Edge-computing-based industrial instrument data real-time analysis method and system

Abstract

This invention relates to the field of industrial instrument data processing technology, specifically to a method and system for real-time analysis of industrial instrument data based on edge computing. The method includes: deploying data acquisition units at edge nodes to acquire raw monitoring data streams; generating standardized data sequences with associated acquisition timestamps after format unification and timestamp alignment; setting physical thresholds and variation patterns based on an industrial process knowledge base; performing real-time compliance verification on the standardized data sequences; and marking abnormal data points and related information. Spatiotemporal clustering analysis is performed on the abnormal data points to identify abnormal data clusters and generate anomaly event description files containing the number of data points within each cluster, the time span, and the identifiers of the industrial instruments involved. The standardized data sequences, compliance verification results, and anomaly event description files are compressed and encrypted before being uploaded to the cloud. This method achieves accurate anomaly verification and clustering analysis at the edge, adapting to the real-time processing needs of industrial instrument data.

Description

Technical Field

[0001] This invention relates to the field of industrial instrument data processing technology, and in particular to a method and system for real-time analysis of industrial instrument data based on edge computing. Background Technology

[0002] Current industrial instrument data processing largely adopts a centralized cloud-based processing model, with edge nodes only handling raw data acquisition and forwarding. Data compliance verification relies solely on a single physical threshold, failing to incorporate industrial process knowledge bases to define parameter change patterns. Anomaly data marking merely records the data's state without associating it with the corresponding acquisition time and data source identifier. Anomaly data processing only provides single-point anomaly alarms, lacking cluster analysis across time and space dimensions. It cannot identify densely distributed anomaly data clusters, nor does it generate structured anomaly event description files containing data volume, time span, and instrument identifiers. Data upload only performs basic processing on the raw data stream, without integrating verification results and anomaly event files for customized compression and encryption.

[0003] Centralized cloud processing results in long data transmission links, limiting real-time analysis response speed. Single threshold verification cannot match the dynamic changes in industrial parameters, leading to poor adaptability of anomaly judgment results to actual operating conditions. Anomaly data lacks temporal and data source correlation information, hindering rapid anomaly source location. Single-point anomaly alarms cannot distinguish between scattered and clustered anomalies, easily generating invalid alarm information. The lack of standardized anomaly event files prevents the complete retention of anomaly aggregation characteristics. Data transmission does not integrate effective information, and transmission efficiency and data security cannot meet the needs of industrial sites. Therefore, it is necessary to rely on an industrial process knowledge base to achieve dual verification of physical thresholds and change patterns, marking anomaly correlation information. Spatiotemporal aggregation analysis of anomaly data is required to generate dedicated anomaly event description files. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a real-time analysis method and system for industrial instrument data based on edge computing.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a real-time analysis method for industrial instrument data based on edge computing, comprising: Data acquisition units are deployed at edge nodes close to industrial instruments to continuously acquire raw monitoring data streams generated by industrial instruments. The original monitoring data stream is formatted and timestamp aligned to generate a time-synchronized standardized data sequence. Each data point in the time-synchronized standardized data sequence is associated with a collection time and a data source identifier. Based on the industrial process knowledge base, the physical threshold range and variation law of key monitoring parameters are defined. Based on the physical threshold range and variation law, the standardized data sequence of time synchronization is checked in real time for compliance. Abnormal data points that exceed the physical threshold range or violate the variation law are marked, along with their associated collection time and data source identifier. Cluster analysis is performed on the marked abnormal data points to identify abnormal data clusters that appear densely in time or space. An abnormal event description file is generated for each identified abnormal data cluster, which includes the number of data points in the cluster, the time span, and the industrial instrument identifiers involved. The time-synchronized standardized data sequence, compliance verification results, and abnormal event description files are processed according to a preset compression and encryption strategy and then uploaded to the cloud analysis platform via the edge network.

[0006] As a further aspect of the present invention, the original monitoring data stream is subjected to format unification and timestamp alignment processing to generate a time-synchronized standardized data sequence, including: The raw monitoring data stream contains time-series measurements collected by multiple types of sensors; Each data packet in the original monitoring data stream is parsed to extract the sensor type code, the original measurement value, and the original timestamp generated by the local clock of each sensor. According to the preset sensor type encoding-data format mapping table, the original measurement values ​​of different sensor types are converted into standard format measurement values ​​with uniform physical units and numerical accuracy; Obtain the global reference time from the network time protocol service of the edge node, and calculate the clock offset between the original timestamp of each data source and the global reference time; The original timestamps of all data sources are corrected using the clock offset to ensure that the acquisition time of all data points is based on the global reference time. After the data has undergone format conversion and timestamp correction, it is sorted and merged according to its corrected acquisition time to form a unified, time-synchronized standardized data sequence.

[0007] As a further aspect of the present invention, real-time compliance verification is performed on the time-synchronized standardized data sequence based on the physical threshold range and its variation pattern, including: From the industrial process knowledge base, load the set of compliance rules for the key monitoring parameters corresponding to the currently monitored industrial process stage, the set of compliance rules including static threshold rules and dynamic trend rules; The standard format measurement values ​​in the time-synchronized standardized data sequence are compared point by point with the upper and lower limits defined in the static threshold rules; A sliding window calculation is performed on the time-synchronized standardized data sequence. Within the sliding window, the rate of change of the standard format measurement values ​​is analyzed, and the calculated rate of change is compared with the maximum allowed rate of change in the dynamic trend rule. When any standard format measurement value exceeds the corresponding upper or lower limit value, it is determined to be a threshold anomaly, and the standard format measurement value, its acquisition time, data source identifier, and the threshold rule violated are recorded. When the rate of change calculated within any sliding window exceeds the maximum rate of change, it is determined to be an abnormal trend, and the start and end times of the sliding window, the sequence segments involved, and the trend rules violated are recorded.

