Log tamper-proofing and fault tracing method and system for rail transit motor driver

Abstract

This invention relates to the field of rail transit motor drive control and safety monitoring technology, and discloses a method and system for log anti-tampering and fault tracing of rail transit motor drives based on SIL3. The method collects the status parameters of the motor drive and binds them with SIL3 safety level monitoring points to generate structured logs; it uses CPLD hardware to perform SHA-256 hash encryption, and combines local dual storage and cloud backup to achieve tamper-proof log storage; it incorporates log integrity verification into the SIL3 safety monitoring task, triggering a safety shutdown response in case of anomalies; it matches data before and after a fault using a multi-parameter time-series correlation model to locate the root cause of the fault, and relies on adaptive learning to update the model to adapt to equipment aging and new faults. This invention achieves SIL3-level control over the entire log lifecycle, improves fault tracing efficiency by 70%, and can reuse Bosman's existing ARM combined with CPLD architecture and SIL3 certification achievements.

Description

Technical Field

[0001] This invention relates to the field of motor drive control and safety monitoring technology for rail transit, and in particular to a method and system for log anti-tampering and fault tracing of rail transit motor drives based on SIL3. Background Technology

[0002] In rail transit systems, rail transit motor drives are core actuators for vehicle door systems, air conditioning systems, and traction auxiliary systems, and their operating status directly determines the operational safety of the rail transit system. Fan inverters, compressor inverters, and EC motor drives are all examples of rail transit motor drives. According to relevant core standards for rail transit, motor drives must record fault logs to support post-fault tracing.

[0003] Currently, the industry generally uses the method of storing logs in plaintext in local FLASH without mandatory encryption processing and access control. During maintenance, the integrity of the logs can be easily destroyed due to accidental operation or malicious tampering, thus making them unusable as a basis for fault analysis. In addition, log data that has not been solidified and saved in time may be lost due to emergencies such as power outages, resulting in the omission of key fault information.

[0004] Currently, most logs only record a single fault code, lacking key operating parameters before and after the fault, making it impossible to pinpoint the root cause of the fault and causing difficulties in tracing its origin. There is no linkage mechanism between lost or tampered logs and SIL (Safety Integrity Level) protection, meaning that even if log problems are detected, relevant safety protections cannot be triggered in time, potentially leading to an expansion of the fault scope and triggering serious chain reactions. For example, if a motor experiences a jamming fault and safety protection is not triggered in time to achieve active shutdown, it may lead to more serious faults such as mechanical damage.

[0005] Therefore, how to prevent tampering of rail transit motor drive logs and effectively trace faults based on the logs has become a technical problem that needs to be solved. Summary of the Invention

[0006] The purpose of this invention is to provide a method and system for log anti-tampering and fault tracing of rail transit motor drives based on SIL3. It integrates SIL3 security level to realize log anti-tampering and fault tracing scheme, realizes full life cycle security management of logs and accurate fault location, and overcomes the defects of existing technologies such as easy tampering, difficult tracing and lack of safety interlock.

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] According to one aspect of the present invention, a method for preventing log tampering and tracing faults in a rail transit motor drive is provided, comprising the following steps:

[0009] S1. Parameter Acquisition: Based on the operating requirements of the rail transit motor driver, the drive status parameters, load status parameters and environmental status parameters of the motor driver are acquired.

[0010] S2. Parameter Binding: Associate and bind the collected status parameters with SIL3 security level monitoring points to generate structured logs;

[0011] S3. Log anti-tampering processing: The structured log is encrypted using the CPLD hardware logic control module built into the motor driver to form an encrypted log;

[0012] S4. Log backup storage: The encrypted logs are stored using a dual local storage architecture combined with cloud backup.

[0013] S5. Log tampering detection: The log integrity verification task is incorporated into the SIL3 security monitoring task to verify the integrity of the encrypted logs in real time. If log tampering or log loss is detected, a SIL3 security response action is triggered.

[0014] S6. Fault tracing and processing: Extract parameter time-series data within a preset time period before and after the fault from the stored complete logs, match the extracted parameter time-series data with the pre-established fault parameter model, and locate the root cause of the fault based on the matching results.

