Sis risk monitoring method and system based on safety interlocking state atlas

Abstract

The application discloses a SIS risk monitoring method and system based on a safety interlocking state atlas, relates to the technical field of industrial control, and comprises the following steps: collecting safety interlocking data of SIS, performing data registration, and generating SIS interlocking operation records; performing space-time coupling analysis on bypass states in interlocking state deviation, and generating a bypass superimposed state; evaluating the health states of each node in the safety interlocking state atlas based on interlocking trigger completeness and interlocking state deviation, generating node health degrees, screening abnormal nodes from the safety interlocking state atlas according to the interlocking trigger completeness and the node health degrees, taking the abnormal nodes as risk propagation starting points, performing risk propagation analysis on the safety interlocking state atlas, and generating risk propagation paths; and matching the risk nodes with preset disposal rules, and generating SIS risk monitoring results. The bypass superimposed state is generated by performing feature coding, and the possibility that the superimposed risk is ignored due to independent monitoring of each bypass state is reduced.

Description

Technical Field

[0001] This invention relates to the field of industrial control technology, and in particular to a SIS risk monitoring method and system based on a safety interlock status graph. Background Technology

[0002] With the increasing demands for functional safety in petrochemical, fine chemical, energy production, and continuous industrial processes, Safety Instrumented Systems (SIS) have become an important technical means for industrial process safety control. SIS typically relies on field input signals, preset logical interlocking relationships, and output execution status. As the scale of SIS expands and the number of field measurement points, logical interlocking relationships, and execution objects increases, the operation monitoring method is gradually evolving from single-device status monitoring to comprehensive analysis of multi-source operation data. Input signals, logical status, output execution status, bypass status, and fault diagnosis information can all serve as the data basis for safety operation evaluation.

[0003] However, existing technologies still have the following shortcomings: input signals, logical interlocking relationships and output execution states are usually recorded in a scattered manner, making it difficult to reflect the triggering relationship and state transition process between nodes from the perspective of the overall interlocking link. At the same time, existing monitoring methods lack a unified evaluation of the completeness of states that have been completed, deviated, or have not undergone the expected transition during an interlocking triggering process, making it difficult to continuously, correlate, and path-based monitor potential risks in critical safety links of SIS. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a SIS risk monitoring method based on a security interlocking state graph to solve the problem that existing monitoring methods are unable to continuously, correlate, and path-based monitor potential risks in critical SIS security links.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a SIS risk monitoring method based on a safety interlock status map, comprising,

[0008] Collect safety interlock data of SIS, perform data registration, generate SIS interlock operation records, establish safety interlock topology based on SIS interlock operation records, perform state mapping on safety interlock topology, and generate safety interlock state map;

[0009] State transition analysis is performed on the safety interlock state map to generate interlock state deviation. Spatiotemporal coupling analysis is performed on the bypass state in the interlock state deviation to generate bypass superposition state. Based on the interlock state deviation and bypass superposition state, the state transition integrity of the safety interlock state map is verified, and the interlock trigger integrity is generated.

[0010] The health status of each node in the safety interlock status map is evaluated based on the interlock trigger integrity and interlock status deviation, and the node health is generated. Abnormal nodes are screened from the safety interlock status map based on the interlock trigger integrity and node health. The abnormal nodes are used as the starting point for risk propagation. Risk propagation analysis is performed on the safety interlock status map to generate risk propagation paths.

[0011] Risk coupling judgment is performed on the integrity of interlocking triggers and the health of nodes by risk propagation path, risk nodes are identified, risk nodes are matched with preset handling rules, and SIS risk monitoring results are generated.

[0012] As a preferred embodiment of the SIS risk monitoring method based on safety interlock status graphs described in this invention, the specific steps for generating SIS interlock operation records are as follows:

[0013] The system collects input signals, logical interlocking relationships, output execution status, bypass status, and fault diagnosis information from the SIS to form safety interlocking data. It then performs object matching on the safety interlocking data according to the logical interlocking relationships in the safety interlocking data to generate interlocking object association results.

[0014] Based on the interlocking object association results, the sampling timestamp of the safety interlocking data is corrected, and the safety interlocking data is arranged according to the corrected sampling timestamp to generate the SIS interlocking operation record.

[0015] As a preferred embodiment of the SIS risk monitoring method based on safety interlock state map described in this invention, the specific steps for generating the safety interlock state map are as follows:

[0016] According to the logical interlocking relationship in the SIS interlocking operation record, find the associated input signals and output execution states, and perform graph structure modeling of the logical interlocking relationship and the associated input signals and output execution states to form a set of interlocking nodes;

[0017] Based on the set of interlocking nodes and logical interlocking relationships, directed connections are established between nodes, and topological encoding is performed on the directed connections to generate a secure interlocking topology.

[0018] Configure the attributes of the SIS interlocking operation records according to the interlocking node set to form node status data;

[0019] Based on the logical interlocking relationship, the input signals in the node state data are logically determined, and the determination results and node state data are mapped to the safety interlocking topology to generate a safety interlocking state map.

[0020] As a preferred embodiment of the SIS risk monitoring method based on safety interlocking state graphs described in this invention, the specific steps for generating interlocking state deviations are as follows:

[0021] Based on the directed connections in the safety interlock state graph, obtain the sampling timestamps of the nodes at both ends of the connection, and compare the time and order of state changes of the nodes at both ends to form state transition entries.

[0022] The state transition entries are time-based baselines are defined according to logical interlocking relationships to form state transition benchmarks.

[0023] The timing deviation and state consistency of the state transition entries are compared with the state transition baseline to generate interlocking state deviations.

[0024] As a preferred embodiment of the SIS risk monitoring method based on safety interlocking state graphs described in this invention, the specific steps for generating bypass superposition states are as follows:

[0025] Filter out deviation records with bypass enabled status from the interlocking status deviations, locate the node number in the deviation record to the interlocking node in the safety interlocking status map, and continuously trace the associated connection along the directed connection corresponding to the interlocking node to form the bypass action path.

[0026] In the SIS interlocking operation record, find the sampling timestamps of each bypass state switching from normal state to bypass state and from bypass state back to normal state, respectively, and use them as the bypass occurrence time and bypass release time. The absolute value of the difference between the bypass occurrence time and the bypass release time is used as the bypass duration. The bypass duration is spatiotemporally correlated with the bypass action path to form the bypass spatiotemporal characteristics.

[0027] By performing path overlap and time overlap discrimination on the spatiotemporal features of bypasses, filtering out bypass states where the action paths overlap and the durations overlap, and performing spatiotemporal clustering to form bypass coupling results;

[0028] The bypass coupling results are topologically located to determine the superposition position and number of bypass states in the safety interlocking state map, and feature encoding is performed to generate bypass superposition states.

[0029] As a preferred embodiment of the SIS risk monitoring method based on safety interlock state graph described in this invention, the specific steps for generating interlock trigger integrity are as follows:

[0030] The directed connections in the safety interlock state graph are arranged sequentially according to the logical interlocking relationship. The pre-trigger state and post-trigger state of each directed connection are obtained, and the direction of state change is recorded to form a state transition item. The state transition items are arranged according to the arrangement order of the directed connections to generate the target transition sequence.

[0031] Match the signal hysteresis, execution deviation and state missing position in the interlocking state deviation with the state transition items in the target transition sequence one by one, record the state transition items that have deviated and the deviation type, and form a transition deviation sequence.

[0032] Map the superposition position and superposition quantity in the bypass superposition state to the target transition sequence, check whether the state transition items involved in the superposition position satisfy the logical interlocking relationship, remove the state transition items that do not satisfy the logical interlocking relationship, and form a valid transition sequence.

[0033] The number of state transitions in the effective transition sequence that did not experience interlocking state deviations is counted, and the ratio of the number of state transitions to the total number of state transitions in the target transition sequence is calculated to generate the interlocking trigger integrity.

[0034] As a preferred embodiment of the SIS risk monitoring method based on the safety interlocking state graph described in this invention, the specific steps for generating node health are as follows:

[0035] By using directed connections, state transition items in the effective transition sequence are assigned to associated nodes in the interlocking node set. The total number of state transition items associated with each node is counted. Similarly, state transition items in the transition deviation sequence are assigned to associated nodes in the interlocking node set. The number of state transition items that cause interlocking state deviations in each node is counted, thus forming the node deviation statistics.

[0036] The node migration integrity is calculated by using the node deviation statistics to determine the ratio of the number of state transition items for each node that have not experienced interlocking state deviations to the total number of associated state transition items.

