Off-line simulation, boundary check and safe release method of oilfield station control strategy

Abstract

The application relates to the technical field of industrial automation and process control, and discloses an offline simulation, boundary check and safe release method of an oilfield station control strategy, which comprises the following steps: acquiring multi-source time sequence data to determine an abnormal reason; generating a candidate control strategy package containing a forward control sequence and a stage rollback control sequence; matching historical samples to generate a predicted trajectory, and constructing a forward prediction state set and a recovery state set; checking the boundary safety of the forward state set, and checking the recovery reachability of the stage rollback control sequence starting from the most unfavorable forward state; when the safe allowable control increment of a main execution object is smaller than a minimum effective input increment, determining a substitute execution object and rechecking; and according to the joint checking result, releasing control instructions in stages, and executing the rollback control sequence in an abnormal state. The application realizes bidirectional verification of forward execution and backward recovery before strategy release, avoids control instructions from falling into a mechanical dead zone, and improves the reliability of automatic control of an unattended station.

Description

Technical Field

[0001] This invention relates to the field of industrial automation and process control technology, specifically to a method for offline simulation, boundary verification, and secure release of control strategies for oilfield stations. Background Technology

[0002] With the advancement of digital transformation in oilfields, oilfield stations are gradually moving towards unmanned operation, which places extremely high demands on the operational reliability of automatic control systems for gathering and transportation pipelines and process equipment. Existing control strategy issuance methods typically rely on digital simulation to predict the evolution of controlled parameters before issuing commands, in order to determine whether control actions will violate the safety boundaries set by the process. However, this predictive verification is often limited to the forward control execution process, neglecting whether the system itself has the ability to smoothly retreat to a safe state if sudden disturbances or equipment failures occur after the control commands are issued. When an anomaly actually occurs, the control system often resorts to rough operations such as emergency stops due to the lack of pre-verified recovery paths, which can easily cause water hammer in the pipeline fluid or trigger shutdowns of related equipment.

[0003] Meanwhile, actuators such as control valves and frequency converters in oilfields are generally subject to static friction and dead zones due to mechanical wear and aging. Small adjustment increments issued by conventional control algorithms are easily consumed by these mechanical dead zones and cannot be converted into effective physical actions. When encountering such invalid command conditions, existing systems typically cannot automatically redistribute control actions to other available equipment by combining process topology and safety margins. Furthermore, in the dynamic monitoring of command execution, existing technologies largely rely on comparing the error between actual curves and a single predicted trajectory, making it difficult to accurately distinguish whether parameter deviations stem from actuator inaction, upstream process disturbances, or mismatches in the simulation model itself. This single-perspective approach easily leads to false alarms and erroneous system rollbacks. Moreover, abnormal data collected is often automatically fed back to update the control model without compliance review, resulting in parameter contamination of the core predictive model and severely restricting the safety of automated control in unattended stations.

[0004] Therefore, this invention proposes an offline simulation, boundary verification, and security release method for oilfield station control strategies to address the shortcomings of existing technologies. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides an offline simulation, boundary verification, and secure release method for oilfield station control strategies. This method solves the problems of existing oilfield station control strategies lacking security verification of anomaly recovery paths before release, and being unable to adaptively cope with dead zones of actuators and accurately distinguish the sources of deviations during execution.

[0006] To achieve the above objectives, this invention provides the following technical solution: an offline simulation, boundary verification, and security release method for oilfield station control strategies, comprising: Acquire multi-source time-series data from oilfield stations and determine the causes of abnormal events based on the directed graph of station process topology; Based on the determined cause and the current operating condition, a candidate control strategy package is generated. The candidate control strategy package includes the main execution object, the controlled parameter, the phased forward control sequence, and the corresponding phased backoff control sequence. Based on the current operating conditions, historical steady-state response samples are matched, and a forward prediction state set and a recovery state set are generated based on the matched historical steady-state response samples. Calculate the remaining safety margin of the safety verification parameters relative to the fixed safety boundary, verify whether the forward prediction state set satisfies the fixed safety boundary, and take the most unfavorable forward state in the forward prediction state set as the starting point to verify whether the recovery state set is entered after executing the stage rollback control sequence, and obtain the joint verification result. When the security allowable control increment of the main execution object is less than the minimum effective input increment, an alternative execution object is determined, and a forward prediction state set and a recovery state set are regenerated for the alternative execution object and the verification is re-executed. Based on the joint verification result, a release gating result is generated. Control instructions are issued in stages according to the release gating result. When an abnormal termination condition is triggered, the forward control instructions that have not yet been executed are stopped and the stage rollback control sequence is executed.

[0007] Preferably, determining the cause of anomalies based on a directed graph of the station's process topology includes: Candidate associated nodes in the direction of anomaly propagation are determined based on the directed graph of the station's process topology; The basic propagation delay is determined based on the effective process volume of the connected process path between the candidate associated node and the measurement point node that triggered the abnormal event, and the average volumetric flow rate of the connected process path. Extract the effective change time and direction of parameter change of the candidate associated nodes; When the effective change time of the parameter is earlier than the trigger time of the abnormal event, and the difference between the effective change time of the parameter and the trigger time of the abnormal event and the difference between the basic propagation delay does not exceed the allowable deviation of the propagation delay, and the direction of the parameter change conforms to the process relationship or control action relationship, the corresponding candidate associated node is marked as the determined cause, and a process deviation cause evidence chain is generated.

[0008] Preferably, generating a forward prediction state set and a recovery state set based on matched historical steady-state response samples includes: Based on the effective process volume of the connected process path and the volumetric flow rate of the in-situ mixture under the current operating conditions, the historical propagation delay of the historical steady-state response samples is corrected to obtain the estimated propagation delay. Using the candidate control strategy package generation time as the prediction start time, and based on the response feature alignment time and the estimated propagation delay, generate a no-new control reference trajectory, a forward control prediction trajectory, a stage backoff prediction trajectory, and a trajectory associated with process disturbance conditions. Based on the prediction deviation, the upper envelope and lower envelope of the prediction interval of the forward control prediction trajectory at each prediction time are determined to construct the forward prediction state set, and the envelopes of the stage backtracking prediction trajectories generated at different starting states are used together to form the recovery state set.

[0009] Preferably, calculating the remaining safety margin of the safety verification parameters relative to the fixed safety boundary includes: The remaining safety margin is calculated based on the upper and lower envelopes of the prediction interval at the prediction time, and the fixed upper and lower safety boundaries determined according to the design boundary and the safety interlock action boundary. The formula for calculating the remaining safety margin is as follows: ; In the formula, This is the sequence number of the security verification parameter; For the predicted time; For the first Each security verification parameter at the prediction time The remaining safety margin; To establish a fixed upper safety boundary; To fix the lower safety boundary; For the first Each security verification parameter at the prediction time The upper envelope of the prediction interval; For the first Each security verification parameter at the prediction time The lower envelope of the prediction interval.

[0010] Preferably, starting with the most unfavorable forward state in the forward prediction state set, verifying whether the stage rollback control sequence has been executed has entered the recovery state set includes: Extract a complete state vector from the forward-predicted state set, which is formed by samples of the same prediction time and the same historical steady-state response. Select the state vector where the remaining safety margin reaches its minimum value and the effective boundary state vector to form the most unfavorable forward state set; Examine the stage backoff prediction trajectory generated from the set of most unfavorable forward states; When the predicted backtracking trajectory does not reach the fixed safety boundary, the remaining safety margin of each safety verification parameter is not lower than the warning threshold, and the backtracking end state enters the backtracking target state or the safety maintenance state, the recovery feasibility verification is deemed to have passed.

[0011] Preferably, determining the alternative execution object includes: Calculate the difference between the minimum remaining safety margin of the safety verification parameter and the remaining safety margin warning threshold, and divide the difference by the absolute value of the control gain to obtain the limit control increment; The minimum value among the limited control increment of all safety verification parameters, the remaining adjustment range of the main execution object, the maximum adjustment range of a single stage, and the original control increment of the current execution stage is taken as the safety allowable control increment; When the safety allowable control increment is less than the minimum effective input increment, candidate execution objects that affect the same controlled parameter are extracted according to the station process topology directed graph.

[0012] Preferably, determining the alternative execution object further includes: Candidates for execution are filtered out from the candidate execution objects if the control direction is inconsistent with the target adjustment direction of the controlled parameter, the remote control status is abnormal, the permissions are insufficient, there are safety interlock conflicts, the remaining adjustment range is insufficient, or the recovery feasibility verification is not passed. For the candidate execution objects that pass the screening, they are sorted in order of increasing proportion of remaining safety margin, increasing rollback time, and increasing control response time; The candidate execution object that ranks first in the sorting is determined as the alternative execution object.

[0013] Preferably, generating a release gating result based on the joint verification result includes: When the joint verification result satisfies the following conditions: both the forward security verification and the recovery feasibility verification pass, the remaining security margin is higher than the warning threshold, the data trust status and permission status are passed, and the risk level is low, a release gating result that allows release is generated. When the forward prediction state set reaches a fixed security boundary, there is a security interlocking conflict, the recovery feasibility verification fails, or there is no alternative execution object, a release gating result that blocks the release is generated. When the original control increment fails the security check, and passes the joint check after reducing the control increment, extending the observation time, or reducing the number of execution stages, a degraded release gating result is generated.

