Abnormity detection method and device for nuclear power automation system, electronic equipment and medium

Abstract

The invention provides an anomaly detection method and device for a nuclear power automation system, electronic equipment and a medium, and the method comprises the steps: obtaining multi-modal data in the nuclear power automation system, carrying out the time synchronization of the multi-modal data, and forming a synchronous data set; extracting the characteristics of the operation parameters, the system logs and the state information in the synchronous data set, and generating cross-modal fusion characteristics based on the obtained multi-dimensional characteristics; determining a comprehensive feature space of the nuclear power automation system based on the cross-modal fusion features; and converting the comprehensive feature space into a risk index, thereby determining the operation condition of the nuclear power automation system based on the risk index and a risk grade threshold value, and feeding back early warning information. According to the anomaly detection method for the nuclear power automation system, the multi-modal data in the nuclear power automation system is obtained, a single data source is not needed any more, when the operation state of the nuclear power automation system is calculated, the recommendation precision is more accurate, and the early warning information of the nuclear power automation system is output in time.

Description

Technical Field

[0001] This invention relates to the field of automation system control technology, and in particular to an anomaly detection method, device, electronic equipment and medium for nuclear power automation systems. Background Technology

[0002] The application of automation systems has permeated all aspects of production and daily life. Examples include industrial manufacturing, robotics, automated production lines, and nuclear power. In automated control systems, the PLC (Programmable Logic Controller) acts as the industrial brain, controlling the stable operation of various devices. Faults are inevitable in automated systems during operation, and in high-risk fields such as nuclear power, even more stringent requirements are placed on the real-time performance and reliability of fault monitoring.

[0003] Currently, fault detection in automation systems suffers from two main shortcomings: First, the data sources for diagnosing automation system faults generally rely on a single type of data. For example, threshold alarms may be triggered by real-time current / voltage waveforms, or analysis may be limited to the on / off status of input / output port registers, or even just parsing specific error codes in device logs. Such single data sources or conditional diagnostics cannot comprehensively and accurately reflect the overall operating status of the automation system. Second, current early warning mechanisms are crude and lack intelligence. In the diagnostic process, they rely solely on static thresholds and fixed rules, using manually set static thresholds (e.g., "current" greater than 6 amps) for diagnostic processing. This makes the early warning mechanism a known, predefined fault mode, unable to effectively diagnose new or complex faults. Furthermore, in actual monitoring, threshold settings are often unreasonable. Setting the threshold too low results in weak anti-interference capabilities and frequent false alarms; setting it too high leads to slow response and delayed fault handling.

[0004] Therefore, current early warning technologies for automated systems have inherent defects due to their static, isolated, and delayed nature, making it difficult to meet the stringent requirements of modern industry for dynamic and early perception of systemic risks, especially in high-risk fields such as nuclear power. Summary of the Invention

[0005] This invention provides an anomaly detection method, device, electronic equipment, and medium for nuclear power automation systems, in order to solve the problems of single data sources, unintelligent monitoring mechanisms, and false alarms and missed alarms in the aforementioned early warning technologies for nuclear power automation systems.

[0006] In a first aspect, the present invention provides an anomaly detection method for a nuclear power automation system. The nuclear power automation system includes multiple hardware devices and at least two mutually redundant control devices. The anomaly detection method includes: Acquire multimodal data, which includes the operating parameters of the nuclear power automation system during operation, system logs, and status information of each control device; The multimodal data is synchronized in time to obtain a synchronized dataset; Features of the running parameters, system logs and status information in the synchronization dataset are extracted respectively, and the obtained multi-dimensional features are fused to generate cross-modal fusion features; Based on the cross-modal fusion features, a comprehensive feature space of the nuclear power automation system is determined. The comprehensive feature space is used to characterize the global judgment features of the nuclear power automation system between normal and abnormal states. The comprehensive feature space is converted into a risk index, and the operating status of the nuclear power automation system is determined based on the risk index and risk level threshold, so as to provide timely feedback of early warning information of the nuclear power automation system.

