An alarm association and disposal recommendation method in a safety production comprehensive analysis platform

Abstract

The application discloses a kind of alarm association and disposal recommendation method in safety production comprehensive analysis platform, including obtaining multi-source alarm, working condition, interlocking, personnel and operation data and standardization as event object, according to process propagation time delay, alarm density and production stage form adaptive association observation window;Three-layer reasoning diagram of alarm layer, working condition layer and disposal layer are constructed, and time, topological structure, process direction, parameter response symbol, interlocking state and data source consistency check of credibility are implemented to candidate association edge;Anti-fact intervention is executed to recover to normal state to candidate reason, and the minimum root cause set that meets coverage threshold is sought according to the remaining alarm risk after state propagation.The application can reduce false association, repeated dispatching and unexecutable recommendation, improve the verifiability of root cause positioning and disposal recommendation.

Description

Technical Field

[0001] This invention belongs to the field of wooden pallet processing technology, specifically, it relates to an alarm association and handling recommendation method in a comprehensive safety production analysis platform. Background Technology

[0002] Safety production integrated analysis platforms typically connect to data sources such as distributed control systems (DCS), programmable logic controllers (PLCs), safety instrumented systems (SIS), video analytics devices, environmental monitoring sensors, personnel positioning terminals, access control systems, equipment management systems, and hazard identification systems. Different data sources may simultaneously generate multiple alarms under the same abnormal operating conditions, including threshold exceeding, state switching, interlocking actions, video recognition, personnel crossing boundaries, and equipment malfunctions.

[0003] Existing platforms often use fixed time windows, device or region clustering, historical co-occurrence frequency, rule base matching, or knowledge graph path search to correlate alarms. Fixed time windows are difficult to adapt to abnormal processes with different propagation delays, such as pressure changes, thermal inertia, material conveying, gas diffusion, and equipment wear. They are prone to splitting derivative alarms caused by the same reason into multiple events, or merging independent abnormal errors.

[0004] Alarm correlation results based on correlation or path reachability often lack verification of operational feasibility. Even if two alarms frequently co-occur in historical data, if their parameter change direction contradicts the material flow direction, energy transfer direction, control loop action direction, or interlocking logic, a true causal relationship cannot be established between them. Relying solely on statistical correlation as the basis for correlation can easily lead to false correlations that are not valid in terms of production mechanisms.

[0005] Currently, root cause analysis and action recommendations are often separate. After identifying a suspected root cause, the system typically searches for text suggestions, historical cases, or fixed action trees based on alarm codes, rarely further verifying the prerequisites, prohibition conditions, execution permissions, on-site resources, action mutual exclusion relationships, and waiting order of the action. As a result, there may be situations where the suggested content is understandable but cannot be executed on-site, or where multiple actions conflict with each other.

[0006] Some systems update recommendation weights based on whether personnel select suggestions, whether work orders are closed, or the frequency of use of action items. However, this feedback cannot directly prove that the action has eliminated the root cause, nor can it distinguish the individual contributions of multiple parallel actions to risk reduction. Directly using operational habits as effectiveness feedback can easily lead to the continued prioritization of high-frequency but limited-effect actions.

[0007] Furthermore, when sensor reliability is low, key operating condition data is missing, or there are conflicting directional evidences or unclear differences in candidate root causes in the alarm chain, existing solutions may still output highly deterministic handling suggestions, which is not conducive to making prudent decisions in production sites with high safety requirements. In view of this, the present invention is proposed. Summary of the Invention

[0008] To solve the above-mentioned technical problems, the basic concept of the technical solution adopted by the present invention is as follows: A method for alarm correlation and handling recommendation in a comprehensive safety production analysis platform, characterized by the following steps: Step S1: Obtain multi-source alarm data and operating condition data from the production site, map the multi-source alarm data and operating condition data into standard event objects with object identifier, variable type, status value, occurrence time, topology location, production stage, data source and data source credibility, and determine an adaptive correlation observation window based on process propagation delay, alarm density and production stage. Step S2: Construct a three-layer reasoning graph of alarm-operating condition-handling based on the standard event object. The three-layer reasoning graph includes alarm nodes, operating condition nodes, handling action nodes, as well as alarm observation relationships, operating condition causal relationships, action effect relationships, and action constraint relationships. Step S3: Generate candidate association edges within the adaptive association observation window, calculate the evidence consistency of candidate association edges based on time sequence, process topology reachability, process propagation direction, parameter response sign, interlocking status, historical support, and data source credibility, and delete candidate association edges that violate preset hard process constraints. Step S4: Determine candidate cause nodes from the verified three-layer inference graph, perform counterfactual intervention to set each candidate cause node to a normal state, propagate the state change after intervention along the working condition causal relationship, and determine the counterfactual interpretation gain of each candidate cause node based on the remaining alarm risk after propagation. Step S5: Based on the counterfactual explanation gain, the path evidence from the candidate cause node to the actual alarm node, and the root cause quantity penalty, solve for the minimum root cause set whose alarm weighted coverage is not lower than the preset coverage threshold; Step S6: Extract candidate actions from the action nodes based on the minimum root cause set, verify the preconditions, prohibition conditions, execution permissions, on-site resources, interlocking conflicts, action mutual exclusion relationships and secondary risks of the candidate actions, generate at least one executable action sequence, and sort the executable action sequence according to the expected risk decay, root cause coverage, execution time, resource conflict cost and reasoning uncertainty. Step S7: Obtain the execution receipt of the handling action and the working condition data after the handling, compare the predicted risk decay with the actual risk decay, update the credibility of the working condition causal relationship and the action effectiveness parameters of the handling action respectively; and when the degree of evidence conflict or reasoning uncertainty exceeds the corresponding threshold, limit the output to the working condition verification step and the preset safety fallback action.

