An automatic alarm method and system for laboratory abnormal states

Abstract

The application discloses a kind of laboratory abnormal state automatic alarm method and system, belong to laboratory safety monitoring technical field, comprising: the continuous sampling value of multiple monitoring signals is analyzed by sliding window, analysis result is encoded as event unit by discretization, wherein, the event unit includes the identification of physical quantity type, change rate and change mode;In the preset time window, the correlation strength matrix is constructed based on the co-occurrence relationship between each event unit;The appearance frequency of each event unit and the strength of each correlation edge are updated by exponential weighted moving average dynamic baseline, wherein the weight of historical data decays exponentially with time.The application can convert multiple sensor monitoring signals into physical semantic event units with causal labels, establish a dynamic correlation atlas between event units, and achieve hierarchical alarm through time-decaying dynamic baseline and causal chain reasoning, so as to accurately identify and alarm at the early warning stage of the accident.

Description

Technical Field

[0001] This invention relates to the field of laboratory safety monitoring technology, and more specifically, to an automatic alarm method and system for abnormal laboratory conditions. Background Technology

[0002] Laboratories (such as chemical laboratories and biological laboratories) typically store and use large quantities of hazardous chemicals, flammable and explosive gases, and biological agents. If abnormal conditions such as gas leaks, localized overheating, or open flames occur and are not detected and dealt with in a timely manner, they can easily lead to safety accidents such as fires, explosions, and poisoning. To ensure laboratory safety, existing laboratories generally deploy environmental monitoring and alarm systems, which collect environmental parameters in real time through temperature sensors, humidity sensors, smoke sensors, gas concentration sensors, and flame sensors, and trigger alarms when parameters are abnormal.

[0003] Currently, the alarm judgment logic of existing laboratory alarm systems is relatively primitive, basically remaining at the level of "single sensor threshold triggering". The typical approach is: the temperature sensor collects the temperature signal, the smoke sensor collects the smoke concentration signal, and each is compared with a preset fixed threshold value. Once a signal exceeds the threshold value, an audible and visual alarm is triggered. Even relatively advanced systems simply summarize the monitoring data of multiple sensors and perform "AND / OR" logic judgment.

[0004] The alarm modes described above are essentially isolated event alarms, rather than state-reasoned alarms, and have the following drawbacks:

[0005] First, the data from each sensor is treated as independent signal sources. There is no semantic relationship between data such as temperature, humidity, gas concentration, flame, and infrared, so the system cannot detect abnormal evolution patterns such as "gas leaks are often accompanied by local temperature rises".

[0006] Second, the system only focuses on whether the signal exceeds the limit at the current moment, without caring about how the parameters have changed over a period of time and the physical meaning represented by the change pattern. It cannot distinguish between parameter fluctuations caused by normal experimental operations and parameter drifts that are precursors to accidents.

[0007] Third, the alarm decision-making uses static thresholds, which cannot adapt to the characteristics of the laboratory's normal state changing over time, such as large parameter fluctuations when someone is operating during the day and stable parameters when no one is at night.

[0008] In pursuit of rapid alarm response, the system is forced to lower the alarm thresholds of each sensor. As a result, normal experimental operations frequently trigger false alarms, such as airflow disturbances caused by opening a fume hood or instantaneous temperature fluctuations caused by equipment startup. In order to reduce false alarm interference, the system is forced to raise the thresholds. As a result, slowly evolving dangers (such as continuous leakage of trace amounts of gas or gradual overheating of equipment) have already caused irreversible accidents by the time the threshold is reached. Summary of the Invention

[0009] To address the problems existing in the prior art, the present invention aims to provide an automatic alarm method and system for abnormal laboratory conditions. This system can convert multi-sensor monitoring signals into physical semantic event units with causal labels, establish a dynamic correlation map between event units, and achieve graded alarms through time-decayed dynamic baselines and causal chain inference, thereby accurately identifying and alarming when the accident is still in its early stages.

[0010] According to a first aspect, one embodiment of this application provides an automatic alarm method for abnormal laboratory conditions, the method being executable by an alarm device or a chip in the alarm device, the method comprising:

[0011] A sliding window analysis is performed on the continuous sampled values ​​of multiple monitoring signals, and the analysis results are discretized and encoded into event units, wherein the event unit includes identifiers of physical quantity type, rate of change, and change mode;

[0012] Within a preset time window, an association strength matrix is ​​constructed based on the co-occurrence relationships between each event unit;

[0013] For the frequency of occurrence of each event unit and the strength of each associated edge, an exponentially weighted moving average is used to update the dynamic baseline, where the weight of historical data decays exponentially over time.

[0014] Event units and associated edges that deviate from the dynamic baseline are identified as anomalies. The causal driving direction is determined based on the chronological order and correlation strength of the anomaly events, and the causal chain is traced back to the most upstream root cause event.

[0015] Based on the length of the causal chain and the type of the root cause event, alarm signals of different priorities are output;

[0016] The alarm confirmation result is written back to the correlation strength matrix and the dynamic baseline.

[0017] According to the above scheme, the method transforms the raw sensor signals into physical semantic event units with kinematic characteristics (amplitude, rate, and pattern). A dynamic correlation strength matrix is ​​constructed through the co-occurrence relationships between event units, and a dynamic baseline that adaptively adjusts over time is established for the event units and their correlation edges. Based on this, causal chain reasoning is performed only on abnormal events deviating from the dynamic baseline to identify the upstream root cause event, and a graded alarm is output based on the causal chain length and the root cause event type. Simultaneously, the alarm confirmation result is written back to the correlation strength matrix and the dynamic baseline, achieving closed-loop self-optimization of the system. This method can identify accident precursors from multi-parameter time series, issuing alarms before serious consequences arise, and does not rely on manually set fixed thresholds, thus balancing alarm response speed and low false alarm rate.

[0018] In conjunction with the first aspect, in some embodiments, the step of discretizing and encoding the analysis results into event units includes:

[0019] The continuous sampled values ​​of each monitoring signal are maintained in a sliding window buffer. The sliding window is updated each time a new sampled value is obtained. The instantaneous amplitude, first derivative, and second derivative of the sampled value within the sliding window are calculated as ternary feature quantities.

