Process alarm intelligent optimization method and system based on association rules

Abstract

The application relates to the technical field of process alarm intelligent optimization, and discloses a process alarm intelligent optimization method and system based on association rules, which comprises the following steps: according to historical process alarm parameter data, an association rule library corresponding to each working condition is established through association rule analysis; the causal strength of each rule in the association rule library is analyzed, the corresponding transfer entropy is calculated, a directed edge is established between alarm cause points by taking the transfer entropy as the weight of the edge, and a first association network is constructed; cause matching is performed in the first association network, corresponding cause points are identified, cause points with a connection relationship are screened out, a second association network is obtained; alarm root cause analysis is performed in the second association network, the connection edge weight and path length are analyzed, the corresponding path effective value is calculated, invalid paths and invalid cause points are dynamically removed according to the path effective value, and the process alarm is responded; and the application ensures that the finally positioned root cause is a real effective alarm source, and improves the accuracy and response speed of the alarm.

Description

Technical Field

[0001] This application relates to the field of intelligent optimization technology for process alarms, and more specifically to a method and system for intelligent optimization of process alarms based on association rules. Background Technology

[0002] Currently, in modern industrial production, process alarm systems are a crucial component in ensuring production safety, equipment stability, and product quality. With the continuous improvement of industrial automation and informatization, production processes are becoming increasingly complex, and the number of monitoring points is growing exponentially. Distributed control systems and real-time databases record massive amounts of process parameters, and when these parameters exceed preset thresholds, the system generates alarms. Traditional alarm management systems generally face the problem of alarm overload. When process fluctuations or equipment anomalies occur, hundreds or even thousands of alarm messages may be triggered in a short period, many of which are causally related or duplicate alarms. Under such information overload, operators find it difficult to accurately identify the true root cause of the fault from the massive number of alarms in a very short time, leading to response delays and misjudgments.

[0003] Existing technologies have the following problems: alarm correlation analysis targets data across all time periods, ignoring the multi-condition characteristics of the production process, and cannot accurately bind alarm information to specific operating conditions, resulting in poor generalization ability and high false alarm rate; correlation analysis reveals simultaneous alarm occurrences but cannot effectively distinguish alarm causes, easily providing misleading information during root cause localization; once a fixed alarm strategy is set, it is difficult to dynamically adjust it with process changes, equipment aging, and other factors, resulting in poor environmental adaptability; to solve at least one of the above problems, this application proposes a process alarm intelligent optimization method and system based on correlation rules. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the purpose of this application is to provide a method and system for intelligent optimization of process alarms based on association rules, which can effectively solve the problems in the background technology. The specific technical solution of this application is as follows:

[0005] Intelligent optimization methods for process alarms based on association rules include:

[0006] Data analysis is performed based on historical process alarm parameter data to analyze the operating status corresponding to the alarm points, and an association rule library is established for each operating condition through association rule analysis.

[0007] Analyze the causal strength of each rule in the association rule base, calculate the corresponding transition entropy, use the transition entropy as the weight of the edge, establish directed edges between alarm cause points, and construct the first association network;

[0008] Based on the real-time process alarm parameters, determine the real-time operating conditions and analyze the alarm situation. Perform cause matching in the first association network to identify the corresponding cause points and filter out the cause points with connection relationships to obtain the second association network.

[0009] In the second association network, alarm root cause analysis is performed. The connection edge weights and path lengths are analyzed to calculate the corresponding path validity values. Invalid paths and invalid cause points are dynamically removed according to the path validity values ​​to respond to process alarms.

[0010] Specifically, the process involves analyzing historical process alarm parameter data to determine the operating conditions corresponding to alarm points, and establishing a rule library for each operating condition through association rule analysis, including:

[0011] Data analysis is performed based on historical process alarm parameter data to extract corresponding parameter statistical features, analyze the frequency of occurrence of different alarm information within a preset time window, construct feature vectors, and cluster to obtain the operating status corresponding to each alarm point.

[0012] By analyzing the rules within a working condition and the working condition transition, a rule library corresponding to each working condition is established.

[0013] Specifically, the step of analyzing the rules and transitions within a work condition through association rules to establish an association rule base for each work condition includes:

[0014] Within each working condition, the temporal correlation of the rules is analyzed to obtain the first correlation rule;

[0015] Based on historical operating condition transition data, the migration of rules during the operating condition transition process is analyzed to obtain the second association rule;

[0016] By combining the first and second association rules, an association rule library is established for each working condition.

[0017] Specifically, the analysis of the causal strength of each rule in the association rule base, the calculation of the corresponding transition entropy, and the use of the transition entropy as the weight of the edges, establishes directed edges between alarm cause points to construct the first association network, including:

[0018] Analyze the causal strength of each rule in the association rule base, calculate the transition probability of the rule through the conditional probability distribution, and obtain the transition entropy;

[0019] For the same rule that appears in multiple working conditions, calculate the average value of the transition entropy under each working condition to obtain the weight of the edge;

[0020] Based on the edge weights, directed edges are established between the alarm cause points to construct the first association network.

[0021] Specifically, the process involves determining the real-time operating conditions and analyzing the alarm status based on real-time process alarm parameters, performing cause matching in the first association network to identify corresponding cause points, and filtering out cause points with connection relationships to obtain the second association network, including:

[0022] Based on the real-time process alarm parameters, the real-time operating conditions are determined and the alarm situation is analyzed. The alarm situation is used as the rule pre-order node and rule post-order node respectively. Cause matching is performed in the first association network to identify the corresponding cause points and obtain the target point set.

[0023] Based on the set of target points, cause points with connection relationships are selected to obtain the second association network.

[0024] Specifically, the step of filtering out cause points with connection relationships based on the target point set to obtain the second association network includes:

[0025] Based on the set of target points, cause points that have at least one directed connected path with the target points are selected from the first association network to obtain the first connected network;

[0026] Based on the real-time operating condition analysis, the matching degree between the cause points and the operating conditions in the first connected network is analyzed, and the cause points with a matching degree greater than the preset matching threshold are filtered out to obtain the second connected network.

[0027] Analyze the direction of the connected paths in the second connected network, calculate the in-degree and out-degree of the corresponding cause points, and calculate the connection strength of the corresponding connecting edges. Filter out the connecting edges whose connection strength is greater than a preset strength threshold to obtain the second associated network.

[0028] Specifically, the step of performing alarm root cause analysis in the second association network, analyzing the connection edge weights and path lengths to calculate the corresponding path validity values, dynamically removing invalid paths and invalid cause points according to the path validity values, and responding to process alarms includes:

[0029] In the second association network, alarm root cause analysis is performed to calculate the corresponding effective value of the path by analyzing the weight of the connecting edge and the path length.

[0030] Based on the centrality of cause points analyzed by path validity values, invalid paths and invalid cause points are dynamically removed, and process alarms are responded to.

[0031] Specifically, the step of performing alarm root cause analysis in the second association network, analyzing the connection edge weights and path lengths to calculate the corresponding effective path values, includes:

[0032] In the second association network, alarm root cause analysis is performed by comparing the time intervals between two nodes on the same connection edge and calculating the corresponding time series weights.

[0033] Based on the real-time process parameters of each node in the second association network, analyze parameter anomalies and calculate the corresponding anomaly scores;

[0034] By combining temporal weights and outlier scores, the causal propagation in the path is simulated, and the effective value of the path is calculated by analyzing the weight of the connecting edge and the path length.