[0037] The difference between node migration integrity and interlocking trigger integrity is used as node integrity deviation. Fault diagnosis information of each node is searched in the node status data. The node integrity deviation and fault diagnosis information are fused to form node health characteristics.

[0038] Rank mapping is performed on node health characteristics to generate node health scores.

[0039] As a preferred embodiment of the SIS risk monitoring method based on safety interlock state graphs described in this invention, the specific steps for generating the risk propagation path are as follows:

[0040] The integrity of the target migration sequence is screened based on the integrity of the interlock trigger to form an abnormal migration sequence. Based on the abnormal migration sequence, the state migration items that have interlock state deviations are screened in the migration deviation sequence. The interlock nodes associated with the state migration items are located along the directed connections in the safety interlock state map to form candidate abnormal nodes.

[0041] Candidate abnormal nodes are sorted by health status, and the sorted candidate abnormal nodes are then screened for health status to form a set of abnormal nodes.

[0042] Taking the abnormal node in the abnormal node set as the starting point of risk propagation, the nodes connected to the abnormal node are identified according to the connection direction of the directed connection in the safety interlocking state graph, and the next node is tracked along the connection direction of the directed connection until the directed connection terminates. The nodes are arranged according to the tracking order to form a candidate propagation sequence.

[0043] From the candidate propagation sequences, nodes and directed connections that have interlocking state deviations and nodes and directed connections that are affected by bypass superposition are selected respectively, and the paths are merged to generate risk propagation paths.

[0044] As a preferred embodiment of the SIS risk monitoring method based on safety interlocking state graphs described in this invention, the specific steps for generating SIS risk monitoring results are as follows:

[0045] The completeness of the interlocking trigger and the health of each abnormal node are traversed sequentially along the risk propagation path to form node risk parameters. The node risk parameters are then normalized and risk scores are generated to form a node risk score.

[0046] Calculate the average risk score of nodes in the same risk propagation path, and identify abnormal nodes whose risk scores are not lower than the average as risk nodes;

[0047] The node type and interlocking status deviation of the risk node are compared item by item with the applicable conditions recorded in the preset handling rules to form the risk handling result;

[0048] Based on the risk nodes, risk handling results are configured in the risk propagation path to generate SIS risk monitoring results.

[0049] Secondly, this invention provides a SIS risk monitoring system based on a safety interlock status graph, comprising:

[0050] The state graph module is used to collect safety interlock data of SIS, perform data registration, generate SIS interlock operation records, establish a safety interlock topology based on the SIS interlock operation records, perform state mapping on the safety interlock topology, and generate a safety interlock state graph.

[0051] The bypass overlay module is used to perform state transition analysis on the safety interlock state map, generate interlock state deviation, and perform spatiotemporal coupling analysis on the bypass state in the interlock state deviation to generate bypass overlay state. Based on the interlock state deviation and bypass overlay state, the module verifies the state transition integrity of the safety interlock state map and generates the interlock trigger integrity.

[0052] The node health module is used to evaluate the health status of each node in the safety interlock status graph based on the interlock trigger integrity and interlock status deviation, generate node health scores, screen abnormal nodes from the safety interlock status graph based on the interlock trigger integrity and node health scores, use abnormal nodes as the starting point for risk propagation, perform risk propagation analysis on the safety interlock status graph, and generate risk propagation paths.

[0053] The risk monitoring module is used to determine the risk coupling between the integrity of the interlocking trigger and the health of the nodes through the risk propagation path, identify risk nodes, match the risk nodes with the preset handling rules, and generate SIS risk monitoring results.

[0054] The beneficial effects of this invention are as follows: By performing feature encoding, bypass superposition states are generated, realizing a unified expression of the common action position, superposition quantity, and superposition relationship of multiple bypass states in the safety interlocking state map. This enables the originally independent bypass states to be correlated and analyzed according to the overlap of action paths and durations, accurately reflecting the degree of common action of multiple bypass states on the same interlocking link, and further clarifying the specific interlocking location where bypass superposition occurs and the number of bypasses involved. This improves the ability to identify weak points and potential risks in interlocking under complex bypass conditions, reduces the probability of risk omission caused by only independently monitoring a single bypass state and ignoring the simultaneous, continuous, and locally concentrated actions of multiple bypasses, and provides a reliable basis for subsequent interlocking trigger integrity verification, abnormal node screening, and risk propagation path analysis. Attached Figure Description

[0055] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 This is a flowchart of a SIS risk monitoring method based on a safety interlocking state graph.

[0057] Figure 2 A flowchart for generating SIS risk monitoring results.

[0058] Figure 3A flowchart for generating a safety interlocking state diagram.

[0059] Figure 4 A flowchart for generating interlocking trigger integrity. Detailed Implementation

[0060] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0061] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0062] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0063] Reference Figures 1-4 As one embodiment of the present invention, this embodiment provides a SIS risk monitoring method based on a safety interlocking state graph, comprising the following steps:

[0064] S1: Collect safety interlock data from SIS, perform data registration, generate SIS interlock operation records, establish a safety interlock topology based on the SIS interlock operation records, perform state mapping on the safety interlock topology, and generate a safety interlock state map.

[0065] S1.1: Collect input signals, logical interlocking relationships, output execution status, bypass status, and fault diagnosis information from the SIS to form safety interlocking data. Perform object matching on the safety interlocking data according to the logical interlocking relationships in the safety interlocking data to generate interlocking object association results. Based on the interlocking object association results, correct the sampling timestamp of the safety interlocking data, and arrange the safety interlocking data according to the corrected sampling timestamp to generate the SIS interlocking operation record.

[0066] Input signals are acquired from the input channels of the SIS controller. The input signals retain at least the input point name, signal value, and sampling timestamp. The signal value includes the status of switch quantities and the sampled value of analog quantities. Logic interlocking relationships are acquired from the logic configuration file stored in the SIS controller. The logic interlocking relationships record at least the names of the input points involved in the interlocking, the logic conditions between each input point, and the name of the output point to which the interlocking action points. The output execution status is obtained from the output channel of the SIS controller and the status feedback interface of the field execution device. The output execution status retains at least the output point name, output command status, execution feedback status, and sampling timestamp. The bypass status is obtained from the bypass operation record stored in the SIS controller. The bypass status retains at least the bypass object name, bypass enable status, and sampling timestamp. Fault diagnosis information is collected from the diagnostic register of the SIS controller. The fault diagnosis information retains at least the fault object name, fault code, fault status, and sampling timestamp. The sampling period of the input signal is set according to the actual scan period of the SIS controller. For example, when the scan period of the SIS controller is 100 milliseconds, the input signal is saved once every 100 milliseconds. The output execution status, bypass status, and fault diagnosis information are saved according to the sampling period when their respective statuses change. The logical interlock relationship is updated synchronously when the logical configuration changes. The data type, object name, status value, and sampling timestamp of the input signal, logical interlock relationship, output execution status, bypass status, and fault diagnosis information are retained to form safety interlock data.

[0067] Using the input point name and output point name recorded in the logical interlocking relationship as matching fields, the input point name is compared with the input signal in the safety interlocking data item by item, and the output point name is compared with the output execution status in the safety interlocking data item by item. Then, the bypass object name in the bypass status and the fault object name in the fault diagnosis information are compared with the input point name and output point name. Data with the same name are assigned to the same logical interlocking relationship, generating the interlocking object association result.

[0068] Based on the interlocking object association results, safety interlocking data belonging to the same logical interlocking relationship are placed under the same time reference. The sampling time recorded by the SIS controller is used as the correction reference. The time offset between the sampling timestamp of each safety interlocking data and the correction reference is compared. The sampling timestamp of each safety interlocking data is offset and corrected according to the time offset direction. This delays the sampling timestamps of early sampling timestamps towards the correction reference time and advances the sampling timestamps of late sampling timestamps towards the correction reference time, thus keeping the sampling timestamps of the safety interlocking data uniform. The input signals, output execution status, bypass status, and fault diagnosis information under the same logical interlocking relationship are arranged from earliest to latest according to the corrected sampling timestamps, and the corresponding logical interlocking relationships and object affiliation relationships are retained to generate the SIS interlocking operation record.

[0069] S1.2: According to the logical interlocking relationship in the SIS interlocking operation record, find the associated input signals and output execution states, and perform graph structure modeling on the logical interlocking relationship and the associated input signals and output execution states to form an interlocking node set; establish directed connections between nodes based on the interlocking node set and the logical interlocking relationship, and perform topology encoding on the directed connections to generate a safety interlocking topology.

