Middleware-based multi-source device heterogeneous fusion and intelligent control system

Abstract

The application discloses a middleware-based multi-source device heterogeneous fusion and intelligent control system, relates to the technical field of Internet of Things middleware and heterogeneous device intelligent control, and constructs a cause and effect anchor point according to heterogeneous device facts, control action issuing records and action receipts, maps device facts between adjacent cause and effect anchor points to a cause and effect interval, and forms a fact relationship graph; minimum trigger fact cuts are extracted through a previous state back substitution, and it is judged whether the minimum trigger fact cuts cross mutually incompatible cause and effect intervals; when the compatible condition is met, an activation token containing a cut set abstract, an anchor point abstract and a target device state version is generated, and the application rechecks the current state version before issuing an instruction, so that false control caused by splicing new and old device facts is avoided.

Description

Technical Field

[0001] This invention relates to the field of IoT middleware and intelligent control technology for heterogeneous devices, specifically to a middleware-based multi-source device heterogeneous fusion and intelligent control system. Background Technology

[0002] When switching transfer pumps in a liquid ammonia storage tank, level gauges, leak probes, and valve actuators are connected to the middleware via different protocols. Equipment clock drift and gateway queuing may cause new liquid levels, old valve positions, and expired leak-free states to be pieced together into a false combination of facts, falsely triggering pump start-up. Since the timestamps of different devices cannot be directly compared, simply setting time thresholds is insufficient to identify such fragmented snapshots. Summary of the Invention

[0003] The purpose of this invention is to provide a middleware-based multi-source device heterogeneous fusion and intelligent control system to address the shortcomings of the prior art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a middleware-based multi-source device heterogeneous fusion and intelligent control system, comprising: The causal anchor construction module obtains facts and action receipts from heterogeneous devices and constructs causal anchors based on the issuance and receipt records of the same control action. The fact graph generation module maps device facts between adjacent causal anchor points to corresponding causal intervals to form a fact graph. The minimum triggering fact cut set extraction module, based on the fact relationship graph, sequentially replaces each fact that satisfies the linkage rule with its preceding state and rematches it to obtain the minimum triggering fact cut set that changes the linkage rule from satisfied to unsatisfied. The activation token generation module determines whether the facts in the minimum triggering fact cut set cross incompatible causal intervals. If not, it generates an activation token containing a cut set summary, an anchor point summary, and the target device state version. Before issuing the instruction, the module obtains the current state version of the target device or its edge agent. Only when the current state version matches the activation token will the linkage action be converted into a target protocol instruction and issued. Otherwise, the fact relationship graph generation module will be re-executed based on the updated device facts.

[0005] Preferably, the causal anchor construction module performs the following steps: S101, For the control action to be issued, construct a issuance record including the target device identifier, action type, action parameter summary, issuance sequence number and issuance time; S102, the protocol adapter selects a carrier that does not change the execution semantics according to the order of ignorable extended fields, equivalent encoding sequences and session side tags, and writes the causal watermark that uniquely corresponds to the control action into the carrier. S103, the protocol type, protocol adapter instance identifier, gateway identifier, transmission channel identifier, transmission session identifier, target endpoint, distribution sequence number and protocol adapter version number are concatenated in sequence to form the distribution path fingerprint of the corresponding distribution record.

[0006] Preferably, the causal anchor construction module also performs the following steps: S111, Receive action receipt, extract causal watermark from the carrier carried by the action receipt, or read causal watermark from the session sideband record according to the transmission session identifier and receipt sequence number, and recalculate the receipt path fingerprint according to the transmission path traversed when the action receipt arrives. S112, only when the cause-effect watermark, path fingerprint, device identifier and issue sequence number are consistent will the action receipt be recognized as corresponding to the issue record; S113. Within the observation period after the action receipt, find three consecutive device facts with the same device identifier, consecutive receiving sequence number, sequentially increasing acquisition time, and state vector consistent with the target state vector, and determine the first one as the first stable device fact. S114, when there is a difference between the state vector before the control action is issued and the target state vector, and the first stable device fact represents the migration to the target state vector, the issuance record, action receipt and the first stable device fact are encapsulated as a closed causal anchor point; otherwise, the device fact after the action receipt is marked as a suspended fact.

[0007] Preferably, the fact diagram generation module performs the following steps: S201, arrange the closed causal anchor points according to the closing time, take the receiving time corresponding to the first stable device fact in the previous closed causal anchor point as the left boundary, and take the sending time corresponding to the sending record in the next closed causal anchor point as the right boundary, and establish the causal interval. S202, Write the device facts that are not marked as suspended facts within the causal interval into the corresponding fact slots according to the device identifier; S203, when the device reported sequence number is looped, the original device reported sequence number is converted into an expanded device reported sequence number based on the difference between the current device reported sequence number and the previous device reported sequence number and the sequence number space allowed by the protocol; when the target protocol does not provide a device reported sequence number, the expanded device reported sequence number is replaced by the gateway received offset and a passive sorting flag is written.

[0008] Preferably, the fact diagram generation module also performs the following steps: S211, For each fact slot, starting from the left boundary state vector, write the full attributes or change attributes sequentially along the reported sequence number of the expanded device to obtain the positive playback state vector; when the positive playback state vector is consistent with the fact state vector corresponding to the device fact and the reported sequence number of the expanded device is continuous, mark the device fact as positively reachable. S212, starting from the right boundary state vector, restore the changed attributes recorded in the device facts to their original values ​​in reverse order of the reported sequence number of the expanded device; when the restored state vector is consistent with the state vector corresponding to the previous device fact, mark the previous device fact as reachable in the reverse direction. S213, the device that has both forward reachability and reverse reachability is marked as a two-way closed device; S214, for a device fact that is not bidirectionally closed, if its deployed device reported sequence number is between adjacent bidirectionally closed device facts, its state change can be obtained from the playback of the previous state and can be traced back from the subsequent state, and its issued path fingerprint is consistent with the previous device fact or the subsequent device fact, it is marked as clamped and assigned; otherwise, it is marked as suspended.

[0009] Preferably, the fact diagram generation module also performs the following steps: S221, converts the device fact that has completed bidirectional closure or clamping ownership into a fact node; S222, when adjacent fact nodes belong to the same fact slot, the expanded device reporting sequence number of the later fact node is equal to the expanded device reporting sequence number of the earlier fact node plus 1, and the corresponding state of the later fact node can be obtained after writing the change attribute recorded by the later fact node to the earlier fact node, a state connection edge is established between adjacent fact nodes. S223, when the causal watermark, the path fingerprint and the action receipt sequence number corresponding to the fact node are consistent with the closed causal anchor point, establish an action receipt association edge between the fact node and the first stable device fact in the closed causal anchor point. S224. Connect the fact node with the smallest reported sequence number in each fact slot to the previous closed causal anchor point, and connect the fact node with the largest reported sequence number to the next closed causal anchor point. Establish interval entry edges and interval exit edges respectively to form a fact relationship graph.

[0010] Preferably, the minimum trigger fact cut set extraction module performs the following steps: S301, extract the fact nodes that participate in the matching of the current linkage rule from the fact relationship graph, and read the previous state corresponding to each fact node along the state receiving edge; for fact nodes that do not have an incoming state receiving edge, read the first stable device fact in the previous closed causal anchor point as the previous state along the interval entering edge. S302, arrange the fact nodes participating in the matching according to the causal interval attribution relationship and the action receipt association relationship, so that the fact nodes with the action receipt association edge enter the back-substitution sequence before other fact nodes in the same causal interval; S303, replace the single fact node in the back-substitution sequence with the corresponding preceding state in turn, and rematch the linkage rule while keeping the other fact nodes unchanged. The fact node that causes the linkage rule to change from being satisfied to not being satisfied is marked as a failure pivot.

[0011] Preferably, the minimum triggering fact cut set extraction module also performs the following steps: S311, write the failure pivots that correspond to the same closed causal anchor point or can be traced back to the same issued record along the action receipt associated edge into the same fold group; S312, for each folding group, read the failure fulcrum in reverse order according to the reported sequence number of the unfolding device, and perform reverse folding along the state receiving edge; when the state change corresponding to the failure fulcrum located behind can be formed by the state change corresponding to the failure fulcrum located in front along the action receipt association relationship, mark the failure fulcrum located behind as the accompanying fulcrum and remove it from the folding group. S313, establish a back-substitution bit string for the failed pivot points retained after reverse folding, and perform combined back-substitution sequentially starting from 1 according to the number of back-substitutions; S314. The set of failure points that, after combination back substitution, cause the linkage rule to change from satisfied to unsatisfied, and after removing any of the failure points, cannot maintain the state change result of the linkage rule changing from satisfied to unsatisfied, is determined as the minimum triggering fact cut set.

