Methods, systems, equipment, and media for switching operating modes of particle accelerators

Abstract

This application discloses a method, system, device, and medium for switching operating modes of a particle accelerator, relating to the field of particle accelerator control technology. It can dynamically reconstruct the safety boundaries of device operation according to different operating scenarios, achieving adaptive matching between safety constraints and operating modes. The method includes: defining mode objects and their configuration information in a mode library; responding to a mode switching command, obtaining comprehensive configuration information of the mode object to be activated from the mode library based on the identifier of the mode to be activated; sending the device parameter configuration information and safety constraint configuration information of the mode object to be activated to the target device controller, so that the target device controller adjusts the device operating state according to the device parameter configuration information; and sending the operation permission configuration information of the mode object to be activated to the access security module of the underlying control network, controlling the access security module to switch the operation permissions to a state matching the mode to be activated.

Description

Technical Field

[0001] This application relates to the field of particle accelerator control technology, and in particular to a method, system, device and medium for switching the operating mode of a particle accelerator. Background Technology

[0002] Particle accelerators, especially superconducting linear accelerators, are the core of modern large-scale scientific facilities, and their operation is extremely complex and precise. Throughout the accelerator's entire lifecycle, it is necessary to frequently switch between various operating modes, including injection commissioning, beam optimization, full-power operation, and shutdown for maintenance. Each mode switch requires that the parameter states of all subsystems accurately and synchronously transition to the target operating condition to ensure beam stability, equipment physical safety, and the smooth conduct of experimental tasks. This places extremely high demands on the reliability and intelligence level of operation control.

[0003] In existing technologies, the switching control of particle accelerator operating modes mainly relies on two methods. One method is primarily manual operation by operators, who manually set and adjust a massive number of equipment parameters one by one according to different operating scenarios to achieve switching control of operating modes. However, manual setting is prone to errors and it is difficult to ensure that all parameters switch to the target state synchronously and accurately, affecting the stability of particle accelerator operation. The other method is a static recovery mechanism based on parameter snapshots. This method can only record and restore the target values ​​of equipment parameters. It is essentially a static and isolated parameter configuration method. Although it can write back the global parameter set at a pre-saved moment to the device at once to achieve rapid recovery of target values, its configuration logic is limited to the simple storage and retrieval of parameter target values. It severs the inherent connection between parameter settings and safety constraint thresholds and operation access permissions, lacks a multi-dimensional dynamic linkage mechanism, and cannot automatically adjust the system's safety behavior boundaries and personnel operation permissions according to the current operating scenario. In summary, neither of the above two methods can achieve precise switching control of particle accelerator operating modes and is difficult to meet the complex operating requirements of particle accelerators. Summary of the Invention

[0004] In view of this, this application provides a method, system, device and medium for switching control of particle accelerator operating modes. The main purpose is to solve the problem that the existing switching control methods for particle accelerator operating modes cannot achieve precise switching control of particle accelerator operating modes and are difficult to meet the complex operating requirements of particle accelerators.

[0005] The first aspect provides a method for switching operating modes of a particle accelerator, the method comprising: The pattern library defines pattern objects and their configuration information. The pattern objects are used to carry the comprehensive configuration information of the corresponding operating mode of the particle accelerator. The comprehensive configuration information is associated with and bound to device parameter configuration information, safety constraint configuration information, and operation permission configuration information. In response to the command to switch operating modes, the comprehensive configuration information of the mode object to be activated is obtained from the mode library according to the mode identifier to be activated; The device parameter configuration information and security constraint configuration information of the object to be activated are sent to the target device controller, so that the target device controller can adjust the device operating state according to the device parameter configuration information and dynamically reconstruct the security boundary of the device operation according to the security constraint configuration information. When it is confirmed that the actual operating state and security boundary of the target device controller meet the preset consistency conditions, the operation permission configuration information of the object to be activated is sent to the access security module of the underlying control network, and the access security module is controlled to switch the operation permission to a state that matches the mode to be activated.

[0006] Furthermore, the device parameter configuration information includes a set of setpoint data for the accelerator subsystem, which includes at least the magnet current value, the radio frequency cavity phase and amplitude value, the vacuum pump group start / stop status, and the threshold parameters of the beam diagnostic equipment. The safety constraint configuration parameters include dynamic boundary data logically associated with the setpoint data. The dynamic boundary data is defined as the upper limit threshold, lower limit threshold, maximum rate of change limit, and interlocking logic relationship between parameters. The operation permission configuration parameters include a role-based access control matrix, which defines the read, write, modify, and forced overwrite permissions of different user roles for specific parameter groups under different operating modes.

[0007] Furthermore, before confirming that the actual operating state of the target device controller and the safety boundary have met the preset consistency conditions, the method further includes: The operation permission configuration information of the object to be activated is preloaded into the access security module of the underlying control network, and the access security module is controlled to put the operation permission configuration information into an inactive locked state. Perform consistency verification between the actual operating state of the target device controller and the safety boundary; If the actual operating state of the target device controller and the security boundary meet the preset consistency conditions, then the access security module is controlled to unlock the locked state and switch the operation permission to a state that matches the activation mode.

[0008] Furthermore, the consistency verification of the actual operating state of the target device controller with the security boundary includes: The verification module reads the currently set parameter values ​​and the effective safety boundary settings from the controllers of each target device. The currently set parameter running value is compared with the corresponding parameter target value in the mode object to be activated to determine whether the deviation between the two is within the preset parameter tolerance range. At the same time, a second comparison is made between the effective security boundary setting value and the corresponding security boundary expectation value in the mode object to be activated, so as to determine whether the two are within the preset boundary error threshold. Only when the results obtained from the first comparison and the results obtained from the second comparison both meet the consistency condition is it confirmed that the actual operating state and safety boundary of the target device controller have met the preset consistency condition.

[0009] Furthermore, after defining the pattern object and its configuration information in the pattern library, the method further includes: A unique version number and digital signature are generated for each of the pattern objects, and the version number and digital signature are bound and stored with the comprehensive configuration information of the pattern object; Accordingly, after obtaining the comprehensive configuration information of the mode object to be activated from the mode library based on the mode identifier to be activated, the method further includes: Synchronously read the comprehensive configuration information of the mode object to be activated and its bound digital signature from the mode library; The comprehensive configuration information of the object to be activated is calculated using a preset signature verification algorithm to verify the validity of the bound digital signature and to check whether the version number conforms to the preset upgrade strategy. Only when the bound digital signature verification is successful and the version number conforms to the preset upgrade strategy, the comprehensive configuration information is determined to be complete, and the device parameter configuration information and security constraint configuration information of the object to be activated are sent to the target device controller.

[0010] Further, the step of sending the device parameter configuration information and security constraint configuration information of the object to be activated to the target device controller includes: A connection to the underlying control network is established through a communication driver module, and the connection adopts an industrial control communication protocol that supports real-time data access and publish / subscribe mechanisms. In response to the successful establishment of the connection, the parameter settings and security constraint thresholds of the target device are extracted from the comprehensive configuration information of the object to be activated, and converted into corresponding underlying device control commands. The underlying device control instructions are encapsulated into atomic transaction packets, sorted according to a preset device dependency order, and sent to the target device controller in batches and concurrently based on the connection, while a timeout timer is started. The feedback signal from the target device controller is monitored in real time, and the following determinations are made: If write confirmation receipts are received from all target device controllers within a preset time, the delivery is deemed successful, and the execution status of the object to be activated is updated to activated. If no write confirmation receipt is received from all target device controllers within the preset time, an exception handling process will be triggered.

[0011] Furthermore, the exception handling process includes: Abort the issuance of atomic transaction packets to the remaining target device controllers that have not received write confirmation receipts; A rollback command is generated and sent to all target device controllers that have received the new configuration to force the device parameter settings and safety boundary settings to be restored to the state specified by the rollback command. The rollback command carries the configuration information of the original operating mode before the switch or the configuration information of the preset safe shutdown mode. The access security module is controlled to discard pre-loaded, locked operation permission configuration information, and maintain the operation permissions in a state that matches the original running mode or downgrade them to the lowest security permission state. A fault report is generated, which includes the fault type, a list of failed devices, and the rollback execution result. An alarm signal for mode switching failure is sent to the upstream client.