[0035] Specifically, the process of analyzing the centrality of cause points based on path validity values, dynamically removing invalid paths and invalid cause points, and responding to process alarms includes:

[0036] Analyze the centrality of cause points based on path validity values, and calculate the valid scores of nodes;

[0037] Paths and cause points with valid values ​​less than a preset first threshold and valid scores less than a preset second threshold are selected, and invalid paths and invalid cause points are removed to obtain the alarm cause network.

[0038] Based on the alarm cause network analysis, the alarm cause is analyzed and corresponding handling measures are generated to respond to the process alarm.

[0039] A process alarm intelligent optimization system based on association rules is used to implement the aforementioned process alarm intelligent optimization method based on association rules, including:

[0040] The association rule analysis module performs data analysis based on historical process alarm parameter data, analyzes the operating status corresponding to the alarm point, and establishes an association rule library for each operating condition through association rule analysis.

[0041] The association network construction module analyzes the causal strength of each rule in the association rule base, calculates the corresponding transition entropy, uses the transition entropy as the weight of the edge, establishes directed edges between alarm cause points, and constructs the first association network.

[0042] The process alarm analysis module determines the real-time operating conditions and analyzes the alarm situation based on the real-time process alarm parameters. It performs cause matching in the first association network, identifies the corresponding cause points, and filters out cause points with connection relationships to obtain the second association network.

[0043] The process alarm response module performs alarm root cause analysis in the second associated network, analyzes the connection edge weights and path lengths to calculate the corresponding path validity values, dynamically removes invalid paths and invalid cause points according to the path validity values, and responds to the process alarms.

[0044] The beneficial effects of this application are as follows: By analyzing specific working conditions through parameter analysis, association rules are analyzed within each independent working condition, and rule changes during the working condition transition process are considered; the information flow direction and causal strength between alarm cause points are analyzed using transfer entropy, and the transfer entropy is used as the weight of directed edges to construct a first association network, which can accurately distinguish causal directions and quantify the strength of causal relationships; based on real-time alarm conditions, a second association network is dynamically extracted from the first association network through connected path filtering, working condition matching degree filtering, and connection strength filtering; in the second association network, the effective value of the path is calculated by comprehensively considering the temporal weight, node anomaly score, edge weight, and path length, and invalid paths and invalid cause points are dynamically removed, filtering out interference paths that exist in connection but have a weak actual impact, ensuring that the root cause finally located is a truly effective alarm source, and improving the accuracy and response speed of alarms. Attached Figure Description

[0045] Figure 1 This is a flowchart illustrating the process alarm intelligent optimization method based on association rules in the embodiments of this application;

[0046] Figure 2 This is a schematic diagram of the first association network in an embodiment of this application;

[0047] Figure 3 This is a flowchart illustrating the second association network construction process in the embodiments of this application;

[0048] Figure 4 This is a schematic diagram of the intelligent optimization system for process alarms based on association rules in the embodiments of this application. Detailed Implementation

[0049] The present application will be further described in detail below with reference to the accompanying drawings and embodiments.

[0050] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0051] Hereinafter, the terms "first," "second," and other generic terms are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0052] refer to Figure 1The image shows a specific implementation of the intelligent optimization method for process alarms based on association rules in this application, including:

[0053] S101. Perform data analysis based on historical process alarm parameter data, analyze the operating status corresponding to the alarm point, and establish an association rule library for each operating condition through association rule analysis.

[0054] S102. Analyze the causal strength of each rule in the association rule base, calculate the corresponding transition entropy, use the transition entropy as the weight of the edge, establish directed edges between alarm cause points, and construct the first association network.

[0055] S103. Determine the real-time operating conditions and analyze the alarm situation based on the real-time process alarm parameters. Perform cause matching in the first association network, identify the corresponding cause points, and filter out the cause points with connection relationships to obtain the second association network.

[0056] S104. Perform alarm root cause analysis in the second association network, analyze the connection edge weights and path lengths to calculate the corresponding path validity values, dynamically remove invalid paths and invalid cause points according to the path validity values, and respond to the process alarm.

[0057] In this embodiment, industrial production processes often involve multiple stable operating conditions and transitional states between these conditions. These conditions include, but are not limited to, normal production, feeding, load reduction, and cleaning / regeneration. Under different operating conditions, the baseline values ​​and fluctuation characteristics of process parameters differ significantly. Process alarm parameter data with timestamps is retrieved from a historical database. This data records the label, occurrence time, and the corresponding process parameter value for each alarm. For the historical data, the system defines a fixed-length sliding time window, for example, a window width of 5 minutes and a step size of 1 minute. Within each window, statistical features of all alarm points are extracted, including but not limited to the frequency of occurrence, first alarm time, and average alarm duration. These features are then sequentially concatenated into a high-dimensional feature vector. A clustering algorithm is used to cluster the feature vector, with each cluster center representing a typical operating condition. After clustering, each time window and the alarm points within that window are assigned an operating condition label.

[0058] Within each operating condition label, a time-series association rule mining algorithm is used to analyze the first association rule between alarm points. For example, under operating condition M, if the feed pump P-101 trips, a low reactor inlet flow alarm will inevitably occur within 2 minutes. The system analyzes historical operating condition transition data, i.e., the migration of alarm rules during the transition period when the production process moves from one operating condition to another, to analyze the second association rule. For example, during the transition from operating condition M to operating condition N, pressure fluctuation alarms often occur before temperature fluctuation alarms. The first and second association rules are merged to obtain an association rule library corresponding to each operating condition, containing operating condition labels and time-series information.

[0059] It should be noted that by clustering operating conditions, alarm rules can be accurately matched with specific production states, avoiding rule conflicts and false alarms caused by confusion of operating conditions. The constructed operating condition association rule library contains the internal propagation law under steady-state operating conditions as well as the transient rules when operating conditions switch, which improves the completeness and scenario adaptability of the rule library, provides accurate data support for subsequent analysis of causal relationships, and improves the effectiveness of the entire alarm optimization method.

[0060] Specifically, for each operating condition's association rule base, the system extracts the two alarm points involved in each rule. For each rule, it extracts the historical alarm time-series data of these two alarm points under the corresponding operating condition and calculates the transition entropy from the cause point sequence Y to the result point sequence X. Specifically, by estimating the probability distribution of the sequence, the system calculates the reduction in uncertainty in predicting the current value of X when the past value of Y is introduced, given the past value of X. This reduction in uncertainty is the transition entropy. For the same rule appearing in multiple operating conditions, its transition entropy value is calculated for each condition, and the arithmetic mean of the transition entropy values ​​is taken as the final edge weight for this rule. After completing the calculation for all rules, the system constructs a directed weighted network graph, using alarm points as nodes, the existence of rules as directed connections, and the calculated average transition entropy as edge weights. This graph serves as the first association network, reflecting the average causal transmission relationship between all alarm points under different operating conditions.

[0061] It should be noted that introducing transfer entropy into the causal strength quantification of process alarm association rules can determine the causal relationship between alarm causes. By assigning transfer entropy weights to edges, the first association network can quantify the direction and intensity of information flow. The average causal strength of the rule can be obtained by taking the average value of the same rule under different operating conditions, which can improve the robustness and adaptability of the network.

[0062] When a real-time process alarm occurs, the system first collects the current process parameters and uses the same feature extraction method as in step S101 to determine the current real-time operating condition. The system acquires all currently occurring alarm points and uses these alarm points as target points. In the first association network, each target point is both a result of other nodes (as a subsequent node) and a cause of other nodes (as a preceding node). Using these target points as seeds, the system traces forward and backward through the first association network to identify all nodes with direct or indirect directed connections to the target points, forming an initial connected subgraph, which serves as the first connected network.