[0012] Preferably, the activation token generation module performs the following steps: S401, for each failed pivot in the minimum triggering fact cut set, read the closed causal anchor points before and after along the interval entry edge and interval exit edge, and combine the action receipt associated edge and the issued path fingerprint to form an interval witness chain. S402, according to the closing order of the closed causal anchor points, interweave the witness chains of each interval, replace each failed fulcrum with the corresponding previous state, and perform replay along the state-bearing edge to obtain a common closed corridor; S403, when different interval witness chains give opposite closing orders for the same pair of closed causal anchor points, or when the same device in the same closed corridor has different attribute values ​​along the same distribution path fingerprint and the same unfolded device reporting sequence number, the corresponding causal intervals will be marked as incompatible. S404, determine that the minimum triggering fact cut set does not cross mutually exclusive causal intervals only when all interval witness chains can be embedded in the same common closed corridor and there are no mutually exclusive markers.

[0013] Preferably, the activation token generation module and instruction issuance module perform the following steps: S501, the failure pivot identifier, preceding fact node identifier, causal interval identifier, closed causal anchor identifier, and issued record identifier in the minimum triggering fact cut set are concatenated in sequence and hashed to obtain the cut set summary; the closed causal anchor identifier, closure sequence number, causal watermark, and issued path fingerprint in the common closed corridor are concatenated in sequence and hashed to obtain the anchor summary. S502, write the cut set summary, anchor point summary, target device status version, linkage rule identifier, rule version number, target device identifier and token serial number into the activation token; S503 reads the current status version returned by the target device or edge agent before sending it out. Only when the current status version is consistent with the target device status version in the activation token, the activation token has not been consumed, the token sequence number is the latest token sequence number corresponding to the target device, and the rule version number is still in the enabled state, the linkage action is converted into a target protocol instruction and sent to the target device through the corresponding sending path. S504: After the target protocol instruction is sent, the activation token is marked as consumed. When the current state version is inconsistent, the action receipt is not returned within 2 times the device reporting cycle, or the action receipt is inconsistent with the target protocol instruction summary, the activation token is revoked, the updated device facts are written into the device fact set, and the fact relationship graph generation module is re-executed starting from the previous closed causal anchor point closest to the updated device facts.

[0014] The technical effects and advantages provided by the present invention in the above technical solution are as follows: 1. This invention differs from existing technologies that only splice multi-source facts based on timestamps or cached current values. This invention writes a causal watermark and records the issuance path fingerprint when a control action is issued. This is combined with the matched action receipt and continuous stable equipment facts to form a closed causal anchor point. Then, causal intervals are divided using adjacent closed causal anchor points. Delayed old facts are filtered out through forward playback, reverse tracing, and clamping attribution. Therefore, it can prevent the incorrect combination of new liquid levels, old valve positions, and expired leak-free states in liquid ammonia transfer scenarios, avoiding accidental pump activation.

[0015] 2. Unlike existing technologies that directly issue control commands after the rules are met, this invention sequentially substitutes the facts involved in the matching back to the previous state, extracts the minimum triggering fact cut set, and interweaves the corresponding interval witness chains into a common closed corridor. Only when there is no reversed closed order or exclusionary state acceptance result is a one-time activation token formed, binding the cut set digest, anchor point digest, and target device state version. Before issuing, the current state version is reviewed again; if the version changes, the token is revoked and the fact relationship graph is rebuilt, thereby avoiding dangerous linkage based on expired facts. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0017] Figure 1 This is a flowchart of the middleware-based multi-source device heterogeneous fusion and intelligent control system module of the present invention.

[0018] Figure 2 This is a flowchart of the minimum triggering fact cut set determination method of the present invention.

[0019] Figure 3 This is a flowchart of the activation token generation module execution method of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example 1, please refer to Figure 1 As shown in this embodiment, the middleware-based multi-source device heterogeneous fusion and intelligent control system includes: The causal anchor construction module obtains facts and action receipts from heterogeneous devices and constructs causal anchors based on the issuance and receipt records of the same control action.

[0022] To avoid the problem of splicing new liquid level data, old valve position data, and expired no-leak data during the switching of transfer pumps for liquid ammonia storage tanks, the middleware performs correlation processing on heterogeneous device data and action receipts before issuing control actions. Heterogeneous device data includes device identifier, attribute name, attribute value, acquisition time, reception time, device reporting sequence number, and protocol type. Action receipts include device identifier, receipt status, reception time, transmission session identifier, and receipt sequence number. Control actions include target device identifier, action type, action parameters, and issuance sequence number.

[0023] When the middleware receives a control action to be sent, it first constructs a sending record. The sending record is denoted as D, and D includes the target device identifier, action type, action parameter digest, sending sequence number, sending time, causal watermark, and sending path fingerprint. The action parameter digest is processed using the SHA-256 hash function, which processes the byte string of action parameters arranged in ascending order by field name, and the first 128 bits of the hash result are extracted. The ascending order of field names ensures that the same action parameter yields the same action parameter digest in different protocol adapters. The causal watermark is denoted as C. The causal watermark is obtained as follows: the target device identifier, action type, action parameter digest, sending sequence number, the second-level time slice corresponding to the sending time, and a 16-byte random salt value are concatenated sequentially. The concatenation result is processed using the SHA-256 hash function, and the first 128 bits of the hash result are extracted. The calculation of causal watermarking is expressed as follows: C equals the byte string obtained by concatenating the target device identifier, action type, action parameter digest, distribution sequence number, second-level time slice and random salt value in sequence using the SHA-256 hash function, and then truncating the first 128 bits.

[0024] A second-level time slice is equal to the number of milliseconds at the time of transmission divided by 1000 and then rounded down. Causal watermarks are used to distinguish control actions with the same action parameters but different transmission batches.

[0025] The protocol adapter selects the carrier in a fixed order without changing the execution semantics. When the target protocol contains ignorable extended fields, the lower 16 bits of the causal watermark are written into these fields. When the target protocol does not contain ignorable extended fields but allows two independent optional fields to be interchanged, the lower 16 bits of the causal watermark are split into 16 binary bits; each binary bit corresponds to a field arrangement order. When the binary bit is 0, the first field comes first, followed by the second; when the binary bit is 1, the second field comes first, followed by the first. The field arrangement order is only used after the protocol document explicitly states that the order does not affect the execution result, and after the target device has completed 20 verifications of the same action. In these 20 verifications, the result of each action must be consistent with the result when the field order was not adjusted. When the target protocol neither contains ignorable extended fields nor allows the interchange of field order, the causal watermark, transmission session identifier, and sequence number are written into the session sideband record maintained by the protocol adapter.

[0026] The distribution path fingerprint is denoted as P. The distribution path fingerprint is obtained as follows: the protocol type, protocol adapter instance identifier, gateway identifier, transmission channel identifier, transmission session identifier, target endpoint, distribution sequence number, and protocol adapter version number are concatenated sequentially. The concatenation result is processed using the SHA-256 hash function, and the first 128 bits of the hash result are truncated. The distribution path fingerprint is calculated as follows: P equals the byte string obtained by concatenating the protocol type, protocol adapter instance identifier, gateway identifier, transmission channel identifier, transmission session identifier, target endpoint, distribution sequence number, and protocol adapter version number sequentially using the SHA-256 hash function, and then truncating the first 128 bits.

[0027] The target endpoint can be any one of the following: MQTT topic, TCP connection address, serial port address, or fieldbus station number. The path fingerprint is used to distinguish control actions sent to the same target device via different gateways or different transport sessions.

[0028] After receiving the action receipt, the protocol adapter reads the lower 16 bits of the causal watermark from the ignorable extended field or equivalent encoded sequence carried in the action receipt. When using session-side recording, the protocol adapter reads the causal watermark corresponding to the action receipt based on the transmission session identifier and receipt sequence number. Subsequently, it recalculates the receipt path fingerprint according to the protocol type used when the action receipt arrived, the protocol adapter instance identifier, gateway identifier, transmission channel identifier, transmission session identifier, target endpoint, distribution sequence number, and protocol adapter version number.