[0014] Preferably, control commands are issued in stages according to the gating results, and when an abnormal termination condition is triggered, the forward control commands that have not yet been executed are stopped and the stage rollback control sequence is executed, including: After a control command is issued, the actual feedback response, including the controlled parameters, the execution object feedback parameters, and the safety verification parameters, is collected. The actual feedback response is compared with the no-new-control-reference-trajectory, the forward-control-predicted-trajectory, and the associated-process-disturbance-condition-trajectory, and the multivariate root mean square error is calculated to determine the control execution status. When the actual feedback response continuously deviates from the dynamic prediction tolerance range corresponding to the forward control prediction trajectory, or when the safety interlocking condition is met, the abnormal termination condition is determined to be triggered.

[0015] Preferably, after the abnormal termination condition is triggered, the method further includes: The predicted trajectory mismatch samples that cause the abnormal termination condition to be triggered, as well as the candidate minimum effective input increment observation values ​​extracted from the observations, are written into the candidate update area. In the offline playback simulation environment, the multi-source time-series data, candidate control strategy packages, and data in the candidate update area when the abnormal event occurs are loaded, and consistency verification is performed. When simulation and verification are re-executed using data from the candidate update region, and the forward prediction state set does not reach the fixed safety boundary and the stage rollback control sequence can enter the rollback target state or the safety maintenance state, the consistency verification is determined to be successful. The verified data will be written as the new version into the historical steady-state response sample library or the device characteristic parameter library, while the original historical version will be retained.

[0016] This invention provides an offline simulation, boundary verification, and secure deployment method for oilfield station control strategies. It offers the following advantages: 1. This invention ensures that the automatic control process always has a verified safe exit path by simultaneously planning the forward control sequence and the stage backoff control sequence when generating the control strategy, and jointly verifying the boundary compliance of the forward predicted state set and the backoff reachability under the most unfavorable forward state before issuing the command. Furthermore, when the main execution object is restricted, a replacement object reallocation based on the safety-permitted control increment is triggered, preventing control commands from getting stuck in the equipment action dead zone. The overall solution closely coordinates strategy planning, bidirectional simulation verification, fault-tolerant allocation, and abnormal controlled backoff, improving the operational reliability of complex process pipeline networks in unattended environments.

[0017] 2. This invention employs a multi-reference trajectory comparison mechanism in the control command execution monitoring stage. By constructing a comparison logic between the root mean square error of the actual feedback response and various reference predicted trajectories, such as those without new control, forward control, and associated process disturbances, the system can utilize the error distribution characteristics between trajectories to distinguish whether the current process deviation originates from the actuator's failure to generate effective action, the natural control response, or external feedforward disturbances. This judgment method based on the comparison of actual curves and predicted envelopes overcomes the limitations of conventional systems that rely solely on a single static threshold for alarms, and reduces the misjudgment rate caused by cross-interference under complex operating conditions.

[0018] 3. This invention establishes a controlled update mechanism based on offline playback for the evolution of control rules. For trajectory mismatch samples that lead to control termination and equipment dead zone parameters extracted from new observations, the system does not directly overwrite the underlying configuration. Instead, it isolates them to a candidate update area and re-enacts historical operating conditions in the offline playback simulation environment to perform consistency checks. Version updates are only allowed when it is verified that the new parameters do not exceed the original fixed safety boundaries and do not disrupt the verified fallback path. This mechanism prevents abnormal fluctuations or erroneous data from contaminating the core control model, ensuring the safety and compliance of adaptive updates. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the system architecture according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the method flow according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the logical flow of multi-source time-series data processing and anomaly cause tracing and classification according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the logical flow of bidirectional control strategy generation and multi-class predicted trajectory simulation in an embodiment of the present invention; Figure 5 This is a schematic diagram of the logical flow of multi-level boundary joint verification and control object reallocation in an embodiment of the present invention; Figure 6 This is a schematic diagram of the logic flow for phased execution monitoring and pre-verification rollback in an embodiment of the present invention; Figure 7 This is a schematic diagram illustrating the logical flow of offline playback consistency verification and data versioning update in an embodiment of the present invention. Detailed Implementation

[0020] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Reference Figure 1 This invention provides an offline simulation, boundary verification, and security release system for oilfield station control strategies, comprising a data access layer, a simulation gating layer, a release execution layer, and a sample and parameter update layer.

[0022] The data access layer includes a protocol communication module and a data preprocessing module. The protocol communication module is used to acquire continuous production parameters, discrete equipment data, and safety status data from SCADA (Supervisory Control and Data Acquisition), DCS (Distributed Control System), RTU (Remote Terminal Unit), PLC (Programmable Logic Controller), and safety interlocking systems. The data preprocessing module is used to filter, deduplicate, filter quality codes, align the time axis, and standardize the format of the acquired data to generate a standardized time-series dataset.

[0023] The simulation gating layer comprises a strategy generation module, a trajectory simulation module, and a safety verification module. The strategy generation module generates a chain of evidence for process deviations based on standardized time-series data and a directed graph of the station's process topology. It then generates a candidate control strategy package containing forward control sequences and phased backoff control sequences based on the identified causes and the current operating conditions. The trajectory simulation module generates a baseline trajectory without new control parameters, a forward control prediction trajectory, a phased backoff prediction trajectory, and a trajectory related to process disturbance conditions, based on historical steady-state response samples and the current operating conditions. It also constructs a forward prediction state set and a recovery state set. The safety verification module calculates the remaining safety margin of the safety verification parameters, performs multi-level boundary checks on the candidate control strategies, and reallocates the control object when the main execution object does not meet the effective control conditions. It outputs the release gating state vector and the release gating result.

[0024] The release execution layer includes an instruction issuance module, a status monitoring module, and a rollback execution module. The instruction issuance module, based on the release gating results, converts control sequences that are allowed to be released or downgraded into control instructions that the field controllers can recognize. The status monitoring module compares the actual feedback response with the baseline trajectory without new control, the forward control prediction trajectory, and the trajectory of associated process disturbance conditions to determine the control execution status and the source of deviation. The rollback execution module stops subsequent forward control and executes a verified stage rollback control sequence when abnormal termination conditions, safety interlock conditions, or equipment execution abnormalities are triggered.

[0025] The sample and parameter update layer includes an anomaly data storage module and an offline replay verification module. The anomaly data storage module is used to temporarily store predicted trajectory mismatch samples and candidate minimum effective input increment observations; the offline replay verification module is used to verify the consistency between candidate updated data and historical operating conditions, fixed safety boundaries, and stage rollback conditions in an offline replay simulation environment, and writes the verified data as the new version into the historical steady-state response sample library or the equipment characteristic parameter library.

[0026] Reference Figure 2 This invention provides an offline simulation, boundary verification, and secure release method for oilfield station control strategies, comprising the following steps: S100 acquires multi-source time-series data from oilfield stations, filters, deduplicates, filters quality codes, aligns time axes, and standardizes the multi-source time-series data, and extracts historical steady-state operating condition samples; for abnormal events, it traces the associated causes along the directed graph of the station's process topology and classifies candidate abnormal causes into known causes, ruled-out causes, and unmonitorable causes. S200 generates a candidate control strategy package containing forward control sequence and stage backoff control sequence based on the determined cause and current operating conditions; matches historical steady-state response samples located in the corresponding applicable domain, and after response feature alignment and propagation delay correction, generates a no-new control reference trajectory, forward control prediction trajectory, stage backoff prediction trajectory and associated process disturbance condition trajectory, and constructs a forward prediction state set and a recovery state set. S300 calculates the remaining safety margin of the safety verification parameters relative to the fixed safety boundary, and performs multi-level boundary verification on the forward predicted state set and the recovery state set; when the safety allowable control increment of the main execution object is less than its minimum effective input increment, the control object is reallocated according to control performance, equipment status, remaining safety margin, and recovery feasibility, and offline simulation and safety verification are re-executed; based on the verification results, the gating state vector and gating results are generated and published. S400 issues control commands in stages based on the gating results and collects actual feedback responses; compares the actual feedback responses with multiple types of baseline predicted trajectories, and determines the source of deviation by combining the feedback from the executing object, propagation delay, and remaining safety margin of safety verification parameters; when abnormal termination conditions, fixed safety boundary conditions, or safety interlock conditions are met, it stops subsequent forward control and executes the stage rollback control sequence. The S500 writes the predicted trajectory mismatch samples and candidate minimum effective input increment observations into the candidate update area, performs historical operating condition playback and consistency verification in the offline playback simulation environment, and writes the verified data as a new version into the historical steady-state response sample library or equipment characteristic parameter library, and records the entire process information of strategy generation, simulation verification, release execution, abnormal rollback and data update.

[0027] To further illustrate the implementation process of the above system and method, the following detailed explanation is provided in conjunction with each functional module and steps S100 to S500.

[0028] Reference Figure 3 For step S100, the following sub-steps are performed sequentially: multi-source time-series data acquisition and time axis alignment, steady-state condition sample extraction, determination of the scope of anomaly investigation, and classification of anomaly causes: S101 performs multi-source time-series data acquisition and time axis alignment processing.

[0029] The protocol communication module acquires multi-source timing data from SCADA, DCS, RTU, PLC, and safety interlocking systems through industrial communication protocols.

[0030] Multi-source time-series data includes continuous production parameters, discrete equipment data, and safety status data. Continuous production parameters include pipeline temperature, manifold pressure, fluid flow rate, and storage tank level; discrete equipment data includes oil pump operating status, inverter output frequency, regulating valve control output, and valve position feedback; safety status data includes alarm status, safety interlock status, manual locking status, and process switching status.