[0008] As a further aspect of the present invention, the step of performing cluster analysis on the marked anomalous data points to identify anomalous data clusters that appear densely in the time or spatial dimension includes: Collect all labeled threshold anomalies and trend anomalies within the preset analysis time window as a candidate anomaly dataset; For the candidate anomaly dataset, time clustering analysis is performed based on the collection time, and anomalies with similar collection times and time intervals less than the time clustering threshold are grouped into the same time anomaly cluster. For the candidate anomaly dataset, spatial clustering analysis is performed based on the physical location corresponding to the data source identifier, and anomaly points that are physically adjacent and whose spatial distance is less than the spatial clustering threshold are grouped into the same spatial anomaly cluster. Calculate the number of anomalous points contained in each of the time anomaly clusters, as well as the start and end times of the time anomaly clusters; Calculate the number of anomalous points contained in each of the spatial anomaly clusters, as well as the center coordinates and radius of the physical area covered by the spatial anomaly clusters; The temporal anomaly clusters and spatial anomaly clusters that meet the preset density conditions are identified as the anomalous data clusters with analytical value.

[0009] As a further aspect of the present invention, it also includes a step of performing local real-time feature extraction on the time-synchronized standardized data sequence at the edge node: The time-synchronized standardized data sequence is divided into continuous data segments using a sliding time window. For each data segment, the standard format measurement values ​​are calculated to have statistical characteristics, including the mean, maximum, minimum, standard deviation, and approximate entropy of the data segment. For each data segment, perform a fast Fourier transform and extract the amplitude and frequency of the main frequency components from the transform results; The statistical features calculated for each data segment are combined with the amplitude and frequency of the extracted main frequency components to form a multidimensional feature vector for the data segment. The multidimensional feature vectors of all data segments generated in chronological order, along with the start and end time identifiers of the corresponding data segments, are encapsulated into a local feature data stream. The calculation of statistical characteristics for standard format measurements within each data segment specifically includes: The average value is obtained by summing all standard format measurements within the data segment and dividing by the total number of data points. Traverse all standard format measurement values ​​within the data segment, find the maximum and minimum values, and use them as the maximum and minimum values, respectively. Based on the average value, the mean of the sum of squares of the differences between all standard format measurements and the average value is calculated, and then the square root is taken to obtain the standard deviation. Based on the symbolic dynamics method, the approximate entropy value of the standard format measurement value sequence within the data segment is calculated to measure the complexity of the sequence.

[0010] As a further aspect of the present invention, it also includes a deep correlation analysis and model update step performed on a cloud-based analytics platform: Receives standardized data sequences for time synchronization, compliance verification results, abnormal event description files, and local feature data streams uploaded from multiple edge nodes; Cross-node data fusion is performed on the time-synchronized standardized data sequences uploaded from different edge nodes that are correlated in time, to reconstruct a global industrial process status view; Based on the global industrial process status view, root cause analysis is performed on the received abnormal event description files to explore the causal or temporal correlation between abnormal data clusters across multiple edge nodes. Using historically accumulated time-synchronized standardized data sequences, anomaly event description files, and root cause analysis results, train or update the machine learning model for anomaly prediction, and generate updated anomaly prediction model parameters. The updated anomaly prediction model parameters, along with the optimized compliance rules generated based on root cause analysis, are then distributed to the corresponding edge nodes.

[0011] As a further aspect of the present invention, based on the global industrial process status view, root cause analysis is performed on the received abnormal event description file, including: From the global industrial process status view, extract the operating data sequence of all relevant industrial instruments within the time span and industrial instrument identification range recorded in the abnormal event description file; Analyze the operational data sequence to find whether there were any leading changes or disturbances in specific parameters or specific devices before the occurrence of the abnormal data clusters; Based on the physical principles and topological connections of the industrial process, determine whether the leading change or disturbance is sufficient to logically deduce the subsequent abnormal data cluster; If a logical deduction relationship exists, the parameters, devices, and change characteristics corresponding to the leading change or disturbance shall be recorded as potential root causes in the abnormal event description file. Summarize the potential root causes from all abnormal event description files and generate a root cause analysis report.

[0012] As a further aspect of the present invention, the step of training or updating the machine learning model for anomaly prediction using historically accumulated time-synchronized standardized data sequences, anomaly event description files, and root cause analysis results includes: The time-synchronized standardized data sequence or the feature data extracted from it is used as the model input features; The anomaly type marked in the anomaly description file or the root cause type determined by the root cause analysis report is used as the model training label. A deep neural network containing multiple hidden layers is constructed as the basic architecture of the machine learning model; The machine learning model is trained using labeled historical data to optimize model parameters, enabling the model to predict the type or probability of anomalies occurring within a specific future time window based on the characteristics of the input data. Evaluate the prediction accuracy and recall of the trained machine learning model on the validation dataset, adjust the model structure or parameters based on the evaluation results, and generate the updated anomaly prediction model parameters that meet the performance requirements.

[0013] As a further aspect of the present invention, the processing according to a preset compression and encryption strategy includes: The standardized data sequence for time synchronization, compliance verification results, and abnormal event description files that need to be uploaded are compressed using a dictionary-based general lossless compression algorithm to reduce data volume. The compressed data is encrypted using a symmetric encryption algorithm with a session key securely obtained from the cloud, generating ciphertext data. Generate a data integrity check code for the encrypted data, and append the data integrity check code to the encrypted data; The encrypted data, with an appended data integrity check code, is encapsulated into a data packet conforming to the edge-cloud communication protocol, ready for upload.

[0014] As a further aspect of the present invention, the present invention also includes an industrial instrument data real-time analysis system based on edge computing, the system including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, it implements the steps of the industrial instrument data real-time analysis method based on edge computing as described above.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are as follows: Based on the industrial process knowledge base, the physical threshold range and variation pattern of key monitoring parameters are defined. Real-time compliance verification is performed on standardized data sequences that have unified format, timestamp alignment, and are associated with collection time and data source identifier. Abnormal data points that exceed the physical threshold or violate the variation pattern are marked along with their collection time and data source identifier. The anomaly judgment is consistent with the actual operation logic of the industrial process. The verification dimensions cover both static threshold boundaries and dynamic change characteristics. Abnormal data points are bound to collection time and data source identifier. The anomaly mark can directly correspond to specific collection nodes and time nodes, and the directional and relevance of the anomaly information is enhanced.

