Intelligent operation and maintenance early warning method and device, electronic equipment and storage medium

Abstract

The application relates to the technical field of industrial control, and in particular to an intelligent operation and maintenance early warning method and device, electronic equipment and a storage medium. Raw working condition data such as equipment vibration, temperature and current are collected according to a period, and instantaneous feature vectors and sliding window tensors are obtained through preprocessing. The sliding window tensors are respectively input into a lightweight LSTM and a lightweight Transformer model, and corresponding time sequence anomaly scores and global anomaly scores are obtained. A standard clause deviation score and a redundancy suppression term are calculated in combination with the instantaneous feature vectors, a comprehensive early warning score is obtained by fusing multiple score values, and device classification early warning is realized according to the score. The application fuses double lightweight AI models and industry operation and maintenance standards, can be deployed on an embedded end, reduces the early warning false alarm rate, improves the early warning accuracy and interpretability, and realizes active early warning of the equipment running state.

Description

Technical Field

[0001] This application relates to the field of industrial control technology, and in particular to an intelligent operation and maintenance early warning method, device, electronic device and storage medium. Background Technology

[0002] In industrial sites, building electromechanical systems, and transportation electromechanical systems, numerous embedded servers deployed on equipment or within racks continuously collect operational data such as vibration, bearing temperature, and motor current online. These servers need to perform status assessments and early warnings locally, while adhering to industry operation and maintenance standards and enterprise service specifications. Currently, the operation and maintenance systems for such equipment generally rely on simple rule engines or human experience, lacking deep learning and trend prediction capabilities for equipment operating status, making proactive early warning difficult. Alternatively, they may be overly reliant on cloud-based rule platforms, failing to achieve integrated deployment of dynamic knowledge base updates and lightweight AI prediction in embedded environments. This results in early warning results being easily influenced by a single data source, leading to high false alarm rates and poor interpretability. Summary of the Invention

[0003] To overcome the shortcomings of existing technologies, this invention provides an intelligent operation and maintenance early warning method, device, electronic device, and storage medium, which integrates dual lightweight AI models and industry operation and maintenance standards. It can be deployed on embedded devices, reducing the false alarm rate of early warnings, improving the accuracy and interpretability of early warnings, and realizing proactive early warning of equipment operating status.

[0004] A first aspect of this application provides an intelligent operation and maintenance early warning method, the method comprising: Original operating condition data is obtained according to a preset sampling period; The original working condition data is preprocessed to obtain a single-moment instantaneous feature vector and a sliding window tensor consisting of W consecutive sampling moments; The sliding window tensor is input into a lightweight LSTM model, and the lightweight LSTM model outputs a temporal anomaly score; the sliding window tensor is input into a lightweight Transformer model, and the lightweight Transformer model outputs a global anomaly score. The standard clause deviation score and redundancy suppression term are obtained based on the instantaneous feature vector; The comprehensive early warning score is determined based on the time-series anomaly score, the global anomaly score, the standard clause deviation score, and the redundancy suppression item. The warnings are tiered based on the comprehensive warning score.

[0005] In an optional implementation, before acquiring the original operating condition data according to a preset sampling period, the method further includes: When power-on startup is detected, the local operation and maintenance knowledge graph and the embedded standard service knowledge base are loaded from local storage to obtain a local cached version that runs in memory. Detect the status of the edge-cloud communication link; When the edge-cloud communication link is determined to be normal based on its status, the differential packets sent from the cloud are retrieved through edge-cloud collaborative synchronous proxy; the differential packets are then subjected to version verification and hash verification in sequence; after verification, the differential packets are hot-loaded using a double buffer mechanism and atomically switched to the updated running version; the differential packets include knowledge differential packets and model weight differential packets; When the edge-cloud communication link is determined to be abnormal based on the edge-cloud communication link status, the local cache version is used.

[0006] In an optional implementation, obtaining the standard clause deviation score based on the instantaneous feature vector includes: Traverse the operation and maintenance knowledge graph to obtain the set of currently hit fault paths; pass Calculate the deviation score of the standard clause ;in, For the set of faulty paths, Configure weights for edges in the knowledge graph. For the map attributes and instantaneous feature vectors The matching degree function.

[0007] In an optional implementation, obtaining the redundancy suppression term based on the instantaneous feature vector includes: The instantaneous feature vector is compared with the operation and maintenance standard threshold in the embedded standard service knowledge base to determine whether a short-term threshold alarm is triggered. The model determination result is obtained by combining the temporal anomaly score and the global anomaly score. When the determination result of the short-term threshold alarm is inconsistent with the determination result of the model, the redundancy suppression term is set to a preset positive value; When the determination result of the short-term threshold alarm is consistent with the determination result of the model, the redundancy suppression term is set to 0.

[0008] In one optional implementation, the lightweight LSTM model includes two LSTM layers, one Dropout layer, and a fully connected output head; during the training phase, a one-step prediction reconstruction unsupervised loss combined with a binary cross-entropy supervised loss is used for joint training; during the inference phase, the temporal anomaly score is normalized to the [0,1] interval based on the reconstruction loss and the temporal threshold.

[0009] In one optional implementation, the lightweight Transformer model includes an input projection layer, a position encoding layer, a Transformer encoder, a mean pooling layer, and a fully connected classification head; the Transformer encoder has 1 to 2 layers and 2 to 4 attention heads; during the training phase, weighted binary cross-entropy is used as the main loss, and normal sample comparison regularization constraint is superimposed.