[0031] Each time series data entry must include at least the location identifier, sampled value, source system sampling time, data reception time, data quality code, and data source identifier.

[0032] The protocol communication module uses OPC (Open Platform Communications) or other industrial communication protocols supported by the field control system to read data. Data quality codes include GOOD (Good Quality, data quality valid), BAD (Bad Quality, data quality invalid), and UNCERTAIN (Uncertain Quality, data quality uncertain).

[0033] The data preprocessing module filters and deduplicates multi-source time-series data based on data quality codes, data sources, and sampling times. Data with a BAD quality code, incomplete data fields, or a data refresh interval exceeding three times the rated sampling period for the corresponding point are marked as invalid data. Data with an UNCERTAIN quality code retains its quality status identifier, but its sampled values ​​are not used for time axis alignment, and the corresponding alignment value is marked as missing.

[0034] Critical data refers to data that is included in the steady-state determination parameter table, the evidence chain for process deviation causes, the safety verification parameter set, or the execution feedback point set. Time-series data not included in the above sets are considered non-critical data. Control strategies must not be automatically issued based on missing critical data.

[0035] When there are multiple valid data sources for the same parameter, the data preprocessing module selects the data source according to the primary and backup order recorded in the point data source configuration table; when the data sources have the same priority, the data with the newest sampling time of the source system is selected; when the sampling time of the source systems is the same, the data with the newest data reception time is selected.

[0036] The data preprocessing module establishes a unified time axis, and the sampling period of the unified time axis is the minimum value among the rated sampling periods of the key points.

[0037] For the Data from discrete devices is time-aligned using a zero-order hold method. The zero-order hold duration must not exceed three times the rated sampling period of the discrete device data; if it does, the corresponding alignment value is marked as missing. Let the first... Data from discrete devices at the effective sampling time The sample value is Then the alignment time satisfy When, the alignment value is In the formula, For discrete device data sequence numbers; This refers to the valid sampling sequence number during the time axis alignment process; and These are adjacent valid sampling times; For the first Data from discrete devices at the sampling time The sampled values; For the first Data from discrete devices at the alignment time Alignment value.

[0038] For the For each continuous production parameter, time alignment is performed using linear interpolation. Linear interpolation is only performed when the time interval between adjacent valid sampling moments does not exceed three times the rated sampling period of the continuous production parameter; otherwise, the corresponding time period is marked as missing data.

[0039] Let the first A continuous production parameter at adjacent valid sampling times and The sampled values ​​are respectively and ,and Then the alignment time The parameter value is: ; In the formula, This refers to the sequence number of continuous production parameters; and The first A continuous production parameter at the sampling time and The sampled values; For the first A series of production parameters at the alignment time Alignment value.

[0040] The data preprocessing module arranges continuous production parameters, discrete equipment data, and safety status data according to a unified timestamp to generate a standardized time-series dataset. The standardized time-series dataset includes a unified timestamp, alignment values ​​for each data point, data quality codes, and data source identifiers.

[0041] S102, extract steady-state condition samples and perform joint determination of continuous parameters and discrete states.

[0042] Within the steady-state determination time window, the data preprocessing module performs joint judgment on continuous production parameters, discrete equipment data, and safety status data in the standardized time series dataset.

[0043] The steady-state determination time window is determined based on the control response time, fluid propagation delay, and on-site commissioning records of the corresponding process flow, with an initial length of 5 to 15 minutes. Different steady-state determination time windows are set for different process flows.

[0044] For the For each continuous production parameter, the sample variance within the steady-state determination time window is calculated using the following formula: ; when When the coefficient of variation is: ; In the formula, The sampling sequence number within the steady-state determination time window; For the first The number of valid sampling points for each continuous production parameter within the steady-state determination time window, and ; For the first The continuous production parameter at the ... The sampled values ​​at each sampling time; For the first The arithmetic mean of a series of continuous production parameters within the steady-state determination time window; This represents the sample variance. The standard deviation is the sample standard deviation. The coefficient of variation.

[0045] For the first The minimum effective absolute value of the continuous production parameter is taken as the larger of the corresponding sensor resolution and the minimum effective value of the parameter under normal operation. Its physical dimensions are the same as those of the first parameter. All continuous production parameters are the same.

[0046] when At that time, the first When the sample variance of a continuous production parameter is not greater than the corresponding steady-state variance threshold, and the coefficient of variation is not greater than the corresponding steady-state coefficient of variation threshold, the continuous production parameter is considered to be in a steady state; when When the coefficient of variation is not calculated, the sample variance is not greater than the corresponding steady-state variance threshold, which can be used to determine that the continuous production parameter is in a stable state.

[0047] The steady-state thresholds for variance and coefficient of variation are taken as the 95th percentile of the corresponding statistical distributions within a confirmed historical steady-state operating time window. When there are fewer than 20 valid historical steady-state operating time windows, the initial thresholds are determined using commissioning data, trial operation data, or confirmed initial operating data from similar equipment.

[0048] For the For discrete equipment data, the number of state transitions and the duration of continuous state maintenance within the steady-state determination time window are statistically analyzed. If the number of state transitions does not exceed the allowable number of transitions specified in the equipment operating procedures, and the duration of continuous state maintenance is not less than the minimum stabilization time of the corresponding equipment or process flow, the discrete equipment data is determined to be in a stable state.

[0049] Key continuous production parameters and key discrete equipment data are determined by the station steady-state judgment parameter table. When all key continuous production parameters meet their respective applicable steady-state judgment conditions, all key discrete equipment data meet the stability conditions, and there are no shutdown-level or emergency-level alarms, safety interlock actions, manual forced operations, or key data quality anomalies, the data within the corresponding time window is marked as a historical steady-state operating condition sample, and the steady-state state is recorded as passed.

[0050] Historical steady-state operating condition samples are correlated with subsequent effective control actions, feedback from the executing object, and corresponding parameter response curves to form historical steady-state response samples.

[0051] If any steady-state condition is not met, the data preprocessing module generates a steady-state condition not met flag, records the steady-state state as restricted, and records the trigger time, parameter flag, actual statistical value, corresponding threshold, equipment status, and data quality status. Data within the corresponding time window is not used as historical steady-state condition samples, nor is it used to construct historical steady-state response samples.

[0052] The steady-state state is a restricted and non-terminating anomaly cause analysis, but it does not allow the direct generation of published results.

[0053] S103, determine the scope of investigation for abnormal causes based on the directed graph of the station's process topology.

[0054] The data preprocessing module determines whether the real-time continuous production parameters exceed the fixed safety boundary or historical boundary based on the standardized time-series dataset, and determines whether there is an alarm state, a change in the safety interlock state, or an abnormal equipment state.

[0055] Abnormal equipment status refers to the equipment's operating status not falling within the permitted state of the current process flow as specified in the equipment's operating procedures.

[0056] When any abnormal trigger condition is met, the data preprocessing module generates an out-of-limit deviation event. An out-of-limit deviation event includes at least an event identifier, a triggering measurement point identifier, an event trigger time, an actual parameter value, a corresponding boundary value, an equipment status, and a data quality status.

[0057] The strategy generation module reads the directed graph of the station's process topology. The directed graph of the station's process topology consists of nodes and directed edges; nodes represent station equipment, process units, sensors, or objects to be executed, and directed edges represent the material conveying direction or control relationships.

[0058] Each directed edge includes at least a starting node, an ending node, a connection status, a medium type, an effective process volume of the pipe segment, and the status of the corresponding equipment or valve. The effective process volume of the pipe segment is the sum of the effective volumes of the pipe segments connected between the starting and ending nodes and the internal volumes of intermediate process equipment; closed or isolated branches are not included.

[0059] The strategy generation module uses the measurement point node that triggers the over-limit deviation event as the starting point for tracking, and searches for related equipment and measurement points along the material inflow direction, material outflow direction, and control action direction.

[0060] Process paths that are shut down, isolated, under maintenance, or experiencing communication failures are not considered valid propagation paths, but the status of the corresponding path is retained as a basis for classifying abnormal causes.

[0061] The strategy generation module determines candidate associated nodes, anomaly propagation directions, and time series data extraction ranges based on the station's process topology directed graph, forming a set of candidate anomaly causes.

[0062] S104, perform a comparison of the propagation timing and process relationship and generate anomaly cause classification results.

[0063] For each candidate associated node in the candidate anomaly cause set, the strategy generation module extracts the parameter values, data quality codes, equipment status, control commands, execution feedback, alarm status, safety interlock status, and manual operation records before the triggering of the out-of-limit deviation event.

[0064] For a process path where candidate associated node a and out-of-range deviation event node b are connected, the basic propagation delay is: ; In the formula, Candidate related nodes To the over-limit deviation event node Basic propagation delay; Candidate related nodes To the over-limit deviation event node The effective process volume of the currently connected process paths; To analyze the average volumetric flow rate of this connected process path within the time window.

[0065] The effective process volume and average volumetric flow rate use the same pressure, temperature and flow rate references, and the basic propagation delay is uniformly converted to the same time unit as the timestamp of the standardized time series dataset.

[0066] When the average volumetric flow rate is lower than the effective measurement limit of the corresponding flow measurement point, or when the process path is closed, isolated, or has inconsistent flow direction, the corresponding path will be marked as a state where the propagation delay cannot be calculated.

[0067] When the parameters of a candidate associated node exceed the historical steady-state fluctuation range for at least two consecutive sampling times, the sampling time at which the parameters first exceed the historical steady-state fluctuation range is determined as the effective change time of the parameters.

