A method and system for determining a safe recovery point after abnormal rectification of high-risk operations

Abstract

The application discloses a high-risk operation abnormality rectification post-safety recovery point determination method and system, and belongs to the technical field of operation safety management. The method constructs an inspection item topology graph of an operation process, and the inspection item topology graph contains inspection standards, time sequence dependency relationships and influence propagation weights. A snapshot of a field state is captured when an abnormality occurs. According to the influence propagation weights and the snapshot, a subsequent node is deduced along the time sequence dependency relationships, and a set of affected nodes is determined. The next node of the last unaffected node is determined as a minimum safety recovery point, and a pre-recovery checklist is generated. Sequential verification is forced before unlocking, and the permission of the point and subsequent nodes is unlocked after passing. The abnormality and the recovery process are stored as a case package, and the influence propagation weights are updated. The system includes topology mapping, field snapshot, influence deduction, recovery positioning, verification unlocking and case weight adjustment modules. The application can quantify the abnormality influence range, avoid repeated inspection, ensure ordered verification of the recovery operation, and improve safety and efficiency.

Description

Technical Field

[0001] This application relates to the field of work safety management technology, and more specifically, to a method and system for determining the safety recovery point after rectification of abnormalities in high-risk operations. Background Technology

[0002] High-risk operations typically involve steps such as work application, approval, risk briefing, pre-operation inspection, in-operation monitoring, post-operation confirmation and acceptance. Existing electronic ticketing systems can digitize these business processes, supporting mobile terminals to select inspection items, fill in inspection results, submit anomaly descriptions, upload supporting materials, and confirm rectification, forming a relatively complete business record. However, in the continuous process of "discovering anomalies during process inspection, completing rectification, and resuming operations," there is still a problem that the resumption point is difficult to determine.

[0003] Existing systems typically store inspection items as independent records, only noting pass / fail status, anomaly descriptions, and rectification results, without structurally expressing the sequential relationships, conditional dependencies, and risk impacts between inspection items. When an intermediate inspection item experiences an anomaly, the system cannot automatically determine which subsequent inspection items must be re-verified based on the anomaly's impact on the validity of subsequent inspection items. Furthermore, completing anomaly rectification does not equate to eliminating the anomaly's impact. Continuing work directly after the anomaly node may skip affected inspection items, creating security vulnerabilities; re-executing the entire process from the start point each time will duplicate irrelevant checks, wasting resources. In addition, existing technologies suffer from shortcomings such as relying on experience to determine the scope of anomaly impact, lacking reproducible quantitative evidence, missing environmental and equipment parameters at the time of the anomaly, the possibility of skipping or changing the order of the re-inspection checklist, and the failure to use the anomaly recovery process to correct risk assessments for subsequent similar operations. Summary of the Invention

[0004] In a first aspect, this application provides a method for determining the safety recovery point after rectification of abnormalities in high-risk operations. The method is based on the standard operating procedures, electronic work ticket templates, inspection item configurations, on-site input data and historical abnormality recovery data corresponding to the high-risk operation type, and performs structured modeling and dynamic simulation of the operation process, including the following steps.

[0005] Step 1: Construct a topology diagram of the inspection items in the work process. For a high-risk work type, determine the inspection items to be performed from work procedures, work ticket templates, risk identification tables, inspection standard libraries, and on-site management systems, and model each inspection item as an inspection item node. An inspection item node must have at least the following fields: node identifier, inspection item name, inspection standard, work stage, risk level, applicable work level, data collection requirements, and node status. The node identifier is used to establish a connection between work tickets, on-site snapshots, verification records, and case packages; the inspection item name is used to display the inspection task to the operators; the inspection standard is used to determine whether the node passes; the work stage indicates the position before, during, or after the work; the risk level expresses the risk importance of the node itself; the applicable work level matches different work levels such as Level 1 hot work and confined space operations; and the data collection requirements specify the evidence type, such as photographs, sensor data, manual readings, or operation logs.

[0006] Directed edges are established between inspection item nodes according to the execution order of the work procedure, resulting in a graph structure of the inspection item topology. The directed edges represent the temporal constraints, precondition constraints, or risk impact relationships between previous and subsequent inspection items. The starting point of a directed edge is the preceding node, and the ending point is the subsequent node; the same node can have one or more subsequent nodes, thus supporting linear, branching, and merging processes. Preferably, the topology graph corresponding to the work procedure adopts a directed acyclic graph (DAG) to enumerate propagation paths along directed edges without loop propagation. For work procedures with cyclic reviews, a single review can be expanded into nodes with different stage identifiers, still stored in a directed acyclic staged structure.

[0007] The influence propagation weights are configured based on the risk levels of the nodes connected by the directed edges and the risk relationships between the nodes. The influence propagation weight is a dimensionless quantity used to represent the potential impact of an anomaly at the starting node on the effectiveness of the check at the ending node. Data sources may include risk association descriptions in the work procedures, control measure relationships in the risk identification table, expert configurations, historical case statistics, and verification results of similar work. Weights can be entered by the system administrator during the work ticket template configuration phase, or incrementally updated by the case weight adjustment module without changing the node and directed edge structure. Weights are bound to directed edges and retain the work type, version number, effective time, and adjustment source.

[0008] In one possible implementation, the influence propagation weights are represented by discrete values ​​between 0 and 1, where 0 indicates that anomalies are not considered to affect the endpoint node within the current modeling scope, and 1 indicates that anomalies at the starting point have the highest impact on the effectiveness of endpoint checks. Several discrete levels, such as low, medium, high, and extremely high, can also be used, and these levels can be mapped to a preset numerical range before extrapolation. This application does not limit the storage format of the weights, as long as it can be used for comparable calculations of different propagation relationships.

[0009] Step 2: Capture a snapshot of the abnormal node's on-site status. When any inspection item node is marked as abnormal by the operator, on-site supervisor, sensor interface, or electronic work ticket rule engine, the abnormal marker is first validated. Validation confirms that the abnormal marker corresponds to the current work ticket, the current work stage, and the current node, and that it contains the recording personnel, recording time, abnormal status, and necessary supporting information. Validation checks whether the node exists, whether the work ticket is in progress, whether the abnormal time is within the valid range of the work ticket, and whether the marker source belongs to an authorized terminal or business interface.

[0010] After successful verification, the system retrieves the matching snapshot acquisition parameter template based on the node attributes of the abnormal node. The snapshot acquisition parameter template is associated with the node identifier, job type, risk level, and data acquisition requirements, specifying the quantitative parameters to be read at the time of the abnormality, the parameter units, sampling time, sampling source, and allowed data range. For example, the template for gas-related nodes can read combustible gas concentration, oxygen content, and temperature; the template for equipment-related nodes can read equipment operating status, alarm codes, and equipment identifiers; and the template for personnel operation-related nodes can read operator identifiers, operation timestamps, and terminal event logs. These parameters are limited to the existing inspection criteria in the work procedures, node attributes, or handover materials and cannot alter the original inspection standards due to the setting of snapshots.