[0007] In one embodiment of the present invention, time synchronization of the multimodal data to obtain a synchronization dataset includes: using a preset time period as a time base sequence; aligning the running parameters and the status information to the time base sequence through interpolation; allocating the system logs to corresponding time points in the time base sequence according to the occurrence time of each log; and merging the running parameters, the status information, and the system logs allocated to the same time point into synchronization data points to generate the synchronization dataset.

[0008] In one embodiment of the present invention, features of the running parameters, system logs, and status information in the synchronization dataset are extracted respectively, including: extracting dynamic features from the running parameters in the synchronization dataset based on a convolutional neural network to obtain running features; extracting features from the status information in the synchronization dataset based on a long short-term memory network to obtain device features; and extracting features from the system logs in the synchronization dataset based on a semantic reading model to obtain semantic features.

[0009] In one embodiment of the present invention, the cross-modal fusion feature includes modal association features and modal joint features. The obtained multi-dimensional features are fused to generate cross-modal fusion features, including: performing modal association on the linear transformations corresponding to the operation features, the device features, and the semantic features based on an attention mechanism to obtain the modal association features; and performing weighted summation and feature dimensionality reduction on the operation features, the device features, and the semantic features to obtain the modal joint features.

[0010] In one embodiment of the present invention, determining the comprehensive feature space of the nuclear power automation system based on the cross-modal fusion features includes: constructing redundant device pairs for adjacent control devices according to the modal association features; performing health feature convergence and abnormal feature distancing processing on each device in the nuclear power automation system based on the modal joint features to obtain a first spatial feature; performing fault feature estimation on the control devices in the redundant device pairs based on the modal joint features to obtain a second spatial feature; and determining the comprehensive feature space based on the first spatial feature and the second spatial feature.

[0011] In one embodiment of the present invention, the risk level thresholds include a first risk threshold, a second risk threshold, and a third risk threshold. Determining the operating status of the nuclear power automation system based on the risk index and the risk level thresholds includes: determining the nuclear power automation system to be in a normal state when the risk index is less than or equal to the first risk threshold and greater than zero; determining the nuclear power automation system to be in a state of alert when the risk index is greater than the first risk threshold and less than or equal to the second risk threshold; determining the nuclear power automation system to be in a state of warning when the risk index is greater than the second risk threshold and less than or equal to the third risk threshold; and determining the nuclear power automation system to be in an emergency state when the risk index is greater than the fourth risk threshold and less than or equal to the full risk range.

[0012] In one embodiment of the present invention, the risk level threshold is dynamically updated based on the false alarm rate and false negative rate of the nuclear power automation system.

[0013] Secondly, the present invention also provides an anomaly detection device for a nuclear power automation system, the nuclear power automation system including multiple hardware devices and at least two mutually redundant control devices, the anomaly detection device comprising: The acquisition module is used to acquire multimodal data, which includes the operating parameters of the nuclear power automation system during operation, system logs, and status information of each control device. The data synchronization module is used to synchronize the multimodal data in time to obtain a synchronized dataset; The feature fusion module is used to extract features from the running parameters, system logs and status information in the synchronization dataset, and fuse the obtained multi-dimensional features to generate cross-modal fusion features. The spatial data determination module is used to determine the comprehensive feature space of the nuclear power automation system based on the cross-modal fusion features. The comprehensive feature space is used to characterize the global judgment features of the nuclear power automation system between normal and abnormal states. The early warning module is used to convert the comprehensive feature space into a risk index, and determine the operating status of the nuclear power automation system based on the risk index and risk level threshold, so as to provide timely feedback of the early warning information of the nuclear power automation system.

[0014] Thirdly, the present invention also provides an electronic device, including a processor, a memory, and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute a computer program stored in the memory to implement the anomaly detection method of the nuclear power automation system as described in any of the preceding claims.

[0015] Fourthly, the present invention also provides a computer-readable storage medium storing computer-readable instructions thereon, which, when executed by a computer processor, cause the computer to perform the anomaly detection method of the nuclear power automation system as described above.