[0012] Secondly, a switching control system for the operating mode of a particle accelerator is provided. The system adopts a decoupled architecture of production and consumption, including a mode definition platform, a mode library, a mode execution engine, and an underlying control network. The pattern definition platform, as the producer of pattern objects, provides a graphical user interface to define pattern objects and store them in the pattern library. The pattern objects are used to carry the comprehensive configuration information of the corresponding operating mode of the particle accelerator. The comprehensive configuration information is associated with and bound to device parameter configuration information, safety constraint configuration information, and operation permission configuration information. The pattern library is configured to use the transaction features of the database to version, classify, and retrieve the pattern objects; The pattern execution engine, acting as a consumer of pattern objects, runs independently of the pattern definition module and is configured as follows: In response to the command to switch operating modes, the comprehensive configuration information of the mode object to be activated is obtained from the mode library according to the mode identifier to be activated; The device parameter configuration information and security constraint configuration information of the object to be activated are sent to the target device controller, so that the target device controller can adjust the device operating state according to the device parameter configuration information and dynamically reconstruct the security boundary of the device operation according to the security constraint configuration information. The operation permission configuration information of the object to be activated is sent to the access security module of the underlying control network; When it is confirmed that the actual operating state and security boundary of the target device controller meet the preset consistency conditions, the access security module is controlled to switch the operation permission to a state that matches the activation mode. The underlying control network consists of distributed target device controllers, which are configured as follows: Receive and execute device parameters and security constraint instructions from the mode execution engine; The access security module receives and applies operation permission configuration information, performs permission control based on dynamically reconstructed security boundaries, and feeds back the actual running status to the mode execution engine.

[0013] Thirdly, a switching control device for a particle accelerator operating mode is provided, the device comprising: The definition unit is used to define mode objects and configuration information of mode objects in the mode library. The mode object is used to carry the comprehensive configuration information of the corresponding operation mode of the particle accelerator. The comprehensive configuration information is associated with and bound to device parameter configuration information, safety constraint configuration information and operation permission configuration information. The acquisition unit is used to obtain the comprehensive configuration information of the mode object to be activated from the mode library in response to the operation mode switching command; The first control unit is used to send the device parameter configuration information and security constraint configuration information of the object to be activated to the target device controller, so that the target device controller can adjust the device operating state according to the device parameter configuration information and dynamically reconstruct the security boundary of the device operation according to the security constraint configuration information. The second control unit is used to send the operation permission configuration information of the target device controller to the access security module of the underlying control network when it is confirmed that the actual operating state and security boundary of the target device controller meet the preset consistency conditions, and to control the access security module to switch the operation permission to a state that matches the target mode.

[0014] Fourthly, a switching control device for a particle accelerator operating mode is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor. When the processor executes the program, it implements the aforementioned switching control method for the particle accelerator operating mode.

[0015] In a fifth aspect, a storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the above-mentioned switching control method for the operation mode of the particle accelerator is implemented.

[0016] By means of the above technical solution, a switching control method, system, device and medium for the operation mode of a particle accelerator provided by this application, compared with the existing method of using manual configuration or single-parameter snapshot recovery to implement the switching control of the operation mode of the particle accelerator, defines mode objects and the configuration information of mode objects in the mode library in this application. The mode object is used to carry the comprehensive configuration information of the corresponding operation mode of the particle accelerator, and the comprehensive configuration information is associated and bound with device parameter configuration information, safety constraint configuration information and operation permission configuration information; in response to a switching instruction of the operation mode, obtain the comprehensive configuration information of the to-be-activated mode object in the mode library according to the to-be-activated mode identifier; send the device parameter configuration information and safety constraint configuration information of the to-be-activated mode object to the target device controller, so that the target device controller adjusts the device operation state according to the device parameter configuration information and dynamically reconstructs the safety boundary of the device operation according to the safety constraint configuration information; send the operation permission configuration information of the to-be-activated mode object to the access security module of the underlying control network. When it is confirmed that the actual operation state of the target device controller and the safety boundary meet the preset consistency conditions, control the access security module to switch the operation permission to a state matching the to-be-activated mode. The whole process realizes the standardization and efficient reuse of the operation mode switching by constructing atomized mode objects based on the mode library, deeply binding device parameters, safety constraints and operation permissions, significantly reducing the manual configuration error and shortening the switching cycle; at the same time, by synchronously sending the device parameters and safety constraints to the target device controller, the safety boundary of the device operation can be dynamically reconstructed according to different operation scenarios, realizing the adaptive matching of safety constraints and operation modes, effectively reducing the risk of over-limit operation of the device, and greatly improving the safety and stability of the particle accelerator operation; in addition, this application switches the operation permission after the actual operation state of the device and the safety boundary meet the consistency conditions, realizing the linkage control of parameter configuration, safety constraints and permission operations, ensuring the reliability of mode switching while realizing the dynamic and accurate adaptation of operation permissions to the operation mode, which is conducive to reusing successful operation modes as standardized digital assets, and further improving the switching efficiency of the operation mode of the particle accelerator.

[0017] The above description is only an overview of the technical solution of this application. In order to be able to understand the technical means of this application more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features and advantages of this application more obvious and understandable, the specific embodiments of this application are specifically given below. Brief Description of the Drawings

[0018] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart illustrating a method for switching control of particle accelerator operating modes in one embodiment of this application. Figure 2 This is a flowchart illustrating a method for switching control of particle accelerator operating modes in another embodiment of this application. Figure 3 This is a flowchart illustrating a method for switching control of particle accelerator operating modes in another embodiment of this application. Figure 4 yes Figure 1 A schematic diagram of a specific implementation method for step 103; Figure 5 This is a structural block diagram of a particle accelerator operation mode switching control system in one embodiment of this application; Figure 6 This is a flowchart illustrating the pattern object definition stage in one embodiment of this application; Figure 7 This is a flowchart illustrating the execution phase of a pattern object in one embodiment of this application; Figure 8 This is a schematic diagram of the structure of a particle accelerator operation mode switching control device in one embodiment of this application; Figure 9 This is a schematic diagram of the device structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0019] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0020] In related technologies, the switching control of particle accelerator operating modes mainly relies on two methods. One method is manual operation by operators, where they manually set and adjust a massive number of equipment parameters one by one according to different operating scenarios to achieve switching control of operating modes. However, manual setting is prone to errors and it is difficult to ensure that all parameters switch to the target state synchronously and accurately, affecting the stability of particle accelerator operation. The other method is a static recovery mechanism based on parameter snapshots. This method can only record and restore the target values ​​of equipment parameters. It is essentially a static and isolated parameter configuration method. Although it can write back the global parameter set at a pre-saved moment to the device at once to achieve rapid recovery of target values, its configuration logic is limited to the simple storage and retrieval of parameter target values. It severs the inherent connection between parameter settings and safety constraint thresholds and operation access permissions, lacks a multi-dimensional dynamic linkage mechanism, and cannot automatically adjust the system's safety behavior boundaries and personnel operation permissions according to the current operating scenario. In summary, neither of the above two methods can achieve precise switching control of particle accelerator operating modes and is difficult to meet the complex operating requirements of particle accelerators.

[0021] To address this issue, this embodiment provides a method for switching operating modes of a particle accelerator, such as... Figure 1 As shown, it includes the following steps: 101. Define pattern objects and their configuration information in the pattern library.

[0022] In this embodiment, the particle accelerator control system deploys a highly available pattern library, which serves as the core configuration management center for storing and managing various operating conditions throughout the accelerator's entire lifecycle. The pattern library is constructed using a relational database or a non-relational document database, supporting version control and concurrent access. Standardized pattern objects are defined within the library, each corresponding to a specific operating state of the particle accelerator, such as low-energy injection mode, high-energy storage mode, beam commissioning mode, or shutdown maintenance mode. Each pattern object is assigned a globally unique pattern identifier and contains metadata information, such as creation time, applicable physics experiment type, and version number, to facilitate rapid retrieval and traceability by the system.

[0023] In this embodiment, the mode object carries the comprehensive configuration information for the corresponding operating mode of the particle accelerator. This information uses atomized encapsulation technology to logically bind configuration data that was originally scattered across different subsystems into an indivisible whole. Specifically, the comprehensive configuration information contains three closely related configuration information pieces: The equipment parameter configuration information records the specific settings of each subsystem of the accelerator in the target mode, such as the magnet power supply, radio frequency system, vacuum unit, and beam diagnostic equipment. This includes not only static parameters, such as current setpoint and frequency value, but also dynamic timing parameters, such as pulse waveform, trigger delay, and scan curve, ensuring that the equipment can accurately reproduce the physical field environment required for this mode.

[0024] Safety constraint configuration information defines dynamic safety boundaries that strictly match the mode. These constraints include allowable fluctuation ranges for key parameters, rate-of-change limits, interlocking logic conditions, and exception handling strategies. Unlike safety constraints, the constraints in this embodiment are dynamically loaded with the mode; for example, in debug mode, adjustments to certain parameters that are prohibited in normal operation mode may be allowed.

[0025] The operation permission configuration information specifies the access levels and operation command sets for different user roles on the underlying device in operating mode. This configuration clarifies which control interfaces are open, which functions are locked, and the approval process for specific operations.