[0016] Clustering analysis is performed on the marked abnormal data points in both time and space dimensions to identify anomalous data clusters that appear densely in time or space. For each anomalous data cluster, an anomalous event description file is generated, which includes the number of data points within the cluster, the time span, and the identification of industrial instruments involved. The distribution pattern of anomalous data can be clearly distinguished, and a clear distinction is formed between scattered anomalies and clustered anomalies. The anomalous event description file fixes the core feature information within the cluster. The aggregation status, duration, and associated instrument information of the anomalous data are completely preserved. The recording format of anomalous events has standardized and structured characteristics. Attached Figure Description

[0017] Figure 1 This is a flowchart of the real-time analysis method for industrial instrument data based on edge computing as described in this invention; Figure 2 A flowchart for real-time compliance verification; Figure 3 This is a graph showing the results of anomaly detection and labeling in industrial pressure time series data. Figure 4 Box plot comparing the temperature parameter distribution of core industrial equipment; Figure 5 To perform in-depth correlation analysis of the progress distribution of each step in the cloud. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] In the description of this invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, in the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0020] See Figure 1 This invention provides a real-time analysis method for industrial instrument data based on edge computing, the specific method including: Data acquisition units are deployed at edge nodes close to industrial instruments to continuously acquire raw monitoring data streams generated by these instruments. The raw monitoring data streams are formatted and timestamped to generate a time-synchronized standardized data sequence. Each data point in this time-synchronized standardized data sequence is associated with a collection time and data source identifier. Based on an industrial process knowledge base, the physical threshold ranges and variation patterns of key monitoring parameters are defined. Real-time compliance checks are performed on the time-synchronized standardized data sequence according to these physical threshold ranges and variation patterns, marking abnormal data points that exceed the physical threshold range or violate the variation patterns, along with their associated collection times and data source identifiers. Cluster analysis is performed on the marked abnormal data points to identify anomalous data clusters that appear densely in time or space. An anomaly event description file is generated for each identified anomalous data cluster, containing the number of data points within the cluster, the time span, and the identifiers of the industrial instruments involved. The time-synchronized standardized data sequence, compliance check results, and anomaly event description files are processed according to a preset compression and encryption strategy and then uploaded to the cloud analysis platform via the edge network.

[0021] In one embodiment of the present invention, the raw monitoring data stream contains time-series measurements collected by multiple types of sensors. Each data packet in the raw monitoring data stream is parsed to extract the sensor type code, the raw measurement value, and the raw timestamp generated by the local clock of each sensor. Based on a preset sensor type code-data format mapping table, the raw measurement values ​​of different sensor types are converted into standard format measurement values ​​with uniform physical units and numerical precision. A global reference time is obtained from the network time protocol service of the edge nodes, and the clock offset between the raw timestamp of each data source and the global reference time is calculated. The clock offset is used to correct the raw timestamps of all data sources, ensuring that the acquisition time of all data points is based on the global reference time. The data, after format conversion and timestamp correction, is sorted and merged according to its corrected acquisition time to form a unified, time-synchronized, standardized data sequence.

[0022] See Figure 2 The system loads a set of compliance rules for key monitoring parameters corresponding to the currently monitored industrial process stage from the industrial process knowledge base. This set of compliance rules includes static threshold rules and dynamic trend rules. Standard format measurements from the time-synchronized standardized data sequence are compared point-by-point with the upper and lower limits defined in the static threshold rules. A sliding window calculation is performed on the time-synchronized standardized data sequence, analyzing the rate of change of the standard format measurements within the sliding window and comparing the calculated rate of change with the maximum allowed rate of change in the dynamic trend rules. When any standard format measurement exceeds the corresponding upper or lower limit, it is determined to be a threshold anomaly, and the standard format measurement, its acquisition time, data source identifier, and the violated threshold rule are recorded. When the calculated rate of change within any sliding window exceeds the maximum rate of change, it is determined to be a trend anomaly, and the start and end times of the sliding window, the involved sequence segments, and the violated trend rule are recorded.

[0023] In practice, the raw monitoring data stream contains time-series measurements from various types of sensors, such as pressure values ​​returned by pressure sensors and temperature values ​​returned by temperature sensors. Each data packet in the raw monitoring data stream is parsed to extract the sensor type code, the raw measurement value, and the raw timestamp generated by each sensor's local clock. Based on a pre-defined sensor type code-data format mapping table, the raw measurement values ​​from different sensor types are converted into standard format measurement values ​​with unified physical units and numerical precision. For example, all pressure values ​​are unified to megapascals and retained to two decimal places, and all temperature values ​​are unified to degrees Celsius and retained to one decimal place.

[0024] In practice, the global reference time is obtained from the network time protocol service of the edge nodes, and the clock offset between the original timestamp of each data source and the global reference time is calculated. The calculated clock offset is used to correct the original timestamps of all data sources, ensuring that the acquisition time of all data points is based on the global reference time, thereby eliminating time asynchrony problems caused by internal clock drift or initialization differences in the sensors. The data, after format conversion and timestamp correction, is sorted and merged according to its corrected acquisition time to form a unified, time-synchronized, standardized data sequence. In this sequence, each data point is associated with a unified acquisition time and a unique data source identifier.

[0025] In some embodiments, a set of compliance rules corresponding to key monitoring parameters of the currently monitored industrial process stage is loaded from an industrial process knowledge base. This set of compliance rules explicitly includes static threshold rules and dynamic trend rules. Standard format measurements in a time-synchronized standardized data sequence are compared point-by-point with the upper and lower limits defined in the static threshold rules. In a specific implementation, a sliding window calculation is performed on the time-synchronized standardized data sequence. Within the sliding window, the rate of change of the standard format measurements is analyzed, and the calculated rate of change is compared with the maximum allowed rate of change in the dynamic trend rules.