[0016] The beneficial effects of this invention are as follows: This invention proposes an anomaly detection method, device, electronic equipment, and medium for nuclear power automation systems. The method includes: acquiring multimodal data from the nuclear power automation system; synchronizing the multimodal data in time to form a synchronization dataset; extracting features from operating parameters, system logs, and status information in the synchronization dataset; and generating cross-modal fusion features based on the obtained multi-dimensional features; determining the comprehensive feature space of the nuclear power automation system based on the cross-modal fusion features; converting the comprehensive feature space into a risk index; and determining the operating status of the nuclear power automation system based on the risk index and risk level threshold, and providing early warning information. This invention provides an anomaly detection method for nuclear power automation systems, acquiring multimodal data from the system instead of relying on a single data source. This results in more accurate predictions of the operating status of the nuclear power automation system and timely output of early warning information. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention. It is obvious that the drawings described below are merely some embodiments of the invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0018] In the attached diagram: Figure 1 This is a diagram showing the equipment relationships in a nuclear power automation system provided in this embodiment of the invention. Figure 2 This is a flowchart of an anomaly detection method for a nuclear power automation system provided in an embodiment of the present invention; Figure 3This is a block diagram of an anomaly detection device for a nuclear power automation system provided in one embodiment of the present invention; Figure 4 This is a schematic diagram illustrating a structure suitable for implementing an electronic device according to an exemplary embodiment of the present invention. Detailed Implementation

[0019] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments. Various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0020] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. The drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0021] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0022] As described in the background section, current monitoring of nuclear power plant automation systems generally suffers from problems such as a single signal source and insufficiently intelligent response mechanisms. Especially in safety-critical areas like nuclear power, traditional early warning methods are significantly inadequate for monitoring control equipment in digital control systems, specifically exhibiting the following four shortcomings: 1) Hidden faults: During the initial operation of the system, the aging and performance degradation of components are very slow, and their weak signs are easily drowned out by noise. Traditional methods cannot effectively identify them, such as the aging and performance degradation of capacitors and power modules.

[0023] 2) Common Cause Failure (CFF) Risk: Redundant control devices in the same batch may simultaneously enter a degradation state due to common design, material or environmental factors, causing the redundant devices to fail to achieve redundancy. Traditional single-type data sources cannot identify such related failure risks.

[0024] 3) Transient faults: High radiation environments can cause transient anomalies in control equipment (such as memory bit flips or instruction execution errors), generating non-repeatable transient anomaly logs that are difficult to capture and diagnose.

[0025] 4) Alarm storm: A single underlying failure can trigger a massive number of related alarms, causing the root cause to be masked and greatly increasing the difficulty for maintenance personnel to locate the root cause of the anomaly.

[0026] like Figure 1 As shown, a nuclear power plant automation system includes N hardware devices and M control devices. The hardware devices can be sensors, and the control devices can be programmable logic controllers (PLCs), central controllers, etc., where M and N are positive integers greater than or equal to 2. The data acquisition and monitoring center is connected to multiple control devices, with redundancy between adjacent control devices. Under normal circumstances, only one control device operates and outputs data, while the other redundant control device operates independently. The input / output ports of each control device are connected to multiple hardware devices to ensure stable operation.

[0027] like Figure 2 As shown, the present invention provides an anomaly detection method for a nuclear power automation system. The nuclear power automation system includes multiple hardware devices and at least two mutually redundant control devices. The method includes at least steps S210 to S250: S210. Acquire multimodal data, which includes operating parameters, system logs, and status information of each control device during the operation of the nuclear power automation system.

[0028] This anomaly detection method can be used in nuclear power programmable logic controllers, nuclear power distributed control systems, and other industrial automation systems.