[0011] The snapshot acquisition parameter template is used to read the quantized parameters of the abnormal node at the time of the abnormality. For sensors that can be connected in real time, the most recent valid sampled value or the sampled value within the specified sampling window at the time of the abnormality is read; for devices that cannot be connected in real time, the quantized readings entered by the mobile terminal are read and the entry time and source are recorded; for personnel operation logs, the event timestamp, node operation status, and evidence identifier are read. The unique identifier of the abnormal node, work ticket identifier, abnormality mark, abnormal time, parameter name, parameter value, parameter unit, acquisition source, acquisition status, and supporting material reference relationship are encapsulated into a field status snapshot. The field status snapshot can be saved as a structured record, key-value set, or versioned object. Its function is to convert the original abnormal description, which cannot be directly calculated, into a digital status record that can be used for impact inference.

[0012] Step 3: Based on the impact propagation weights and the temporal dependencies of the on-site state snapshot, the system performs impact deduction. After rectification, the system starts from the abnormal node and traverses backward along the directed edges in the inspection item topology graph. The output of the deduction is a set of affected nodes, which includes subsequent inspection item nodes that need to be re-verified due to this anomaly. During the deduction process, not all subsequent nodes are directly marked as affected. Instead, the determination is made by combining the propagation path, the inspection standards of the nodes traversed by the path, the comparison results between the on-site snapshot and the standards, the number of propagation steps, and the dynamic confidence threshold.

[0013] The propagation path from the anomalous node to subsequent nodes is enumerated along directed edges. A propagation path is an ordered sequence of nodes starting from the anomalous node, passing through one or more directed edges, and reaching the target subsequent node. The data source for path enumeration is the node table and directed edge table of the check item topology graph. Processing can employ depth-first traversal, breadth-first traversal, or topological order scanning. To avoid redundant calculations in the directed graph, each path should be uniquely identified by its node and directed edge sequences. When a path passes through already visited nodes or exceeds a preset propagation depth, further expansion can be stopped based on the graph structure and configuration rules.

[0014] Independence is determined for each propagation path to identify mutually independent paths. Path independence is used to prevent the same risk relationship from being repeatedly counted through the same key intermediate nodes. The node sets and directed edge sets of two paths can be compared: if two paths do not share intermediate nodes configured as key propagation nodes or key directed edges, except for a common anomaly origin or target node, they can be considered mutually independent; if two paths share key intermediate nodes, share the same risk control conditions, or are merely repeated traversals of the same path, they can be considered not independent. The data sources for independence determination are the path node sequence, directed edge attributes, and key markers in the node attributes. The processing results serve as constraints when merging path propagation strength.

[0015] The propagation weights are adjusted based on the comparison results between the inspection criteria of the nodes along the propagation path and the snapshots of the on-site conditions. The comparison result indicates whether a certain quantitative parameter in the snapshot meets the corresponding node or associated inspection criteria, and can also be represented as pass, fail, or cannot be determined. For criteria directly related to abnormal snapshots, the influence level on the current path is increased when the comparison fails, and the influence level is maintained or decreased when the comparison passes. For criteria not covered by the snapshot, they are processed according to the original weights and node attributes in the topology diagram, and missing data is not mistakenly considered as pass. The adjusted result is still a dimensionless value and should be limited to a preset range.

[0016] The propagation intensities of each independent path are combined to obtain the propagation intensities of each path leading to the same subsequent node. For a path, the propagation intensity can be represented as the product of the adjusted weights of each directed edge, reflecting the comprehensive impact on the target node after the anomaly propagates step by step along the path. The formula is: ;

[0017] in, The path propagation strength of path p is a dimensionless quantity; p represents a directed propagation path from the abnormal node to the target node; e represents a directed edge in the path. This represents the directed edge influence propagation weight, which is a dimensionless quantity, after correction based on the comparison results of the on-site condition snapshot and the inspection standards. This formula can enable multiple consecutive high-influence relationships to form a high intensity, and can also attenuate the influence of any low-influence relationship on distant ends.

[0018] For the same subsequent node, the path propagation intensities are merged according to the independent paths to obtain the cumulative value of the node's influence. An optional discrete implementation is to sum the independent path intensities and limit them to the range of 0 to 1: ;

[0019] in, This represents the cumulative impact of subsequent nodes v, which is a dimensionless quantity; v represents the target's subsequent nodes. This represents the set of mutually independent propagation paths leading to the subsequent node v; Indicates the propagation intensity along the corresponding path; This indicates that the upper limit of the accumulated result is limited to 1; this calculation is used to express the superimposed impact of multiple independent risk sources on the same node. A preset nonlinear merging method can also be used, but the node impact should not decrease when the number of independent paths increases, and the merged value should have definite upper and lower bounds.

[0020] Step 4: Perform step decay on the cumulative impact value of nodes and determine the affected nodes using a dynamic confidence threshold; then, adjust the cumulative impact value of nodes based on the propagation steps from subsequent nodes to the abnormal node to obtain the decayed impact value. The propagation steps are the number of directed edges traversed from the abnormal node to the target node; for target nodes with multiple paths, the shortest propagation steps, the configured effective propagation steps, or the impact can be decayed separately for each path and then merged. Step decay is used to express that the risk impact gradually weakens as the process distance increases, while not covering high-impact relationships directly demonstrated by on-site snapshots.

[0021] An optional off-step decay implementation is as follows: ;

[0022] in, This represents the decayed effect of node v, and is a dimensionless quantity. This indicates the cumulative value affected by the node; This represents the step decay coefficient, which is a dimensionless quantity and ranges from 0 to 1. λ represents the number of propagation steps from the abnormal node to node v, and is a dimensionless integer. This formula incorporates the propagation distance into the impact value. The output and input have the same dimensions, and their signs are defined. During field deployment, λ can be configured as a discrete parameter corresponding to the job type or risk level. For critical safety nodes that are required to maintain their impact with the number of steps, a non-attenuation flag can be set in their node attributes, and the larger of the original impact value and the attenuation value can be used for determination.

[0023] The dynamic confidence threshold for each subsequent node is determined based on the job level and node attributes of this anomaly. The dynamic confidence threshold is a dimensionless decision boundary used to determine whether a target node needs re-verification. Its data sources include the job level, the risk level of the anomaly node, the risk level of the target node, the type of inspection standard for the target node, the completeness of the on-site snapshot, and whether the node belongs to a critical control node. Lower decision thresholds can be configured for higher job levels, higher target node risk levels, or stronger anomalies shown in the snapshot, allowing more nodes to be included in the affected set. Higher thresholds can be configured for low-risk, weakly correlated nodes to reduce irrelevant duplicate verifications.

[0024] Subsequent nodes whose decayed influence value reaches the dynamic confidence threshold are marked as affected nodes, resulting in the set of affected nodes. This can be represented by the following criteria: v∈A, if and only if D(v)≥T(v);

[0025] Where A represents the set of affected nodes; v represents subsequent nodes; D(v) represents the decayed impact value of node v; T(v) represents the dynamic confidence threshold determined based on the job level and node attributes; both D(v) and T(v) are dimensionless quantities, thus this determination has dimensional consistency. For the anomalous node itself, its status can be retained as an anomalous rectification status, and it is not mandatory to repeatedly add it to the set of subsequent affected nodes; for subsequent nodes that have a direct high-risk association with the anomalous node, they can be directly marked through node attributes or threshold rules.