[0015] According to one embodiment of the present invention, the drive state parameters include PWM drive command, IGBT switching frequency, DC bus voltage and current, and motor speed command; the load state parameters include actual motor torque, three-phase stator current, rotor position, and load power; and the environmental state parameters include IGBT temperature, capacitor temperature, and vibration value.

[0016] According to one embodiment of the present invention, the structured log includes a timestamp, a SIL3 security level identifier, a parameter set, a fault code, and a checksum.

[0017] According to one embodiment of the present invention, the encryption process of the CPLD hardware logic control module is hardware-level hash encryption; the encryption log is bound to the unique hardware serial number of the motor driver.

[0018] According to one embodiment of the present invention, the SIL3 level security response action includes: if a single log verification fails, triggering a buzzer alarm and an indicator light alarm; if ≥3 consecutive logs are lost or tampered with, immediately cutting off the PWM drive command of the motor driver, causing the motor to slow down to a stop, with a stop response time ≤200ms, and simultaneously generating a "log abnormality fault code" and storing it in an independent security partition.

[0019] According to an embodiment of the present invention, the method further includes step S7: after locating the root cause of the fault, it also associates a preset motor driver fault solution library and outputs fault handling suggestions, wherein the fault solution library includes sensor calibration steps and motor maintenance guidelines.

[0020] According to one embodiment of the present invention, the motor driver includes an air conditioner fan inverter, a compressor inverter, and an EC motor driver.

[0021] According to one embodiment of the present invention, the local dual storage includes a primary FLASH partition for storing the main body of the logs and a read-only backup FLASH partition for storing encrypted verification information, and the cloud backup is implemented through an MVB or TRDP rail transit dedicated communication interface.

[0022] According to another aspect of the present invention, a log anti-tampering and fault tracing system for a rail transit motor drive is provided for implementing the method, the system comprising:

[0023] The parameter acquisition module is used to acquire the drive status parameters, load status parameters, and environmental status parameters of the motor driver.

[0024] The log generation module, connected to the parameter acquisition module, is used to generate structured logs based on the Ulog log component and SIL3 security level monitoring points;

[0025] The anti-tampering module, connected to the log generation module, includes a CPLD hardware logic control unit and a storage unit. The CPLD hardware logic control unit is used to encrypt the structured logs. The storage unit includes a main FLASH partition, a read-only backup FLASH partition, and a cloud storage interface. The cloud storage interface is an MVB or TRDP communication interface.

[0026] The security interlock module, connected to the anti-tampering module, is used to verify log integrity and trigger SIL3 level security response actions;

[0027] The fault tracing module, connected to the anti-tampering module, is used to locate the root cause of the fault by matching the pre-established fault parameter model with the time-series curve of the log parameters.

[0028] According to one embodiment of the present invention, the hardware architecture of the system adopts a combined control mode of ARM processor and CPLD; the CPLD hardware logic control unit of the anti-tampering module is also used to generate a unique hardware serial number of the motor driver and associate the unique hardware serial number with the encrypted log.

[0029] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0030] 1. Significantly improved log security: Through CPLD hardware encryption, SIL3 verification tasks and triple redundant storage, the log tampering detection rate is 100%, the loss rate is reduced to 0, and the abnormal response meets the requirements of SIL3 level;

[0031] 2. Significantly improved fault tracing efficiency: The multi-parameter time-series correlation model enables tracing from fault codes to fault causes, reducing tracing time from 2-4 hours to within 30 minutes, improving operation and maintenance efficiency by 70%, and outputting standardized handling suggestions, thus lowering the operation and maintenance threshold;

[0032] 3. Strong feasibility and compatibility: It is developed entirely based on Bosman's existing "ARM+CPLD" hardware architecture, RTOS / Ulog software platform and SIL3 certification results. No new hardware is required, the development cycle is 3-6 months, the transformation cost is reduced by 40%, and it can be directly adapted to a variety of products such as air conditioner fan inverters and compressor inverters.

[0033] 4. Adaptability to the entire lifecycle: Through dynamic threshold adjustment and new fault learning, the model can cover the entire lifecycle of the equipment from new commissioning to aging (more than 10,000 hours of operation), avoiding false alarms and missed alarms caused by parameter drift and extending the applicable period of the model. Attached Figure Description

[0034] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0035] Figure 1 This is a flowchart of the log anti-tampering and fault tracing method for rail transit motor drivers according to an embodiment of the present invention;

[0036] Figure 2 This is a schematic diagram of the log anti-tampering and fault tracing system for rail transit motor drivers according to an embodiment of the present invention. Detailed Implementation

[0037] To facilitate a clear description of the technical solutions in the embodiments of the present invention, the terms "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. For example, the first threshold and the second threshold are merely used to distinguish different thresholds and do not limit their order. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that the terms "first" and "second" are not necessarily different.