[0029] For example, multimodal data is acquired from a nuclear power plant automation system. This multimodal data includes operating parameters collected from each control device and field hardware device within the system, such as power supply voltage, operating current, and chip temperature of the hardware and control devices, as well as jitter, memory usage, communication load, and chip load of the application software within the control devices during cycle time. This data is represented in time series form and denoted as [X=x t1 x t2 , ..., x tn The status information acquired from the registers of each control device, such as the master / slave switching record of two redundant control devices, the cumulative number of actions at the output point, and the operating mode, is represented as a discrete sequence [S=s]. t1 s t2 , ..., s tm]; and system logs generated during the operation of various hardware and control devices in the nuclear power automation system, including watchdog timeouts, abnormal event descriptions, and warning messages such as memory check errors, denoted as [T=t1, t2, ..., t d ], where n, m, and d are positive integers, n is the total number of running parameters, m is the total number of status information entries, and d is the total number of text entries.

[0030] S220. Perform time synchronization on the multimodal data to obtain a synchronized dataset.

[0031] In one embodiment, time synchronization of multimodal data to obtain a synchronization dataset includes: using a preset time period as a time base sequence; aligning running parameters and status information to the time base sequence through interpolation; allocating system logs to corresponding time points in the time base sequence according to the occurrence time of each log; and merging running parameters, status information, and system logs allocated to the same time point into synchronization data points to generate a synchronization dataset.

[0032] For example, a time reference sequence (t) is generated based on a preset time period. i ); The missing values ​​of operating parameters and status information in the time base sequence are supplemented using interpolation; for missing text data points in the system log, the corresponding text entries are mapped to the nearest missing time point. If the time missing deviation is large (e.g., exceeding the time threshold), the corresponding missing time points are aligned using a sliding window aggregation. Operating parameters, status information, and system log text at the same time point are recorded as synchronization data points [Di=(x ti s ti , t ti The multiple synchronized data points are merged into a synchronized dataset [D=(D1, D2, ..., Dv)] based on a time base sequence, where i and v are positive integers, 0 < i ≤ v, and v ≥ 3.

[0033] It should be noted that interpolation is a method that uses known, discrete data points to construct an approximate function (interpolation function) to estimate or predict the value of unknown points within that data point range. Sliding window aggregation is a technique for real-time computation of continuous, unbounded data streams; it defines a fixed-length or time-span "window" that slides forward as new data arrives or time progresses, dynamically aggregating and calculating data falling within the window.

[0034] S230. Extract the features of the running parameters, system logs and status information from the synchronization dataset respectively, and fuse the obtained multi-dimensional features to generate cross-modal fusion features.

[0035] In one embodiment, features of the running parameters, system logs, and status information in the synchronization dataset are extracted respectively, including: extracting dynamic features from the running parameters in the synchronization dataset based on a convolutional neural network to obtain running features; extracting features from the status information in the synchronization dataset based on a long short-term memory network to obtain device features; and extracting features from the system logs in the synchronization dataset based on a semantic reading model to obtain semantic features.

[0036] For example, feature extraction is performed on the running parameters, status information, and system logs in the synchronization dataset, including: extracting dynamic pattern features from the running parameters in the synchronization dataset based on a convolutional neural network to obtain running features h. ts For example, it can capture features in voltage and current waveforms that indicate aging of power supply or filter circuits, such as increased ripple and glitches; learn the abnormal and normal fluctuation ranges during the use of control equipment and memory; and detect long-term drift or sudden jitter. It can also extract features from the state information in the synchronized dataset using a long short-term memory network to obtain device features h. state For example, the switching time between the main control device and the backup control device, the number of actions, etc., are converted into device features; semantic reading models are used to extract features from the system logs in the synchronization dataset to obtain semantic features h. text This allows us to understand log semantics in system logs such as "heartbeat not captured," which may seem minor but indicate serious hidden dangers in the communication status.

[0037] It's important to note that Convolutional Neural Networks (CNNs) are deep learning neural networks specifically designed to process data with a grid-like topology (such as images, audio, and video). Long Short-Term Memory Networks (LSTMs) are a special type of recurrent neural network designed to learn long-term dependencies. Semantic reading models can be NLP (Natural Language Processing) models, which are mathematical models or algorithms that enable computers to understand, process, and generate human language.

[0038] In one embodiment, the cross-modal fusion feature includes modal association features and modal joint features. The obtained multi-dimensional features are fused to generate cross-modal fusion features, including: performing modal association on the linear transformations corresponding to the operation features, device features and semantic features based on the attention mechanism to obtain modal association features; and performing weighted summation and feature dimensionality reduction on the operation features, device features and semantic features to obtain modal joint features.