[0070] According to the logical interlocking relationships in the SIS interlocking operation record, the input and output points involved in the interlocking are read one by one. Based on the input point, the input signal with the same point name is matched in the SIS interlocking operation record. Based on the output point, the output execution state with the same point name is matched. An interlocking node is established for each input signal, each logical interlocking relationship, and each output execution state. When the same input point or the same output point appears repeatedly in different logical interlocking relationships, the same interlocking node is used and no duplicate interlocking node is established, so that each interlocking node maintains a unique data object. The interlocking nodes are arranged according to the relationship between the input signal, the logical interlocking relationship, and the output execution state to form an interlocking node set.

[0071] Based on the set of interlocking nodes, directed connections are established between nodes according to the triggering order recorded in the logical interlocking relationships. The interlocking node containing the input signal is connected to the interlocking node containing the corresponding logical interlocking relationship. Simultaneously, the interlocking node containing the logical interlocking relationship is connected to the interlocking node containing the corresponding output execution state. When a logical interlocking relationship contains multiple input signals, directed connections are established from the interlocking nodes containing each input signal to the interlocking node containing the same logical interlocking relationship. When an output execution state participates in a subsequent logical interlocking relationship, corresponding directed connections are established according to the subsequent logical interlocking relationships, ensuring the directed connections... The direction is consistent with the interlocking trigger direction in the SIS interlocking operation record. Each interlocking node in the interlocking node set is configured with a unique node number according to the connection order of the directed connections. For each directed connection, the start node number and the end node number are recorded. Using the start node number as an index, the end node number is recorded sequentially according to the connection direction of the directed connection. When there are multiple directed connections to the same start node, the corresponding end node numbers are arranged according to the connection order in the logical interlocking relationship. This allows the connection direction and connection order between the input signal, the logical interlocking relationship, and the output execution state to be recovered based on the node number, generating a safe interlocking topology.

[0072] S1.3: Configure the attributes of the SIS interlocking operation records according to the interlocking node set to form node status data; perform logical state determination on the input signals in the node status data based on the logical interlocking relationship, map the determination result and node status data to the safety interlocking topology, and generate a safety interlocking status map.

[0073] Based on the unique node number and corresponding data object of each interlocking node in the interlocking node set, the records of the same data object are matched item by item in the SIS interlocking operation record. For the interlocking node where the input signal is located, the signal value, sampling timestamp, bypass status and fault diagnosis information of the input signal are configured. For the interlocking node where the logical interlocking relationship is located, the logical conditions recorded in the logical interlocking relationship and the input signals participating in the logical judgment are configured. For the interlocking node where the output execution status is located, the output execution status, sampling timestamp, bypass status and fault diagnosis information are configured, so that each interlocking node has the operation attributes corresponding to the SIS interlocking operation record, forming node status data.

[0074] Based on the logical conditions recorded in the logical interlocking relationship, input signals participating in the same logical interlocking relationship are obtained item by item from the node status data. For digital input signals, the valid state specified in the logical interlocking relationship is assigned a value of 1, and the invalid state is assigned a value of 0. For analog input signals, the actual sampled value of the input signal is compared with the trigger limit recorded in the logical interlocking relationship. If the logical condition is met, a value of 1 is assigned; otherwise, a value of 0 is assigned. The trigger limit adopts the interlocking setting value of the corresponding input signal in the original SIS logic configuration. For example, when the interlocking setting value of the pressure input signal is 1.60 MPa, the logical condition is that the pressure is greater than or equal to 1.60 MPa. Therefore, a value of 1 is assigned when the pressure reaches 1.60 MPa or higher, and 0 is assigned when the pressure is lower than 1.60 MPa. When the pressure is 0MPa, the value is assigned to 0. The Boolean values ​​of each input signal are processed according to the Boolean operation type and operation order recorded in the logical interlocking relationship. Specifically, the AND operation requires that all the Boolean values ​​of the input signals involved in the operation are 1, and outputs 1 when any input signal has a Boolean value of 0. The OR operation outputs 1 when at least one of the input signals involved in the operation has a Boolean value of 1, and outputs 0 when all Boolean values ​​are 0. The NOT operation converts the Boolean value of the input signal from 1 to 0 and converts the Boolean value of 0 to 1. For logical interlocking relationships containing multi-level logical conditions, the Boolean operation results are obtained level by level according to the order of operation recorded in the logical interlocking relationship. When the final Boolean operation result is 1, it is recorded as a triggered state. When the final Boolean operation result is 0, it is recorded as a non-triggered state, forming the judgment result.

[0075] Based on the unique node number in the interlocking node set, the node status data is configured to the interlocking nodes with the same unique node number in the safety interlocking topology, and the judgment result is configured to the interlocking node where the corresponding logical interlocking relationship is located. When there are node status data at multiple sampling times for the same interlocking node, the node status data is arranged from earliest to latest according to the sampling timestamp, so that the node where the input signal is located, the node where the logical interlocking relationship is located, and the node where the output execution state is located in the safety interlocking topology retain the corresponding operating state and state change sequence, and a safety interlocking state map is generated.

[0076] S2: Perform state transition analysis on the safety interlock state map to generate interlock state deviation, and perform spatiotemporal coupling analysis on the bypass state in the interlock state deviation to generate bypass superimposed state. Verify the state transition integrity of the safety interlock state map based on the interlock state deviation and bypass superimposed state, and generate the interlock trigger integrity.

[0077] S2.1: Obtain the sampling timestamps of the nodes at both ends of the connection based on the directed connection in the safety interlock state diagram, and compare the time and order of state changes of the nodes at both ends to form state transition entries; perform time-series baseline calibration on the state transition entries according to the logical interlock relationship to form a state transition benchmark; compare the time-series deviation and state consistency of the state transition entries with the state transition benchmark to generate interlock state deviation.

[0078] According to the connection direction of the directed connection in the safety interlocking state diagram, the sampling timestamps and node states of the two ends of each directed connection are obtained continuously. The node states of the same node at two adjacent sampling times are compared. When the node state at the later sampling time is different from the node state at the previous sampling time, the later sampling time is taken as the node state change time. When the node states at two adjacent sampling times are consistent, the state change time is not recorded. The state change times of the two ends of the node are compared according to the connection direction of the directed connection. The difference between the state change times of the upstream node and the downstream node is taken as the response time of the adjacent node. The state change time of the two ends of the node is recorded. When the state change time of the downstream node is later than that of the upstream node, it is recorded as a positive migration. When the downstream node does not change its state, it is recorded as no migration. The state migration entry is composed of the two ends of the directed connection, the state change time, the response time, the state change direction, and the state migration result.

[0079] State transition entries belonging to the same directed connection are grouped into the same comparison range according to logical interlocking relationships. From these entries, those with a normal bypass state, no recorded fault diagnosis information, and whose input signals, logical states, and output execution states conform to the logical interlocking relationship are retained. The response times of adjacent nodes in the retained state transition entries are collected, and the average response time is used as the baseline response time. The maximum value among the retained response times is used as the upper limit of the allowed response time. Simultaneously, the direction of state change during normal triggering and the state after triggering are recorded according to the logical interlocking relationship. The baseline response time, the upper limit of the allowed response time, the direction of state change, and the state after triggering form the state transition base. For example, if the response time of the same directed connection in 10 normal interlocking triggers is between 80 and 120 milliseconds, then the average of the 10 response times is used as the baseline response time, and 120 milliseconds is used as the upper limit of the allowed response time. The specific value is determined based on the normal interlocking trigger results in the SIS interlocking operation record.

[0080] The state transition entries to be analyzed are compared item by item with the state transition benchmarks of the same logical interlocking relationship and the same directed connection. When the downstream node in the state transition entry completes the state change in accordance with the state change direction specified by the state transition benchmark, but the response time of the adjacent node is greater than the upper limit of the allowed response time, it is determined that there is signal hysteresis in the corresponding directed connection. When the response time of the adjacent node does not exceed the upper limit of the allowed response time, and the state change direction and the state after triggering of the downstream node are consistent with the state transition benchmark, the state transition is determined to be normal, and no interlocking state deviation is recorded. When the upstream node has reached the triggering state specified by the logical interlocking relationship, and the downstream node changes state within the upper limit of the allowed response time, but the state change direction or the state after triggering of the downstream node is inconsistent with the state transition benchmark, it is determined that there is execution deviation. When the upstream node has reached the triggering state specified by the logical interlocking relationship, and the downstream node has not changed state after the upper limit of the allowed response time, it is determined that there is state missing. According to the position of the directed connection where the deviation occurs, the signal hysteresis, execution deviation, and state missing are recorded respectively, and the state change time, response time, and state change result in the corresponding state transition entry are retained to generate interlocking state deviation.