[0026] It should be noted that the three types of configuration information mentioned above do not exist independently during the pattern object definition process, but are associated and bound through a strong consistency mechanism. When an engineer defines a new pattern object through the host computer configuration tool, the system automatically executes a logical verification algorithm: checking whether the device parameter settings fall within the currently defined security constraints, verifying whether the operation permission configuration covers the control requirements of all critical devices, and ensuring that there are no logical conflicts among the three. Only configuration combinations that pass the verification can be instantiated into a valid pattern object and stored in the pattern library.

[0027] 102. In response to the command to switch the operating mode, obtain the comprehensive configuration information of the mode object to be activated from the mode library according to the mode identifier to be activated.

[0028] When the particle accelerator system enters a switching state, operators or upper-level control programs can initiate a switching command through the user interface, or an external experimental control system can initiate a switching command according to a preset timing sequence. The switching command contains a unique identifier for the mode to be activated. This identifier serves as an index number for the mode object, forming a one-to-one mapping with a specific mode object pre-stored in the mode library. For example, when operators need to switch the accelerator to full-power operation mode, they can select the identifier corresponding to that mode on the interface, or the system can automatically generate and send an execution command containing that identifier based on task scheduling logic.

[0029] Correspondingly, the particle accelerator system's command receiving module monitors and captures the operation mode switching commands in real time, and verifies the validity of the command format. If the verification passes, in response to the parsed mode identifier, the system controls the access to the mode library through the high-speed internal bus or database access interface. The system uses the mode identifier as the query keyword to quickly locate the corresponding mode object to be activated in the index table of the mode library. Since the mode object has atomically bound device parameters, safety constraints, and operation permissions in the previous steps, the system can completely read the comprehensive configuration information it carries at once when obtaining the mode object. The extracted comprehensive configuration information is temporarily stored in the system's high-speed cache or memory working area, forming a complete configuration data package. This configuration data package contains all the magnet current settings, radio frequency phase parameters, dynamic safety threshold ranges, and the new operation permission matrix that will take effect soon, preparing the data for subsequent execution.

[0030] Before formally distributing the comprehensive configuration information of the mode object to be activated to the underlying device, this embodiment also includes a pre-loading verification stage. The pre-loading verification stage compares and analyzes the extracted comprehensive configuration information with the real-time status snapshot of the current device. Specifically, it checks whether the parameter configuration information of the device to be activated is within the adjustable range of the physical device, verifies whether the security constraint configuration information to be activated is compatible with the current hardware topology, and confirms the logical consistency of the operation permission configuration information. If corrupted mode object data, version mismatch, or logical conflicts are found during the retrieval or verification process, the system will immediately abort the switching process, return a specific error code to the operator, and maintain the current operating mode unchanged to prevent erroneous configurations from flowing into the control loop. Only after the comprehensive configuration information passes the integrity and consistency verification is it marked as ready, triggering subsequent parameter distribution and security boundary reconstruction processes, thereby ensuring that every operating mode switch is performed based on accurate, complete, and secure configuration data.

[0031] 103. Send the device parameter configuration information and security constraint configuration information of the object to be activated to the target device controller, so that the target device controller can adjust the device operating state according to the device parameter configuration information and dynamically reconstruct the security boundary of the device operation according to the security constraint configuration information.

[0032] In this embodiment, once the comprehensive configuration information of the target mode object is verified and marked as ready, the particle accelerator system will unpack the device parameter configuration information and safety constraint configuration information in the comprehensive configuration information and broadcast or unicast them to the target device control of each subsystem through a high real-time industrial communication network.

[0033] The aforementioned target device controllers include, but are not limited to, magnet power controllers, RF cavity frequency controllers, vacuum system PLCs, and beam diagnostic front-end units. To ensure timing consistency, the data packets carry a unified timestamp or trigger frame number. All target device controllers are required to store the received data in their respective buffer registers, but not execute it immediately; instead, they wait for a global synchronization signal. This mechanism ensures that thousands of devices across the accelerator can simultaneously receive new configuration commands with microsecond-level time precision, avoiding asynchronous device actions caused by network latency differences.

[0034] Correspondingly, upon receiving the global synchronization signal, the target device controller first rapidly adjusts the device's operating status based on the device parameter configuration information. The controller's internal control algorithm immediately loads new setpoints, waveform curves, or timing logic. For example, the injection magnet power controller smooths the current from its current holding value to the specific amperes required for injection based on the new parameters, and the RF system controller adjusts the cavity phase to match the new acceleration gradient. During this process, the target device controller uses pre-loaded parameters to generate real-time drive signals, driving actuators such as power amplifiers to rapidly converge the actual operating trajectory of the physical device to the operating point defined by the target mode.

[0035] Simultaneously, the target device controller dynamically reconstructs the safety boundaries of the device's operation at its local logic layer based on the received safety constraint configuration information. In this step, the safety constraints are no longer static thresholds fixed in the firmware, but rather dynamic strategies that update in real time with mode switching. The target device controller loads the new safety constraints into the hardware protection logic or high-speed software protection process, immediately overriding the old safety rules. These safety constraints include, but are not limited to, maximum allowable current, temperature limits, rate of change limits, and interlocking logic tables. For example, when switching to a high-brightness operating mode, the target device controller's safety boundaries automatically tighten, reducing the allowable beam loss threshold; while when switching to machine debugging mode, the safety boundaries may be moderately relaxed in some non-critical areas to allow exploratory operations, but at the same time, more stringent single-step confirmation logic will be activated. This dynamic reconstruction ensures that the device's protection strategy adaptively matches the current operating mode at any given time. Once any parameter exceeds the limit or abnormal fluctuations occur during actual adjustments, the new safety boundaries will immediately take effect and trigger interlocking protection, significantly improving the safety of the particle accelerator system under changing operating conditions.

[0036] 104. When it is confirmed that the actual operating status and security boundary of the target device controller meet the preset consistency conditions, the operation permission configuration information of the object to be activated is sent to the access security module of the underlying control network, and the access security module is controlled to switch the operation permission to a state that matches the mode to be activated.

[0037] In this embodiment, after the device parameters and safety constraint information have been sent to the target device controller, the main control logic unit of the particle accelerator system extracts the operation permission configuration information of the object to be activated separately and sends it to the access security module deployed at the edge of the underlying control network or through a secure communication channel independent of the real-time control bus. Here, the access security module can be an independent hardware security gateway, a security function block in a programmable logic controller, or a high-priority daemon running in a real-time operating system. Specifically, it is used to uniformly manage the operator's actions, parameter modification permissions, and device control permissions, receive and temporarily store the operation permission configuration information corresponding to the mode to be activated, and wait for the triggering conditions for permission switching.

[0038] Before the permission switch is triggered, to verify the consistency between the operating status and the security boundary, the execution verification module can collect and compare the actual operating status of each target device controller in real time. This determines whether the current actual operating parameters of the device match the device parameter configuration information of the mode to be activated, and whether the security boundary after the device reconstruction has been stably effective. When the actual operating status, parameter configuration results, and security boundary of all target devices meet the preset consistency conditions, the preconditions for mode switching are considered to be met.

[0039] After the consistency conditions are confirmed to be met, a permission switching enable signal is sent to the access security module, controlling the access security module to switch the currently effective operation permissions to a state matching the mode to be activated. At this time, the operations that operators can perform, the range of accessible parameters, and the configuration items that can be modified on the control interface are all constrained according to the permission rules of the new mode, realizing dynamic adaptation between operation permissions and operating mode. By completing the device status and security boundary configuration first, and then switching operation permissions, unauthorized operations or unauthorized control when the device is not ready are effectively avoided, improving the security of the particle accelerator's operating mode switching process.