[0010] In an optional implementation, before inputting the sliding window tensor into the lightweight Transformer model and outputting the global anomaly score through the lightweight Transformer model, the method further includes: Obtain the CPU utilization and available memory percentage of the embedded server; When the CPU utilization rate is less than the first preset threshold and the available memory ratio is greater than the second preset threshold, the sliding window length W remains unchanged. When the CPU utilization rate is greater than the first preset threshold or the available memory ratio is less than the second preset threshold, the sliding window length W is halved and the minimum value is not less than 64, the lightweight Transformer model is turned off, and the global anomaly score is set to 0.

[0011] A second aspect of this application provides an intelligent operation and maintenance early warning device, the device comprising: The data acquisition module is used to acquire raw operating condition data according to a preset sampling period; The data preprocessing module is used to preprocess the original working condition data to obtain a single-moment instantaneous feature vector and a sliding window tensor composed of W consecutive sampling moments. The model computation module is used to input the sliding window tensor into a lightweight LSTM model and output a temporal anomaly score through the lightweight LSTM model; and to input the sliding window tensor into a lightweight Transformer model and output a global anomaly score through the lightweight Transformer model. The score calculation module is used to obtain the standard clause deviation score and redundancy suppression term based on the instantaneous feature vector; The comprehensive early warning score is determined based on the time-series anomaly score, the global anomaly score, the standard clause deviation score, and the redundancy suppression item. The graded early warning module is used to issue graded early warnings based on the comprehensive early warning score.

[0012] A third aspect of this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the intelligent operation and maintenance early warning method.

[0013] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described intelligent operation and maintenance early warning method.

[0014] In summary, the intelligent operation and maintenance early warning method, device, electronic equipment, and storage medium provided in this application periodically collect equipment operating data and perform preprocessing to generate instantaneous feature vectors and sliding window tensors. A lightweight LSTM model is used to mine the temporal features of the data to obtain a temporal anomaly score, and a lightweight Transformer model is combined to extract global features to obtain a global anomaly score. Relying on these dual lightweight models, in-depth analysis and trend prediction of equipment operating status are achieved, eliminating reliance on manual experience and simple rules, and realizing proactive early warning. Simultaneously, the lightweight model is adaptable to embedded local deployment. By combining the standard clause deviation score and redundancy suppression term calculated from the instantaneous feature vector, multi-dimensional scores are integrated to obtain a comprehensive early warning score and execute tiered early warnings, effectively avoiding judgment bias caused by a single data dimension, reducing the false alarm rate, and improving the interpretability of the early warning results when combined with industry operation and maintenance standards. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the architecture of an embedded intelligent operation and maintenance early warning system based on edge-cloud collaboration, as shown in an embodiment of this application. Figure 2 This is a flowchart illustrating an intelligent operation and maintenance early warning method according to an embodiment of this application; Figure 3 This is another flowchart illustrating an intelligent operation and maintenance early warning method according to an embodiment of this application; Figure 4 This is a functional block diagram of an intelligent operation and maintenance early warning device shown in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of an electronic device shown in an embodiment of this application. Detailed Implementation

[0016] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0017] The following will clearly and completely describe the concept, specific structure, and technical effects of the present invention in conjunction with embodiments and accompanying drawings, so as to fully understand the purpose, features, and effects of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are all within the scope of protection of the present invention. Furthermore, all connections / linkages involved in the patent do not simply refer to direct contact between components, but rather to the ability to form a better connection structure by adding or reducing connecting accessories according to specific implementation conditions. The various technical features in this invention can be combined interactively without contradicting each other.

[0018] Reference Figure 1 The diagram shown is an architectural schematic of an embedded intelligent operation and maintenance early warning system based on edge-cloud collaboration, as illustrated in an embodiment of this application. The embedded intelligent operation and maintenance early warning system includes a perception layer, an embedded server, and a cloud collaboration layer. This system is executed by an embedded electronic device, enabling real-time data acquisition on the device side, multi-model inference, knowledge rule verification, and hierarchical early warning. Continuous iterative optimization is achieved through edge-cloud collaboration.

[0019] Perception layer: Includes multi-source sensor interfaces and edge acquisition gateways, responsible for collecting and preprocessing raw operating condition data of the equipment.

[0020] Embedded server layer: Deployed on the device side, it includes a data preprocessing and feature caching module, a resource adaptive scheduler, a lightweight LSTM time series module, a lightweight Transformer module, a configurable operation and maintenance knowledge graph, an embedded standard and service knowledge base, a three-source fusion early warning engine, a local early warning and handling interface, and an edge-cloud collaborative synchronization agent.

[0021] Cloud-based collaboration layer: Includes collaborative calibration and auditing modules, knowledge orchestration and version service modules, and model training and weight distribution modules, responsible for providing cloud-based training, knowledge updates, and version management capabilities.

[0022] The overall system workflow is as follows: The perception layer collects data and completes protocol adaptation and timestamp alignment, outputting raw data to the embedded server layer; the embedded server preprocesses and caches the data, and the resource adaptive scheduler dynamically controls the start / stop and sliding window length of the lightweight LSTM / Transformer model according to the hardware load; simultaneously, the preprocessed feature data is input into the dual-model inference module and the knowledge rule verification module, respectively, outputting time-series anomaly scores, global anomaly scores, and standard clause deviation scores. The three-source fusion early warning engine performs fusion calculation on the above three types of scores to generate a comprehensive early warning score and an interpretable early warning message; the local early warning and handling interface outputs alarm information and operation and maintenance suggestions, while the edge-cloud collaborative synchronous agent uploads the early warning event to the cloud; after the cloud completes calibration and auditing, it sends out updated knowledge data packages and model weight packages, and updates the embedded server through differential synchronization and hot loading mechanisms to achieve closed-loop iteration of the system.