[0039] For example, motion features h are processed by a pre-defined attention module. ts Equipment characteristics h state and semantic features h textFeature association is performed to calculate the correlation between different feature data, thus obtaining modal association features.

[0040] The deterministic expression for modal correlation features is shown in (1): Attention(Q,K,V)=softmax( (1) Where Attention(Q, K, V) represents the modality association feature, and Q, K, V are the motion features h, respectively. ts Equipment characteristics h state and semantic features h text The linear transformation representation, softmax is the magic transformer, which is used to transform motion features h ts Equipment characteristics h state and semantic features h text Convert to multiple positive numbers that sum to 1, where T is the transpose. For the attention dimension.

[0041] For motion characteristics h ts Equipment characteristics h state and semantic features h text Weighted processing is performed, with splicing as an intermediate transition feature, and dimensionality reduction is applied to the intermediate transition feature to obtain the modal joint feature Z.

[0042] The formula for determining the weighted feature is shown in (2): (2) in, For intermediate transition features, Concat is the concatenation function. This is the first learnable weight matrix; As a characteristic of motion, This is the second learnable weight matrix; For equipment characteristics, This is the third learnable weight matrix; These are semantic features.

[0043] S240. Based on cross-modal fusion features, determine the comprehensive feature space of the nuclear power automation system. The comprehensive feature space is used to characterize the global judgment features of the nuclear power automation system between normal and abnormal states.

[0044] In one embodiment, determining the comprehensive feature space of a nuclear power automation system based on cross-modal fusion features includes: constructing redundant device pairs for adjacent control devices based on modal correlation features; performing health feature convergence and abnormal feature distancing processing on each device in the nuclear power automation system based on modal joint features to obtain a first spatial feature; performing fault feature estimation on the control devices in the redundant device pairs based on modal joint features to obtain a second spatial feature; and determining the comprehensive feature space based on the first spatial feature and the second spatial feature.

[0045] For example, determining the comprehensive feature space of a nuclear power automation system through cross-modal fusion features includes: constructing a redundant device pair (C1, C2) between two redundant control devices using an adjacency matrix based on the modal association features of two redundant control devices; within the feature space, bringing the features of each healthy device in the nuclear power automation system closer together and pushing the features of healthy and abnormal devices further apart through modal joint features to obtain the first spatial features.

[0046] The expression (3) for determining the first spatial feature is shown below: (3) in, B represents the first spatial feature; B represents the set of all devices in the nuclear power automation system; a represents a specific device; P(a) represents the set of devices with the same health label in the nuclear power automation system. In a nuclear power plant automation system, z refers to the collection of all equipment except for a itself; a z b z c Let be the joint modal features of devices a, b, and c; sim(u, v): cosine similarity function, sim(u, v) = u·v / (||u||||v||); Temperature parameter, used to adjust sensitivity to difficult-to-use equipment; Σ represents the summation sign. To sum the values ​​of each device in set B, To sum over each device in set P(a), To sum the values ​​of each device in set A(a).

[0047] Second space features This ensures that the characteristics of all healthy devices in the same nuclear power automation system are close to each other in the vector space, while simultaneously making the characteristics of abnormal devices far away from the characteristics of all healthy devices.

[0048] Based on the modal joint features, the fault characteristics of the two control devices in the redundant equipment pair are estimated. If only one of C1 and C2 in the redundant equipment pair fails, or if the two fail in different modes, the modal joint features of the two devices change in different directions. If C1 and C2 in the redundant equipment pair fail synchronously and similarly due to the same reason, the modal joint features of the two devices will also change synchronously and similarly. The second spatial features are obtained.

[0049] The formula for determining the second spatial feature is shown in (4): (4) Where Lccf is the second spatial feature; P is the set of all redundant control device pairs (C1, C2) collected from the equipment relationship diagram in the nuclear power automation system; (C1, C2) is a pair where control devices C1 and C2 have a strong correlation edge in the relationship diagram (belonging to the same redundant device pair); D(u, v) is the squared Euclidean distance between feature vectors, D(u, v) = ||uv||², using squaring to enhance the gradient; margin is a boundary value greater than 0, defining the maximum allowable distance between the modal joint features of redundant control device pairs.