[0040] The switching control method for the operation mode of the particle accelerator provided by the embodiments of the present application, compared with the existing method of using manual configuration or single-parameter snapshot restoration to achieve the switching control of the operation mode of the particle accelerator, defines mode objects and the configuration information of the mode objects in the mode library in the present application. The mode object is used to carry the comprehensive configuration information of the corresponding operation mode of the particle accelerator, and the comprehensive configuration information is associated and bound with device parameter configuration information, safety constraint configuration information, and operation permission configuration information. In response to the switching instruction of the operation mode, the comprehensive configuration information of the to-be-activated mode object is obtained from the mode library according to the to-be-activated mode identifier. The device parameter configuration information and safety constraint configuration information of the to-be-activated mode object are sent to the target device controller, so that the target device controller adjusts the device operation state according to the device parameter configuration information and dynamically reconstructs the safety boundary of device operation according to the safety constraint configuration information. The operation permission configuration information of the to-be-activated mode object is sent to the access security module of the underlying control network. When it is confirmed that the actual operation state of the target device controller and the safety boundary meet the preset consistency conditions, the access security module is controlled to switch the operation permission to the state matching the to-be-activated mode. Through constructing atomic mode objects based on the mode library, the device parameters, safety constraints, and operation permissions are deeply bound in the whole process, realizing the standardization and efficient reuse of operation mode switching, significantly reducing the manual configuration error and shortening the switching cycle. At the same time, by synchronously sending the device parameters and safety constraints to the target device controller, the safety boundary of device operation can be dynamically reconstructed according to different operation scenarios, realizing the adaptive matching of safety constraints and operation modes, effectively reducing the risk of over-limit operation of the device, and greatly improving the safety and stability of the particle accelerator operation. In addition, the present application switches the operation permission after the actual operation state of the device and the safety boundary meet the consistency conditions, realizing the linkage control of parameter configuration, safety constraint, and permission operation. While ensuring the reliability of mode switching, the dynamic and accurate adaptation of operation permission with the operation mode is realized, which is beneficial to reusing the successful operation mode as a standardized digital asset, and further improving the switching efficiency of the operation mode of the particle accelerator.

[0041] In this embodiment, the aforementioned equipment parameter configuration information includes a set of setpoint data for the accelerator subsystem. This setpoint data includes at least the magnet current value, RF cavity phase and amplitude values, vacuum pump group start / stop status, and threshold parameters for the beam diagnostic equipment. Specifically, for the magnet system, the setpoint data includes the excitation current value of the main diode magnet, the gradient current value of the quadrupole magnet, and the fine-tuning current value of the correction magnet. These values ​​directly determine the beam trajectory and focusing characteristics. For the RF system, the data includes the phase-locked value of the accelerator cavity, the output amplitude value of the high-frequency power amplifier, and the gain coefficient of the low-level feedback system to ensure the stability of the beam energy gain. For the vacuum system, the configuration information is refined into the start / stop status logic of the vacuum pump group in each region, the molecular pump speed setting, and the voltage threshold of the ion pump, used to maintain a specific vacuum level. Furthermore, for the beam diagnostic equipment, the setpoint data also includes the alarm threshold of the beam position monitor, the integral time constant of the beam loss monitor, and the range switching command of the current transformer.

[0042] In this embodiment, the aforementioned safety constraint configuration parameters include dynamic boundary data logically associated with the setpoint data. Dynamic boundary data is defined as the upper and lower threshold values, maximum rate of change limits, and interlocking logic relationships between parameters. Specifically, the safety constraint configuration parameters are not independent static limits, but rather dynamic boundary data with a strong logical association with the setpoint data. This association is reflected in the adaptive adjustment of the safety boundary as the setpoint changes. The dynamic boundary data is specifically defined in four dimensions: first, the upper and lower threshold values, which are not fixed values ​​but functions based on the setpoint. For example, the safety upper limit of the magnet current is defined as 105% of the setpoint value to prevent the parameter from exceeding the physically permissible range during adjustment; second, the maximum rate of change limit, which specifies the maximum slope of the parameter's permissible change per unit time to avoid sudden changes in current or voltage impacting the power grid or equipment; and most importantly, the interlocking logic relationships between parameters, which is a set of Boolean logic rules defining the dependency constraints between multiple parameters. For example, the logic rule can be set to only apply when the vacuum level is below 10... -7 When Pa and the cooling water flow rate are normal, the RF cavity amplitude setpoint is allowed to be non-zero, or when the beam loss monitoring value exceeds the dynamic threshold, the magnet current change rate is forcibly limited to zero.

[0043] In this embodiment, the aforementioned operation permission configuration parameters include a role-based access control matrix. This matrix defines the read, write, modify, and force-overwrite permissions for specific parameter groups for different user roles under different operating modes. Specifically, the rows of the matrix define different user roles, such as junior operator, senior physicist, system administrator, and maintenance engineer, while the columns define specific parameter groups or functional modules, such as the main loop magnet current group, the RF phase fine-tuning group, and the safety interlock bypass group. The cell content of the matrix precisely defines the level of operation permission a specific role has for a specific parameter group under that operating mode, including: read permission, write permission, modify permission, and force-overwrite permission. Importantly, this matrix is ​​mode-sensitive. For example, in beam commissioning mode, a senior physicist role might have permission to modify the RF phase and force-overwrite permission for certain non-critical interlocks; while in high-energy physics operating mode, the permissions for the same role are automatically downgraded to only read permission and limited write permission, and the force-overwrite permission is completely revoked.

[0044] The aforementioned pattern objects can utilize a three-dimensional data structure of parameters, range, and permissions. In this structure, each pattern object to be activated is defined as a composite entity containing three fields: target operating value, upper and lower limits of safety constraints, and operation permission rules. During the pattern object definition phase, when physics experts create a new pattern through the pattern management platform, they must atomically bind these three types of information for a specific device group. For example, when defining a pattern for a superconducting magnet, its target current value, overcurrent protection threshold, and the modification permission for this parameter during operation must be set simultaneously. After the pattern object definition is completed, a logical rationality check is automatically performed. Only after the check passes is the complete pattern object serialized and stored in the pattern library. This design ensures the integrity of the operational strategy and avoids configuration conflicts caused by the separation of parameters and safety policies.

[0045] In practical applications, to eliminate timing race risks during mode switching, particle accelerator systems need to preload and lock operation permissions before formally verifying device state consistency. In this state, even if the new configuration contains more lenient permission rules, external operation requests cannot use these rules to bypass existing security restrictions. Furthermore, such as... Figure 2 As shown, before confirming in step 104 that the actual operating state of the target device controller and the safety boundary have met the preset consistency conditions, the method further includes the following steps: 201. Preload the operation permission configuration information of the object to be activated into the access security module of the underlying control network, and control the access security module to put the operation permission configuration information into an inactive locked state.

[0046] 202. Verify the consistency between the actual operating status of the target device controller and the safety boundary.

[0047] 203. If the actual operating state of the target device controller and the security boundary meet the preset consistency conditions, then control the access security module to release the locked state and switch the operation permission to a state that matches the activation mode.

[0048] While the permission configuration is locked and waiting, the particle accelerator system initiates a deep consistency check between the actual operating state of the target device controller and the safety boundary. The main control unit polls the status registers of each subsystem via a high-speed real-time network, collecting real-time values ​​of key physical quantities, such as the actual readings of the magnet current, the VSWR of the RF cavity, and the pressure value of the vacuum chamber, and compares these data with the preset steady-state tolerance window in the target mode object. At the same time, the particle accelerator system verifies the reconstruction of the safety boundary, confirming that each controller has successfully loaded and activated the new dynamic thresholds and interlocking logic, and that these new logics are in a ready rather than faulty state.

[0049] In this embodiment, the consistency verification logic relies on a dual match between physical state and logical constraints. Specifically, the preset consistency condition is met only when the actual operating parameters of all critical devices are stable within the allowable error range of the target setpoint, and all relevant security constraint configurations are confirmed to be in the latest active state. Specifically, the verification module reads the currently set parameter operating values ​​and the effective security boundary setting values ​​from each target device controller. A first comparison is made between the currently set parameter operating values ​​and the corresponding target parameter values ​​in the target mode object to determine if the deviation is within the preset parameter tolerance range. Simultaneously, a second comparison is made between the effective security boundary setting values ​​and the corresponding expected security boundary values ​​in the target mode object to determine if they are within the preset boundary error threshold. Only when both the results of the first and second comparisons meet the consistency condition is the actual operating state and security boundary of the target device controller confirmed to have met the preset consistency condition. Conversely, if any device is found to be in an excessive oscillation period, has exceeded parameter limits, or fails to load security logic during the verification process, the verification program will immediately return a non-compliance signal and keep the new permission configuration in the access security module locked to prevent opening operation permissions when the system is not in a stable state.

[0050] If the consistency verification result shows that the actual operating status of all target device controllers and the reconstructed security boundaries meet the preset consistency conditions, that is, the device parameters have been synchronously adjusted to the requirements of the activation mode, the security boundaries have been stably effective and there are no abnormal prompts, then the access security module sends an unlock command to control the access security module to release the lock on the preloaded operation permission configuration information.

[0051] Once the unlocking is complete, the access security module immediately activates the pre-loaded operation permission configuration information, and the particle accelerator system switches the current operation permission rules to a state that fully matches the mode to be activated. At this time, the operator's operation permissions, parameter access range, configuration modification permissions, etc., are all constrained according to the rules of the mode to be activated, achieving coordinated adaptation between operation permissions and device operating status and security boundaries, ensuring the integrity and reliability of the operating mode switching.