[0023] Reference Figure 2 and Figure 3 The diagram shown is a flowchart illustrating an intelligent operation and maintenance early warning method according to an embodiment of this application. The intelligent operation and maintenance early warning method includes the following steps.

[0024] S21: Start loading local data to form a cached version. If the link is normal, it will synchronize differential packets. If there is an error, it will continue to use the local cached version.

[0025] After the embedded server starts, it loads the local knowledge graph index and standard library. If the network is available, it pulls the differential package by version number through the synchronization agent, performs hot update after verifying the hash, and rolls back to the previous stable version if it fails.

[0026] In some embodiments, the method further includes: When power-on startup is detected, the local operation and maintenance knowledge graph and the embedded standard service knowledge base are loaded from local storage to obtain a local cached version that runs in memory. Detect the status of the edge-cloud communication link; When the edge-cloud communication link is determined to be normal based on its status, the differential packets sent from the cloud are retrieved through edge-cloud collaborative synchronous proxy; the differential packets are then subjected to version verification and hash verification in sequence; after verification, the differential packets are hot-loaded using a double buffer mechanism and atomically switched to the updated running version; the differential packets include knowledge differential packets and model weight differential packets; When the edge-cloud communication link is determined to be abnormal based on the edge-cloud communication link status, the local cache version is used.

[0027] In some embodiments, after the embedded server starts, it first reads and loads the local operation and maintenance knowledge graph and the embedded standard service knowledge base from local non-volatile storage, and loads them into the runtime memory to form a local cached version that runs in memory. Subsequently, the system detects the connectivity status of the edge-cloud communication link and executes different initialization branch processes according to the link status.

[0028] When the edge-cloud communication link is normal, the system requests differential data from the cloud based on the current version number through the edge-cloud collaborative synchronization agent, pulling differential package data containing knowledge differential packages and model weight differential packages. The pulled differential packages undergo version verification and hash verification sequentially. If verification passes, a double-buffer mechanism is used to write the differential package data to a backup buffer, completing hot loading, and atomically switching to the updated running version to ensure uninterrupted system operation. If verification fails, the system automatically rolls back to the previous stable version and continues running using the locally cached version.

[0029] When the edge-cloud communication link is abnormal, the system cannot synchronize and update data from the cloud. Instead, it directly uses the local cache version that was loaded into memory during this startup and proceeds with the subsequent data collection and processing process to ensure the autonomous operation of the system in the event of a network outage.

[0030] The above optional implementation methods realize an initialization mechanism of "loading upon power-on, differential updating when the link is available, and stable operation when the link is abnormal". At the same time, the security and continuity of the update process are ensured through version verification, hash verification and atomic switching of double buffer.

[0031] S22, acquire raw operating condition data according to the preset sampling period.

[0032] Three types of key data are collected as raw operating condition data through a multi-source sensor interface and an edge acquisition gateway at a unified sampling period Ts. After timestamp alignment, the data is written to the raw stream buffer. The raw operating condition data includes vibration signal, bearing temperature, and motor current, as shown in Table 1 below.

[0033] Table 1:

[0034] Since independent data acquisition by each sensor may result in timing discrepancies, the edge acquisition gateway performs unified timestamp marking and alignment processing on multiple asynchronous data streams to eliminate time differences between channels, ensuring that the three types of operating data correspond one-to-one in the time dimension, and the aligned raw data stream is completely sent to the embedded server.

[0035] It should be noted that the edge acquisition gateway integrates the ability to parse common industrial communication protocols, supporting Modbus RTU, Modbus TCP, and MQTT protocol adaptation, and can connect to different types of field sensors and lower-level devices. In this embodiment, model-level feature engineering and computation are all performed on the embedded server. The edge acquisition gateway only completes protocol conversion and multi-channel data timing alignment, and does not perform model-related calculations such as filtering, feature extraction, and tensor construction within the gateway, thus simplifying the gateway load and ensuring the originality of the data.

[0036] S23, preprocess the original working condition data to obtain a single-moment instantaneous feature vector and a sliding window tensor composed of W consecutive sampling moments.

[0037] In some embodiments, after the embedded server acquires the raw operating condition data transmitted by the edge acquisition gateway, it performs data preprocessing on the raw operating condition data. Specifically, it performs targeted filtering and noise reduction for different types of data, including: applying bandpass filtering (e.g., 10 Hz to 5 kHz, which can be configured according to the equipment speed) to the raw vibration acceleration sequence to suppress electrical interference and high-frequency structural noise; and using sliding median filtering for bearing temperature and motor current data to remove isolated pulse interference such as spikes and jumps.

[0038] Based on the filtered three types of data, an instantaneous feature vector of dimension D=3 is constructed at each sampling time. .in, This represents the root mean square (RMS) value of the vibration signal. and These are the filtered temperature and current values, respectively.

[0039] Among them, the average values ​​of each feature obtained by cloud-based statistical analysis based on historical normal operating condition data. with standard deviation These parameters are sent to the embedded server along with the weight package. The average values ​​of each feature, obtained from cloud statistics during the device deployment phase, are used. with standard deviation Standardize the feature vectors: .

[0040] Using the normalized feature vectors from W consecutive sampling times as units, construct a sliding window tensor. This serves as the input data for subsequent LSTM / Transformer model inference.