[0050] Among them, control devices C1 and C2 experienced faults in different modes, and their combined modal characteristics changed in different directions, leading to... Increase it beyond the margin.

[0051] By learning the physical correlation between control devices through the second spatial feature Lccf, the feature representations of redundant control devices in a healthy state are highly similar.

[0052] First spatial features Adding the feature space Lccf to the second feature space yields the comprehensive feature space.

[0053] The expression for determining the comprehensive feature space is shown in (5): Ltotal= + Lccf (5) Where Ltotal is the comprehensive feature space. As the first spatial feature, is a hyperparameter, and Lccf is a second spatial feature.

[0054] S250. The comprehensive feature space is converted into a risk index, and the operation status of the nuclear power automation system is determined based on the risk index and risk level threshold, so as to provide timely feedback on the early warning information of the nuclear power automation system.

[0055] In one embodiment, the risk level thresholds include a first risk threshold, a second risk threshold, and a third risk threshold. The operating status of the nuclear power plant automation system is determined based on the risk index and the risk level thresholds, including: determining the nuclear power plant automation system to be in a normal state when the risk index is less than or equal to the first risk threshold and greater than zero; determining the nuclear power plant automation system to be in a state of alert when the risk index is greater than the first risk threshold and less than or equal to the second risk threshold; determining the nuclear power plant automation system to be in a state of warning when the risk index is greater than the second risk threshold and less than or equal to the third risk threshold; and determining the nuclear power plant automation system to be in an emergency state when the risk index is greater than the fourth risk threshold and less than or equal to the full risk range.

[0056] For example, the comprehensive feature space Ltotal is converted into a risk index r, typically a value between 0 and 1 or 0 and 100, representing the severity of system failure or anomaly. The risk level threshold includes a first risk threshold. Second risk threshold and the third risk threshold The risk index r is mapped to four levels, where 0 < r ≤ At that time, the nuclear power plant automation system level is 0, and the nuclear power plant automation system is in normal condition; when <r≤ At that time, the nuclear power plant automation system is at level 1, and the nuclear power plant automation system is in a state of alert; when <r≤ At that time, the nuclear power plant automation system is at level 2, and the nuclear power plant automation system is in a warning state; when <r≤ At that time, the nuclear power plant automation system was at level 3, indicating an emergency. A hierarchical mapping method was used to convert the risk index into discrete warning levels, thereby quantifying the abstract risk into actionable instructions for industrial operations and maintenance personnel. Warning information from the nuclear power plant automation system was displayed on a screen or touchscreen, such as "Alarm: Control equipment - C1, C2 detected a common cause fault; power isolation recommended."

[0057] In one embodiment, the risk level threshold is updated based on the false alarm rate and false negative rate of the nuclear power plant automation system. Specifically, through a threshold adjustment mechanism, parameters are configured based on the operation and maintenance strategy, and adjustments can be made using discrete data from the system and reinforcement learning to obtain the updated risk level threshold.

[0058] The expression for determining the updated risk level threshold is shown in (6): (6) in, The risk level threshold has been updated; The risk level threshold has not been updated. The learning rate; The false alarm rate of nuclear power plant automation systems; Let be the false alarm rate of the nuclear power automation system, where k is a positive integer, 0 < k ≤ 3.

[0059] like Figure 3 As shown, the present invention also provides an anomaly detection device for a nuclear power automation system. The nuclear power automation system includes multiple hardware devices and at least two mutually redundant control devices. The anomaly detection device includes: The acquisition module 310 is used to acquire multimodal data, which includes the operating parameters of the nuclear power automation system, system logs, and status information of each control device during operation. The data synchronization module 320 is used to synchronize multimodal data over time to obtain a synchronized dataset; The feature fusion module 330 is used to extract features from the running parameters, system logs and status information in the synchronization dataset, and fuse the obtained multi-dimensional features to generate cross-modal fusion features. The spatial data determination module 340 is used to determine the comprehensive feature space of the nuclear power automation system based on cross-modal fusion features. The comprehensive feature space is used to characterize the global judgment features of the nuclear power automation system between normal and abnormal states. The early warning module 350 is used to convert the comprehensive feature space into a risk index, and determine the operating status of the nuclear power automation system based on the risk index and risk level threshold, so as to provide timely feedback of early warning information of the nuclear power automation system.