[0052] In practical applications, to ensure the immutability of configuration information in the pattern library, an identity verification and encryption binding process can be introduced during the pattern definition phase. Correspondingly, when an engineer or automated script completes the definition and saving of a new pattern object and its comprehensive configuration information in the pattern library, the particle accelerator system immediately triggers the security generation module. Furthermore, such as... Figure 3 As shown, after step 101, the method further includes the following steps: 301. Generate a unique version number and digital signature for each of the pattern objects, and bind and store the version number and digital signature with the comprehensive configuration information of the pattern object.

[0053] Accordingly, after step 102, the method also includes the following steps: 302. Synchronously read the comprehensive configuration information of the mode object to be activated and its bound digital signature from the mode library.

[0054] 303. Calculate the comprehensive configuration information of the object to be activated using a preset signature verification algorithm to verify the validity of the bound digital signature and check whether the version number conforms to the preset upgrade strategy.

[0055] 304. The comprehensive configuration information is deemed complete only when the bound digital signature verification is successful and the version number conforms to the preset upgrade strategy.

[0056] In this embodiment, the security generation module first generates a globally unique version number based on the timestamp, creator information, and hash value of the configuration content to track the iteration history of the pattern object. Then, the system uses a pre-set asymmetric encryption private key to perform a digital signature operation on the complete binary data stream of the comprehensive configuration information, generating a corresponding digital signature. Finally, the system atomically binds and stores the version number, digital signature, and comprehensive configuration information. Once the data is loaded into memory, the security verification module immediately intervenes, using a pre-stored public key and a preset signature verification algorithm to perform reverse calculations on the read comprehensive configuration information. The calculated digest value is compared with the read digital signature to verify the authenticity and integrity of the data. Simultaneously, the extracted version number is logically matched with the preset upgrade strategy of the current operating environment.

[0057] The aforementioned preset upgrade strategy can be pre-configured according to the operational requirements of the particle accelerator. For example, it can be set to only allow the use of the latest version of the mode object, allow the use of mode objects of at least a specified version, or prohibit the use of older mode objects of a version lower than a certain threshold. If the version number conforms to the upgrade strategy, the version verification is deemed to have passed; if the version number does not conform to the upgrade strategy, for example, if an older version is used or the minimum version requirement is not met, the version verification is deemed to have failed, subsequent operations are refused, and a version error message is issued.

[0058] Only when the digital signature verification is successful and the version number conforms to the preset upgrade strategy will the comprehensive configuration information of the object to be activated be determined to be complete, secure, and compliant. This will trigger the subsequent process, which will send the device parameter configuration information and security constraint configuration information of the object to be activated to the target device controller. If the digital signature verification fails or the version number does not conform to any of the upgrade strategy, the current mode switching process will be terminated, the original running state will be maintained, and the corresponding error information will be output to ensure the security of the particle accelerator mode switching process and avoid abnormal device operation due to configuration information tampering or version non-compliance.

[0059] In practical applications, the configuration information distribution process begins with the establishment of a highly reliable communication link. After determining that the comprehensive configuration information of the object to be activated possesses integrity, security, and compliance, the distribution process of device parameter configuration information and security constraint configuration information is initiated. This process can actively initiate a connection request with the underlying control network through the communication driver module built into the particle accelerator system. Specifically, such as... Figure 4 As shown, step 103 includes the following steps: 401. Establish a connection with the underlying control network through the communication driver module.

[0060] 402. In response to the successful establishment of the connection, extract the parameter settings and security constraint thresholds of the target device from the comprehensive configuration information of the object to be activated, and convert them into the corresponding underlying device control commands.

[0061] 403. Encapsulate the underlying device control instructions into atomic transaction packets, sort them according to a preset device dependency order, and send the sorted atomic transaction packets to the target device controller in a batch concurrent manner based on the connection, while starting a timeout timer.

[0062] 404. If write confirmation receipts are received from all target device controllers within the preset time, the delivery is deemed successful, and the execution status of the object to be activated is updated to activated.

[0063] 405. If no write confirmation receipt is received from all target device controllers within the preset time, the exception handling process will be triggered.

[0064] In this embodiment, an industrial control communication protocol that supports real-time data access and publish / subscribe mechanisms is selected, such as EPICS CA or PVA protocol, and can also be extended to support OPC UA protocol. This type of protocol features low latency and high reliability, meeting the real-time requirements of simultaneous transmission of multiple devices and parameters in a particle accelerator. Simultaneously, the publish / subscribe mechanism ensures that transmitted commands are accurately pushed to the corresponding target device controller, avoiding command loss or erroneous transmission.

[0065] Specifically, during the connection establishment process, the communication driver module will monitor the connection status of the underlying control network in real time, including network link connectivity, communication rate, and data transmission stability. If a connection abnormality is detected, a network connection alarm will be issued immediately, and the distribution process will be terminated, waiting for staff to troubleshoot the network fault and re-initiate the connection. If the connection is successfully established, the communication driver module will send a connection success signal to the system, triggering the subsequent instruction extraction and conversion process.

[0066] In response to the successful connection establishment feedback signal, the parameter settings and security constraint thresholds corresponding to each target device are extracted from the comprehensive configuration information of the objects to be activated. Since the configuration information of the objects to be activated is in a standardized data format, while the underlying device controller can only recognize control commands in a specific format, the extracted parameter settings and security constraint thresholds need to be converted into underlying device control commands compatible with the target device controller through the command conversion module. This ensures that the commands can be accurately parsed and executed by the target device controller. For example, the standardized parameter values ​​are converted into binary or hexadecimal commands that the device can recognize. At the same time, the command format is verified to avoid delivery failure due to incorrect command format.

[0067] After instruction conversion, all underlying device control instructions are encapsulated into atomic transaction packages. These atomic transaction packages are indivisible and uninterruptible, ensuring that each set of control instructions can be completely sent to the target device controller, avoiding problems such as incomplete configuration and inconsistent parameters caused by instruction splitting. Subsequently, based on the operating logic of each subsystem device of the particle accelerator, a preset device dependency order is determined. For example, the parameter configuration of the vacuum system device must be completed first, followed by the parameter configuration of the magnet power supply device, to avoid operational abnormalities caused by incorrect device startup order. The atomic transaction packages are then sorted according to this dependency order to ensure that the sending process conforms to the logical requirements of device operation.

[0068] After sorting is completed, based on the previously established underlying control network connection, the sorted atomic transaction packets are sent to the corresponding target device controllers in batch concurrent manner. At the same time, the system starts a timeout timer with a preset timeout period. This timeout period can be flexibly configured according to the number of devices and parameter complexity. For example, it can be set to 30 seconds to monitor the feedback signals of the target device controllers and avoid the indefinite waiting of the sending process due to device failure or communication delay.

[0069] After the distribution process is initiated, the feedback signals from each target device controller can be monitored in real time via the communication driver module. The focus is on receiving instruction write confirmation acknowledgments returned by the target device controllers. After each atomic transaction packet is distributed, the corresponding target device controller, after completing instruction parsing and writing, will return a write confirmation acknowledgment to the particle accelerator system, indicating that the device has successfully received and stored the corresponding parameter settings and safety constraint thresholds. The particle accelerator system performs real-time statistics on the feedback confirmation acknowledgments to determine whether write confirmation acknowledgments from all target device controllers have been received within the preset timeout period. If write confirmation receipts are successfully received from all target device controllers within the preset time, and the receipt information all shows that the command was written successfully, then the device parameter configuration information and security constraint configuration information are determined to have been successfully sent. The execution status of the objects to be activated is immediately updated to "activated," and this status is synchronously stored in the mode library to provide a status basis for subsequent permission switching and operation monitoring. If write confirmation receipts are not received from all target device controllers within the preset time, for example, some devices do not return receipts, the returned receipts show that the command was written failed, or the timeout timer reaches the preset time and no device has responded, then the sending is determined to have failed. The exception handling process is immediately triggered, and the timeout timer is stopped to avoid wasting resources.

[0070] After the specific exception handling process is triggered, the issuance of atomic transaction packets to the remaining target device controllers that have not received the write confirmation receipt is stopped; a rollback instruction is generated and sent to all target device controllers that have received the new configuration to force the device parameter settings and security boundary settings to be restored to the state specified by the rollback instruction. The rollback instruction carries the configuration information of the original operating mode before the switch or the configuration information of the preset safe shutdown mode; the control access security module discards the preloaded, locked operation permission configuration information and maintains the operation permissions in a state matching the original operating mode or downgrades them to the lowest security permission state; a fault report is generated, which includes the exception type, the list of failed devices and the rollback execution result, and an alarm signal for mode switching failure is sent to the upstream client.