[0063] Furthermore, the parameter statistical characteristics of each node in the first connected network under the current real-time operating conditions are calculated to determine the degree of matching between the node's characteristics and the current operating conditions. A matching threshold (e.g., 0.6) is set, and nodes with a matching degree lower than the threshold are removed. Although these nodes have network connections to the current alarm, the probability of an alarm occurring under the current operating conditions is extremely low, resulting in the second connected network. The connection edges in the second connected network are then filtered, and the in-degree and out-degree of each node in the network are analyzed. Combined with the transition entropy weight of the edges, the connection strength of each edge is calculated. A strength threshold (e.g., 0.5) is set, and weak connection edges with connection strengths lower than the strength threshold are removed. The causal relationships represented by these edges are very weak in the current local network. The network composed of the nodes and directed edges retained after filtering is the second associated network.

[0064] It should be noted that connectivity filtering ensures that the analysis scope focuses on the parts that are truly relevant to the current event; operating condition matching filtering eliminates historical associations that are inconsistent with the current production status, greatly reducing the interference of false alarm nodes; connection strength filtering retains the most important causal transmission paths, making the network structure more concise and clear; the resulting second association network is adapted to the current alarm scenario, providing an accurate analytical approach for subsequent precise root cause analysis.

[0065] In the second association network, for each directed edge, the real-time alarm occurrence times of the two nodes connected by that edge are compared, and the time interval between them is calculated. The shorter the time interval, the faster the causal propagation. Corresponding time-series weights are assigned based on the time interval. The system collects real-time process parameter values ​​for each node in the second association network and calculates anomaly scores by comparing them with their historical distribution under normal operating conditions. The higher the anomaly score of a node, the more abnormal its current state is, and the greater its potential contribution to causal propagation. The effective value of the path between any two nodes is calculated. After calculating the effective values ​​of all paths, the effective score of each node is calculated, and a threshold for the effective value of the path (e.g., 0.2) and a threshold for the effective score of the node are set (e.g., 0.5).

[0066] Preferably, the second association network is traversed. If the valid value of a path is lower than the valid value threshold, it is determined to be an invalid path and deleted. If the valid score of a node is lower than the valid score threshold, it is determined to be an invalid cause point, and its connected edges are deleted. After dynamic pruning of the connecting edges, the alarm cause network is obtained. The source node in this network is the root cause of this alarm event. Based on the root cause alarm point, the corresponding handling measures are retrieved from the preset expert knowledge base and pushed to the operator in the form of pop-ups, voice, etc., to complete the intelligent response to the process alarm.

[0067] It should be noted that by introducing temporal weights and anomaly scores, the static network structure is integrated with dynamic real-time data, allowing the calculation of effective path values ​​to reflect the actual physical process. By setting dynamic thresholds to automatically prune invalid paths and nodes, the limitations of fixed thresholds and human experience can be avoided, enabling adaptive responses to alarm scenarios of varying scales and complexities. The resulting alarm cause network identifies the root cause and demonstrates the fault propagation chain and key intermediate links, improving the accuracy and efficiency of alarm response.

[0068] This application analyzes specific operating conditions through parameter analysis, analyzes association rules within each independent operating condition, and considers rule changes during operating condition transitions. It utilizes transfer entropy to analyze the information flow direction and causal strength between alarm cause points, using transfer entropy as the weight of directed edges to construct a first association network. This network accurately distinguishes causal directions and quantifies the strength of causal relationships. Based on real-time alarm conditions, a second association network is dynamically extracted from the first association network through connectivity path filtering, operating condition matching degree filtering, and connection strength filtering. In the second association network, a path validity value is calculated by comprehensively considering temporal weights, node anomaly scores, edge weights, and path lengths. Invalid paths and invalid cause points are dynamically removed, and interference paths with weak actual impact are filtered out, ensuring that the root cause ultimately located is a truly effective alarm source, thus improving alarm accuracy and response speed.

[0069] Furthermore, data analysis is performed based on historical process alarm parameter data to analyze the operating conditions corresponding to the alarm points. A rule library for each operating condition is established through association rule analysis, including:

[0070] S201. Based on historical process alarm parameter data, perform data analysis, extract corresponding parameter statistical features, analyze the frequency of occurrence of different alarm information within a preset time window, construct feature vectors, and cluster to obtain the operating status corresponding to each alarm point.

[0071] S202. Analyze the rules and transitions within each working condition through association rules, and establish an association rule library for each working condition.

[0072] In this embodiment, process alarm parameter data containing precise timestamps is retrieved from a historical database. This data records the tag, occurrence time, and process parameter values ​​at the time of each alarm. Tags include, but are not limited to, "high reactor temperature," and process parameter values ​​include, but are not limited to, temperature, pressure, and flow rate. The system defines a fixed-length time sliding window. The window width can be preset according to the dynamic characteristics of the process; for example, it can be set to 10 minutes for a slow-changing reaction process and 2 minutes for a fast-changing reaction process. The window sliding step size is set to one-fifth to one-third of the window width to ensure the continuity of the time series.

[0073] Within each time window, feature extraction is performed. For each alarm point appearing within the window, the following statistical features are extracted: the frequency of the alarm, the offset of the first alarm time relative to the start point of the window, the offset of the last alarm time relative to the end point of the window, the total duration of the alarm, the average time interval between two adjacent alarms, the instantaneous value of the corresponding process parameter at the time of the alarm, and its deviation from the normal range. Overall statistical features of all alarm points within the window are extracted, including the total number of alarms, the number of different alarm types, and the number of alarms per unit time. These features are then concatenated sequentially into a high-dimensional feature vector. This process is repeated across all sliding windows to obtain the feature vector set.

[0074] Furthermore, an unsupervised clustering algorithm is employed to perform cluster analysis on the feature vector set. This algorithm includes, but is not limited to, the K-Means algorithm. The number of operating condition categories is set according to the actual system operation. The feature vector set is input into the clustering algorithm, and the category label for each feature vector is output, thus obtaining the operating condition status identifier. Each cluster center represents the corresponding operating condition, including but not limited to steady-state production conditions and material feeding disturbance conditions. After clustering, a unique operating condition label is assigned to each time window and each alarm record within that window.

[0075] It should be noted that by using sliding window feature extraction and cluster analysis, the operating condition can be determined, avoiding the subjectivity and incompleteness of relying on manual experience to classify operating conditions. The feature vector construction process integrates multi-dimensional information such as alarm frequency, temporal distribution, and parameter deviation, improving the accuracy and robustness of the operating condition identification results. Matching alarm points with specific operating conditions provides accurate data support for subsequent analysis of alarm rules under specific operating condition constraints, and can eliminate rule conflicts and misassociations caused by overlapping operating conditions.

[0076] Specifically, by analyzing the rules within operating conditions and the transition between operating conditions, a rule base corresponding to each operating condition is established. The rule base is constructed through sub-operating condition analysis and the introduction of operating condition transition analysis. Rules within operating conditions reflect the alarm propagation patterns under specific steady-state conditions, exhibiting stability and repeatability. Operating condition transition rules identify transient alarm patterns during process state changes, comprehensively covering various operating scenarios in the production process. This provides high-quality data input for subsequent causal network construction, improving the accuracy and reliability of alarm root cause analysis.

[0077] Furthermore, by analyzing the rules within the operating conditions and the operating condition transitions through association rule analysis, an association rule base corresponding to each operating condition is established, including:

[0078] S301. Within each working condition, analyze the temporal correlation of the rules to obtain the first correlation rule;

[0079] S302. Based on historical operating condition transition data, analyze the migration of rules during the operating condition transition process to obtain the second association rule;

[0080] S303. Combine the first association rule and the second association rule to establish an association rule library for each working condition.