[0009] In a preferred embodiment of the present invention, the standard event object further includes a threshold or desired state, duration, peak value, change slope, and number of repetitions; fingerprint merging is performed on events that are repeatedly reported by the same object and the same variable within a preset deduplication time, and the effective alarm range of jitter-type threshold alarm is determined by the entry threshold, exit threshold, and shortest duration; the reliability of the data source is determined based on sensor calibration status, communication quality, data integrity rate, recent maintenance time, and consistency of redundant measurement points.

[0010] In a preferred embodiment of the present invention, the window length of the adaptive correlation observation window is determined by the base window, the propagation delay from the seed alarm corresponding object to the process topology reachable object, the current alarm density, and the production stage change index. When the alarm density is higher than the density threshold, the time range for merging independent events is shortened. During the start-up, shutdown, switching, feeding, or maintenance stages, the time range is expanded according to the allowable propagation delay of the corresponding process link, and the window length is limited to between the preset minimum window and the preset maximum window.

[0011] In a preferred embodiment of the present invention, the working condition causal relationship includes at least one of the following: material transfer relationship, energy transfer relationship, mechanical connection relationship, spatial diffusion relationship, control loop relationship, and interlocking protection relationship; each working condition causal relationship stores the direction of action, parameter response symbol, allowable response delay interval, applicable production stage, relationship credibility, and source of evidence; each disposal action node stores the action object, action type, preconditions, expected effect, prohibition conditions, required permissions, required resources, expected response delay, failure rollback action, and risk level.

[0012] As a preferred embodiment of the present invention, candidate cause nodes To candidate result node Consistency of evidence Determined according to the following formula: ; in, For normalization function, For time compliance, For topological reachability, For process direction conformity, For parameter response sign compliance, For historical support, Punishment for contradictory evidence and The corresponding weight is used; when a candidate associated edge violates the material flow direction, energy transfer direction, control loop action direction, or irreversible hard constraints in the interlocking logic, the candidate associated edge is deleted.

[0013] As a preferred embodiment of the present invention, candidate reasons Counterfactual explanation gain Determined according to the following formula: ; Among them, Robs represents the weighted alarm risk under the current observation status. To mitigate the remaining alert risk after counterfactual intervention on candidate cause c, The minimum root cause set is obtained by solving an objective function that increases the gain of path evidence and counterfactual explanation while reducing the number of root causes, provided that the actual alarm weighted coverage is not lower than a preset coverage threshold. The output is the order of occurrence, process path, parameter response direction, supporting alarm, contradictory alarm, counterfactual explanation gain, and data source credibility of each root cause.

[0014] In a preferred embodiment of the present invention, the action constraint relationship includes a prerequisite relationship, a mutual exclusion relationship, a parallel relationship, a waiting relationship, a fallback relationship, and a permission relationship; a directed acyclic action graph is constructed based on the action constraint relationship, and a candidate action sequence is generated by forward state deduction; the prerequisite conditions of the next action are re-verified in the predicted state after the execution of each action, and the corresponding candidate action sequence is terminated when a high-level secondary risk, resource conflict, or interlocking conflict is predicted to occur.

[0015] In a preferred embodiment of the present invention, an effect observation interval is established centered on the expected response delay of each action. The actual risk attenuation is determined based on the root cause state recovery amount, downstream alarm reduction amount, risk level decrease amount, and newly added secondary risks. When multiple actions are executed in parallel, contribution intervals are divided according to the expected response delay, the target object, and the influence path. The action combination effectiveness is updated for actions with overlapping influence paths and indistinguishable contributions. The credibility of the causal relationship is updated using success evidence and failure evidence. The inference uncertainty is determined at least based on the key data missing rate, candidate root cause score difference, number of hard constraint conflicts, proportion of low-credibility causal relationships, and variance of action effects.