[0026] In some embodiments, when any standard format measurement value exceeds the corresponding upper or lower limit, it is determined to be a threshold anomaly, and the standard format measurement value, its acquisition time, data source identifier, and the violated threshold rule are recorded. When the rate of change calculated within any sliding window exceeds the maximum rate of change, it is determined to be a trend anomaly, and the start and end times of this sliding window, the involved sequence segment, and the violated trend rule are recorded. In the specific sliding window calculation, the rate of change can be calculated using the formula:

[0027] in: This represents the rate of change calculated within the sliding window. This represents the last standard format measurement value at the end of the sliding window. This represents the first standard format measurement value at the start of the sliding window. This indicates the time when the data acquisition ends during the sliding window. This indicates the starting time of the data collection for the sliding window. This calculation result will be directly compared with the maximum allowable rate of change threshold set in the dynamic trend rule.

[0028] In one embodiment of the present invention, all labeled threshold anomalies and trend anomalies within a preset analysis time window are collected as a candidate anomaly dataset. For the candidate anomaly dataset, temporal clustering analysis is performed based on the collection time, grouping anomalies with similar collection times and time intervals less than a temporal clustering threshold into the same temporal anomaly cluster. For the candidate anomaly dataset, spatial clustering analysis is performed based on the physical location corresponding to the data source identifier, grouping anomalies with adjacent physical locations and spatial distances less than a spatial clustering threshold into the same spatial anomaly cluster. The number of anomalies contained in each temporal anomaly cluster, as well as the start and end times of that cluster, are calculated. The number of anomalies contained in each spatial anomaly cluster, as well as the center coordinates and radius of the physical area covered by that cluster, are also calculated. Temporal and spatial anomaly clusters that meet preset density conditions are identified as anomaly data clusters with analytical value.

[0029] In practice, all labeled threshold anomalies and trend anomalies within a preset analysis time window are collected as a candidate anomaly dataset. The candidate anomaly dataset contains multiple anomaly data point records, each record including at least the data collection time, data source identifier, anomaly type, and associated measurement value. For the candidate anomaly dataset, temporal clustering analysis is performed based on the collection time, grouping anomalies with similar collection times and time intervals less than a time clustering threshold into the same temporal anomaly cluster. Temporal clustering analysis can be based on a set time clustering threshold; for example, all anomalies with an absolute difference of less than five minutes between collection times can be clustered into one cluster.

[0030] In practical implementation, for the candidate anomaly dataset, spatial clustering analysis is performed based on the physical location corresponding to the data source identifier. Anomalies that are physically adjacent and whose spatial distance is less than the spatial clustering threshold are grouped into the same spatial anomaly cluster. The mapping relationship between data source identifiers and physical locations is provided by a pre-defined device location mapping table. Spatial clustering analysis calculates the Euclidean distance between points based on geographic coordinates. The number of anomalies contained in each temporal anomaly cluster, as well as the start and end times of the temporal anomaly cluster, are calculated. The number of anomalies contained in each spatial anomaly cluster, as well as the center coordinates and radius of the physical area covered by the spatial anomaly cluster, are also calculated. The center coordinates of the physical area of ​​the spatial anomaly cluster can be obtained by calculating the arithmetic mean of the physical location coordinates of all data points within the cluster. The radius of the spatial anomaly cluster is the distance from the center coordinates to the physical location of the farthest data point within the cluster.

[0031] In some embodiments, temporal and spatial outlier clusters that meet preset density conditions are identified as anomalous data clusters with analytical value. The preset density conditions can be implemented by setting a threshold for the minimum number of points within a cluster; for example, specifying that an anomalous cluster must contain at least three outliers to be considered analytically valuable. In some embodiments, the evaluation of spatial distance in spatial clustering analysis can be based on the following formula:

[0032] in: Representing data points With data points Spatial distance between them and Representing data points plane coordinates, and Representing data points The plane coordinates. When When the data points are less than the set spatial aggregation threshold, With data points Spatially, they are considered adjacent. It is understood that spatial distance calculations are based on a Cartesian coordinate system, assuming negligible topographic relief in the monitored area. It is understood that the temporal and spatial clustering thresholds are preset configuration parameters, with their specific values ​​set according to the characteristics of the industrial process and monitoring requirements. Optionally, temporal and spatial clustering analyses can be implemented using hierarchical clustering or density-based clustering algorithms. Optionally, for the finally determined anomalous data clusters, an anomalous event description file is generated, containing the number of data points within the cluster, the time span, and the identifiers of the involved industrial instruments. The time span is determined by the start and end times of the temporal anomalous cluster, and the involved industrial instrument identifiers are extracted from the data points contained in the spatial anomalous cluster.

[0033] In one embodiment of the invention, local real-time feature extraction is performed on time-synchronized standardized data sequences at edge nodes. The time-synchronized standardized data sequence is segmented into continuous data segments using a sliding time window. For standard-format measurements within each data segment, statistical features are calculated, including the average, maximum, minimum, standard deviation, and approximate entropy of the data segment. For each data segment, a Fast Fourier Transform is performed, and the amplitude and frequency of the main frequency components are extracted from the transform result. The statistical features calculated for each data segment are combined with the extracted amplitude and frequency of the main frequency components to form a multidimensional feature vector for that data segment. The multidimensional feature vectors of all data segments generated in chronological order, along with the start and end time identifiers of the corresponding data segments, are encapsulated into a local feature data stream.

[0034] The specific steps for calculating statistical characteristics for each data segment's standard formatted measurements include: summing all standard formatted measurements within the data segment and dividing by the total number of data points to obtain the average; iterating through all standard formatted measurements within the data segment to find the maximum and minimum values, which are then designated as the maximum and minimum values, respectively; calculating the mean of the sum of squares of the differences between all standard formatted measurements and the average, and then taking the square root to obtain the standard deviation; and finally, using a symbolic dynamics method, calculating the approximate entropy of the standard formatted measurement sequence within the data segment to measure the sequence's complexity.

