AI-based mes data stream anomaly detection system and method

Abstract

The present application relates to the technical field of data analysis, in particular to an MES data stream anomaly detection system and method based on AI. The present application collects and sorts work order business logs and device communication logs into historical work order event sequences through work order number aggregation and bilateral time sorting; then uses the PrefixSpan algorithm to mine frequent candidate event sequences to form a normal work order path benchmark for comparing event missing, position offset and additional occurrence in real-time production data streams. Further, the sequence anomaly number, device response time difference, work order state jump number and interface communication timeout number are jointly included in the closed loop state parameter set, and the data stream state score is calculated through the improved XGBoost algorithm. Thus, the present application can identify real-time production data stream anomalies while further corresponding the abnormal data stream to the work order flow verification direction or the device communication troubleshooting direction, playing a role from "finding anomalies" to "distinguishing anomaly sources and outputting verification objects".

Description

Technical Field

[0001] This invention relates to the field of data analysis technology, and in particular to an AI-based MES data stream anomaly detection system and method. Background Technology

[0002] MES data flow anomaly detection system is a control platform that continuously monitors and reviews the data transmission and instruction issuance process within the manufacturing execution system. It is used to promptly detect sudden situations that deviate from the normal operating mode during the information flow of workshop equipment, so as to ensure the continuity and accuracy of the underlying production data.

[0003] Traditional MES data flow anomaly detection systems, while capable of continuously monitoring data transmission and instruction issuance within the manufacturing execution system, face challenges in industrial automated production. The business flow records and equipment communication records for the same work order reflect the work order execution status and equipment response status respectively, exhibiting differences in time source, event granularity, and anomaly manifestation. This makes it difficult to transform historical normal work order flow patterns into a comparable benchmark. Furthermore, when real-time production data continuously enters the MES system, relying solely on single communication timeouts, single status changes, or single event errors for review makes it difficult to distinguish whether the current event is a necessary event in the normal sequence, an event with a sequence deviation, or an event occurring additionally relative to the normal work order path. Moreover, when work order event sequence deviations and equipment communication status anomalies occur simultaneously, traditional review methods tend to treat them separately, resulting in unclear anomaly sources. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing an AI-based MES data stream anomaly detection system and method.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: the AI-based MES data stream anomaly detection system includes: The timing construction module collects work order business logs and equipment communication logs generated during the historical operation of industrial equipment automation based on the MES system, and extracts historical work order event sequences from the work order business logs and equipment communication logs. The frequent sequence mining module filters out frequent candidate event sequences from historical work order event sequences; The sequence alignment module collects real-time production data streams generated during the automated real-time operation of industrial equipment from the MES system, and filters out anomalies from frequent candidate event sequences by referring to the real-time production data streams to obtain sequence anomaly identification results. The status parameter integration module determines the closed-loop status parameter set based on work order business logs, device communication logs, and sequence anomaly identification results. The data flow status determination module calculates the data flow status score based on the closed-loop status parameter set, and classifies the data flow into normal data flow and abnormal data flow based on the data flow status score to obtain the data flow detection result.

[0006] As a further aspect of the present invention, the time-series construction module includes a log collection submodule, a work order classification submodule, and a time-series generation submodule; The log collection submodule collects work order business logs generated during the historical operation of industrial equipment automation based on the MES system, and the corresponding equipment communication logs. It obtains the work order number, server-side reception time, and historical work order events from the work order business logs, and obtains the material batch identifier and equipment-side recording time from the equipment communication logs. The work order classification submodule aggregates material batch identifiers, historical work order events, server-side reception time, and device-side recording time with the same work order number into the data group corresponding to the same work order number, and generates a set of historical work order events containing each data group. The timing generation submodule arranges the corresponding historical work order events according to the order of the device-side recording time and the server-side receiving time in each data group of the historical work order event set from earliest to latest, thus obtaining the historical work order event sequence.

[0007] As a further aspect of the present invention, the frequent sequence mining module includes a completion screening submodule, a candidate generation submodule, and a support determination submodule; The completion filtering submodule retrieves the work order completion status record field from the work order business log, compares it with the preset normal completion standard reference field, and retains the corresponding historical work order event in the historical work order event sequence when the work order completion status record field is the same as the normal completion standard reference field. When the work order completion status record field is different from the normal completion standard reference field, the corresponding historical work order event is filtered out from the historical work order event sequence. Each retained historical work order event is counted as a normal historical work order event, and a normal historical work order event sequence is constructed according to the order of normal historical work order events in the historical work order event sequence. The candidate generation submodule treats the normal historical work order event sequence as the basic sequence sample in the PrefixSpan algorithm, counts the occurrence frequency of each normal historical work order event in the basic sequence sample, selects each normal historical work order event whose occurrence frequency is greater than or equal to the preset prefix frequency threshold as a candidate prefix, locates the occurrence position of each candidate prefix in the basic sequence sample, extracts the normal historical work order events after each occurrence position as the corresponding suffix extension events, concatenates each candidate prefix with the corresponding suffix extension events, and removes duplicates from the sequences with the same event name order after concatenation to obtain the candidate event sequence. The system supports a decision submodule that uses the PrefixSpan algorithm to calculate the sequence support score of candidate event sequences in the base sequence samples. Candidate event sequences with a sequence support score greater than or equal to a preset support comparison threshold are retained as frequent candidate event sequences.

[0008] As a further aspect of the present invention, the sequence alignment module includes a real-time acquisition submodule, a location extraction submodule, and an anomaly recording submodule; The real-time acquisition submodule collects real-time production data streams generated during the automated real-time operation of industrial equipment based on the MES system. It obtains the current work order event and the event arrival time corresponding to the current work order event from the real-time production data stream, arranges the current work order events according to the event arrival time, and obtains the current work order event set. The location extraction submodule obtains the name of the normal historical work order event in the frequent candidate event sequence, and generates the occurrence position number of the normal historical work order event according to the arrangement order of the normal historical work order event in the frequent candidate event sequence. It also obtains the name of the current work order event in the current work order event set, and generates the occurrence position number of the current work order event according to the arrangement order of the current work order event in the current work order event set. The anomaly recording submodule compares the name of the current work order event with the names of normal historical work order events one by one. When the name of a current work order event does not contain the name of a corresponding normal historical work order event, the corresponding normal historical work order event is marked as a missing normal historical work order event in the current work order event set and is treated as a sequence missing anomaly. When the name of a current work order event contains the name of a corresponding normal historical work order event, the module compares the occurrence position number of the current work order event with the occurrence position number of the normal historical work order event. When the occurrence position number of the current work order event is greater than or less than the occurrence position number of the corresponding normal historical work order event, the corresponding current work order event is marked as a current work order event with a positional anomaly and is treated as a sequence position anomaly. When the name of a normal historical work order event does not contain the name of a corresponding current work order event, the corresponding current work order event is marked as a current work order event that appears additionally to the frequent candidate event sequence and is treated as a sequence extra anomaly. The module records sequence missing anomalies, sequence position anomalies, and sequence extra anomalies to obtain the sequence anomaly identification result.