[0081] In this embodiment, all alarm records belonging to the same operating condition label are filtered from historical alarm data with operating condition labels. These records are arranged in chronological order to construct an alarm time sequence database specific to that operating condition. A fixed-length time window is set as the basic unit for transaction division based on the dynamic response time of the process. Taking a distillation column in the petrochemical industry as an example, if the response time from an abnormal temperature at the top of the column to a change in the composition at the bottom of the column is typically 3-5 minutes, the window width can be set to 8 minutes to fully cover a propagation cycle. The window sliding step size is set to one-quarter of the window width, i.e., 2 minutes, to ensure overlap between adjacent windows and avoid missing the correlations located at the window boundaries.

[0082] For each sliding window, extract all alarm point labels occurring within the window, remove duplicates, and form a transaction record corresponding to that window. The transaction record includes a transaction ID, operating condition label, and a list of alarm point labels. Traverse the entire operating condition time series to obtain the transaction dataset corresponding to that operating condition. A frequent pattern growth algorithm is used for association rule mining. Growth algorithms include, but are not limited to, the FP-Growth algorithm. This algorithm compresses the transaction data in memory by constructing a frequent pattern tree and recursively mines frequent itemsets, resulting in higher efficiency when processing large-scale alarm data. Input the transaction dataset into the algorithm, and the algorithm outputs all frequent itemsets satisfying the minimum support and minimum confidence, along with their corresponding association rules.

[0083] Specifically, in terms of parameter settings, minimum support and minimum confidence need to be preset. Minimum support is used to filter frequent itemsets, reflecting the frequency of a certain alarm combination in all transactions. For example, in a working condition with 1000 transaction windows, if the minimum support is set to 0.02, it means that a certain alarm combination needs to appear in at least 20 windows to be considered statistically significant. Minimum confidence is used to generate reliable rules from frequent itemsets, representing the conditional probability of a subsequent item appearing when the preceding item appears. Based on the sparsity of historical alarm data and process characteristics, the minimum support can be preset to between 0.01 and 0.05, and the minimum confidence to between 0.7 and 0.85.

[0084] It should be noted that by performing rule mining within a single operating condition, alarm propagation patterns deeply coupled with the physical characteristics of that condition were obtained. This eliminated interference from other operating conditions, improved the reliability of the rules, and enhanced the efficiency of rule mining under large-scale alarm data. This provides accurate data support for subsequent construction of causal networks and real-time root cause analysis.

[0085] Specifically, operating condition transition events are identified from historical data. When the operating condition label changes between adjacent time windows, it indicates that an operating condition transition has occurred. The start time and direction of each transition are recorded. For each operating condition transition event, alarm data segments before and after the transition are extracted. The extracted time range needs to cover the complete transition process from the stable period of the old operating condition to the stable period of the new operating condition. For example, data from 10 minutes before the transition to 15 minutes after the transition can be extracted. The specific duration can be adjusted based on empirical knowledge of the transient characteristics of the process to ensure that all transient responses caused by the operating condition switch can be captured.

[0086] For each transfer event, the alarm sequences within the extracted time segment are arranged chronologically to form a transfer alarm sequence. Each element in the sequence contains an alarm point label and an occurrence timestamp. All alarm sequences corresponding to historical transfer events are integrated to form a working condition transfer alarm sequence dataset. A generalized sequence pattern mining algorithm is selected to find frequently occurring subsequences in the sequence database. The algorithm input is a sequence dataset, where each sequence consists of events with occurrence times. The output is a frequent sequence pattern and its support, defined as the proportion of transfer events containing that sequence pattern to the total number of transfer events. The sequence patterns mined by the algorithm serve as second association rules, represented as a chain of alarm sequences, for example, pressure fluctuation alarm → regulating valve action alarm → temperature fluctuation alarm. Each rule not only includes the sequential relationship of alarm points but also the typical time interval range between adjacent alarms and the working condition transfer direction label corresponding to that rule.

[0087] It should be noted that by analyzing the working condition transition process, transient alarm patterns that do not exist under steady-state conditions are extracted, reflecting the unique fault propagation paths and timing patterns when the process state changes. When the production process is in the working condition switching stage, it can provide more accurate alarm prediction and root cause diagnosis, avoiding misjudgments caused by ignoring the dynamic process characteristics.

[0088] Specifically, the first association rule is standardized, with each rule record including rule number, rule type, operating condition label, set of preceding alarm points, set of succeeding alarm points, support value, and confidence value. The second association rule is also standardized. The first and second association rules are compared according to their applicable scenarios and rule content. If identical first and second association rules are found within the same applicable scenario, the rule with the higher statistical value is retained. To support rapid rule matching based on real-time operating conditions in subsequent steps, an efficient index structure needs to be established for the rule base. Using the applicable scenario as the first-level index, rules within the same operating condition are organized together; rules for all operating condition transfers in the same transfer direction are organized together. For each rule, an inverted index based on its preceding items is created to quickly locate potentially triggered rules given a set of alarm points. All processed rules are stored to obtain the complete association rule base.

[0089] It should be noted that by integrating steady-state rules and dynamic rules, a rule base covering all operating conditions and the entire process is constructed. The rule base includes repetitive patterns under steady-state conditions and transient patterns during transition phases. Each rule is bound to a specific operating condition or transition direction, avoiding the mixing and misuse of rules in different scenarios. The rule base provides accurate data support for the subsequent intelligent optimization process of alarms.

[0090] Furthermore, the causal strength of each rule in the association rule base is analyzed, the corresponding transition entropy is calculated, and the transition entropy is used as the weight of the edges to establish directed edges between alarm cause points, constructing the first association network, including:

[0091] S401. Analyze the causal strength of each rule in the association rule base, calculate the transition probability corresponding to the rule through the conditional probability distribution, and obtain the transition entropy;

[0092] S402. For the same rule that appears in multiple working conditions, calculate the average value of the transfer entropy under each working condition to obtain the weight of the edge.

[0093] S403. Based on the weight of the edges, establish directed edges between the alarm cause points to construct the first association network.

[0094] In this embodiment, each rule is extracted from the association rule base. Taking the rule "feed pump trip alarm (node ​​A) → reactor inlet flow low alarm (node ​​B)" as an example, this rule will appear in multiple operating conditions. Each operating condition is handled separately. For the application of this rule under a specific operating condition, the alarm occurrence time series of nodes A and B within that operating condition time period is extracted from the historical alarm database. Continuous alarm events are transformed into discrete time series. With a fixed sampling frequency, such as one sampling point every 10 seconds, a binary sequence is constructed. At each moment, if the alarm is active, it is marked as 1; otherwise, it is marked as 0. This yields two binary sequences A(t) and B(t) of length T, where t is time.

[0095] Specifically, the transfer entropy from A to B is calculated. The historical window length and prediction step size are set according to the required computational accuracy. The historical window length represents the use of historical values ​​of A to predict B(t); the prediction step size represents the delay from the past of A to the current moment of B. The transfer entropy is estimated using probability distributions. A histogram method is used to discretize the value spaces of A and B into several intervals. Since A and B are both binary variables, the probabilities to be estimated include the probability of B(t) taking a value, the conditional probability of B(t) taking a value given its past values, and the conditional probability of B(t) taking a value given both past values ​​of A and B. By traversing and statistically analyzing the entire time series, the frequency of each combination is calculated and divided by the total number of samples to obtain the corresponding probability estimate, which serves as the transfer entropy from A to B. This quantifies the reduction in prediction uncertainty brought about by introducing past values ​​of A, based on known past values ​​of B. If past values ​​of A do not help in predicting B, the two conditional probabilities are equal, and the transfer entropy is zero; if past values ​​of A significantly reduce the uncertainty of B, the transfer entropy is positive. After calculating all rules under all operating conditions, each rule obtains a transition entropy value under each operating condition. The larger the value, the stronger the causal drive from the cause point to the result point under that operating condition.