[0071] Taking the establishment and execution of the beamline operation mode of the superheavy element synthesis experimental terminal as an example, the switching control process of the above-mentioned particle accelerator operation mode is explained in detail: First, physics experts log in to the mode management platform and import key subsystems involved in the beamline, such as the superconducting magnet power supply, machine protection system, timing synchronization equipment, and front-end beam diagnostic components, through templates. They precisely define their working parameters, dynamic safety boundaries, and fine-grained operation permissions. After review, the mode object containing the complete configuration matrix is ​​stored in the mode library. Subsequently, the operators select the mode ID in the central control room and trigger the execution command. The mode execution engine then retrieves the configuration from the library and uses EPICS. The CA / PVA protocol distributes target parameter values ​​and safety ranges to each device's IOC in batches. Simultaneously, it dynamically loads new permission rules through the EPICS access security mechanism, causing unnecessary debugging parameters on the operator interface to be immediately grayed out and locked. Finally, after the configuration is distributed, the execution verification module compares the actual device status with the set values ​​in real time. If any parameter deviation or status mismatch is detected, a beam disallow signal is immediately generated and input into the beam allow system, thereby physically blocking beam extraction and ensuring that the experimental terminal only enters the beam-carrying operation state under conditions that fully comply with the preset safety specifications.

[0072] Furthermore, as a specific implementation of the above method, this application provides a switching control system for the operating mode of a particle accelerator. This system adopts a decoupled architecture for production and consumption, such as... Figure 5 As shown, it includes a pattern definition platform, a pattern library, a pattern execution engine, and an underlying control network; The pattern definition platform, as the producer of pattern objects, provides a graphical user interface to define pattern objects and store them in the pattern library. The pattern objects are used to carry the comprehensive configuration information of the corresponding operating mode of the particle accelerator. The comprehensive configuration information is associated with and bound to device parameter configuration information, safety constraint configuration information, and operation permission configuration information. The pattern library is configured to use the transaction features of the database to version, classify, and retrieve the pattern objects; The pattern execution engine, acting as a consumer of pattern objects, runs independently of the pattern definition module and is configured as follows: In response to the command to switch operating modes, the comprehensive configuration information of the mode object to be activated is obtained from the mode library according to the mode identifier to be activated; The device parameter configuration information and security constraint configuration information of the object to be activated are sent to the target device controller, so that the target device controller can adjust the device operating state according to the device parameter configuration information and dynamically reconstruct the security boundary of the device operation according to the security constraint configuration information. The operation permission configuration information of the object to be activated is sent to the access security module of the underlying control network; When it is confirmed that the actual operating state and security boundary of the target device controller meet the preset consistency conditions, the access security module is controlled to switch the operation permission to a state that matches the activation mode. The underlying control network consists of distributed target device controllers, which are configured as follows: Receive and execute device parameters and security constraint instructions from the mode execution engine; The access security module receives and applies operation permission configuration information, performs permission control based on dynamically reconstructed security boundaries, and feeds back the actual running status to the mode execution engine.

[0073] The aforementioned decoupled architecture for production and consumption is physically and logically divided into three independent parts: first, a pattern definition platform located at the management end, dedicated to experts for strategy formulation, parameter tuning, and permission planning; second, a pattern library serving as an intermediate storage layer, used to persistently store approved pattern objects; and third, a pattern execution engine located at the control network, responsible for responding to execution commands in real time and driving the underlying devices. This architecture allows changes to the execution strategy to be made without modifying the underlying control code, requiring only an update of the pattern objects at the management end; simultaneously, upgrades or maintenance at the execution end will not affect the strategy definition process, achieving effective isolation between business logic and control logic.

[0074] In the collaborative process following the receipt of execution instructions, the specific mode execution engine integrates an instruction receiving module, a configuration parsing and mapping module, a communication driver module, and a permission management module. When an operator triggers a mode switch, the engine first reads the target mode object from the mode library, parsing out the device list and the corresponding parameter-range-permission triplet. Subsequently, the communication driver module uses industrial protocols such as EPICS CA / PVA or OPC UA to establish a high-concurrency connection with the underlying device controller. The mode execution engine performs two synchronous actions: on the one hand, it batch writes the target working value and upper and lower limits of safety constraints into the process variables and protection logic units of the device controller; on the other hand, the permission management module calls the underlying access security service to dynamically load operation permission rules and refresh the control status of the operator interface in real time. This millisecond-level synchronization mechanism of parameter distribution and permission locking ensures that the device is in a controlled and secure permission environment the moment it enters a new operating state.

[0075] It should be noted that this embodiment provides an operation permission control process that dynamically evolves with the mode state, embedding permission rules within the mode object. When the system switches from standby mode to beam operation mode, the mode execution engine not only adjusts device parameters but also automatically revoks the operator's right to modify critical security parameters based on the operation permission rule fields in the new mode, retaining only monitoring rights. When switching back to debug mode, the mode execution engine automatically restores the corresponding debug permissions. This method, through deep integration of the mode execution engine and the underlying access security layer, achieves automated and real-time deployment of permission policies, eliminating the lag and risk of misoperation caused by manual intervention in permission configuration, and fundamentally ensuring the inherent security of the system in complex experimental environments.

[0076] Refer to the specific pattern object definition stage Figure 6 As shown, this embodiment details the complete lifecycle management process of a pattern object from creation to readiness. First, a physical expert or authorized operator logs into the pattern definition platform and initiates a request to create a new pattern. Then, in the configuration phase, the user defines a specific set of device parameters for the pattern object, including setting target operating values, safe operating ranges, and fine-grained operation permission rules for each subsystem. After the pattern object is defined, a parameter rationality verification mechanism is automatically triggered, conducting a deep review of the logical consistency, numerical legality, and security compliance of the input data. If the verification result is unsuccessful, an error message is returned, guiding the user back to the editing interface to correct the configuration, forming a closed-loop iterative optimization. Only when the verification result is deemed successful is the pattern object and its associated configuration information officially saved to the pattern library. At this point, the pattern status is updated to ready, signifying that it is qualified to be invoked and executed, and can be used by subsequent operation control processes.

[0077] For specific pattern object execution phase reference Figure 7 As shown, this embodiment details the entire execution chain of a pattern object from user triggering to final effectiveness. First, the operator selects the target pattern object on the terminal and clicks "execute," which is then captured by the pattern execution engine. The engine immediately reads the complete pattern object data from the pattern library, parses the high-level configuration parameters, and maps them to the underlying EPICS PV address. Subsequently, using the CA / PVA communication protocol, the target parameter values ​​are batch-distributed to each device's IOC, and new permission rules are dynamically loaded to the EPICS access security layer, locking or unlocking corresponding operation permissions in real time. After distribution, a verification process is performed, comparing the actual feedback values ​​from the devices with the set values. If the verification is successful, the pattern is deemed to have officially taken effect and runs stably according to the new parameters and permission policies. If the verification fails, a protection mechanism is immediately triggered, error logs are reported, and a rollback operation is automatically performed to restore the system to its pre-execution secure state, ensuring the reliability of the control process.

[0078] Furthermore, as a specific implementation of the above method, embodiments of this application provide a switching control device for the operating mode of a particle accelerator, such as... Figure 8 As shown, the device includes: a definition unit 51, an acquisition unit 52, a first control unit 53, and a second control unit 54.

[0079] The definition unit 51 is used to define a mode object and the configuration information of the mode object in the mode library. The mode object is used to carry the comprehensive configuration information of the corresponding operation mode of the particle accelerator. The comprehensive configuration information is associated with and bound to device parameter configuration information, safety constraint configuration information and operation permission configuration information. The acquisition unit 52 is used to obtain the comprehensive configuration information of the mode object to be activated from the mode library in response to the operation mode switching command; The first control unit 53 is used to send the device parameter configuration information and security constraint configuration information of the object to be activated to the target device controller, so that the target device controller can adjust the device operating state according to the device parameter configuration information and dynamically reconstruct the security boundary of the device operation according to the security constraint configuration information. The second control unit 54 is used to send the operation permission configuration information of the target device controller to the access security module of the underlying control network when it is confirmed that the actual operating state and security boundary of the target device controller meet the preset consistency conditions, and to control the access security module to switch the operation permission to a state that matches the target mode.

