RWKV model-based railway ticket station-level safety operation and maintenance method and platform

Abstract

The invention discloses a railway ticket station-level safety operation and maintenance method and platform based on an RWKV model. The method comprises the steps of collecting multi-source heterogeneous time sequence data generated in operation of ticket terminal equipment; the collected multi-source heterogeneous time series data are preprocessed; inputting the preprocessed multi-source heterogeneous time sequence data into a pre-trained RWKV model, reasoning by using a time mixing module and a channel mixing module of the RWKV model, and outputting a quantitative index for evaluating the health state of the equipment; the quantitative index comprises a fault early warning probability value representing the health state of the equipment; and generating and executing an operation and maintenance instruction based on the quantitative index, wherein the operation and maintenance instruction comprises the functions of triggering a grading alarm, generating a disposal work order or starting and stopping equipment. According to the method, the fault diagnosis efficiency and accuracy can be improved, the high availability and safety of a railway ticket selling system are guaranteed, the operation and maintenance efficiency is remarkably improved, and in addition, the invention further provides a railway passenger ticket station level safety operation and maintenance platform based on the RWKV model, and the same beneficial effects are achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of railway informatization technology, more particularly to a railway ticket station-level safe operation method based on an RWKV model. BACKGROUND

[0002] The railway ticket system is a core component of key transportation infrastructure, and its station-level nodes bear key functions such as terminal management, local transaction processing, and data synchronization verification. The stable operation of terminal devices such as self-service ticketing machines and ticket gates deployed in these nodes is directly related to the transportation order and passenger travel experience.

[0003] Currently, the safety operation of railway ticket stations mainly relies on a monitoring system based on fixed rules and manual experience. This existing technical solution is usually composed of the following parts: first, the state data, network traffic, and operation logs of the equipment are collected through the deployed sensors and log systems; second, the pre-set static threshold is used for abnormality judgment; and finally, when the threshold is triggered, an alarm is generated and the operation personnel are relied on to intervene in fault diagnosis and disposal. However, this existing technical solution has inherent structural defects. The existing solution relies on static thresholds and cannot effectively handle long sequences of multi-source heterogeneous time series data generated during equipment operation. At the same time, it has low fault diagnosis efficiency and poor accuracy, and is prone to cause passenger delays during peak passenger transport periods. That is, the existing technology has the technical problems of early warning lag, low efficiency of diagnosis, and lack of intelligence.

[0004] Therefore, how to provide a railway ticket station-level safe operation method based on an RWKV model, which can improve the efficiency and accuracy of fault diagnosis and improve the operation efficiency through an automated process to ensure the high availability and security of the railway ticketing system, is a technical problem that needs to be solved by those skilled in the art. SUMMARY

[0005] To solve the above technical problems, the present application provides a railway ticket station-level safe operation method based on an RWKV model, which can improve the efficiency and accuracy of fault diagnosis and improve the operation efficiency through an automated process to ensure the high availability and security of the railway ticketing system. The present application also provides a railway ticket station-level safe operation platform based on an RWKV model, which also has the above beneficial effects.

[0006] The present application provides a technical solution as follows: The present application provides a railway ticket station-level safe operation method based on an RWKV model, comprising the steps of: collecting multi-source heterogeneous time series data generated during the operation of ticket terminal equipment; Preprocessing the collected multi-source heterogeneous time series data; inputting the preprocessed multi-source heterogeneous time series data into a pre-trained RWKV model, performing joint inference by using a time mixing module and a channel mixing module of the RWKV model, and outputting a quantitative index for evaluating a device health state; receiving and analyzing the quantitative index output by the RWKV model, wherein the quantitative index comprises a failure warning probability value representing the device health state; generating and executing an operation and maintenance instruction based on the quantitative index, wherein the operation and maintenance instruction comprises triggering a hierarchical alarm, generating a treatment work order, or starting and stopping a device function.

[0007] Further, in a preferred manner of the present application, preprocessing the collected multi-source heterogeneous time series data comprises: parsing the text log data, converting the original log into a standardized word sequence through dynamic variable replacement and word segmentation filtering; normalizing the numerical sensor data, performing time alignment, missing value interpolation, and Z-score standardization processing to eliminate the dimension effect; constructing high-order time series features, and calculating statistical features and frequency domain features of the normalized numerical data within a sliding window.

[0008] Further, in a preferred manner of the present application, the construction of the RWKV model comprises the steps of: dynamically adjusting the weight of historical information by using a time decay factor to enhance the memory of long-term key events of the device; using a multivariate attention mechanism to assign dynamic weights to different device parameters in the multi-source heterogeneous time series data; training the model using historical time series data containing device failure labels, and using a Focal Loss loss function to solve the class imbalance problem of failure samples.

[0009] Further, in a preferred manner of the present application, the inference by using the time mixing module and the channel mixing module of the RWKV model specifically comprises: performing weighted fusion on the outputs of the RWKV sub-model, the LSTM-CNN sub-model, the support vector machine SVM sub-model, and the random forest sub-model by using a multi-model fusion system to generate the failure warning probability value.

[0010] Further, in a preferred manner of the present application, the method further comprises the steps of: introducing a device failure case library and device structure knowledge, wherein the device failure case library comprises: historical failure types, corresponding failure features, and failure handling schemes; using a CNN-Transformer model to process waveform data at the time of failure, extracting local and global features of the failure waveform graph to form a failure feature vector; Calculate the similarity of the fault feature vector and the cases in the device fault case library, and combine the device structure knowledge to perform reverse deduction for precise positioning of the fault module.

[0011] Further, in a preferred mode of the present application, it further comprises the step of: using personnel activity data, device state data and environmental factor data, using fuzzy comprehensive evaluation method or analytic hierarchy process method to establish a station safety risk assessment model.

[0012] Further, in a preferred mode of the present application, it further comprises the step of: periodically collecting feedback data generated during operation and maintenance operation execution, and using the feedback data to incrementally train the RWKV model to optimize the model parameters; predicting future business load peaks according to historical passenger flow data, and automatically adjusting computing resources, spare parts inventory or personnel scheduling plan according to the prediction results.

[0013] In addition, the present application also provides a railway ticket station-level safety operation and maintenance platform based on the RWKV model, which is used to realize the railway ticket station-level safety operation and maintenance method based on the RWKV model as described above, comprising: A data acquisition layer is used to acquire multi-source heterogeneous time series data of a station-level ticket system; An RWKV model inference layer is deployed on a station edge server and comprises a pre-trained RWKV model, which is used to perform real-time inference on preprocessed data and output fault probability and risk warning; A safety operation and maintenance service layer provides device state monitoring, intelligent fault diagnosis, safety event handling and operation and maintenance resource scheduling functions, and is used to drive a closed-loop operation and maintenance process according to the output results of the RWKV model inference layer; A man-machine interaction layer is used to display warning information, operation and maintenance work orders and statistical reports, and supports voice interaction with operation and maintenance personnel.