[0060] It should be noted that the anomaly detection device for the nuclear power automation system provided in the above embodiments and the anomaly detection method for the nuclear power automation system provided in the above embodiments belong to the same concept. The specific way of performing each step has been described in detail in the method embodiments, and will not be repeated here.

[0061] This invention proposes an anomaly detection method and apparatus for nuclear power plant automation systems. The method includes: acquiring multimodal data from the nuclear power plant automation system; synchronizing the multimodal data in time to form a synchronization dataset; extracting features from operating parameters, system logs, and status information in the synchronization dataset; and generating cross-modal fusion features based on the obtained multi-dimensional features; determining the comprehensive feature space of the nuclear power plant automation system based on the cross-modal fusion features; converting the comprehensive feature space into a risk index; and determining the operating status of the nuclear power plant automation system based on the risk index and risk level thresholds, and providing early warning information. This invention provides an anomaly detection method for nuclear power plant automation systems, acquiring multimodal data from the system instead of relying on a single data source. It offers more accurate predictions when estimating the operating status of the nuclear power plant automation system, provides timely early warning information, and dynamically updates thresholds to achieve early warning.

[0062] In some embodiments, an electronic device is also provided, which may be a server, and its internal structure diagram is shown below. Figure 3 As shown, the electronic device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of the server-side method described above.

[0063] In some embodiments, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the following steps: acquiring multimodal data, including operating parameters, system logs, and status information of various control devices during the operation of a nuclear power automation system; synchronizing the multimodal data in time to obtain a synchronized dataset; extracting features from the operating parameters, system logs, and status information in the synchronized dataset, and fusing the obtained multi-dimensional features to generate cross-modal fusion features; determining the comprehensive feature space of the nuclear power automation system based on the cross-modal fusion features, the comprehensive feature space being used to characterize the global judgment features of the nuclear power automation system between normal and abnormal states; converting the comprehensive feature space into a risk index, and determining the operating status of the nuclear power automation system based on the risk index and risk level thresholds, so as to provide timely feedback of early warning information for the nuclear power automation system.

[0064] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program thereon, which, when executed by a computer processor, causes the computer to perform the aforementioned anomaly detection method for a nuclear power plant automation system. This computer-readable storage medium may be included in the electronic device described in the above embodiments, or it may exist independently and not assembled into the electronic device.

[0065] It should be noted that the computer-readable medium shown in the embodiments of the present invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0066] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or electronic device described above can be referred to the relevant descriptions on the server side and client side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0067] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. An anomaly detection method for a nuclear power plant automation system, characterized in that, The nuclear power automation system includes multiple hardware devices and at least two redundant control devices. The anomaly detection method includes: Acquire multimodal data, which includes the operating parameters of the nuclear power automation system during operation, system logs, and status information of each control device; The multimodal data is synchronized in time to obtain a synchronized dataset; Features of the running parameters, system logs and status information in the synchronization dataset are extracted respectively, and the obtained multi-dimensional features are fused to generate cross-modal fusion features; Based on the cross-modal fusion features, a comprehensive feature space of the nuclear power automation system is determined. The comprehensive feature space is used to characterize the global judgment features of the nuclear power automation system between normal and abnormal states. The comprehensive feature space is converted into a risk index, and the operating status of the nuclear power automation system is determined based on the risk index and risk level threshold, so as to provide timely feedback of early warning information of the nuclear power automation system.