[0016] Compared with the prior art, the present invention has the following advantages: This invention reduces missed associations and excessive aggregation caused by fixed time windows by changing the association observation window according to process propagation delay, alarm density, and production stage. This invention verifies candidate association edges through hard constraints such as material flow direction, energy transfer, parameter response sign, control loop, and interlock status, which can eliminate spurious associations that are statistically co-occurring but do not hold true in production mechanism. This invention restores candidate causes to the normal state and propagates the changes in operating conditions after intervention, and verifies the explanatory power of candidate causes with residual alarm risk, so that root cause reasoning has verifiable state change basis.

[0017] This invention, by finding the minimum root cause set that satisfies the alarm weighted coverage threshold, can merge and process derivative alarms caused by the same reason, reducing duplicate work orders, duplicate dispatches, and conflicting handling tasks. This invention uses real working condition changes rather than work order closed status to correct causal relationships and action efficiency, and updates the combined efficiency of parallel actions whose contributions cannot be distinguished, which can reduce the interference of personnel selection preferences on the recommendation model.

[0018] The specific embodiments of the present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0019] In the attached diagram: Figure 1 This is a flowchart of the alarm association and handling recommendation method of the present invention.

[0020] Figure 2 This is a schematic diagram of the three-layer reasoning diagram for alarm and operating condition handling in this invention.

[0021] Figure 3 This is a flowchart illustrating the cause-and-effect relationship of the present invention.

[0022] Figure 4 This is a schematic diagram of the closed loop of action constraint reasoning and effect feedback in this invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments will be clearly and completely described below with reference to the accompanying drawings. The following embodiments are used to illustrate the present invention.

[0024] Example 1: Closed-loop processing of alarm correlation, root cause reasoning, and action recommendation like Figure 1 As shown, this embodiment includes steps S101 to S108.

[0025] Step S101: Standardization of Multi-Source Alarms and Operating Condition Data The platform receives data uploaded by DCS, PLC, SIS, video analytics devices, environmental monitoring sensors, personnel positioning terminals, access control systems, equipment management systems, and work permit systems via message bus, industrial interface, or data gateway. To eliminate differences in source protocols and field definitions, each piece of raw data is mapped to a standard event object E.

[0026]

[0027] In the formula, The object identifier corresponding to the event. For variable or event type, This is the current value or state value. Let t be the threshold or desired state, and t be the time of occurrence. Where s represents the region or topological location, s represents the current production stage, and q represents the data source. This relates to the reliability of the data source. For video recognition or human behavior alerts, This can be used to identify confidence levels. It can be used as a threshold for judgment.

[0028] Data source credibility The determination is based on sensor calibration status, communication quality, data integrity rate, recent maintenance time, and consistency of redundant measurement points. When a sensor is under maintenance, bypassed, experiencing communication abnormalities, or in a long-term drift state, its weight as causal evidence is reduced, while the corresponding event is retained and a data reliability indicator is generated.

[0029] For alarms that are repeatedly reported for the same object and variable within the deduplication time, the platform performs fingerprint merging, retaining the first occurrence time, latest occurrence time, duration, peak value, slope of change, and number of repetitions. For alarms that fluctuate around a threshold, different entry and exit thresholds are used, and the effective alarm range is determined by combining the shortest duration.

[0030] The platform performs clock skew correction on timestamps from different systems. When a unified clock source exists, it is used for correction; when no unified clock source exists, the time skew between data sources can be estimated based on periodic control commands, interlocking actions, or synchronization events with a definite causal sequence.

[0031] Step S102: Form an adaptive correlation observation window When a seed alarm occurs, the platform retrieves objects that are reachable from the seed object in terms of material, energy, control, mechanical, or spatial relationships from the process topology, and reads the typical propagation delay and allowable propagation delay range corresponding to each type of relationship.

[0032]

[0033] In the formula, To observe the window length, Basic window, The maximum permissible propagation delay from the seed object to the reachable object. This is a production stage change indicator, where da represents the current alarm density. This is an alarm density correction term. , and For adjustment coefficients, This indicates that the results will be restricted to the smallest window. With the largest window between.

[0034] For events with rapid propagation speeds, such as pressure interlocks, power outages, emergency stops, and control commands, shorter propagation delays are permissible. For events related to temperature accumulation, material conveying, equipment wear, and gas diffusion, longer propagation delays are permissible. During start-up, shutdown, switching, material feeding, or maintenance phases, production stage variation indicators increase. When alarm density exceeds the density threshold, the alarm density correction term can use negative correction to reduce the probability of excessive merging of independent anomalies; when alarm density is low and the process chain is long, the alarm density correction term can use positive correction to preserve the complete propagation chain.