[0038] It should be noted that in this invention, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0039] In this invention, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one" or similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, "at least one of a, b, or c" can represent: a, b, c, a combination of a and b, a combination of a and c, a combination of b and c, or a, b, and c, where a, b, and c can be single or multiple.

[0040] like Figure 1 The diagram shows a flowchart of a method for preventing log tampering and tracing faults in rail transit motor drives. The method includes the following steps:

[0041] S1. Parameter Acquisition: Based on the operational requirements of the rail transit motor driver, the drive status parameters, load status parameters, and environmental status parameters of the motor driver are acquired. The drive status parameters include PWM drive commands, IGBT switching frequency, DC bus voltage and current, and motor speed commands. The load status parameters include actual motor torque, three-phase stator current, rotor position, and load power. The environmental status parameters include IGBT temperature, capacitor temperature, and vibration value.

[0042] S2. Parameter Binding: The collected status parameters are associated and bound with the SIL3 security level monitoring points to generate structured logs; the structured logs include timestamps, SIL3 security level identifiers, parameter sets, fault codes, and check codes.

[0043] S3. Log anti-tampering processing: The structured log is encrypted using the CPLD hardware logic control module built into the motor driver to form an encrypted log; the encryption processing of the CPLD hardware logic control module is hardware-level hash encryption; the encrypted log is bound to the unique hardware serial number of the motor driver.

[0044] S4. Log Multiple Backup Storage: The encrypted logs are stored using a local dual storage combined with cloud backup architecture; the local dual storage includes a main FLASH partition for storing the main body of the logs and a read-only backup FLASH partition for storing encrypted verification information; the cloud backup is implemented through an MVB or TRDP rail transit dedicated communication interface.

[0045] S5. Log tampering detection: The log integrity verification task is incorporated into the SIL3 security monitoring task to verify the integrity of the encrypted logs in real time. If log tampering or log loss is detected, a SIL3 security response action is triggered.

[0046] S6. Fault tracing and processing: Extract parameter time-series data within a preset time period before and after the fault from the stored complete logs, match the extracted parameter time-series data with the pre-established fault parameter model, and locate the root cause of the fault based on the matching results.

[0047] The method further includes step S7: after locating the root cause of the fault, it also associates with a preset motor driver fault solution library and outputs fault handling suggestions. The fault solution library includes sensor calibration steps and motor maintenance guidelines.

[0048] The motor drive includes an air conditioner fan inverter, a compressor inverter, and an EC motor drive.

[0049] like Figure 2 The diagram shows a schematic of a log anti-tampering and fault tracing system for rail transit motor drives, which includes:

[0050] The parameter acquisition module is used to acquire the drive status parameters, load status parameters, and environmental status parameters of the motor driver.

[0051] The log generation module, connected to the parameter acquisition module, is used to generate structured logs based on the Ulog log component and SIL3 security level monitoring points;

[0052] The anti-tampering module, connected to the log generation module, includes a CPLD hardware logic control unit and a storage unit. The CPLD hardware logic control unit is used to encrypt the structured logs. The storage unit includes a main FLASH partition, a read-only backup FLASH partition, and a cloud storage interface. The cloud storage interface is an MVB or TRDP communication interface.

[0053] The security interlock module, connected to the anti-tampering module, is used to verify log integrity and trigger SIL3 level security response actions;

[0054] The fault tracing module, connected to the anti-tampering module, is used to locate the root cause of the fault by matching the pre-established fault parameter model with the time-series curve of the log parameters.

[0055] The system's hardware architecture adopts a combined control mode combining an ARM processor and a CPLD; the CPLD hardware logic control unit of the anti-tampering module is also used to generate a unique hardware serial number for the motor driver and associate the unique hardware serial number with the encrypted log.