[0096] It should be noted that by calculating the transfer entropy and utilizing the time-series information of alarm events, the accuracy of alarm root cause analysis can be improved. The non-parametric characteristics of transfer entropy are applicable to both linear and non-linear relationships and can adapt to various types of causal transmission mechanisms in complex industrial processes.

[0097] For all calculated rules, each rule is labeled with its applicable working condition and its transition entropy value, uniquely identified by the combination of the preceding and succeeding nodes. For example, if rule C→D exists in working conditions 1, 3, and 5, then the transition entropy values ​​in these three working conditions all belong to the same node pair (C, D). For each node pair, the transition entropy values ​​appearing in all working conditions are integrated, and their arithmetic mean is calculated as the final edge weight for that node pair. After calculating all node pairs, each directed node pair receives a unique weight.

[0098] It should be noted that by calculating the average transfer entropy across operating conditions, the fluctuations in causal strength under different operating conditions can be eliminated, the relatively stable average causal relationship between nodes can be extracted, the globality of the constructed first association network can be improved, and the storage redundancy and matching complexity caused by maintaining a separate network for each operating condition can be avoided. The mean processing can reduce the calculation bias caused by the sparsity or noise of individual operating condition data, and improve the robustness and reliability of the weights.

[0099] Specifically, all alarm points involved in the association rule base are collected, including alarms for various process parameters such as temperature, pressure, flow rate, liquid level, and equipment status. Each alarm point is assigned a unique node identifier, such as... Figure 2 As shown in the figure, the numbers represent the average transfer entropy between the corresponding alarm cause points. For each calculated directed node pair, a directed edge is created between the alarm cause points, and the calculated average transfer entropy is set as the weight of the edge. After adding all edges, the first association network is constructed, reflecting the causal propagation path and its average strength between alarm points in the entire process system. For example, a fault propagation chain is formed from the feed pump tripping to low inlet flow rate to high reactor temperature to high outlet pressure, which is represented in the network as continuous directed weighted edges.

[0100] It should be noted that by constructing the first association network, the scattered causal rules are integrated into a global, computable process alarm causal graph, which can intuitively present the complex causal chains that were originally hidden in the data, making it easier to analyze the fault propagation logic of the system. The first association network provides accurate data support for subsequent real-time alarm matching, subgraph extraction, path search and other operations. By regularly updating the association rule base and recalculating the transfer entropy, the edge weights of the first association network can be iteratively optimized, improving the adaptability and analysis efficiency of the alarm optimization process.

[0101] Furthermore, based on real-time process alarm parameters, the real-time operating conditions are determined and the alarm situation is analyzed. Cause matching is performed in the first association network to identify the corresponding cause points, and cause points with connection relationships are filtered out to obtain the second association network, which includes:

[0102] S501. Determine the real-time operating conditions and analyze the alarm situation based on the real-time process alarm parameters. Take the alarm situation as the rule pre-order node and rule post-order node respectively, perform cause matching in the first association network, identify the corresponding cause points, and obtain the target point set.

[0103] S502. Based on the target point set, filter out the cause points that have connection relationships to obtain the second association network.

[0104] In this embodiment, the system continuously collects current process parameter data, including real-time values ​​of various measuring points related to alarms, including but not limited to temperature, pressure, flow rate, and liquid level. Using the same feature extraction method as in step S201, the system extracts statistical features of each alarm point within the window, centered on the current moment, to construct a feature vector for the current moment. This feature vector is then input into the clustering algorithm in step S201. The clustering algorithm outputs the cluster center closest to the feature vector, and the category label corresponding to this cluster center is used as the current real-time operating condition.

[0105] Specifically, the system retrieves all alarm points triggered at the current moment from the real-time alarm server, forming a current alarm point set. For each alarm point, it treats the alarm point as a potential cause node (i.e., the preceding node of the rule) and searches for all directed edges originating from that alarm point in the first association network, adding the matched destination nodes to the candidate set. Similarly, it treats the alarm point as a potential result node (i.e., the following node of the rule) and searches for all directed edges ending from that alarm point in the first association network, adding the matched source nodes to the candidate set. After completing bidirectional matching for all current alarm points, all matched nodes—including the current alarm point itself, the destination nodes obtained from forward matching, and the source nodes obtained from backward matching—are integrated, deduplicated, and a target point set is obtained. This set contains all alarm points that may have a direct causal relationship with the current alarm event.

[0106] It should be noted that, through the two-way matching mechanism, real-time alarm events can be accurately located in the global causal network. Forward matching ensures that no subsequent chain reactions that the current alarm may trigger are missed, while backward matching ensures that the potential upstream causes that led to the current alarm can be traced. This comprehensively covers the upstream and downstream directions of fault propagation, and the resulting set of target points can be used to construct a local causal network, providing accurate data support for real-time root cause analysis.

[0107] Specifically, based on the set of target points, cause points with interconnected relationships are selected to obtain the second correlation network. Through connectivity filtering, the discrete set of target points can be integrated into a causal propagation subnetwork, removing isolated nodes that, although directly connected to the current alarm, cannot be integrated into the overall propagation chain, thus reducing noise interference. The second correlation network can effectively control the size of the subgraph, ensuring the efficiency of real-time calculation, while avoiding the introduction of irrelevant nodes due to over-extension, providing accurate input for the final root cause analysis.

[0108] like Figure 3 As shown, based on the set of target points, cause points with connection relationships are filtered out to obtain the second association network, which includes:

[0109] S601. Based on the set of target points, select cause points from the first association network that have at least one directed connected path with the target points to obtain the first connected network.

[0110] S602. Based on the real-time operating conditions, analyze the matching degree between the cause points and the operating conditions in the first connected network, filter out the cause points with a matching degree greater than a preset matching threshold, and obtain the second connected network.

[0111] S603. Analyze the direction of the connected paths in the second connected network, calculate the in-degree and out-degree of the corresponding cause points and calculate the connection strength of the corresponding connecting edges, filter out the connecting edges with a connection strength greater than a preset strength threshold, and obtain the second associated network.

[0112] In this embodiment, based on the target point set and the first association network, a breadth-first search is used to filter out cause points from the first association network that have at least one directed connected path with the target points, thus obtaining the first connected network. Specifically, an empty visit set is initialized to record nodes that have been traversed; an empty subgraph edge set is initialized; an empty queue is initialized; each node in the target point set is traversed, and the node is added to the queue and the visit set; when the queue is not empty, a node is removed from the head of the queue. In the first association network, all outgoing edges originating from the given node are searched. For neighboring nodes corresponding to outgoing edges, if the neighboring node has not been visited, the neighboring node is added to the queue and the visit set, and the outgoing edge and its weight are added to the subgraph edge set. All incoming edges ending at the given node are searched. For predecessor nodes corresponding to incoming edges, if the predecessor node has not been visited, the predecessor node is added to the queue and the visit set, and the incoming edge and its weight are added to the subgraph edge set. This operation is repeated until the queue is empty, and the union of all connected components obtained is taken as the first connected network.