[0026] Step 5: Determine the set of topological boundary nodes and the candidate interval for recovery points. Perform bidirectional backtracking along directed edges from the set of affected nodes. Forward backtracking is used to find the preceding control node of the affected node before the abnormal node, and backward backtracking is used to identify the termination position of the affected domain and its subsequent nodes. Nodes outside the set of affected nodes that have adjacent directed edges to the affected nodes are identified as topological boundary nodes, resulting in the set of topological boundary nodes. The data sources for boundary nodes are the set of affected nodes, the topological graph node table, and the directed edge table. During processing, check whether the start and end points of directed edges belong to the affected set, and record adjacent nodes outside the set as boundary nodes, while retaining the edge direction and adjacency type.

[0027] The starting and ending boundary nodes are determined from the set of topological boundary nodes. The starting boundary node is the boundary node located before the affected area along the job sequence and can serve as the entry point for pre-recovery verification; the ending boundary node is the boundary node located after the affected area along the job sequence and is used to define the end range of pre-recovery verification. In the branching process, the starting and ending boundary nodes can be selected based on the topological order, node stage, and reachability with abnormal nodes. For multiple ending boundary nodes, candidate intervals can be formed separately, and then compared uniformly using cost evaluation values. The nodes arranged between the starting and ending boundary nodes according to their temporal reachability constitute the candidate interval for recovery points. The candidate interval for recovery points is not a simple text interval, but rather a set of candidate nodes in the topology graph constrained by boundaries.

[0028] Step 6: Determine the minimum safe recovery point from the candidate recovery point interval based on the cost evaluation value. Candidate recovery points are nodes within the candidate recovery point interval that can serve as the entry point for restarting the operation. The cost evaluation value is used to comprehensively compare the reverification workload required for different candidate recovery points, the coverage of affected nodes, the completeness of risk control, and temporal continuity. Its data sources include node risk level, number of inspection items, resources required for inspection, topological distance between affected nodes and candidate points, whether the node is a critical control node, and verification order constraints. The smaller the cost evaluation value, the lower the overall cost of reverification and recovery operations while satisfying safe recovery constraints.

[0029] In one possible implementation, the cost evaluation value consists of configured discrete scores, without requiring the use of complex formulas. The system generates a coverage score, a verification workload score, a risk omission penalty score, and a time-series break penalty score for each candidate recovery point, and merges them according to the weights corresponding to the job level. Candidate points must meet their prerequisite condition of being verifiable or already verified; candidate points that do not meet the prerequisite condition are directly excluded. The remaining candidate points are sorted in ascending order of cost evaluation value, and the first-ranked point is selected as the minimum safe recovery point; when costs are the same, candidate points with higher topological order and the ability to cover more affected nodes are prioritized.

[0030] Based on the minimum safe recovery point, extract the nodes between it and the termination boundary node. Arrange the inspection criteria for each node according to temporal dependencies to generate a mandatory verification list before recovery. The mandatory verification list before recovery includes at least the list item identifier, corresponding node identifier, inspection criteria, verification prerequisites, evidence type, verification order, current verification status, verification personnel, verification time, and evidence citation. The list covers affected nodes and their required prerequisite control nodes for recovery, and does not reduce content by simply deleting nodes that have passed the verification. For each list item, mark the type of dependency relationship between it and its prerequisite inspection items, including direct temporal dependency, conditional dependency, risk control dependency, data validity dependency, and common prerequisite dependency. The data sources for dependency relationship types are directed edge attributes, node attributes, and operating procedures; their purpose is to determine the conditions under which verification of the list item can begin.

[0031] Step 7: Force the sequential completion of the verification checklist before restoration and unlock operation permissions. The system determines the preconditions for verification of each item based on the dependency type and issues the items to be verified to the mobile work terminal according to the checklist order. Verification may require operators to re-upload on-site photos, re-read sensor data, re-enter inspection results, or submit equipment status evidence. The system compares the new verification data with the corresponding inspection standards and records the status as passed, failed, pending supplementation, or unable to determine. The verification status summary record is used to save the status change, verification order, personnel, time, evidence, and reason for the result for each item.

[0032] If any item fails verification, the system triggers a re-verification of the corresponding check item and its prerequisite dependencies. The scope of re-verification is determined by the dependency type: for direct temporal dependencies, at least the current item and its immediate predecessor are re-verified; for conditional dependencies, all prerequisites that make the condition true are re-verified; for risk control dependencies, related items covered by the same control measure are re-verified; for data validity dependencies, data within the corresponding time window is re-collected. If all checklist items pass verification, the operation permissions of the minimum safe recovery point and its subsequent nodes are switched from locked to unlocked. If a new anomaly is detected, the impact deduction, determination of the affected node set, generation of the recovery point candidate interval, and checklist generation are re-executed with the node corresponding to the new anomaly. The new checklist is then appended to the current verification sequence. The original verification results are not allowed to replace the verification of the new anomaly.

[0033] Step 8: Associate and store the anomaly recovery case package and update the impact propagation weight. Associate and store the anomaly node identifier, on-site status snapshot, affected node set, minimum safe recovery point, recovery point candidate range, mandatory pre-recovery verification list, verification status summary record, actual recovery result, and anomaly recovery timeline as an anomaly recovery case package. The case package can be stored in an anomaly recovery case library or an anomaly recovery knowledge graph, establishing at least the association between the work ticket, anomaly node, work type, risk level, on-site snapshot, affected node, recovery point, and verification result. The anomaly occurrence point, rectification range, recovery verification point, and actual recovery point can be visualized on the electronic work ticket timeline to form a complete causal chain.

[0034] A multi-level index is established for the anomaly recovery case package. The first-level index can be based on job type, job level, and job procedure version; the second-level index can be based on anomaly node identifier, anomaly type, risk level, and anomaly time window; the third-level index can be based on parameter ranges in the field snapshot, characteristics of the affected node set, topological location of the recovery point, and verification results; auxiliary indexes can also be established based on topology graph version, affected edge version, and case time. The data sources for the multi-level index are case package fields and topology graph metadata. The index building process includes field standardization, parameter bucketing, node identifier mapping, set feature encoding, and version association.

[0035] Extract the anomaly fingerprint records from the anomaly recovery case package and match them with a multi-level index. Retrieve a sorted list of similar cases from the historical anomaly recovery case database. An anomaly fingerprint record must at least consist of the anomaly node identifier, job type, job level, quantized parameter range at the time of the anomaly, characteristics of the affected node set, topology propagation level, and verification results. A coarse screening can be performed first by job type and topology version, followed by a fine screening by anomaly nodes, parameter range, and affected node set, and finally sorted by similarity. The similarity can be calculated using a weighted discrete similarity formula: ;

[0036] in, This represents the similarity between the current case and historical case c, and is a dimensionless score. Indicates the similarity between assignment type and assignment level; Indicates the similarity between abnormal nodes and their topological locations; Indicates the similarity of the parameter ranges in the on-site status snapshot; This indicates the similarity between the set of affected nodes and the verification results; , , , The weights are non-negative, and their sum is 1. Each similarity component takes values ​​between 0 and 1, therefore... It remains a dimensionless quantity. If no formula is needed, the four matching results can be divided into complete match, partial match, and no match, and then added together according to preset scores.