[0056] Example 1: Case Study on Anti-Tampering and Fault Traceability of Compressor Inverter Logs

[0057] Taking the subway compressor frequency converter (model: BSM-Compressor-VFD) of Shenzhen Bosman Technology Co., Ltd. as an example, the implementation process of the present invention is described in detail. This product is used in subway air conditioning systems, complies with EN50155 standard, has an input voltage of 3AC380V, and a rated output capacity of 15kVA.

[0058] The hardware system adopts an architecture combining an ARM Cortex-M4 MCU and an Altera CPLD. SHA-256 encryption logic is programmed into the CPLD. The main FLASH memory uses an 8MB industrial-grade chip (100,000 erase / write cycles), and the backup FLASH memory is set to read-only mode.

[0059] The software system adds a log collection task to the RTOS platform. This task has a higher priority than ordinary control tasks, and it extends the structured log generation function based on the Ulog component, with preset SIL3 safety monitoring points (such as overcurrent threshold and torque fluctuation threshold).

[0060] The communication system interfaces with the subway TCMS system via the MVB interface to complete log upload tests and ensure communication stability in compliance with the IEC61373 vibration standard.

[0061] During the parameter acquisition step, the MCU acquires multiple parameters in real time at a frequency greater than 100 milliseconds per acquisition. The acquired parameters include:

[0062] (1) Drive status parameters, such as PWM drive command (duty cycle 0-100%), IGBT switching frequency (20kHz), DC bus voltage (700V), motor speed command (0-3000rpm);

[0063] (2) Load condition parameters, such as actual motor torque (0-50 N·m), three-phase stator current (0-50 A), rotor position (0-360°), and load power (0-15 kW);

[0064] (3) Environmental condition parameters, such as IGBT temperature (-40~150℃), capacitor temperature (-40~85℃), vibration value (≤50m / s², in compliance with IEC61373 standard).

[0065] Based on the collected parameters, generate structured logs. For example, generate structured logs that include the following fields:

[0066] Timestamp: 2025-08-25 14:30:00.123;

[0067] SIL3 designation: SL3;

[0068] Parameter set: PWM duty cycle 50%, IGBT frequency 20kHz, bus voltage 700V, torque 45N·m, current 40A, IGBT temperature 80℃;

[0069] Fault code: None, indicating normal operation.

[0070] Verification code: SHA-256 calculated value.

[0071] Next, the structured logs of the above example are encrypted. The CPLD module performs SHA-256 encryption on the logs, binds them to the device's unique serial number: BSM-2025-0001, and generates encrypted logs named: "a1b2c3d4...|BSM-2025-0001".

[0072] Multiple backups are used to store the generated encrypted logs. For local storage, the primary FLASH memory stores the encrypted logs, while the backup FLASH memory stores the verification code and serial number. For cloud backup, the encrypted logs are uploaded to the subway's TCMS system via the MVB interface, with a synchronization time difference of less than or equal to 10 milliseconds.

[0073] If three consecutive log hash values ​​do not match at any given time, it indicates that the log may have been tampered with. The safety interlock module immediately triggers a buzzer alarm and a flashing red indicator light; it cuts off the PWM drive command, and the motor speed drops from 3000 rpm to a stop. A fault code "E-LOG001" is generated and saved to a separate safety partition.

[0074] Maintenance personnel read the local backup log via USB interface and extracted data from the 5 seconds prior to the fault. They found that the current surged from 40A to 75A (≥1.5 times the rated value); the torque decreased from 45N·m to 12N·m (≤0.3 times the rated value); and the speed dropped from 3000rpm to 0. By matching the "motor jamming" model, the fault was located as a stuck compressor exhaust valve.

[0075] Furthermore, the system outputs the following suggestions: Turn off the inverter power supply, remove the compressor exhaust valve end cover; clean foreign objects from the valve seat, and check the valve plate sealing; after reassembly, perform a no-load test run (speed 0-3000rpm, lasting 5min); verify whether the current and torque parameters have returned to normal.

[0076] In a test on a subway line, compressor jamming faults were successfully located three times. The logs were not tampered with or lost, and the safety response time was ≤200ms, meeting the SIL3 level requirements. The operation and maintenance efficiency was improved by 70%, verifying the effectiveness and practicality of the invention.

[0077] Example 2: Construction of a multi-parameter temporal correlation model

[0078] The multi-parameter time-series correlation model is constructed based on the parameter types (drive, load, and environmental state parameters) and fault cases (such as compressor jamming) of rail transit motor drivers.