[0014] Further, in a preferred mode of the present application, the data acquisition layer specifically comprises: A device state monitoring module is used to acquire operating parameters of ticket selling terminals and ticket checking gates; An environmental monitoring module is used to monitor device operating environment through temperature and humidity sensors and smoke sensors; A network probe module is used to acquire network traffic, port access records and abnormal login logs; A data preprocessing module is used to clean, convert, integrate and normalize the acquired multi-source heterogeneous data to form standardized input feature vectors.

[0015] Further, in a preferred mode of the present application, the RWKV model inference layer specifically comprises: A model training module is configured to train the RWKV model by using historical equipment time series data and taking Focal Loss as a loss function. A real-time inference engine is configured to input the preprocessed feature vector into the trained RWKV model, capture time dependency through a time mixing module, and perform cross-feature correlation analysis through a channel mixing module, and output a device health state score and a failure probability; the inference layer of the RWKV model is further integrated with a multi-model fusion module configured to receive output results of the RWKV sub-model, the SVM and random forest-based machine learning sub-model, and the LSTM-CNN-based deep learning sub-model.

[0016] The railway ticket station-level safety operation method based on the RWKV model provided by the present application includes the following steps: collecting multi-source heterogeneous time series data generated during operation of a ticket terminal device; preprocessing the collected multi-source heterogeneous time series data; inputting the preprocessed multi-source heterogeneous time series data into a pre-trained RWKV model, and performing joint inference by using a time mixing module and a channel mixing module of the RWKV model to output a quantitative indicator for evaluating the health state of the device; receiving and analyzing the quantitative indicator output by the RWKV model, wherein the quantitative indicator includes a failure warning probability value representing the health state of the device; generating and executing operation and maintenance instructions based on the quantitative indicator, wherein the operation and maintenance instructions include triggering a hierarchical alarm, generating a disposal work order, or starting and stopping a device function. The railway ticket station-level safety operation method based on the RWKV model provided by the present application can improve the efficiency and accuracy of fault diagnosis, improve the operation and maintenance efficiency through an automated process, ensure the high availability and safety of the railway ticketing system, significantly shorten the average fault diagnosis time, significantly improve the efficiency of solving difficult faults, improve the operation and maintenance efficiency; at the same time, the risk of data misoperation is reduced, the accuracy of safety event prediction is significantly improved, and the dynamic scheduling of operation and maintenance personnel and spare parts is realized in combination with passenger flow prediction, the resource utilization rate is significantly improved, and the operation and maintenance cost is significantly reduced. The present application has enhanced scalability and does not need to reconstruct the platform, which is suitable for various station scenarios. In addition, the present application also provides a railway ticket station-level safety operation platform based on the RWKV model, which also has the above-mentioned beneficial effects. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without any creative effort.

[0018] Fig. 1A flowchart of a railway ticket station-level safety operation method based on an RWKV model according to an embodiment of the present application is shown in the figure. Fig. 2 A general system architecture of railway ticket station-level safety operation based on an RWKV model according to an embodiment of the present application is shown in the figure. Fig. 3 An architecture diagram of a station safety operation service platform according to an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0019] In order for those skilled in the art to better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0020] As shown in the figure, Figs. 1 to 3 The present application provides a railway ticket station-level safety operation method based on an RWKV model, which comprises: collecting multi-source heterogeneous time series data generated in the operation of a ticket terminal device; preprocessing the collected multi-source heterogeneous time series data; inputting the preprocessed multi-source heterogeneous time series data into a pre-trained RWKV model, and performing joint inference using the time mixing module and the channel mixing module of the RWKV model to output a quantitative indicator for evaluating the health status of the device; receiving and analyzing the quantitative indicator output by the RWKV model, wherein the quantitative indicator comprises a fault warning probability value representing the health status of the device; generating and executing operation and maintenance instructions based on the quantitative indicator, wherein the operation and maintenance instructions comprise triggering hierarchical alarms, generating disposal work orders, or starting and stopping device functions. The railway ticket station-level safety operation method based on the RWKV model provided by the present application can improve the efficiency and accuracy of fault diagnosis, and improve the operation and maintenance efficiency through an automated process, thereby ensuring the high availability and safety of the railway ticketing system. The average fault diagnosis time is shortened from 40 minutes to within 10 minutes, the efficiency of solving difficult faults is significantly improved, and the operation and maintenance efficiency is improved. At the same time, the risk of data misoperation is reduced, the accuracy of safety event prediction is significantly improved, and the dynamic scheduling of operation and maintenance personnel and spare parts is realized in combination with passenger flow prediction, the resource utilization rate is significantly improved, and the operation and maintenance cost is significantly reduced. The present application has enhanced scalability and does not need to be restructured. It is suitable for various station scenarios. In addition, the present application also provides a railway ticket station-level safety operation platform based on an RWKV model, which also has the above-mentioned beneficial effects.

[0021] In the data collection step, through the deployment of sensors such as temperature sensors, voltage sensors and log interfaces such as network controllers at the station, multi-source heterogeneous time series data of ticket terminal equipment such as self-service ticket vending machines and ticket gates are collected, including hardware sensor data such as temperature, current and voltage, sampling frequency of 1Hz~10Hz, operation log data such as operation records, error codes and network communication data such as network delay and data packet loss rate. These data are encrypted and transmitted through YD-SOMN security control protocol to ensure data security. In the data preprocessing step, the collected data are cleaned, such as missing value processing using linear interpolation, abnormal value marking based on 3σ principle, alignment, uniform interpolation of non-equidistant data to 1Hz time series and standardization, numerical type features using Z-score standardization, and category type features using Embedding mapping to form input feature vectors within 512 dimensions to eliminate baseline differences between devices and improve data quality. In the intelligent analysis and early warning step, the preprocessed feature vectors are input into the pre-trained RWKV model. The model captures the time evolution law of the device state through the time mixing module Time-mix, such as the slow rising trend of temperature, and performs cross-feature nonlinear interaction modeling through the channel mixing module Channel-mix, such as the correlation between voltage drop and monitoring signal fluctuation, and outputs the device failure probability, a value between 0 and 1. The model inference delay is controlled within 100ms, supporting real-time processing. In the operation and disposal step, according to the failure probability, a hierarchical early warning is triggered, such as probability 0.3~0.6 for first-level warning, 0.6~0.8 for second-level warning and ≥0.8 for third-level warning, and an operation work order is automatically generated and pushed to the operation personnel terminal through APP or SMS. Through the efficient time series processing capability of the RWKV model, early warning of device failure is realized 30 minutes to 2 hours in advance, the average diagnosis time of failure is shortened from 40 minutes to within 10 minutes, the operation response speed and accuracy are improved, and the operation cost is reduced through automatic disposal and reduction of manual intervention.