[0035] The observation window does not only capture data by time, but also uses process topology reachable objects as the spatial and object scope. For alarms that have no process, control, mechanical, or spatial propagation relationship with the seed object, even if they occur close in time, they are not directly included in the same related event.

[0036] Step S103: Construct a three-layer reasoning graph for alarms, operating conditions, and handling. like Figure 2 As shown, the three-layer inference graph G consists of an alarm node set A, a working condition node set X, a handling action node set U, and a relation edge set R. The alarm layer represents the alarms actually observed by the platform; the working condition layer represents the equipment status, process status, environmental status, personnel status, and operational status; and the handling layer represents the executable actions and their execution constraints.

[0037]

[0038] Among them, RAA represents the timing or propagation candidate relationship between alarms, RAX represents the observation mapping relationship from operating status to alarm, RXX represents the causal relationship of operating status, RUX represents the expected impact of the handling action on the operating status, and RUU represents the precondition, mutual exclusion, parallelism, waiting, rollback and permission relationship between actions.

[0039] Causal relationships in operating conditions can be established based on process flow diagrams, piping and instrumentation diagrams, equipment ledgers, control logic, interlock causal tables, hazard and operability analysis records, operating procedures, and historical operating data. Each relationship should at least retain the direction of action, parameter response sign, allowable time delay interval, applicable production stage, relationship credibility, and source of evidence.

[0040] Action nodes are represented by action atoms whose execution results can be individually verified and recorded. Each action atom (uk) includes at least the action object, action type, preconditions (Pk), expected effect (Dk), prohibition conditions (Fk), required permissions (Qk), required resources (Zk), and expected response time. Failure rollback action Bk and risk level Lk.

[0041] In the three-layer reasoning graph, all nodes and relationships retain version numbers and applicable scopes. After equipment modification, process change, or interlocking logic update, the new version of the relationship only applies to the time period following the change. Historical event reviews use the knowledge version that was valid at the time the event occurred to avoid mixing old and new process relationships.

[0042] Step S104: Verification of consistency between process constraints and evidence For any candidate cause node within the observation window and candidate result nodes Determine the time compliance respectively Topological reachability Compliance of process direction Parameter response sign compliance Historical support and punishment for contradictory evidence And calculate the evidence consistency of candidate associated edges. .

[0043]

[0044] Time compliance is used to determine whether the cause occurred earlier than the result and whether the time difference is within the allowable response delay range; topology reachability is used to determine whether two objects are connected through process, control, space or mechanical relationships; process direction compliance is used to determine whether the influence propagates along the allowable direction; parameter response sign compliance is used to determine whether the parameter rise and fall direction conforms to the production mechanism; historical support reflects the stable support in similar operating conditions in the past; contradictory evidence penalty is used to accumulate evidence that violates hard constraints or contradicts redundant observations.

[0045] When a candidate relationship violates an irreversible hard constraint, the platform directly deletes the corresponding candidate association edge. For example, closing an upstream valve can lead to a decrease in downstream flow, but in the absence of control commands and mechanical feedback, a decrease in downstream flow cannot reversely cause the upstream valve to close automatically; pump failure usually leads to a decrease in outlet pressure, but if the actual observation is that the outlet pressure increases, then the candidate association edge with high outlet pressure due to pump failure will be penalized for contradiction or deleted.

[0046] When redundant measurement points exist for the same object, the weight of observation evidence is determined by the consistency of measurement points. If a measurement point alarms, but adjacent redundant measurement points, control outputs, and field feedback are all normal, the weight of this alarm as evidence of the root cause of production conditions is reduced, and measurement point abnormalities or communication abnormalities are treated as independent candidate causes.

[0047] For control loop related events, the platform simultaneously verifies control commands, actuator feedback, and the response of the controlled variable. When only the control output changes but the actuator feedback does not change, a candidate for actuator failure is prioritized; when the actuator feedback changes but the controlled variable does not change in the expected direction, a candidate for pipeline blockage, media interruption, or measurement point abnormality is prioritized.

[0048] Step S105: Counterfactual root cause verification and solution of the minimum root cause set like Figure 3 As shown, after consistency verification, the operating nodes with earlier occurrence times, lower in-degree, high-reliability reachable paths to multiple alarms, and data source reliability meeting the threshold are selected as the candidate cause set C. For each candidate cause c, the current operating condition diagram is copied, and candidate cause c is set to the normal state, i.e., the counterfactual intervention do(c=normal) is executed.