[0068] The historical steady-state fluctuation range is taken from the 2.5th percentile to the 97.5th percentile of the corresponding continuous production parameter sampling values ​​under the same process flow and similar operating conditions; when there are fewer than 20 valid historical steady-state operating condition samples, the minimum to maximum values ​​of the valid samples are taken. Similar operating conditions refer to the same combination of operating equipment and media flow direction, and the flow rate, pressure, and temperature are within the same preset operating condition range.

[0069] When there are no fewer than 20 confirmed propagation records under the same process path and similar operating conditions, the allowable deviation of propagation delay is taken as the 95th percentile of the absolute value distribution of the difference between the actual propagation delay and the basic propagation delay; when there are fewer than 20 propagation records, the allowable deviation of propagation delay is taken as the larger value between the two unified sampling periods and 20% of the basic propagation delay.

[0070] If the effective change of the candidate associated node parameter precedes the out-of-limit deviation event, the difference between the two time differences and the difference between the basic propagation delay does not exceed the allowable deviation of the propagation delay, and the direction of parameter change conforms to the material balance relationship, pressure transmission relationship, temperature transmission relationship, or control action relationship, the corresponding candidate abnormal cause will be marked as a confirmed cause.

[0071] If the candidate associated node data is continuous and valid, but no valid changes have occurred that exceed the historical steady-state fluctuation range, or if the time and direction of the change are inconsistent with the process relationship, the corresponding candidate abnormal cause will be marked as an excluded cause.

[0072] If a candidate associated node experiences a communication interruption, a BAD data quality code, missing key sampling data, or the execution object lacks the feedback points required for cause determination, the corresponding candidate abnormal cause will be marked as an unmonitorable cause.

[0073] The same candidate abnormal cause corresponds to only one classification result. When it meets both the undetectable cause and other classification conditions, it is preferentially marked as an undetectable cause.

[0074] The strategy generation module generates a chain of evidence for the causes of process deviations based on the cause classification results. This chain of evidence includes at least the event identifier, candidate related nodes, cause classification results, effective parameter change time, basic propagation delay, allowable propagation delay deviation, parameter change direction, parameter change magnitude, equipment status, control commands, execution feedback, safety interlock status, manual operation records, and data quality status.

[0075] Reference Figure 4 For step S200, the following sub-steps are executed sequentially: candidate control strategy package generation, historical steady-state response sample matching, propagation delay correction, and construction of multi-class benchmark predicted trajectories: S201, Generate a candidate control policy package containing forward control sequences and phase backoff control sequences.

[0076] The strategy generation module receives the evidence chain of process deviation causes, standardized time series dataset, steady state, equipment status, and safety interlock status.

[0077] If no definite cause exists, no executable candidate control policy package is generated; only an exception message and a record of the reason why it cannot be monitored are generated.

[0078] When a definite cause exists, the strategy generation module determines the primary execution target and alternative execution targets based on the definite cause, the current value of the controlled parameter, and the target range. The controlled parameter is a continuous production parameter that the candidate control strategy intends to adjust to the target value or target range.

[0079] When there are multiple known causes, known causes that are in the same process path, correspond to the same controlled parameter, and have the same control direction are merged to generate a candidate control strategy package; known causes with inconsistent control directions generate candidate control strategy packages separately, and the generated candidate control strategy packages must not be released at the same time.

[0080] The primary and alternative execution objects should meet the following requirements: valid remote control permissions, normal equipment operation status, remaining adjustment range meets control direction requirements, and there are no safety interlock conflicts.

[0081] The candidate control strategy package should include at least the strategy identifier, triggering event, determination of cause, main execution object, alternative execution object, controlled parameter, current value of controlled parameter, target value or target range of controlled parameter, control parameters of execution object, current set value of execution object, set of safety verification parameters, strategy validity period, risk level, safety constraints, interlocking inspection conditions, manual confirmation requirements, and evidence chain index of process deviation cause.

[0082] The validity period of a strategy is defined as a steady-state determination time window for the corresponding process flow. Within the validity period, if the process flow status, operating equipment combination, equipment operating status, safety interlock status, control authority, or the applicable domain of historical steady-state response samples changes, the candidate control strategy package becomes invalid.

[0083] The initial risk level of the candidate control strategy package is determined based on the risk level of the corresponding control action in the equipment operating procedures. If step S300 determines that an alternative execution object should be used, or if any multi-level boundary check status is restricted, the safety check module updates the risk level to high risk.

[0084] The strategy generation module divides the control process into multiple execution phases. This refers to the execution phase number. Each execution phase includes the execution object, control direction, control increment, target setpoint of the execution object, maximum adjustment range per phase, minimum observation time, expected response time, expected response range, execution feedback point, abnormal termination condition, minimum abnormal duration, rollback target state, rollback verification time, phase stop condition, and next phase entry condition.

[0085] Each execution stage constitutes a forward control sequence in the order of execution. The control increment for a single stage is determined based on the deviation of the controlled parameter, the remaining adjustment range of the executed object, the maximum single adjustment amount specified in the equipment operating procedures, and the current safety constraints, and takes the minimum value allowed by the above constraints.

[0086] Generate the first When the forward control parameters for each execution phase are checked, a corresponding phase backoff control sequence is generated synchronously. For control parameters that can be continuously adjusted in reverse, the phase backoff control sequence adjusts the control parameter to the [number missing]th [phase missing]. The settings or preset security settings are set before the start of each execution phase.

[0087] For equipment that is not suitable for immediate reverse operation due to limitations such as minimum operating time, frequent start-stop protection, thermal inertia, or fluid inertia, the phased rollback control sequence will adjust the corresponding equipment to a safe holding state. The safe holding state is determined based on the equipment performance curves, process design documents, and equipment operating procedures.

[0088] S202, Match historical steady-state response samples and determine the alignment time of response features.

[0089] The trajectory simulation module extracts current operating condition features from candidate control strategy packages and standardized time-series datasets. These features include process flow status, main execution object type, operating equipment combination, control direction, proposed control increment, flow rate, pressure, temperature, moisture content, in-situ gas-liquid volume ratio, and equipment performance status.

[0090] The trajectory simulation module first filters historical steady-state response samples according to the process flow status, main execution object type, operating equipment combination and control direction, and then determines whether the current operating condition characteristics are within the applicable domain of each historical steady-state response sample.

[0091] For historical steady-state response samples determined by the applicable domain, the continuous operating condition characteristics are dimensionless according to the upper and lower limits of the corresponding applicable domain, and the weighted Euclidean feature distance between the current operating condition and the historical steady-state response samples is calculated.

[0092] When the upper limit of the applicable domain of a certain continuous operating condition feature is equal to the lower limit, the difference between the current operating condition feature value and the fixed value shall not exceed the corresponding sensor resolution, and the continuous operating condition feature shall not participate in the feature distance calculation.

[0093] The characteristic distance threshold is taken as the 95th percentile of the characteristic distance distribution among similar historical steady-state response samples; when there are fewer than 20 valid historical steady-state response samples, the initial characteristic distance threshold is determined using debugging data or trial operation data of similar equipment.

[0094] If there is no matching sample that meets both the requirements of applicable domain and feature distance, the matching status of the sample's applicable domain is recorded as "not passed," and the historical response curve is not used to extrapolate the current working condition.

[0095] For matched samples, the trajectory simulation module extracts historical response curves before and after the control action and uses a second-order local polynomial smoothing method to reduce the impact of measurement noise. The smoothing window is selected from 5, 7, 9, 11, 13, and 15 consecutive sampling points, taking the maximum number of sampling points whose coverage time does not exceed one-third of the expected response time in the candidate control strategy package; if there are no sampling points that meet the conditions, smoothing is not performed, and the rate of change is directly calculated based on the original historical response curve.

[0096] The trajectory simulation module calculates the rate of change of the historical response curve between adjacent sampling times. The rate of change threshold is set to four times the standard deviation of the rate of change of the corresponding parameter under the historical steady-state conditions without any new control.

[0097] After a control action occurs, if the absolute value of the rate of change of the historical response curve exceeds the rate of change threshold for at least two consecutive sampling times, the sampling time at which the rate of change threshold is first exceeded is determined as the response characteristic time.

[0098] When the feedback from the execution object is valid, the moment when the first valid change in the feedback from the execution object occurs is taken as the response feature alignment moment; when the feedback from the execution object is unavailable, the moment when the earliest valid change occurs among the controlled parameter and the upstream and downstream related parameters is taken as the response feature alignment moment.

[0099] S203, calculate the estimated propagation delay under the current operating conditions.

[0100] The trajectory simulation module reads the effective process volume, liquid volumetric flow rate, water content, standard state gas flow rate, absolute pressure, thermodynamic temperature, and gas compressibility factor data corresponding to the current operating conditions and matched samples.

[0101] The pressure and temperature under standard conditions are based on the standard conditions configured by the station's metering system. The same standard conditions are used for historical operating conditions and current operating conditions.

[0102] The gas compressibility factor data table is established based on the analyzed natural gas composition. The trajectory simulation module uses bilinear interpolation to read the gas compressibility factor based on absolute pressure and thermodynamic temperature. If the absolute pressure or thermodynamic temperature exceeds the range of the gas compressibility factor data table, the propagation delay calculation status is recorded as failing.