[0020] The three-dimensional feature quantities are subjected to multi-level quantization matching to obtain level identifiers, and the level identifiers are assembled with the physical quantity type identifiers of the corresponding monitoring signals to form the event units.

[0021] According to the above scheme, the "kinematic characteristics" of each monitoring signal are characterized by three dimensions: the instantaneous amplitude, first derivative, and second derivative of the sampled values ​​within a sliding window. Continuous feature values ​​are discretized into level identifiers, forming the smallest event particles with physical semantics. Each event unit not only indicates "what parameter it is" but also "how the parameter is changing," providing the first layer of discrimination for distinguishing between normal fluctuations and accident precursors.

[0022] In conjunction with the first aspect, in some embodiments, constructing the association strength matrix based on the co-occurrence relationship between each event unit includes:

[0023] For each newly arrived event unit, trace back the historical event units that have been generated within a preset time length and form event pairs, and record the co-occurrence time interval, timing direction and total number of occurrences of each event pair;

[0024] The initial value of the comprehensive association strength is calculated based on the central tendency and dispersion of the co-occurrence time interval and the distribution ratio of the time series direction, and the direction preference is determined based on the distribution ratio of the time series direction.

[0025] Construct a two-dimensional matrix indexed by event unit type and fill it with the initial value of the comprehensive correlation strength. Apply saturation suppression processing to each strength value according to the total number of occurrences and normalize it.

[0026] According to the above scheme, by recording the co-occurrence time interval, temporal direction, and total number of occurrences of event pairs within a time window, and calculating the comprehensive correlation strength and directional preference accordingly, a dynamically evolving event correlation map is constructed. This map reflects which abnormal signals tend to occur together in the current state and their temporal relationship, providing a benchmark for normal / abnormal pattern discrimination and a basis for subsequent causal direction determination.

[0027] In conjunction with the first aspect, in some embodiments, updating the dynamic baseline using an exponentially weighted moving average includes:

[0028] Statistically analyze the historical fluctuation characteristics of each event unit type and associated edge, and assign personalized exponential decay coefficients to each event unit type and associated edge according to the magnitude of the fluctuation.

[0029] Baseline updates with exponential decay weighting are performed on the occurrence frequency and associated edge strength of each event unit type, and the baseline updates of the relevant event unit types and associated edges are temporarily frozen when a preset operation is detected.

[0030] According to the above scheme, a dynamic baseline with a time decay factor is established for each event unit type and each associated edge. The weight of historical data decays exponentially over time, so that the baseline always reflects the normal state of the recent period. At the same time, a larger decay coefficient is assigned to signals with large fluctuation amplitude to speed up adaptation. When a preset operation behavior (such as opening a fume hood or starting up equipment) is detected, the update of the relevant baseline is temporarily frozen to avoid incorporating parameter fluctuations caused by normal operation into the baseline or misjudging them as abnormal.

[0031] In conjunction with the first aspect, in some embodiments, updating the dynamic baseline using an exponentially weighted moving average further includes:

[0032] The baselines are stored as multiple sets of copies according to preset time periods. The upper and lower offset boundaries of each baseline copy are calculated, and the baseline value is proportionally transitioned to the currently used baseline value when the time period is switched.

[0033] According to the above scheme, by maintaining multiple independent baseline copies for weekday daytime, weekday nighttime, and weekends, and calculating the upper and lower offset boundaries of each copy, the system can adapt to the differences between the normal state of the laboratory during day and night and weekdays / holidays during time period switching, thus avoiding misjudgments during time period switching.

[0034] In conjunction with the first aspect, in some embodiments, determining the causal driving direction based on the temporal sequence and correlation strength of abnormal events includes:

[0035] The frequency sampling value of the occurrence of the current event unit and the real-time value of the strength of the associated edge are compared with the upper and lower offset boundaries of the corresponding baseline to determine the direction and degree of deviation, and then summarized to form a set of abnormal event units and a set of abnormal associated edges.

[0036] Using abnormal event units as nodes and abnormal associated edges as connections, the connection direction is determined based on directional preferences to construct a causal candidate graph.

[0037] According to the above scheme, only abnormal event units and abnormal associated edges that deviate from the dynamic baseline are included in causal inference, which reduces computational overhead and eliminates interference from normal fluctuations. A causal candidate graph is constructed with abnormal event units as nodes and abnormal associated edges as connections, and the connection direction is determined according to directional preferences, providing a graph structure basis for causal chain tracing.

[0038] In conjunction with the first aspect, in some embodiments, the tracing back along the causal chain to the most upstream root cause event includes:

[0039] Perform dual checks on direction consistency and interval stability on each directed connection edge in the causal candidate graph, retain valid causal edges that pass the checks, and remove causal edges that fail the checks.

[0040] Traverse all nodes in the causal candidate graph, mark nodes without predecessor nodes as root cause candidate nodes, prioritize each root cause candidate node according to its propagation breadth, propagation depth and its own abnormality, and output the root cause candidate node with the first position and its causal propagation chain.

[0041] According to the above scheme, false causal relationships are eliminated by dual checks of directional consistency and interval stability, while valid causal edges are retained. Root cause candidates are locked by identifying nodes without predecessors and sorted by propagation breadth, propagation depth, and degree of their own anomaly. The upstream root cause event and its causal propagation chain are output, so that the system can clearly point out "what caused what" and provide a basis for differentiated alarms.

[0042] In conjunction with the first aspect, in some embodiments, the step of outputting alarm signals of different priorities based on the length of the causal chain and the type of the root cause event includes:

[0043] Extract the physical quantity type identifier of the root cause candidate node at the top of the ranking and map it to the initial value of the danger level. Then, correct the danger level according to its abnormal deviation to obtain the final value of the danger level.

[0044] The total number of valid causal edges in the causal propagation chain is counted as the causal chain length value. The priority ranking of root cause candidate nodes is adjusted according to the final value of the danger level and the causal chain length value to obtain the comprehensive alarm priority order.

[0045] An alarm suppression mask is generated for all subordinate nodes downstream of the root cause candidate node, and an alarm signal is output targeting the root cause candidate node with the highest ranking. The alarm signal includes the physical quantity type identifier of the root cause event, the final value of the danger level, the causal chain length value, the comprehensive alarm priority, and the causal propagation chain.