[0113] It should be noted that by extracting connected paths, discrete target points are integrated into a causal propagation subgraph, which can remove isolated nodes that are directly connected to the current alarm but cannot be integrated into the overall propagation chain, effectively reducing noise interference. The first connected network ensures that subsequent analysis only focuses on alarm points that are logically related, avoiding wasting computing resources on irrelevant nodes and improving the accuracy and efficiency of alarm root cause analysis.

[0114] Specifically, based on the real-time operating condition label and the first connected network, the matching degree between each node in the first connected network and the real-time operating condition is calculated. The system obtains the feature vector distribution of all time windows under each operating condition through cluster analysis. For each alarm point, its behavioral characteristics under each operating condition are statistically analyzed. All time windows belonging to the operating condition are extracted from the historical database, and the number of times the alarm point appears in these windows is counted. Dividing this number by the total number of windows for the operating condition yields the occurrence frequency of the alarm point under that operating condition. For the alarm point, the process parameter values ​​corresponding to each alarm time under historical operating conditions are extracted, including but not limited to temperature and pressure values, and a Gaussian distribution model of the alarm point under that operating condition is constructed. At the current time, the real-time process parameter value corresponding to the alarm point is obtained, and the parameter density of this value in the historical distribution is calculated. The matching degree is obtained by weighted averaging of the occurrence frequency and parameter density.

[0115] Set a matching threshold based on the system's alarm accuracy requirements, for example, 0.6. Traverse all nodes in the first connected network. If the matching degree is less than the matching threshold, the node is determined to be mismatched with the current operating condition and is removed from the network. When deleting a node, all incoming and outgoing edges connected to that node are also deleted. The nodes retained after operating condition matching degree filtering, along with the edges between them, form the second connected network.

[0116] It should be noted that by introducing a working condition matching threshold, nodes that exist in the causal chain but have an extremely low probability of occurrence or inconsistent parameter characteristics under the current working condition can be quickly removed, effectively avoiding false alarms caused by the generalization of cross-working condition rules. The calculation of the working condition matching degree integrates historical occurrence frequency and real-time parameter characteristics, so that the screening results conform to statistical laws and reflect the actual situation at the current moment, improving the pertinence and accuracy of subsequent root cause analysis.

[0117] Furthermore, for each node in the second connected network, calculate its in-degree and out-degree; for each directed edge, calculate the connection strength. For the target node, a larger in-degree indicates more contributing factors, diluting the importance of each edge; for the source node, a larger out-degree corresponds to a wider range of influence. Calculate the connection strength by multiplying the reciprocal of the in-degree and the reciprocal of the out-degree, and set a strength threshold based on the required accuracy, for example, 0.5. Traverse all edges in the second connected network. If the connection strength is less than the strength threshold, delete the edge from the second connected network. Edge deletion will cause some nodes to become isolated. Traverse all nodes and delete those nodes that become isolated after edge deletion. The nodes and edges retained after connection strength filtering are the second connected network.

[0118] It should be noted that by filtering based on connection strength, the causal network is simplified, retaining edges with high causal strength and importance in the local topology, while removing weak connections and redundant paths. The calculation of connection strength combines the inherent weight of the edge and the topological attributes of the node, and combines the absolute strength of the causal relationship with its relative importance in the local network. The second association network provides high-quality input data for subsequent root cause localization, enabling root cause analysis to quickly focus on the corresponding path and improve the accuracy and real-time performance of cause analysis.

[0119] Furthermore, alarm root cause analysis is performed in the second association network. The connection edge weights and path lengths are analyzed to calculate the corresponding effective path values. Invalid paths and invalid cause points are dynamically removed based on the effective path values, and a response is given to the process alarm, including:

[0120] S701. Perform alarm root cause analysis in the second associated network, analyze the connection edge weights and path lengths, and calculate the corresponding effective path values.

[0121] S702. Analyze the centrality of cause points based on the effective value of the path, dynamically remove invalid paths and invalid cause points, and respond to process alarms.

[0122] In this embodiment, alarm root cause analysis is performed in the second association network, and the effective value of the path is calculated by analyzing the weight of the connecting edges and the path length. By introducing time-series weights and anomaly scores, the effective value of the path integrates the static causal network with dynamic real-time data, making the evaluation of causal paths more consistent with the actual production process. Time-series weights ensure that only paths with reasonable time sequence and rapid transmission are assigned high values, effectively avoiding time-series mismatch caused by generalization of historical statistics. Anomaly scores strengthen the role of parameters that are truly abnormal at the current moment in the path, making root cause location more focused on the actual fault point, and improving the adaptability and accuracy of root cause analysis under changing operating conditions.

[0123] Specifically, based on the centrality of cause points analyzed according to the effective value of the path, invalid paths and invalid cause points are dynamically removed to respond to process alarms. Through dynamic threshold iterative pruning, the alarm causal network can be adaptively simplified, and secondary paths and irrelevant nodes can be automatically identified and eliminated, improving the accuracy and efficiency of root cause localization. This effectively copes with complex scenarios of concurrent alarms and multi-path propagation, and enhances the credibility of the output root cause.

[0124] Furthermore, root cause analysis of the alarm is performed in the second association network, analyzing the edge weights and path lengths to calculate the corresponding effective path values, including:

[0125] S801. Perform alarm root cause analysis in the second associated network, compare the time interval between two nodes on the same connection edge, and calculate the corresponding time series weight.

[0126] S802. Based on the real-time process parameters of each node in the second association network, analyze the abnormal parameter conditions and calculate the corresponding abnormality score.

[0127] S803. Combining temporal weights and outlier scores, simulate causal propagation in the path, analyze the edge weights and path lengths to calculate the corresponding effective path values.

[0128] In this embodiment, the system obtains the alarm occurrence time of each node in the second associated network from the real-time alarm server. For each node, the timestamp of the most recent alarm is recorded. For each directed edge in the second associated network, denoted as from node U to node V, the alarm time t_U of node U and the alarm time t_V of node V are obtained, and the time interval Δt = t_V - t_U is calculated.

[0129] Specifically, the time-series weight w_time = exp(-Δt / τ) is calculated, with w_time = 0 when Δt < 0. Here, exp(·) represents an exponential function with the natural constant as its base, and τ is the time decay constant. The characteristic of the exponential decay function is that w_time approaches 1 as Δt approaches 0; as Δt increases, w_time gradually decays towards 0. The decay rate is controlled by τ; the larger τ is, the slower the decay, allowing for a longer time delay; the smaller τ is, the faster the decay, and the more sensitive it is to time delays. The value of the time decay constant τ is set according to the characteristics of the process. For example, the response of flow and pressure parameters is usually very fast, possibly completing propagation within a few seconds to tens of seconds, so τ can be set to 30 seconds.

[0130] It should be noted that by introducing time-series weights based on real-time time intervals, static causal edges are integrated with dynamic alarm timing. Subsequent path analysis can fully consider the real-time occurrence order of events. The exponential decay function reflects the time urgency of causal transmission, and the time decay constant enables adaptation to different process response characteristics. Introducing time-series weights can effectively avoid the misuse of historical statistical rules in real-time scenarios and improve the accuracy of root cause analysis.

[0131] For each node in the second association network, the system retrieves the current real-time value of that measuring point from the real-time database. It then obtains the distribution model of that measuring point under historical normal operating conditions, where normal operating conditions refer to the steady-state normal operating conditions identified in step S201. From the historical data, all time periods belonging to normal operating conditions are extracted, and all sampled values ​​of the measuring point within these time periods are collected to form a sample set. Statistical analysis is performed on this sample set, calculating the sample mean and sample standard deviation. For each measuring point, its sample mean and sample standard deviation under each normal operating condition are pre-calculated and stored.