[0037] In one possible implementation, to All values ​​are taken according to discrete matching rules; The value can be 1, 0.5, or 0 depending on whether the job type and job level are the same or similar. The value is 1, 0.5, or 0 depending on whether the abnormal node and its topological location are the same or similar; The value is 1, 0.5, or 0 depending on whether the key parameters in the snapshot of the on-site condition are in the same or similar standard range, and the average value of each parameter is taken. The similarity score is set to 1, 0.5, or 0 based on the degree of overlap between the affected node set and the verification results. All similarity components are between 0 and 1; missing data is not considered a match and is treated as 0. to Substituting the values ​​into the weighted summation formula, we can obtain the similarity score between the current case and historical cases.

[0038] The minimum safe recovery point of the first case in the similar case ranking list is taken as the reference recovery point. The propagation steps from the current case's minimum safe recovery point to the abnormal node are compared with those of the reference recovery point. Based on the comparison results, the adjustment direction and step size of the influence propagation weights are determined. When the current minimum safe recovery point is later than the reference recovery point, and the current verification records indicate that all nodes within the reference range have passed verification, the original influence propagation range may be too large, and the weights of the relevant directed edges are adjusted to decrease. When the current minimum safe recovery point is earlier than the reference recovery point, or when a new abnormality appears after the current recovery, the original influence propagation range may be too small, and the weights of the relevant directed edges are adjusted to increase. The adjustment should also be combined with the verification results and should not be mechanically modified solely based on the recovery point position.

[0039] Generate weight adjustment records. Each weight adjustment record includes at least the topology graph version, the directed edge being adjusted, the weight before adjustment, the adjustment direction, the adjustment step size, the weight after adjustment, the case study on which the adjustment was based, the verification result, the adjustment time, and the executing entity. Incrementally update and version-store the influence propagation weights of the corresponding directed edges in the topology graph of the inspection item according to the weight adjustment records. Incremental updates only change the relevant directed edges supported by case evidence, without completely overwriting the original topology graph; version-stored records retain the old version, the generated new version, the effective time of the record, and the applicable job type. The updated influence propagation weights are synchronized to the topology graph of the inspection item for use in subsequent similar job simulations. It should be understood that case-based weight adjustment is a data-driven, incremental correction of pre-existing propagation relationships and does not change the inspection item topology, on-site snapshot, influence simulation, recovery location, and verification unlocking loop of this application.

[0040] Secondly, this application provides a system for determining the safe recovery point after rectification of abnormalities in high-risk operations, including a topology mapping module, a site snapshot module, an impact simulation module, a recovery positioning module, a verification and unlocking module, and a case weighting module.

[0041] The topology mapping module is used to construct a topology graph of inspection items for the work process. This module obtains inspection items from the work procedures and work ticket templates corresponding to high-risk work types, configures node attributes, establishes directed edges between nodes, and configures the impact propagation weights based on the risk level and risk correlation of the connected nodes. The topology mapping module can be deployed in the work ticket template management service or in a backend service with graph data storage capabilities; its output includes at least a node table, a directed edge table, an inspection standard table, a node attribute table, and topology graph version information.

[0042] The on-site snapshot module verifies the anomaly flag when any inspection item node is marked as abnormal, calls the matching snapshot acquisition parameter template according to the node attributes, reads the quantization parameters at the time of the anomaly, and encapsulates the anomaly node identifier and quantization parameters into an on-site status snapshot. This module can connect to mobile terminals, environmental sensors, device interfaces, and operation log services, and can also receive manually entered quantization values. The snapshot module retains the acquisition source, acquisition time, and data integrity status to support subsequent comparison and auditing.

[0043] The impact projection module is used to project from abnormal nodes to subsequent nodes along the temporal dependency relationship of the inspection item topology graph based on the impact propagation weight and the on-site status snapshot. This module performs path enumeration, propagation path independence determination, comparison of on-site snapshot with inspection standard, weight correction, path propagation intensity calculation, node impact accumulation, step decay and dynamic threshold determination, and outputs the set of affected nodes, the impact value of each node, the threshold, the determination basis and projection version.

[0044] The recovery and localization module is used to backtrack bidirectionally along the directed edges based on the set of affected nodes to determine the set of topological boundary nodes, the candidate interval of recovery points, and the cost evaluation value of each candidate point, and to determine the minimum safe recovery point. This module extracts inspection criteria from the minimum safe recovery point to the termination boundary node, forms a checklist that must be verified before recovery, and marks the dependency type, verification order, and evidence requirements for the checklist items.

[0045] The verification and unlocking module is used to force the sequential completion of the mandatory verification checklist before unlocking the minimum safe recovery point. This module controls the operability status of checklist items according to dependency type, receives on-site photos, sensor data and manual confirmation results, and records the verification status summary. If it fails, it triggers the corresponding check item and its predecessor dependencies to be re-verified. If all checks pass, it switches the operation permissions of the minimum safe recovery point and its subsequent nodes to the unlocked state. When a new anomaly occurs, it is added to the current verification sequence and the impact is re-analyzed.

[0046] The case weight adjustment module is used to associate and store abnormal node identifiers, on-site status snapshots, affected node sets, minimum safe recovery points, and verification status summary records into an abnormal recovery case package. It establishes a multi-level index for the case package, extracts abnormal fingerprint records, retrieves a sorted list of similar cases, obtains reference recovery points, generates weight adjustment records, performs incremental updates and versioned storage on the corresponding directed edges, and synchronizes the updated weights to the inspection item topology graph.

[0047] The above modules can be implemented by software, hardware, firmware or a combination thereof. They can be centrally deployed on a server, or the on-site snapshot collection and verification unlocking parts can be deployed on a mobile terminal, and the topology mapping, impact inference and case weight adjustment can be deployed in the background service. This application embodiment does not limit the specific physical deployment location, communication protocol and storage medium of the modules. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This application presents a flowchart outlining the method for determining safe recovery points after rectification of abnormal high-risk operations.

[0050] Figure 2 Determine the system module architecture diagram for the safety recovery point after rectification of high-risk operational anomalies in this application;

[0051] Figure 3 This is a topology diagram of the inspection items and a schematic diagram of the influence propagation weights in this application;

[0052] Figure 4 A flowchart for the anomaly impact simulation and determination of the affected node set in this application;

[0053] Figure 5 The flowchart for determining the minimum safe recovery point, verifying unlocking, and adjusting case weights in this application is shown. Detailed Implementation

[0054] The present application will now be described in detail with reference to the embodiments. It should be understood that the following embodiments are used to illustrate the technical solutions of the present application, and not to limit the scope of protection of the present application. Without departing from the technical concept of the present application, those skilled in the art can make appropriate adjustments to the node attributes, parameter templates, data storage methods and module deployment methods. The embodiments of the present application do not limit the operation type, sensor brand, mobile terminal type, database type and specific communication method.

[0055] In the processing chain of this application, the inspection item topology diagram is the static logical foundation, the on-site status snapshot is the dynamic input, the affected node set is the output of the impact deduction, the recovery point candidate interval is the intermediate result of topology localization, the mandatory verification list before recovery is the control object for on-site execution, the verification status summary record is the closed-loop result, and the anomaly recovery case package is a persistent object used for auditing and subsequent adjustment. Each object can be associated through work ticket identifier, topology diagram version, node identifier, and event time. Processing steps can be executed sequentially by the same service or triggered by a message queue in the order of anomaly capture, deduction, localization, verification, and case archiving; regardless of the implementation path adopted, it should be ensured that the valid output of the previous stage becomes the input of the next stage, and the original verification sequence should be retained when the anomaly recurs.