[0029] Action receipts and distribution records are matched based on four consistent criteria: The first item is consistent with the lower 16 bits of the causal watermark; The second item is that the receipt path fingerprint is consistent with the distribution path fingerprint; The third item is that the device identifier in the action receipt matches the target device identifier in the distribution record; The fourth item is that the issuance sequence number corresponding to the action receipt is consistent with the issuance sequence number in the issuance record.

[0030] One point is awarded for each item that is satisfied, and zero points are awarded for each item that is not satisfied. When the matching score is equal to 4, the action receipt is recognized as the action receipt corresponding to the same control action; when the matching score is less than 4, the action receipt is not used to construct a closed causal anchor point.

[0031] After the action receipt is matched, the middleware obtains the device facts following the action receipt and calculates the observation duration W used to identify the first stable device fact. The reporting period for device facts is denoted as T. T is calculated based on the difference between adjacent reception times of the most recent 20 valid device facts. When the number of valid device facts is 20, the 19 adjacent reception time differences are arranged in ascending order, and the 10th difference after arrangement is taken as T; when the number of valid device facts is 5 to 19, the existing adjacent reception time differences are arranged in ascending order, and the difference in the middle position after arrangement is taken as T; when the number of valid device facts is less than 5, the rated reporting period in the device registration information is used; if the rated reporting period is not recorded in the device registration information, T is 1 second. The observation duration W is equal to 3 times T; when 3 times T is less than 2 seconds, W is 2 seconds; when 3 times T is greater than 10 seconds, W is 10 seconds.

[0032] The middleware determines the target state vector E based on the action type and parameters of the control action. Taking the start-up action of a liquid ammonia transfer pump as an example, the target state vector E includes the operating state as start-up, the contactor state as engagement, and the outlet valve state as open. The equipment facts after each action acknowledgment are converted into a state vector V. The difference between state vector V and the target state vector E is denoted as Q. The calculation process for Q is as follows: Each attribute value in state vector V is compared sequentially with the corresponding attribute value in the target state vector E; if the attribute values ​​are the same, it is recorded as 0; if the attribute values ​​are different, it is recorded as 1; all comparison results are added together to obtain Q. When Q equals 0, it indicates that the equipment facts are completely consistent with the target state vector E.

[0033] The middleware sorts the device facts after the action receipt in ascending order according to the reception time within the observation period W, and finds the earliest three consecutive device facts. The three consecutive device facts must simultaneously meet the following conditions: the device identifiers of the three device facts are the same; the reception sequence number increases by 1 in sequence; the acquisition times are arranged in chronological order; and the Q corresponding to each device fact is equal to 0. When the above conditions are met, the first of the three consecutive device facts is determined as the first stable device fact.

[0034] The conditions for a state transition to occur include: the state vector corresponding to the most recently confirmed equipment fact before the control action is issued is denoted as B; B and the target state vector E differ in at least one attribute value; and the state vector corresponding to the first stable equipment fact is completely identical to the target state vector E. When all three conditions are met simultaneously, the control action is considered to have caused a state transition from state vector B to the target state vector E.

[0035] When the causal watermark verification passes and the state transition is successful, the distribution record, action receipt, first stable device fact, state vector B, target state vector E, causal watermark, and distribution path fingerprint are encapsulated into a closed causal anchor point. The closed causal anchor point is identified as A. A is obtained as follows: the causal watermark, distribution path fingerprint, action receipt sequence number, and the reception sequence number of the first stable device fact are concatenated sequentially, the concatenation result is processed using the SHA-256 hash function, and the first 128 bits of the hash result are truncated.

[0036] When the causal watermark verification fails, or no three consecutive device facts satisfying the conditions are obtained within the observation period W, or the state vector B is completely consistent with the target state vector E, or the first stable device fact does not represent the target state vector E, the device fact after the action receipt is marked as a suspended fact. Suspended facts are further coded with the following causes: inconsistent causal watermarks are coded as C01; inconsistent path fingerprints are coded as C02; failure to obtain three consecutive device facts satisfying the conditions is coded as C03; and state transitions are not established, coded as C04. Suspended facts do not participate in causal interval partitioning.

[0037] The retention period for suspended facts is denoted as R. R equals 10 times the observation period W; when 10 times W is less than 30 seconds, R is 30 seconds; when 10 times W is greater than 300 seconds, R is 300 seconds. If a new action receipt or a new device fact is received within the retention period R, action receipt matching and the identification of the first stable device fact are re-executed. If the closure condition is not met after the retention period R, the suspended fact is written to the anomaly log and remains in a state where it does not participate in causal interval partitioning.

[0038] Taking the scenario of switching transfer pumps in a liquid ammonia storage tank as an example, after the transfer pump start action is issued, the valve actuator returns an action receipt via the Modbus link, the transfer pump contactor reports its operating status via the MQTT link, and the level gauge reports its level information via the OPC UA link. A closed causal anchor point is formed only when the action receipt matches the issued record in four aspects, and three consecutive device facts following the action receipt indicate that the transfer pump has transitioned from a stopped state to a started state. Old valve position facts delayed due to network congestion, mismatched action receipts returned due to session switching, and device facts whose state transition cannot be confirmed are all marked as suspended facts, thereby avoiding the use of inconsistent fact combinations from different sources for subsequent causal interval division.

[0039] The fact graph generation module maps device facts between adjacent causal anchor points to corresponding causal intervals, forming a fact graph.

[0040] The middleware arranges closed causal anchors in ascending order of their closing times. Taking any two adjacent closed causal anchors, the receiving time corresponding to the first stable device fact in the i-th closed causal anchor is denoted as the left boundary Li, and the sending time corresponding to the sending record in the (i+1)-th closed causal anchor is denoted as the right boundary Ri. The i-th causal interval is denoted as Ii, which includes device facts whose receiving times are greater than or equal to Li and less than Ri. The causal interval identifier is denoted as Ki. Ki is equal to the byte string obtained by concatenating the identifiers of the i-th and (i+1)-th closed causal anchors using the SHA-256 hash function, and then truncating the first 128 bits. Dangling facts are not written to Ii.

[0041] The middleware creates fact slots based on the device identifier for each device fact written to Ii. Each fact slot only holds device facts with the same device identifier. Each device fact includes at least the device reported sequence number, reception time, normalized attribute name, normalized attribute value, protocol type, transmission session identifier, and distribution path fingerprint. Two device facts with the same reception time are arranged in ascending order of gateway reception offset; two device facts with the same gateway reception offset are arranged in ascending order of device reported sequence number.

[0042] When device-reported sequence numbers exhibit loop wrapping, the middleware converts the original device-reported sequence number into an expanded device-reported sequence number. The protocol allows a maximum number of original device-reported sequence numbers, denoted as M. The wrapping count is denoted as C, initially set to 0. If the current original device-reported sequence number is less than the previous original device-reported sequence number, and the difference between the previous and current original device-reported sequence numbers is greater than M divided by 2, C is incremented by 1. The expanded device-reported sequence number U is calculated as follows: the current original device-reported sequence number is added to the result of C multiplied by M. The middleware then arranges the device facts within the same fact slot in ascending order of U. If the target protocol does not provide an original device-reported sequence number, the gateway receive offset is used as U, and a passive sorting flag is written into the device facts.

[0043] For each fact slot, the middleware determines a left boundary state vector, denoted as XL. If the device identifier corresponding to the current fact slot is the same as the device identifier corresponding to the first stable device fact in the i-th closed causal anchor point, the state vector corresponding to that first stable device fact is taken as XL. If the device identifiers are different, the most recent confirmed device fact whose reception time is less than or equal to Li is read, and the state vector corresponding to that confirmed device fact is taken as XL. The attributes in the state vector are arranged in ascending order of attribute name.

[0044] The middleware performs forward replay along the sequence number of the reported devices. For the j-th device fact after sorting, the previous state vector is denoted as Xj-1. When the j-th device fact is reported in full, all attribute values ​​in the j-th device fact are used to replace the corresponding attribute values ​​in Xj-1, resulting in the forward replay state vector Xj. When the j-th device fact is reported incrementally, only the changed attribute values ​​are used to replace the corresponding attribute values ​​in Xj-1, while the unchanged attribute values ​​are retained, resulting in Xj. The attribute names, attribute values, and units of measurement in Xj are concatenated sequentially, and the concatenated byte string is processed using the SHA-256 hash function. The first 128 bits are then extracted to obtain the forward replay digest.