[0049] After counterfactual intervention, based on the changes in the direction of action, parameter response sign, and response delay propagation state recorded in the causal relationship of the operating conditions, the remaining alarm risk Rcf(c) after the candidate causes have been eliminated is predicted through the observation mapping relationship. The weighted alarm risk under the current observation state is Robs.

[0050]

[0051] In the formula, For the counterfactual explanation gain of candidate cause c, This is a non-zero constant used to avoid a denominator of zero. A larger counterfactual interpretation gain indicates that more downstream alarm risks can be eliminated after restoring the candidate cause to normal.

[0052] Simultaneously, the alarm coverage Cov(c) of candidate causes is calculated, which is the proportion of the sum of actual alarm weights that candidate cause c can reach through high-confidence causal relationships to the total actual alarm weights. To avoid identifying multiple overlapping candidate nodes as root causes simultaneously, the platform solves for the minimum set of root causes that satisfies the coverage threshold. .

[0053]

[0054] In the formula, C′ is a subset of candidate reasons. For the first Risk weight of each actual alarm, Reasons for being a candidate Alert Path evidence, Counterfactual interpretation gain weights Penalty is imposed for the number of root causes. The solution must also satisfy the requirement that the actual weighted coverage of alarms is not lower than the preset coverage threshold.

[0055] The platform can use enumeration search, branch and bound, integer programming, or greedy search based on marginal gain to solve for the minimum root cause set. When the number of candidate causes is small, enumeration search is used; when the number of candidate causes is large, it is first filtered according to counterfactual interpretation gain and coverage, and then branch and bound or greedy search is used.

[0056] The platform outputs a chain of evidence along with the root cause conclusion. The chain of evidence includes the sequence of events, the process propagation path, the direction of parameter response, supporting alarms, contradictory alarms, counterfactual interpretation gain, alarm coverage, and data source credibility, for on-duty personnel to verify.

[0057] Step S106: Generate a sequence of actions that satisfy the constraints. For each root cause in the minimum root cause set, retrieve action atoms from the disposal layer that can reduce the corresponding risk state. First, perform hard constraint checks: the preconditions for the action must be met, the prohibition conditions must not be met, the executor's permissions must be met, the on-site resources must be available, and the action must not conflict with the current interlock protection, the work ticket being executed, or other confirmed actions.

[0058] For actions that pass the hard constraint check, a directed acyclic motion graph is formed based on the preceding and waiting relationships in the action constraint relationship. Two actions acting on the same device with opposite control directions are marked as mutually exclusive; when the effect of one action can only be judged after the other action is executed, a waiting node and verification condition are set between the two actions; when a high-risk action fails, a rollback action is pre-associated.

[0059] The platform performs forward state deduction starting from the current operating condition. For each action atom added, the platform predicts changes in the operating condition based on the action effect relationship and re-examines the preconditions for the next action; if a new high-level risk, resource conflict, or interlocking conflict is predicted, the corresponding candidate action sequence is terminated.

[0060]

[0061] In the formula, π represents the candidate action sequence, Dh represents the expected decrease in risk, Cr represents the coverage of the root cause state, Ca represents the reduction of the current alarm risk, Rs represents the secondary risk, and Te represents the expected execution time. For resource conflict costs, For the uncertainty of sequential reasoning, and As weights. The platform assigns weights to action sequences that satisfy hard constraints. Sort.

[0062] The output includes the sorted handling steps, verification items before each step, expected response, maximum waiting time, conditions for non-execution, and fallback actions. Handling suggestions can be categorized into verification, risk isolation, operational condition adjustment, resource scheduling, and recovery.

[0063] Step S107: Collect execution feedback and evaluate actual results Personnel can confirm the start, completion, inability to execute, or rollback of an action via the terminal, and can upload valve positions, instrument readings, on-site photos, or voice descriptions. The platform establishes an effect observation interval centered on the expected response delay of each action, and collects alarm recovery status, changes in operating conditions, new alarms, and interlock status within this interval.

[0064] For action The platform determines the actual risk reduction. and predicting risk decay Actual risk attenuation is determined by a combination of factors, including the recovery of the root cause, the reduction of downstream alarms, the decrease in risk level, and the emergence of new secondary risks, and is not solely based on work order closure.

[0065]

[0066] When multiple actions are executed in parallel, the platform divides the contribution range according to the expected response latency, target, and impact path of each action. For actions with highly overlapping impact paths and indistinguishable contributions, only the combined performance of the actions is updated, without forcing attribution to individual actions.

[0067] If an action is not executed, the execution conditions are not met, or the execution receipt is missing, the corresponding observation results will not be considered as evidence of action failure. Only when it is confirmed that the action has been executed, the data within the effect observation period is complete, and there are no new external disturbances, will evidence of action success or failure be formed.