[0009] As a further aspect of the present invention, the state parameter integration module includes a state normalization submodule, a quantity normalization submodule, and a parameter integration submodule. The status normalization submodule obtains the instruction issuance time and the number of work order status jumps from the work order business log, and obtains the material batch identifier, equipment response time and the number of interface communication timeouts from the equipment communication log. It calculates the difference between the equipment response time and the instruction issuance time to obtain the equipment response time difference. The quantity normalization submodule counts the number of missing sequence anomalies in the sequence anomaly identification results to obtain the number of missing events, counts the number of position anomalies in the sequence anomaly identification results to obtain the number of offset events, and counts the number of extra sequence anomalies in the sequence anomaly identification results to obtain the number of extra events. The parameter integration submodule normalizes the device response time difference, work order status jump count, interface communication timeout count, number of missing events, number of offset events, and number of extra events. It integrates the material batch identifier, normalized device response time difference, normalized work order status jump count, normalized interface communication timeout count, normalized number of missing events, normalized number of offset events, and normalized number of extra events to obtain a closed-loop state parameter set.

[0010] As a further embodiment of the present invention, the data flow state determination module includes a variable acquisition submodule, a state calculation submodule, and a data determination submodule; The variable acquisition submodule takes the normalized equipment response time difference, the normalized number of work order status jumps, and the normalized number of interface communication timeouts corresponding to each material batch identifier in the closed-loop state parameter set as the equipment state input variables in the improved XGBoost algorithm, and takes the normalized number of missing events, the normalized number of offset events, and the normalized number of extra events corresponding to each material batch identifier in the closed-loop state parameter set as the work order event sequence anomaly input variables in the improved XGBoost algorithm. The status calculation submodule uses the improved XGBoost algorithm to calculate the data stream status score corresponding to each material batch identifier based on the equipment status input variables and the work order event sequence abnormal input variables. The data judgment submodule determines the real-time production data stream associated with the corresponding material batch identifier as a normal data stream when the data stream status score is less than the preset status score judgment threshold, and determines the real-time production data stream associated with the corresponding material batch identifier as an abnormal data stream when the data stream status score is greater than or equal to the preset status score judgment threshold. It outputs data stream detection results containing normal and abnormal data streams, which are used to provide the MES system with work order flow verification objects and equipment communication troubleshooting objects.

[0011] The AI-based MES data stream anomaly detection method includes the following steps: Based on the MES system, collect work order business logs and equipment communication logs generated during the historical operation of industrial equipment automation, and extract historical work order event sequences from the work order business logs and equipment communication logs. Filter frequently occurring candidate event sequences from historical work order event sequences; Based on the real-time production data stream generated during the automated real-time operation of industrial equipment by the MES system, abnormal items are screened out from the frequent candidate event sequences by referring to the real-time production data stream to obtain the sequence abnormality identification result; Based on the work order business log, device communication log, and sequence anomaly identification results, determine the closed-loop status parameter set; The data flow state score is calculated based on the closed-loop state parameter set. The data flow state score is used to classify the data flow into normal and abnormal data flows, and the data flow detection result is obtained.

[0012] Compared with the prior art, the advantages and positive effects of the present invention are as follows: This invention uses work order number aggregation and bilateral time sorting to organize work order business logs and equipment communication logs into a historical work order event sequence that reflects the sequential relationship of historical work order flows. Based on this, the PrefixSpan algorithm mines frequent candidate event sequences from the normal historical work order event sequence, enabling the system to obtain a sequence benchmark representing the normal work order path. This allows subsequent real-time production data streams to be compared based on whether normal events are missing, whether positional deviations have occurred, or whether additional events have occurred. Furthermore, the number of anomalies generated by sequence comparison, along with equipment response time differences, work order status jump counts, and interface communication timeout counts, are incorporated into a closed-loop state parameter set. The improved XGBoost algorithm calculates the data stream state score corresponding to each material batch identifier based on equipment state input variables and work order event sequence anomaly input variables. This allows the normal path benchmark formed by the PrefixSpan algorithm to complement the state judgment capability of the XGBoost algorithm: the former provides a structured basis for whether work order flows deviate from the normal path, while the latter converts this deviation degree, along with the equipment communication status, into a state basis for distinguishing between normal and abnormal data streams. Therefore, this invention can identify anomalies in real-time production data streams and further map the abnormal data streams to the direction of work order flow verification or equipment communication troubleshooting, thus advancing from "discovering anomalies" to "distinguishing the source of anomalies and outputting the objects to be verified". Attached Figure Description

[0013] Figure 1 This is a block diagram of the system of the present invention; Figure 2 This is a block diagram illustrating the module flow principle of the system of the present invention; Figure 3 This is a schematic diagram illustrating the steps of the method of the present invention. Detailed Implementation

[0014] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0015] Please see Figure 1-2 This invention provides a technical solution: an AI-based MES data stream anomaly detection system includes: The time-series construction module is based on the work order business logs and equipment communication logs generated during the historical operation of industrial equipment automation in the MES system. It extracts historical work order event sequences from the work order business logs and equipment communication logs. This module collects, classifies, and sorts the work order business logs and equipment communication logs in the MES system according to the work order number, material batch identifier, and time field, thereby achieving the purpose of converting scattered logs into traceable historical work order event sequences. These sequences are then used by the subsequent frequent sequence mining module to extract stable work order flow patterns from normal historical operation processes.

[0016] The time-series construction module includes a log collection submodule, a work order classification submodule, and a time-series generation submodule.

[0017] The workflow of the log collection submodule is as follows: The MES system reads the work order business logs generated during the historical operation of industrial equipment automation from the work order business log table. The work order business logs refer to the business-side records generated during the work order dispatch, commencement, transfer, reporting, and completion processes. Next, it reads the device communication logs corresponding to the work order business logs from the device communication log table. The device communication logs refer to the communication-side records generated during the interaction between the industrial equipment and the MES system. In the work order business logs, the work order number is read as a text field, used to identify a single production work order; the server-side reception time is read as a time field, used to indicate when the MES system received the work order business logs; historical work order events are read as event names, used to indicate work order transfer events that have occurred during historical operations. In the device communication logs, the material batch identifier is read as a text field, used to distinguish the material batch corresponding to the work order; the device-side recording time is read as a time field, used to indicate when the industrial equipment generated the device communication log. After reading, the work order number, server-side receiving time, and historical work order events from the same work order business log are grouped into a business-side field group, and the material batch identifier and device-side recording time from the corresponding device communication log are grouped into a device-side field group. These fields are then bound according to the correspondence between the work order business log and the device communication log. Subsequently, the server-side receiving time and device-side recording time are standardized to a year-month-day-hour-minute-second format, and the work order number, server-side receiving time, historical work order events, material batch identifier, and device-side recording time are bound according to the log source relationship to form a log collection record.