[0103] The trajectory simulation module converts the standard state gas flow rate into the in-situ gas phase volumetric flow rate, and divides the liquid phase volumetric flow rate into oil phase volumetric flow rate and water phase volumetric flow rate according to the water content. The sum of the oil phase volumetric flow rate, water phase volumetric flow rate, and in-situ gas phase volumetric flow rate is the in-situ mixture volumetric flow rate.

[0104] For the For each matched sample, the propagation delay under the current operating condition is: ; In the formula, To match the sample sequence number; According to the first The current operating condition propagation delay is calculated for each matched sample; For the first Historical propagation delay of each matched sample record; and These are the effective process volumes of the connected process paths between the associated nodes and the nodes where the controlled parameters are located under the current and historical operating conditions, respectively. and These are the average in-situ volumetric flow rates of the mixture under current and historical operating conditions, respectively.

[0105] When multiple matching samples exist, the median of the propagation delays corresponding to each matching sample is taken as the estimated propagation delay for the current operating condition.

[0106] If the current in-situ mixture volumetric flow rate is lower than the effective measurement lower limit of the corresponding flow measurement point, or if the process path between the associated node and the node where the controlled parameter is located is closed, isolated, or has inconsistent flow direction, the propagation delay calculation status will be recorded as failing; otherwise, the propagation delay calculation status will be recorded as passing.

[0107] If the propagation delay calculation state is "not passed", no forward prediction state set and recovery state set that can be used for automatic publishing will be constructed.

[0108] S204 generates multiple types of baseline prediction trajectories and constructs a forward prediction state set and a recovery state set.

[0109] The trajectory simulation module uses the generation time of the candidate control strategy package as the prediction start time, aligns the time according to the response characteristics of the matched samples and estimates the propagation delay based on the current operating conditions, performs time and position correction on the historical response curve, and adjusts the starting value of the historical response curve to the current state value.

[0110] For the During each execution phase, the trajectory simulation module generates a new control reference trajectory, a forward control prediction trajectory, a phase backoff prediction trajectory, and a trajectory related to process disturbance conditions.

[0111] No new control baseline trajectory indicates parameter changes when the control setpoint of the executed object remains unchanged. If the parameters are in a stable state within the observation time window before the prediction start time, the corresponding trajectory is generated based on the current parameter values; if the parameters show a continuous changing trend, the corresponding trajectory is generated based on the changing trend within the observation time window.

[0112] The forward control prediction trajectory is generated based on the historical control increments and corresponding response increments in the matching samples. The historical response increment is adjusted according to the ratio of the current control increment to the historical control increment only when the current control direction is consistent with the historical control direction, the current control increment is within the applicable range of the matching samples, and the historical control increment is not less than the minimum effective input increment of the corresponding execution object.

[0113] The trajectory simulation module determines the prediction interval based on the deviation between the predicted values ​​of the matched samples and the historical actual response values. When there are no fewer than 20 valid matched samples, the prediction interval is set to the 2nd to 97th percentile of the prediction deviation distribution, and the forward trajectory reliability status is recorded as "passed". When there are 5 to 19 valid matched samples, the prediction interval is set to the minimum to maximum value of the prediction deviation, and the forward trajectory reliability status is recorded as "limited". When there are fewer than 5 valid matched samples, no forward prediction status set is constructed, and the forward trajectory reliability status is recorded as "failed".

[0114] The prediction intervals of each parameter of the forward control prediction trajectory at each prediction time constitute the forward prediction state set.

[0115] The trajectory simulation module extracts the effective boundary state vector and the minimum remaining safety margin state vector formed by the same prediction time and the same prediction sample from the forward prediction state set. These are used as the starting states of the stage backoff control sequence to generate the stage backoff prediction trajectory. The envelopes of the stage backoff prediction trajectories generated from different starting states at the same backoff time together constitute the recovery state set.

[0116] When valid response samples with the same execution object and corresponding rollback direction exist, the corresponding response samples are used to generate a stage rollback prediction trajectory, and the rollback trajectory reliability status is recorded as passed; when there are no valid response samples with the corresponding rollback direction, but the rollback direction control action can be determined based on the equipment performance curve or on-site debugging data, a stage rollback prediction trajectory is generated, and the rollback trajectory reliability status is recorded as restricted; when the rollback direction control action cannot be determined, a recovery state set is not constructed, and the rollback trajectory reliability status is recorded as failed.

[0117] The associated process disturbance condition trajectory is generated based on the disturbance source node, disturbance start time, change direction, change magnitude and duration in the evidence chain of process deviation causes, and a corresponding prediction interval is generated simultaneously.

[0118] All four types of trajectories are multivariable time-series trajectories composed of controlled parameters, execution object feedback parameters, and safety verification parameters.

[0119] Reference Figure 5For step S300, multi-level boundary verification, joint verification of forward and recovery states, control object validity judgment, control object reallocation, and release gating processing are performed sequentially, specifically including the following sub-steps: S301, calculate the remaining security margin of the security verification parameters and perform multi-level boundary checks.

[0120] Multi-level security verification rules include design boundaries, operational boundaries, historical boundaries, process-related boundaries, mechanism response boundaries, equipment executable boundaries, interlock conflict boundaries, access boundaries, and data trust boundaries.

[0121] Design boundaries are determined based on equipment design documents and rated parameters; operational boundaries are determined based on equipment operating procedures; historical boundaries are determined based on historical steady-state response samples under similar process flows and operating conditions; process-related boundaries are determined based on material balance relationships, pressure relationships, temperature relationships, and upstream and downstream parameter constraints; mechanistic response boundaries are determined based on control direction, response amplitude, and propagation delay; equipment executable boundaries are determined based on remote control status, equipment operating status, execution feedback, remaining adjustment range, and minimum effective input increment; interlock conflict boundaries are determined based on safety interlock status and equipment protection status; access boundaries are determined based on control permissions; and data reliability boundaries are determined based on data quality codes, data refresh time, data integrity, and consistency of redundant measurement points.

[0122] The historical boundary is taken from the 2nd to the 97th percentile of the corresponding continuous production parameters in the historical steady-state response samples under the same process flow and similar operating conditions; when there are fewer than 20 valid samples, the historical boundary state is recorded as undetermined.

[0123] The threshold for process-related deviations is taken as the 95th percentile of the absolute value distribution of the corresponding residuals in the historical steady-state response samples of similar operating conditions; when there are fewer than 20 valid samples, the process-related status is recorded as undeterminable.

[0124] The predicted response direction should be consistent with the confirmed control action direction. When there are no fewer than 20 valid historical response samples, the predicted response time should be between the 5th and 95th percentiles of the historical valid response time distribution; when there are fewer than 20 valid samples, the minimum to maximum values ​​of the valid samples should be used, and the mechanistic response state should be recorded as restricted.

[0125] If any critical data is in a BAD state, is missing, or has a refresh interval exceeding three times the rated sampling period, the data reliability status is "not passed"; if only non-critical data is in an UNCERTAIN state, the data reliability status is "limited".

[0126] The fixed safety upper boundary is the smaller of the design upper limit and the safety interlock action upper limit, and the fixed safety lower boundary is the larger of the design lower limit and the safety interlock action lower limit. When no corresponding directional safety interlock action value is configured, the corresponding directional design boundary is used. The fixed safety boundary does not change with historical samples, prediction deviations, or parameter update results.

[0127] Safety verification parameters are parameters in continuous production that are related to candidate control strategies and participate in boundary verification, including the controlled parameter and its upstream and downstream related parameters. When a continuous production parameter is selected into the safety verification parameter set, its continuous production parameter index in the standardized time-series dataset is used. .

[0128] Let the first Each security verification parameter at the prediction time The upper and lower envelopes of the prediction interval are respectively and The fixed safety upper boundary and the fixed safety lower boundary are respectively and The remaining safety margin is: ; In the formula, For the first Each security verification parameter at the prediction time The remaining safety margin has the same physical dimensions as the safety verification parameter.

[0129] When the remaining safety margin is not greater than 0, the corresponding predicted state is determined to have reached or exceeded the fixed safety boundary.

[0130] The remaining safety margin warning threshold is the maximum value among the sensor measurement uncertainty, the historical parameter fluctuation range within the equipment's response time, and the safety buffer amount specified in the equipment's operating procedures. If the remaining safety margin is greater than 0 but not higher than the corresponding warning threshold, the remaining safety margin is deemed insufficient.

[0131] S302, perform joint verification of the forward predicted state set and the recovered state set.

[0132] Security verification module checks the first Whether the set of forward predicted states for each execution stage satisfies the multi-level boundary verification rules over the entire prediction time.

[0133] If any security verification parameter reaches a fixed security boundary, or if the design boundary, interlocking conflict boundary, device executable boundary, permission boundary, or data trust boundary fails, the forward security verification is deemed to have failed.

[0134] When the forward prediction state set does not trigger the mandatory blocking condition, the security verification module extracts the complete state vector formed by the same prediction time and the same prediction sample from the forward prediction state set, selects the state vector with the smallest remaining security margin and the effective boundary state vector, and forms the most unfavorable forward state set.

[0135] The extreme values ​​of a single parameter at different prediction times or different prediction samples must not be combined into a single state vector.

[0136] The safety verification module checks the stage rollback prediction trajectory generated from the set of most unfavorable forward states. The rollback process should simultaneously meet the following conditions: the stage rollback prediction trajectory does not reach the fixed safety boundary; the remaining safety margin of each safety verification parameter is not lower than the corresponding warning threshold; the execution object is in a controllable state; the control authority, execution feedback, and safety interlock status meet the requirements; and the rollback end state enters the rollback target state or the safety maintenance state.