[0022] Specifically, in the embodiments of the present application, the preprocessing of the collected multi-source heterogeneous time series data includes: analyzing the text log data, converting the original log into a standardized word sequence through dynamic variable replacement and word segmentation filtering; normalizing the numerical sensor data, performing time alignment, missing value interpolation and Z-score standardization processing to eliminate the influence of dimension; constructing high-order time series features based on the statistical features and frequency domain features of the normalized numerical data within the sliding window.

[0023] The embodiment of the application is implemented based on a three-level distributed system architecture, which comprises a remote security service center (SSOC), a station center ticket security system and a station security operation access platform. Through a YD-SOMN security management and control protocol, policy issuing, event reporting and global cooperation are realized. The ticket security system serves as a secondary control node and comprises a security management and control center, a security monitoring and audit center and a security emergency response center. The security management and control center is composed of boundary protection equipment and intrusion detection equipment. The security monitoring and audit center adopts ELK-Stack for log aggregation and combines with an RWKV model for abnormal behavior identification. The station security operation access platform serves as a terminal node and deploys a network controller to support more than 100,000 network session monitoring. Data is uploaded to the station center through an API interface, multi-level processing and cooperation of data are realized, the scalability and reliability of the system are improved, the network load is reduced through hierarchical processing, station-level edge deployment is supported, and the characteristics of dispersion and high real-time requirement of the railway ticket system are adapted. Meanwhile, the standardized protocol ensures safe transmission of data.

[0024] Specifically, in the embodiment of the application, the construction of the RWKV model comprises the steps of: dynamically adjusting the weight of historical information by using a time decay factor to enhance the memory of long-term key events of the equipment; using a multivariate attention mechanism to assign dynamic weights to different equipment parameters in the multi-source heterogeneous time series data; and using historical time series data containing equipment failure labels to train the model, and using a Focal Loss loss function to solve the class imbalance problem of failure samples.

[0025] Specifically, in the embodiment of the application, the inference by using the time mixing module and the channel mixing module of the RWKV model is specifically: the outputs of the RWKV sub-model, the LSTM-CNN sub-model, the support vector machine SVM sub-model and the random forest sub-model are weighted and fused by a multi-model fusion system to generate the fault early warning probability value.

[0026] Specifically, in the embodiment of the application, the steps further comprise: a device fault case library and device structure knowledge are introduced; the device fault case library comprises: historical fault types, corresponding fault features and fault handling schemes; a CNN-Transformer model is used to process waveform data when a fault occurs, local and global features of a fault waveform graph are extracted to form a fault feature vector; the similarity between the fault feature vector and the cases in the device fault case library is calculated, and reverse deduction is performed in combination with the device structure knowledge to accurately locate the fault module.

[0027] In an embodiment of the present application, the model dynamically adjusts the weight of historical information with a time decay factor, such as for device failure warning scenarios, optimizes the decay parameter to enhance the memory of long-term key events such as the last maintenance record, and a multivariate attention mechanism assigns dynamic weights to different device parameters such as temperature and current, focusing on key influencing factors. During training, historical time series data containing device failure labels such as continuous 72-hour monitoring signal sequences are used, and the dataset is constructed through a sliding window, such as a window length of 120 steps, with the label being whether there is a failure within 30 minutes after the end of the window. Data augmentation such as time perturbation and noise injection is used to solve the sample imbalance problem, and the optimizer uses AdamW with a learning rate of 1e-4 and a weight decay of 1e-5. The loss function uses Focal Loss to alleviate the class imbalance caused by the scarcity of failure samples. The training hardware is based on 8xNVIDIA A100, which uses the parallel training capability of RWKV to accelerate convergence, improving the accuracy and robustness of the model, and increasing the accuracy of failure warning to more than 95%. At the same time, through adaptive learning, false positives are reduced, and the adaptability of the model to individual differences in devices is enhanced. Among them, the feature extraction of the text log data includes data cleaning of the log text: removing redundant symbols such as delimiters, garbled characters, standardizing formats, and dynamic variable replacement. Secondly, use TextCNN or lightweight BERT-mini model to extract semantic features: TextCNN uses multiple size convolution kernels to capture local phrase features, outputting a fixed dimension vector; BERT-mini captures context semantics through Transformer layers, outputting a 256-dimensional vector. The extracted feature vector is concatenated with the numerical sensor data to form a comprehensive input feature, effectively handling the heterogeneity and noise of log data, improving the feature expression capability, and enabling the RWKV model to more accurately identify complex failure patterns and reduce false positives and false negatives.

[0028] In addition, the embodiment of the present application further comprises the steps of: using personnel activity data, device state data and environmental factor data, using fuzzy comprehensive evaluation method or analytic hierarchy process, establishing a station safety risk assessment model.

[0029] Specifically, in the embodiment of the present application, it further comprises the steps of: periodically collecting feedback data generated during operation and maintenance operation, and using the feedback data to perform incremental training on the RWKV model to optimize the model parameters; predicting future business load peaks according to historical passenger flow data, and automatically adjusting computing resources, spare parts inventory or personnel scheduling plans according to the prediction results.

[0030] In addition, the present application also provides a railway ticket station-level safety operation and maintenance platform based on the RWKV model, which is used to realize the railway ticket station-level safety operation and maintenance method based on the RWKV model as described above, comprising: A data acquisition layer is used to acquire multi-source heterogeneous time series data of a station-level ticket system. The RWKV model inference layer deployed on the station edge server includes a pre-trained RWKV model, which is used for real-time inference on preprocessed data to output a fault probability and a risk warning. The safe operation service layer provides device state monitoring, intelligent fault diagnosis, security event handling, and operation resource scheduling functions, and is used to drive a closed-loop operation process according to the output result of the RWKV model inference layer. The human-computer interaction layer is used to display warning information, operation work orders, and statistical reports, and supports voice interaction with operation personnel.

[0031] Specifically, in the embodiments of the present application, the data collection layer specifically includes: A device state monitoring module is used to collect operation parameters of ticket selling terminals and ticket checking gates. An environment monitoring module is used to monitor device operating environments through temperature and humidity sensors and smoke sensors. A network probe module is used to collect network traffic, port access records, and abnormal login logs. A data preprocessing module is used to clean, convert, integrate, and normalize the collected multi-source heterogeneous data to form standardized input feature vectors.