[0018] The workflow of the work order classification submodule is as follows: It reads the work order number from the log collection records and uses it as the collection index. When the work order number first appears in the collection index, a data group corresponding to the work order number is created. If the work order number already exists in the collection index, the corresponding log collection record is written to the existing data group. Next, the material batch identifier, historical work order events, server-side receiving time, and device-side recording time under the same work order number are written to the data group while maintaining the same record relationship. The material batch identifier is used to distinguish different material batches under the same work order number, historical work order events are used to record work order flow actions, and server-side receiving time and device-side recording time are used to record the time of the same historical work order event on the business side and the device side. Each time a log collection record is written, the correspondence between the material batch identifier and the historical work order event is retained, so that when historical work order events are arranged in chronological order, the material batch corresponding to that historical work order event can be traced simultaneously. Subsequently, the collection is completed one by one according to the work order number, so that records corresponding to the same work order number are in the same data group, and records corresponding to different work order numbers are in different data groups, generating a historical work order event set.

[0019] The workflow of the time sequence generation submodule is as follows: It reads the device-side recording time and server-side receiving time from each data group in the historical work order event set. The device-side recording time represents the order in which historical work order events are recorded by the industrial equipment, and the server-side receiving time represents the order in which the MES system receives historical work order events. Next, within each data group, the order of device-side recording time and server-side receiving time is compared. If the device-side recording time is earlier than the device-side recording time of another historical work order event, the corresponding historical work order event is ranked first. If the device-side recording times are the same, the server-side receiving times are compared, and the historical work order event with the earlier server-side receiving time is ranked first. After sorting within the same data group, the historical work order events are no longer arranged according to the log reading order, but rather according to a time sequence prioritizing device-side recording time and supplementing it with server-side receiving time, so that the order of events under the same work order number corresponds to the historical operation process of the industrial equipment automation. Subsequently, the historical work order events are read sequentially according to the sorted order within each data group, so that each data group forms an event sequence arranged chronologically, thus forming the historical work order event sequence.

[0020] The frequent sequence mining module filters out frequent candidate event sequences from historical work order event sequences. This module uses event sequences that meet the normal completion criteria in historical work order event sequences as the basis for mining, and filters out high-frequency and stable work order event arrangement patterns through candidate generation and support determination, thereby achieving the purpose of extracting the normal work order flow benchmark sequence, which is used by the subsequent sequence comparison module to compare the real-time production data stream with the frequent candidate event sequences for anomaly comparison.

[0021] The frequent sequence mining module includes a completion screening submodule, a candidate generation submodule, and a support decision submodule.

[0022] The workflow of the completion screening submodule is as follows: It reads the work order completion status record field from the work order business log. This field indicates the completion status of the work order at the end of its historical run. Next, it reads the preset normal completion standard reference field, which consists of the work order completion status field, the completion quantity achieved field, the quality inspection release field, and the equipment execution closed-loop field. The work order completion status field indicates that the work order has completed all process flows according to the preset process route; the completion quantity achieved field indicates that the actual completion quantity has reached the planned work order quantity; the quality inspection release field indicates that the final process inspection result is qualified and release is allowed; and the equipment execution closed-loop field indicates that the equipment has completed processing and sent execution completion information back to the MES system. The process for setting the reference fields for normal completion standards is as follows: The completion status of the final process is read from the process route configuration of the MES system as the work order completion status field; the quantity consistency status is read from the work order planned quantity vs. reported quantity verification record as the completed quantity achievement field; the qualified release status is read from the final process inspection record as the quality inspection release field; and the closed-loop completion status is read from the processing completion feedback record in the equipment communication log as the equipment execution closed-loop field. These four fields are combined into reference fields for filtering normal historical work order events. Subsequently, the work order completion status record fields are compared item by item with the normal completion standard reference fields. If the work order completion status record field matches the normal completion standard reference field, the corresponding historical work order event is retained in the historical work order event sequence; if the work order completion status record field does not match the normal completion standard reference field, the corresponding historical work order event is removed from the historical work order event sequence. Finally, each retained historical work order event is counted as a normal historical work order event, and a normal historical work order event sequence is constructed according to the order of normal historical work order events in the historical work order event sequence.

[0023] The workflow of the candidate generation submodule is as follows: In the Python runtime environment, the PrefixSpan sequence mining package is used to process normal historical work order event sequences. The PrefixSpan algorithm is a sequence mining algorithm that starts with a prefix, progressively searches for suffix extension events in the sequence sample, and forms candidate sequences. Normal historical work order event sequences serve as the base sequence samples, which are collections of event sequences formed by arranging normal historical work order events in order. The frequency of occurrence of a normal historical work order event refers to the number of times it appears in the base sequence samples. Next, the names of normal historical work order events in the base sequence samples are read item by item, and the frequency of occurrence of each normal historical work order event is accumulated. The preset prefix frequency threshold is generated by sorting the frequency of occurrence of all normal historical work order events in the base sequence samples. All frequencies are arranged from smallest to largest. When the number of occurrences is odd, the frequency corresponding to the middle position is taken as the preset prefix frequency threshold; when the number of occurrences is even, the frequency corresponding to the first middle position is taken as the preset prefix frequency threshold. Subsequently, normal historical work order events with a frequency greater than or equal to a preset prefix frequency threshold are selected as candidate prefixes, while normal historical work order events with a frequency less than the preset prefix frequency threshold are not selected as candidate prefixes. Next, the occurrence position of each candidate prefix is ​​located in the basic sequence sample, and the normal historical work order events following each occurrence position are extracted as the corresponding suffix extension events. Each candidate prefix is ​​then concatenated with its corresponding suffix extension event in the original order. Taking three normal historical work order event sequences in the basic sequence sample as an example, the first sequence is dispatch, material loading, processing completed, and quality inspection released; the second sequence is dispatch, material loading, processing completed, and quality inspection released; and the third sequence is dispatch, material loading, equipment return completed, and quality inspection released. When the frequency of dispatch and material loading is greater than or equal to the preset prefix frequency threshold, dispatch and material loading are selected as candidate prefixes. When dispatch is used as a candidate prefix, material loading, processing completed, and quality inspection released are extracted after dispatch in the first and second sequences, and material loading, equipment return completed, and quality inspection released are extracted after dispatch in the third sequence. Dispatch is then concatenated with the suffix extended event to obtain dispatch, material loading, processing completed, and quality inspection released, as well as dispatch, material loading, equipment return completed, and quality inspection released. The event names of the first and second sequences are arranged in the same order after concatenation, so only one sequence is retained. Concatenation sequences with different event name orders are retained to generate candidate event sequences.