[0056] The inspection criteria for each inspection item node can include numerical range criteria, status equality criteria, manual verification criteria for photographic features, and operation record integrity criteria. For the numerical range criteria, the system converts the snapshot parameter units to standard units before comparison. For the status equality criteria, the system compares device status codes or on / off states. For the photographic and manual verification criteria, the system records the pending verification, pass / fail results, and their supporting evidence. For the operation record integrity criteria, the system checks whether the necessary operations exist and whether the chronological order conforms to the procedures. All of the above criteria can be used as executable inspection items in the mandatory pre-recovery checklist, and the checklist generation inherits the corresponding evidence requirements and judgment methods.

[0057] Please see Figures 1 to 5 The specific implementation method of this application is as follows:

[0058] Example 1:

[0059] This embodiment uses a high-risk operation involving pre-operation inspection, in-operation monitoring, and post-operation confirmation as an example to illustrate the complete closed loop from topology mapping to case weight adjustment. Compared with subsequent embodiments, this embodiment covers all processing steps; subsequent embodiments modify the operation scenario, parameter combinations, or deployment methods based on this.

[0060] During the work order template configuration phase, the topology mapping module reads the work procedures for this work type, setting pre-work gas detection as node A, in-work gas concentration monitoring as node B, in-work equipment status inspection as node C, post-work site cleanup as node D, and post-work acceptance confirmation as node E. Nodes A through E each have their own unique identifier, inspection standard, stage attribute, and risk level. Directed edges are established from A to B, A to C, B to D, C to D, and D to E according to the work procedures. A to B and B to D are associated with gas risks, A to C and C to D are associated with equipment status, and D to E is a temporal dependency after site cleanup is completed.

[0061] The topology mapping module assigns an impact propagation weight between 0 and 1 to each directed edge. Edges associated with gas risks receive higher weights, those associated with equipment status receive medium weights, and edges with only general temporal relationships receive lower weights. The weights only indicate the initial degree of anomalous impact propagation; specific values ​​are determined by operating procedures, risk identification materials, or management personnel. The system saves the node table, directed edge table, inspection criteria, and weights in topology map version V1.

[0062] After the operation begins, the operator completes node A on a mobile terminal and then proceeds to node B. An anomaly is detected in the gas concentration monitoring at node B, and the mobile terminal submits an anomaly marker, an anomaly description, and a work ticket identifier. The on-site snapshot module verifies that the marker belongs to the current work ticket, node B is in an operable phase, the marker time is valid, and the submission terminal has registered the information. Upon successful verification, the module calls the snapshot acquisition parameter template for node B, reads the combustible gas concentration, oxygen content, temperature, sensor identifier, sampling time, and operation log timestamp at the time of the anomaly, and records the referenced on-site photos to create a snapshot. .

[0063] After rectification, the impact prediction module enumerates paths from node B along B to D and D to E, and simultaneously forms propagation paths to D and E through B to D and B to D to E. If there is no reachable relationship between node C and B originating from B, then C will not be directly included in the propagation path due to the current B anomaly. Module check snapshot. The relationship between gas parameters and the field safety standards upon which nodes D and E are based is determined. For nodes whose gas-related standards have not been reproven, the correction weight of the corresponding edges is maintained or increased; for node C, which only involves equipment status, it is processed separately according to the original topology and node attributes.

[0064] For a path to node D, the module determines that B to D is a direct path. For a path to node E, the module determines that B to D to E is an extended path. The path propagation strength is multiplied edge-by-edge according to the adjusted weights of each edge. The cumulative node influence of node D is obtained by merging the independent paths to D, and the cumulative node influence of node E is obtained by merging the independent paths to E. The module decays the influence according to the number of propagation steps and reads the dynamic confidence thresholds of nodes D and E respectively. When the decayed influence values ​​of D and E reach the corresponding thresholds, D and E are added to the set of affected nodes. If the impact value of node C does not reach the threshold, C will not be marked as an affected node, but whether it serves as a recovery front control node is still determined by the topology and dependency type.

[0065] The recovery and localization module backtracks bidirectionally along the directed edges to affected nodes D and E, identifying node B as the starting adjacent boundary node and the ending boundary node after the affected area. Based on the operation sequence, reachability, and boundary relationships, the module forms a candidate range of recovery points. Candidate points can include recoverable entry points after node B and before node D verification, as well as other nodes that meet the preconditions. The module calculates a cost evaluation value for each candidate point, assessing the number of nodes requiring re-verification, risk coverage, whether critical checks are skipped, and temporal continuity with the ending boundary node, ultimately determining the minimum safe recovery point R.

[0066] The recovery and positioning module extracts nodes from node R to the termination boundary node and generates a mandatory checklist before recovery. The checklist includes at least the gas-related inspection criteria for node D and the post-operation verification criteria for node E; if node C is identified as a risk control prerequisite for D, node C and its inspection criteria are also added to the checklist. Checklist items are arranged by temporal dependency and labeled as direct temporal dependency, risk control dependency, or data validity dependency, respectively.

[0067] The verification and unlocking module first locks the operation permissions of nodes R and subsequent nodes. The on-site supervisor can only begin verification according to the checklist order. For node D, the terminal requires re-collecting gas parameters and uploading on-site photos; for node E, the terminal requires confirming the on-site cleanup status and submitting corresponding evidence. The system compares the newly collected values ​​with the inspection standards and records the verification personnel, verification time, data source, and pass / fail status. If node D fails, the module triggers re-verification of node D and its preceding dependent nodes; if nodes D and E both pass, R and its subsequent nodes are switched to unlocked.

[0068] If a new node becomes abnormal during the verification process, such as the on-site cleanup node E becoming abnormal again, the system will recapture a snapshot with E as the new abnormal node and perform an impact simulation, forming a new set and list of affected nodes. The new list is appended to the current verification sequence. Items that have already passed in the original list are only used as a reference if the dependencies allow and the data validity period has not expired, and cannot directly cover the verification requirements corresponding to the new abnormality.

[0069] After the task is completed, the case weight adjustment module will identify node B and take a snapshot. The affected node set, minimum safe recovery point R, candidate interval, mandatory verification list before recovery, and verification status summary record are associated to form the anomaly recovery case package CP1. The case package marks the anomaly occurrence point, rectification interval, recovery verification point, and actual recovery point in the electronic work ticket timeline, and establishes a multi-level index of work type, anomaly node, parameter interval, topology map version, and recovery result.

[0070] The system retrieves cases similar to CP1 from the historical case database and generates a sorted list of similar cases. If the reference recovery point of the first case is later than R, and the verification results of the first case show that all intermediate nodes are reliable, the system generates an adjustment record to reduce the weights of the relevant propagation edges. If the reference recovery point of the first case is earlier, but CP1 experiences association anomalies after recovery, an adjustment record to increase the weights of the relevant propagation edges is generated. The new weights are saved as topology graph version V2, while the old version V1 is retained. Subsequent similar jobs will read V2 according to the effective conditions.