[0080] The switching control device for the operation mode of the particle accelerator provided by the embodiment of the present invention, compared with the existing method of using manual configuration or single-parameter snapshot restoration to achieve the switching control of the operation mode of the particle accelerator, defines mode objects and the configuration information of the mode objects in the mode library in this application. The mode objects are used to carry the comprehensive configuration information of the corresponding operation mode of the particle accelerator, and the comprehensive configuration information is associated and bound with device parameter configuration information, safety constraint configuration information, and operation permission configuration information; in response to the switching instruction of the operation mode, the comprehensive configuration information of the to-be-activated mode object is obtained in the mode library according to the to-be-activated mode identifier; the device parameter configuration information and safety constraint configuration information of the to-be-activated mode object are sent to the target device controller, so that the target device controller adjusts the device operation state according to the device parameter configuration information and dynamically reconstructs the safety boundary of the device operation according to the safety constraint configuration information; the operation permission configuration information of the to-be-activated mode object is sent to the access security module of the underlying control network, and when it is confirmed that the actual operation state of the target device controller and the safety boundary have met the preset consistency conditions, the access security module is controlled to switch the operation permission to the state matching the to-be-activated mode. Throughout the process, by constructing atomic mode objects based on the mode library, the device parameters, safety constraints, and operation permissions are deeply bound, realizing the standardization and efficient reuse of the operation mode switching, significantly reducing the manual configuration error and shortening the switching cycle; at the same time, by synchronously sending the device parameters and safety constraints to the target device controller, the safety boundary of the device operation can be dynamically reconstructed according to different operation scenarios, realizing the adaptive matching of safety constraints and operation modes, effectively reducing the risk of over-limit operation of the device, and greatly improving the safety and stability of the particle accelerator operation; in addition, this application switches the operation permission after the actual operation state of the device and the safety boundary meet the consistency conditions, realizing the linkage control of parameter configuration, safety constraints, and permission operations, ensuring the reliability of mode switching while realizing the dynamic and precise adaptation of operation permissions to the operation mode, which is beneficial to reusing the successful operation mode as a standardized digital asset and further improving the switching efficiency of the operation mode of the particle accelerator.

[0081] In a specific application scenario, the device parameter configuration information includes a set of setpoint data for the accelerator subsystem, and the setpoint data at least includes magnet current values, RF cavity phase and amplitude values, start-stop states of the vacuum pump group, and threshold parameters of beam diagnostic equipment; The safety constraint configuration parameters include dynamic boundary data logically associated with the setpoint data, and the dynamic boundary data is defined as the upper limit threshold, lower limit threshold, maximum change rate limit of the parameter, and the interlock logic relationship between parameters; The operation permission configuration parameters include a role-based access control matrix, and the matrix defines the read, write, modify, and forced overwrite permissions of different user roles for specific parameter groups in different operation modes.

[0082] In specific application scenarios, the device further includes: The third control unit is used to preload the operation permission configuration information of the target device controller to be activated mode object into the access security module of the underlying control network before confirming that the actual operating state and security boundary of the target device controller have met the preset consistency conditions, and to control the access security module to put the operation permission configuration information into an inactive locked state. The verification unit is used to verify the consistency between the actual operating state and the security boundary of the target device controller. The switching unit is used to control the access security module to release the locked state and switch the operation permission to a state that matches the activation mode if the actual operating state of the target device controller and the security boundary have met the preset consistency conditions.

[0083] In specific application scenarios, the verification unit is specifically used for: The verification module reads the currently set parameter values ​​and the effective safety boundary settings from the controllers of each target device. The currently set parameter running value is compared with the corresponding parameter target value in the mode object to be activated to determine whether the deviation between the two is within the preset parameter tolerance range. At the same time, a second comparison is made between the effective security boundary setting value and the corresponding security boundary expectation value in the mode object to be activated, so as to determine whether the two are within the preset boundary error threshold. Only when the results obtained from the first comparison and the results obtained from the second comparison both meet the consistency condition is it confirmed that the actual operating state and safety boundary of the target device controller have met the preset consistency condition.

[0084] In specific application scenarios, the device further includes: The generation unit is used to define pattern objects and configuration information of pattern objects in the pattern library, generate a unique version number and digital signature for each pattern object, and bind and store the version number and digital signature with the comprehensive configuration information of the pattern object. Correspondingly, the reading unit is used to synchronously read the comprehensive configuration information of the mode object to be activated and its bound digital signature from the mode library after obtaining the comprehensive configuration information of the mode object to be activated from the mode library according to the mode identifier to be activated. The calculation unit is used to calculate the comprehensive configuration information of the object to be activated using a preset signature verification algorithm, so as to verify the validity of the bound digital signature and check whether the version number conforms to the preset upgrade strategy. The distribution unit is used to determine that the comprehensive configuration information is complete only when the bound digital signature verification is successful and the version number conforms to the preset upgrade strategy, and then distribute the device parameter configuration information and security constraint configuration information of the object to be activated to the target device controller.

[0085] In specific application scenarios, the sending unit is specifically used for: A connection to the underlying control network is established through a communication driver module, and the connection adopts an industrial control communication protocol that supports real-time data access and publish / subscribe mechanisms. In response to the successful establishment of the connection, the parameter settings and security constraint thresholds of the target device are extracted from the comprehensive configuration information of the object to be activated, and converted into corresponding underlying device control commands. The underlying device control instructions are encapsulated into atomic transaction packets, sorted according to a preset device dependency order, and sent to the target device controller in batches and concurrently based on the connection, while a timeout timer is started. The feedback signal from the target device controller is monitored in real time, and the following determinations are made: If write confirmation receipts are received from all target device controllers within a preset time, the delivery is deemed successful, and the execution status of the object to be activated is updated to activated. If no write confirmation receipt is received from all target device controllers within the preset time, an exception handling process will be triggered.

[0086] In specific application scenarios, the triggered exception handling process includes: Abort the issuance of atomic transaction packets to the remaining target device controllers that have not received write confirmation receipts; A rollback command is generated and sent to all target device controllers that have received the new configuration to force the device parameter settings and safety boundary settings to be restored to the state specified by the rollback command. The rollback command carries the configuration information of the original operating mode before the switch or the configuration information of the preset safe shutdown mode. The access security module is controlled to discard pre-loaded, locked operation permission configuration information, and maintain the operation permissions in a state that matches the original running mode or downgrade them to the lowest security permission state. A fault report is generated, which includes the fault type, a list of failed devices, and the rollback execution result. An alarm signal for mode switching failure is sent to the upstream client.

[0087] Based on the above-described particle accelerator operating mode switching control method, this application embodiment also provides a storage medium storing a computer program, which, when executed by a processor, implements the above-described particle accelerator operating mode switching control method.

[0088] Based on this understanding, the technical solution of this application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, or portable hard drive), and includes several instructions to cause a computer device (such as a personal computer, server, or network device) to execute the methods described in the various implementation scenarios of this application.

[0089] Based on the above-described particle accelerator operating mode switching control method, in a virtual device embodiment, to achieve the above objective, this application embodiment also provides a physical device for switching control of particle accelerator operating modes, specifically a computer, smartphone, tablet computer, smartwatch, server, or network device, etc., the physical device including a storage medium and a processor; the storage medium is used to store a computer program; the processor is used to execute the computer program to implement the above-described particle accelerator operating mode switching control method.

[0090] Optionally, the physical device may also include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, input units such as a keyboard, etc., and optional user interfaces may also include USB interfaces, card reader interfaces, etc. The network interface may optionally include standard wired interfaces, wireless interfaces (such as Wi-Fi interfaces), etc.

[0091] In an exemplary embodiment, see Figure 9 The aforementioned physical device includes a communication bus, a processor, a memory, and a communication interface. It may also include an input / output interface and a display device. The various functional units can communicate with each other via the bus. The memory stores a computer program, and the processor executes the program stored in the memory to perform the particle accelerator operating mode switching control method described in the above embodiments.

[0092] Those skilled in the art will understand that the physical device structure for switching control of a particle accelerator operating mode provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or combine certain components, or have different component arrangements.

[0093] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the physical device controlling the switching of the particle accelerator's operating modes, supporting the execution of information processing programs and other software and / or programs. The network communication module is used to enable communication between the various components within the storage medium, as well as communication with other hardware and software in the information processing physical device.

[0094] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented using software plus necessary general-purpose hardware platforms, or it can be implemented through hardware. By applying the technical solution of this application, compared with the existing methods, this application constructs atomic pattern objects based on a pattern library, deeply binding device parameters, security constraints, and operation permissions, realizing the standardization and efficient reuse of operation mode switching, significantly reducing manual configuration errors and shortening the switching cycle; at the same time, by synchronously distributing device parameters and security constraints to the target device controller, the device operation safety boundary can be dynamically reconstructed according to different operating scenarios, realizing adaptive matching of security constraints and operation modes, effectively reducing the risk of device over-limit operation, and greatly improving the safety and stability of particle accelerator operation; in addition, this application switches operation permissions only after the actual operating state of the device and the safety boundary meet the consistency conditions, realizing the linkage control of parameter configuration, security constraints, and permission operation, ensuring the reliability of mode switching, and realizing the dynamic and accurate adaptation of operation permissions with the operation mode, which is conducive to reusing successful operation modes as standardized digital assets, further improving the switching efficiency of particle accelerator operation modes.