[0137] If all states in the worst-case forward state set satisfy the above conditions, the recovery feasibility check is deemed to have passed; if any state does not satisfy the above conditions, the recovery feasibility check is deemed to have failed.

[0138] S303, determine the valid control conditions of the main execution object and perform control object reallocation.

[0139] The control gain is determined based on verified historical control actions or equipment performance curves, and represents the change in the corresponding safety verification parameter caused by a unit change in control input.

[0140] When there are no fewer than 20 confirmed effective control actions within the same execution object, the same control direction, and the same equipment operating range, the minimum effective control gain threshold is taken as the 5th percentile of the absolute value distribution of the control gain; when there are fewer than 20 effective control actions, the minimum control gain determined by the equipment performance curve or on-site commissioning data is adopted.

[0141] When the absolute value of the control gain of the main execution object for any security verification parameter is lower than the minimum effective control gain threshold, the control effect of the main execution object is deemed insufficient, and the corresponding security allowable control increment is not calculated.

[0142] For each safety verification parameter where the control gain is effective and the remaining safety margin decreases after the main execution object takes action, first calculate the difference between the minimum remaining safety margin of the safety verification parameter within the prediction time range and the corresponding remaining safety margin warning threshold; if the difference is less than 0, take 0, and then divide the difference by the absolute value of the corresponding control gain to obtain the control increment limited by the safety verification parameter.

[0143] The minimum value among the control increments limited by all safety verification parameters, the remaining adjustment range of the main execution object, the maximum adjustment range in a single stage, and the original control increment in the current execution stage is taken as the safety-permitted control increment. If there are no safety verification parameters whose remaining safety margin decreases with control actions, the safety-permitted control increment is the minimum value among the remaining adjustment range of the main execution object, the maximum adjustment range in a single stage, and the original control increment in the current execution stage.

[0144] The safety verification module reads the minimum valid input increment of the main execution object from the device characteristic parameter library. When the safety-permitted control increment is not less than the minimum valid input increment, the control increment of the current execution stage is limited to within the safety-permitted control increment, and the forward prediction state set and recovery state set are rechecked.

[0145] If the safety allowable control increment is less than the minimum effective input increment, or if the main execution object has insufficient control function, abnormal remote control status, invalid execution feedback, or insufficient remaining adjustment range, the control object reallocation is initiated.

[0146] The safety verification module extracts candidate execution objects that can affect the same controlled parameter based on the directed graph of the station's process topology. The control performance parameters of each candidate execution object include control direction, control gain, control response time, minimum effective input increment, remaining adjustment range, expected proportion of remaining safety margin, backoff time, remote control status, execution feedback status, control authority, and safety interlock status.

[0147] The expected percentage of remaining safety margin is the ratio of the reduction in remaining safety margin before and after the action of the candidate execution object to the remaining safety margin before the action. The maximum value of this ratio among all safety verification parameters is taken as the expected percentage of remaining safety margin occupied by the candidate execution object.

[0148] For each candidate execution object, calculate the safety allowable control increment according to the steps in this article, and sequentially eliminate candidates that have inconsistent control direction with the target adjustment direction of the controlled parameter, abnormal remote control status, insufficient permissions, invalid execution feedback or safety interlock conflicts, safety allowable control increment less than the minimum effective input increment, insufficient remaining adjustment range, cause any safety verification parameter to reach the fixed safety boundary or the remaining safety margin to fall below the warning threshold after the action, and cannot pass the recovery feasibility verification.

[0149] For the selected candidate execution objects, they are sorted in order of increasing remaining safety margin occupancy ratio, increasing rollback time, increasing control response time, and priority of execution objects as specified in the equipment operation procedures. The candidate execution object ranked first is determined as the alternative execution object.

[0150] The alternative execution object, control direction, and control increment are transmitted to the trajectory simulation module to regenerate the forward control prediction trajectory, stage backoff prediction trajectory, forward prediction state set, and recovery state set, and multi-level boundary verification and joint verification are re-executed.

[0151] If no suitable alternative execution object exists, a state of "no available execution object" is generated.

[0152] S304, generate the publish gating state vector and publish gating result.

[0153] The released gating state vector includes sample applicable domain matching state, propagation delay calculation state, forward trajectory reliability state, backtracking trajectory reliability state, design boundary state, operational boundary state, historical boundary state, process association state, mechanism response state, equipment executable state, interlocking conflict state, permission state, data trustworthy state, steady state state, recovery implementable state, controlled object reassignment state, risk level, and manual confirmation state.

[0154] In addition to the risk level and manual confirmation status, each status component is recorded as passed, restricted, failed, or cannot be determined. The risk level is recorded as low risk or high risk, and the manual confirmation status is recorded as no manual confirmation required or manual confirmation required.

[0155] The gating results are judged in the following order: blocked release, prompt only, manual confirmation required, downgraded release, and allowed release, and a unique result is generated.

[0156] If any of the following situations occur: sample application domain matching fails, propagation delay calculation fails, forward trajectory reliability fails, backtracking trajectory reliability fails, fixed security boundary is reached or exceeded, security interlock conflict occurs, key data is untrusted, recovery feasibility verification fails, permission status fails, remaining security margin after reducing control increment is still not higher than the warning threshold, or there is no available executable object, then a blocking release result will be generated.

[0157] If there is no definite reason or the reason cannot be monitored that prevents the generation of an executable candidate control strategy package, only a prompt result will be generated.

[0158] If the forward safety verification and recovery feasibility verification pass and the fixed safety boundary and safety interlock conditions are not triggered, but the risk level is high, the steady state is restricted, the forward trajectory reliability is restricted, the backtrack trajectory reliability is restricted, the historical boundary state, the process association state or the mechanism response state is undeterminable, the permission state is restricted or the non-critical data trust state is restricted, a result requiring manual confirmation will be generated.

[0159] If the original control increment fails the security check, and passes the joint check after reducing the control increment, extending the observation time, or reducing the number of execution stages, but does not meet the conditions for manual confirmation, a downgraded release result is generated.

[0160] If the forward security check and recovery feasibility check both pass, all boundary checks pass, the remaining security margin is higher than the warning threshold, the data trust status and permission status pass, the risk level is low and no manual confirmation is required, then a release permission result is generated.

[0161] Reference Figure 6 For step S400, the control command issuance and execution monitoring, related process disturbance identification, and anomaly rollback are executed sequentially, specifically including the following sub-steps: S401 issues control commands and performs multi-track deviation monitoring.

[0162] When the gating result is "allow release" or "downgrade release," the instruction issuing module verifies the validity period of the candidate control strategy package, the status of the field equipment, the status of the safety interlocks, and the control permissions, and then sets the next... The control commands for each execution stage are converted into industrial communication messages that the field controller can recognize and then sent out.

[0163] When the release of the gating result requires manual confirmation, it will be issued after confirmation by personnel with the corresponding control permissions and re-verification of the above status; when the release of the gating result is to block the release or only generate a prompt, no data writing will be performed.

[0164] After the control command is issued, the status monitoring module collects the actual feedback response according to the shortest observation time specified in the candidate control strategy package. The actual feedback response includes the timing sampled values ​​of the controlled parameters, the feedback parameters of the executed object, and the safety verification parameters. Alarm status, safety interlock status, and data quality status are monitored independently and are not included in the trajectory error calculation.

[0165] The status monitoring module will be the first The prediction interval of each security verification parameter in the forward prediction state set of each execution stage is intersected with the interval limited by the fixed upper security boundary minus the remaining security margin warning threshold and the fixed lower security boundary plus the remaining security margin warning threshold to form the dynamic prediction tolerance interval.

[0166] If the intersection is empty, it is determined that there is no valid dynamic prediction tolerance range in the current execution phase, and an abnormal termination condition is triggered.

[0167] The status monitoring module compares the actual feedback response with the no-new-addition control reference trajectory, the forward control prediction trajectory, and the trajectory associated with process disturbance conditions.

[0168] Before comparison, the standard deviation of each parameter in the historical steady-state response samples is used as the scale to perform dimensionless processing on the actual feedback response and each benchmark predicted trajectory; when the standard deviation is 0, the corresponding sensor resolution is used as the scale. The multivariate root mean square error is the square root of the arithmetic mean of the squared dimensionless deviations of all parameters involved in the comparison at all sampling times.

[0169] The error tolerance threshold for each type of trajectory is taken as the 95th percentile of the multivariate root mean square error distribution of the confirmed samples of the corresponding category; the trajectory discrimination threshold is taken as the 5th percentile of the distribution of the difference between the second smallest root mean square error and the smallest root mean square error among the correctly classified samples. When there are fewer than 20 valid samples for the corresponding category, the initial threshold is determined using debugging data or trial operation data from similar equipment.

[0170] The control execution state is determined according to the trajectory corresponding to the minimum error only when the minimum error is less than the corresponding error tolerance threshold and the difference between the second smallest error and the minimum error is not less than the trajectory differentiation threshold; otherwise, it is marked as predicted trajectory mismatch.

[0171] If all safety verification parameters in the actual feedback response are within the dynamic prediction tolerance range throughout the entire observation time window, the minimum error corresponds to the forward control prediction trajectory, and the feedback from the executing object is consistent with the control command, then the current execution stage is determined to be in line with expectations.