[0079] First, based on the operating characteristics of motor drives such as air conditioner fan inverters, compressor inverters, and EC motor drives, the following parameters with high correlation and high sensitivity were selected:

[0080] (1) Drive status parameters, including PWM drive command, IGBT switching frequency, DC bus voltage / current, and motor speed command; these parameters can directly reflect the core control status of IGBT and inverter, and change significantly during faults;

[0081] (2) Load status parameters, including actual motor torque, three-phase stator current, rotor position, and load power; these parameters are directly related to the motor load characteristics and the root cause of the fault, such as stalled rotor or stuck exhaust valve, which will directly lead to sudden changes in current / torque.

[0082] (3) Environmental condition parameters, including IGBT temperature, capacitor temperature, and vibration value (compliant with IEC61373); these parameters can reflect the stress of the equipment operating environment. IGBT overheating, capacitor aging and other faults will be accompanied by abnormal temperature. Vibration value can help judge mechanical faults.

[0083] Then, parameter data is collected according to the selected parameters. The collected parameters are preprocessed to ensure data validity. A suitable collection frequency needs to be determined, and the timestamps of the drive, load, and environmental parameters must be perfectly aligned to avoid correlation deviations caused by timing misalignments. Outlier removal is then performed, such as removing instantaneous parameter jumps caused by communication interference and filtering data exceeding the normal parameter range. Missing values ​​are filled in, for example, using interpolation to fill in missing values ​​caused by brief communication interruptions, ensuring the continuity of the timing data curve. Finally, the fault time window division rules are determined. For example, if the fault trigger time is T0, the time window is defined as: T0-t1s ~ T0+t2s, where the first t1s is used to capture fault precursors (such as a slow rise in current), and the latter t2s is used to capture drastic parameter changes after the fault occurs (such as a sudden drop in speed). Preferably, t1=5s and t2=2s.

[0084] Next, for the preprocessed time series data, features with strong fault distinguishability are extracted. Typical fault type features include:

[0085] (1) Trend characteristics: Extract the trend of parameter change within the time window, such as sudden increase, sudden decrease, and return to zero. The trend characteristics of sudden change can be obtained by calculating the slope. For example, when the absolute value of the slope is greater than or equal to 0.5 times the rated value per second, it can be determined as a sudden change. Based on the sudden change characteristics, it can be further distinguished which type of sudden increase, sudden decrease, or return to zero it is.

[0086] (2) Threshold characteristics: Set the parameter threshold range according to the SIL3 safety monitoring point. For example, set the threshold range of current ≥ 1.5 times the rated value according to the overcurrent threshold. When the threshold is exceeded, it is marked as a fault-related characteristic. Similarly, the torque fluctuation threshold can be set as: torque ≤ 0.3 times the rated value, and the vibration value can be set to ≥ 50m / s² (IEC61373 standard).

[0087] (3) Cooperative features: By extracting the cooperative change relationship between multiple parameters, the core of the model is constructed. For example: motor jamming cooperative features, including the feature combination of sudden current increase, sudden torque decrease and speed return to zero; IGBT overheating cooperative features, which meet the associated combination logic of IGBT temperature ≥150℃, DC bus current fluctuation exceeding 20% ​​and no significant change in torque; communication failure cooperative features, including MVB / TRDP frame loss rate ≥10%, no response to speed command and current maintained at 80% of rated value.

[0088] Then, a one-to-one correspondence is established between the extracted time-series features and the root causes of the faults to form a fault-feature mapping library, and the model is solidified based on the system hardware and software.

[0089] Based on the type of motor drive (air conditioner fan, compressor, EC motor) and common faults, the core root causes are listed. For example, common faults of compressor inverters include stuck discharge valve, blocked condenser, and refrigerant leakage; common faults of air conditioner fan inverters include blade wear, damaged bearings, and fan stall; common faults of EC motor drives include rotor eccentricity, winding short circuit, and sensor drift.

[0090] A mapping table is constructed using the collaborative feature as the key and the root cause of the fault as the value. For example, if the collaborative feature is: current ≥ 1.5 times the rated value + torque ≤ 0.3 times the rated value + speed → 0, the corresponding root cause of the fault is: compressor discharge valve jamming, and the associated drive is the compressor frequency converter.