[0081] S2.2: Select deviation records with bypass enabled status from the interlocking status deviations, locate the node number in the deviation record to the interlocking node in the safety interlocking status map, and continuously trace the associated connection along the directed connection corresponding to the interlocking node to form the bypass action path.

[0082] Each deviation record in the interlocking state deviation retains the unique node number of the node where the deviation occurred, the time of the deviation occurrence, and the bypass activation status in the node status data. The bypass activation status in the interlocking state deviation is checked line by line. If the bypass activation status is active, the corresponding deviation record is retained. If the bypass activation status is normal, it is not considered a bypass status and is not included in subsequent processing. If there are duplicate records for the same unique node number under the same sampling timestamp, only one record is retained. Records that continuously maintain the bypass activation status under different sampling timestamps are retained in chronological order for subsequent determination of the bypass status duration. The retained unique node number is then used to determine the duration of the bypass status. The node number is compared item by item with the unique node number of the interlocking node set in the safety interlocking state map. The interlocking node with the same number is taken as the interlocking node in the bypass state. According to the topology code in the safety interlocking state map, the directed connection with the unique node number of the interlocking node in the bypass state as the starting node number is read. If there is one directed connection, the next connected interlocking node is entered along the directed connection. If there are two or more directed connections, the next connected interlocking node is entered according to the order of the directed connections in the topology code, so that the connection relationship extending to different interlocking branches can be preserved for the same bypass state.

[0083] The existing depth-first traversal method is used to continuously trace along the connection direction of the directed connection. The depth-first traversal method is used to continuously visit reachable nodes from a specified starting node in the graph structure along the connection edge. The interlocking node where the bypass state is located is used as the starting node, and the directed connection in the safety interlocking state graph is used as the traversal direction. Each time a new interlocking node is entered, the directed connection with the entered interlocking node as the starting node is read, and the next interlocking node is entered along the directed connection. When there are multiple directed connections extending downstream in the entered interlocking node, the first directed connection in the topology encoding is continuously traced until the connection ends, and then the interlocking node that generated the branch is returned, and the next directed connection is continued to be traced. When an interlocking node is encountered that has been visited in the same traversal process, the traversal along the corresponding directed connection is stopped to avoid repeatedly passing through the same interlocking node.

[0084] When a directed connection reaches an interlocking node that does not have a downstream directed connection, the tracking of the corresponding branch is terminated. When the interlocking node where the bypass state is located does not have a downstream directed connection, the tracking is terminated at the interlocking node where the bypass state is located. According to the order of the interlocking nodes and directed connections actually passed by each branch, the directed connections between the interlocking node where the bypass state is located, the interlocking nodes along the way, the terminating interlocking node, and the adjacent interlocking nodes are retained, so that each record represents the range of connections that the bypass state can affect downstream from the interlocking node where it is located, forming the bypass action path.

[0085] S2.3: In the SIS interlocking operation record, find the sampling timestamps of each bypass state switching from normal state to bypass state and from bypass state back to normal state, respectively, and use them as the bypass occurrence time and bypass release time. Take the absolute value of the difference between the bypass occurrence time and bypass release time as the bypass duration, and associate the bypass duration with the bypass action path in time and space to form the bypass time and space characteristics.

[0086] According to the corrected sampling timestamps in the SIS interlocking operation record, the bypass activation states corresponding to the same bypass state are arranged from earliest to latest. The bypass activation states of adjacent sampling times are compared one by one. When the previous sampling time is in the normal state and the next sampling time is in the bypass state, the sampling timestamp of the next sampling time is taken as the bypass occurrence time. When the previous sampling time is in the bypass state and the next sampling time returns to the normal state, the sampling timestamp of the next sampling time is taken as the bypass deactivation time. The bypass occurrence time of the same bypass state is grouped with the first bypass deactivation time that appears afterward according to the time sequence, so that each bypass activation has a corresponding start time and end time.

[0087] Obtain the time values ​​of the bypass occurrence and bypass deactivation times for each group, calculate the absolute value of the difference between the bypass occurrence and deactivation times, and use the result as the bypass duration. The bypass occurrence and deactivation times are calculated using the same time unit; for example, if the sampling timestamp is recorded in milliseconds, the bypass duration is expressed in milliseconds. When the same bypass state has multiple activations and deactivations, calculate the bypass duration corresponding to each bypass activation in the order of the bypass occurrence times, without merging adjacent bypass activations. Utilize the unique node of the interlocking node where the bypass state is located. Point numbering is used to locate bypass action paths with the same unique node number as the starting node in the bypass action path. The bypass occurrence time, bypass cancellation time, and bypass duration are configured to the corresponding bypass action path. When the bypass state corresponds to multiple downstream bypass action paths, the bypass occurrence time, bypass cancellation time, and bypass duration of the same bypass activation are configured to each bypass action path respectively. The interlocking nodes and directed connections passed through by each bypass action path are retained, so that each bypass action path has both topological action range and time duration range, forming the bypass spatiotemporal characteristics.

[0088] S2.4: Perform path overlap and time overlap discrimination on the spatiotemporal features of the bypass, filter out bypass states where the action paths overlap and the durations overlap, and perform spatiotemporal clustering to form bypass coupling results.

[0089] The bypass action path, bypass occurrence time, and bypass release time corresponding to each bypass state are read from the bypass spatiotemporal features. Based on the interlocking nodes and directed connections recorded in the bypass action path, the bypass action paths of different bypass states are compared pairwise. If two bypass action paths have directed connections with the same start and end node numbers, it is determined that the two bypass action paths overlap, and the location of the same directed connection is recorded. If two bypass action paths do not have the same directed connection, it is determined that the two bypass action paths do not overlap and are not included in subsequent time overlap determination. For two bypass action paths that overlap... For each bypass state, compare the bypass occurrence time and bypass deactivation time of the two bypass states. Take the later of the two bypass occurrence times as the overlap start time and the earlier of the two bypass deactivation times as the overlap end time. If the overlap end time is later than the overlap start time, it means that the two bypass states are simultaneously maintaining the bypass state on the same action path, and it is determined that the duration overlaps. If the overlap end time is not later than the overlap start time, it is determined that the duration does not overlap. Retain the bypass states that simultaneously satisfy path overlap and duration overlap, and record the corresponding overlapping directed connection, overlap start time, and overlap end time.

[0090] The objects are divided into interconnected sets according to their connection relationships. Each retained bypass state is treated as a clustering object. The connection condition is that two bypass states simultaneously satisfy the conditions of path overlap and duration overlap. Starting from any bypass state that has not yet been grouped, other bypass states that satisfy the connection condition with the bypass state are grouped into the same group. The remaining bypass states are then checked with the newly grouped bypass states until no new bypass states satisfy the connection condition. The process is repeated with the remaining bypass states that have not yet been grouped until all retained bypass states are grouped.

[0091] The bypass states within the same group are arranged from earliest to latest according to the time of bypass occurrence. The bypass action path, overlapping directed connection, bypass occurrence time, bypass release time, and time overlap range corresponding to each bypass state are retained. Records containing only one bypass state and not simultaneously satisfying the path overlap and duration overlap with other bypass states are not considered as bypass coupling objects. The bypass coupling result is formed by groups containing two or more bypass states.

[0092] S2.5: Perform topology positioning on the bypass coupling results, determine the superposition position and number of superpositions of the bypass state in the safety interlocking state map, and perform feature encoding to generate the bypass superposition state.

[0093] Based on the overlapping directed connections recorded in the bypass coupling results, the start and end node numbers of the directed connections are compared in the safety interlocking state map. The location of the directed connection with the same number is taken as the location where the bypass states act together. When the same bypass coupling result contains multiple consecutive overlapping directed connections, the corresponding positions are recorded consecutively according to the connection order of the directed connections, forming the superposition position of the bypass states in the safety interlocking state map. Each superposition position is used as a statistical object to count the number of bypass states that act on the same superposition position and whose durations overlap. For example, when the same directed connection is simultaneously acted on by three bypass states within the overlapping range at the same time, the superposition number of the corresponding superposition position is recorded as 3. When different bypass states pass through the same directed connection but their durations do not overlap, they are not included in the same superposition count. When there are multiple superposition positions, the superposition number of each superposition position is counted separately, so that each superposition position has a corresponding number of bypass state superpositions.