[0046] According to the above scheme, by mapping the physical quantity type of the root cause event to the danger level, and modifying the danger level in combination with the degree of abnormal deviation, the alarm priority is adjusted according to the danger level and the length of the causal chain. An alarm suppression mask is generated for downstream subordinate nodes to avoid repeated alarms, and a graded alarm signal containing evidence of the causal chain is output, so that managers not only know "where something went wrong", but also "how things developed to this point".

[0047] In conjunction with the first aspect, in some embodiments, writing back the alarm confirmation result to the correlation strength matrix and the dynamic baseline includes:

[0048] Obtain the feedback results of manual confirmation, divide the nodes in the causal propagation chain into root node, intermediate node and terminal node according to their position, mark the causal edge from the root node to the successor node as the root segment causal edge, and mark the causal edge from the intermediate node to the successor node as the intermediate segment causal edge.

[0049] When the result is confirmed to be a real accident, different gain coefficients are applied to the current strength values ​​of the root cause segment causal edge and the intermediate segment causal edge to enhance them;

[0050] When the result is confirmed as a false alarm, different attenuation coefficients are applied to the current strength values ​​of the root cause segment causal edge and the intermediate segment causal edge to weaken them, and the attenuation of their historical data weights is accelerated. At the same time, the baseline offset boundary of the event unit type that frequently triggers false alarms is widened.

[0051] According to the above scheme, by writing back the manual confirmation results to the correlation strength matrix and dynamic baseline, the causal edges corresponding to real accidents are enhanced, making the system more sensitive to identify similar accident patterns; the causal edges corresponding to false alarms are attenuated, the historical weights are attenuated at an accelerated rate, and the baseline offset boundary of frequently false alarm event unit types is widened, eliminating the triggering conditions for such false alarms; as the usage time increases, the false alarm rate of the system continues to decrease, and the detection rate of real accidents continues to increase, achieving closed-loop self-optimization.

[0052] According to a second aspect, one embodiment of this application provides an automatic alarm system for abnormal laboratory conditions, the system comprising:

[0053] The event encoding module is used to perform sliding window analysis on continuous sampled values ​​of multiple monitoring signals and discretize the analysis results into event units, wherein the event unit includes identifiers of physical quantity type, rate of change and change mode;

[0054] The association construction module is used to construct an association strength matrix based on the co-occurrence relationship between each event unit within a preset time window;

[0055] The baseline update module is used to update the dynamic baseline by using an exponentially weighted moving average to calculate the frequency of occurrence of each event unit and the strength of each associated edge, where the weight of historical data decays exponentially over time.

[0056] The root cause tracing module is used to identify event units and associated edges that deviate from the dynamic baseline as anomalies, determine the causal driving direction based on the time sequence and correlation strength of the abnormal events, and trace back to the upstream root cause event along the causal chain.

[0057] An alarm grading module is used to output alarm signals of different priorities based on the length of the causal chain and the type of the root cause event.

[0058] The feedback parameter tuning module is used to write back the alarm confirmation result to the correlation strength matrix and the dynamic baseline.

[0059] According to the above scheme, the system achieves the same technical effect as the method described in the first aspect through the coordinated work of the event encoding module, the association construction module, the baseline update module, the root cause tracing module, the alarm classification module, and the feedback parameter tuning module, which will not be elaborated here.

[0060] According to a third aspect, one embodiment of this application provides an alarm device including a processor and a memory, the memory storing one or more instructions executable on the processor, wherein when the one or more instructions are executed by the processor, the alarm device performs an automatic alarm method for laboratory abnormal states according to the first aspect or any possible embodiment of the first aspect.

[0061] According to a fourth aspect, one embodiment of this application provides a computer-readable storage medium storing one or more instructions that, when executed on a computer, cause the computer to perform an automatic alarm method for an abnormal laboratory state according to the first aspect or any possible embodiment of the first aspect. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 This is a schematic diagram of the overall system structure of the present invention;

[0064] Figure 2 This is a flowchart of the automatic alarm method of the present invention;

[0065] Figure 3 This is a schematic diagram of the sliding window analysis and event unit encoding process of the present invention;

[0066] Figure 4 This is a schematic diagram of the alarm feedback parameter tuning process of the present invention;

[0067] Figure 5 This is a data flow diagram between the various modules in the system of the present invention. Detailed Implementation

[0068] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0069] The technical solutions in this application embodiment can be applied to various scenarios that require collaborative analysis of multiple monitoring parameters and output alarms, such as chemical laboratories, biological laboratories, pharmaceutical research and development laboratories, hazardous materials warehouses, clean rooms, etc.; the alarm devices in this application embodiment can be data processing devices that are connected to each monitoring sensor in a wired or wireless manner, such as industrial control computers, embedded alarm controllers, edge computing gateways, or servers deployed in the cloud, etc.

[0070] For a better understanding of the embodiments of this application, please refer to Figures 1 to 5 The application scenarios applicable to the embodiments of this application are described in detail below.

[0071] like Figure 1As shown, system 100 includes multiple monitoring sensors 110, a data acquisition unit 120, an alarm device 130, an audible and visual alarm 140, a remote monitoring center 150, an automatic fire extinguishing device 160, and a management terminal 170. The monitoring sensors 110 include one or more of the following: temperature sensor, humidity sensor, smoke sensor, gas concentration sensor, flame sensor, and infrared sensor. These are deployed at corresponding monitoring points within the laboratory to collect corresponding environmental physical quantities and output monitoring signals. The data acquisition unit 120 samples, amplifies, and performs analog-to-digital conversion on the monitoring signals output by each monitoring sensor 110 to obtain continuous sampled values ​​and reports them to the alarm device 130. The alarm device 130 executes the automatic alarm method for abnormal laboratory conditions provided in this embodiment, analyzes and processes the continuous sampled values ​​of multiple monitoring signals, and outputs an alarm signal. The audible and visual alarm 140 issues an audible and visual alarm under the control of the alarm device 130. The remote monitoring center 150 receives alarm reports sent by the alarm device 130 via ZigBee, GPRS, or Ethernet. Automatic fire extinguishing device 160 is used to automatically activate fire extinguishing in emergency situations. Management terminal 170 (such as personal computer, mobile phone, tablet computer) is used to receive prompts and emergency notifications pushed by alarm device 130 and return manual confirmation results to alarm device 130.