2. The anomaly detection method for a nuclear power plant automation system according to claim 1, characterized in that, The multimodal data is time-synchronized to obtain a synchronized dataset, including: Use the preset time period as the time base sequence; The operating parameters and the status information are aligned to the time base sequence by interpolation; The system logs are assigned to the corresponding time points in the time base sequence based on the occurrence time of each log entry; The running parameters, status information, and system logs allocated to the same point in time are merged into synchronization data points to generate the synchronization dataset.

3. The anomaly detection method for a nuclear power plant automation system according to claim 2, characterized in that, Features of the running parameters, system logs, and status information in the synchronized dataset are extracted respectively, including: Dynamic features are extracted from the running parameters in the synchronization dataset using a convolutional neural network to obtain running features; Device features are obtained by extracting features from the state information in the synchronization dataset based on a long short-term memory network. Based on the semantic reading model, feature extraction is performed on the system logs in the synchronized dataset to obtain semantic features.

4. The anomaly detection method for a nuclear power plant automation system according to claim 3, characterized in that, The cross-modal fusion feature includes modality association features and modality joint features. The obtained multi-dimensional features are fused to generate the cross-modal fusion feature, including: Modal association is performed on the linear transformations corresponding to the operational features, device features, and semantic features based on an attention mechanism to obtain the modal association features; The operational features, device features, and semantic features are weighted and dimensionality reduced to obtain joint modal features.

5. The anomaly detection method for a nuclear power plant automation system according to claim 4, characterized in that, The comprehensive feature space of the nuclear power automation system is determined based on the cross-modal fusion features, including: Based on the modal association characteristics, redundant device pairs are constructed for the adjacent control devices; Based on the modal joint features, the health features of each device in the nuclear power automation system are brought closer and the abnormal features are moved away to obtain the first spatial features; Based on the modal joint features, the fault characteristics of the control equipment in the redundant equipment pair are calculated to obtain the second spatial features; The comprehensive feature space is determined based on the first spatial feature and the second spatial feature.

6. The anomaly detection method for a nuclear power plant automation system according to claim 4, characterized in that, The risk level thresholds include a first risk threshold, a second risk threshold, and a third risk threshold. Determining the operational status of the nuclear power plant automation system based on the risk index and the risk level thresholds includes: When the risk index is less than or equal to the first risk threshold and greater than zero, the nuclear power automation system is determined to be in a normal state. When the risk index is greater than the first risk threshold and less than or equal to the second risk threshold, the nuclear power automation system is determined to be in a state of alert. When the risk index is greater than the second risk threshold and less than or equal to the third risk threshold, the nuclear power automation system is determined to be in a warning state. When the risk index is greater than the fourth risk threshold and less than or equal to the full risk range, the nuclear power automation system is determined to be in an emergency state.

7. The anomaly detection method for a nuclear power plant automation system according to claim 6, characterized in that, The risk level threshold is dynamically updated based on the false alarm rate and false negative rate of the nuclear power automation system.

8. An anomaly detection device for a nuclear power plant automation system, characterized in that, The nuclear power automation system includes multiple hardware devices and at least two redundant control devices, and the anomaly detection device includes: The acquisition module is used to acquire multimodal data, which includes the operating parameters of the nuclear power automation system during operation, system logs, and status information of each control device. The data synchronization module is used to synchronize the multimodal data in time to obtain a synchronized dataset; The feature fusion module is used to extract features from the running parameters, system logs and status information in the synchronization dataset, and fuse the obtained multi-dimensional features to generate cross-modal fusion features. The spatial data determination module is used to determine the comprehensive feature space of the nuclear power automation system based on the cross-modal fusion features. The comprehensive feature space is used to characterize the global judgment features of the nuclear power automation system between normal and abnormal states. The early warning module is used to convert the comprehensive feature space into a risk index, and determine the operating status of the nuclear power automation system based on the risk index and risk level threshold, so as to provide timely feedback of the early warning information of the nuclear power automation system.

9. An electronic device, characterized in that, It includes a processor, a memory, and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute a computer program stored in the memory to implement the anomaly detection method of the nuclear power automation system as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by the computer's processor, causes the computer to perform the anomaly detection method for the nuclear power automation system as described in any one of claims 1 to 7.

Images