[0032] Specifically, in the embodiments of the present application, the RWKV model inference layer specifically includes: A model training module is used to train the RWKV model using historical device time series data with Focal Loss as the loss function. A real-time inference engine is used to input the preprocessed feature vectors into the trained RWKV model, capture time series dependency through a time mixing module, and perform cross-feature correlation analysis through a channel mixing module to output a device health state score and a fault probability. The RWKV model inference layer also integrates a multi-model fusion module, which is used to receive output results of RWKV sub-models, machine learning sub-models based on SVM and random forests, and deep learning sub-models based on LSTM-CNN.

[0033] More specifically, as an important part of the core infrastructure of the railway ticket system, the passenger travel service is the core infrastructure of the station level node, which undertakes the key functions of ticket terminal management, local transaction processing, data synchronization verification, etc. Its safe and stable operation is directly related to the transportation order and passenger experience. In view of the problems of fault early warning lag, low safety threat recognition accuracy, and insufficient multi-source data integration capability in the existing station level operation and maintenance, although there are existing technologies related to railway operation, they focus on network level data analysis and resource scheduling, and do not design solutions for the characteristics of station level equipment dispersion and high real-time response requirements. Moreover, the ticket centralized operation and maintenance platform only realizes process standardization, lacks active early warning and intelligent diagnosis capabilities driven by AI, and the new RWKV model, as a fusion architecture that combines the advantages of recurrent neural network (RNN) and Transformer, has high-efficiency processing capability for long sequence data, and its computational complexity and memory occupation are significantly lower than those of traditional Transformer models, which has shown excellent performance in time series prediction and natural language understanding.

[0034] The introduction of the RWKV model into the field of railway ticket safety operation provides a technical basis for operation and maintenance log analysis and fault dialogue diagnosis. Therefore, the RWKV model is deeply integrated with the station level operation and maintenance scenario, which is expected to break through the existing technical bottlenecks, but there is no related technical solution to realize landing application at present. It is urgent to build an AI operation and maintenance system adapted to the station scenario, realize the transformation from passive repair to active defense, and based on this, the embodiments of the present application aim to solve the problems of fault response lag, low safety threat recognition accuracy, insufficient multi-source data integration capability, and lack of intelligent decision-making in the existing railway ticket station level operation and maintenance, specifically including: realizing early warning of equipment failure and data security risk, shortening the fault diagnosis time; building a closed-loop operation and maintenance mechanism to integrate the whole process of fault positioning, disposal, and tracing; adapting to the heterogeneous data environment of the station level to improve the accuracy of operation and maintenance decision-making in complex scenarios. The platform involved in the embodiments of the present application relies on the security management and control platform and network security base supported by the four-level network security protection system of the railway ticket, and the security monitoring and auditing service platform is established. The platform is deployed in each railway group company, can actively collect user security service information through the YD-SOMN security management and control protocol and related API interface, and realizes monitoring, auditing, evaluation, diagnosis, and comprehensive analysis of the user network security environment through security monitoring, security auditing, and simulation technology, as well as the remote monitoring, auditing, evaluation, and expert diagnosis system deployed by the ticket office center, automatically helps users to handle the security configuration of the system, asset security management, security mechanism, and the calling process of security services to respond to security events that occur in the system, protects the user's set target, and continuously solves the dynamic security problems that occur in the information system operation process.

[0035] The present application takes the railway ticket four-level network security guarantee system as the basis, the platform adopts the three-level distributed architecture of "remote security service center (SSOC), local center ticket security system, station security operation access platform", combines the RWKV model and the YD-SOMN management and control protocol, realizes the intelligent processing and multi-level collaborative operation of safety data. Among them, the remote security service center (SSOC) supports elastic expansion, establishes trusted communication through the YD-SOMN security management and control protocol, establishes the existing security management and control equipment, realizes the coupling of the original security management and control equipment, and finally realizes the monitoring, auditing and simulation of the ticket system. At the same time, through the YD-SOMN security management and control protocol and related API interface, the running state, log information, security information, security events and other information events of the security management and control center platform related equipment deployed in the railway ticket network security system can be collected. The platform system architecture combines SSE-CMM as a guide, establishes a security service system, and implements security service engineering by the method of system engineering, and continuously reduces the security risk in the information system through the risk process, engineering process and guarantee process; The security service is divided into five levels, and the graded security service is provided for the security domain of different levels and the equipment of different security levels, so that the information system meets the requirements of the competent department under reasonable investment; A dynamic response security service system is established to solve the contradiction between the changing security risks in the information system and the lack of human resources to discover the security risks in the information system at every moment; The manageable and automatic security service system uses the security facilities and security management and control capabilities deployed by the ticket to complete a large number of basic information system vulnerability checks, security audits, security monitoring, security reinforcement and other security service work, provides basic information for security scheme design by information security experts, and establishes a perfect information security expert database.

[0036] Specifically, the platform involves three core modules: security management and control center: composed of boundary protection equipment, intrusion detection equipment, security authentication system, etc., providing password service, access control and other basic security capabilities, outputting device state data through security monitoring / audit interface; Security monitoring and auditing center: deploying security evaluation scanning, expert diagnosis and service simulation system, using ELK-Stack to realize log centralized aggregation and analysis, and combining RWKV model to identify abnormal behavior; Security emergency response center: stores emergency plan library, receives risk strategy issued by SSOC and executes response operation.

[0037] Among them, the station safety operation access service platform, as the terminal access node, adopts the "data layer-big model engine layer-service layer-interaction layer" architecture, deploys the network controller, supports more than 100,000 network session monitoring, provides network status analysis, risk scanning, local emergency disposal and other functions, and uploads terminal logs to the bureau center through the API interface.

[0038] Among them, the data acquisition layer involved in the embodiments of the present application is realized by using a network controller and various network probes, and by means of a YD-SOMN safety control protocol and a standardized API interface, safety service information of a station-level ticket system is actively collected, including terminal device status, network traffic data, operation logs, safety configuration parameters and asset account information, and encrypted transmission with station terminals and bureau center servers is realized through a controllable safety communication platform. Among them, the device state monitoring device: such as ticketing terminals, station travel service equipment, such as gates, cameras, etc., real-time collection of device running parameters; for monitoring device status and personnel activity.

[0039] Environmental monitoring equipment: such as temperature and humidity sensors, smoke sensors, harmful gas sensors, etc., real-time monitoring of the environmental conditions in the station. Personnel positioning equipment: real-time positioning of operation and maintenance personnel, grasping personnel position information, and ensuring personnel safety.