[0041] Data loss during the data collection process is handled in a tiered manner. When the number of consecutive missing points is ≤3, linear interpolation is used to complete the data to ensure the integrity of the sliding window data. When the number of consecutive missing points is >3, the sliding window is discarded and a system alarm is triggered. The sliding window is not sent into the model inference process to avoid abnormal data affecting the model results.

[0042] After preprocessing, the instantaneous feature vectors are... With sliding window tensor Write the data to a circular feature cache for concurrent reading by subsequent inference and graph matching threads. The instantaneous feature vector is included. Also used in the clause matching function of knowledge graphs Real-time comparison of standard terms.

[0043] S24, input the sliding window tensor into the lightweight LSTM model, and output the temporal anomaly score through the lightweight LSTM model.

[0044] In some embodiments, the preprocessed sliding window tensor The lightweight LSTM model is used for inference. The lightweight LSTM model consists of two LSTM layers, a Dropout layer, and a fully connected output head. During the training phase, a one-step prediction reconstruction unsupervised loss combined with a binary cross-entropy supervised loss is used for joint training. During the inference phase, the temporal anomaly score is normalized to the [0,1] interval based on the reconstruction loss and the temporal threshold.

[0045] Temporal features are extracted using a lightweight LSTM model and calculated using a preset threshold. The output is a temporal anomaly score with values ​​in the [0,1] interval. This score is used to characterize the degree of local anomalies in equipment operating conditions within a short time window.

[0046] S25, input the sliding window tensor into the lightweight Transformer model, and output the global anomaly score through the lightweight Transformer model.

[0047] In some embodiments, the preprocessed sliding window tensor Inference is performed using a lightweight Transformer model. The lightweight Transformer model includes an input projection layer, a positional encoding layer, a Transformer encoder, a mean pooling layer, and a fully connected classification head; the Transformer encoder has 1-2 layers and 2-4 attention heads. During training, weighted binary cross-entropy is used as the primary loss, supplemented by normal sample contrast regularization constraints.

[0048] By using a lightweight Transformer model, the sliding window tensor is first mapped to the feature dimensions through the input projection layer. Temporal information is then supplemented by positional encoding before being fed into the Transformer encoder for feature extraction. The encoder output is then averaged along the time dimension and processed by a fully connected classification head. The model ultimately outputs a global anomaly score. The score is normalized to the [0,1] interval and is used to characterize the degree of coordinated anomalies of multiple parameters such as vibration, bearing temperature, and motor current.

[0049] It should be noted that the lightweight LSTM model and the lightweight Transformer model are pre-built and trained, then deployed on an embedded server after cloud training, INT8 quantization.

[0050] In some embodiments, the system builds models based on the open-source deep learning framework PyTorch (components such as torch.nn.LSTM and torch.nn.TransformerEncoder), independently constructing lightweight networks using only the framework's basic components, without calling general-purpose large models or third-party pre-trained temporal models. That is, two lightweight networks are trained from scratch in the cloud based on historical operating data, and the quantized weights are distributed to the embedded server for inference via weight difference packets. During deployment, the results can be exported as ONNX Runtime or TorchScript, and INT8 quantization can be performed on the embedded side (e.g., using the framework's built-in torch.quantization or ONNX Runtime quantization tools).

[0051] At least 30 days of normal operating condition sliding window data collected from the cloud are used as positive samples; time-series sliding windows from 1 to 6 hours prior to a failure are extracted as abnormal samples, and these samples are labeled in conjunction with on-site maintenance records; unlabeled data is used only for unsupervised training branches. Historical operating condition data is defined as the sliding window tensor obtained after collection and preprocessing. The feature dimension D=3, corresponding to the vibration RMS value, bearing temperature, and motor current, respectively; the sliding window length W ranges from 64 to 512. All model training is completed in the cloud, and the trained model weights are quantized using INT8 and then sent to the embedded server along with the weight difference package.

[0052] Next, a custom lightweight Long Short-Term Memory (LSTM) network is constructed, consisting of two LSTM layers, one Dropout layer, and a fully connected output header. The specific layer configuration is as follows: First LSTM layer: Input dimension is 3, hidden layer dimension is set to 64, batch_first mode is enabled; The second LSTM layer has an input dimension that continues from the previous layer, with an output dimension of 64, and the hidden layer dimension remains 64. Dropout layer: Enabled only during model training, with a dropout probability of p=0.1, used to suppress overfitting; Fully connected output header: Configure the linear layer Linear(64, 32), ReLU activation function, linear layer Linear(32, 1), and Sigmoid activation function in sequence.

[0053] The model takes the hidden state at the last moment of the second LSTM layer. The input is a fully connected header, and the final output is a scalar timing anomaly analyzer with values ​​ranging from [0,1]. .

[0054] To facilitate understanding of the inventive concept of this application, the following provides a lightweight LSTM model structure example for reference. Figure 2 As shown.

[0055] Table 2:

[0056] Take the hidden state at the last moment Obtained through a full connector This structure corresponds to a custom small network (without pre-trained weights) in PyTorch that stacks nn.LSTM and nn.Linear.

[0057] During model training, a joint loss method is used, primarily employing unsupervised reconstruction loss and secondarily supervising classification loss. Unsupervised principal loss: A one-step time series prediction reconstruction method is adopted, utilizing a sliding window. Forward W Predict the feature vector at time W from data at time 1, and reconstruct the loss. ; Supervised auxiliary loss (optional): Apply binary cross-entropy loss to labeled outlier samples. ; The total loss is then expressed as The balance coefficient λ = 0.5.