[0024] The workflow of the support decision submodule is as follows: The PrefixSpan algorithm is used to read the order of event names in the candidate event sequence, and then the normal historical work order event sequences in the base sequence sample are read one by one. Once the first event name in the candidate event sequence is found in the base sequence sample, the search continues from that position for the next event name until all event names in the candidate event sequence are found in the same order. At this point, the base sequence sample is recorded as a support sample. If no event name in the candidate event sequence can be found in the same order, the base sequence sample is not recorded as a support sample. Support samples indicate that a normal historical work order event sequence completely contains the order of events in the candidate event sequence. Normal historical work order event sequences not recorded as support samples do not participate in the cumulative support count for that candidate event sequence. The formula for calculating the sequence support score using the PrefixSpan algorithm is: ;in, Represents a sequence of candidate events In the basic sequence sample The sequence support score in the candidate event sequence The base sequence sample is formed by concatenating candidate prefix and suffix expansion events. Composed of a normal historical work order event sequence, Represents the basic sequence sample A normal historical work order event sequence in the process. Represents a sequence of candidate events The event names in the sequence can be arranged in the normal historical work order event sequence according to the same chronological order. Find them one by one in the middle. Indicates support for candidate event sequences The number of basic sequence samples, This represents the total number of basic sequence samples. Next, the preset support comparison threshold is generated by sorting the sequence support scores of all candidate event sequences. All sequence support scores are arranged from smallest to largest. When the number of sequence support scores is odd, the middle sequence support score is taken as the preset support comparison threshold; when the number of sequence support scores is even, the first middle sequence support score is taken as the preset support comparison threshold. Subsequently, candidate event sequences with sequence support scores greater than or equal to the preset support comparison threshold are retained, while candidate event sequences with sequence support scores less than the preset support comparison threshold are filtered out, forming frequent candidate event sequences.

[0025] The sequence comparison module collects real-time production data streams generated during the automated real-time operation of industrial equipment from the MES system. It filters out anomalies from frequent candidate event sequences by referring to the real-time production data stream, and obtains the sequence anomaly identification results. This module organizes the current work order events in the real-time production data stream into a current work order event set according to their arrival time, and performs a bidirectional comparison with the event names and position numbers in the frequent candidate event sequences. This achieves the purpose of identifying missing events, event position offsets, and the occurrence of additional events, which are then used by the subsequent state parameter integration module to convert the sequence anomaly identification results into calculable closed-loop state parameters.

[0026] The sequence alignment module includes a real-time acquisition submodule, a location extraction submodule, and an anomaly recording submodule.

[0027] The workflow of the real-time acquisition submodule is as follows: The MES system reads the current work order event and its corresponding arrival time from the real-time production data stream. The real-time production data stream refers to the stream of work order event records entering the MES system during the real-time automated operation of industrial equipment. The current work order event refers to the name of the work order event that has occurred during real-time operation, and the event arrival time refers to the time when the current work order event entered the MES system. The event name of the current work order event uses the same event naming rule as the event names of the aforementioned historical work order events, enabling the events in the real-time production data stream to be compared with the names of normal historical work order events in the frequent candidate event sequence. Next, the current work order event and the event arrival time are bound to the same real-time production data stream record, and the event arrival time is converted to a year-month-day-hour-minute-second format. Subsequently, the current work order events are arranged from earliest to latest according to their arrival time; when the event arrival times are the same, the current work order events are arranged according to the order in which they were received in the real-time production data stream, forming a set of current work order events.

[0028] The specific workflow of the location extraction submodule is as follows: First, it reads the names of normal historical work order events from the frequent candidate event sequence. These names refer to the event names used to characterize normal work order flow events within the frequent candidate event sequence. Next, it generates a normal historical work order event occurrence position number based on the order of these events in the frequent candidate event sequence. The position number is counted starting from the first normal historical work order event in the frequent candidate event sequence, incrementing for each subsequent normal historical work order event read. Then, it reads the name of the current work order event from the current work order event set. This name refers to the work order event name already collected in the real-time production data stream. Based on the order of the current work order event in the current work order event set, it generates a current work order event occurrence position number. This position number is also counted starting from the first current work order event in the current work order event set, incrementing for each subsequent current work order event read. The position number is not part of the event name, but rather the position of the event name within the corresponding sequence. When the same event name appears repeatedly in the same sequence, a position number is generated for each occurrence according to its position, enabling subsequent position comparisons to distinguish different occurrence positions of events with the same name. This generates the occurrence position numbers for normal historical work orders and the occurrence position numbers for the current work order.

[0029] The workflow of the exception recording submodule is as follows: After the current work order event set and the frequent candidate event sequence enter the exception recording process, two event name lists are first established. The current work order event name list is arranged according to the occurrence position number of the current work order event, and the normal historical work order event name list is arranged according to the occurrence position number of the normal historical work order event. The current work order event name list is searched starting from the first name in the normal historical work order event name list. If no matching name is found, it means that the normal historical work order event that should appear in the frequent candidate event sequence does not appear in the current work order event set, and the corresponding normal historical work order event is written as a sequence missing exception item. When a matching name is found, the position number bound to each name is read. If the position number of the current work order event is greater than that of a normal historical work order event, it indicates that the current work order event has shifted backward relative to the normal sequence. If the position number of the current work order event is less than that of a normal historical work order event, it indicates that the current work order event has shifted forward relative to the normal sequence. Both forward and backward shifts are written into the sequence position anomaly entry. If the two position numbers are the same, the current work order event is identical to the corresponding normal historical work order event in both name and position, and no anomaly entry is written. Next, the normal historical work order event name list is searched backward starting from the first name in the current work order event name list. If no matching name is found, it indicates that an event outside the frequent candidate event sequence has occurred in the current production process, and an additional sequence anomaly entry is written for the corresponding current work order event. Taking the frequent candidate event sequence as dispatch, material loading, processing completion, and quality inspection release, and the current work order event set as dispatch, processing completion, material loading, rework request, and quality inspection release, the position number of material loading in the current work order event set is later than the position number of the normal historical work order event, while the position number of processing completion in the current work order event set is earlier than the position number of the normal historical work order event. Both material loading and processing completion are written into the sequence position anomaly item. The rework request does not appear in the frequent candidate event sequence and is written into the sequence additional anomaly item. Finally, the sequence missing anomaly item, the sequence position anomaly item, and the sequence additional anomaly item are recorded to form the sequence anomaly identification result.

[0030] The status parameter integration module determines the closed-loop status parameter set based on work order business logs, equipment communication logs, and sequence anomaly identification results. This module statistically and normally integrates the status change information in the work order business logs, the response and timeout information in the equipment communication logs, and the anomaly quantity information in the sequence anomaly identification results to form a closed-loop status parameter set corresponding to the same material batch. This set is then used by the subsequent data flow status determination module to input multi-dimensional anomaly performance into the improved XGBoost algorithm for status score calculation.