[0040] The network controller is used as a data acquisition gateway, and the data collected by various sensors and devices are summarized, converted and transmitted to the data layer, which does not limit to containing business data and safety data; Business data interface: collecting ticket transaction stream, order status, data synchronization log and other business data; safety data interface: connecting with firewall, intrusion detection system, obtaining network traffic, port access record, abnormal login log and other safety data.

[0041] Data storage and archiving: by integrating the above core data, including device status data, business operation data, safety log data, the data is standardized after processing, and is transmitted to the local cache node through the dual-redundancy communication network.

[0042] Data preprocessing module: cleaning the collected data, removing noise, missing value filling, etc., conversion, data format conversion, standardization, etc., integrating multi-source data fusion and protocol data dimension reduction, etc., improving data quality, reducing data redundancy, and providing clean and standardized data for AI big model training and reasoning.

[0043] Data management module: realizes the functions of data permission management, backup and recovery, data synchronization, etc., ensures the safety, integrity and consistency of data. As to the RWKV model inference layer in the embodiment of the application, the RWKV model inference layer as the platform intelligent core comprises a model training module and an inference engine, is suitable for station-level edge server deployment, performs feature extraction and associated coding on collected time series data, realizes real-time inference of safety anomalies and risk level evaluation through multi-scale time series segmentation technology, and the model inference delay is controlled within 100 ms.

[0044] Among them, the data preprocessing model: feature engineering processing is performed on the data, such as feature extraction, feature selection, etc., to provide more effective feature vectors for subsequent model training, form multi-dimensional device operation state data, including device historical operation data such as operation time length, load rate, past fault records; real-time operation data such as network congestion, host resource overload, service deadlocks, etc.; fault state data such as fault time check features, monitoring signal waveform graphs, fault occurrence time.

[0045] Among them, the fault early warning module is fused through RWKV and machine learning, is based on the RWKV model, and is fused with machine learning algorithms, including support vector machine SVM, random forest, etc., or deep learning models such as LSTM, CNN, etc., uses device historical operation data and real-time data to establish a device fault early warning model to predict possible faults of the device.

[0046] The basic model: the RWKV model is used to process device time series data, and the optimal monitoring signal change sequence of 72 hours is selected to capture long-term dependence of data, and a time series feature vector is output.

[0047] The fusion model: the time series feature vector output by the RWKV is input to a set of machine learning algorithms, including support vector machine SVM, random forest, etc., together with device static features including device model, service life, and a fault early warning result is output through a weighted voting mechanism, including fault occurrence probability and predicted occurrence time, and the early warning is triggered when the probability exceeds a preset threshold, and the preset threshold is preferably 85%.

[0048] As to the fault diagnosis and positioning module, the CNN-Transformer model is used to process fault data, wherein the CNN layer extracts local features of the fault waveform graph, such as waveform mutation points and peak abnormalities, and the Transformer layer captures global correlation between features, and outputs a fault feature vector.

[0049] Regarding knowledge fusion, a device fault case library is introduced, including historical fault types, corresponding features, treatment schemes, device structure knowledge, device internal module connection relationships, and module functions. The cosine similarity is used to match the fault feature vector with the case library data, and the device structure knowledge is used to deduce the fault impact path in reverse, to realize fault type diagnosis, such as voltage module fault, data transmission module fault, and fault location positioning, specific fault module number, and location.

[0050] Among them, the fault diagnosis and positioning model: combined with the device fault case library and the device structure knowledge, using deep learning models such as CNN-Transformer model to analyze the device fault data, to realize accurate diagnosis of fault type and precise positioning of fault location. For example, by analyzing the current and voltage data of the travel clothing device and the waveform graph at the time of fault, the fault type of the device is diagnosed, and the specific module where the fault occurs is determined.

[0051] Among them, the safety risk assessment model: comprehensively considers personnel activities, device status, environmental factors and other data, uses fuzzy comprehensive evaluation method, analytic hierarchy process (AHP) combined with machine learning model to establish station safety risk assessment model to evaluate the safety risk level of station and provide decision basis for safety management.

[0052] Among them, the emergency disposal scheme generation model: based on natural language processing (NLP) technology and knowledge graph, constructs railway station emergency disposal knowledge graph, integrates historical emergency disposal cases and related regulations and systems, when an emergency occurs, uses AI large model to generate corresponding emergency disposal scheme according to event type, severity and other information.

[0053] The safety operation service layer involved in the embodiments of the present application provides five major functional services, including device state monitoring, intelligent fault diagnosis, safety event disposal, operation and maintenance resource scheduling, and decision effect evaluation, forming a "monitoring, early warning, disposal, review" closed loop, which specifically includes: Real-time monitoring center, establish IT resource monitoring index model library, system monitoring index model library, business monitoring index model library, health degree model library. Real-time display of device running status, personnel position, environmental parameters and other information in the station in the form of map, chart, etc. When the device is abnormal or the personnel violates the rules, timely alarm information is sent, and the abnormal position and situation are marked on the interface.

[0054] Intelligent early warning management: display device fault early warning information, safety risk early warning information, etc., including early warning device name, early warning type, early warning level, expected occurrence time, etc., operation and maintenance personnel can view early warning details and perform corresponding processing operations, such as single maintenance, on-site investigation, etc.

[0055] Fault management: Implement functions such as fault reporting, fault diagnosis result viewing, fault handling progress tracking, and fault maintenance record management. Operation and maintenance personnel can submit device fault information through this module, the system automatically calls the fault diagnosis and positioning model to give diagnosis results and maintenance suggestions, and maintenance personnel record the maintenance process and results after completing the maintenance, forming a fault handling closed loop.

[0056] Security risk management: Analyze abnormal logs through causal reasoning mechanism, identify security risks such as database misoperation and unauthorized access, and output traceability report; at the same time, show station security risk assessment results, including risk levels of each area and each device, analyze the causes of risks, and provide risk control measures suggestions, management personnel can develop targeted security management strategies according to risk assessment results to reduce security risks.

[0057] Emergency command and dispatch: In the event of an emergency, display event information and emergency disposal plan, provide resource scheduling functions such as personnel, vehicles, and materials, and track emergency disposal progress in real time to ensure that emergency disposal work is orderly and efficient.

[0058] In addition, combined with passenger flow prediction data such as holiday peak period distribution, dynamically adjust operation and maintenance resource allocation, and generate work order priority suggestions.

[0059] Human-computer interaction layer: The human-computer interaction layer designs a graphical operation interface, supports one-key triggering of fault handling process by operation and maintenance personnel, integrates voice interaction function to realize work order voice broadcast and state query. In addition, it supports report statistical analysis, generates various statistical reports such as device fault statistical report, personnel inspection statistical report, and security risk statistical report according to operation and maintenance data, supports multi-dimensional analysis and query of data, and provides decision support for management personnel to help optimize operation and maintenance work flow and resource allocation.