[0045] In this context, the standardized attributes of the j-th device fact form a fact state vector Yj. The attribute names, attribute values, and units of measurement in Yj are concatenated sequentially. The concatenated byte string is processed using the SHA-256 hash function, and the first 128 bits are extracted to obtain the fact state digest. When the forward replay digest matches the fact state digest, and the U corresponding to the j-th device fact is equal to the U corresponding to the previous device fact plus 1, the j-th device fact is marked as forward reachable. Device facts carrying passive ordering tags are judged based on the continuity of gateway received offsets. When the difference in gateway received offsets between two adjacent device facts is equal to 1, the continuity condition is considered satisfied.

[0046] When two device facts with the same U appear in the same fact slot, the fact state summaries corresponding to the two device facts are compared. If the fact state summaries match, the device fact with the earlier reception time is retained, and the other device fact is marked as a duplicate reference. If the fact state summaries do not match, both device facts are marked as sequence number conflict facts. Sequence number conflict facts do not participate in forward playback and enter the clamping and attribution process.

[0047] The middleware performs reverse tracing based on the state transition corresponding to the (i+1)th closed causal anchor point. If the device identifier corresponding to the current fact slot is the same as the target device identifier in the (i+1)th closed causal anchor point, the state vector before the state transition in the (i+1)th closed causal anchor point is used as the right boundary state vector XR. If the device identifiers are different, the closest confirmed device fact to Ri, received at a time less than Ri, is read, and the state vector corresponding to that confirmed device fact is used as XR.

[0048] The middleware reads device facts in the fact slots in descending order of U. For the j-th device fact, the changed attributes recorded in the j-th device fact are restored to their original values, and the unchanged attribute values ​​are retained from the current reverse tracing state vector, resulting in the restored state vector Zj-1. Zj-1 is compared item by item with the fact state vector Yj-1 corresponding to the previous device fact. If the number of attributes, attribute names, attribute values, and units of measurement are the same, the previous device fact is marked as reversibly reachable, and Zj-1 is used as the state vector for the next reverse tracing. If the device fact is fully reported and does not carry the original attribute values, the device fact whose U is less than the current U and is closest to the current U is read, and the fact state vector corresponding to that device fact is used as Zj-1.

[0049] When the same device fact has both a forward reachability marker and a reverse reachability marker, the device fact is marked as bidirectionally closed. Bidirectional closure indicates that the device fact can be obtained both by replaying the reported sequence number along the device from the previous closed causal anchor point and by tracing back the state migration corresponding to the subsequent closed causal anchor point. Device facts with only a single-sided marker or no marker enter the clamping and attribution process.

[0050] The middleware performs path fingerprint inheritance for device facts lacking path fingerprints. For the device fact to be processed, it searches for the nearest preceding and succeeding device facts within the same fact slot. If both the preceding and succeeding device facts have path fingerprints, and the two path fingerprints are identical, the identical path fingerprint is written to the device fact to be processed. If there are changes in the transport session identifier, protocol adapter version number, or gateway identifier between the preceding and succeeding device facts, no writing is performed. If only a preceding device fact or only a succeeding device fact exists, the readable path fingerprint is compared with the path fingerprints in the adjacent closed causal anchor points; if the comparison results are consistent, the path fingerprint is written to the device fact to be processed.

[0051] For device facts that are not bidirectionally closed, the middleware performs clamping and attribution. The device fact to be processed is denoted as Fc. Within the same fact slot, the nearest bidirectionally closed device fact whose U is less than the corresponding U of Fc is read and used as the preceding state Fp; the nearest bidirectionally closed device fact whose U is greater than the corresponding U of Fc is read and used as the succeeding state Fn. If Fp or Fn is missing, clamping and attribution is not performed.

[0052] Clamping attribution is determined based on three conditions. The first condition is that the value corresponding to Fp is less than the value corresponding to Fc, and the value corresponding to Fc is less than the value corresponding to Fn. The second condition is that after writing the changed attribute recorded in Fc into the fact state vector corresponding to Fp, the resulting state vector is consistent with the fact state vector corresponding to Fc; after writing the attribute value before the change recorded in Fn back into the fact state vector corresponding to Fn, the resulting state vector can be traced back to the fact state vector corresponding to Fc along the device reporting sequence number. The third condition is that the path fingerprint corresponding to Fc is consistent with the path fingerprint corresponding to Fp, or the path fingerprint corresponding to Fc is consistent with the path fingerprint corresponding to Fn. When all three conditions are met, Fc is marked as clamping attribution and written to Ii.

[0053] When a conflicting fact enters the clamping and attribution process, an additional judgment is required: Write the conflicting facts into the corresponding fact state vectors of Fp, and continue forward playback in ascending order of U; retain the conflicting fact that can form a consistent result with the fact state vector corresponding to Fn, and mark the other conflicting fact as a suspended fact. If neither of the two conflicting facts can form a consistent result with the fact state vector corresponding to Fn, both conflicting facts are marked as suspended facts.

[0054] Devices that cannot be assigned a device are marked as pending facts and assigned a failure code is attached. Missing Fp is denoted as G01; missing Fn as G02; invalid state inheritance relationship as G03; invalid path fingerprint inheritance relationship as G04; unresolved sequence number conflict as G05. Pending facts do not participate in the formation of the fact relationship graph, nor do they participate in subsequent linkage rule matching.

[0055] The middleware uses the device facts that have completed bidirectional closure or clamp attribution as fact nodes. The fact node identifier is denoted as Nj. Nj is obtained as follows: Ki, device identifier, U, fact state digest, and attribution type are concatenated sequentially; the concatenated byte string is processed using the SHA-256 hash function; and then the first 128 bits are truncated. Attribution types include bidirectional closure and clamp attribution.

[0056] The middleware connects fact nodes according to state continuity relationships. Two adjacent fact nodes within the same fact slot are denoted as Na and Nb, respectively. When the state vector corresponding to Na is written into the change attributes recorded in Nb, and it is consistent with the state vector corresponding to Nb, and the U corresponding to Nb is equal to the U corresponding to Na plus 1, a state continuity edge is established pointing from Na to Nb. The state continuity edge contains Ki, device identifier, start U, and end U.

[0057] The middleware connects fact nodes according to action receipt associations. When the causal watermark, distribution path fingerprint, and action receipt sequence number of a fact node match those of any closed causal anchor point, the fact node corresponding to the first stable device fact in that closed causal anchor point is connected to the current fact node, establishing an action receipt association edge. The action receipt association edge is written with the closed causal anchor point identifier and the action receipt sequence number.

[0058] The middleware connects fact nodes according to causal interval affiliation. For each fact slot in Ii, the fact node with the smallest U is connected to the fact node corresponding to the first stable device fact in the i-th closed causal anchor point, establishing an interval entry edge; the fact node with the largest U is connected to the fact node corresponding to the first stable device fact in the (i+1)-th closed causal anchor point, establishing an interval exit edge. Both interval entry and interval exit edges are written to Ki. The fact relationship graph consists of fact nodes, state acceptance edges, action receipt association edges, interval entry edges, and interval exit edges.

[0059] In the scenario of switching transfer pumps in a liquid ammonia storage tank, valve actuators report valve position facts via Modbus links, transfer pump contactors report operational facts via MQTT links, and leak probes report leak facts via OPC UA links. Old valve position facts arriving late due to gateway queuing, although their reception time falls within Ii, cannot simultaneously satisfy forward playback and reverse tracing with their expanded device reporting sequence number. When the state inheritance relationship and the descending path fingerprint inheritance relationship between the old valve position fact and adjacent facts are also invalid, the old valve position fact is marked as a suspended fact. During subsequent reverse fact backtracking, only fact nodes that have completed bidirectional closure or clamping attribution in the fact relationship graph are called, thus avoiding splicing the old valve position fact with the new liquid level fact into a device state that has never actually occurred.

[0060] Please see Figure 2 As shown, the minimum triggering fact cut set extraction module replaces each fact that satisfies the linkage rule with its preceding state and rematches it to obtain the minimum triggering fact cut set that changes the linkage rule from satisfied to unsatisfied.