[0071] Example 2:

[0072] The difference between this embodiment and Embodiment 1 is that the specific operation type is hot work, the anomaly occurs at the gas monitoring node during the operation, and the site status snapshot includes multiple environmental quantification parameters. The topology mapping module establishes nodes for pre-operation combustible material cleanup, pre-operation gas detection, in-operation gas monitoring, fire extinguisher status inspection, post-operation residual fire confirmation, and site acceptance according to the hot work operation procedures, and establishes directed edges according to the operation procedures. Gas detection and gas monitoring nodes are configured as high-risk nodes, and residual fire confirmation nodes are configured as nodes jointly associated with gas risk and site status.

[0073] When a gas monitoring node malfunctions during operation, the on-site snapshot module calls the parameter template corresponding to that node to read the combustible gas concentration, oxygen content, temperature, sampling time, and sensor status. If a parameter exceeds the inspection standard, the system corrects subsequent edges related to gas risk; if the temperature parameter also affects the ember confirmation standard, the relevant propagation relationship of the ember confirmation node is incorporated into the simulation. For fire extinguishing equipment status checks, if the inspection standard is not directly related to the gas snapshot, the system determines the status based on the initial weight of the equipment inspection edge and node attributes, and does not automatically mark all equipment as affected due to gas anomalies.

[0074] In this embodiment, the dynamic confidence threshold is configured according to the hot work operation level. Higher-level hot work operations use stricter threshold rules, and even a small attenuation effect value can trigger re-verification; lower-level hot work operations still need to comply with the direct verification requirements of key nodes, but higher thresholds are used for unrelated general nodes. When locating the recovery point, the system prioritizes ensuring that key nodes such as gas monitoring and residual fire confirmation are on the mandatory verification list before recovery, and then determines the minimum safe recovery point within the candidate interval based on the cost evaluation value.

[0075] Compared with Example 1, this example focuses on demonstrating the processing method of differentiating the risk-related edges of multiple parameters in the snapshot, without changing the overall closed loop of anomaly capture, path propagation, threshold determination, list verification, case storage and version-based weight adjustment.

[0076] Example 3:

[0077] The difference between this embodiment and Embodiment 1 is that the operation type is confined space operation, and the inspection item topology diagram has a branching and merging structure. The topology diagram includes nodes such as pre-operation gas detection, ventilation status confirmation, monitoring personnel confirmation, personnel entry permission, continuous monitoring during operation, and post-operation personnel evacuation confirmation. Ventilation status confirmation and monitoring personnel confirmation form prerequisites for the entry permission node, which merges into the continuous monitoring node after entry permission is granted, and continuous monitoring connects to the personnel evacuation confirmation node.

[0078] When an anomaly occurs at the ventilation status confirmation node, the impact projection module enumerates paths forward from that node. Since ventilation status confirmation simultaneously affects access permits and continuous monitoring during operations, the module generates two propagation paths with different intermediate node relationships and performs an independence determination. If the two paths only converge at the anomaly origin and the continuous monitoring target node, and do not share a critical intermediate control node, they are calculated as independent paths. If the two paths share the same ventilation control node, only one independent propagation contribution is retained to avoid duplicate accumulation.

[0079] Once the set of affected nodes is formed, the recovery and location module performs bidirectional backtracking on the branch nodes. For nodes that allow entry, the system determines the starting boundary based on the status of two preconditions; for nodes requiring continuous monitoring and personnel evacuation confirmation, the system determines one or more termination boundaries. If multiple termination boundaries correspond to different branches, the module generates candidate intervals and calculates cost evaluation values ​​for each. Only candidate recovery points that cover all affected branches and do not skip key preconditions are included in the final comparison.

[0080] The mandatory verification checklist before restoration is controlled by dependency type. The prerequisites for entering a permitted node must simultaneously meet the requirements of ventilation status confirmation and monitoring personnel confirmation; continuous monitoring nodes require re-collection of gas parameters and confirmation of continuous and valid monitoring records; personnel evacuation confirmation nodes require evidence of the site status after the operation is completed. If any prerequisite fails, subsequent dependencies remain locked. Compared to Example 1, this example focuses on the handling of branching, merging, common prerequisite dependencies, and multiple topological boundary nodes.

[0081] Example 4:

[0082] The difference between this embodiment and Embodiment 1 lies in the separate deployment of the system. The topology mapping module, impact projection module, recovery and location module, and case weighting module are deployed in the background service; the interactive parts of the on-site snapshot module and the verification and unlocking module are deployed on the mobile work terminal. When the network is available, the mobile terminal obtains the topology map version, node attributes, and list of tasks to be executed corresponding to the work ticket; when an anomaly occurs, it first collects the node identifier, quantification parameters, and evidence references on the terminal, and then uploads the on-site snapshot to the background service.

[0083] The backend service completes the validity verification of the anomaly markers and impact projection, returning the set of affected nodes, the set of topology boundary nodes, the candidate range of recovery points, the cost evaluation value, and the list of nodes that must be verified before recovery to the mobile terminal. The mobile terminal displays the currently verifiable items according to the list order and keeps unauthorized recovery points and subsequent nodes locked. After each verification, the terminal uploads the verification status, evidence, and timestamp; the backend service re-determines whether the next item meets the prerequisites based on the dependencies and returns the lock or unlock result.

[0084] If the mobile terminal is temporarily unable to connect to the backend service, the original anomaly record and snapshot data can be saved first, but the minimum safe recovery point should not be unlocked directly based on local experience. After the network is restored, the terminal submits the data to the backend service, which then performs the simulation and inventory generation using the current valid topology map version. If the backend service detects that the topology map version has changed, it records both the version at the time of the anomaly and the version used in the simulation in the case package. Compared with Embodiment 1, this embodiment focuses on module separation, version synchronization, and terminal lock control; the technical closed loop remains the same as in Embodiment 1.

[0085] Example 5:

[0086] The difference between this embodiment and Embodiment 1 lies in the emphasis on multi-level indexing, similar case sorting, weight adjustment records, and incremental updates and versioned storage. After the system has been running for a period of time, the historical anomaly recovery case library stores multiple case packages with different job types, anomaly nodes, and verification results. The case weight adjustment module generates anomaly fingerprints for each case package, including job type and level, anomaly node, anomaly snapshot parameter range, characteristics of the affected node set, recovery point topology location, and verification pass status.

[0087] When retrieving the current case, the module first performs a first-level filter based on job type and job procedure version, then a second-level filter based on abnormal nodes and risk level, and finally a third-level similarity calculation based on parameter range, set of affected nodes, and propagation steps. The module outputs a ranked list of similar cases and records the similarity component and ranking criteria for each candidate case. The minimum safe recovery point of the ranked case is used as the reference recovery point. The difference in propagation steps between the actual recovery point of the current case and the reference recovery point is used to determine the adjustment direction, but the final adjustment must also consider the verification status summary record and whether any new anomalies appear after recovery.

[0088] When the current case repeatedly indicates that the impact of a directed edge is overestimated, the module generates an incremental adjustment to decrease the edge's weight; when the current case indicates that abnormal impacts frequently exceed the weight of the edge and cause subsequent node verifications to fail, the module generates an incremental adjustment to increase the edge's weight. The weight adjustment record specifies the values ​​before and after the adjustment, the adjustment step size, the case-based data, the topology graph version, and the effective scope. The backend service creates a new topology graph version without overwriting existing versions; edges not supported by cases are not modified. The new version is synchronized to the job ticket template service. Subsequent newly created job tickets read the new weights according to the version's effective time, and already started job tickets continue to complete the current closed loop according to their bound version.