[0172] Consistency between the execution feedback and the control command means that the direction of change of the execution feedback is the same as the direction of the control command, and the difference between the execution feedback value and the target value corresponding to the control command does not exceed the allowable tracking error specified in the equipment technical documents or field calibration records.

[0173] The minimum error corresponds to no new control reference trajectory, and if the feedback from the executing object does not change effectively within the expected response time, it is determined that the executing object has not produced an effective action.

[0174] The minimum error corresponds to the trajectory of the associated process disturbance condition. When the feedback from the executing object is consistent with the control command, it is marked as a suspected associated process disturbance.

[0175] S402, Identify associated process disturbances based on propagation delay and process relationship.

[0176] For suspected associated process disturbances, the condition monitoring module extracts time-series data of the controlled parameters and associated node parameters from the standardized time-series dataset. All time-series data use the same sampling period and analysis time window.

[0177] If any time series data has consecutive missing data, invalid data quality, a standard deviation of 0, or no identifiable changes within the analysis time window, the cross-correlation coefficient is not calculated, and the source of the disturbance is marked as undeterminable.

[0178] When the time series data meets the calculation conditions, the state monitoring module calculates the normalized cross-correlation coefficients of the controlled parameters and the parameters of the associated nodes at different time offsets, and determines the correlation peak delay with the largest absolute value of the correlation coefficient.

[0179] When there are no fewer than 20 historical propagation records of similar operating conditions, the time delay search range is taken from the 5th percentile to the 95th percentile of the propagation time delay distribution; when there are fewer than 20 propagation records, the propagation time delay estimated under the current operating condition is taken as the center, and the estimated propagation time delay is extended forward by 20% and forward by the larger value of the two unified sampling periods, respectively.

[0180] When there are historically uncorrelated steady-state samples, the correlation strength threshold is the larger of the 95th percentile of the absolute value distribution of their cross-correlation coefficients and 0.6; when there are no historically uncorrelated steady-state samples, the correlation strength threshold is 0.6.

[0181] When the relevant peak delay is within the delay search range, the absolute value of the correlation coefficient reaches the correlation strength threshold, the parameter change direction conforms to the process relationship corresponding to the directed graph of the station process topology, the feedback of the local execution object is consistent with the control command, the remaining safety margin of each safety verification parameter is higher than the corresponding early warning threshold, and the stage backoff control sequence still meets the recovery feasibility conditions, the actual response deviation is judged as the associated process disturbance.

[0182] Once a process disturbance is identified as related, the current monitoring benchmark is switched to the related process disturbance condition trajectory and its prediction range pre-generated in step S204. The current execution stage is maintained, and the next execution stage is not initiated until the actual feedback response re-enters the dynamic prediction tolerance range corresponding to the forward control prediction trajectory, or an abnormal termination condition is triggered. The already generated prediction range must not be expanded during control execution.

[0183] When the conditions for judging related process disturbances are not met, check the data quality status, manual operation records, process flow switching records, current fluid physical property parameters and execution object feedback, and classify the causes of deviations into data quality abnormalities, changes in external operation status, mismatch of the application domain of the predicted trajectory, and the execution object not producing effective actions or being unable to be monitored.

[0184] S403, Stop forward control and execute the phase rollback control sequence.

[0185] Abnormal termination conditions include: any safety verification parameter reaching or exceeding the fixed safety boundary; the safety interlock system generating an action signal; the remaining safety margin of the safety verification parameter being lower than the warning threshold and continuing to decrease; the feedback from the executing object not following the control command within the expected response time; the actual feedback response continuously being outside the dynamic prediction tolerance range corresponding to the current monitoring benchmark; and the mismatch between the applicable domain of the predicted trajectory and the current control strategy being unable to continue verification.

[0186] The number of times the actual feedback response is continuously outside the dynamic prediction tolerance range is determined based on the shortest anomaly duration and the unified sampling period in the candidate control strategy package, and shall not be less than 2 consecutive sampling times.

[0187] When any abnormal termination condition is met, the status monitoring module stops the current execution phase and prohibits entry into the next execution phase. The rollback execution module cancels the forward control instructions that have not yet been executed and extracts the phase rollback control sequence that has passed the recovery executability check.

[0188] Under the conditions of priority for safety interlocks, equipment protection, local control authority, and manual lockout status, the rollback execution module converts the stage rollback control sequence into control commands that the field controller can recognize and issues them.

[0189] For execution objects that can be continuously reversed, adjust the corresponding control parameters to the rollback target state; for equipment that is not suitable for immediate reverse operation, adjust the corresponding equipment to the safety holding state.

[0190] During the execution of the phased rollback control sequence, the actual feedback response is compared with the phased rollback predicted trajectory and recovery state set.

[0191] The controlled parameters, execution object feedback parameters, and safety verification parameters all enter the recovery state set at the corresponding rollback time. The execution object feedback is consistent with the stage rollback control command. When each safety verification parameter does not reach the fixed safety boundary and meets its applicable steady-state judgment condition within the rollback verification time, a rollback completion state is generated.

[0192] When the actual feedback response continuously deviates from the recovery state set, the execution object refuses to execute the phase rollback control command, communication is interrupted, or the safety maintenance state is not formed, new control commands will stop being sent, the on-site safety interlocks and equipment protection outputs will not be changed, and alarm information, abnormal measurement point information, and manual handling tasks will be sent to the station operation terminal.

[0193] Reference Figure 7 For step S500, the following sub-steps are performed sequentially: handling of mismatched predicted trajectories, observation of candidate minimum effective input increments, offline replay verification, and version update: S501, handles the predicted trajectory mismatch samples and extracts candidate minimum effective input increment observations.

[0194] The data states of historical steady-state response samples include valid states, unverified states, and isolated states. Valid state samples can participate in trajectory generation, unverified state samples are suspended from participating in trajectory generation, and isolated state samples cannot participate in trajectory generation.

[0195] If the current operating condition is within the applicable domain of the historical steady-state response sample being called, the key data quality is valid, and after excluding manual operation, process flow switching and related process disturbances, the actual feedback response exceeds the corresponding prediction interval for two consecutive observation time windows, or the time exceeding the prediction interval for two consecutive observation time windows reaches the shortest abnormal duration, the corresponding historical steady-state response sample will be marked as a state to be verified and written into the candidate update area.

[0196] The abnormal data temporary storage module extracts the control output and execution feedback of the execution object to form candidate minimum effective input increment observations.

[0197] When extracting candidate minimum valid input increment observations, the following conditions must be met simultaneously: the data quality code is in GOOD state; the control output changes continuously in the same direction; the change in control output exceeds the controller output resolution and the steady-state control output fluctuation range; the execution feedback is continuously valid; there are no manual operations, safety interlock actions, or process flow switching during the observation period; and the upstream and downstream safety verification parameters meet their respective applicable steady-state judgment conditions.

[0198] When the change in the execution feedback is not less than the resolution of the feedback sensor and is maintained for no less than two consecutive uniform sampling periods, the net change in the same direction between the start of the change in the control output and the first effective feedback time is recorded as a candidate minimum effective input increment observation.

[0199] The maximum allowable execution response time of the equipment is taken from the value recorded in the equipment's technical documentation; if the technical documentation does not record this value, the maximum effective response time confirmed in the field commissioning records is taken. If no effective change occurs in the execution feedback after the maximum execution response time is reached, the corresponding net change in control output is recorded as the lower limit observation value of the minimum effective input increment. The lower limit observation value is not directly used as an effective parameter in the equipment characteristic parameter library.

[0200] S502 performs consistency checks in an offline playback simulation environment.

[0201] The offline replay verification module loads the historical steady-state response samples to be verified, the candidate minimum effective input increment observations, and their associated running records from the candidate update area into the offline replay simulation environment.

[0202] The offline playback simulation environment simultaneously loads the standardized time-series dataset, the directed graph of the station process topology, the equipment static ledger data, the candidate control strategy package, the multi-level safety verification rules, the control instructions, the execution feedback, the safety interlock status, and the manual operation records at the time of the corresponding event.

[0203] If the direction of the response generated by the historical steady-state response sample to be verified is inconsistent with the direction of the actual historical feedback response, or if the root mean square error of the multivariate variables exceeds the error tolerance threshold for two consecutive playback observation time windows, the sample is marked as isolated.

[0204] When mismatch is caused by abnormal data quality, manual operation, process change, or mismatch of applicable domains, the original sample is retained and candidate modification records with applicable domains or data quality identifiers are generated. The consistency check specified in this step is re-executed on the candidate modification records, and the original sample must not be modified before it passes.

[0205] Candidate minimum effective input increment observations are categorized according to device identification, control direction, and device operating range. The device operating range is preferentially divided according to the device performance curve; if the device performance curve is not specified, a device operating range is divided into 10% of the rated control range of the executed object.

[0206] When the same device has no less than 20 valid observations in the same control direction and the same device operating range, the 95th percentile of the valid observation distribution is taken as the candidate minimum valid input increment; when there are 5 to 19 valid observations, the maximum value among the valid observations is taken; when there are fewer than 5 valid observations or only lower limit observations, no new valid parameters are generated.

[0207] The offline replay verification module re-executes steps S200 and S300 using candidate update data. The updated predicted response direction should be consistent with the confirmed historical actual response direction. The forward predicted state set and the recovery state set should not reach the fixed safety boundary. The candidate control strategy should not conflict with the safety interlocking conditions and the forced blocking conditions. The phase rollback control sequence should be able to enter the rollback target state or the safety hold state.