[0060] In the embodiment of the application, the RWKV model-based ticket terminal device fault early warning is implemented as follows: The RWKV model involved in the embodiment of the application constructs an intelligent fault early warning, which is a key of the station safety operation and maintenance service platform. By utilizing the parallel training advantages of RWKV fusion Transformer and the efficient reasoning characteristics of RNN, the dynamic change law of the device running state is captured through time series modeling, the potential fault is early warned, and the early warning time can be 30 minutes to 2 hours.

[0061] Specifically, the following technical contents are included: RWKV constructs an intelligent early warning working mechanism The current mainstream AI large language model mainly adopts the Transformer architecture, such as GPT and LLaMA models. The Transformer model performs well in various tasks, but its computational complexity grows quadratically with the length of the input sequence, limiting its efficiency in processing long sequences and making it unsuitable for scenarios that require timely responses, such as security and maintenance.

[0062] The patent embodiment of the present application adopts a new RWKV sequence modeling architecture, which replaces the self-attention mechanism of the Transformer with a time mixing module and a channel mixing module, while retaining the advantages of both.

[0063] Furthermore, the following work warning mechanism is implemented: device data acquisition, data preprocessing, feature engineering, RWKV model inference, fault warning output, and operation and maintenance linkage. Multi-dimensional device state data acquisition collects multi-source heterogeneous time series data from railway ticket terminal devices, including: hardware sensor data (1Hz~10Hz sampling): temperature, humidity, voltage, current, fan speed, etc.; operation log data: operation records such as "ticket printing success" and "ticket refund request"; error codes such as "0x003 print paper"; status codes such as "standby" and "running"; network and communication data such as 1Hz sampling; network delay, packet loss rate, and server connection status; environmental data (0.1Hz sampling): environmental temperature and humidity in the area where the device is located; data storage uses a time series database (InfluxDB can be used), indexed by device ID and timestamp, and retains at least 3 months of historical data for model training.

[0064] Data cleaning and standardization preprocessing are implemented as follows: a. Data cleaning: Missing value processing: short-time missing (<5s) is filled with linear interpolation, and long-time missing is marked as "abnormal segment" and used as a feature.

[0065] b. Abnormal value processing: based on the 3σ principle to identify sensor jump anomalies, and keep the abnormal mark (not as noise removal, because the anomaly may be a precursor to failure). The 3σ algorithm is as follows: Gaussian distribution, also known as normal distribution, assumes that random variable X follows Gaussian distribution, i.e.:

[0066] Its probability density function is:

[0067] Where σ is the standard deviation and u is the mean.

[0068] The Gaussian distribution curve depends on two factors, namely the mean and the standard deviation, the mean of the distribution determines the center position of the graph, and the standard deviation determines the height and width of the image. When the standard deviation is small, the curve is "tall and thin", and when the standard deviation is large, the curve is "short and fat".

[0069] Sigma principle: the probability of numerical distribution in (μ-σ, μ+σ) is 0.6526; 2sigma principle: the probability of numerical distribution in (μ-2σ, μ+2σ) is 0.9544; 3sigma principle: the probability of numerical distribution in (μ-3σ, μ+3σ) is 0.9974; 3σ rule, interval (μ-3σ, μ+3σ) is considered as the actual possible value interval of random variable X, and the probability of falling outside the interval is less than three thousandths.

[0070] c. Time alignment: non-equidistant data is uniformly interpolated to 1Hz time series to ensure consistent time steps.

[0071] d. Standardization: Numerical features such as temperature, voltage: Z-score standardization is used, based on device historical mean and standard deviation, to avoid the influence of baseline differences between different devices.

[0072] Categorical features such as status code, error code: Embedding such as error code mapping to low-dimensional vector.

[0073] Text log: extract semantic features through TextCNN or pre-trained language models such as BERT-mini and convert them into fixed-dimensional vectors.

[0074] Regarding the time series feature enhancement involved in the embodiments of the present application, specifically including: constructing high-order time series features based on original features to improve the sensitivity of the model to failure precursors: statistical features: mean, variance, maximum, minimum, trend slope such as temperature rise rate within a sliding window (such as 5min, 30min); frequency domain features: extract high-frequency components of monitoring signals such as current through Fourier transform; state transition features: switching frequency of device status code, the dimension of the final input model feature vector is controlled within 512.

[0075] Regarding the design of the RWKV fault warning model in the embodiments of the present application, specifically including: RWKV architecture, the goal is to build a "real-time monitoring, intelligent warning, automatic handling, review and optimization" full-process ticket safety warning system, and shorten the emergency response time to seconds.

[0076] The time mixing module of the embodiments of the present application is used to aggregate the features of each time step in the sequence by weighting the historical information, and capture the evolution law of the device state over time, such as slow temperature rise, monitoring signal frequency change, etc.

[0077] The main purpose of the time mixing module is to realize global information interaction, which is similar to the self-attention module in the traditional Transformer. The module uses three variables R, K, and V, which correspond to Q, K, and V in the Transformer. The specific calculation formula is as follows:

[0078] Where µ is a weight used to control the time offset mixing, which can be regarded as a scalar in the time dimension. These formulas use a trainable weight vector W to linearly interpolate the current time step xi and the previous time step xi 1.

[0079] WKV operator calculation, the calculation method of the WKV operator in the model is similar to the method used in the Attention Free Transformer (AFT). However, unlike the case where W is a pair matrix in AFT, the model regards W as a channel vector and is modified by the relative position. In the model, this recursive behavior is defined by the time-dependent update of the WKV vector, which is shown in the following equation:

[0080] In RWKV, it is realized by multiplying the interaction of ki and vi at the scalar level, thereby avoiding the overhead of quadratic complexity. Finally, the output calculation formula of the time mixing module is as follows:

[0081] As the time step i increases, the vector Vi is affected by more and more historical information, because wkvi is a weighted sum over the position interval [1, i].

[0082] The interaction is realized by multiplication operation within a given time step, and the sum is performed over different time steps, which can effectively capture the long-term dependencies in the sequence data.

[0083] Regarding the channel mixing module in the embodiments of the present application, the following technical content is involved: nonlinear interaction modeling is performed on the multidimensional features of each time step, such as temperature, current, monitoring signals, operation log encoding, etc., to capture cross-feature correlations, such as the correlation between "voltage dip, abnormal fluctuation of monitoring signals" and power module failure. Parallel computing is supported, and GPU can be used for efficient training to solve the problem of slow RNN training speed, and adapt to the scene of station equipment failure warning. The equipment operation data is typical time series data, which is continuously generated according to the timestamp. The time series modeling capability of RWKV is naturally adapted. The terminal device has limited computing power, and the O(n) complexity of RWKV inference can meet the real-time requirements, while the high computing cost of Transformer is difficult to deploy. It also supports long sequence input, such as more than 1024 steps, which can incorporate more rich historical state information and improve the early warning lead time.