[0072] It should be noted that, Figure 1 The number, type, and device connection relationships of the sensors shown are merely examples. This application does not limit the specific number, type, or implementation of each monitoring sensor in the embodiments. For example, monitoring sensor 110 can also communicate directly with alarm device 130 wirelessly.

[0073] refer to Figure 2 , Figure 2 This is a schematic flowchart of an automatic alarm method for abnormal laboratory conditions according to an embodiment of this application. Figure 2 As shown, the method may include the following steps:

[0074] Step 201: Perform sliding window analysis on the continuous sampled values ​​of multiple monitoring signals, and discretize and encode the analysis results into event units;

[0075] Step 202: Within a preset time window, construct an association strength matrix based on the co-occurrence relationship between each event unit;

[0076] Step 203: Update the dynamic baseline by using an exponentially weighted moving average for the occurrence frequency of each event unit and the strength of each associated edge;

[0077] Step 204: Identify event units and associated edges that deviate from the dynamic baseline as anomalies, determine the causal driving direction based on the chronological order and correlation strength of the anomalous events, and trace back to the root cause event at the upstream end of the causal chain.

[0078] Step 205: Output alarm signals of different priorities according to the length of the causal chain and the type of the root cause event;

[0079] Step 206: Write the alarm confirmation result back to the correlation strength matrix and the dynamic baseline.

[0080] The following is combined with Figures 3 to 5 The specific implementation methods of each of the above steps are described in detail.

[0081] For step 201: The monitoring sensor outputs a monitoring signal at a preset sampling frequency (e.g., 1 Hz), and the data acquisition unit 120 samples the monitoring signal to obtain continuous sample values ​​x(t), where t represents the sampling time sequence number. The alarm device 130 maintains a sliding window buffer for each monitoring signal, and the length of the sliding window is N sampling points (e.g., N=30, corresponding to 30 seconds).

[0082] Upon acquiring a new sampled value x(t), the alarm device 130 adds the new sampled value to the sliding window buffer and removes the oldest sampled value from the window, thereby updating the sliding window. Subsequently, the alarm device 130 calculates three characteristic quantities of the sampled values ​​within the sliding window: instantaneous amplitude A(t), which can be the latest sampled value x(t) within the window, or the average or median of the sampled values ​​within the window; in this embodiment, the latest sampled value is used as an example; first derivative D1(t), representing the rate of change, which can be the difference between the two latest sampled values ​​within the window, i.e., D1(t) = x(t) - x(t-1), or the slope of the least squares linear fitting of multiple sampled values ​​within the window; second derivative D2(t), representing the trend of the rate of change, i.e., D2(t) = D1(t) - D1(t-1). Optionally, to suppress sampling noise, a moving average filter (e.g., three-point smoothing) can be first applied to the sampled values ​​within the window before calculating the above characteristic quantities.

[0083] Next, the alarm device 130 performs multi-level quantization matching on the three characteristic quantities to obtain their respective level identifiers. For example, the instantaneous amplitude A(t) is compared with pre-divided amplitude level intervals and mapped to amplitude level identifiers (e.g., -2, -1, 0, +1, +2, corresponding to "significantly lower than normal", "slightly lower than normal", "normal", "slightly higher than normal", and "significantly higher than normal", respectively); the first derivative D1(t) is mapped to rate level identifiers (e.g., -2, -1, 0, +1, +2, corresponding to "rapid descent", "slow descent", "stable", "slow rise", and "rapid rise", respectively); and the second derivative D2(t) is mapped to mode level identifiers (e.g., -2, -1, 0, +1, +2, corresponding to "accelerated descent", "decelerated descent", "stable", "decelerated rise", and "accelerated rise", respectively). The boundary values ​​of each level interval can be pre-set based on the physical characteristics of the monitored signal or determined based on the quantiles of historical statistical distributions.

[0084] Finally, the alarm device 130 assembles the aforementioned level identifiers and the corresponding physical quantity type identifiers of the monitored signals into an event unit. For example, the physical quantity type identifier is an 8-bit code (e.g., temperature TEMP=00000001, humidity HUM=00000010, gas concentration GAS=00000011, smoke SMOKE=00000100, flame FLAME=00000101, infrared IR=00000110), the rate level identifier and the mode level identifier are each a 3-bit code, and the three are concatenated into a 14-bit event unit type code; simultaneously, a timestamp is added to each event unit, forming an event record stored in the event stream buffer. For example, the temperature sensor output is no longer simply "37.5℃", but rather the event unit "TEMP_RISE_ACCEL" (temperature accelerating upward) or "TEMP_STABLE" (temperature stabilizing). The technical effect of step 201 is to transform the underlying sensor data stream into a discrete event stream with kinematic characteristics. Each event unit not only indicates "what parameter it is", but also "how the parameter is changing", providing the first layer of discrimination basis for distinguishing normal fluctuations from accident precursors.

[0085] For step 202: The event units corresponding to each monitoring signal are continuously accumulated in the event stream buffer. Whenever a new event unit e arrives, the alarm device 130 traces back the historical event units generated within a preset time length (e.g., 60 seconds), forms an event pair (e,f) with each historical event unit f in the traceback window, and updates the statistical information of the event pair: co-occurrence time interval. That is, the absolute value of the difference between the timestamps of two event units; the temporal direction, if Greater than If event f occurs first and event e occurs later, then the direction is recorded once. Conversely, record the direction once. The total number of occurrences C(e,f) is the sum of the total number of occurrences of the event within the statistical period.

[0086] Subsequently, the alarm device 130 calculates the initial value of the overall correlation strength based on the statistical information of each event pair. For example, the initial value of the overall correlation strength S0(e,f) can be calculated using the following formula: ;

[0087] in, Let be the average time interval of the event pair (e,f) across all co-occurrences (the central tendency of the co-occurrence time intervals), and let τ be a preset time decay constant (e.g., τ = 20 seconds); B(e,f) is a stability factor based on the dispersion of the co-occurrence time intervals, for example... , where σ(e,f) is the standard deviation (dispersion) of the co-occurrence time interval. This is a preset constant; This represents the total number of occurrences. Simultaneously, directional preference is determined based on the distribution ratio of directional events across all co-occurring records: if the directional preference is present in all co-occurring records... proportion If the value is greater than a preset direction threshold (e.g., 0.7), then the event pair (e, f) is determined to have a directional preference. ;like If the value is greater than the preset direction threshold, then a direction preference is determined. Otherwise, it is determined that there is no clear directional preference.