[0068] Step S108: Update inference parameters and implement uncertainty gating For causal relationships supported by actual operating conditions, increase the success count; for causal relationships where the prediction has an impact but no actual response occurs and the observation data is complete, increase the failure count. Update the relationship reliability using the posterior mean of a beta distribution. .

[0069]

[0070] In the formula, and For relationship Prior success parameters and prior failure parameters, and This section presents the success and failure evidence generated from the feedback of this response. The action effectiveness parameters are updated in the same way, but the evidence of success is determined by whether the actual risk attenuation reaches the expected range.

[0071] When prediction deviations persist in multiple handling processes for the same operating condition, the platform does not directly delete the original knowledge. Instead, it reduces the scope of application of the corresponding causal relationship or handling action, generates knowledge items to be reviewed, and requires the addition of limiting information such as production stage, equipment model, media type, or environmental conditions.

[0072] The platform determines the overall inference uncertainty U. The inference uncertainty consists of at least the key data missing rate, the candidate root cause score gap, the number of hard constraint conflicts, the proportion of low-confidence causal relationships, and the variance of action effects.

[0073]

[0074] In the formula, M represents the missing key data rate. This is the normalized value of the difference between the scores of the top two candidate root causes. For hard constraint conflict quantities, The proportion of causal relationships under low-reliability operating conditions. For the variance of action effect, and For the corresponding weights.

[0075] When U exceeds the first threshold, the platform reduces the confidence level of automatic sorting and prompts for manual review; when U exceeds the second threshold which is higher than the first threshold, the output is limited to low-risk content such as verifying key measurement points, confirming equipment status, executing existing safety isolation procedures, and notifying the corresponding positions, and no unconfirmed equipment control actions are output.

[0076] When subsequent alarms arrive, the platform re-establishes the observation window and three-layer inference graph based on the updated propagation delay, the reliability of the causal relationship of the operating condition, and the action effectiveness parameters. Derivative alarms that have been confirmed to belong to the same root cause chain are displayed in a collapsed manner on the interface, retaining the highest risk alarm, root cause node, propagation path, and handling progress; when a new alarm appears that cannot be explained by the existing minimum root cause set, the root cause solution is re-triggered.

[0077] Example 2: Recommendations for Alarm Correlation and Handling of Abnormal Circulating Cooling Branches A circulating cooling branch of a certain production unit experienced four alarms within a short period of time: high pump outlet pressure, low branch flow, high motor current, and elevated temperature of the cooled equipment. Simultaneously, the platform detected that the pump was running, the frequency converter was stable, the downstream regulating valve opening command was 70%, the valve position feedback was 35%, and the backup branch was available.

[0078] The platform uses the earliest low branch flow alarm as the seed alarm, and forms an observation window based on the cooling water pipeline topology, the response delay from valve to flow meter, and the thermal inertia delay from flow change to equipment temperature change, and incorporates the four types of alarms and related operating condition data into the same associated event.

[0079] Candidate causes include pump performance degradation, insufficient downstream valve opening, flow meter malfunction, and pipeline blockage. According to process constraints, pump performance degradation usually corresponds to a decrease in outlet pressure, which contradicts the current high outlet pressure; flow meter malfunction cannot simultaneously explain high outlet pressure and high motor current; insufficient downstream valve opening or pipeline blockage can both lead to increased pipeline resistance, increased outlet pressure, decreased flow rate, and increased pump load.

[0080] The platform implemented counterfactual interventions. After restoring the valve from insufficient opening to normal, the model predicted a decrease in pipeline resistance, recovery of flow rate, a drop in outlet pressure and motor current, and a decrease in the temperature of the cooled equipment after thermal inertia time, covering all four types of alarms. Restoring the pipeline from blockage to normal also covered the main alarms, but historical maintenance records and differential pressure measurements did not provide support. Therefore, insufficient valve opening showed high counterfactual interpretation gain and consistent evidence, and was identified as the primary root cause, while pipeline blockage was considered a secondary root cause.

[0081] The platform extracts actions from the handling layer: verify valve position feedback, check the actuator's air or power supply, reduce the load on the cooled equipment, activate the backup branch when pressure and interlock conditions are met, and gradually restore the load after the flow rate stabilizes. Since activating the backup branch requires the backup valve to be in normal condition and the main branch pressure to not exceed the limit, this action is scheduled after the status verification; restoring the load requires the flow rate and temperature to remain stable for a set period of time, so it is scheduled as the last step.

[0082] The operators first verified the valve position and confirmed that the valve actuator was stuck. Then, they reduced the load and activated the backup branch. Within the expected response range, the platform observed that the branch flow recovered, the outlet pressure decreased, and the motor current decreased, and no new high-level alarms appeared. Based on this, the credibility of the causal chain of "insufficient valve opening - increased pipeline resistance - high pressure, low flow, and high current" was increased, and the action efficiency parameters of the corresponding action combination under similar working conditions were improved.