[0035] In practical implementation, local real-time feature extraction is performed on time-synchronized standardized data sequences at edge nodes. For the time-synchronized standardized data sequences, a sliding time window is applied to segment them into continuous data segments. The length of the sliding time window is a fixed time span, and adjacent windows can overlap. For example, for a pressure data sequence sampled at a frequency of 1 Hz, a sliding window of 60 seconds can be set, sliding forward in 1-second steps, thus segmenting the continuous time-series data into a series of data segments lasting 60 seconds with 59 seconds of overlap. In practical implementation, statistical features are calculated for the standard format measurements within each data segment. These statistical features include the average, maximum, minimum, standard deviation, and approximate entropy value of the data segment. For each data segment, a Fast Fourier Transform is performed, and the amplitude and frequency of the main frequency components are extracted from the transform results. The statistical features calculated for each data segment are combined with the extracted amplitude and frequency of the main frequency components to form a multidimensional feature vector for the data segment. The multidimensional feature vectors of all data segments generated in chronological order, along with the start and end time identifiers of the corresponding data segments, are encapsulated into a local feature data stream.

[0036] In some embodiments, statistical characteristics are calculated for the standard format measurements within each data segment. All standard format measurements within the data segment are traversed, and the maximum and minimum values ​​are identified as the maximum and minimum values, respectively. Based on the average, the mean of the sum of squares of the differences between all standard format measurements and the average is calculated, and then the square root is taken to obtain the standard deviation. Using a symbolic dynamics method, the approximate entropy of the sequence of standard format measurements within the data segment is calculated to measure the complexity of the sequence. The calculation of the approximate entropy can be described mathematically using the following formula:

[0037] in: Represents approximate entropy. It is the template length during sequence comparison. This is a similarity tolerance, usually taken as a multiple of the standard deviation. It is the total number of standard format measurements in the data segment. and These are conditional probability measures of the regularity of sequences under different template lengths. The calculated mean, maximum, minimum, standard deviation, and approximate entropy value together constitute a subset of the statistical features of the data segment.

[0038] In some embodiments, a Fast Fourier Transform is performed on the data segment, and the top k frequency components with the largest amplitudes are identified from the spectrum. The frequency values ​​and corresponding amplitudes of these main frequency components are extracted as the spectral features of the data segment. The local feature data stream is a sequence of feature vectors arranged in time order, with each feature vector corresponding to a specific time window. For example, a window containing two sequences, pressure and temperature, may generate feature vectors in the format shown in the table below after calculation. Refer to Table 1 for an example of the construction of multidimensional feature vectors corresponding to a specific time window.

[0039] Table 1: Examples of Multidimensional Feature Vector Construction

[0040] It is understood that Table 1 is merely an example, and the dimensions and specific content of the multidimensional feature vector are determined by the type of the original monitoring data and the extracted features. Optionally, the main frequency components can be selected from several components whose amplitude exceeds a set threshold or are ranked high by amplitude. Optionally, the calculation parameters m and r for the approximate entropy value can be pre-calibrated according to the specific data type. It is understood that the local feature data stream retains the key pattern information of the original data sequence, while the data volume is much smaller than the original sequence, which helps to reduce the overhead of subsequent transmission and processing.

[0041] See Figure 3The figure presents the anomaly identification results of pressure time series data. The curves in the figure represent the original pressure time series data, with a stable sampling frequency, fluctuating around the range of approximately 100-102 kPa, reflecting the normal pressure variation pattern of the industrial process. The dots represent abnormal data points marked after real-time compliance verification, which can be divided into two typical anomaly clusters: High-value spike anomaly clusters: appearing at approximately 80 seconds, the pressure value suddenly rises to above 104 kPa, significantly exceeding the normal fluctuation range, belonging to threshold anomalies, violating the physical upper limit rules of key monitoring parameters, and accompanied by a drastic instantaneous change rate, also triggering trend anomaly judgment. Low-value dense anomaly clusters: appearing at approximately 200-220 seconds, the pressure value continuously drops to the range of 94-96 kPa, multiple anomaly points densely clustered in the time dimension, forming a time anomaly cluster, meeting the preset time clustering threshold, requiring the generation of a corresponding anomaly event description file, recording the number of data points within the cluster, the time span, and the data source identifier. From an analytical perspective, the visualization results fully reflect the core aspects of the method: generating an aligned stress sequence through time synchronization and standardization; verifying and marking data points that exceed the range or change rate limits based on the static threshold rules and dynamic trend rules of the industrial process knowledge base; performing time clustering analysis on the marked points to identify anomalous data clusters with analytical value, providing a basis for subsequent cloud-based root cause analysis and model updates.

[0042] In one embodiment of the present invention, deep correlation analysis and model update steps are performed on a cloud-based analytics platform. The platform receives time-synchronized standardized data sequences, compliance verification results, anomaly event description files, and local feature data streams uploaded from multiple edge nodes. Cross-node data fusion is performed on the time-synchronized standardized data sequences uploaded from different edge nodes that are correlated in time, reconstructing a global industrial process status view. Based on the global industrial process status view, root cause analysis is performed on the received anomaly event description files to explore causal or temporal correlations between anomaly data clusters across multiple edge nodes. Using historically accumulated time-synchronized standardized data sequences, anomaly event description files, and root cause analysis results, a machine learning model for anomaly prediction is trained or updated, generating updated anomaly prediction model parameters. The updated anomaly prediction model parameters, along with optimized compliance rules generated based on root cause analysis, are distributed to the corresponding edge nodes.

[0043] Based on the global industrial process status view, root cause analysis of received abnormal event description files includes: extracting the operating data sequence of all relevant industrial instruments within the time span and involved industrial instrument identifiers recorded in the abnormal event description file from the global industrial process status view; analyzing this operating data sequence to find whether there were any leading changes or disturbances in specific parameters or equipment before the occurrence of abnormal data clusters; determining whether the leading changes or disturbances are sufficient to logically deduce the subsequent abnormal data clusters based on the physical principles and topological connections of the industrial process; if a logical deduction relationship exists, recording the parameters, equipment, and change characteristics corresponding to the leading changes or disturbances as potential root causes in the abnormal event description file; and summarizing the potential root causes of all abnormal event description files to generate a root cause analysis report.