[0061] After the middleware completes the fact graph formation, it performs counterfactual back-substitution on the linkage rules currently in a satisfied state. Fact nodes participating in the matching of the current linkage rule are extracted only from fact nodes that have completed bidirectional closure or clamped attribution; suspended facts do not participate in counterfactual back-substitution. Each fact node participating in the matching records the fact node identifier, device identifier, causal interval identifier, closed causal anchor point identifier, issued record identifier, state receiving edge, action receipt association edge, fact state vector, and rule condition item number.

[0062] Linkage rules are structured into a condition tree based on the logical relationships between condition items. The condition tree includes leaf nodes and parent nodes. Each leaf node corresponds to one device attribute judgment, and its value can be 0 or 1. When a device attribute meets the judgment conditions recorded in the rule, the leaf node value is 1; when the device attribute does not meet the judgment conditions recorded in the rule, the leaf node value is 0. When the parent node is in an AND relationship, its value is equal to the product of the values ​​of all child nodes; when the parent node is in an OR relationship, its value is equal to 1 minus the product of the values ​​of each child node (each subtracted from 1) and then multiplied; when the parent node is in a NOT relationship, its value is equal to 1 minus the values ​​of its child nodes. The root node value is denoted as R. When R equals 1, the linkage rule is satisfied; when R equals 0, the linkage rule is not satisfied.

[0063] The middleware reads the fact nodes referenced by leaf nodes from the condition tree. When the same fact node is referenced by multiple leaf nodes, only the fact node identifier is retained once, and all rule condition item numbers are recorded under that fact node. The set of fact nodes participating in the matching of the current linkage rule is denoted as V. The number of fact nodes in V is denoted as m. V is sorted in ascending order by causal interval identifier, closing time of closed causal anchor point, device identifier, and reported sequence number of expanded device, to obtain the sequence of facts to be back-substituted.

[0064] For each fact node in the fact sequence to be back-replaced, the middleware reads the preceding state along the state-inheriting edge. If the current fact node has an incoming state-inheriting edge, the fact state vector corresponding to the previous fact node pointed to by the incoming state-inheriting edge is determined as the preceding state. If the current fact node does not have an incoming state-inheriting edge, the first stable device fact in the previous closed causal anchor point is read along the interval entry edge, and the fact state vector corresponding to that first stable device fact is determined as the preceding state. If neither the interval entry edge nor the incoming state-inheriting edge exists, the current fact node is marked as having no preceding fact node and does not participate in subsequent single back-replacements.

[0065] The middleware adjusts the sequence of facts to be returned based on the causal interval attribution relationship and the action receipt association relationship.

[0066] Fact nodes with action receipt associated edges are arranged before fact nodes without action receipt associated edges within the same causal interval; multiple fact nodes with action receipt associated edges are arranged in ascending order according to the issuance time of the corresponding issuance record; multiple fact nodes corresponding to the same issuance record are arranged according to the pointing order of the state receiving edges.

[0067] The adjusted sequence of facts to be backfactualized is denoted as B. B is used to ensure that the state change directly caused by the control action precedes the accompanying state change in counterfactual backfactualization.

[0068] The middleware sequentially performs replacements on individual fact nodes in B. For the j-th fact node in B, it copies all fact nodes used for matching the current linkage rule, replaces the fact state vector corresponding to the j-th fact node with the previous state, and leaves the remaining fact nodes unchanged. The set of replaced fact nodes is denoted as Vj. The middleware recalculates the leaf nodes in the condition tree affected by the j-th fact node based on Vj, and recalculates the values ​​of each parent node along the path from the leaf node to the root node, obtaining the back-substitution result Rj. When the root node value R before back-substitution is equal to 1 and the back-substitution result Rj is equal to 0, the j-th fact node is marked as a failure pivot. The failure pivot record includes at least the fact node identifier, the previous fact node identifier, the causal interval identifier, the closed causal anchor point identifier, the issued record identifier, the affected rule condition item number, and the back-substitution result. The failure pivot is used to characterize that, under the condition that the remaining fact nodes remain unchanged, restoring the fact node to its previous state will cause the current linkage rule to lose its satisfied state.

[0069] The failed pivots in the back-substitution pivot table are grouped according to two types of association relationships.

[0070] The first type of association is where multiple failure pivots correspond to the same closed causal anchor point; The second type of association is that multiple failure points can be traced back to the same issued record along the action receipt association edge.

[0071] When any one type of association is established, the corresponding failed pivot is written to the same folding group. When a failed pivot satisfies the writing conditions of multiple folding groups, the byte string concatenated with the closing causal anchor identifier, the issued record identifier, and the expanded device reported sequence number is used as the sorting basis, and the failed pivot is written to the folding group with the highest sorting position.

[0072] The middleware performs reverse folding for each fold group. Reverse folding starts from the failure pivot with the largest reported sequence number from the unfolding device, and reads the previous failure pivot in the same fold group in reverse order along the state connection edges. The previous failure pivot is denoted as Fa, and the subsequent failure pivot is denoted as Fb. The middleware reads the preceding state of Fa and replays the change attributes recorded by the fact nodes one by one along the state connection edges from Fa to Fb. During the replay process, change attributes that are the same as the corresponding issued record of Fa are not written to the replay state; change attributes that are different from the corresponding issued record of Fa are written to the replay state according to the order of the state connection edges. After the replay is completed, the folded state is obtained.

[0073] When the number of attributes, attribute names, attribute values, and units of measurement are the same, it is determined that the state change corresponding to Fb can be formed by the state change corresponding to Fa along the action receipt association relationship. Fb is marked as an accompanying fulcrum and removed from the folding group.

[0074] If any one of the comparison results differs, Fb is retained. Reverse folding continues until all failed pivots in the folding group have been compared. The failed pivots retained after reverse folding are used to represent independent state changes that cannot be replaced by preceding changes of the same control action.

[0075] For example, a pump start-up action may sequentially cause the contactor to engage, the outlet valve to open, and the pump outlet pressure to change. The contactor fact node, outlet valve fact node, and pressure fact node can all be identified as failure points. When all three failure points are traced back to the same pump start-up record along the action receipt association edge, and after restoring the contactor fact node to its previous state, the outlet valve opening and pressure change no longer occur during playback along the state continuation edge, then the outlet valve fact node and pressure fact node are marked as accompanying failure points. After reverse folding, only the contactor fact node is retained to avoid repeatedly including continuous state changes caused by the same control action in the minimum trigger fact cut set.

[0076] The middleware aggregates the retained failure pivots from each folding group to form a combined back-substitution candidate set. This combined back-substitution candidate set is denoted as C. The number of failure pivots in C is denoted as n. C is sorted in ascending order by causal interval identifier, closing time of closed causal anchor point, issuing time of issued record, and reported sequence number of unfolded device. The sorted failure pivots are denoted as C1 to Cn. A back-substitution bit string of length n is created for C. Each bit in the back-substitution bit string corresponds to one failure pivot. When the k-th bit is 1, the fact state vector corresponding to Ck is replaced with the preceding state of Ck; when the k-th bit is 0, the fact state vector corresponding to Ck remains unchanged. The number of bits with a value of 1 in the back-substitution bit string is denoted as the back-substitution count. The back-substitution count is equal to the sum of all bit values ​​in the back-substitution bit string. Back-substitution bit strings are enumerated in order of back-substitution count from 1 to n. Multiple back-substitution bit strings with the same back-substitution count are arranged in ascending order according to the binary sequence formed by the corresponding bit values ​​from C1 to Cn. For each substitution string, the middleware replaces the failed pivots with a value of 1 with their corresponding preceding states, while the remaining fact nodes retain their current states, and recalculates the value of the condition tree root node. The recalculated root node value is denoted as Rc. When Rc equals 0, the set of failed pivots corresponding to the current substitution string is recorded as a candidate fact cut set. The middleware continues to verify each failed pivot in the candidate fact cut set. For the k-th failed pivot in the candidate fact cut set, it is removed from the set, restoring it to its current fact state vector, while the remaining failed pivots retain their preceding states, and the condition tree root node value is recalculated. The recalculated root node value is denoted as Rc,k.

[0077] When every single failure pivot in the candidate fact cut set satisfies Rc,k = 1, it means that removing any one failure pivot would not maintain the change in the linkage rule from a satisfied state to a dissatisfied state. This candidate fact cut set is then determined as the minimum triggering fact cut set. The middleware enumerates the back-substitution counts from 1 to n sequentially. Therefore, the candidate fact cut set that passes the verification for the first time simultaneously satisfies both the minimum number of failure pivots and the absence of redundant failure pivots.