[0083] If the flow rate does not recover after execution, the platform reduces the confidence level of insufficient valve opening as the sole root cause based on the failure receipt, re-enables pipeline blockage as a candidate cause, and outputs subsequent verification steps such as differential pressure verification, filter inspection, and backup pipeline switching.

[0084] Example 3: Security Gating in Case of Conflicting Multiple Source Evidence A high concentration alarm for combustible gas was triggered in the storage and transportation area. Video analysis did not detect any leaking plume, the readings of two adjacent redundant gas sensors were normal, the alarm sensor was in a calibration expired state, and wind direction data was missing. The platform considered sensor drift, localized minor leaks, and communication anomalies as candidate causes.

[0085] Due to missing key wind direction data, conflicts between individual sensors and redundant measuring points, and low reliability of alarm sensors, the overall inference uncertainty exceeds the second threshold. The platform does not output deterministic control recommendations to close a specific valve; instead, it outputs low-risk steps such as having personnel move away from the alarm point, using a portable detector to verify the upwind direction, checking the sensor power supply and calibration status, setting up a warning zone according to existing procedures, and notifying the relevant personnel.

[0086] Once the portable detector confirms that the gas concentration at the corresponding location is normal, the platform adds supporting evidence for sensor drift candidates; once the portable detector confirms that the concentration is abnormal, the platform re-establishes a three-layer inference graph based on the on-site detection results as highly reliable observations, and continues to locate the leak source based on pipeline topology and wind direction information.

[0087] Example 4: Construction and Deployment of Inference Model The reasoning model of this invention can be implemented by combining symbolic rule reasoning, probabilistic graphical reasoning, and data-driven parameter learning. Material flow direction, interlock prohibition conditions, permission conditions, and action mutual exclusion relationships are stored using symbolic rules; the credibility of working condition causal relationships, propagation delay distribution, and action effectiveness are stored using updatable parameters; counterfactual state propagation can be implemented using discrete state transitions, Bayesian networks, structural causal models, or lightweight dynamic models calibrated with field data.

[0088] To ensure real-time performance, edge computing nodes can perform alarm deduplication, time synchronization, basic window partitioning, and local operational condition verification, while the central platform completes cross-regional three-layer inference graph construction, counterfactual root cause reasoning, and action sequence optimization. In the event of a communication interruption, edge computing nodes retain only approved low-risk verification rules and fixed security fallback procedures, and will not generate new high-risk handling actions in the absence of central evidence.

[0089] The system may include a data access module, an event standardization module, an adaptive window module, a three-layer inference graph module, an evidence consistency verification module, a counterfactual root cause reasoning module, a handling action orchestration module, an effect evaluation module, a parameter update module, and a security gating module. These modules can be deployed on the same server or implemented collaboratively by the server and edge computing devices.

[0090] A computer program that performs the method of the present invention can be stored in a non-volatile computer-readable storage medium and executed by at least one processor. Computer-readable storage media include, but are not limited to, read-only memory, random access memory, solid-state drives, magnetic disks, optical disks, and other media capable of storing program instructions.

[0091] The technical features described above can be combined with each other when there is no conflict. For those skilled in the art, any equivalent substitutions made to node types, relationship types, scoring methods, threshold setting methods, or deployment structures without departing from the inventive concept should fall within the protection scope of this invention.

[0092] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for alarm correlation and handling recommendation in a comprehensive safety production analysis platform, characterized in that, Includes the following steps: Step S1: Obtain multi-source alarm data and operating condition data from the production site, map the multi-source alarm data and operating condition data into standard event objects with object identifier, variable type, status value, occurrence time, topology location, production stage, data source and data source credibility, and determine an adaptive correlation observation window based on process propagation delay, alarm density and production stage. Step S2: Construct a three-layer reasoning graph of alarm-operating condition-handling based on the standard event object. The three-layer reasoning graph includes alarm nodes, operating condition nodes, handling action nodes, as well as alarm observation relationships, operating condition causal relationships, action effect relationships, and action constraint relationships. Step S3: Generate candidate association edges within the adaptive association observation window, calculate the evidence consistency of candidate association edges based on time sequence, process topology reachability, process propagation direction, parameter response sign, interlocking status, historical support, and data source credibility, and delete candidate association edges that violate preset hard process constraints. Step S4: Determine candidate cause nodes from the verified three-layer inference graph, perform counterfactual intervention to set each candidate cause node to a normal state, propagate the state change after intervention along the working condition causal relationship, and determine the counterfactual interpretation gain of each candidate cause node based on the remaining alarm risk after propagation. Step S5: Based on the counterfactual explanation gain, the path evidence from the candidate cause node to the actual alarm node, and the root cause quantity penalty, solve for the minimum root cause set whose alarm weighted coverage is not lower than the preset coverage threshold; Step S6: Extract candidate actions from the action nodes based on the minimum root cause set, verify the preconditions, prohibition conditions, execution permissions, on-site resources, interlocking conflicts, action mutual exclusion relationships and secondary risks of the candidate actions, generate at least one executable action sequence, and sort the executable action sequence according to the expected risk decay, root cause coverage, execution time, resource conflict cost and reasoning uncertainty. Step S7: Obtain the execution receipt of the handling action and the working condition data after the handling, compare the predicted risk decay with the actual risk decay, and update the credibility of the working condition causal relationship and the action effectiveness parameters of the handling action respectively. And when the degree of evidence conflict or reasoning uncertainty exceeds the corresponding threshold, the output will be limited to the working condition verification steps and the preset safety fallback actions.