[0058] The Adam optimizer was selected, and the initial learning rate was set to 10. 3. Batch size = 64, set early stopping strategy, patience value = 10 to prevent model overfitting.

[0059] After training, the reconstruction loss is calculated on the validation set to determine the quantile threshold. (Preferred 95th percentile). The reasoning stage is achieved through... Calculate the time series anomaly score. After threshold calibration, perform INT8 quantization on the entire model, retain only the parameter blocks of the LSTM layers and fully connected heads, and package them into a weight difference package.

[0060] In subsequent applications of the lightweight LSTM model, it exhibits high sensitivity to local data abrupt changes and short-term trend reversals in vibration, temperature, and current within a short sliding window. It is primarily used to capture early, short-term anomalies in equipment, and the output... .

[0061] While training the lightweight LSTM model, a custom lightweight Transformer model is also implemented, including an input projection layer, a positional encoding layer, a Transformer encoder, an average pooling layer, and a fully connected classification head group, with approximately 10 parameters. 5 Level, specific configuration is as follows: Input projection layer: The original features of dimension D=3 are mapped to the model dimension dmodel=64 through the Linear layer; Position coding layer: Employs sinusoidal position coding or learnable position vectors, with the coding length consistent with the sliding window length W; Transformer encoder: The encoder has 1 or 2 layers, the number of attention heads nhead=2, the feedforward dimension dim_feedforward=128, and the dropout probability p=0.1; Mean pooling layer: Performs global mean pooling on the temporal dimension of the encoder output to obtain a feature vector with dimension 64; Fully connected classification head: Configure Linear(64, 32), ReLU activation function, Linear(32, 1), and Sigmoid activation function in sequence. The final output is a scalar global anomaly score with values ​​in the range [0,1]. .

[0062] It should be noted that the encoder is implemented as a small, custom model (approximately 10 parameters) that wraps `nn.TransformerEncoderLayer` in PyTorch. 5 (On a scale of magnitude), a fine-tuned version of a non-TimesFM, PatchTST, or other third-party pre-trained time series basic models.

[0063] To facilitate understanding of the inventive concept of this application, the following provides a lightweight Transformer network layer configuration example for reference. Figure 3 As shown.

[0064] Table 3:

[0065] Sharing the same time-series sliding window dataset as the lightweight LSTM model, soft labels are added to the operation and maintenance knowledge graph nodes for samples with known fault types. .

[0066] During model training, the main loss is a weighted binary cross-entropy. Simultaneously, a contrastive regularization constraint is added, requiring the model output corresponding to normal samples to be... The mean value does not exceed 0.2, which enhances the model's ability to distinguish between normal and abnormal data.

[0067] The AdamW optimizer was selected, with an initial learning rate set to 5×10⁻⁶. 4 Combined with a cosine learning rate scheduling strategy, the number of training rounds is set to 50-100 rounds.

[0068] During training, ensure that the two models use the same sliding window segmentation rule; after training, calculate the AUC index of the two models in the cloud, and determine the initial values ​​of the fusion coefficients α and β based on the evaluation results.

[0069] After training, INT8 quantization is performed on the Transformer encoder and classification head. The quantized incremental weight blocks are packaged into independent weight difference packets and sent to the embedded server.

[0070] In subsequent applications of the lightweight Transformer model, relying on the self-attention mechanism, it learns the variable coupling relationship among vibration, bearing temperature, and motor current within the same sliding window. This allows for accurate identification of multi-variable collaborative anomalies such as "stable current and simultaneous increase in vibration and temperature," and the output... Used to characterize global coupling anomalies.

[0071] In an optional implementation, before inputting the sliding window tensor into the lightweight Transformer model and outputting the global anomaly score through the lightweight Transformer model, the method further includes: Obtain the CPU utilization and available memory percentage of the embedded server; When the CPU utilization rate is less than the first preset threshold and the available memory ratio is greater than the second preset threshold, the sliding window length W remains unchanged. When the CPU utilization rate is greater than the first preset threshold or the available memory ratio is less than the second preset threshold, the sliding window length W is halved and the minimum value is not less than 64, the lightweight Transformer model is turned off, and the global anomaly score is set to 0.

[0072] Because the lightweight LSTM model and the lightweight Transformer model share the same sliding window tensor on embedded devices. As input, the system needs to dynamically adjust the model operation strategy and data sliding window parameters according to the real-time hardware load of the device, taking into account both the accuracy of early warning and the stability of system operation, and preventing data omission and inference timeout caused by insufficient computing power.

[0073] In some embodiments, the system collects and monitors the CPU utilization and available memory ratio of the embedded server in real time, with a preset CPU utilization threshold of 85% and an available memory ratio threshold of 15%.

[0074] When CPU utilization is below 85% and available memory usage is above 15%, the device is considered to be under normal load, and the current sliding window length W remains unchanged. At this point, the same sliding window tensor... Input a lightweight LSTM model and a lightweight Transformer model respectively. The two models perform inference in parallel and output temporal anomaly scores synchronously. With global anomaly The two sets of values ​​jointly participate in the subsequent comprehensive early warning calculation, giving full play to the advantages of each model and accurately identifying local time-series anomalies and multivariate collaborative anomalies.