[0132] Specifically, the absolute value of the difference between the real-time data and the sample mean is calculated and divided by the sample standard deviation to obtain the standardized distance, which represents the standard deviation multiple by which the current value deviates from the normal mean, reflecting the degree of abnormality. The standardized distance is then normalized to the range of 0 to 1 to obtain the anomaly score.

[0133] It should be noted that by introducing anomaly scores based on real-time process parameters, the static alarm status of nodes is associated with the dynamic changes of continuous parameters. The calculation of anomaly scores can give higher weight to nodes in a severely abnormal state in subsequent path analysis, while appropriately reducing the weight of nodes that trigger alarms but whose parameters deviate slightly. This can effectively avoid false alarm interference caused by overly sensitive alarm thresholds, making the final root cause location more accurate and reliable.

[0134] Furthermore, a depth-first search algorithm is used to enumerate the paths from any node to any node in the second association network, resulting in a set of paths. Each path consists of a sequence of nodes and a corresponding sequence of edges. For each path, its path validity value is calculated.

[0135] Specifically, for each edge on the path, its static weight is the mean of the transition entropy, representing the historical average causal strength. The static weights of all edges on the path are accumulated to obtain the static edge weight accumulation. For each edge on the path, the static weight is multiplied by the temporal weight to obtain the dynamic contribution of that edge. The dynamic contributions of all edges are accumulated to obtain the temporal weight modulation, reflecting the path accumulation strength after real-time time information modulation. For each node on the path, the average of the anomaly scores of all nodes on the path is calculated to obtain the average anomaly score. The static edge weight accumulation is multiplied by the temporal weight modulation, divided by the square root of the path length, and multiplied by the average anomaly score to obtain the path effective value.

[0136] It should be noted that by integrating static weights, time-series weights, anomaly scores, and path lengths, the path validity value achieves a multi-dimensional and multi-level quantitative evaluation of causal paths. Through fusion calculation, the path validity value can truly reflect the actual transmission efficiency of each causal path in this alarm event. The calculation results of the path validity value provide quantitative indicators for subsequent path screening and root cause localization, enabling the rapid identification of the most critical fault propagation chain from the path, thus improving the accuracy and interpretability of root cause analysis.

[0137] Furthermore, based on the centrality of cause points analyzed according to path validity values, invalid paths and invalid cause points are dynamically removed, and process alarms are responded to, including:

[0138] S901. Analyze the centrality of cause points according to the path validity value and calculate the valid score of the node;

[0139] S902. Filter out paths and cause points whose valid values ​​are less than a preset first threshold and whose valid scores are less than a preset second threshold, remove invalid paths and invalid cause points, and obtain the alarm cause network.

[0140] S903. Analyze the alarm cause network based on the alarm cause network and generate corresponding handling measures to respond to the process alarm.

[0141] In this embodiment, the path set generated in step S803 and the effective value of each path are obtained. For each node q in the second association network, all paths that satisfy the condition "the first node of the path is equal to q" are selected from the path set. The sum of the effective values ​​of all paths originating from that node is calculated to obtain the effective score of node q, which reflects the overall contribution intensity of all causal paths starting from q in this alarm event. If a node is located at the starting point of multiple high-value paths, its effective score will be high; if a node has no paths starting from it, that is, it only serves as an intermediate node or an end point, or the effective values ​​of paths starting from it are very low, then its effective score will be low or zero.

[0142] It should be noted that by calculating the effective score of a node, the likelihood of each node being the source of the fault is reflected, providing a quantitative basis for the subsequent screening of invalid nodes. It comprehensively considers all possible propagation paths starting from each node, avoiding the one-sidedness that may be caused by a single path, and improving the comprehensiveness and stability of root cause localization.

[0143] Specifically, based on the data distribution in the current network, a first threshold for path validity and a second threshold for node validity are dynamically set. For example, the set of all path validity values ​​in the current second association network is calculated, and the lower quartile is taken as the first threshold for path validity. The set of all node validity scores is calculated, and the lower quartile is taken as the second threshold for node validity. All paths in the current network are traversed. For each path, all edges corresponding to paths with valid values ​​less than the first threshold are deleted. After path pruning, the network structure has changed, and the validity score of each node in the remaining network is recalculated. For the recalculated node validity scores, threshold comparisons are performed again. For each node, nodes with validity scores less than the second threshold are selected as invalid cause points, and these nodes and all edges connected to them are deleted. After pruning, the remaining network serves as the alarm cause network, where each path has a high path validity value, and each node has a high validity score.

[0144] It should be noted that, through dual-threshold dynamic iterative pruning, the alarm causal network can be adaptively pruned, automatically identifying and eliminating secondary paths and irrelevant nodes. The adaptive threshold setting based on quantiles ensures that the screening criteria can be dynamically adjusted according to the actual situation of each alarm event, and has strong adaptability to networks of different sizes and characteristics. The iterative pruning process ensures the stability of the network structure, and the final alarm cause network contains core causal relationships, providing clear and accurate input for subsequent root cause identification, thus improving the accuracy and efficiency of root cause localization.

[0145] Specifically, root cause nodes are identified from the alarm cause network. A root cause node has an in-degree of zero, meaning no other nodes point to it, and it also has the highest effective score, indicating that the path originating from it has the greatest overall contribution. Specifically, all nodes with an in-degree of 0 in the alarm cause network are selected and added to the candidate root cause set. If there is only one node in the candidate root cause set, that node is directly identified as the root cause node. If there are multiple nodes in the set, their effective scores are compared, and the node with the highest effective score is selected as the root cause node. If the effective scores are also the same, the node with the higher anomaly score is selected.

[0146] After identifying the root cause node, the alarm tag for that node is obtained, such as a high reactor temperature alarm or a feed pump P-101 trip alarm. The system accesses a pre-built expert knowledge base, a structured database jointly maintained by process engineers, equipment engineers, and operation experts, which stores suggested handling measures for each alarm tag. The knowledge base can be constructed using relational database tables, with table structures including fields such as alarm tag, handling measure description, priority, relevant work section, and responsible position. For example, the handling measure description might be to check if the reactor agitator motor current is normal, confirm the cooling water valve opening, and contact instrumentation personnel to check the temperature sensor.

[0147] The system uses the alarm tag of the root cause node as a query condition to search for corresponding handling measures in the expert knowledge base. If multiple matching records are found, the system filters them based on the current operating conditions and contextual information in the alarm cause network, selecting the measure that matches the current process. The system then visualizes and pushes the diagnostic results. The displayed content should include the root cause alarm tag, handling measures, a visual graph of the alarm cause network, and basic information about the alarm event. Push methods include pop-ups on the operator's HMI, voice broadcasts, and push notifications to mobile apps. After seeing the push information, operators can immediately follow the handling measures and intuitively understand the fault propagation process through the visual graph, deepening their understanding of the process system.

[0148] It should be noted that by identifying the root cause of alarms through the network of alarm causes, the complex graph theory analysis results are transformed into intuitive and actionable conclusions that directly serve production operations. The root cause identification process is based on in-degree analysis and effective score comparison, with clear logic and reliable results. By introducing an expert knowledge base, intelligent response to process alarms is achieved, which shortens the troubleshooting time and improves the ability to ensure production safety.

[0149] like Figure 4 As shown, the intelligent optimization system for process alarms based on association rules is used to implement an intelligent optimization method for process alarms based on association rules, including:

[0150] The association rule analysis module performs data analysis based on historical process alarm parameter data, analyzes the operating status corresponding to the alarm point, and establishes an association rule library for each operating condition through association rule analysis.