[0094] By using the topological coding order in the safety interlocking status map, the starting node number, ending node number, number of stacks, time of bypass occurrence, and time of bypass release are recorded sequentially for each stacking position. When there are multiple bypass stacks at the same stacking position, the corresponding records are arranged from earliest to latest according to the time of bypass occurrence, so that the stacking position, number of stacks, and occurrence time are in one-to-one correspondence, thus generating the bypass stacking status.

[0095] S2.6: Arrange the directed connections in the safety interlock state graph according to the logical interlock relationship, obtain the pre-trigger state and post-trigger state of each directed connection, record the direction of state change, form state transition items, arrange the state transition items according to the arrangement order of the directed connections, and generate the target transition sequence.

[0096] Based on the triggering sequence of input signals, logical conditions, and output execution states in the logical interlocking relationship, verify the starting node number and ending node number of each directed connection in the safety interlocking state diagram. Directed connections from the interlocking node where the input signal is located to the interlocking node where the logical interlocking relationship is located are arranged first, followed by directed connections from the interlocking node where the logical interlocking relationship is located to the interlocking node where the output execution state is located. When the output execution state continues to participate in the next logical interlocking relationship, the connections continue to be arranged backward according to the connection direction of the directed connections in the safety interlocking topology. When multiple input signals participate in the same logical interlocking relationship, the corresponding directed connections are arranged according to the topology code recorded in the safety interlocking topology, so that each logical interlocking relationship forms a connection sequence from the input signal to the logical interlocking relationship and then to the output execution state.

[0097] Based on the arranged directed connections, obtain the node states of the start node and the end node before and after the state change. For the start node, the node state recorded at the last sampling moment before the state change is taken as the pre-trigger state, and the node state recorded at the first sampling moment after the state change is taken as the post-trigger state. For the end node, obtain the node states before and after the response in the same way. When the node state changes from an untriggered state to a triggered state, the state change direction is recorded as a positive change; when it recovers from a triggered state to an untriggered state, the state change direction is recorded as a negative change. If the node state does not change in consecutive adjacent sampling moments, it is recorded as a positive change. For each directed connection, the starting node number, ending node number, pre-trigger state, post-trigger state, and state change direction are recorded in the same entry to form a state transition item. For example, when the interlocking node containing the input signal changes from a non-triggered state to a triggered state, and subsequently the interlocking node containing the logical interlocking relationship changes from a non-triggered state to a triggered state, the corresponding state transition item records the positive change from a non-triggered state to a triggered state between the two interlocking nodes. When the interlocking node containing the logical interlocking relationship has been triggered but the interlocking node containing the output execution state remains in its original state, the corresponding state transition item records the state retention of the interlocking node containing the output execution state.

[0098] The state transition items are arranged sequentially according to the directed connection order determined in the first segment. When the same logical interlocking relationship contains multiple input branches, the state transition items of each input branch are arranged first according to the topology code, and then the state transition items pointing to the output execution state of the logical interlocking relationship are arranged. When there are continuous logical interlocking relationships, the state transition items are arranged backward along the directed connection order in the safety interlocking topology so that the arrangement order of the state transition items is consistent with the normal interlocking trigger order in the safety interlocking state graph, thus generating the target transition sequence.

[0099] S2.7: Match the signal hysteresis, execution deviation and state missing position in the interlocking state deviation with the state transition items in the target transition sequence one by one, record the state transition items with deviation and the deviation type, and form a transition deviation sequence.

[0100] According to the order of state transition items in the target transition sequence, the starting node number, ending node number, pre-trigger state, post-trigger state, and state change direction of each state transition item are obtained one by one. The directed connection positions recorded at the signal hysteresis, execution deviation, and state missing positions in the interlocking state deviation are also obtained. The starting node number and ending node number in the directed connection position are compared with the starting node number and ending node number in the state transition item, respectively. When the two node numbers are consistent, the interlocking state deviation is located to the corresponding state transition item. When any node number is inconsistent, the comparison continues with the next state transition item in the target transition sequence.

[0101] For signal hysteresis that leads to a state transition item, check the state change direction recorded in the interlock state deviation against the state change direction in the state transition item. If the state change direction is consistent and the response time exceeds the upper limit of the allowable response time in the state transition benchmark, record the deviation type as signal hysteresis in the corresponding state transition item. For execution deviation, check the post-trigger state recorded in the interlock state deviation against the post-trigger state in the state transition item. If the post-trigger state is inconsistent, record the deviation type as execution deviation in the corresponding state transition item. For a state missing position, if the starting node in the state transition item has reached the trigger state, but the ending node has not changed its state within the upper limit of the allowable response time, record the deviation type as state missing in the corresponding state transition item.

[0102] When the same state transition item simultaneously meets two or more interlocking state deviation judgment conditions, the corresponding deviation type is retained in the same state transition item, and the state transition item is not repeatedly created. State transition items that do not match the signal hysteresis, execution deviation, and state missing position are not regarded as state transition items with deviations. According to the original state transition item arrangement order in the target transition sequence, the state transition items with deviations and their corresponding deviation types are arranged in sequence to form a transition deviation sequence.

[0103] S2.8: Map the overlay position and overlay quantity in the bypass overlay state to the target transition sequence, check whether the state transition items involved in the overlay position satisfy the logical interlocking relationship, remove the state transition items that do not satisfy the logical interlocking relationship, and form a valid transition sequence; count the number of state transition items in the valid transition sequence that have not experienced interlocking state deviation, calculate the ratio of the number of state transition items to the total number of state transition items in the target transition sequence, and generate the interlocking trigger integrity.

[0104] Read the start node number, end node number, and stacking quantity recorded at each stacking position in the bypass stacking state. Compare the start node number and end node number with the start node number and end node number recorded in each state transition item in the target transition sequence. If both node numbers match, configure the corresponding stacking quantity to the state transition item. If the two node numbers do not match, continue comparing to the next state transition item to ensure that the stacking position in the bypass stacking state is assigned to a specific state transition item in the target transition sequence. For state transition items without configured stacking quantities, retain the corresponding state transition item. For state transition items with configured stacking quantities, call the same start node and end node. For the corresponding logical interlocking relationship, compare the pre-trigger state, post-trigger state, and state change direction recorded in the state transition item with the triggering conditions specified by the logical interlocking relationship. If the pre-trigger state meets the triggering conditions specified by the logical interlocking relationship, and the post-trigger state and state change direction conform to the interlocking action specified by the logical interlocking relationship, the corresponding state transition item is retained. If the pre-trigger state has met the triggering conditions, but the post-trigger state has not reached the state specified by the logical interlocking relationship, or the state change direction is inconsistent with the interlocking action specified by the logical interlocking relationship, the corresponding state transition item is removed. The state transition items retained after verification are kept in the original order of the target transition sequence to form a valid transition sequence.

[0105] The state transition items in the valid transition sequence are checked using the transition deviation sequence. If neither the start node number nor the end node number of a state transition item in the valid transition sequence appears in the transition deviation sequence, it is recorded as no interlocking state deviation has occurred. If the same start node number and end node number exist in the transition deviation sequence, it is recorded as an interlocking state deviation has occurred. The number of state transition items that have not experienced interlocking state deviation is counted, and the total number of state transition items in the target transition sequence is also counted. The interlocking trigger integrity is calculated as the ratio of the number of state transition items that have not experienced interlocking state deviation to the total number of state transition items in the target transition sequence. The interlocking trigger integrity is a dimensionless value, ranging from 0 to 1. For example, if the target transition sequence contains 20 state transition items, and after bypass overlay verification, 15 state transition items have not experienced interlocking state deviation, then the interlocking trigger integrity is 15 / 20, or 0.75. The interlocking trigger integrity is then generated.

[0106] S3: Evaluate the health status of each node in the safety interlock status map based on the interlock trigger integrity and interlock status deviation, generate node health, screen abnormal nodes from the safety interlock status map based on the interlock trigger integrity and node health, use abnormal nodes as the starting point of risk propagation, perform risk propagation analysis on the safety interlock status map, and generate risk propagation paths.