[0091] The mapping library and feature extraction algorithm are embedded into the RTOS platform of the ARM processor and invoked in real time using the Ulog logging component. After preprocessing, the collected parameters are directly input into the model, and the root cause of the fault is output by matching the mapping library.

[0092] Example 3: Updating the model through adaptive learning

[0093] Adaptive learning data can come from local devices and / or the cloud, extracting historical operational data and fault case data from encrypted logs. Data is filtered to collect only valid learning data, including ① new fault cases that do not match existing models (feature combinations not in the mapping library); ② aging data with a cumulative device runtime ≥ 5000 hours; and ③ environmental parameters that have consistently exceeded normal ranges.

[0094] Set trigger conditions for adaptive learning to ensure it only starts when model accuracy decreases or new faults are added. The trigger conditions include:

[0095] (1) New fault triggering: Incremental training update is triggered when the local model fails to match fault features twice in a row, or when ≥5 new fault cases of the same type are collected in the cloud.

[0096] (2) Device aging trigger: When the ARM processor detects that the device has accumulated 10,000 hours of operation or 5,000 start-stop times, and the parameter threshold misjudgment rate is ≥5%, dynamic threshold update is triggered;

[0097] (3) Environmental adaptation trigger: When environmental parameters (such as vibration value, temperature) exceed the normal range for 30 consecutive days, feature weight update is triggered.

[0098] After the triggering conditions are met, incremental training is performed using an incremental decision tree algorithm. For example, new fault cases collected from the cloud are input into the existing model with their time-series features and root cause labels. Branches are added to the decision tree—for example, a new refrigerant leakage fault with the following features: load power ≤ 70% of rated value, torque fluctuation ±8%, and capacitor temperature ≥ 90℃. The mapping library is updated and fault solutions are associated, for example, the solution: check the refrigerant piping sealing.

[0099] For high-temperature environments, the feature weight of IGBT temperature is increased from 0.2 to 0.3, while the weight of vibration value is reduced from 0.3 to 0.2. For example, under high temperature conditions, an IGBT temperature ≥140℃ can be used to trigger overheating fault judgment first, rather than relying on vibration value.

[0100] The trained new model is input into the existing fault sample library of Bosman (containing at least 100 historical fault cases, such as the 3 jamming faults in the example). The verification indicators are: ① Fault source location accuracy ≥ 95% (equivalent to or higher than the original model); ② Inference time ≤ 100ms (does not affect the real-time control of the motor driver). If the indicators are not met, the model is reverted to the original model.

[0101] For example, taking a compressor inverter as an example, after the inverter has been running for 10,000 hours, the ARM processor detected a 6% false alarm rate for torque parameters (exceeding the 5% threshold), triggering an adaptive update: collecting aging data from the past 3 months, calculating the torque anomaly threshold adjustment coefficient to 1.1; executing incremental training of the model, adjusting the torque anomaly threshold from ±15% to ±16.5%; verifying offline with 50 historical fault cases, achieving an accuracy of 98% and an inference time of 80ms; finally, deploying a small batch to two drives on a Shenzhen subway line, and after 72 hours without any anomalies, performing a batch update with a 100% success rate.

[0102] Currently, the SIL3 safety level is only applied to the safety control of door controllers. For example, the 2020 SIL3 certification for Bosman door controllers only covers the safety interlocking of door switches. The logging function relies on the Ulog component for independent implementation and only records fault codes and basic parameters, without being bound to the safety level. The CPLD hardware is only used for "motor drive logic control," implementing control of PWM command output and motor forward / reverse switching. This invention overcomes the inherent flaw of traditional logging designs that separate motor drive and log safety, breaking industry practice by deeply binding the SIL3 safety level with the entire lifecycle of log generation, encryption, storage, verification, and traceability. Through the collaborative design of CPLD hardware encryption, multiple backup storage, and SIL3 interlocking response, it solves the log tampering problem, accelerates fault tracing, and reduces fault risk and loss through interlocking control. The CPLD independently implements hardware-level hash encryption, avoiding software tampering risks. Local dual storage combined with cloud backup forms triple redundancy, effectively preventing log loss due to emergency power outages.

[0103] Although the invention has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings, disclosure, and other materials. In this specification, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple components. A single processor or other unit can implement several functions listed in the specification. While certain measures are described in different embodiments, this does not mean that these measures cannot be combined to produce good results.