[0088] Alarm device 130 constructs a two-dimensional matrix M (size N'×N', where N' is the total number of event unit types) indexed by event unit type, and fills the corresponding positions in the matrix with the aforementioned initial values ​​of the comprehensive correlation intensity. To prevent individual high-frequency events from causing the intensity to grow indefinitely, saturation suppression processing is applied to each intensity value based on the total number of occurrences, for example, using... saturation function, where, The correlation strength value is obtained after saturating and suppressing the initial value S0(e,f) of the comprehensive correlation strength. A preset saturation upper limit is set; then, each row (or the entire matrix) is normalized so that each intensity value falls within the [0,1] interval, resulting in a correlation intensity matrix. This matrix is ​​updated in real time, forming a dynamically evolving event correlation map. The technical effect of step 202 is to obtain a dynamic correlation map reflecting "which abnormal signals tend to appear together and their temporal order" under the current state of the laboratory. For example, the system may find that "GAS_CONC_RISE" (gas concentration increase) and "TEMP_RISE_ACCEL" (temperature acceleration increase) have a high correlation intensity at a specific time delay, which means that gas leaks are often accompanied by local temperature rises. This map serves as a benchmark for subsequent normal / abnormal mode discrimination.

[0089] For step 203: Alarm device 130 establishes a dynamic baseline for each event unit type and each associated edge. The dynamic baseline is updated in real time using an exponentially weighted moving average (EWMA) method. ;

[0090] in, This is the sampling value of the occurrence frequency of the event unit type at the current moment (or the real-time value of the associated edge strength). For the updated baseline value, This is the baseline value from the previous moment. The exponential decay coefficient is... The weight of historical data changes over time. Exponential decay, of which Indicates the distance from now The weight decay factor retained from historical data of each sampling period. The larger the baseline, the faster the weight of historical data decays, and the faster the baseline "forgets" historical data.

[0091] Specifically, the alarm device 130 statistically analyzes the historical fluctuation characteristics (such as fluctuation amplitude and variance) of each event unit type and associated edge over a period of time (e.g., the past 24 hours), and assigns personalized exponential decay coefficients to each event unit type and associated edge based on the magnitude of the fluctuation amplitude. For example, signals with large fluctuations (such as wind speed signals caused by airflow disturbances in a fume hood) are assigned larger attenuation coefficients (e.g., ...). To accelerate baseline adaptation; smaller attenuation coefficients are assigned to signals with smaller fluctuations (such as background temperature signals). To maintain baseline stability, when a preset operation is detected (such as a fume hood opening signal, equipment start signal, or access control opening signal), the alarm device 130 temporarily freezes the baseline updates of the relevant event unit type and associated edge. That is, during the duration of the operation, the corresponding baseline is no longer updated with real-time sampled values ​​to avoid incorporating parameter fluctuations caused by normal operation into the baseline.

[0092] In addition, the alarm device 130 stores multiple sets of baseline copies according to preset time periods (e.g., weekday daytime 8:00-18:00, weekday nighttime 18:00-8:00 the next day, and all day on weekends), and updates each set independently; and calculates the upper and lower offset boundaries of each baseline copy, such as the upper offset boundary. Lower offset boundary ,in The baseline value is defined as the historical standard deviation (or mean absolute deviation), and k is a preset boundary coefficient (e.g., k=2.5). During time period switching, the baseline value is proportionally transitioned to the currently used baseline value. For example, during the transition time T after the switch, the baseline is used... Linear interpolation is used to transition the data and avoid misjudgments caused by the instantaneous switching of time periods. The technical effect of step 203 is: a dynamic discrimination benchmark that can adapt to changes in the daily state of the laboratory. The system does not rely on any manually set fixed thresholds, but uses the "normal state that should exist at the current moment" as a reference to judge abnormalities, and can distinguish between "parameter fluctuations caused by normal experimental operations" and "parameter drifts that are precursors to accidents".

[0093] For step 204: First, the alarm device 130 compares the sampling value of the occurrence frequency of the current event unit and the real-time value of the associated edge strength with the upper and lower offset boundaries of the corresponding baseline, respectively. If the event unit type Frequency of occurrence of sampled values Above its offset boundary or below its lower offset boundary If the event unit deviates from the baseline, its deviation direction (upward / downward) and degree of deviation (e.g., deviation ratio) are recorded. ,in Baseline value, The baseline historical standard deviation is used to add it to the set of anomalous event units; similarly, the associated edges whose intensity real-time values ​​deviate from the baseline are added to the set of anomalous associated edges.

[0094] Secondly, the alarm device 130 constructs a causal candidate graph using abnormal event units as nodes and abnormal associated edges as connections. For the associated edge connecting two abnormal event units A and B, the connection direction is determined based on the direction preference determined in step 202: if the direction preference is... If the direction preference is..., then establish a directed connection edge from A to B; If a directional preference is not specified, a directed connection edge is established from B to A; otherwise, no directed connection edge is established.

[0095] Then, the alarm device 130 performs a dual check on the directed connections in the causal candidate graph, checking for both directional consistency and interval stability. Directional consistency check: The proportion of times the connection direction matches the directional preference is counted in the most recent preset number of co-occurrence records (e.g., the most recent 10 times). If this proportion is greater than a preset consistency threshold (e.g., 0.8), the check passes. Interval stability check: The coefficient of variation (the ratio of standard deviation to mean) of the co-occurrence time interval of the event pair is calculated. If the coefficient of variation is less than a preset stability threshold (e.g., 0.3), the check passes. Directed connections that pass both checks are retained as valid causal edges, while those that fail are removed.

[0096] Next, alarm device 130 traverses all nodes in the causal candidate graph, marking nodes without predecessor nodes (i.e., nodes without any valid causal edges pointing to them) as root cause candidate nodes; it then prioritizes each root cause candidate node based on its propagation breadth (out-degree), propagation depth, and degree of anomalousness (deviation ratio). To avoid ranking distortion caused by differences in the magnitude of different features, Min-Max normalization is first performed on the out-degree, propagation depth, and deviation ratio of all root cause candidate nodes in the current causal candidate graph. ;

[0097] in, For the first Each sample corresponds to a normalized value of a certain feature; For the first The original value (before normalization) of this feature for each sample, such as the original out-degree, original propagation depth, or original deviation ratio.