[0089] If multiple cases adjust the same directed edge in opposite directions, the system can comprehensively process them according to the similarity of the cases, the reliability of the verification results, and the case time, forming a record of pending review or small-step adjustments, without directly and significantly changing the weights. This processing method makes case weight adjustments traceable and gradual. Compared with Example 1, this example does not change the real-time logic of determining the recovery point and verifying unlocking, but specifically explains how the case results update the topology graph in reverse.

[0090] Further explanation:

[0091] In some application scenarios, not all inspection items in the work procedure have the same data collection conditions. For nodes that can automatically provide data from sensors, the system can automatically read the most recent valid data when an anomaly occurs. For nodes that can only be confirmed by personnel, the system can use personnel input, photographic evidence, and operation logs as snapshots or verification evidence. For nodes that have both automatic data and human evidence, the system can save both types of sources separately and mark their respective credibility status in the verification status summary record. Data from different sources does not change the node's identification and dependencies in the topology graph, but it does affect the integrity of snapshots, standard comparison results, and the value of dynamic confidence thresholds.

[0092] In another possible implementation, the system can store the topology map, on-site status snapshots, and case packages separately, but establish a connection through unified work ticket identifiers, event identifiers, node identifiers, and version identifiers. Before executing a simulation task, the system reads the topology map version bound to the work ticket; during the verification task, it reads the list version bound to the simulation results; and when cases are archived, the versions of each object are saved simultaneously. In this way, when work procedures or propagation weights are updated, historical cases can still be reviewed according to the original version, while new cases are processed according to the new version, avoiding the loss of meaning in historical data due to rule changes.

[0093] This application transforms high-risk work processes into an inspection item topology graph containing inspection item nodes, node attributes, directed edges, and impact propagation weights, enabling the electronic system to read and calculate the temporal constraints and risk associations in the work procedures. It saves quantitative parameters, equipment status, and operation logs at abnormal moments through on-site status snapshots, providing an objective data basis for judging the impact of anomalies. It obtains a reproducible set of affected nodes through propagation path independence determination, path propagation strength calculation, node impact accumulation, step decay, and dynamic threshold determination. It determines the candidate interval for recovery points and the minimum safe recovery point through topology boundary backtracking and cost evaluation. It enforces the mandatory verification list before recovery by summarizing dependency relationship types and verification status, and controls the recovery operation with permission locking and unlocking. Through anomaly recovery case packages, multi-level indexes, similar case sorting, weight adjustment records, incremental updates, and versioned storage, it enables historical recovery results to be used to continuously correct impact propagation weights.

[0094] This application can be implemented in electronic work ticket platforms, work safety management platforms, mobile work terminals, and on-site sensor collaborative environments. Its inputs can come from existing work procedures, electronic ticket templates, risk identification data, mobile terminal records, and sensor data. Its outputs can be used for work recovery access control, on-site verification task issuance, work ticket timeline display, and anomaly recovery case archiving, and it has a clear engineering implementation path and industrial application value.

[0095] In practical deployment, node attributes can be stored using structured fields or configuration objects associated with the work ticket template. Modifications to node attributes should generate attribute versions, and the topology map version and node attribute version should be fixed when the work ticket is created to ensure that the same abnormal event can be reproduced according to the rules at the time of the modification during subsequent verification. For sensor data, field snapshots should simultaneously save the original values, standardized values, and unit conversion relationships; for manually entered data, the input terminal and input time should be saved; for photographic or document evidence, evidence identifiers should be saved without forcibly copying the original files. This approach supports the data retrieval required for impact simulations while avoiding the inability to trace verification results due to unclear data sources.

[0096] In one possible implementation, the impact inference module first generates candidate affected nodes, and then performs final labeling based on a dynamic confidence threshold. The generation of candidate nodes relies solely on subsequent nodes reachable from the anomalous node and effective propagation edges; the final labeling also considers key node identifiers in the node attributes, snapshot integrity, and the comparison status with the inspection criteria. For cases where snapshot acquisition fails, the relevant nodes can be marked as requiring supplementary verification, rather than being directly deemed safe. For nodes whose on-site state snapshots have no parameter intersection with a certain inspection criterion, the system retains the original propagation weights and topological dependencies to avoid generating false certainty based on non-existent data.

[0097] Compared to treating abnormal rectification as a simple state switch, this application has at least the following beneficial effects:

[0098] 1. This application represents the temporal dependencies and risk associations between inspection items as an inspection item topology graph, and describes the abnormal impact with directed edges and impact propagation weights, so that the recovery judgment is transformed from a fuzzy decision based on experience into a computable process based on topological relationships.

[0099] 2. After verifying the validity of the anomaly marker, this application captures a snapshot of the on-site status and saves the environmental parameters, equipment parameters, personnel operation timestamps and node identifiers at the time of the anomaly. This allows subsequent impact simulations to be compared with inspection standards using quantitative data, reducing misjudgments caused by relying solely on textual descriptions.

[0100] 3. This application calculates the path propagation strength and merges it into the cumulative value of node impact by enumerating propagation paths and determining independence. Then, it determines the set of affected nodes by combining the propagation step decay and dynamic confidence threshold. This can cover potential risks while avoiding indiscriminate repeated verification of all subsequent nodes.

[0101] 4. This application backtracks the topological boundary based on the set of affected nodes and forms a candidate interval for recovery points. Then, it determines the minimum safe recovery point based on the cost evaluation value, thus forming a well-founded balance between security control and recovery efficiency.

[0102] 5. This application generates a mandatory checklist before recovery that includes the inspection criteria for affected nodes and the types of dependencies, and locks the operation permissions of the recovery point and subsequent nodes before all verifications pass; when a failure occurs or a new exception occurs, the dependency is re-verified, thereby reducing the possibility of skipping key check items from the process control perspective.

[0103] 6. This application will compile an anomaly recovery case package by summarizing abnormal nodes, on-site status snapshots, affected node sets, minimum safe recovery points, and verification status records. It will establish multi-level indexes and form an anomaly recovery timeline, making the causal relationship between anomalies, rectification, verification, and actual recovery traceable and verifiable.

[0104] 7. This application utilizes similar case sorting, reference recovery point comparison, and weight adjustment records to perform incremental updates and versioned storage of impact propagation weights, enabling the system to continuously improve the impact projection of similar operations based on actual recovery results, and retaining historical versions for easy auditing and backtracking.

[0105] It should be understood that the "minimum safe recovery point" described in this application is a candidate recovery point that satisfies the topology pre-constraints, impact range verification constraints, and permission unlocking constraints, and is not equivalent to a simple anomaly occurrence point or the moment when anomaly rectification is completed. The "affected nodes" described in this application are nodes that need to be re-verified, determined based on the current topology map version, on-site status snapshot, propagation calculation results, and dynamic thresholds. It is not excluded that other mandatory verification nodes may be added in specific operating procedures. This application's embodiments do not limit the specific parameters, threshold values, number of index fields, or case sorting algorithms in the formulas, as long as the processing result can achieve the anomaly impact identification, safe recovery location, and verification unlocking closed loop described in this application.