[0107] S3.1: Assign state transition items in the valid transition sequence to associated nodes in the interlocking node set through directed connections, count the total number of associated state transition items for each node, and assign state transition items in the transition deviation sequence to associated nodes in the interlocking node set. Count the number of state transition items with interlocking state deviations for each node to form node deviation statistics. Calculate the ratio of the number of state transition items without interlocking state deviations to the total number of associated state transition items using the node deviation statistics to form the node transition completeness.

[0108] Obtain the start node number and end node number of each state transition item in the valid transition sequence. Compare the start node number and end node number with the unique node number in the interlocking node set item by item. When the node numbers match, register the corresponding state transition item to the interlocking node with the same unique node number. When the same state transition item involves both the start node and the end node, count them as associated state transition items of the start node and the end node respectively. Use the position of the state transition item in the valid transition sequence as the distinguishing criterion to avoid the same state transition item being counted repeatedly under the same interlocking node. The number of state transition items registered at each interlocking node is counted one by one to obtain the total number of state transition items associated with each node. Each state transition item in the transition deviation sequence that has an interlocking state deviation is obtained and compared with the unique node number in the interlocking node set using the same start node number and end node number. State transition items involving signal hysteresis, execution deviation, and state missing are registered to the corresponding interlocking node. When the same state transition item records multiple deviation types at the same time, it is counted as a state transition item with an interlocking state deviation under the corresponding interlocking node. At the same time, all deviation types are retained to avoid double counting due to the number of deviation types. The number of state transition items with interlocking state deviation in each interlocking node is counted and recorded one by one with the total number of state transition items associated with each node to form the node deviation statistics result.

[0109] The total number of state transition items associated with each interlocking node and the number of state transition items that experienced interlocking state deviations are obtained from the node deviation statistics. The difference between the two is the number of state transition items that did not experience interlocking state deviations. The node migration integrity is calculated as the ratio of the number of state transition items that did not experience interlocking state deviations to the total number of associated state transition items. For example, if an interlocking node is associated with 8 state transition items, and 2 of them experience interlocking state deviations, then the number of state transition items that did not experience interlocking state deviations is 6, and the node migration integrity is 6 / 8, or 0.75. The node migration integrity is a dimensionless value, ranging from 0 to 1. The closer the value is to 1, the more complete the state transition process associated with the corresponding interlocking node is, thus forming the node migration integrity.

[0110] S3.2: The difference between node migration integrity and interlocking trigger integrity is used as node integrity deviation. Fault diagnosis information of each node is searched in the node status data. The node integrity deviation and fault diagnosis information are fused to form node health features. The node health features are then mapped to levels to generate node health.

[0111] Obtain the node migration integrity and the interlocking trigger integrity corresponding to the same target migration sequence for each interlocking node. Calculate the difference between the node migration integrity and the interlocking trigger integrity. Both the node migration integrity and the interlocking trigger integrity are dimensionless values ​​between 0 and 1. Therefore, the node integrity deviation ranges from -1 to 1. When the node integrity deviation is less than 0, it indicates that the state migration integrity of the corresponding interlocking node is lower than the overall integrity of the interlocking trigger process. When the node integrity deviation is equal to 0, it indicates that the two are consistent. When the node integrity deviation is greater than 0, it indicates that the state migration integrity of the corresponding interlocking node is higher than the overall integrity. For example, when the node migration integrity is 0.75 and the interlocking trigger integrity is 0.90, the node integrity deviation is -0.15.

[0112] Using the unique node number of the interlocking node and the sampling time range covered by the target migration sequence as indexes, fault diagnosis information corresponding to the same unique node number is obtained from the node status data. The fault code, fault status, and fault occurrence time from the fault diagnosis information are retained. When multiple fault diagnosis information entries exist within the sampling time range covered by the target migration sequence, each entry is retained and arranged according to the fault occurrence time. When no fault diagnosis information is recorded, the corresponding interlocking node is recorded as having no fault diagnosis information. The node integrity deviation of the same interlocking node is used as a continuous numerical field, and the fault code and fault status from the fault diagnosis information are used as discrete status fields. The unique node number maintains a one-to-one correspondence between the two types of fields, forming node health characteristics. The mapping boundary of the health level is determined based on the normal node integrity deviation range recorded during SIS operation and maintenance. For example, the unified... For interlocking nodes that are operating normally and have not recorded fault diagnosis information, if the node integrity deviation is mainly distributed between -0.05 and 0.05, -0.05 is taken as the lower limit of normal fluctuation. When the node integrity deviation is not lower than -0.05 and no fault diagnosis information is recorded, it is mapped to the normal health level. When the node integrity deviation is lower than -0.05 and no fault diagnosis information is recorded, it is mapped to the health level of concern. When the node integrity deviation is lower than -0.05 and fault diagnosis information exists, it is mapped to the abnormal health level. When fault diagnosis information exists and the fault state continues until the end of the target migration sequence, it is mapped to the severe abnormal health level. The normal health level, the health level of concern, the abnormal health level, and the severe abnormal health level are assigned node health scores from high to low, for example, assigned values ​​of 1.00, 0.75, 0.50, and 0.25 respectively, to generate the node health score.

[0113] S3.3: Based on the integrity of the interlock trigger, the target migration sequence is screened for completeness to form an abnormal migration sequence. Based on the abnormal migration sequence, the state migration items that have interlock state deviations are screened in the migration deviation sequence. The interlock nodes associated with the state migration items are located along the directed connections in the safety interlock state map to form candidate abnormal nodes.

[0114] Obtain the interlocking trigger integrity of each target migration sequence, and use the lowest interlocking trigger integrity of the target migration sequence confirmed to be normal in the SIS operation and maintenance record as the lower limit of integrity. When the interlocking trigger integrity is lower than the lower limit of integrity, the corresponding target migration sequence is retained. When the interlocking trigger integrity is not lower than the lower limit of integrity, it is not included in the subsequent anomaly analysis. The retained target migration sequences are formed into anomaly migration sequences. Read the start node number and end node number of each state migration item in the anomaly migration sequence, and compare them item by item with the start node number and end node number of the state migration item in the migration deviation sequence. When the two node numbers are consistent, retain the corresponding state migration item and the recorded signal hysteresis, execution deviation or state missing. When the node numbers are inconsistent, do not retain them.

[0115] By using the start and end node numbers of the retained state transition items, interlocking nodes with the same unique node number are located in the safety interlocking state graph. Then, along the two ends of the interlocking nodes involved in the corresponding directed connection record state transition item, duplicate interlocking nodes are removed to form candidate abnormal nodes.

[0116] S3.4: Sort candidate abnormal nodes according to their health status, and screen the health status of the sorted candidate abnormal nodes to form an abnormal node set; take the abnormal nodes in the abnormal node set as the starting point of risk propagation, identify the nodes connected to the abnormal nodes according to the connection direction of the directed connection in the safety interlocking status graph, and continue to track the next node along the connection direction of the directed connection until the directed connection terminates. Arrange the nodes according to the tracking order to form a candidate propagation sequence.

[0117] Sort the node health of candidate abnormal nodes from low to high, call the health level corresponding to the node health level, retain the candidate abnormal nodes corresponding to the health level of concern, abnormal health level and severe abnormal health level, and remove the candidate abnormal nodes corresponding to the normal health level. If the same node appears repeatedly, it is only retained once, and the order of node health from low to high is maintained to form a set of abnormal nodes.

[0118] Each abnormal node in the abnormal node set is used as the starting point for risk propagation. The system traces downstream nodes level by level along the directed connections in the safety interlocking state graph. When the current node has only one downstream directed connection, the system enters the connected node. When there are multiple downstream directed connections, the system continues to trace along each directed connection. When the system reaches a node that has no downstream directed connection, the system stops tracing the corresponding path. Nodes that have already been passed are not entered again to avoid repeated propagation. The starting point and subsequent nodes of risk propagation are arranged according to the order in which each propagation branch actually passes through the nodes. Directed connections between adjacent nodes are preserved. When an abnormal node forms multiple propagation branches, each propagation branch is recorded to form a candidate propagation sequence.

[0119] S3.5: Select nodes and directed connections that have interlocking state deviations and nodes and directed connections that are affected by bypass superposition from the candidate propagation sequences, and merge the paths to generate risk propagation paths.