[0104] Although the invention has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made therein without departing from the spirit and scope of the invention. Accordingly, this specification and drawings are merely illustrative of the invention and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if such modifications and modifications fall within the scope of the invention and its equivalents, the invention is also intended to include such modifications and modifications.

Claims

1. A method for preventing log tampering and tracing faults in a rail transit motor drive, characterized in that, Includes the following steps: S1. Parameter Acquisition: Based on the operating requirements of the rail transit motor driver, the drive status parameters, load status parameters and environmental status parameters of the motor driver are acquired. S2. Parameter Binding: Associate and bind the collected status parameters with SIL3 security level monitoring points to generate structured logs; S3. Log anti-tampering processing: The structured log is encrypted using the CPLD hardware logic control module built into the motor driver to form an encrypted log; S4. Log backup storage: The encrypted logs are stored using a dual local storage architecture combined with cloud backup. S5. Log tampering detection: The log integrity verification task is incorporated into the SIL3 security monitoring task to verify the integrity of the encrypted logs in real time. If log tampering or log loss is detected, a SIL3 security response action is triggered. S6. Fault tracing and processing: Extract parameter time-series data within a preset time period before and after the fault from the stored complete logs, match the extracted parameter time-series data with the pre-established fault parameter model, and locate the root cause of the fault based on the matching results.

2. The method according to claim 1, characterized in that, The drive status parameters include PWM drive commands, IGBT switching frequency, DC bus voltage and current, and motor speed commands. The load status parameters include the actual motor torque, three-phase stator current, rotor position, and load power; The environmental condition parameters include IGBT temperature, capacitor temperature, and vibration value.

3. The method according to claim 1, characterized in that, The structured log includes timestamps, SIL3 security level identifiers, parameter sets, fault codes, and checksums.

4. The method according to claim 1, characterized in that, The encryption process of the CPLD hardware logic control module is hardware-level hash encryption; the encryption log is bound to the unique hardware serial number of the motor driver.

5. The method according to claim 1, characterized in that, The SIL3 level security response actions include: if a single log verification fails, triggering a buzzer alarm and an indicator light alarm; if more than 3 logs are lost or tampered with consecutively, immediately cutting off the PWM drive command of the motor driver, causing the motor to slow down to a stop, with a stop response time of less than or equal to 200ms, and simultaneously generating a log abnormality fault code and storing it in an independent security partition.

6. The method according to claim 1, characterized in that, The method further includes step S7: after locating the root cause of the fault, it also associates with a preset motor driver fault solution library and outputs fault handling suggestions. The fault solution library includes sensor calibration steps and motor maintenance guidelines.

7. The method according to claim 1, characterized in that, The motor drive includes an air conditioner fan inverter, a compressor inverter, and an EC motor drive.

8. The method according to claim 1, characterized in that, The local dual storage includes a primary FLASH partition for storing the main log data and a read-only backup FLASH partition for storing encrypted verification information. The cloud backup is implemented through an MVB or TRDP rail transit dedicated communication interface.

9. A log anti-tampering and fault tracing system for a rail transit motor drive, used to implement the method of any one of claims 1 to 8, characterized in that, include: The parameter acquisition module is used to acquire the drive status parameters, load status parameters, and environmental status parameters of the motor driver. The log generation module, connected to the parameter acquisition module, is used to generate structured logs based on the Ulog log component and SIL3 security level monitoring points; The anti-tampering module, connected to the log generation module, includes a CPLD hardware logic control unit and a storage unit. The CPLD hardware logic control unit is used to encrypt the structured logs. The storage unit includes a main FLASH partition, a read-only backup FLASH partition, and a cloud storage interface. The cloud storage interface is an MVB or TRDP communication interface. The security interlock module, connected to the anti-tampering module, is used to verify log integrity and trigger SIL3 level security response actions; The fault tracing module, connected to the anti-tampering module, is used to locate the root cause of the fault by matching the pre-established fault parameter model with the time-series curve of the log parameters.

10. The system according to claim 9, characterized in that, The system's hardware architecture adopts a combined control mode that combines an ARM processor and a CPLD; The CPLD hardware logic control unit of the anti-tampering module is also used to generate a unique hardware serial number for the motor driver and associate the unique hardware serial number with the encrypted log.

Images