2. The method according to claim 1, characterized in that, The standard event object also includes threshold or expected state, duration, peak value, change slope and number of repetitions; fingerprint merging is performed on events that are repeatedly reported by the same object and the same variable within a preset deduplication time, and the effective alarm range of jitter type threshold alarm is determined by the entry threshold, exit threshold and shortest duration. The reliability of the data source is determined based on sensor calibration status, communication quality, data integrity rate, recent maintenance time, and consistency of redundant measurement points.

3. The method according to claim 1, characterized in that, The window length of the adaptive correlation observation window is jointly determined by the base window, the propagation delay from the seed alarm corresponding object to the process topology reachable object, the current alarm density, and the production stage change index. When the alarm density is higher than the density threshold, the time range used to merge independent events is shortened. During the start-up, shutdown, switching, feeding, or maintenance stages, the time range is expanded according to the allowable propagation delay of the corresponding process link, and the window length is limited to between the preset minimum window and the preset maximum window.

4. The method according to claim 1, characterized in that, The causal relationships of the operating conditions include at least one of the following: material transfer relationship, energy transfer relationship, mechanical connection relationship, spatial diffusion relationship, control loop relationship, and interlocking protection relationship; each causal relationship of the operating conditions stores the direction of action, parameter response symbol, allowable response delay interval, applicable production stage, relationship credibility, and source of evidence; each action node stores the action object, action type, preconditions, expected effect, prohibition conditions, required permissions, required resources, expected response delay, failure rollback action, and risk level.

5. The method according to claim 1, characterized in that... Candidate reason nodes To candidate result node Consistency of evidence Determined according to the following formula: ； in, For normalization function, For time compliance, For topological reachability, For process direction conformity, For parameter response sign compliance, For historical support, Punishment for contradictory evidence and The corresponding weight is used; when a candidate associated edge violates the material flow direction, energy transfer direction, control loop action direction, or irreversible hard constraints in the interlocking logic, the candidate associated edge is deleted.

6. The method according to claim 1, characterized in that, Counterfactual explanation gain of candidate cause c Determined according to the following formula: ； Among them, Robs represents the weighted alarm risk under the current observation status. To mitigate the remaining alert risk after counterfactual intervention on candidate cause c, The minimum root cause set is obtained by solving an objective function that increases the gain of path evidence and counterfactual explanation while reducing the number of root causes, provided that the actual alarm weighted coverage is not lower than a preset coverage threshold. The output is the order of occurrence, process path, parameter response direction, supporting alarm, contradictory alarm, counterfactual explanation gain, and data source credibility of each root cause.

7. The method according to claim 1, characterized in that, The action constraint relationships include preconditions, mutual exclusions, parallelisms, waiting relationships, rollbacks, and permission relationships. A directed acyclic action graph is constructed based on the action constraint relationships. A candidate action sequence is generated by forward state deduction. The preconditions of the next action are re-verified in the predicted state after each action is executed. The corresponding candidate action sequence is terminated when a high-level secondary risk, resource conflict, or interlocking conflict is predicted.

8. The method according to claim 1, characterized in that, Establish an effect observation interval centered on the expected response time of each action, and determine the actual risk attenuation based on the amount of root cause state recovery, the amount of downstream alarm reduction, the amount of risk level decrease, and the amount of new secondary risks. When multiple actions are executed in parallel, the contribution interval is divided according to the expected response delay, the target, and the impact path. The action combination effectiveness is updated for actions with overlapping impact paths and indistinguishable contributions. The credibility of the causal relationship is updated using successful evidence and failure evidence. The inference uncertainty is determined at least based on the key data missing rate, the candidate root cause score difference, the number of hard constraint conflicts, the proportion of low credibility causal relationships, and the variance of the action effect.

Images