[0120] Obtain the unique node number of each node in the candidate propagation sequence, as well as the starting and ending node numbers of directed connections between adjacent nodes. Compare each node with the state transition items in the migration deviation sequence that have interlocking state deviations. If the node number and the numbers at both ends of the directed connection are consistent, retain the corresponding node and directed connection, and record the corresponding deviation type in signal hysteresis, execution deviation, and state loss. Compare each node and directed connection in the candidate propagation sequence with the superposition position in the bypass superposition state. If the starting and ending node numbers of the superposition position are consistent with the directed connection in the candidate propagation sequence, retain the corresponding node and directed connection, and record the superposition quantity. Do not record the bypass superposition effect for nodes and directed connections that are not in the superposition position. Return the nodes and directed connections that have interlocking state deviations, as well as the nodes and directed connections affected by bypass superposition, to their original positions in the candidate propagation sequence. If the same node or directed connection belongs to both types of results, retain it only once. If the two types of results are in the same propagation branch, retain the nodes and directed connections used to maintain the continuity of the connection between the two types of results, and arrange them continuously according to the connection order in the candidate propagation sequence to generate a risk propagation path.

[0121] S4: By analyzing the risk propagation path, risk coupling judgment is performed on the integrity of interlocking triggers and the health of nodes to identify risk nodes. The risk nodes are then matched with preset handling rules to generate SIS risk monitoring results.

[0122] S4.1: Iterate through the interlocking trigger integrity and node health of each abnormal node along the risk propagation path to form node risk parameters. Normalize the node risk parameters and perform risk scoring to form node risk scores. Calculate the average value of node risk scores in the same risk propagation path and identify abnormal nodes with node risk scores not lower than the average value as risk nodes.

[0123] The node health of each abnormal node is obtained sequentially along the risk propagation path, and the interlocking trigger integrity of the target migration sequence corresponding to the interlocking process to which the abnormal node belongs is obtained. The interlocking trigger integrity and node health are combined to form the node risk parameter. Since the values ​​of interlocking trigger integrity and node health are both 0 to 1, and the larger the value, the more complete the interlocking triggering process and the higher the node health, in order to keep the change direction of the node risk parameter consistent with the risk level, the interlocking trigger integrity and node health are reverse normalized.

[0124] The inverse normalized expressions for interlock trigger integrity and node health are:

[0125] ;

[0126] ;

[0127] in, For the first The inverse normalized value of the interlocking trigger integrity of each abnormal node. For the first The inversely normalized value of the node health of each abnormal node. For the first The completeness of the interlocking triggering of the target migration sequence corresponding to the interlocking process of each abnormal node. For the first The node health of each abnormal node. This refers to the sequence number of abnormal nodes within the same risk propagation path. , and All values ​​are dimensionless and range from 0 to 1. The larger the inverse normalization value, the higher the corresponding risk level.

[0128] The node risk score is calculated by weighting the inverse normalized value of the interlocking trigger integrity and the inverse normalized value of the node health. The expression for the node risk score is as follows:

[0129] ;

[0130] in, For the first Node risk score for each abnormal node. The scoring weights corresponding to the integrity of the interlocking trigger. The scoring weights corresponding to node health. and The values ​​of are all in the range of 0 to 1, and and The sum is 1, when the interlocking trigger integrity and node health have the same risk priority. and If both are set to 0.5, and there is a clear risk priority, the scoring weight of the corresponding parameters can be increased according to the SIS operation and maintenance requirements, while keeping the sum of the two scoring weights at 1. It is a dimensionless numerical value, ranging from 0 to 1. The larger the value, the higher the risk level of the abnormal node.

[0131] The expression for the average risk score of nodes in the same risk propagation path is:

[0132] ;

[0133] in, This represents the average risk score of nodes along the same risk propagation path. This represents the total number of abnormal nodes along the same risk propagation path, expressed in units of individual nodes.

[0134] The node risk score of each abnormal node is compared with the average node risk score. If the node risk score is not lower than the average node risk score, the corresponding abnormal node is identified as a risk node. If the node risk score is lower than the average node risk score, the risk propagation relationship of the corresponding abnormal node is retained, and the corresponding abnormal node is not identified as a risk node.

[0135] S4.2: Compare the node type and interlocking status deviation of the risk node with the applicable conditions recorded in the preset handling rules to form a risk handling result; based on the risk node's configuration of the risk handling result in the risk propagation path, generate SIS risk monitoring results.

[0136] Based on the SIS design documents, interlocking causality matrix, and operation and maintenance procedures, handling rules are set. The node where the input signal is located, the node where the logical interlocking relationship is located, and the node where the output execution status is located are defined as node types. Signal hysteresis, execution deviation, and status loss are defined as interlocking status deviation types. Corresponding handling content is configured for different combinations of node types and interlocking status deviation types. For example, when signal hysteresis occurs at the node where the input signal is located, the handling content is set to check the source of the input signal and the acquisition channel. When execution deviation occurs at the node where the output execution status is located, the handling content is set to check the output command, execution feedback, and the status of the field execution equipment. The handling rules are composed of node type, interlocking status deviation type, and handling content.

[0137] Obtain the node type and interlocking state deviation of the risk node. First, compare it with the node type in the handling rules item by item. Then, compare the interlocking state deviation type in the preset handling rules with the same node type. When both are consistent, call the handling content recorded in the corresponding handling rules to form the risk handling result. When there are multiple interlocking state deviations for the same risk node, call the corresponding handling content respectively and retain the risk handling result according to the deviation type corresponding to the risk node.

[0138] The location of a risk node in the risk propagation path and safety interlock status map is determined by using the unique node number of the risk node. The risk node, interlock status deviation, risk propagation path and risk handling result are configured according to the same unique node number to generate SIS risk monitoring results.

[0139] This embodiment also provides a SIS risk monitoring system based on a safety interlock status graph, including:

[0140] The state graph module is used to collect safety interlock data of SIS, perform data registration, generate SIS interlock operation records, establish a safety interlock topology based on the SIS interlock operation records, perform state mapping on the safety interlock topology, and generate a safety interlock state graph.

[0141] The bypass overlay module is used to perform state transition analysis on the safety interlock state map, generate interlock state deviation, and perform spatiotemporal coupling analysis on the bypass state in the interlock state deviation to generate bypass overlay state. Based on the interlock state deviation and bypass overlay state, the module verifies the state transition integrity of the safety interlock state map and generates the interlock trigger integrity.

[0142] The node health module is used to evaluate the health status of each node in the safety interlock status graph based on the interlock trigger integrity and interlock status deviation, generate node health scores, screen abnormal nodes from the safety interlock status graph based on the interlock trigger integrity and node health scores, use abnormal nodes as the starting point for risk propagation, perform risk propagation analysis on the safety interlock status graph, and generate risk propagation paths.

[0143] The risk monitoring module is used to determine the risk coupling between the integrity of the interlocking trigger and the health of the nodes through the risk propagation path, identify risk nodes, match the risk nodes with the preset handling rules, and generate SIS risk monitoring results.

[0144] This embodiment also provides a computer device applicable to the SIS risk monitoring method based on the safety interlock state graph, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the SIS risk monitoring method based on the safety interlock state graph proposed in the above embodiment.

[0145] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0146] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the SIS risk monitoring method based on a security interlock state map as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0147] In summary, this invention constructs a safety interlocking state map, unifying input signals, logical interlocking relationships, output execution states, bypass states, and fault diagnosis information in the SIS into the interlocking link. It then sequentially analyzes interlocking state deviations, bypass superposition states, interlocking trigger integrity, and node health. Furthermore, it identifies the risk propagation path of abnormal nodes along directed connections and determines risk nodes. This transforms the SIS operational risk from single-point anomaly identification to a correlated monitoring of interlocking relationships, state transitions, bypass superposition, and risk propagation. It improves the ability to locate abnormal nodes and identify the scope of risk impact, reducing the possibility of missing local anomalies and bypass superposition risks due to fragmented monitoring. Ultimately, it achieves the goal of risk monitoring and auxiliary handling of critical safety interlocking links in SIS.

[0148] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A SIS risk monitoring method based on a safety interlocking state graph, characterized in that: include, Collect safety interlock data of SIS, perform data registration, generate SIS interlock operation records, establish safety interlock topology based on SIS interlock operation records, perform state mapping on safety interlock topology, and generate safety interlock state map; State transition analysis is performed on the safety interlock state map to generate interlock state deviation. Spatiotemporal coupling analysis is performed on the bypass state in the interlock state deviation to generate bypass superposition state. Based on the interlock state deviation and bypass superposition state, the state transition integrity of the safety interlock state map is verified, and the interlock trigger integrity is generated. The health status of each node in the safety interlock status map is evaluated based on the interlock trigger integrity and interlock status deviation, and the node health is generated. Abnormal nodes are screened from the safety interlock status map based on the interlock trigger integrity and node health. The abnormal nodes are used as the starting point for risk propagation. Risk propagation analysis is performed on the safety interlock status map to generate risk propagation paths. Risk coupling judgment is performed on the integrity of interlocking triggers and the health of nodes by risk propagation path, risk nodes are identified, risk nodes are matched with preset handling rules, and SIS risk monitoring results are generated.