[0084] The multidimensional features of the ticket data, including user identity, order information, and system log, are processed in parallel to strengthen the weight of key features such as abnormal login device identifier and excessive ticket purchase order number, and to improve the risk positioning efficiency.

[0085] The channel mixing module is another important component of the RWKV model, which is used to process the channel-related information in the sequence data. The calculation process of the channel mixing module is as follows:

[0086] Finally, the output calculation formula of the channel mixing module is as follows:

[0087] In the RWKV model, the acceptance The Sigmoid function is used as the "forget gate" to remove unnecessary historical information. This mechanism allows the model to adjust the attention to different channel information, so as to more effectively capture the key features of the sequence data. In addition, the model also uses the square ReLU activation function to perform nonlinear processing on , that is, . This function compresses negative values to zero while preserving and enhancing the square of positive values. In this way, the model can more effectively extract and highlight positive signals, thereby improving its expression ability.

[0088] The RWKV block workflow is as follows: Input layer (512-dimensional features) to embedding layer (mapped to 1024-dimensional) to 6-layer RWKV block to output layer (2-class: normal / warning) Time mixing module: for 1024-dimensional features, calculate the weight of historical information according to the time step (the weight is dynamically adjusted through the sigmoid and exponential functions to highlight recent key states).

[0089] Channel Mixing Module: Capture nonlinear associations between feature dimensions through 1D convolution (kernel_size=3) and SwiGLU activation function.

[0090] Each layer contains LayerNorm and residual connection to alleviate the problem of gradient vanishing.

[0091] Regarding the training strategy involved in the embodiments of the present application, the following technical content is included: Sample definition: input with sliding window (window length = 120 steps, i.e. 2 hours), label is whether failure occurs within 30 minutes after the end of the window (1 = failure, 0 = normal).

[0092] Data augmentation: time perturbation (e.g. slight translation) and noise injection (e.g. sensor Gaussian noise) are performed on normal samples to solve the problem of few failure samples (positive and negative sample ratio is controlled at 1:5).

[0093] Regarding the training configuration involved in the embodiments of the present application, the following technical content is included: Optimizer: AdamW (learning rate = 1e-4, weight decay = 1e-5).

[0094] Loss function: Focal Loss to solve class imbalance.

[0095] Training hardware: 8x NVIDIA A100, using RWKV parallel training capability to accelerate convergence.

[0096] Iteration strategy: phased training, first pre-training to capture general time series patterns, then fine-tuning with specific device data.

[0097] Regarding the inference optimization involved in the embodiments of the present application, the following technical content is included: Utilize the RNN characteristics of RWKV inference to input new time series data in real time, 1s per step, only need to calculate the output of the current time step, no need to repeat the calculation of history, the inference delay is controlled within 50ms.

[0098] Model quantization: use INT8 quantization to compress the model size from 10GB to 1.25GB, adapt to terminal device computing power.

[0099] Regarding the multi-level early warning and linkage involved in the embodiments of the present application, the following technical content is included: Early warning classification: First level early warning (low risk): model output failure probability 0.3~0.6, prompt "device state abnormal, suggest attention".

[0100] Secondary warning (medium risk): probability 0.6-0.8, prompt "possible failure, recommend inspection within 15 minutes".

[0101] Tertiary warning (high risk): probability ≥0.8, prompt "imminent failure, handle immediately".

[0102] Linkage mechanism: interface with railway operation and maintenance management system (MIS), automatically push warning information to operation and maintenance personnel terminal (APP / SMS).

[0103] High-risk warning triggers temporary degradation strategy for equipment (such as switching self-service ticket machines to "query only, no ticket sales" mode, reducing the impact of failure).

[0104] Specifically, regarding the RWKV combined with multi-model fusion optimization model in the embodiments of the application, the following technical contents are included: Transfer learning: for new equipment, fine-tune the pre-trained model of similar equipment to reduce data dependence; Online learning: regularly update the model with new data (such as weekly incremental training) to adapt to long-term changes such as equipment aging; Hyperparameter optimization: search for RWKV sequence length, hidden layer dimension, and fusion layer attention weight parameters through Bayesian optimization.

[0105] Data collection: select 100 railway ticket self-service machines, collect 6 months of historical operation data (sampling frequency 1 / minute) and real-time data (sampling frequency 1 / 10 seconds), data including voltage (180-240V), temperature (0-40℃), response time (0.5-5s), historical fault types (such as ticket jam, black screen) and other information.

[0106] Data preprocessing: fill missing values with mean, standardize data with Z-Score, divide training set (70%), validation set (20%), test set (10%).

[0107] Model training: RWKV model: set hidden layer dimension 256, learning rate 1e-4, train 50 rounds, validation set time series feature extraction accuracy above 90%.

[0108] SVM and random forest: SVM uses RBF kernel function, random forest decision tree number 100, after training, validation set accuracy is 85%, 88% respectively.

[0109] LSTM-CNN model: LSTM layer number 2 layers, CNN convolution kernel number 32, after training, validation set accuracy above 93%.

[0110] Multi-model fusion: Assign weights according to RWKV (0.3), SVM (0.2), random forest (0.2), and LSTM-CNN (0.3), and the early warning accuracy of the test set is more than 95%.

[0111] Abnormal monitoring and early warning: Through model training to learn the normal business baseline, real-time early warning is performed on behaviors deviating from the baseline (such as abnormal login and illegal port access), and the false negative rate is less than or equal to 0.1%. In addition, the embodiments of the present application also relate to the following technical modules, including a risk assessment module, based on the risk features output by the model, quantifying the risk level (low, medium, and high), triggering an emergency response for high-risk events (such as large-scale user identity leakage events), and entering a monitoring queue for medium and low risks.

[0112] And an intelligent disposal module outputs disposal schemes for different risk levels, such as automatically freezing accounts for first-level abnormalities, starting data backup and recovery for third-level faults, and synchronously notifying users and operation and maintenance teams.

[0113] Automatic response: For high-risk events, the system automatically executes instructions such as freezing abnormal accounts, intercepting suspicious transactions, and locking ticket operations, with a response time controlled within seconds. Manual coordination: Push medium and low-risk events and disposal suggestions to the operation and maintenance platform, manually confirm and supplement intervention, and record the disposal process to provide data for model optimization.