[0031] The state parameter integration module includes a state normalization submodule, a quantity normalization submodule, and a parameter integration submodule.

[0032] The workflow of the status normalization submodule is as follows: It reads the instruction issuance time and the number of work order status transitions from the work order business log. The instruction issuance time refers to the time when the MES system issues the work order instruction to the industrial equipment automation operation side. The number of work order status transitions refers to the number of times the work order status changes under the same work order number. The number of work order status transitions is counted according to the chronological order of work order status records under the same work order number in the work order business log. If the previous work order status is different from the next work order status, the number of work order status transitions is accumulated; if the previous work order status is the same as the next work order status, the number of work order status transitions is not accumulated. Next, it reads the material batch identifier, equipment response time, and the number of interface communication timeouts from the equipment communication log. The equipment response time refers to the time it takes for the industrial equipment to respond to the instruction. The number of interface communication timeouts refers to the number of records in the equipment communication log where the communication status is timed out. When the interface communication status is timed out, the number of interface communication timeouts is accumulated; when the interface communication status is not timed out, the number of interface communication timeouts is not accumulated. Both equipment response time and command issuance time use a standardized time format. When subtracting the two, the same time unit is used for calculation. This ensures that the equipment response delay corresponding to the same material batch identifier can be integrated into subsequent parameters along with the number of work order status jumps and interface communication timeouts. Subsequently, the difference between equipment response time and command issuance time is calculated: Equipment Response Time Difference = Equipment Response Time - Command Issuance Time.

[0033] The workflow of the quantity normalization submodule is as follows: It reads sequence missing anomalies, sequence position anomalies, and sequence extra anomalies from the sequence anomaly identification results. Sequence missing anomalies refer to records in the current work order event set that lack normal historical work order events. Sequence position anomalies refer to records where the current work order event occurrence position number is inconsistent with the normal historical work order event occurrence position number. Sequence extra anomalies refer to current work order event records that appear additionally compared to frequent candidate event sequences. Next, the number of occurrences of sequence missing anomalies is counted for each record, forming the number of missing events; the number of occurrences of sequence position anomalies is counted for each record, forming the number of offset events; and the number of occurrences of sequence extra anomalies is counted for each record, forming the number of extra events. All three quantities are aggregated based on the material batch identifier. Multiple anomalies under the same material batch identifier are accumulated separately, ensuring that the subsequent closed-loop state parameter set can simultaneously represent the degree of event missingness, event position offset, and the degree of extra event occurrence for the same material batch. After all sequence anomaly identification results are statistically analyzed, the number of missing events, the number of offset events, and the number of extra events are generated.

[0034] The parameter integration submodule's workflow is as follows: It reads the device response time difference, work order status jump count, interface communication timeout count, number of missing events, number of offset events, and number of extra events. It then reads the minimum and maximum reference values ​​for the same type of parameter in the historical records. The minimum reference value refers to the lowest value of the same type of parameter in the historical records, and the maximum reference value refers to the highest value of the same type of parameter in the historical records. The historical records are generated and filtered, compared, and statistically analyzed during the aforementioned historical operation of the industrial equipment automation system. The minimum and maximum reference values ​​are directly selected from the historical value set of the same type of parameter. Normalization processing converts all types of parameters into dimensionless values ​​between 0 and 1. When the current parameter value is less than or equal to the minimum reference value, the normalized parameter value = 0; when the current parameter value is greater than or equal to the maximum reference value, the normalized parameter value = 1; when the current parameter value is greater than the minimum reference value and less than the maximum reference value, the normalized parameter value = (current parameter value - minimum reference value) / (maximum reference value - minimum reference value). Next, according to the material batch identifier, the normalized equipment response time difference, the normalized number of work order status jumps, the normalized number of interface communication timeouts, the normalized number of missing events, the normalized number of offset events, and the normalized number of extra events are integrated into the same parameter record to form a closed-loop status parameter set.

[0035] The data flow status determination module calculates the data flow status score based on the closed-loop status parameter set, and classifies the data flow into normal and abnormal data flows based on the data flow status score to obtain the data flow detection result. This module converts the closed-loop status parameter set into input variables for the improved XGBoost algorithm, and calculates the data flow status score by combining the tree model output, the abnormal quantity of the work order event sequence, and the equipment status quantity, thereby achieving the purpose of distinguishing between normal and abnormal data flows. This is used by the MES system to retain normal flow records and generate records to be verified for abnormal data flows, pointing to the work order flow verification object and the equipment communication troubleshooting object, respectively.

[0036] The data flow state determination module includes a variable acquisition submodule, a state calculation submodule, and a data determination submodule.

[0037] The workflow of the variable acquisition submodule is as follows: It reads the closed-loop status parameter set one by one according to the material batch identifier, which is used to distinguish the material batches associated with the real-time production data stream. The normalized equipment response time difference refers to the normalized value of the equipment response time difference; the normalized work order status jump count refers to the normalized value of the work order status jump count; and the normalized interface communication timeout count refers to the normalized value of the interface communication timeout count. These three items are used as the equipment status input variables in the improved XGBoost algorithm. Next, the normalized number of missing events refers to the normalized value of the number of missing events; the normalized number of offset events refers to the normalized value of the number of offset events; and the normalized number of extra events refers to the normalized value of the number of extra events. These three items are used as the work order event sequence anomaly input variables in the improved XGBoost algorithm. The equipment status input variable corresponds to the equipment-side response, work order status changes, and interface communication status. The work order event sequence anomaly input variable corresponds to the missing, positional offset, and additional occurrence of real-time work order events relative to frequent candidate event sequences. Both are combined using the same material batch identifier to form the data stream status calculation input for a single material batch. The equipment status input variable and the work order event sequence anomaly input variable, bound together with the same material batch identifier, form the input variables for the improved XGBoost algorithm.