[0098] This is the minimum value of this feature among all samples currently participating in the normalization. This is the maximum value of this feature among all samples currently participating in the normalization. (Denominator) This represents the range of the current set for this feature; if the range is 0, the normalization value can usually be agreed to be 0 or 1.

[0099] Each feature is mapped to the [0,1] interval, and then a comprehensive priority score is calculated: ;

[0100] in , , These are the normalized out-degree, propagation depth, and deviation ratio, respectively. Preset weighting coefficients (e.g.) The node with the highest score is output as the root cause candidate node ranked first.

[0101] For example, the system detects the simultaneous occurrence of three anomalous event units: "GAS_CONC_RISE" (gas concentration increase), "TEMP_RISE" (temperature increase), and "FLAME_DETECT" (flame detection). Through the causal candidate graph, it is found that FLAME_DETECT appears after TEMP_RISE, and TEMP_RISE appears after GAS_CONC_RISE. Furthermore, each connection passes double verification. Therefore, the inference conclusion is: gas leakage is the root cause, temperature rise is the intermediate state, and flame is the final result. The causal propagation chain is output as "GAS_CONC_RISE→TEMP_RISE→FLAME_DETECT". The technical effect of step 204 is that the inference engine identifies causal chains and root cause events from multiple anomalous events. The system no longer reports "anomaly" in general terms, but clearly indicates "what caused what".

[0102] For step 205: The alarm device 130 extracts the physical quantity type identifier of the top-ranked root cause candidate node and maps it to an initial hazard level value. For example, the preset mapping relationship between physical quantity type and hazard level is as follows: reversible physical quantities such as temperature fluctuations and humidity fluctuations are mapped to hazard level 1 (reversible); hazardous physical quantities such as toxic gas concentrations and smoke concentrations are mapped to hazard level 2 (hazardous); and catastrophic physical quantities such as flames and explosive gases are mapped to hazard level 3 (catastrophic). Subsequently, the hazard level is corrected based on the degree of abnormal deviation of the root cause candidate nodes to obtain the final hazard level value. For example, when the deviation ratio r is not less than 3, the hazard level is increased by one level; when the deviation ratio r is not greater than 1.5, the hazard level is decreased by one level, and the final value is neither lower than 1 nor higher than 3.

[0103] Alarm device 130 calculates the total number of valid causal edges in the causal propagation chain as the causal chain length value L. Based on the final danger level value D and the causal chain length value L, it adjusts the priority ranking of root cause candidate nodes to obtain a comprehensive alarm priority order. For example, the comprehensive alarm priority order = D × 100 + L × 10 + ranking position. Subsequently, alarm device 130 generates alarm suppression masks for all subordinate nodes downstream of the root cause candidate nodes (i.e., all nodes in the causal propagation chain except the root cause node). This means that only the root cause event is alarmed, while repeated alarms are suppressed for the monitoring signals corresponding to subordinate nodes, avoiding "chain false alarms."

[0104] Finally, the alarm device 130 outputs an alarm signal according to the preset alarm classification rules. For example, the alarm classification rules include: Level 1 alarm (early warning): causal chain length L=1 (only one isolated abnormal event, no subsequent propagation signs), and final danger level value D=1 (reversible type), only pushing a prompt message to the management terminal 170, without triggering an audible and visual alarm; Level 2 alarm (alert): causal chain length L=2 (abnormality has begun to propagate), or final danger level value D=2 (dangerous type), triggering a local audible and visual alarm, and simultaneously sending a detailed report containing the causal propagation chain to the remote monitoring center 150 via ZigBee / GPRS; Level 3 alarm (emergency): causal chain length L is not less than 3 (abnormality has formed a propagation chain), or final danger level value D=3 (catastrophic type), immediately triggering a full-area audible and visual alarm, activating the automatic fire extinguishing device 160, and pushing an emergency notification containing a causal chain diagram to all bound terminals. The alarm signal includes the physical quantity type identifier of the root cause event, the final danger level value, the causal chain length value, the comprehensive alarm priority, and the causal propagation chain. The technical effect of step 205 is: a hierarchical alarm system that "explains the reasoning". Unlike traditional systems that only emit alarm sounds, each alarm output by this system comes with "causal chain evidence", so that managers not only know "where the problem occurred", but also "how things developed to this point".

[0105] For step 206: Alarm device 130 pushes the alarm records (including causal propagation chain, root cause event, alarm level, and timestamp) generated in step 205 to management terminal 170. The operator of management terminal 170 manually confirms each alarm record, marks it as "real incident" or "false alarm," and returns the confirmation result to alarm device 130. After obtaining the manual confirmation feedback result, alarm device 130 divides the nodes in the causal propagation chain into root cause nodes, intermediate nodes, and terminal nodes according to their positions: nodes without predecessor nodes are root cause nodes, nodes without successor nodes are terminal nodes, and the remaining nodes are intermediate nodes; the causal edge from the root cause node to the successor node is marked as the root cause segment causal edge, and the causal edge from the intermediate node to the successor node is marked as the intermediate segment causal edge.

[0106] When the result is confirmed as a real incident, the alarm device 130 applies different gain coefficients to the current intensity values ​​of the root cause segment causal edge and the intermediate segment causal edge to enhance them. For example, the intensity value of the root cause segment causal edge is multiplied by the gain coefficient. The strength value of the causal edge in the middle segment multiplied by the gain coefficient That is, the closer the causal edge is to the root cause, the stronger the reinforcement, and the system "learns" to more sensitively identify such accident patterns.