[0078] When multiple candidate fact cut sets pass verification for the same number of iterations, the failed pivots in each candidate fact cut set are arranged in ascending order of causal interval identifier, closing causal anchor point closing time, and issuing record issuing time. The candidate fact cut set whose byte string appears first after sorting is determined as the minimum triggering fact cut set. The remaining candidate fact cut sets that pass verification are written into the equivalent cut set record for subsequent tracing. The minimum triggering fact cut set record includes at least the cut set identifier, failed pivot point identifier, preceding fact node identifier, causal interval identifier, closing causal anchor point identifier, issuing record identifier, action receipt sequence number, and the number of the affected rule condition item. The cut set identifier is obtained as follows: all failed pivots in the minimum triggering fact cut set are arranged in ascending order of causal interval identifier, device identifier, and expanded device reporting sequence number; the arranged failed pivot point identifier, preceding fact node identifier, closing causal anchor point identifier, and issuing record identifier are concatenated sequentially; the concatenated byte string is processed using the SHA-256 hash function, and the first 128 bits of the hash result are extracted.

[0079] For example, the current linkage rules include the tank level meeting the transfer conditions, the outlet valve being open, the leak probe being leak-free, and the transfer pump being stopped. The fact graph contains a new level fact node, an old outlet valve fact node, an expired leak-free fact node, and a transfer pump stop fact node. The middleware sequentially replaces each fact node with its preceding state and rematches the linkage rules. After the new level fact node is restored to its preceding state, the linkage rule changes from a satisfied state to a dissatisfied state; similarly, after the expired leak-free fact node is restored to its preceding state, the linkage rule also changes from a satisfied state to a dissatisfied state. After action receipt relationship tracing and reverse folding, the two failure pivots correspond to different closed causal anchors and cannot be folded into accompanying changes of the same control action. After combined back substitution, the two failure pivots are jointly determined as the minimum triggering fact cut set.

[0080] Subsequent causal compatibility checks are performed only on fact nodes in the minimum triggering fact cut set. Compared to performing cross-interval checks on all fact nodes in the fact relationship graph, this process can exclude accompanying state changes unrelated to the establishment of the linkage rule and limit the verification scope to the set of fact nodes that directly determine the establishment of the linkage rule. When fact nodes in the minimum triggering fact cut set cross causal intervals that cannot be simultaneously established, subsequent processing does not generate activation tokens, thereby avoiding erroneous pump start actions formed by splicing new liquid level facts, old valve position facts, and expired no-leakage facts.

[0081] Please see Figure 3 As shown, the activation token generation module determines whether the facts in the minimum triggering fact cut set cross incompatible causal intervals. If not, it generates an activation token containing a cut set summary, an anchor point summary, and the target device state version.

[0082] After obtaining the minimum triggering fact cut set, the middleware performs a causal interval compatibility judgment for each failed pivot in the minimum triggering fact cut set. The failed pivot is denoted as Fs. The middleware reads the previous closed causal anchor point along the interval entry edge of the fact node corresponding to Fs, reads the next closed causal anchor point along the interval exit edge, and reads the corresponding issued path fingerprint, causal interval identifier, device identifier, expanded device reported sequence number, previous fact node identifier, and action receipt associated edge corresponding to Fs.

[0083] The middleware arranges the previous closed causal anchor, the corresponding fact node of Fs, and the next closed causal anchor in chronological order to form a basic interval witness chain. The basic interval witness chain includes at least a start anchor identifier, an end anchor identifier, a causal interval identifier, a failure pivot identifier, a distribution path fingerprint, and a set of state-connecting edges. When an action receipt associated edge exists, the corresponding distribution record is read along the action receipt associated edge, and the closed causal anchor associated with the distribution record is written into the basic interval witness chain. If a new closed causal anchor is added before the start anchor, the start anchor is updated; if a new closed causal anchor is added after the end anchor, the end anchor is updated.

[0084] Each closed causal anchor point is written with a closure sequence number. The closure sequence numbers are arranged in ascending order of closure time and then sequentially assigned numbers from 1 to p. When two closed causal anchor points correspond to the same closure time, they are arranged in ascending order according to the byte string corresponding to the closed causal anchor point identifier. The closed causal anchor points in the basic interval witness chain are connected in ascending order of closure sequence numbers to obtain the interval witness chain. The interval witness chain is used to indicate which closed causal anchor point a failure pivot point can start from, through which state-accepting edges and action-received edges, and to which closed causal anchor point it can reach. Interval witness chains are formed for all failure pivot points in the minimum triggering fact cut set. The number of interval witness chains is equal to the number of failure pivot points in the minimum triggering fact cut set. The middleware arranges all interval witness chains in ascending order of the starting anchor point closure sequence number, the ending anchor point closure sequence number, the causal interval identifier, and the failure pivot point identifier to obtain the interleaving list. Interleaving is performed on the interleaving list according to the closure sequence number. The interleaving process includes: reading the first closed causal anchor point that has not yet been written into all interval witness chains; selecting the closed causal anchor point with the smallest closure sequence number from the reading results and writing it into the common closed corridor; deleting the current node in each interval witness chain that is the same as the already written closed causal anchor point; repeating the reading, selection, and deletion operations until all closed causal anchor points in all interval witness chains are written into the common closed corridor. The closed causal anchor points in the common closed corridor are arranged in strictly ascending order of closure sequence number.

[0085] The middleware establishes an anchor point order table during the interleaving process. Each row in the anchor point order table corresponds to two closed causal anchor points. Taking any two closed causal anchor points A and B, if A precedes B in the interval witness chain, the order value from A to B is recorded as 1; if B precedes A, the order value from A to B is recorded as -1; if neither interval witness chain contains A nor B simultaneously, the order value from A to B is recorded as 0. For the same pair of closed causal anchor points, if different interval witness chains write 1 and -1 respectively, it is considered that there is a closed order reversal, and the relevant causal intervals are marked as incompatible.

[0086] For example, the first interval witness chain records that closed causal anchor point A precedes closed causal anchor point B, and the second interval witness chain records that closed causal anchor point B precedes closed causal anchor point A. The two interval witness chains cannot simultaneously embed into a common closed corridor with strictly increasing closing sequence numbers. In this case, even if both interval witness chains can complete forward replay, it cannot prove that the two failed pivots were simultaneously established during the same state evolution process. The middleware marks the causal intervals containing A and B as mutually incompatible.

[0087] After determining the closure sequence, the middleware performs state replay on the common closed corridor. State replay starts from the first closed causal anchor point in the common closed corridor. For each failed pivot, the corresponding fact state vector is replaced with the preceding state, and then the changed attributes recorded by subsequent fact nodes are written sequentially along the state-carrying edges. Each attribute write records the device identifier, the issued path fingerprint, the expanded device reporting sequence number, the attribute name, the attribute value before writing, the attribute value after writing, and the source fact node identifier.

[0088] The middleware establishes state continuity records based on the state replay results. These records are categorized by device identifier, distribution path fingerprint, expanded device reporting sequence number, and attribute name. Only one write-after attribute value is allowed for each category. If two different write-after attribute values ​​appear for the same category, it is considered that the same device along the same distribution path fingerprint has mutually exclusive state continuity results, and the corresponding causal intervals are marked as incompatible. Mutually exclusive state continuity results are determined as follows: For enumerated attributes, different write-after attribute values ​​indicate mutual exclusivity; for Boolean attributes, one write-after attribute value being true and the other being false indicates mutual exclusivity; for numerical attributes, the values ​​are converted to a unified unit of measurement before comparison, and two unequal write-after attribute values ​​indicate mutual exclusivity; for string attributes, they are converted to byte strings using UTF-8 encoding, and inconsistent byte strings indicate mutual exclusivity.

[0089] For example, the first interval witness chain records that the outlet valve actuator completes the opening action along the issued path fingerprint P1, and the valve position attribute changes from closed to open; the second interval witness chain records that the same outlet valve actuator completes the closing action along the same issued path fingerprint P1, and the valve position attribute changes from open to closed. If both interval witness chains write the valve position attribute corresponding to the same deployed device report sequence number into different results, then the corresponding facts cannot be in the same common closed corridor, and the middleware will mark the relevant causal intervals as incompatible.