[0038] The workflow of the state calculation submodule is as follows: An improved XGBoost algorithm is trained and run using the XGBoost software library in the Python runtime environment. The XGBoost algorithm is a tree model algorithm that sequentially accumulates the output scores from multiple gradient boosting decision trees. The training data comes from historical samples that have been labeled as normal or abnormal. The input fields in the historical samples are device state input variables and work order event sequence abnormal input variables. The labeling fields in the historical samples are normal labels or abnormal labels. Normal labels indicate a normal data stream where the work order event sequence matches the normal historical work order event sequence, the device response time difference is within the historical normal range, there are no abnormal jumps in the work order state transition count, and there is no abnormal accumulation of interface communication timeouts. Abnormal labels indicate an abnormal data stream with missing sequence anomalies, sequence position anomalies, additional sequence anomalies, device response time differences exceeding the historical normal range, abnormal jumps in the work order state transition count, or abnormal accumulation of interface communication timeouts. Next, the equipment status input variables, work order event sequence anomaly input variables, and annotation fields corresponding to each material batch identifier are arranged as training samples. The input fields in each training sample are normalized values. The normalized equipment response time difference represents the relative position of the equipment's response delay to the instructions issued by the MES system in the historical record. The larger the value, the closer the equipment response is to the historical high latency state. The normalized work order status jump count represents the relative position of the frequency of work order status switching in the historical record. The larger the value, the closer the work order status switching is to the historical high frequency state. The normalized interface communication timeout count represents the relative position of the cumulative timeout of the equipment communication interface in the historical record. The larger the value, the closer the equipment communication is to the historical high timeout state. The normalized number of missing events indicates the degree to which the current work order event set lacks normal historical work order events relative to the frequent candidate event sequence; the larger the value, the closer the event missing is to the historical high missing state. The normalized number of offset events indicates the degree to which the current work order event occurrence position number deviates from the normal historical work order event occurrence position number; the larger the value, the closer the event sequence offset is to the historical high offset state. The normalized number of extra events indicates the degree to which the current work order event set has extra events relative to the frequent candidate event sequence; the larger the value, the closer the extra events are to the historical high extra event state. Subsequently, multiple decision trees are constructed. Each decision tree consists of a root node, internal decision nodes, and leaf nodes. The root node corresponds to the first variable comparison of a decision tree, the internal decision nodes correspond to the variable comparisons after the root node, and the leaf nodes correspond to the state partition into which the input variable set falls after multiple comparisons in that decision tree.The leaf node score is the state contribution value of the training samples within that state partition. Training samples falling into the same leaf node have the same node comparison path. When falling into a leaf node biased towards normally labeled training samples, the leaf node score contributes to the normal data flow direction; when falling into a leaf node biased towards abnormally labeled training samples, the leaf node score contributes to the abnormal data flow direction. The root node and internal judgment nodes each read a device status input variable or a work order event sequence abnormal input variable and compare the read variable value with the node segmentation value. If the variable value is less than the node segmentation value, it enters the left branch; if the variable value is greater than or equal to the node segmentation value, it enters the right branch. After reaching a leaf node, the leaf node score is read. The node segmentation value is selected from the sorted list of corresponding variable values ​​in the training samples. The median value between two adjacent different values ​​is used as the candidate segmentation value. The candidate segmentation value that minimizes the number of partitioning errors for normally labeled and abnormally labeled training samples in the left and right branches is used as the node segmentation value. Compared to the traditional XGBoost algorithm, which only accumulates the scores of each decision tree leaf node, the state calculation submodule introduces the sequence anomaly quantity corresponding to the work order event sequence anomaly input variable and the device state quantity corresponding to the device state input variable into the data stream state score. This allows the data stream state score to simultaneously absorb work order flow sequence deviations and device communication state deviations, making the state score more clearly targeted at the work order flow verification object and the device communication troubleshooting object. The formula for calculating the data stream state score is: ;in, Material batch identifier The corresponding data stream state score, For material batch identifiers in the closed-loop state parameter set; Material batch identifier The corresponding set of input variables consists of the normalized device response time difference, the normalized number of work order status transitions, the normalized number of interface communication timeouts, the normalized number of missing events, the normalized number of offset events, and the normalized number of extra events. This represents the set of decision trees in the improved XGBoost algorithm. Represents a set of decision trees Any decision tree in the process; Indicates the first A decision tree reads a set of input variables. Then, following the root node and internal decision nodes, the leaf node score is reached and output. The leaf node score corresponds to the set of input variables in the _th ... The state partition to which a decision tree belongs; Indicates the first The tree weights of the decision trees range from 0 to 1. First, historical samples that have already been labeled as normal or abnormal are read, and then the weights of the 1st decision tree are calculated. The percentage of correct decisions when each decision tree makes a single decision decision, and then the percentage of correct decisions when the first decision tree makes a single decision decision. The correct decision ratio of the decision trees is converted to the first tree. The proportion of correct decisions made by a single decision tree relative to the sum of correct decisions made by all decision trees; the higher the proportion of correct decisions, the better. The larger; Material batch identifier The corresponding outlier in the work order event sequence is composed of the average of the normalized number of missing events, the normalized number of offset events, and the normalized number of extra events. The larger these three values ​​are, the better. The larger; This represents the correction coefficient corresponding to the abnormal quantity of the work order event sequence, with a value ranging from 0 to 1. First, the abnormal quantity of the work order event sequence and the equipment status quantity corresponding to each material batch identifier in the historical abnormal sample are read. Then, the mean of the abnormal quantity of the work order event sequence and the mean of the equipment status quantity in the historical abnormal sample are calculated. Finally, the mean of the abnormal quantity of the work order event sequence is converted into the proportion of the mean of the abnormal quantity of the work order event sequence to the sum of the two types of means. The larger the mean of the abnormal quantity of the work order event sequence in the historical abnormal sample... The larger; Material batch identifier The corresponding device status variables consist of the average of the normalized device response time difference, the normalized number of work order status transitions, and the normalized number of interface communication timeouts. The larger these three values ​​are, the better. The larger; This represents the correction coefficient corresponding to the equipment status quantity, with a value ranging from 0 to 1. First, the abnormal quantity and equipment status quantity of the work order event sequence corresponding to each material batch identifier in the historical abnormal sample are read. Then, the mean of the abnormal quantity of the work order event sequence and the mean of the equipment status quantity in the historical abnormal sample are calculated. Finally, the mean of the equipment status quantity is converted into the proportion of the mean of the equipment status quantity to the sum of the two types of means. The larger the mean of the equipment status quantity in the historical abnormal sample, the better. The larger; This represents the natural exponential operation. The accumulated result within the parentheses is first inversely calculated, then subjected to natural exponential operation, followed by summing the natural exponential result with 1. Finally, the reciprocal of the sum is taken, converting the accumulated result within the parentheses into a data stream status score between 0 and 1. During real-time calculation, the equipment status input variables corresponding to the same material batch identifier and the abnormal input variables of the work order event sequence are fed into the improved XGBoost algorithm to calculate the data stream status score corresponding to each material batch identifier.

[0039] Compared to the conventional XGBoost algorithm, which calculates state scores solely based on the ensemble results of the tree model, this embodiment sets tree weights according to the correct judgment ratio of each decision tree for historical samples, based on the leaf node scores output by each decision tree. This reduces the interference of decision trees with weaker judgment capabilities on the calculation results. Simultaneously, it introduces work order event sequence anomalies and equipment status variables to correct the tree model output results. Specifically, the work order event sequence anomalies are determined by comparing the frequent candidate event sequence generated by the PrefixSpan algorithm with the current work order event set, based on the number of missing events, the number of offset events, and the number of extra events. The equipment status variables are determined based on the equipment response time difference, the number of work order status transitions, and the number of interface communication timeouts. Therefore, the PrefixSpan algorithm first transforms the deviation of real-time work orders from the normal work order path into structured sequence anomaly variables. The improved XGBoost algorithm then learns the combination relationship between the sequence anomaly variables and the device status variables, and converts the impact of the two types of anomalies on the data stream status into a data stream status score. This avoids judging based solely on a single event error or a single device communication parameter, enabling the calculation results to simultaneously reflect the deviation of work order flow order and the deviation of device communication status, and providing a status basis for subsequently determining the work order flow verification objects and the device communication troubleshooting objects.