Claims

1. A method for determining the safety recovery point after rectification of abnormalities in high-risk operations, characterized in that, include: Construct a topology graph of the work process for each inspection item. The topology graph includes the inspection criteria for each inspection item node, the temporal dependencies between nodes, and the influence propagation weights. When any check item node is marked as abnormal, capture a snapshot of the abnormal node's on-site status. Based on the impact propagation weight and the snapshot of the on-site state, the influence range of the abnormal node is determined by extrapolating from the abnormal node to the subsequent nodes along the temporal dependency, and the set of affected nodes is obtained. The next node after the last node not marked as affected is determined as the minimum safe recovery point, and a checklist of mandatory pre-recovery checks containing the inspection criteria for each node in the set of affected nodes is generated. Before unlocking the minimum safe recovery point, the verification of the pre-recovery checklist must be completed in sequence, and the operation permissions of the minimum safe recovery point and its subsequent nodes are unlocked after the verification is passed. The data related to this anomaly and its recovery process are stored as an anomaly recovery case package, and the impact propagation weight is updated based on the anomaly recovery case package.

2. The method for determining the safety recovery point after rectification of abnormalities in high-risk operations according to claim 1, characterized in that, Construct a topology diagram of the inspection items for the workflow, including: Each inspection item node is determined according to the operation procedure for high-risk operation type, and node attributes are configured for each inspection item node; By establishing directed edges between the nodes of each inspection item according to the execution order of the work procedure, the graph structure of the inspection item topology graph is obtained. Based on the risk level of the nodes connected by the directed edges and the risk association between the nodes, the influence propagation weight of the directed edges is determined, and the topology graph of the inspection items is obtained.

3. The method for determining the safety recovery point after rectification of abnormalities in high-risk operations according to claim 2, characterized in that, Capture a snapshot of the abnormal node's current state, including: The validity of the anomaly markers of abnormal nodes is verified. Once the verification is successful, the matching snapshot collection parameter template is called according to the node attributes. Read the quantization parameters of the abnormal node at the abnormal moment according to the snapshot acquisition parameter template, and encapsulate the identifier of the abnormal node and the read quantization parameters into a field status snapshot.

4. The method for determining the safety recovery point after rectification of abnormalities in high-risk operations according to claim 2, characterized in that, The deduction includes: The propagation paths from the abnormal node to the subsequent node are enumerated along the directed edges, and the independence of each propagation path is determined to obtain mutually independent propagation paths. The propagation weights are adjusted based on the comparison results of the inspection standards of the nodes passed through each propagation path and the on-site status snapshots. The path propagation intensity of each propagation path is obtained by multiplying along the path. The propagation intensities of each path leading to the same subsequent node are combined to obtain the cumulative value of the node's influence.

5. The method for determining the safety recovery point after rectification of abnormalities in high-risk operations according to claim 4, characterized in that, The method also includes: The cumulative impact value of each subsequent node is attenuated and corrected according to the number of propagation steps from the abnormal node to obtain the attenuated impact value of each subsequent node. Based on the job level and node attributes of this anomaly, determine the dynamic confidence threshold for each subsequent node. Mark the subsequent nodes whose decayed impact value reaches the dynamic confidence threshold as affected nodes, thus obtaining the set of affected nodes.

6. The method for determining the safety recovery point after rectification of abnormalities in high-risk operations according to claim 2, characterized in that, The method also includes: By backtracking bidirectionally along the directed edges from the set of affected nodes, the adjacent nodes outside the set of affected nodes are identified as boundary nodes, thus obtaining the set of topological boundary nodes. Determine the starting and ending boundary nodes from the set of topological boundary nodes, and form a candidate interval for recovery points from the nodes between them.

7. The method for determining the safety recovery point after rectification of abnormalities in high-risk operations according to claim 6, characterized in that, The method also includes: The minimum safe recovery point is determined from the candidate recovery point interval based on the cost evaluation value of each node in the candidate recovery point interval when it is used as a candidate recovery point; Starting from the minimum safe recovery point, extract the nodes between it and the termination boundary node. Arrange the inspection criteria of each node according to the temporal dependency to generate a mandatory checklist before recovery, and mark the dependency relationship type between each inspection item in the mandatory checklist and the preceding inspection item.

8. The method for determining the safety recovery point after rectification of abnormalities in high-risk operations according to claim 7, characterized in that, Force the verification of the mandatory checklist before recovery to be completed in sequence, including: Determine the verification prerequisites for each check item in the mandatory verification checklist before recovery according to the dependency relationship type, verify them in sequence, record the pass status of each check item, and obtain a summary record of verification status. If a failure status exists, the corresponding check item and its prerequisite dependent check items will be re-verified. If all passes, the operation permissions of the minimum safe recovery point and its subsequent nodes will be switched from locked to unlocked. If a new anomaly marker appears, the set of affected nodes and the list of nodes that must be verified before recovery are redefined based on the corresponding node and added to the current verification sequence.

9. The method for determining the safety recovery point after rectification of abnormalities in high-risk operations according to claim 8, characterized in that, The associated storage is an exception recovery case package, including: The abnormal node identifier, on-site status snapshot, affected node set, minimum safe recovery point, and verification status summary record are associated and stored as an abnormal recovery case package, and a multi-level index is established for the abnormal recovery case package; Extract the abnormal fingerprint records of the abnormal recovery case package and match them with multi-level indexes. Retrieve a sorted list of similar cases in the historical abnormal recovery case library and take the minimum safe recovery point of the first case in the sorted list as the reference recovery point. Compare the propagation steps from the minimum safe recovery point and the reference recovery point to the abnormal node, and determine the adjustment direction and adjustment step size of the propagation weight accordingly, and generate a weight adjustment record; The weighted adjustment records perform incremental updates and versioned storage of the influence propagation weights of the corresponding directed edges in the inspection item topology graph, and synchronize the updated influence propagation weights to the inspection item topology graph.

10. A system for determining the safety recovery point after rectification of abnormalities in high-risk operations, applied to the method for determining the safety recovery point after rectification of abnormalities in high-risk operations as described in any one of claims 1-9, characterized in that, include: The topology mapping module is used to construct the topology map of the work process. The topology map of the inspection items includes the inspection criteria of each inspection item node, the temporal dependencies between nodes, and the influence propagation weight. The on-site snapshot module is used to capture a snapshot of the on-site status of any inspection item node when it is marked as abnormal. The impact projection module is used to project from the anomalous node to the subsequent node along the temporal dependency based on the impact propagation weight and the snapshot of the on-site state, and obtain the set of affected nodes. The recovery positioning module is used to determine the next node after the last node that is not marked as affected as the minimum safe recovery point, and to generate a checklist of mandatory verifications before recovery containing the inspection criteria for each node in the set of affected nodes. The verification and unlocking module is used to force the verification of the pre-recovery verification checklist in sequence before unlocking the minimum safe recovery point, and unlock the operation permissions of the minimum safe recovery point and its subsequent nodes after the verification is successful. The case weighting module is used to associate and store the data of this anomaly and its recovery process as an anomaly recovery case package, and update the impact propagation weight based on the anomaly recovery case package.

Images