[0090] In this invention, when any interval witness chain contains an action receipt associated edge, the action receipt associated edge must be traceable to a unique issued record. If one action receipt associated edge traces to two different issued records, or two action receipt associated edges with the same action receipt sequence number trace to different causal watermarks, the relevant causal intervals are marked as incompatible. This process is used to exclude false state succession caused by action receipt mismatch after gateway session switching. After completing the closure order judgment, state replay, and action receipt associated edge integrity verification, the marking results of all causal intervals are read. When any causal interval has an incompatible mark, it is determined that the minimum triggering fact cut set crosses the incompatible causal intervals, no activation token is formed, and the failure pivot in the minimum triggering fact cut set is written into the suspended record. The suspended record includes at least the cut set identifier, failure pivot identifier, incompatibility type, relevant closed causal anchor identifier, and relevant issued path fingerprint.

[0091] When all interval witness chains can be embedded into the same common closed corridor, and all causal intervals do not contain incompatible markers, the minimum triggering fact cut set is considered not to cross incompatible causal intervals. The middleware reads the failure pivot identifier, preceding fact node identifier, causal interval identifier, closed causal anchor identifier, and issued record identifier from the minimum triggering fact cut set. These are then arranged in ascending order by causal interval identifier, device identifier, and expanded device reporting sequence number. The resulting byte string is concatenated sequentially, processed using the SHA-256 hash function, and the first 128 bits are truncated to obtain the cut set digest. Similarly, all closed causal anchor identifiers, closure sequence numbers, causal watermarks, and issued path fingerprints in the common closed corridor are read. These are arranged in ascending order by closure sequence number, and the resulting byte string is concatenated sequentially. The resulting byte string is processed using the SHA-256 hash function, and the first 128 bits are truncated to obtain the anchor digest.

[0092] The middleware reads the latest confirmed device fact from the target device. If the target device natively provides a status version, it directly uses the status version returned by the target device; if the target device does not provide a status version, it concatenates the target device identifier, the corresponding expanded device report sequence number of the latest confirmed device fact, and the fact status digest in sequence, processes the concatenation result using a SHA-256 hash function, and truncates the first 128 bits to obtain the target device status version. It then concatenates the cut set digest, anchor digest, target device status version, linkage rule identifier, rule version number, target device identifier, and token sequence number in sequence, processes the concatenation result using a SHA-256 hash function, and truncates the first 128 bits to obtain the activation token identifier. The token sequence number increments by 1 sequentially according to the order in which activation tokens have been generated for the same target device. The activation token includes at least the activation token identifier, cut set digest, anchor digest, target device status version, linkage rule identifier, rule version number, target device identifier, and token sequence number.

[0093] Once the activation token is generated, it is used only for one coordinated action to be issued to the corresponding target device. Before subsequent issuances, the current state version returned by the target device or edge agent is read again and compared with the target device state version in the activation token. If the two state versions match, the coordinated action can be converted into a target protocol instruction; if the two state versions do not match, the current activation token is revoked, and causal interval mapping, counterfactual back-substitution, and causal interval compatibility judgment are re-executed based on the updated device facts.

[0094] It should be noted that the false linkage condition formed by splicing together the new liquid level fact, the old valve position fact, and the expired no-leakage fact during the switching of the transfer pump in the liquid ammonia storage tank will not enter the command issuance stage simply because the rule condition appears to be true. Only when all failure pivots in the minimum trigger fact cut set can be embedded in the same common closed corridor, and the state succession results do not have an exclusive relationship, will an activation token be formed, thereby blocking erroneous pump start actions that cross different real state stages.

[0095] Before issuing the instruction, the module obtains the current state version of the target device or its edge agent. Only when the current state version matches the activation token will the linkage action be converted into a target protocol instruction and issued. Otherwise, the fact relationship graph generation module will be re-executed based on the updated device facts.

[0096] After generating an activation token, the middleware establishes a pending delivery record. This record includes at least the activation token identifier, target device identifier, linkage rule identifier, rule version number, target device status version, linkage action, generation time, and token sequence number. An activation token can only be used once for a target protocol command and cannot be reused after cancellation, timeout, or completion of delivery. Before the command is delivered, the middleware reads the current status version from the target device. If the target device natively provides a status version, the middleware directly reads the status version returned by the target device. If the target device does not provide a status version, the middleware reads the most recently confirmed device fact from the edge agent, concatenates the target device identifier, expanded device report sequence number, and fact status digest sequentially, processes the concatenated byte string using the SHA-256 hash function, and truncates the first 128 bits to obtain the current status version.

[0097] The device facts returned by the edge agent must meet three conditions simultaneously: The actual device identifier matches the target device identifier in the record to be issued; The device's actual corresponding distribution path fingerprint is consistent with the distribution path fingerprint read when the activation token is formed; The actual time of device reception is no more than the valid duration from the current reading time. The valid duration is 3 times the device reporting cycle; if the calculated result is less than 2 seconds, take 2 seconds; if the calculated result is greater than 10 seconds, take 10 seconds.

[0098] The current status version is compared byte-by-byte with the target device status version in the activation token. It also checks whether the activation token identifier has not been consumed, whether the token sequence number is the latest token sequence number corresponding to the target device, and whether the rule version number is still enabled. If all checks are consistent, the linkage action is handed over to the protocol adapter for format conversion.

[0099] The protocol adapter reads the instruction template corresponding to the linkage action based on the target device's protocol type, device model, target endpoint, and protocol adapter version number. It then writes the action type, action parameters, and target device identifier into the instruction template. If the protocol allows writing ignorable extended fields, the lower 16 bits of the activation token identifier are written into the ignorable extended fields; if the protocol does not allow writing ignorable extended fields, the activation token identifier, transmission session identifier, and target protocol instruction summary are written into the session sideband record.

[0100] The target protocol instruction digest is obtained as follows: the target device identifier, action type, action parameters, target endpoint, token sequence number, and protocol adapter version number are concatenated sequentially. The concatenated byte string is then processed using the SHA-256 hash function, and the first 128 bits are truncated. The middleware writes the target protocol instruction, target protocol instruction digest, and activation token identifier into the distribution record, sends it to the target device via the corresponding distribution path, and marks the activation token as consumed.

[0101] When the current state version is inconsistent with the target device state version in the activation token, the middleware revokes the activation token, writes the device facts corresponding to the current state version into the device fact set, and records the reason for revocation. The reason for revocation includes at least state version change, distribution path change, rule version change, and token expiration. After completing the device fact writing, starting from the previous closed causal anchor point closest to the current device fact, the middleware re-executes causal interval mapping, fact relationship graph formation, minimum triggering fact cut set extraction, and causal interval compatibility judgment, without directly reusing the revoked activation token.

[0102] If the target device does not return an action receipt within 2 times the device reporting cycle, or if the returned action receipt is inconsistent with the target protocol instruction summary, the middleware will mark the corresponding issued record as an unclosed record, mark the device fact after the action receipt as a pending fact, and reread the current status version of the target device.

[0103] By performing a status version review before sending the target protocol command and incorporating the status version changes back into the fact diagram formation process, it is possible to avoid continuing to execute linkage actions based on old facts when the target device status has changed.

[0104] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A middleware-based multi-source device heterogeneous fusion and intelligent control system, characterized in that, include: The causal anchor construction module obtains facts and action receipts from heterogeneous devices and constructs causal anchors based on the issuance and receipt records of the same control action. The fact graph generation module maps device facts between adjacent causal anchor points to corresponding causal intervals to form a fact graph. The minimum triggering fact cut set extraction module, based on the fact relationship graph, sequentially replaces each fact that satisfies the linkage rule with its preceding state and rematches it to obtain the minimum triggering fact cut set that changes the linkage rule from satisfied to unsatisfied, including: S301, extract the fact nodes that participate in the matching of the current linkage rule from the fact relationship graph, and read the previous state corresponding to each fact node along the state receiving edge; for fact nodes that do not have an incoming state receiving edge, read the first stable device fact in the previous closed causal anchor point as the previous state along the interval entering edge. S302, arrange the fact nodes participating in the matching according to the causal interval attribution relationship and the action receipt association relationship, so that the fact nodes with the action receipt association edge enter the back-substitution sequence before other fact nodes in the same causal interval; S303, replace the single fact node in the back-substitution sequence with the corresponding preceding state in turn, and rematch the linkage rule while keeping the other fact nodes unchanged. The fact node that causes the linkage rule to change from being satisfied to not being satisfied will be marked as a failure pivot. S311, write the failure pivots that correspond to the same closed causal anchor point or can be traced back to the same issued record along the action receipt associated edge into the same fold group; S312, for each folding group, read the failure fulcrum in reverse order according to the reported sequence number of the unfolding device, and perform reverse folding along the state receiving edge; when the state change corresponding to the failure fulcrum located behind can be formed by the state change corresponding to the failure fulcrum located in front along the action receipt association relationship, mark the failure fulcrum located behind as the accompanying fulcrum and remove it from the folding group. S313, establish a back-substitution bit string for the failed pivot points retained after reverse folding, and perform combined back-substitution sequentially starting from 1 according to the number of back-substitutions; S314. The set of failure points that, after combination back substitution, cause the linkage rule to change from satisfied to unsatisfied, and the state change result of the linkage rule changing from satisfied to unsatisfied cannot be maintained after removing any of the failure points, is determined as the minimum triggering fact cut set. The activation token generation module determines whether the facts in the minimum triggering fact cut set cross incompatible causal intervals. If not, it generates an activation token containing a cut set summary, an anchor point summary, and the target device state version. Before issuing the instruction, the module obtains the current state version of the target device or its edge agent. Only when the current state version matches the activation token will the linkage action be converted into a target protocol instruction and issued. Otherwise, the fact relationship graph generation module will be re-executed based on the updated device facts.