[0044] This process utilizes historically accumulated, time-synchronized, standardized data sequences, anomaly event description files, and root cause analysis results to train or update machine learning models for anomaly prediction. This includes: using time-synchronized, standardized data sequences or feature data extracted from them as model input features; using the anomaly types labeled in the anomaly event description files or the root cause types determined in the root cause analysis reports as model training labels; constructing a deep neural network with multiple hidden layers as the basic architecture of the machine learning model; using labeled historical data to perform supervised learning training on the machine learning model, optimizing model parameters, and enabling the model to predict the type or probability of anomalies occurring within a specific future time window based on the input data features; evaluating the prediction accuracy and recall of the trained machine learning model on a validation dataset; adjusting the model structure or parameters based on the evaluation results; and generating updated anomaly prediction model parameters that meet performance requirements.

[0045] In practical implementation, deep correlation analysis and model updates are performed on a cloud-based analytics platform. This involves receiving time-synchronized standardized data sequences, compliance verification results, anomaly event description files, and local feature data streams uploaded from multiple edge nodes. Cross-node data fusion is performed on the time-correlated time-synchronized standardized data sequences uploaded from different edge nodes to reconstruct a global industrial process status view. This global industrial process status view is a time-aligned dataset containing all relevant monitoring points from upstream, midstream, and downstream of the process line. Based on this global industrial process status view, root cause analysis is performed on the received anomaly event description files to explore causal or temporal correlations between anomaly data clusters across multiple edge nodes. Using historically accumulated time-synchronized standardized data sequences, anomaly event description files, and root cause analysis results, a machine learning model for anomaly prediction is trained or updated, generating updated anomaly prediction model parameters. The updated anomaly prediction model parameters, along with optimized compliance rules generated based on root cause analysis, are then distributed to the corresponding edge nodes.

[0046] In practical implementation, root cause analysis is performed on received abnormal event description files based on a global industrial process status view. From the global industrial process status view, the operating data sequences of all relevant industrial instruments within the time span and involved industrial instrument identifiers recorded in the abnormal event description files are extracted. The operating data sequences are analyzed to identify whether there were any leading changes or disturbances in specific parameters or equipment before the occurrence of abnormal data clusters. Based on the physical principles and topological connections of the industrial process, it is determined whether the leading changes or disturbances are sufficient to logically deduce the subsequent abnormal data clusters. If a logical deduction relationship exists, the parameters, equipment, and change characteristics corresponding to the leading changes or disturbances are recorded as potential root causes in the abnormal event description files. All potential root causes from abnormal event description files are summarized to generate a root cause analysis report. For example, see Table 2 for the information that a root cause analysis report for a batch of product quality fluctuations might contain.

[0047] Table 1: Root Cause Analysis Report Information Sheet for Product Quality Fluctuations

[0048] In some embodiments, a machine learning model for anomaly prediction is trained or updated using historically accumulated time-synchronized standardized data sequences, anomaly event description files, and root cause analysis results. The time-synchronized standardized data sequences or feature data extracted from them are used as input features to the model. The anomaly types labeled in the anomaly event description files or the root cause types determined in the root cause analysis reports are used as training labels for the model. A deep neural network with multiple hidden layers is constructed as the basic architecture of the machine learning model. Supervised learning training of the machine learning model is performed using labeled historical data to optimize model parameters, enabling the model to predict the type or probability of anomalies occurring within a specific future time window based on the input data features. The prediction accuracy and recall of the trained machine learning model are evaluated on a validation dataset. Based on the evaluation results, the model structure or parameters are adjusted to generate updated anomaly prediction model parameters that meet performance requirements. For example, the loss function for model training can be cross-entropy loss, the calculation of which can be found in the following formula:

[0049] in: This represents the average loss of the batch. Indicates the number of samples in the batch. This represents the total number of exception categories. It is an indicator function, when the sample The true category is The value is 1 if the condition is met, and 0 otherwise. The model predicts the sample. Category The probability of.

[0050] See Figure 4 The data visually presents the temperature data distribution characteristics of four key equipment types: feed pump P1, reaction tank A, reaction tank B, and discharge pump P2. From the perspective of the tank's location and range, the median temperature of each piece of equipment is consistently around 60℃, reflecting a consistent basic operating temperature range for the industrial process. Among them, reaction tank A has the widest temperature extreme range (minimum approximately 35℃, maximum approximately 170℃), indicating that its temperature fluctuation during the process reaction stage is significantly greater than that of pump equipment. This is highly consistent with the physical characteristics of the reaction tank as a core heat exchange unit. From the perspective of the interquartile range and the extension of the whisker line, the temperature data distribution of feed pump P1, reaction tank B, and discharge pump P2 is relatively concentrated, with an interquartile range of approximately 70℃. The interquartile range of reaction tank A is approximately 65℃, but the upper whisker line extends to 170℃, indicating the existence of extreme high-temperature operating points, requiring close monitoring of the risk of exceeding temperature thresholds. The lower whisker line reveals that the lower limit of the low temperature for each piece of equipment is around 35℃, consistent with the temperature characteristics of industrial equipment during standby or low-load operation. From a horizontal comparison among the equipment, there are significant differences in the temperature distribution patterns between pump equipment (feed pump P1, discharge pump P2) and reaction tank equipment (reaction tank A, reaction tank B): the extreme temperature difference between pump equipment is about 100℃, while the extreme temperature difference between reaction tank equipment is about 130℃. This difference can be used as an abnormal clustering feature of the equipment type dimension in the edge computing node, providing a statistical basis for subsequent cross-equipment root cause analysis.

[0051] In one embodiment of the present invention, the standardized data sequence for time synchronization, compliance verification results, and abnormal event description files that need to be uploaded are compressed using a dictionary-based general lossless compression algorithm to reduce data volume. The compressed data is then encrypted using a symmetric encryption algorithm with a session key securely obtained from the cloud, generating ciphertext data. A data integrity check code is generated for the ciphertext data and appended to it. The ciphertext data with the appended data integrity check code is then encapsulated into a data packet conforming to the edge-cloud communication protocol, ready for upload.

[0052] In practice, the standardized data sequences for time synchronization, compliance verification results, and abnormal event description files that need to be uploaded are processed according to a preset compression and encryption strategy. Data compression is performed on these standardized data sequences for time synchronization, compliance verification results, and abnormal event description files using a dictionary-based general lossless compression algorithm to reduce data volume. For example, the LZ77 algorithm or its variants can be applied. During compression, the algorithm creates and maintains a dynamic dictionary, replacing recurring string sequences in the input data stream with references to previously occurring positions in the dictionary. This compression process effectively reduces the size of data files containing a large amount of repetitive or regular structures, such as time series data and structured verification result files.