[0095] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing this application. Those skilled in the art will understand that the modules in the apparatus of the embodiment can be distributed within the apparatus of the embodiment as described, or can be modified to be located in one or more apparatuses different from this embodiment. The modules of the above-described embodiment can be combined into one module, or further divided into multiple sub-modules.

[0096] The serial numbers in this application are for descriptive purposes only and do not represent the superiority or inferiority of any particular implementation scenario. The above disclosures are merely a few specific implementation scenarios of this application; however, this application is not limited thereto, and any variations conceived by those skilled in the art should fall within the protection scope of this application.

Claims

1. A method for switching operating modes of a particle accelerator, characterized in that, include: The mode library defines mode objects and their configuration information. The mode objects carry comprehensive configuration information for the corresponding operating mode of the particle accelerator. This comprehensive configuration information is associated with and bound to device parameter configuration information, safety constraint configuration information, and operation permission configuration information. The device parameter configuration information includes a set of setpoint data for the accelerator subsystem. This setpoint data includes at least magnet current values, RF cavity phase and amplitude values, vacuum pump group start / stop status, and threshold parameters of the beam diagnostic equipment. The safety constraint configuration parameters include dynamic boundary data logically associated with the setpoint data. This dynamic boundary data is defined as the upper and lower threshold values, maximum rate of change limits, and interlocking logic relationships between parameters. The operation permission configuration parameters include a role-based access control matrix. This matrix defines the read, write, modify, and forced overwrite permissions for specific parameter groups for different user roles under different operating modes. In response to the command to switch operating modes, the comprehensive configuration information of the mode object to be activated is obtained from the mode library according to the mode identifier to be activated; The device parameter configuration information and security constraint configuration information of the object to be activated are sent to the target device controller, so that the target device controller can adjust the device operating state according to the device parameter configuration information and dynamically reconstruct the security boundary of the device operation according to the security constraint configuration information. When it is confirmed that the actual operating state and security boundary of the target device controller meet the preset consistency conditions, the operation permission configuration information of the object to be activated is sent to the access security module of the underlying control network, and the access security module is controlled to switch the operation permission to a state that matches the mode to be activated. Before confirming that the actual operating status and security boundary of the target device controller meet the preset consistency conditions, the operation permission configuration information of the object to be activated is preloaded into the access security module of the underlying control network, and the access security module is controlled to put the operation permission configuration information into an inactive locked state. Perform consistency verification between the actual operating state of the target device controller and the safety boundary; If the actual operating state of the target device controller and the security boundary meet the preset consistency conditions, then the access security module is controlled to unlock the locked state and switch the operation permission to a state that matches the activation mode.

2. The particle accelerator operating mode switching control method according to claim 1, characterized in that, The consistency verification between the actual operating state of the target device controller and the security boundary includes: The verification module reads the currently set parameter values ​​and the effective safety boundary settings from the controllers of each target device. The currently set parameter running value is compared with the corresponding parameter target value in the mode object to be activated to determine whether the deviation between the two is within the preset parameter tolerance range. At the same time, the effective security boundary setting value is compared with the corresponding security boundary expected value in the mode object to be activated to determine whether the two are within the preset boundary error threshold. Only when the results obtained from the first comparison and the results obtained from the second comparison both meet the consistency condition is it confirmed that the actual operating state and safety boundary of the target device controller have met the preset consistency condition.

3. The method for switching operating modes of a particle accelerator according to any one of claims 1-2, characterized in that, After defining the pattern object and its configuration information in the pattern library, the method further includes: A unique version number and digital signature are generated for each of the pattern objects, and the version number and digital signature are bound and stored with the comprehensive configuration information of the pattern object; Accordingly, after obtaining the comprehensive configuration information of the mode object to be activated from the mode library based on the mode identifier to be activated, the method further includes: Synchronously read the comprehensive configuration information of the mode object to be activated and its bound digital signature from the mode library; The comprehensive configuration information of the object to be activated is calculated using a preset signature verification algorithm to verify the validity of the bound digital signature and to check whether the version number conforms to the preset upgrade strategy. Only when the bound digital signature verification is successful and the version number conforms to the preset upgrade strategy, the comprehensive configuration information is determined to be complete, and the device parameter configuration information and security constraint configuration information of the object to be activated are sent to the target device controller.

4. The method for switching operating modes of a particle accelerator according to any one of claims 1-2, characterized in that, The step of sending the device parameter configuration information and security constraint configuration information of the object to be activated to the target device controller includes: A connection to the underlying control network is established through a communication driver module, and the connection adopts an industrial control communication protocol that supports real-time data access and publish / subscribe mechanisms. In response to the successful establishment of the connection, the parameter settings and security constraint thresholds of the target device are extracted from the comprehensive configuration information of the object to be activated, and converted into corresponding underlying device control commands. The underlying device control instructions are encapsulated into atomic transaction packets, sorted according to a preset device dependency order, and sent to the target device controller in batches and concurrently based on the connection, while a timeout timer is started. The feedback signal from the target device controller is monitored in real time, and the following determinations are made: If write confirmation receipts are received from all target device controllers within a preset time, the delivery is deemed successful, and the execution status of the object to be activated is updated to activated. If no write confirmation receipt is received from all target device controllers within the preset time, an exception handling process will be triggered.

5. The method for switching operating modes of a particle accelerator according to claim 4, characterized in that, The exception handling process includes: Abort the issuance of atomic transaction packets to the remaining target device controllers that have not received write confirmation receipts; A rollback command is generated and sent to all target device controllers that have received the new configuration to force the device parameter settings and safety boundary settings to be restored to the state specified by the rollback command. The rollback command carries the configuration information of the original operating mode before the switch or the configuration information of the preset safe shutdown mode. The access security module is controlled to discard pre-loaded, locked operation permission configuration information, and maintain the operation permissions in a state that matches the original running mode or downgrade them to the lowest security permission state. A fault report is generated, which includes the fault type, a list of failed devices, and the rollback execution result. An alarm signal for mode switching failure is sent to the upstream client.

6. A switching control system for the operating mode of a particle accelerator, characterized in that, The system adopts a decoupled architecture of production and consumption, including a pattern definition platform, a pattern library, a pattern execution engine, and an underlying control network. The mode definition platform, acting as a producer of mode objects, provides a graphical user interface for defining mode objects and storing them in a mode library. These mode objects carry comprehensive configuration information for the corresponding operating mode of the particle accelerator. This comprehensive configuration information is associated with and bound to device parameter configuration information, safety constraint configuration information, and operation permission configuration information. The device parameter configuration information includes a set of setpoint data for the accelerator subsystem. This setpoint data includes at least magnet current values, radio frequency cavity phase and amplitude values, vacuum pump group start / stop status, and threshold parameters of the beam diagnostic equipment. The safety constraint configuration parameters include dynamic boundary data logically associated with the setpoint data. This dynamic boundary data is defined as upper and lower threshold values, maximum rate of change limits, and interlocking logic relationships between parameters. The operation permission configuration parameters include a role-based access control matrix. This matrix defines the read, write, modify, and forced overwrite permissions for specific parameter groups for different user roles under different operating modes. The pattern library is configured to use the transaction features of the database to version, classify, and retrieve the pattern objects; The pattern execution engine, acting as a consumer of pattern objects, runs independently of the pattern definition module and is configured as follows: In response to the command to switch operating modes, the comprehensive configuration information of the mode object to be activated is obtained from the mode library according to the mode identifier to be activated; The device parameter configuration information and security constraint configuration information of the object to be activated are sent to the target device controller, so that the target device controller can adjust the device operating state according to the device parameter configuration information and dynamically reconstruct the security boundary of the device operation according to the security constraint configuration information. The operation permission configuration information of the object to be activated is sent to the access security module of the underlying control network; When it is confirmed that the actual operating state and security boundary of the target device controller meet the preset consistency conditions, the access security module is controlled to switch the operation permission to a state that matches the activation mode. Before confirming that the actual operating status and security boundary of the target device controller meet the preset consistency conditions, the operation permission configuration information of the object to be activated is preloaded into the access security module of the underlying control network, and the access security module is controlled to put the operation permission configuration information into an inactive locked state. Perform consistency verification between the actual operating state of the target device controller and the safety boundary; If the actual operating state of the target device controller and the security boundary meet the preset consistency conditions, then the access security module is controlled to unlock the locked state and switch the operation permission to a state that matches the activation mode. The underlying control network consists of distributed target device controllers, which are configured as follows: Receive and execute device parameters and security constraint instructions from the mode execution engine; The access security module receives and applies operation permission configuration information, performs permission control based on dynamically reconstructed security boundaries, and feeds back the actual running status to the mode execution engine.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images