2. The middleware-based multi-source device heterogeneous fusion and intelligent control system according to claim 1, characterized in that, The causal anchor construction module performs the following steps: S101, For the control action to be issued, construct a issuance record including the target device identifier, action type, action parameter summary, issuance sequence number and issuance time; S102, the protocol adapter selects a carrier that does not change the execution semantics according to the order of ignorable extended fields, equivalent encoding sequences and session side tags, and writes the causal watermark that uniquely corresponds to the control action into the carrier. S103, the protocol type, protocol adapter instance identifier, gateway identifier, transmission channel identifier, transmission session identifier, target endpoint, distribution sequence number and protocol adapter version number are concatenated in sequence to form the distribution path fingerprint of the corresponding distribution record.

3. The middleware-based multi-source device heterogeneous fusion and intelligent control system according to claim 2, characterized in that, The causal anchor construction module also performs the following steps: S111, Receive action receipt, extract causal watermark from the carrier carried by the action receipt, or read causal watermark from the session sideband record according to the transmission session identifier and receipt sequence number, and recalculate the receipt path fingerprint according to the transmission path traversed when the action receipt arrives. S112, only when the cause-effect watermark, path fingerprint, device identifier and issue sequence number are consistent will the action receipt be recognized as corresponding to the issue record; S113. Within the observation period after the action receipt, find three consecutive device facts with the same device identifier, consecutive receiving sequence number, sequentially increasing acquisition time, and state vector consistent with the target state vector, and determine the first one as the first stable device fact. S114, when there is a difference between the state vector before the control action is issued and the target state vector, and the first stable device fact represents the migration to the target state vector, the issuance record, action receipt and the first stable device fact are encapsulated as a closed causal anchor point; otherwise, the device fact after the action receipt is marked as a suspended fact.

4. The middleware-based multi-source device heterogeneous fusion and intelligent control system according to claim 1, characterized in that, The fact diagram generation module performs the following steps: S201, arrange the closed causal anchor points according to the closing time, take the receiving time corresponding to the first stable device fact in the previous closed causal anchor point as the left boundary, and take the sending time corresponding to the sending record in the next closed causal anchor point as the right boundary, and establish the causal interval. S202, Write the device facts that are not marked as suspended facts within the causal interval into the corresponding fact slots according to the device identifier; S203, when the device reported sequence number is looped, the original device reported sequence number is converted into an expanded device reported sequence number based on the difference between the current device reported sequence number and the previous device reported sequence number and the sequence number space allowed by the protocol; when the target protocol does not provide a device reported sequence number, the expanded device reported sequence number is replaced by the gateway received offset and a passive sorting flag is written.

5. The middleware-based multi-source device heterogeneous fusion and intelligent control system according to claim 4, characterized in that, The fact diagram generation module also performs the following steps: S211, For each fact slot, starting from the left boundary state vector, write the full attributes or change attributes sequentially along the reported sequence number of the expanded device to obtain the positive playback state vector; when the positive playback state vector is consistent with the fact state vector corresponding to the device fact and the reported sequence number of the expanded device is continuous, mark the device fact as positively reachable. S212, starting from the right boundary state vector, restore the changed attributes recorded in the device facts to their original values ​​in reverse order of the reported sequence number of the expanded device; when the restored state vector is consistent with the state vector corresponding to the previous device fact, mark the previous device fact as reachable in the reverse direction. S213, the device that has both forward reachability and reverse reachability is marked as a two-way closed device; S214, for a device fact that is not bidirectionally closed, if its deployed device reported sequence number is between adjacent bidirectionally closed device facts, its state change can be obtained from the playback of the previous state and can be traced back from the subsequent state, and its issued path fingerprint is consistent with the previous device fact or the subsequent device fact, it is marked as clamped and assigned; otherwise, it is marked as suspended.

6. The middleware-based multi-source device heterogeneous fusion and intelligent control system according to claim 5, characterized in that, The fact diagram generation module also performs the following steps: S221, converts the device fact that has completed bidirectional closure or clamping ownership into a fact node; S222, when adjacent fact nodes belong to the same fact slot, the expanded device reporting sequence number of the later fact node is equal to the expanded device reporting sequence number of the earlier fact node plus 1, and the corresponding state of the later fact node can be obtained after writing the change attribute recorded by the later fact node to the earlier fact node, a state connection edge is established between adjacent fact nodes. S223, when the causal watermark, the path fingerprint and the action receipt sequence number corresponding to the fact node are consistent with the closed causal anchor point, establish an action receipt association edge between the fact node and the first stable device fact in the closed causal anchor point. S224. Connect the fact node with the smallest reported sequence number in each fact slot to the previous closed causal anchor point, and connect the fact node with the largest reported sequence number to the next closed causal anchor point. Establish interval entry edges and interval exit edges respectively to form a fact relationship graph.

7. The middleware-based multi-source device heterogeneous fusion and intelligent control system according to claim 1, characterized in that, The activation token generation module performs the following steps: S401, for each failed pivot in the minimum triggering fact cut set, read the closed causal anchor points before and after along the interval entry edge and interval exit edge, and combine the action receipt associated edge and the issued path fingerprint to form an interval witness chain. S402, according to the closing order of the closed causal anchor points, interweave the witness chains of each interval, replace each failed fulcrum with the corresponding previous state, and perform replay along the state-bearing edge to obtain a common closed corridor; S403, when different interval witness chains give opposite closing orders for the same pair of closed causal anchor points, or when the same device in the same closed corridor has different attribute values ​​along the same distribution path fingerprint and the same unfolded device reporting sequence number, the corresponding causal intervals will be marked as incompatible. S404, determine that the minimum triggering fact cut set does not cross mutually exclusive causal intervals only when all interval witness chains can be embedded in the same common closed corridor and there are no mutually exclusive markers.

8. The middleware-based multi-source device heterogeneous fusion and intelligent control system according to claim 7, characterized in that, The activation token generation module and command issuance module perform the following steps: S501, the failure pivot identifier, preceding fact node identifier, causal interval identifier, closed causal anchor identifier, and issued record identifier in the minimum triggering fact cut set are concatenated in sequence and hashed to obtain the cut set summary; the closed causal anchor identifier, closure sequence number, causal watermark, and issued path fingerprint in the common closed corridor are concatenated in sequence and hashed to obtain the anchor summary. S502, write the cut set summary, anchor point summary, target device status version, linkage rule identifier, rule version number, target device identifier and token serial number into the activation token; S503 reads the current status version returned by the target device or edge agent before sending it out. Only when the current status version is consistent with the target device status version in the activation token, the activation token has not been consumed, the token sequence number is the latest token sequence number corresponding to the target device, and the rule version number is still in the enabled state, the linkage action is converted into a target protocol instruction and sent to the target device through the corresponding sending path. S504, after the target protocol instruction is sent, mark the activation token as consumed; When the current state version is inconsistent, the action receipt is not returned within 2 times the device reporting cycle, or the action receipt is inconsistent with the target protocol instruction digest, the activation token is revoked, the updated device facts are written into the device fact set, and the fact relationship graph generation module is re-executed starting from the previous closed causal anchor point closest to the updated device facts.

Images