[0107] When the result is confirmed to be a false alarm, the alarm device 130 applies different attenuation coefficients to weaken the current intensity values ​​of the root cause segment causal edge and the intermediate segment causal edge. For example, the intensity value of the root cause segment causal edge is multiplied by the attenuation coefficient. The strength value of the causal edge in the middle section multiplied by the attenuation coefficient Simultaneously, accelerate the decay of the historical data weights of the event unit types and related edges involved in the causal chain (e.g., by increasing the corresponding exponential decay coefficient). The threshold is temporarily increased to twice the original value to allow the system to quickly "forget" false alarm patterns. Furthermore, for event unit types that frequently trigger false alarms (e.g., event unit types where the number of false alarms exceeds a preset threshold within a preset period), their baseline offset boundary is widened (e.g., the boundary coefficient k is increased from 2.5 to 3.0) to eliminate the triggering conditions for such false alarms. The technical effect of step 206 is: a self-evolving alarm system with "learning ability." As usage time increases, the system accumulates experience in each alarm, determining "what patterns are real accidents and what patterns are false alarms," ​​resulting in a continuous decrease in the false alarm rate and a continuous increase in the detection rate of real accidents. This resolves the contradiction between "rapid response" and "low false alarm rate." The system does not rely on lowering the threshold to pursue speed but rather accurately identifies and alarms when the accident is still in its early stages (when the causal chain length is 1 or 2) through causal reasoning.

[0108] In addition, the alarm device 130 includes a processor, a memory, and a communication interface. The processor can be a central processing unit (CPU), microprocessor, digital signal processor (DSP), application-specific integrated circuit (ASIC), or field-programmable gate array (FPGA), etc. The memory can include volatile and / or non-volatile storage devices such as random access memory (RAM), read-only memory (ROM), flash memory, and hard disk, used to store program instructions and data (such as sliding window buffers, correlation strength matrices, dynamic baselines, multiple baseline copies, etc.). The communication interface is used to communicate with the data acquisition unit 120, the audible and visual alarm 140, the remote monitoring center 150, the automatic fire extinguishing device 160, and the management terminal 170, and can support one or more communication methods such as ZigBee, GPRS, Ethernet, Wi-Fi, and Bluetooth. The processor executes the instructions stored in the memory to implement the automatic alarm method for abnormal laboratory conditions provided in this embodiment. Optionally, the alarm device 130 may also include a display for displaying real-time curves, event unit streams, correlation graphs, and causal chain diagrams of each monitoring signal.

[0109] In this embodiment, the system can also be implemented as a software module. For example, the event encoding module, association construction module, baseline update module, root cause tracing module, alarm classification module, and feedback parameter tuning module can each be a software functional module running on the alarm device 130. The data flow between these modules is as follows: The event encoding module encodes the continuous sampled values ​​of each monitoring signal into event units and outputs them to the association construction module and the baseline update module; the association construction module constructs an association strength matrix based on the co-occurrence relationship of the event units and outputs it to the baseline update module and the root cause tracing module; the baseline update module maintains the dynamic baseline and upper and lower offset boundaries and outputs them to the root cause tracing module; the root cause tracing module identifies anomalies and determines root cause events based on the dynamic baseline and the association strength matrix, and outputs the causal propagation chain to the alarm classification module; the alarm classification module outputs an alarm signal and outputs the alarm record to the feedback parameter tuning module; the feedback parameter tuning module writes the confirmation result back to the association strength matrix of the association construction module and the dynamic baseline of the baseline update module. The specific functions of each module correspond one-to-one with the aforementioned method steps, and will not be repeated here.

[0110] It should be understood that the numbering of each step above (such as steps 201 to 206) is only used to identify each step and does not constitute a limitation on the execution order. The execution order of each step can be adjusted, and some steps can be executed in parallel.

[0111] The specific implementation of the alarm device provided in the third aspect and the computer-readable storage medium provided in the fourth aspect can be referred to the contents described in the first and second aspects, and will not be repeated here.

[0112] In this embodiment, the values ​​of each preset constant and weighting coefficient are determined according to the following rules:

[0113] 1. Stability constant : Take the system's preset sampling period (1 second) times, preferably seconds, to ensure that the time interval of the event pair fluctuates within Within a certain time frame, the stability factor should not be lower than ;

[0114] 2. Saturation inhibition upper limit Used to nonlinearly suppress the correlation strength of high-frequency co-occurring event pairs, preventing saturation and overflow of single-type events. Based on the preset time window (For example The theoretical maximum number of co-occurrences within 60 seconds has been determined: ;

[0115] in, The total number of event unit types. The minimum allowable co-occurrence time interval for the system (e.g.) =1 second), The saturation ratio coefficient is preferably β=0.8. This rule ensures that the intensity value enters the saturation region when it reaches 80% of the theoretical upper limit, thus avoiding extreme high-frequency events from dominating the entire correlation matrix.

[0116] 3. Priority weight The preferred method is calibration using the Analytic Hierarchy Process (AHP) or expert experience. , , Achieving a balance between the breadth of its spread and the degree of its own abnormality;

[0117] 4. Personalized attenuation coefficient Based on the percentile linear mapping of the historical variance of each signal, i.e. ,in , This allows signals with greater fluctuations to achieve faster baseline tracking speeds. Additionally, This is the lower limit of the exponential decay coefficient, i.e., the minimum allowable value. . This is the upper limit of the exponential decay coefficient, i.e., the maximum allowable value. The overall meaning of the formula: Based on the magnitude of the historical variance of each signal, the degree of fluctuation is linearly mapped to... The greater the fluctuation of the signal, the closer the fraction is to 1. The closer The faster the baseline tracking and the smaller the fluctuations, the better the signal. The closer The more stable the baseline, the better.

[0118] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An automatic alarm method for abnormal laboratory conditions, characterized in that, include: A sliding window analysis is performed on the continuous sampled values ​​of multiple monitoring signals, and the analysis results are discretized and encoded into event units, wherein the event unit includes identifiers of physical quantity type, rate of change, and change mode; Within a preset time window, an association strength matrix is ​​constructed based on the co-occurrence relationships between each event unit; For the frequency of occurrence of each event unit and the strength of each associated edge, an exponentially weighted moving average is used to update the dynamic baseline, where the weight of historical data decays exponentially over time. Event units and associated edges that deviate from the dynamic baseline are identified as anomalies. The causal driving direction is determined based on the chronological order and correlation strength of the anomaly events, and the causal chain is traced back to the most upstream root cause event. Based on the length of the causal chain and the type of the root cause event, alarm signals of different priorities are output; The alarm confirmation result is written back to the correlation strength matrix and the dynamic baseline.