2. The SIS risk monitoring method based on safety interlocking state graph as described in claim 1, characterized in that: The specific steps for generating the SIS interlock operation record are as follows. The system collects input signals, logical interlocking relationships, output execution status, bypass status, and fault diagnosis information from the SIS to form safety interlocking data. It then performs object matching on the safety interlocking data according to the logical interlocking relationships in the safety interlocking data to generate interlocking object association results. Based on the interlocking object association results, the sampling timestamp of the safety interlocking data is corrected, and the safety interlocking data is arranged according to the corrected sampling timestamp to generate the SIS interlocking operation record.

3. The SIS risk monitoring method based on safety interlocking state graph as described in claim 2, characterized in that: The specific steps for generating the safety interlock state diagram are as follows: According to the logical interlocking relationship in the SIS interlocking operation record, find the associated input signals and output execution states, and perform graph structure modeling of the logical interlocking relationship and the associated input signals and output execution states to form a set of interlocking nodes; Based on the set of interlocking nodes and logical interlocking relationships, directed connections are established between nodes, and topological encoding is performed on the directed connections to generate a secure interlocking topology. Configure the attributes of the SIS interlocking operation records according to the interlocking node set to form node status data; Based on the logical interlocking relationship, the input signals in the node state data are logically determined, and the determination results and node state data are mapped to the safety interlocking topology to generate a safety interlocking state map.

4. The SIS risk monitoring method based on safety interlocking state graph as described in claim 3, characterized in that: The specific steps for generating the interlocking state deviation are as follows: Based on the directed connections in the safety interlock state graph, obtain the sampling timestamps of the nodes at both ends of the connection, and compare the time and order of state changes of the nodes at both ends to form state transition entries. The state transition entries are time-based baselines are defined according to logical interlocking relationships to form state transition benchmarks. The timing deviation and state consistency of the state transition entries are compared with the state transition baseline to generate interlocking state deviations.

5. The SIS risk monitoring method based on safety interlock status graph as described in claim 4, characterized in that: The specific steps for generating the bypass superposition state are as follows: Filter out deviation records with bypass enabled status from the interlocking status deviations, locate the node number in the deviation record to the interlocking node in the safety interlocking status map, and continuously trace the associated connection along the directed connection corresponding to the interlocking node to form the bypass action path. In the SIS interlocking operation record, find the sampling timestamps of each bypass state switching from normal state to bypass state and from bypass state back to normal state, respectively, and use them as the bypass occurrence time and bypass release time. The absolute value of the difference between the bypass occurrence time and the bypass release time is used as the bypass duration. The bypass duration is spatiotemporally correlated with the bypass action path to form the bypass spatiotemporal characteristics. By performing path overlap and time overlap discrimination on the spatiotemporal features of bypasses, filtering out bypass states where the action paths overlap and the durations overlap, and performing spatiotemporal clustering to form bypass coupling results; The bypass coupling results are topologically located to determine the superposition position and number of bypass states in the safety interlocking state map, and feature encoding is performed to generate bypass superposition states.

6. The SIS risk monitoring method based on safety interlock status graph as described in claim 5, characterized in that: The specific steps for generating the interlock trigger integrity are as follows: The directed connections in the safety interlock state graph are arranged sequentially according to the logical interlocking relationship. The pre-trigger state and post-trigger state of each directed connection are obtained, and the direction of state change is recorded to form a state transition item. The state transition items are arranged according to the arrangement order of the directed connections to generate the target transition sequence. Match the signal hysteresis, execution deviation and state missing position in the interlocking state deviation with the state transition items in the target transition sequence one by one, record the state transition items that have deviated and the deviation type, and form a transition deviation sequence. Map the superposition position and superposition quantity in the bypass superposition state to the target transition sequence, check whether the state transition items involved in the superposition position satisfy the logical interlocking relationship, remove the state transition items that do not satisfy the logical interlocking relationship, and form a valid transition sequence. The number of state transitions in the effective transition sequence that did not experience interlocking state deviations is counted, and the ratio of the number of state transitions to the total number of state transitions in the target transition sequence is calculated to generate the interlocking trigger integrity.

7. The SIS risk monitoring method based on safety interlocking state graph as described in claim 6, characterized in that: The specific steps for generating node health are as follows. By using directed connections, state transition items in the effective transition sequence are assigned to associated nodes in the interlocking node set. The total number of state transition items associated with each node is counted. Similarly, state transition items in the transition deviation sequence are assigned to associated nodes in the interlocking node set. The number of state transition items that cause interlocking state deviations in each node is counted, thus forming the node deviation statistics. The node migration integrity is calculated by using the node deviation statistics to determine the ratio of the number of state transition items for each node that have not experienced interlocking state deviations to the total number of associated state transition items. The difference between node migration integrity and interlocking trigger integrity is used as node integrity deviation. Fault diagnosis information of each node is searched in the node status data. The node integrity deviation and fault diagnosis information are fused to form node health characteristics. Rank mapping is performed on node health characteristics to generate node health scores.

8. The SIS risk monitoring method based on safety interlocking state graph as described in claim 7, characterized in that: The specific steps for generating the risk propagation path are as follows: The integrity of the target migration sequence is screened based on the integrity of the interlock trigger to form an abnormal migration sequence. Based on the abnormal migration sequence, the state migration items that have interlock state deviations are screened in the migration deviation sequence. The interlock nodes associated with the state migration items are located along the directed connections in the safety interlock state map to form candidate abnormal nodes. Candidate abnormal nodes are sorted by health status, and the sorted candidate abnormal nodes are then screened for health status to form a set of abnormal nodes. Taking the abnormal node in the abnormal node set as the starting point of risk propagation, the nodes connected to the abnormal node are identified according to the connection direction of the directed connection in the safety interlocking state graph, and the next node is tracked along the connection direction of the directed connection until the directed connection terminates. The nodes are arranged according to the tracking order to form a candidate propagation sequence. From the candidate propagation sequences, nodes and directed connections that have interlocking state deviations and nodes and directed connections that are affected by bypass superposition are selected respectively, and the paths are merged to generate risk propagation paths.

9. The SIS risk monitoring method based on safety interlocking state graph as described in claim 8, characterized in that: The specific steps for generating SIS risk monitoring results are as follows: The completeness of the interlocking trigger and the health of each abnormal node are traversed sequentially along the risk propagation path to form node risk parameters. The node risk parameters are then normalized and risk scores are generated to form a node risk score. Calculate the average risk score of nodes in the same risk propagation path, and identify abnormal nodes whose risk scores are not lower than the average as risk nodes; The node type and interlocking status deviation of the risk node are compared item by item with the applicable conditions recorded in the preset handling rules to form the risk handling result; Based on the risk nodes, risk handling results are configured in the risk propagation path to generate SIS risk monitoring results.

10. A SIS risk monitoring system based on a safety interlock state graph, comprising the SIS risk monitoring method based on a safety interlock state graph as described in any one of claims 1 to 9, characterized in that: include, The state graph module is used to collect safety interlock data of SIS, perform data registration, generate SIS interlock operation records, establish a safety interlock topology based on the SIS interlock operation records, perform state mapping on the safety interlock topology, and generate a safety interlock state graph. The bypass overlay module is used to perform state transition analysis on the safety interlock state map, generate interlock state deviation, and perform spatiotemporal coupling analysis on the bypass state in the interlock state deviation to generate bypass overlay state. Based on the interlock state deviation and bypass overlay state, the module verifies the state transition integrity of the safety interlock state map and generates the interlock trigger integrity. The node health module is used to evaluate the health status of each node in the safety interlock status graph based on the interlock trigger integrity and interlock status deviation, generate node health scores, screen abnormal nodes from the safety interlock status graph based on the interlock trigger integrity and node health scores, use abnormal nodes as the starting point for risk propagation, perform risk propagation analysis on the safety interlock status graph, and generate risk propagation paths. The risk monitoring module is used to determine the risk coupling between the integrity of the interlocking trigger and the health of the nodes through the risk propagation path, identify risk nodes, match the risk nodes with the preset handling rules, and generate SIS risk monitoring results.

Images