[0053] In practical implementation, the compressed data is encrypted using a symmetric encryption algorithm with a session key securely obtained from the cloud, generating ciphertext data. The session key is securely negotiated or obtained from the cloud by the edge node each time a secure connection is established, using an asymmetric encryption algorithm to ensure the confidentiality of the key itself during transmission. The symmetric encryption algorithm can be AES, and the compressed data is encrypted using the session key securely obtained from the cloud in encryption mode. A data integrity check code is generated for the ciphertext data and appended to it. The data integrity check code can be obtained by calculating the message authentication code of the ciphertext data, which can be calculated using a function described by the formula:

[0054] in: This represents the final generated message authentication code. This indicates the selected cryptographic hash function. This indicates a session key securely obtained from the cloud. It is an external filler constant. It is an internal filling constant. This represents a string concatenation operation. This represents the encrypted data to be verified.

[0055] In practice, the encrypted data with an appended data integrity check code is encapsulated into a data packet conforming to the edge-cloud communication protocol, ready for upload. The data packet encapsulation format includes a header and a data body. The header contains information such as the data packet length, source edge node identifier, destination cloud address, timestamp, and encryption algorithm identifier. The data body is the encrypted data with the appended message authentication code. In some embodiments, the DEFLATE algorithm can be selected as the dictionary-based general lossless compression algorithm. Optionally, the message authentication code can also be calculated using a block cipher-based algorithm. The data integrity check code can be generated independently of the encryption process, after data compression and before encryption. The encryption and integrity check processes enhance the confidentiality and integrity of data transmission.

[0056] See Figure 5In the cloud-based deep correlation analysis process, the progress distribution of each core step intuitively reflects the end-to-end analysis progress of industrial instrument data from the edge to the cloud. Specifically: the data fusion stage is 100% complete, having reconstructed the global state view of data uploaded from multiple edge nodes, laying a complete data foundation for subsequent cross-node correlation analysis. The root cause analysis stage is 90% complete, having completed causal and temporal correlation mining of most abnormal events based on the global industrial process state view, with only a small amount of complex cross-device abnormal clusters remaining for root cause tracing. The model training stage is 85% complete, having completed supervised learning training of the deep neural network using historical standardized data, abnormal events, and root cause analysis results, and is currently in the model parameter fine-tuning and validation set evaluation stage to optimize the accuracy and recall of anomaly predictions. The rule deployment stage is 95% complete, having generated updated anomaly prediction model parameters and optimized compliance rules, and is about to complete deployment to the corresponding edge nodes, achieving closed-loop iteration of analytical capabilities. Overall, the progress of each stage of the cloud-based deep correlation analysis is closely linked, demonstrating efficient progress throughout the entire process from data fusion to rule implementation, and providing reliable cloud support for the real-time analysis system of industrial instruments based on edge computing.

[0057] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. An edge-computing-based real-time analysis method for industrial instrument data, characterized in that, include: Data acquisition units are deployed at edge nodes close to industrial instruments to continuously acquire raw monitoring data streams generated by industrial instruments. The original monitoring data stream is formatted and timestamp aligned to generate a time-synchronized standardized data sequence. Each data point in the time-synchronized standardized data sequence is associated with a collection time and a data source identifier. Based on the industrial process knowledge base, the physical threshold range and variation law of key monitoring parameters are defined. Based on the physical threshold range and variation law, the standardized data sequence of time synchronization is checked in real time for compliance. Abnormal data points that exceed the physical threshold range or violate the variation law are marked, along with their associated collection time and data source identifier. Cluster analysis is performed on the marked abnormal data points to identify abnormal data clusters that appear densely in time or space. An abnormal event description file is generated for each identified abnormal data cluster, which includes the number of data points in the cluster, the time span, and the industrial instrument identifiers involved. The time-synchronized standardized data sequence, compliance verification results, and abnormal event description files are processed according to a preset compression and encryption strategy and then uploaded to the cloud analysis platform via the edge network.

2. The method for real-time analysis of industrial instrument data based on edge computing according to claim 1, characterized in that, The original monitoring data stream is formatted and timestamp aligned to generate a time-synchronized standardized data sequence, including: The raw monitoring data stream contains time-series measurements collected by multiple types of sensors; Each data packet in the original monitoring data stream is parsed to extract the sensor type code, the original measurement value, and the original timestamp generated by the local clock of each sensor. According to the preset sensor type encoding-data format mapping table, the original measurement values ​​of different sensor types are converted into standard format measurement values ​​with uniform physical units and numerical accuracy; Obtain the global reference time from the network time protocol service of the edge node, and calculate the clock offset between the original timestamp of each data source and the global reference time; The original timestamps of all data sources are corrected using the clock offset to ensure that the acquisition time of all data points is based on the global reference time. After the data has undergone format conversion and timestamp correction, it is sorted and merged according to its corrected acquisition time to form a unified, time-synchronized, standardized data sequence.

3. The method for real-time analysis of industrial instrument data based on edge computing according to claim 2, characterized in that, Real-time compliance verification of the time-synchronized standardized data sequence is performed based on the physical threshold range and its variation pattern, including: From the industrial process knowledge base, load the set of compliance rules for the key monitoring parameters corresponding to the currently monitored industrial process stage, the set of compliance rules including static threshold rules and dynamic trend rules; The standard format measurement values ​​in the time-synchronized standardized data sequence are compared point by point with the upper and lower limits defined in the static threshold rules; A sliding window calculation is performed on the time-synchronized standardized data sequence. Within the sliding window, the rate of change of the standard format measurement values ​​is analyzed, and the calculated rate of change is compared with the maximum allowed rate of change in the dynamic trend rule. When any standard format measurement value exceeds the corresponding upper or lower limit value, it is determined to be a threshold anomaly, and the standard format measurement value, its acquisition time, data source identifier, and the threshold rule violated are recorded. When the rate of change calculated within any sliding window exceeds the maximum rate of change, it is determined to be an abnormal trend, and the start and end times of the sliding window, the sequence segments involved, and the trend rules violated are recorded.