[0040] The workflow of the data determination submodule is as follows: It acquires the data stream status scores corresponding to multiple sets of historical samples that have been labeled as normal or abnormal. Historical samples refer to historical production data records that have been determined to be normal or abnormal data streams. Normal data streams are those whose work order flow order matches the sequence of frequent candidate events and whose device communication status has not triggered anomaly determination. Abnormal data streams are those with missing sequence anomalies, sequence position anomalies, additional sequence anomalies, or whose device communication status has triggered anomaly determination. The data stream status score is a value between 0 and 1 calculated by the status calculation submodule. Next, the data stream status scores are arranged in ascending order, and the values ​​between the data stream status scores of adjacent normal and abnormal historical samples are selected as candidate thresholds. Subsequently, the number of missed anomalies and the number of false positives corresponding to each candidate threshold are counted. When the data stream status score of an abnormal historical sample is less than the candidate threshold, it is included in the number of missed anomalies; when the data stream status score of an abnormal historical sample is greater than or equal to the candidate threshold, it is not included in the number of missed anomalies. When the data stream status score of a normal historical sample is greater than or equal to the candidate threshold, it is included in the number of false positives; when the data stream status score of a normal historical sample is less than the candidate threshold, it is not included in the number of false positives. The candidate threshold corresponding to the minimum sum of the number of missed anomalies and the number of false positives is determined as the status score judgment threshold. During real-time judgment, when the data stream status score is less than the preset status score judgment threshold, the real-time production data stream associated with the corresponding material batch identifier is judged as a normal data stream; when the data stream status score is greater than or equal to the preset status score judgment threshold, the real-time production data stream associated with the corresponding material batch identifier is judged as an abnormal data stream, and a data stream detection result containing both normal and abnormal data streams is output. After the data flow detection results enter the MES system, the material batch identifiers corresponding to normal data flows are retained as normal flow records, while the material batch identifiers corresponding to abnormal data flows are listed in the pending verification record. Records in the pending verification record with missing, abnormal, or additional abnormal items in the associated sequence are marked as work order flow verification objects. Records in the pending verification record with abnormal behavior in the associated device response time difference, work order status jump count, or interface communication timeout count are marked as device communication troubleshooting objects.

[0041] Please see Figure 3 An AI-based method for detecting anomalies in MES data streams includes the following steps: S1: Based on the MES system, collect the work order business logs and equipment communication logs generated during the historical operation of industrial equipment automation, and extract the historical work order event sequence from the work order business logs and equipment communication logs; S2: Filter frequently occurring candidate event sequences from historical work order event sequences; S3: Based on the MES system, collect the real-time production data stream generated during the automated real-time operation of industrial equipment, and filter out abnormal items from the frequent candidate event sequence by referring to the real-time production data stream to obtain the sequence abnormality identification result; S4: Determine the closed-loop status parameter set based on the work order business log, device communication log, and sequence anomaly identification results; S5: Calculate the data flow state score based on the closed-loop state parameter set, and divide the data flow into normal data flow and abnormal data flow based on the data flow state score to obtain the data flow detection result.

[0042] The AI-based MES data stream anomaly detection method provided in this application solves the problems of difficulty in constructing normal work order paths, difficulty in distinguishing real-time event anomaly types, and unclear anomaly source by coordinating the actions of a time sequence construction module, a frequent sequence mining module, a sequence comparison module, a status parameter integration module, and a data stream status determination module. It achieves the effect of MES data stream anomaly identification, anomaly source differentiation, and output of work order flow verification objects and equipment communication troubleshooting objects.

[0043] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. An AI-based MES data stream anomaly detection system, characterized in that, The system includes: The timing construction module collects work order business logs and equipment communication logs generated during the historical operation of industrial equipment automation based on the MES system, and extracts historical work order event sequences from the work order business logs and equipment communication logs. The frequent sequence mining module filters out frequent candidate event sequences from historical work order event sequences; The sequence alignment module collects real-time production data streams generated during the automated real-time operation of industrial equipment from the MES system, and filters out anomalies from frequent candidate event sequences by referring to the real-time production data streams to obtain sequence anomaly identification results. The status parameter integration module determines the closed-loop status parameter set based on work order business logs, device communication logs, and sequence anomaly identification results. The data flow status determination module calculates the data flow status score based on the closed-loop status parameter set, and classifies the data flow into normal data flow and abnormal data flow based on the data flow status score to obtain the data flow detection result.

2. The AI-based MES data stream anomaly detection system according to claim 1, characterized in that, The time-series construction module includes a log collection submodule, a work order classification submodule, and a time-series generation submodule; The log collection submodule collects work order business logs generated during the historical operation of industrial equipment automation based on the MES system, and the corresponding equipment communication logs. It obtains the work order number, server-side reception time, and historical work order events from the work order business logs, and obtains the material batch identifier and equipment-side recording time from the equipment communication logs. The work order classification submodule aggregates material batch identifiers, historical work order events, server-side reception time, and device-side recording time with the same work order number into the data group corresponding to the same work order number, and generates a set of historical work order events containing each data group. The timing generation submodule arranges the corresponding historical work order events according to the order of the device-side recording time and the server-side receiving time in each data group of the historical work order event set from earliest to latest, thus obtaining the historical work order event sequence.

3. The AI-based MES data stream anomaly detection system according to claim 2, characterized in that, The frequent sequence mining module includes a completion screening submodule, a candidate generation submodule, and a support determination submodule; The completion filtering submodule retrieves the work order completion status record field from the work order business log, compares it with the preset normal completion standard reference field, and retains the corresponding historical work order event in the historical work order event sequence when the work order completion status record field is the same as the normal completion standard reference field. When the work order completion status record field is different from the normal completion standard reference field, the corresponding historical work order event is filtered out from the historical work order event sequence. Each retained historical work order event is counted as a normal historical work order event, and a normal historical work order event sequence is constructed according to the order of normal historical work order events in the historical work order event sequence. The candidate generation submodule treats the normal historical work order event sequence as the basic sequence sample in the PrefixSpan algorithm, counts the occurrence frequency of each normal historical work order event in the basic sequence sample, selects each normal historical work order event whose occurrence frequency is greater than or equal to the preset prefix frequency threshold as a candidate prefix, locates the occurrence position of each candidate prefix in the basic sequence sample, extracts the normal historical work order events after each occurrence position as the corresponding suffix extension events, concatenates each candidate prefix with the corresponding suffix extension events, and removes duplicates from the sequences with the same event name order after concatenation to obtain the candidate event sequence. The system supports a decision submodule that uses the PrefixSpan algorithm to calculate the sequence support score of candidate event sequences in the base sequence samples. Candidate event sequences with a sequence support score greater than or equal to a preset support comparison threshold are retained as frequent candidate event sequences.