[0151] The association network construction module analyzes the causal strength of each rule in the association rule base, calculates the corresponding transition entropy, uses the transition entropy as the weight of the edge, establishes directed edges between alarm cause points, and constructs the first association network.

[0152] The process alarm analysis module determines the real-time operating conditions and analyzes the alarm situation based on the real-time process alarm parameters. It performs cause matching in the first association network, identifies the corresponding cause points, and filters out cause points with connection relationships to obtain the second association network.

[0153] The process alarm response module performs alarm root cause analysis in the second associated network, analyzes the connection edge weights and path lengths to calculate the corresponding path validity values, dynamically removes invalid paths and invalid cause points according to the path validity values, and responds to the process alarms.

[0154] The above description is merely a preferred embodiment of this application. The scope of protection of this application is not limited to the above embodiments. All technical solutions falling within the scope of this application's concept are within the scope of protection of this application. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of this application should also be considered within the scope of protection of this application.

Claims

1. A process alarm intelligent optimization method based on association rules, characterized in that, include: Data analysis is performed based on historical process alarm parameter data to analyze the operating status corresponding to the alarm points, and an association rule library is established for each operating condition through association rule analysis. Analyze the causal strength of each rule in the association rule base, calculate the corresponding transition entropy, use the transition entropy as the weight of the edge, establish directed edges between alarm cause points, and construct the first association network; Based on the real-time process alarm parameters, determine the real-time operating conditions and analyze the alarm situation. Perform cause matching in the first association network to identify the corresponding cause points and filter out the cause points with connection relationships to obtain the second association network. In the second association network, alarm root cause analysis is performed. The connection edge weights and path lengths are analyzed to calculate the corresponding path validity values. Invalid paths and invalid cause points are dynamically removed according to the path validity values ​​to respond to process alarms.

2. The intelligent optimization method for process alarms based on association rules according to claim 1, characterized in that, The process involves analyzing historical process alarm parameter data to determine the operating conditions corresponding to alarm points. This analysis includes establishing a rule library for each operating condition through association rule analysis, including: Data analysis is performed based on historical process alarm parameter data to extract corresponding parameter statistical features, analyze the frequency of occurrence of different alarm information within a preset time window, construct feature vectors, and cluster to obtain the operating status corresponding to each alarm point. By analyzing the rules within a working condition and the working condition transition, a rule library corresponding to each working condition is established.

3. The intelligent optimization method for process alarms based on association rules according to claim 2, characterized in that, The step of analyzing the rules and transitions within a work condition through association rules to establish an association rule base for each work condition includes: Within each working condition, the temporal correlation of the rules is analyzed to obtain the first correlation rule; Based on historical operating condition transition data, the migration of rules during the operating condition transition process is analyzed to obtain the second association rule; By combining the first and second association rules, an association rule library is established for each working condition.

4. The intelligent optimization method for process alarms based on association rules according to claim 1, characterized in that, The analysis of the causal strength of each rule in the association rule base, the calculation of the corresponding transition entropy, and the use of the transition entropy as the weight of the edges are used to establish directed edges between alarm cause points, constructing a first association network, including: Analyze the causal strength of each rule in the association rule base, calculate the transition probability of the rule through the conditional probability distribution, and obtain the transition entropy; For the same rule that appears in multiple working conditions, calculate the average value of the transition entropy under each working condition to obtain the weight of the edge; Based on the edge weights, directed edges are established between the alarm cause points to construct the first association network.

5. The intelligent optimization method for process alarms based on association rules according to claim 1, characterized in that, The process involves determining real-time operating conditions based on real-time process alarm parameters and analyzing alarm situations. Cause matching is performed in the first association network to identify corresponding cause points, and cause points with interconnected relationships are filtered out to obtain the second association network, which includes: Based on the real-time process alarm parameters, the real-time operating conditions are determined and the alarm situation is analyzed. The alarm situation is used as the rule pre-order node and rule post-order node respectively. Cause matching is performed in the first association network to identify the corresponding cause points and obtain the target point set. Based on the set of target points, cause points with connection relationships are selected to obtain the second association network.

6. The intelligent optimization method for process alarms based on association rules according to claim 5, characterized in that, The process of filtering out cause points with connection relationships based on the target point set to obtain the second association network includes: Based on the set of target points, cause points that have at least one directed connected path with the target points are selected from the first association network to obtain the first connected network; Based on the real-time operating condition analysis, the matching degree between the cause points and the operating conditions in the first connected network is analyzed, and the cause points with a matching degree greater than the preset matching threshold are filtered out to obtain the second connected network. Analyze the direction of the connected paths in the second connected network, calculate the in-degree and out-degree of the corresponding cause points, and calculate the connection strength of the corresponding connecting edges. Filter out the connecting edges whose connection strength is greater than a preset strength threshold to obtain the second associated network.

7. The intelligent optimization method for process alarms based on association rules according to claim 1, characterized in that, The alarm root cause analysis is performed in the second association network. The analysis of connection edge weights and path lengths calculates the corresponding path validity value. Invalid paths and invalid cause points are dynamically removed according to the path validity value to respond to the process alarm, including: In the second association network, alarm root cause analysis is performed to calculate the corresponding effective value of the path by analyzing the weight of the connecting edge and the path length. Based on the centrality of cause points analyzed by path validity values, invalid paths and invalid cause points are dynamically removed, and process alarms are responded to.

8. The intelligent optimization method for process alarms based on association rules according to claim 7, characterized in that, The alarm root cause analysis is performed in the second association network, which analyzes the edge weights and path lengths to calculate the corresponding effective path values, including: In the second association network, alarm root cause analysis is performed by comparing the time intervals between two nodes on the same connection edge and calculating the corresponding time series weights. Based on the real-time process parameters of each node in the second association network, analyze parameter anomalies and calculate the corresponding anomaly scores; By combining temporal weights and outlier scores, the causal propagation in the path is simulated, the edge weights and path lengths are analyzed, and the corresponding effective path values ​​are calculated.

9. The intelligent optimization method for process alarms based on association rules according to claim 8, characterized in that, The process of analyzing the centrality of cause points based on path validity values, dynamically removing invalid paths and invalid cause points, and responding to process alarms includes: Analyze the centrality of cause points based on path validity values, and calculate the valid scores of nodes; Paths and cause points with valid values ​​less than a preset first threshold and valid scores less than a preset second threshold are selected, and invalid paths and invalid cause points are removed to obtain the alarm cause network. Based on the alarm cause network analysis, the alarm cause is analyzed and corresponding handling measures are generated to respond to the process alarm.

10. A process alarm intelligent optimization system based on association rules, characterized in that, The method for implementing the intelligent optimization method for process alarms based on association rules as described in any one of claims 1 to 9 includes: The association rule analysis module performs data analysis based on historical process alarm parameter data, analyzes the operating status corresponding to the alarm point, and establishes an association rule library for each operating condition through association rule analysis. The association network construction module analyzes the causal strength of each rule in the association rule base, calculates the corresponding transition entropy, uses the transition entropy as the weight of the edge, establishes directed edges between alarm cause points, and constructs the first association network. The process alarm analysis module determines the real-time operating conditions and analyzes the alarm situation based on the real-time process alarm parameters. It performs cause matching in the first association network, identifies the corresponding cause points, and filters out cause points with connection relationships to obtain the second association network. The process alarm response module performs alarm root cause analysis in the second associated network, analyzes the connection edge weights and path lengths to calculate the corresponding path validity values, dynamically removes invalid paths and invalid cause points according to the path validity values, and responds to the process alarms.

Images