4. The method for real-time analysis of industrial instrument data based on edge computing according to claim 3, characterized in that, The step of performing cluster analysis on the marked anomalous data points to identify anomalous data clusters that appear densely in the time or spatial dimensions includes: Collect all labeled threshold anomalies and trend anomalies within the preset analysis time window as a candidate anomaly dataset; For the candidate anomaly dataset, time clustering analysis is performed based on the collection time, and anomalies with similar collection times and time intervals less than the time clustering threshold are grouped into the same time anomaly cluster. For the candidate anomaly dataset, spatial clustering analysis is performed based on the physical location corresponding to the data source identifier, and anomaly points that are physically adjacent and whose spatial distance is less than the spatial clustering threshold are grouped into the same spatial anomaly cluster. Calculate the number of anomalous points contained in each of the time anomaly clusters, as well as the start and end times of the time anomaly clusters; Calculate the number of anomalous points contained in each of the spatial anomaly clusters, as well as the center coordinates and radius of the physical area covered by the spatial anomaly clusters; The temporal anomaly clusters and spatial anomaly clusters that meet the preset density conditions are identified as the anomalous data clusters with analytical value.

5. The real-time analysis method for industrial instrument data based on edge computing according to claim 4, characterized in that, It also includes a step of performing local real-time feature extraction on the time-synchronized standardized data sequence at the edge node: The time-synchronized standardized data sequence is divided into continuous data segments using a sliding time window. For each data segment, the standard format measurement values ​​are calculated to have statistical characteristics, including the mean, maximum, minimum, standard deviation, and approximate entropy of the data segment. For each data segment, perform a fast Fourier transform and extract the amplitude and frequency of the main frequency components from the transform results; The statistical features calculated for each data segment are combined with the amplitude and frequency of the extracted main frequency components to form a multidimensional feature vector for the data segment. The multidimensional feature vectors of all data segments generated in chronological order, along with the start and end time identifiers of the corresponding data segments, are encapsulated into a local feature data stream. The calculation of statistical characteristics for standard format measurements within each data segment specifically includes: The average value is obtained by summing all standard format measurements within the data segment and dividing by the total number of data points. Traverse all standard format measurement values ​​within the data segment, find the maximum and minimum values, and use them as the maximum and minimum values, respectively. Based on the average value, the mean of the sum of squares of the differences between all standard format measurements and the average value is calculated, and then the square root is taken to obtain the standard deviation. Based on the symbolic dynamics method, the approximate entropy value of the standard format measurement value sequence within the data segment is calculated to measure the complexity of the sequence.

6. The method for real-time analysis of industrial instrument data based on edge computing according to claim 5, characterized in that, This also includes in-depth correlation analysis and model update steps performed on a cloud-based analytics platform: Receives standardized data sequences for time synchronization, compliance verification results, abnormal event description files, and local feature data streams uploaded from multiple edge nodes; Cross-node data fusion is performed on the time-synchronized standardized data sequences uploaded from different edge nodes that are correlated in time, to reconstruct a global industrial process status view; Based on the global industrial process status view, root cause analysis is performed on the received abnormal event description files to explore the causal or temporal correlation between abnormal data clusters across multiple edge nodes. Using historically accumulated time-synchronized standardized data sequences, anomaly event description files, and root cause analysis results, train or update the machine learning model for anomaly prediction, and generate updated anomaly prediction model parameters. The updated anomaly prediction model parameters, along with the optimized compliance rules generated based on root cause analysis, are then distributed to the corresponding edge nodes.

7. The method for real-time analysis of industrial instrument data based on edge computing according to claim 6, characterized in that, Based on the global industrial process status view, root cause analysis is performed on the received abnormal event description file, including: From the global industrial process status view, extract the operating data sequence of all relevant industrial instruments within the time span and industrial instrument identification range recorded in the abnormal event description file; Analyze the operational data sequence to find whether there were any leading changes or disturbances in specific parameters or specific devices before the occurrence of the abnormal data clusters; Based on the physical principles and topological connections of the industrial process, determine whether the leading change or disturbance is sufficient to logically deduce the subsequent abnormal data cluster; If a logical deduction relationship exists, the parameters, devices, and change characteristics corresponding to the leading change or disturbance shall be recorded as potential root causes in the abnormal event description file. Summarize the potential root causes from all abnormal event description files and generate a root cause analysis report.

8. The method for real-time analysis of industrial instrument data based on edge computing according to claim 7, characterized in that, The process of training or updating a machine learning model for anomaly prediction using historically accumulated time-synchronized standardized data sequences, anomaly event description files, and root cause analysis results includes: The time-synchronized standardized data sequence or the feature data extracted from it is used as the model input features; The anomaly type marked in the anomaly description file or the root cause type determined by the root cause analysis report is used as the model training label. A deep neural network containing multiple hidden layers is constructed as the basic architecture of the machine learning model; The machine learning model is trained using labeled historical data to optimize model parameters, enabling the model to predict the type or probability of anomalies occurring within a specific future time window based on the characteristics of the input data. Evaluate the prediction accuracy and recall of the trained machine learning model on the validation dataset, adjust the model structure or parameters based on the evaluation results, and generate the updated anomaly prediction model parameters that meet the performance requirements.

9. The method for real-time analysis of industrial instrument data based on edge computing according to claim 8, characterized in that, The processing according to the preset compression and encryption strategy includes: The standardized data sequence for time synchronization, compliance verification results, and abnormal event description files that need to be uploaded are compressed using a dictionary-based general lossless compression algorithm to reduce data volume. The compressed data is encrypted using a symmetric encryption algorithm with a session key securely obtained from the cloud, generating ciphertext data. Generate a data integrity check code for the encrypted data, and append the data integrity check code to the encrypted data; The encrypted data, with an appended data integrity check code, is encapsulated into a data packet conforming to the edge-cloud communication protocol, ready for upload.

10. A real-time analysis system for industrial instrument data based on edge computing, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the real-time analysis method for industrial instrument data based on edge computing as described in any one of claims 1 to 9.

Images