[0208] If all of the above conditions are met, the candidate updated data will be marked as verified; if any condition is not met, the data will remain in the pending verification state or be marked as isolated.

[0209] S503 performs versioned updates and records all process data.

[0210] For verified historical steady-state response samples, candidate modification records of sample applicable domains, and candidate minimum effective input increments, the offline playback verification module generates a new data version.

[0211] Each data version must include at least the version number, device or sample identifier, data source, applicable domain, verification time, historical operating conditions used for verification, verification results, effective conditions, and conditions for reverting to the previous version.

[0212] After the new version completes permission review and version confirmation, it is written to either the historical steady-state response sample library or the device characteristic parameter library. Before the new version takes effect, the original valid version continues to be used; after the new version takes effect, the original valid version is converted to a historical version and retained, without being directly overwritten or deleted.

[0213] The offline replay verification module records data from the entire process, including anomaly triggering, cause classification, candidate control strategy package generation, trajectory simulation, multi-level boundary verification, gating deployment, control command issuance, actual response monitoring, anomaly rollback, and offline replay verification.

[0214] The updates to the historical steady-state response sample library and the equipment characteristic parameter library must not be automatically written to the field controller, nor should they automatically modify the control logic of the safety interlock system.

[0215] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An offline simulation, boundary verification, and security release method for oilfield station control strategies, characterized in that, include: Acquire multi-source time-series data from oilfield stations and determine the causes of abnormal events based on the directed graph of station process topology; Based on the determined cause and the current operating condition, a candidate control strategy package is generated. The candidate control strategy package includes the main execution object, the controlled parameter, the phased forward control sequence, and the corresponding phased backoff control sequence. Based on the current operating conditions, historical steady-state response samples are matched, and a forward prediction state set and a recovery state set are generated based on the matched historical steady-state response samples. Calculate the remaining safety margin of the safety verification parameters relative to the fixed safety boundary, verify whether the forward prediction state set satisfies the fixed safety boundary, and take the most unfavorable forward state in the forward prediction state set as the starting point to verify whether the recovery state set is entered after executing the stage rollback control sequence, and obtain the joint verification result. When the security allowable control increment of the main execution object is less than the minimum effective input increment, an alternative execution object is determined, and a forward prediction state set and a recovery state set are regenerated for the alternative execution object and the verification is re-executed. Based on the joint verification result, a release gating result is generated. Control instructions are issued in stages according to the release gating result. When an abnormal termination condition is triggered, the forward control instructions that have not yet been executed are stopped and the stage rollback control sequence is executed.

2. The offline simulation, boundary verification, and security release method for oilfield station control strategy according to claim 1, characterized in that, The causes of abnormal events are determined based on the directed graph of the station's process topology, including: Candidate associated nodes in the direction of anomaly propagation are determined based on the directed graph of the station's process topology; The basic propagation delay is determined based on the effective process volume of the connected process path between the candidate associated node and the measurement point node that triggered the abnormal event, and the average volumetric flow rate of the connected process path. Extract the effective change time and direction of parameter change of the candidate associated nodes; When the effective change time of the parameter is earlier than the trigger time of the abnormal event, and the difference between the effective change time of the parameter and the trigger time of the abnormal event and the difference between the basic propagation delay does not exceed the allowable deviation of the propagation delay, and the direction of the parameter change conforms to the process relationship or control action relationship, the corresponding candidate associated node is marked as the determined cause, and a process deviation cause evidence chain is generated.

3. The offline simulation, boundary verification, and security release method for oilfield station control strategy according to claim 1, characterized in that, A forward prediction state set and a recovery state set are generated based on the matched historical steady-state response samples, including: Based on the effective process volume of the connected process path and the in-situ mixture volumetric flow rate under the current operating conditions, the historical propagation delay of the historical steady-state response samples is corrected to obtain the estimated propagation delay. Using the candidate control strategy package generation time as the prediction start time, and based on the response feature alignment time and the estimated propagation delay, generate a no-new control reference trajectory, a forward control prediction trajectory, a stage backoff prediction trajectory, and a trajectory associated with process disturbance conditions. Based on the prediction deviation, the upper envelope and lower envelope of the prediction interval of the forward control prediction trajectory at each prediction time are determined to construct the forward prediction state set, and the envelopes of the stage backtracking prediction trajectories generated at different starting states are used together to form the recovery state set.

4. The offline simulation, boundary verification, and security release method for oilfield station control strategy according to claim 1, characterized in that, Calculate the remaining safety margin of the safety verification parameters relative to the fixed safety boundary, including: The remaining safety margin is calculated based on the upper and lower envelopes of the prediction interval at the prediction time, and the fixed upper and lower safety boundaries determined according to the design boundary and the safety interlock action boundary. The formula for calculating the remaining safety margin is as follows: ； In the formula, This is the sequence number of the security verification parameter; For the predicted time; For the first Each security verification parameter at the prediction time The remaining safety margin; To establish a fixed upper safety boundary; To fix the lower safety boundary; For the first Each security verification parameter at the prediction time The upper envelope of the prediction interval; For the first Each security verification parameter at the prediction time The lower envelope of the prediction interval.

5. The offline simulation, boundary verification, and security release method for oilfield station control strategy according to claim 1, characterized in that, Starting with the most unfavorable forward state in the forward prediction state set, verify whether the recovery state set has been entered after executing the stage rollback control sequence, including: Extract a complete state vector from the forward-predicted state set, which is formed by samples of the same prediction time and the same historical steady-state response. Select the state vector where the remaining safety margin reaches its minimum value and the effective boundary state vector to form the most unfavorable forward state set; Examine the stage backoff prediction trajectory generated from the set of most unfavorable forward states; When the predicted backtracking trajectory does not reach the fixed safety boundary, the remaining safety margin of each safety verification parameter is not lower than the warning threshold, and the backtracking end state enters the backtracking target state or the safety maintenance state, the recovery feasibility verification is deemed to have passed.

6. The offline simulation, boundary verification, and security release method for oilfield station control strategy according to claim 1, characterized in that, Determine the alternative execution target, including: Calculate the difference between the minimum remaining safety margin of the safety verification parameter and the remaining safety margin warning threshold, and divide the difference by the absolute value of the control gain to obtain the limit control increment; The minimum value among the limited control increment of all safety verification parameters, the remaining adjustment range of the main execution object, the maximum adjustment range of a single stage, and the original control increment of the current execution stage is taken as the safety allowable control increment; When the safety allowable control increment is less than the minimum effective input increment, candidate execution objects that affect the same controlled parameter are extracted according to the station process topology directed graph.

7. The offline simulation, boundary verification, and security release method for oilfield station control strategy according to claim 6, characterized in that, Determining the alternative execution target also includes: Candidates for execution are filtered out from the candidate execution objects if the control direction is inconsistent with the target adjustment direction of the controlled parameter, the remote control status is abnormal, the permissions are insufficient, there are safety interlock conflicts, the remaining adjustment range is insufficient, or the recovery feasibility verification is not passed. For the candidate execution objects that pass the screening, they are sorted in order of increasing proportion of remaining safety margin, increasing rollback time, and increasing control response time; The candidate execution object that ranks first in the sorting is determined as the alternative execution object.

8. The offline simulation, boundary verification, and security release method for oilfield station control strategy according to claim 1, characterized in that, Based on the joint verification results, a release gating result is generated, including: When the joint verification result satisfies the following conditions: both the forward security verification and the recovery feasibility verification pass, the remaining security margin is higher than the warning threshold, the data trust status and permission status are passed, and the risk level is low, a release gating result that allows release is generated. When the forward prediction state set reaches a fixed security boundary, there is a security interlocking conflict, the recovery feasibility verification fails, or there is no alternative execution object, a release gating result that blocks the release is generated. When the original control increment fails the security check, and passes the joint check after reducing the control increment, extending the observation time, or reducing the number of execution stages, a degraded release gating result is generated.

9. The offline simulation, boundary verification, and security release method for oilfield station control strategy according to claim 3, characterized in that, Control commands are issued in stages according to the gating results, and when an abnormal termination condition is triggered, the forward control commands that have not yet been executed are stopped and the stage rollback control sequence is executed, including: After a control command is issued, the actual feedback response, including the controlled parameters, the execution object feedback parameters, and the safety verification parameters, is collected. The actual feedback response is compared with the no-new-control-reference-trajectory, the forward-control-predicted-trajectory, and the associated-process-disturbance-condition-trajectory, and the multivariate root mean square error is calculated to determine the control execution status. When the actual feedback response continuously deviates from the dynamic prediction tolerance range corresponding to the forward control prediction trajectory, or when the safety interlocking condition is met, the abnormal termination condition is determined to be triggered.

10. The offline simulation, boundary verification, and security release method for oilfield station control strategy according to claim 9, characterized in that, After the abnormal termination condition is triggered, the method further includes: The predicted trajectory mismatch samples that cause the abnormal termination condition to be triggered, as well as the candidate minimum effective input increment observation values ​​extracted from the observations, are written into the candidate update area. In the offline playback simulation environment, the multi-source time-series data, candidate control strategy packages, and data in the candidate update area when the abnormal event occurs are loaded, and consistency verification is performed. When simulation and verification are re-executed using data from the candidate update region, and the forward prediction state set does not reach the fixed safety boundary and the stage rollback control sequence can enter the rollback target state or the safety maintenance state, the consistency verification is determined to be successful. The verified data will be written as the new version into the historical steady-state response sample library or the device characteristic parameter library, while the original historical version will be retained.

Images