[0075] When CPU utilization is greater than or equal to 85%, or available memory usage is less than or equal to 15%, the device is considered to be in a high-load state. The system automatically halves the sliding window length W, and strictly ensures that the minimum sliding window length is no less than 64, reducing the amount of data computation per inference. Simultaneously, the lightweight Transformer model is disabled, and inference using that model is no longer executed. Global anomalies are directly distributed... Set to 0. This strategy simplifies the computation process, reduces hardware computing power consumption, and only retains the lightweight LSTM model to continue working. In subsequent fusion calculations, the weights are renormalized according to the coefficient rules, and early warning is completed based on a single model, effectively avoiding the risks of inference timeout and data loss under high load, and ensuring the continuous and reliable operation of the system.

[0076] S26, Obtain the standard clause deviation score and redundancy suppression term based on the instantaneous feature vector.

[0077] In some embodiments, the system introduces knowledge constraints to retrieve subgraphs in the graph that match the current operating condition, in order to Deviation from standard library threshold calculation Specifically, the system traverses the pre-loaded operation and maintenance knowledge graph, matches the fault paths corresponding to devices and components based on the current instantaneous feature vector, and obtains the set of currently matched fault paths. For each hit path, assign weights to the edges along that path. Calculate the map attributes and instantaneous feature vectors Matching degree function Then sum the weighted matching degrees of all edges on the path. Take the maximum value among all paths to obtain the standard clause deviation score. .

[0078] Among them, the standard clauses deviate from the points The formula for calculating the overall deviation between the current operating condition and each fault path and corresponding standard clause in the knowledge graph is as follows: ; in, For the set of faulty paths, Configure weights for edges in the knowledge graph. For the map attributes and instantaneous feature vectors The matching degree function.

[0079] Meanwhile, the system can also dynamically adjust the value of the redundancy suppression term based on the deviation between the model anomaly score and the threshold alarm, thereby achieving refined false alarm suppression.

[0080] In an optional implementation, obtaining the redundancy suppression term based on the instantaneous feature vector includes: The instantaneous feature vector is compared with the operation and maintenance standard threshold in the embedded standard service knowledge base to determine whether a short-term threshold alarm is triggered. The model determination result is obtained by combining the temporal anomaly score and the global anomaly score. When the determination result of the short-term threshold alarm is inconsistent with the determination result of the model, the redundancy suppression term is set to a preset positive value; When the determination result of the short-term threshold alarm is consistent with the determination result of the model, the redundancy suppression term is set to 0.

[0081] Among them, the redundancy suppression term Used to suppress false alarms from a single source.

[0082] In some embodiments, the system compares the preprocessed instantaneous feature vector with the operation and maintenance standard thresholds in the embedded standard service knowledge base index by index to determine whether vibration, bearing temperature, and motor current exceed preset short-term alarm thresholds, thereby obtaining the judgment result of short-term threshold alarm. Simultaneously, the system analyzes the time-series anomalies output by the lightweight LSTM model. Global anomaly analysis of the output of the lightweight Transformer model The results are combined by taking the maximum or average of the two values ​​and comparing them with a preset model judgment threshold to obtain the model judgment result.

[0083] When the judgment result of the short-term threshold alarm is inconsistent with the judgment result of the model, for example, the threshold alarm shows that the device is abnormal but the model judges it to be normal, or the model judges it to be abnormal but no threshold alarm is triggered, it indicates that there is a possibility of a false alarm from a single source. In this case, the redundancy suppression term is set to a preset positive value. When the two judgment results are consistent, it indicates that the two types of judgments corroborate each other and there is no obvious risk of false alarm. The redundancy suppression term is set to 0.

[0084] In the calculation of the comprehensive early warning score, by subtracting δ×R t This approach lowers the overall warning score for inconsistent scenarios, effectively reducing the false alarm rate caused by exceeding a single threshold or occasional model bias.

[0085] S27. Determine the comprehensive early warning score based on the time-series anomaly score, the global anomaly score, the standard clause deviation score, and the redundancy suppression item.

[0086] When the time series anomaly is obtained Global anomaly classification Standard terms deviate from the standard terms and redundancy suppression terms Subsequently, relying on a multi-dimensional assessment mechanism, combined with model reasoning results, operational standard constraints, and false alarm suppression strategies, the time-series anomaly score, global anomaly score, standard clause deviation score, and redundancy suppression item generated by the preceding process are integrated to complete a unified quantitative assessment of the degree of operational anomalies.

[0087] In some embodiments, the system uses a weighted fusion method to calculate the comprehensive early warning score at time t. : ; The fusion coefficient δ, along with α, β, and γ, is distributed after collaborative calibration in the cloud. α, β, and γ satisfy α+β+γ=1 by default to ensure the weight balance between the model and knowledge constraints in the early warning judgment.

[0088] It should be noted that, and These respectively characterize local timing anomalies and multivariate coupling anomalies in the equipment; It represents the degree of deviation of the current operating condition from industry operation and maintenance standards and knowledge graph fault clauses; This is used to offset invalid alarms caused by a single data source. The model score and knowledge deviation score positively contribute to the warning score, while the redundancy suppression term lowers the score when there is a conflict between the threshold alarm and the model's judgment. The calculated comprehensive warning score is... The value ranges from [0,1], and the higher the value, the higher the overall risk of equipment malfunction.

[0089] In addition, the system possesses adaptive capabilities based on link status. When the edge-cloud communication link is interrupted and interaction with the cloud is impossible, the fusion engine automatically increases the fusion coefficient γ corresponding to the deviation score of the standard clause, strengthening the constraint weights of the local operation and maintenance knowledge graph and the embedded standard knowledge base, and relying on local rules to ensure the effectiveness of the early warning. When the edge-cloud communication link returns to normal, the cloud audit module compares the local inference results of the embedded server with the cloud recalculation results, generates correction values ​​for the fusion coefficients α, β, and γ, and sends them to the local system to complete parameter iterative optimization and continuously improve the accuracy of the early warning.