2. The automatic alarm method for abnormal laboratory conditions according to claim 1, characterized in that, The step of discretizing and encoding the analysis results into event units includes: The continuous sampled values ​​of each monitoring signal are maintained in a sliding window buffer. The sliding window is updated each time a new sampled value is obtained. The instantaneous amplitude, first derivative, and second derivative of the sampled value within the sliding window are calculated as ternary feature quantities. The three-dimensional feature quantities are subjected to multi-level quantization matching to obtain level identifiers, and the level identifiers are assembled with the physical quantity type identifiers of the corresponding monitoring signals to form the event units.

3. The automatic alarm method for abnormal laboratory conditions according to claim 2, characterized in that, The construction of the association strength matrix based on the co-occurrence relationship between each event unit includes: For each newly arrived event unit, trace back the historical event units that have been generated within a preset time length and form event pairs, and record the co-occurrence time interval, timing direction and total number of occurrences of each event pair; The initial value of the comprehensive association strength is calculated based on the central tendency and dispersion of the co-occurrence time interval and the distribution ratio of the time series direction, and the direction preference is determined based on the distribution ratio of the time series direction. Construct a two-dimensional matrix indexed by event unit type and fill it with the initial value of the comprehensive correlation strength. Apply saturation suppression processing to each strength value according to the total number of occurrences and normalize it.

4. The automatic alarm method for abnormal laboratory conditions according to claim 3, characterized in that, The method of updating the dynamic baseline using an exponentially weighted moving average includes: Statistically analyze the historical fluctuation characteristics of each event unit type and associated edge, and assign personalized exponential decay coefficients to each event unit type and associated edge according to the magnitude of the fluctuation. Baseline updates with exponential decay weighting are performed on the occurrence frequency and associated edge strength of each event unit type, and the baseline updates of the relevant event unit types and associated edges are temporarily frozen when a preset operation is detected.

5. The automatic alarm method for abnormal laboratory conditions according to claim 4, characterized in that, The method of updating the dynamic baseline using an exponentially weighted moving average also includes: The baselines are stored as multiple sets of copies according to preset time periods. The upper and lower offset boundaries of each baseline copy are calculated, and the baseline value is proportionally transitioned to the currently used baseline value when the time period is switched.

6. The automatic alarm method for abnormal laboratory conditions according to claim 5, characterized in that, The method of determining the causal driving direction based on the chronological order and correlation strength of abnormal events includes: The frequency sampling value of the occurrence of the current event unit and the real-time value of the strength of the associated edge are compared with the upper and lower offset boundaries of the corresponding baseline to determine the direction and degree of deviation, and then summarized to form a set of abnormal event units and a set of abnormal associated edges. Using abnormal event units as nodes and abnormal associated edges as connections, the connection direction is determined based on directional preferences to construct a causal candidate graph.

7. The automatic alarm method for abnormal laboratory conditions according to claim 6, characterized in that, The root cause event traced back to the most upstream point in the causal chain includes: Perform dual checks on direction consistency and interval stability on each directed connection edge in the causal candidate graph, retain valid causal edges that pass the checks, and remove causal edges that fail the checks. Traverse all nodes in the causal candidate graph, mark nodes without predecessor nodes as root cause candidate nodes, prioritize each root cause candidate node according to its propagation breadth, propagation depth and its own abnormality, and output the root cause candidate node with the first position and its causal propagation chain.

8. The automatic alarm method for abnormal laboratory conditions according to claim 7, characterized in that, The step of outputting alarm signals of different priorities based on the length of the causal chain and the type of the root cause event includes: Extract the physical quantity type identifier of the root cause candidate node at the top of the ranking and map it to the initial value of the danger level. Then, correct the danger level according to its abnormal deviation to obtain the final value of the danger level. The total number of valid causal edges in the causal propagation chain is counted as the causal chain length value. The priority ranking of root cause candidate nodes is adjusted according to the final value of the danger level and the causal chain length value to obtain the comprehensive alarm priority order. An alarm suppression mask is generated for all subordinate nodes downstream of the root cause candidate node, and an alarm signal is output targeting the root cause candidate node with the highest ranking. The alarm signal includes the physical quantity type identifier of the root cause event, the final value of the danger level, the causal chain length value, the comprehensive alarm priority, and the causal propagation chain.

9. The automatic alarm method for abnormal laboratory conditions according to claim 8, characterized in that, The step of writing back the alarm confirmation result to the correlation strength matrix and the dynamic baseline includes: Obtain the feedback results of manual confirmation, divide the nodes in the causal propagation chain into root node, intermediate node and terminal node according to their position, mark the causal edge from the root node to the successor node as the root segment causal edge, and mark the causal edge from the intermediate node to the successor node as the intermediate segment causal edge. When the result is confirmed to be a real accident, different gain coefficients are applied to the current strength values ​​of the root cause segment causal edge and the intermediate segment causal edge to enhance them; When the result is confirmed as a false alarm, different attenuation coefficients are applied to the current strength values ​​of the root cause segment causal edge and the intermediate segment causal edge to weaken them, and the attenuation of their historical data weights is accelerated. At the same time, the baseline offset boundary of the event unit type that frequently triggers false alarms is widened.

10. An automatic alarm system for abnormal laboratory conditions, applied to the automatic alarm method for abnormal laboratory conditions as described in any one of claims 1-9, characterized in that, include: The event encoding module is used to perform sliding window analysis on continuous sampled values ​​of multiple monitoring signals and discretize the analysis results into event units, wherein the event unit includes identifiers of physical quantity type, rate of change and change mode; The association construction module is used to construct an association strength matrix based on the co-occurrence relationship between each event unit within a preset time window; The baseline update module is used to update the dynamic baseline by using an exponentially weighted moving average to calculate the frequency of occurrence of each event unit and the strength of each associated edge, where the weight of historical data decays exponentially over time. The root cause tracing module is used to identify event units and associated edges that deviate from the dynamic baseline as anomalies, determine the causal driving direction based on the time sequence and correlation strength of the abnormal events, and trace back to the upstream root cause event along the causal chain. An alarm grading module is used to output alarm signals of different priorities based on the length of the causal chain and the type of the root cause event. The feedback parameter tuning module is used to write back the alarm confirmation result to the correlation strength matrix and the dynamic baseline.

Images