment upper and lower limits, mode switching prerequisite states, execution timeout times, failure retry times, and rollback trigger conditions, to form a reconstruction strategy package with safety constraints; determining a total number of migration cycles, calculating a mixing coefficient for each migration cycle based on a sigmoid function : wherein, is a shape parameter; is a total number of migration cycles, is a current migration cycle; At each migration cycle, the actual effective control action is calculated and applied to the real control loop when , , , migration is completed and the system is fully operational under the new structure; wherein wherein is the old control structure output, is the new control structure output; During the migration process, a lightweight abnormal event stream monitoring and causal strength calculation are performed in parallel. If the integrated causal strength of the new-born path exceeds the safety threshold, the migration is immediately frozen, the current mixing coefficient and control action are maintained, and the four-layer nested judgment mechanism is returned to re-evaluate.

10. The control loop dynamic reconfiguration method of abnormal event stream causality inference according to claim 1, characterized in that, After the reconstruction deployment, the abnormal event stream is monitored within a predetermined time scale; if the abnormal event stream disappears, the verified reconstruction strategy package is marked as a steady state, and is included in the atomic action library after being tagged by the scene; If the abnormality still exists or a new abnormal pattern appears, the strategy rollback is triggered, and the causal inference and evaluation cycle is restarted, including: After the successful completion of the migration, a predetermined observation period is entered, and the original abnormal event stream is continuously monitored to determine whether it disappears, whether a new high-intensity path with the same or similar pattern as the original trigger path set appears, and whether the key controlled variable operation index is restored; If all the monitoring conditions are met during the observation period, it is determined that the reconstruction is successful, the reconstructed trigger path set topology features, variable process semantic tags, and system steady-state working point are encoded as a scene feature vector, and the successful reconstruction strategy package with safety constraints is associated with the scene feature vector and stored in the reconstruction case knowledge base; If a new high-intensity abnormal pattern appears during the observation period, it is determined that the reconstruction fails, and an automatic rollback program is started to restore the control structure to the pre-reconstruction state by using a smooth transition curve; After the rollback is completed, the failure log is recorded, a new round of diagnosis and reconstruction cycle is started from the real-time acquisition and causal inference steps, and the failed strategy combination is avoided in the subsequent action matching, realizing the continuous adaptive learning of the system.

11. A system for dynamic reconfiguration of control loops for anomaly event stream causal inference of the method according to any of claims 1-10, characterized in that the system It includes: A multi-source event acquisition and causal inference module for real-time acquisition of multi-source abnormal event streams generated during the operation of an industrial control system, performing online lightweight causal inference on event sequences within a recent time window, and identifying driving causal paths with controller input or output variables as endpoints; A multi-layer path evaluation and decision module for identifying driving causal paths, starting a four-layer nested judgment mechanism, and activating a reconstruction preparation state only when the four-layer judgment is true; A reconstruction strategy generation and verification module for matching and combining multiple basic reconstruction actions from a pre-configured atomic action library based on the structure, variable, and timing characteristics of the current driving causal path in the reconstruction preparation state, forming a reconstruction strategy package; only when the verification is successful, the execution is approved; A safe migration deployment module for setting safety boundary constraints for each action in the reconstruction strategy package, deploying the strategy package to the real control loop under the constraints, and controlling the new and old control structures to migrate gradually over multiple periods according to an S-shaped function; If a new-born high-intensity driving causal path is detected during the migration process, the transition migration is immediately frozen, and the multi-layer path evaluation and decision module is triggered to re-evaluate; A monitoring feedback and knowledge learning module for monitoring the abnormal event stream within a predetermined time scale after the reconstruction deployment; If the abnormal event stream disappears, the verified reconstruction strategy package is marked as a steady state, and is included in the atomic action library after being tagged by the scene; If the anomaly still exists or a new anomaly pattern appears, the strategy rollback is triggered, the multi-source event collection and causal inference module is restarted, and an adaptive reconstruction cycle is formed.

Images