[0090] S28, tiered early warning is issued based on the comprehensive early warning score.

[0091] When the comprehensive early warning score is calculated Subsequently, the system will determine the level of equipment operation risk based on preset classification threshold rules and match corresponding operation and maintenance handling suggestions, realizing a closed-loop output from quantified risk to executable actions. To facilitate understanding of the inventive concept of this application, an exemplary judgment rule example for classification early warning is shown in Table 4 below.

[0092] Table 4:

[0093] In this embodiment, the system first determines the early warning score based on the overall early warning score. The warning level is determined by the range the warning falls into; for emergency warning levels, additional checks are performed to verify deviations from the standard clauses. To ensure the reliability of high-risk assessments, the system checks whether a threshold has been reached. Based on the assessment result, it retrieves corresponding handling suggestions from the embedded standard service knowledge base and operation and maintenance knowledge graph, generates an interpretable early warning message containing the warning level, attribution path, and handling measures, and pushes it to the local interface or cloud platform to provide clear operational guidance for operation and maintenance personnel.

[0094] Reference Figure 4 The diagram shown is a functional block diagram of the intelligent operation and maintenance early warning device according to an embodiment of this application.

[0095] In some embodiments, the intelligent operation and maintenance early warning device 40 may include multiple functional modules composed of computer program segments. The computer programs of each program segment of the intelligent operation and maintenance early warning device 40 may be stored in the memory of an electronic device and executed by at least one processor to perform (see details). Figure 1(Description) The intelligent operation and maintenance early warning function. Based on its functions, it can be divided into multiple functional modules. These functional modules may include: a data acquisition module 401, a data preprocessing module 402, a model calculation module 403, a score calculation module 404, and a graded early warning module 405. The module referred to in this application is a series of computer program segments that can be executed by at least one processor and perform a fixed function, stored in memory. In this embodiment, the functions of each module will be detailed in subsequent embodiments.

[0096] The data acquisition module 401 is used to acquire raw operating condition data according to a preset sampling period.

[0097] The data preprocessing module 402 is used to preprocess the original working condition data to obtain a single-moment instantaneous feature vector and a sliding window tensor composed of W consecutive sampling moments.

[0098] The model computation module 403 is used to input the sliding window tensor into a lightweight LSTM model and output a temporal anomaly score through the lightweight LSTM model; and to input the sliding window tensor into a lightweight Transformer model and output a global anomaly score through the lightweight Transformer model.

[0099] The score calculation module 404 is used to obtain the standard clause deviation score and redundancy suppression term based on the instantaneous feature vector; The comprehensive early warning score is determined based on the time-series anomaly score, the global anomaly score, the standard clause deviation score, and the redundancy suppression item.

[0100] The graded early warning module 405 is used to issue graded early warnings based on the comprehensive early warning score.

[0101] It should be understood that the various variations and specific embodiments of the intelligent operation and maintenance early warning method provided in the above embodiments are also applicable to the intelligent operation and maintenance early warning device of this embodiment. Through the foregoing detailed description of the intelligent operation and maintenance early warning method, those skilled in the art can clearly understand the implementation method of the intelligent operation and maintenance early warning device in this embodiment. For the sake of brevity, it will not be described in detail here.

[0102] See Figure 5 The diagram shown is a schematic representation of the structure of an electronic device according to an embodiment of this application. In a preferred embodiment of this application, the electronic device 5 includes a memory 51, at least one processor 52, and at least one communication bus 53.

[0103] Those skilled in the art should understand that Figure 5The structure of the electronic device shown does not constitute a limitation of the embodiments of this application. It can be a bus structure or a star structure. The electronic device 5 may also include more or fewer other hardware or software than shown, or different component arrangements.

[0104] In some embodiments, the electronic device 5 is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions. Its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), digital processors, and embedded devices. The electronic device 5 may also include user equipment, which includes, but is not limited to, any electronic product capable of human-computer interaction with a user via a keyboard, mouse, remote control, touchpad, or voice control device, such as a personal computer, tablet computer, smartphone, or digital camera.

[0105] In the embodiments provided in this application, it should be understood that the disclosed methods, apparatuses, computer-readable storage media, and electronic devices can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple components or modules may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices, components, or modules may be electrical, mechanical, or other forms.

[0106] The components described as separate parts may or may not be physically separate. The components shown as components may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the components can be selected to achieve the purpose of this embodiment according to actual needs.

[0107] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each component can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0108] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: USB flash drive, portable hard drive, read-only memory (ROM). Various media that can store program code, such as only memory, random access memory (RAM), magnetic disks or optical disks.