4. The AI-based MES data stream anomaly detection system according to claim 3, characterized in that, The sequence alignment module includes a real-time acquisition submodule, a location extraction submodule, and an anomaly recording submodule; The real-time acquisition submodule collects real-time production data streams generated during the automated real-time operation of industrial equipment based on the MES system. It obtains the current work order event and the event arrival time corresponding to the current work order event from the real-time production data stream, arranges the current work order events according to the event arrival time, and obtains the current work order event set. The location extraction submodule obtains the name of the normal historical work order event in the frequent candidate event sequence, and generates the occurrence position number of the normal historical work order event according to the arrangement order of the normal historical work order event in the frequent candidate event sequence. It also obtains the name of the current work order event in the current work order event set, and generates the occurrence position number of the current work order event according to the arrangement order of the current work order event in the current work order event set. The exception recording submodule compares the name of the current work order event with the name of the normal historical work order event one by one. When the name of the current work order event does not contain the name of the corresponding normal historical work order event, the corresponding normal historical work order event is marked as a missing normal historical work order event in the current work order event set and is treated as a sequence missing exception. When the name of a corresponding normal historical work order event appears in the name of each current work order event, the occurrence position number of the current work order event is compared with the occurrence position number of the normal historical work order event. If the occurrence position number of the current work order event is greater than or less than the occurrence position number of the corresponding normal historical work order event, the corresponding current work order event is marked as a current work order event with an abnormal position and is treated as a sequence position anomaly. If the name of a corresponding current work order event does not appear in the name of each normal historical work order event, the corresponding current work order event is marked as a current work order event that appears additionally relative to the frequent candidate event sequence and is treated as a sequence additional anomaly. Record sequence missing anomalies, sequence position anomalies, and sequence extra anomalies to obtain sequence anomaly identification results.

5. The AI-based MES data stream anomaly detection system according to claim 4, characterized in that, The state parameter integration module includes a state normalization submodule, a quantity normalization submodule, and a parameter integration submodule. The status normalization submodule obtains the instruction issuance time and the number of work order status jumps from the work order business log, and obtains the material batch identifier, equipment response time and the number of interface communication timeouts from the equipment communication log. It calculates the difference between the equipment response time and the instruction issuance time to obtain the equipment response time difference. The quantity normalization submodule counts the number of missing sequence anomalies in the sequence anomaly identification results to obtain the number of missing events, counts the number of position anomalies in the sequence anomaly identification results to obtain the number of offset events, and counts the number of extra sequence anomalies in the sequence anomaly identification results to obtain the number of extra events. The parameter integration submodule normalizes the device response time difference, work order status jump count, interface communication timeout count, number of missing events, number of offset events, and number of extra events. It integrates the material batch identifier, normalized device response time difference, normalized work order status jump count, normalized interface communication timeout count, normalized number of missing events, normalized number of offset events, and normalized number of extra events to obtain a closed-loop state parameter set.

6. The AI-based MES data stream anomaly detection system according to claim 5, characterized in that, The data stream state determination module includes a variable acquisition submodule, a state calculation submodule, and a data determination submodule; The variable acquisition submodule takes the normalized equipment response time difference, the normalized number of work order status jumps, and the normalized number of interface communication timeouts corresponding to each material batch identifier in the closed-loop state parameter set as the equipment state input variables in the improved XGBoost algorithm, and takes the normalized number of missing events, the normalized number of offset events, and the normalized number of extra events corresponding to each material batch identifier in the closed-loop state parameter set as the work order event sequence anomaly input variables in the improved XGBoost algorithm. The status calculation submodule uses the improved XGBoost algorithm to calculate the data stream status score corresponding to each material batch identifier based on the equipment status input variables and the work order event sequence abnormal input variables. The data judgment submodule determines the real-time production data stream associated with the corresponding material batch identifier as a normal data stream when the data stream status score is less than the preset status score judgment threshold, and determines the real-time production data stream associated with the corresponding material batch identifier as an abnormal data stream when the data stream status score is greater than or equal to the preset status score judgment threshold. It outputs data stream detection results containing normal and abnormal data streams, which are used to provide the MES system with work order flow verification objects and equipment communication troubleshooting objects.

7. The AI-based MES data stream anomaly detection system according to claim 3, characterized in that, The reference fields for normal completion standards include: a work order completion status field indicating that the work order has completed all process flows according to the preset process route; a completion quantity achievement field indicating that the actual completed quantity has reached the planned work order quantity; a quality inspection release field indicating that the final process inspection result is qualified and release is allowed; and an equipment execution closed loop field indicating that the equipment has completed the processing and sent the execution end information back to the MES system.

8. The AI-based MES data stream anomaly detection system according to claim 4, characterized in that, The process of comparing the name of the current work order event with the name of the normal historical work order event one by one also includes: when the location sequence number of the current work order event is the same as the location sequence number of the corresponding normal historical work order event, it is not recorded as an abnormal item.

9. The AI-based MES data stream anomaly detection system according to claim 6, characterized in that, The process of setting the state score judgment threshold is as follows: obtain the data stream state scores corresponding to multiple sets of historical samples that have been labeled normally or abnormally, arrange them in ascending order of scores, select the values ​​between the data stream state scores of adjacent normal historical samples and abnormal historical samples as candidate thresholds, count the number of abnormal missed judgments and the number of normal misjudgments corresponding to each candidate threshold, and determine the candidate threshold corresponding to the minimum sum of the number of abnormal missed judgments and the number of normal misjudgments as the state score judgment threshold.

10. An AI-based method for detecting anomalies in MES data streams, characterized in that: Includes the following steps: Based on the MES system, collect work order business logs and equipment communication logs generated during the historical operation of industrial equipment automation, and extract historical work order event sequences from the work order business logs and equipment communication logs. Filter frequently occurring candidate event sequences from historical work order event sequences; Based on the real-time production data stream generated during the automated real-time operation of industrial equipment by the MES system, abnormal items are screened out from the frequent candidate event sequence by referring to the real-time production data stream to obtain the sequence abnormality identification result; Based on the work order business log, device communication log, and sequence anomaly identification results, determine the closed-loop status parameter set; The data flow state score is calculated based on the closed-loop state parameter set. The data flow state score is used to classify the data flow into normal and abnormal data flows, and the data flow detection result is obtained.

Images