[0114] The optimization detection and feedback module includes review optimization. After the emergency ends, the model analyzes the disposal process data, optimizes the identification algorithm and disposal process, improves the efficiency of subsequent emergencies, regularly inputs emergency disposal data into the RWKV model, updates the time mixing and channel mixing module parameters, improves the risk identification accuracy and emergency response efficiency, and forms a "collection, analysis, disposal-optimization" closed loop.

[0115] In summary, compared with the prior art, the embodiments of the present application have the following advantages: first, the operation and maintenance efficiency is improved: the average fault diagnosis time is shortened from 40 minutes to less than 10 minutes, the difficult fault solving efficiency is improved by more than 3 times, and the station is supported for 7x24 hours continuous service; second, the security protection is upgraded: the data misoperation risk is reduced by 90%, the security event prediction accuracy is 92%, and a full-cycle protection system of "pre-warning, in-process blocking, and post-tracing" is formed; third, the resource allocation is optimized, combined with passenger flow prediction to realize dynamic scheduling of operation and maintenance personnel and spare parts, the resource utilization rate is significantly improved, and the operation and maintenance cost is significantly reduced; fourth, the scalability is enhanced: modular design is adopted, and when new passenger ticket equipment types are added, only the feature library needs to be updated, without the need to restructure the platform, which is suitable for various station scenarios. Compared with the prior art, it has outstanding substantial characteristics and significant progress.

[0116] The foregoing description of the disclosed embodiments enables one skilled in the art to make or use the application. Numerous modifications of those embodiments can be apparent to those skilled in the art, and the generic principles defined herein can be applied to other embodiments without the use of the innovation falling outside the spirit and scope of the application. Therefore, the application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A railway passenger ticket station-level safety operation and maintenance method based on the RWKV model, characterized in that, Including the following steps: Collect multi-source heterogeneous time-series data generated during the operation of ticket terminal equipment; The collected multi-source heterogeneous time-series data are preprocessed; The preprocessed multi-source heterogeneous time series data is input into a pre-trained RWKV model. The time mixing module and channel mixing module of the RWKV model are used for joint inference to output quantitative indicators for evaluating the health status of the equipment. Receive and parse the quantitative indicators output by the RWKV model, the quantitative indicators including fault warning probability values ​​that characterize the health status of the equipment; Operation and maintenance instructions are generated and executed based on the quantitative indicators. These instructions include triggering tiered alarms, generating work orders, or starting / stopping equipment.

2. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to claim 1, characterized in that, The preprocessing of the collected multi-source heterogeneous time-series data includes: parsing the text log data and converting the original log into a normalized word sequence through dynamic variable replacement and word segmentation filtering; normalizing the numerical sensor data by performing time alignment, missing value interpolation, and Z-score normalization to eliminate the influence of dimensions; constructing high-order time-series features and calculating their statistical and frequency domain features within a sliding window based on the normalized numerical data.

3. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to claim 2, characterized in that, The construction of the RWKV model includes the following steps: using a time decay factor to dynamically adjust the weights of historical information to enhance the memory of key events in the long term of the equipment; and using a multivariate attention mechanism to assign dynamic weights to different equipment parameters in the multi-source heterogeneous time series data. The model is trained using historical time-series data that includes equipment fault labels.

4. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to claim 3, characterized in that, The joint inference using the time mixing module and channel mixing module of the RWKV model specifically involves: weighting and fusing the outputs of the RWKV sub-model, LSTM-CNN sub-model, Support Vector Machine (SVM) sub-model, and Random Forest sub-model through a multi-model fusion system to generate the fault warning probability value.

5. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to claim 1, characterized in that, It also includes the following steps: Introduce a database of equipment failure cases and knowledge of equipment structure; The equipment failure case library includes: historical failure types, corresponding failure characteristics, and failure handling solutions; The CNN-Transformer model is used to process the waveform data when the fault occurs, and the local and global features of the fault waveform are extracted to form the fault feature vector. The similarity between the fault feature vector and the cases in the equipment fault case library is calculated, and the equipment structure knowledge is combined to perform reverse deduction to accurately locate the fault module.

6. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to claim 1, characterized in that, It also includes the following steps: using personnel activity data, equipment status data, and environmental factor data, and employing fuzzy comprehensive evaluation method or hierarchical analysis method to establish a station safety risk assessment model.

7. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to claim 1, characterized in that, It also includes the following steps: regularly collecting feedback data generated during the execution of operation and maintenance, and using the feedback data to incrementally train the RWKV model to optimize the model parameters; predicting future business load peaks based on historical passenger flow data, and automatically adjusting computing resources, spare parts inventory, or personnel scheduling plans based on the prediction results.

8. A railway passenger ticket station-level safety operation and maintenance platform based on the RWKV model, characterized in that, The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to any one of claims 1 to 7 includes: The data acquisition layer is used to collect multi-source heterogeneous time-series data from the station-level ticketing system; The RWKV model inference layer, deployed on the station edge server, includes a pre-trained RWKV model used for real-time inference on pre-processed data, outputting fault probability and risk warnings. The security operation and maintenance service layer provides functions such as equipment status monitoring, intelligent fault diagnosis, security incident handling, and operation and maintenance resource scheduling. It is used to drive the closed-loop operation and maintenance process based on the output results of the RWKV model inference layer. The human-computer interaction layer is used to display early warning information, operation and maintenance work orders and statistical reports, and supports voice interaction with operation and maintenance personnel.

9. The railway passenger ticket station-level safety operation and maintenance platform based on the RWKV model according to claim 8, wherein the data acquisition layer specifically includes: The equipment status monitoring module is used to collect operating parameters of ticket vending terminals and ticket gates; The environmental monitoring module is used to monitor the operating environment of the equipment through temperature and humidity sensors and smoke sensors; The network probe module is used to collect network traffic, port access records, and abnormal login logs; The data preprocessing module is used to clean, transform, integrate, and reduce the collected multi-source heterogeneous data to form a standardized input feature vector.

10. The railway passenger ticket station-level safety operation and maintenance platform based on the RWKV model according to claim 9, wherein the RWKV model inference layer specifically includes: The model training module is used to train the RWKV model using historical device time-series data and Focal Loss as the loss function. The real-time inference engine is used to input the preprocessed feature vectors into the trained RWKV model, capture temporal dependencies through the temporal fusion module, and perform cross-feature correlation analysis through the channel fusion module to output the device health status score and failure probability. The RWKV model inference layer also integrates a multi-model fusion module, which is used to receive the output results of the RWKV sub-model, the machine learning sub-model based on SVM and random forest, and the deep learning sub-model based on LSTM-CNN.

Images