[0109] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0110] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0111] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. An intelligent operation and maintenance early warning method, characterized in that, The method includes: When power-on startup is detected, the local operation and maintenance knowledge graph and the embedded standard service knowledge base are loaded from local storage to obtain a local cached version that runs in memory. Original operating condition data is obtained according to a preset sampling period; The original working condition data is preprocessed to obtain a single-moment instantaneous feature vector and a sliding window tensor composed of W consecutive sampling moments; the value of W ranges from 64 to 512. The sliding window tensor is input into a lightweight LSTM model, and the lightweight LSTM model outputs a temporal anomaly score; the sliding window tensor is input into a lightweight Transformer model, and the lightweight Transformer model outputs a global anomaly score. The standard clause deviation score and redundancy suppression term are obtained based on the instantaneous feature vector. The standard clause deviation score reflects the overall deviation between the current operating condition and each fault path and corresponding standard clause in the local operation and maintenance knowledge graph. The redundancy suppression term is used to suppress false alarms from a single source. The standard clause deviation score is obtained through the following steps: traversing the operation and maintenance knowledge graph to obtain the set of currently hit fault paths; through... Calculate the deviation score of the standard clause ;in, For the set of faulty paths, Configure weights for edges in the knowledge graph. For the map attributes and instantaneous feature vectors The matching degree function; the redundancy suppression term is obtained through the following steps: comparing the instantaneous feature vector with the operation and maintenance standard threshold in the embedded standard service knowledge base to determine whether a short-term threshold alarm is triggered; combining the time-series anomaly score and the global anomaly score to obtain the model judgment result; when the judgment result of the short-term threshold alarm is inconsistent with the model judgment result, the redundancy suppression term is set to a preset positive value; when the judgment result of the short-term threshold alarm is consistent with the model judgment result, the redundancy suppression term is set to 0; The comprehensive early warning score is determined based on the time-series anomaly score, the global anomaly score, the standard clause deviation score, and the redundancy suppression item. The warnings are tiered based on the comprehensive warning score.

2. The intelligent operation and maintenance early warning method according to claim 1, characterized in that, Before acquiring the original operating condition data according to the preset sampling period, the method further includes: Detect the status of the edge-cloud communication link; When the edge-cloud communication link is determined to be normal based on its status, the differential packets sent from the cloud are retrieved through edge-cloud collaborative synchronous proxy; the differential packets are then subjected to version verification and hash verification in sequence; after verification, the differential packets are hot-loaded using a double buffer mechanism and atomically switched to the updated running version; the differential packets include knowledge differential packets and model weight differential packets; When the edge-cloud communication link is determined to be abnormal based on the edge-cloud communication link status, the local cache version is used.

3. The intelligent operation and maintenance early warning method according to claim 1, characterized in that, The lightweight LSTM model includes two LSTM layers, one Dropout layer, and a fully connected output head. During the training phase, a one-step prediction reconstruction unsupervised loss combined with a binary cross-entropy supervised loss is used for joint training. During the inference phase, the temporal anomaly score is normalized to the [0,1] interval based on the reconstruction loss and the temporal threshold.

4. The intelligent operation and maintenance early warning method according to claim 1, characterized in that, The lightweight Transformer model includes an input projection layer, a position encoding layer, a Transformer encoder, a mean pooling layer, and a fully connected classification head; the Transformer encoder has 1 to 2 layers and 2 to 4 attention heads; during the training phase, weighted binary cross-entropy is used as the main loss, and normal sample comparison regularization constraint is superimposed.

5. The intelligent operation and maintenance early warning method according to claim 1, characterized in that, Before inputting the sliding window tensor into the lightweight Transformer model and outputting the global anomaly score through the lightweight Transformer model, the method further includes: Obtain the CPU utilization and available memory percentage of the embedded server; When the CPU utilization rate is less than the first preset threshold and the available memory ratio is greater than the second preset threshold, the sliding window length W remains unchanged. When the CPU utilization rate is greater than the first preset threshold or the available memory ratio is less than the second preset threshold, the sliding window length W is halved and the minimum value is not less than 64, the lightweight Transformer model is turned off, and the global anomaly score is set to 0.

6. An intelligent operation and maintenance early warning device, characterized in that, The device includes: The data acquisition module is used to load the local operation and maintenance knowledge graph and the embedded standard service knowledge base from local storage when power-on startup is detected, and obtain the local cached version running in memory; and to obtain the raw operating condition data according to the preset sampling period. The data preprocessing module is used to preprocess the original working condition data to obtain a single-moment instantaneous feature vector and a sliding window tensor composed of W consecutive sampling moments. The model computation module is used to input the sliding window tensor into a lightweight LSTM model and output a temporal anomaly score through the lightweight LSTM model; and to input the sliding window tensor into a lightweight Transformer model and output a global anomaly score through the lightweight Transformer model. The score calculation module is used to obtain the standard clause deviation score and redundancy suppression term based on the instantaneous feature vector; A comprehensive early warning score is determined based on the time-series anomaly score, the global anomaly score, the standard clause deviation score, and the redundancy suppression item. The standard clause deviation score is obtained through the following steps: traversing the operation and maintenance knowledge graph to obtain the currently hit set of fault paths; through... Calculate the deviation score of the standard clause ;in, For the set of faulty paths, Configure weights for edges in the knowledge graph. For the map attributes and instantaneous feature vectors The matching degree function; the redundancy suppression term is obtained through the following steps: comparing the instantaneous feature vector with the operation and maintenance standard threshold in the embedded standard service knowledge base to determine whether a short-term threshold alarm is triggered; combining the time-series anomaly score and the global anomaly score to obtain the model judgment result; when the judgment result of the short-term threshold alarm is inconsistent with the model judgment result, the redundancy suppression term is set to a preset positive value; when the judgment result of the short-term threshold alarm is consistent with the model judgment result, the redundancy suppression term is set to 0; The graded early warning module is used to issue graded early warnings based on the comprehensive early warning score.

7. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the intelligent operation and maintenance early warning method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the intelligent operation and maintenance early warning method according to any one of claims 1 to 5.

Images