A sand collecting pump station operating condition unit emergency shutdown instantaneous quick door linkage timing optimization method

Abstract

The application discloses a kind of sand collection pump station operating condition unit emergency stop instantaneous quick door linkage timing optimization method, belong to pump station control technical field.This method first constructs the non-uniform signal feature template library of different fault types by collecting historical emergency stop data;Then the real-time operation data is sampled by sliding window, and the standardized matching score is calculated by online matching with the template library to generate structured emergency event objects;Then compare the standardized score with the preset threshold, and select the high-precision linkage path or the conservative safety path according to the confidence level;Further create a master intelligent agent and multiple sub-agents, generate parallel linkage timing according to fault type and preset timing parameters, and isolate abnormalities through fault propagation links;Then issue hardware instructions under the ability token mechanism to ensure secure isolation of credentials;Finally, insert a persistent checkpoint at the key node to achieve traceability and accurate recovery of the entire process state.

Description

Technical Field

[0001] This invention relates to the field of pump station control technology, and more specifically, to a method for optimizing the timing of the instantaneous fast door linkage during emergency shutdown of the unit in the Shaji pump station under operating conditions. Background Technology

[0002] As a core facility of the regional water conservancy hub, the Shaji Pumping Station may encounter sudden situations such as electrical faults, hydraulic stalls, or mechanical jamming during operation. In such cases, an immediate emergency shutdown procedure must be executed, and the rapid-action doors must be closed simultaneously to prevent the accident from escalating. In actual operation, the timing requirements for the rapid-action doors during emergency shutdown are extremely stringent: the doors must close within hundreds of milliseconds and must coordinate precisely with multiple control units, including those controlling for unit speed reduction, hydraulic pressure relief, and backup power switching. However, due to the significant differences in the physical signal characteristics triggered by different fault types, traditional fixed-sequence logic is ill-suited to the varied fault modes, often resulting in delayed response, disordered action sequences, or even failure to operate, seriously threatening the safe operation of the pumping station.

[0003] To address the aforementioned issues, existing technologies primarily employ preset timing schemes based on programmable logic controllers (PLCs). This involves setting fixed action delays and sequences for different types of faults based on historical experience, and then distributing control commands to each actuator via hardwiring or fieldbus. Some advanced solutions introduce distributed control systems (DCS), using host computer software to configure and program the linkage logic, enabling centralized monitoring of multiple control units. Furthermore, some research has explored using vibration and current sensor signals for fault diagnosis, triggering preset linkage programs based on the diagnostic results.

[0004] However, the aforementioned existing technologies have significant drawbacks: First, logic based on fixed timing cannot adapt to the diversity of fault signals. The same set of timing parameters cannot simultaneously meet the requirements of speed and coordination under different fault types, often requiring a trade-off between security and timeliness. Second, existing fault diagnosis and linkage control are disconnected. Diagnostic results are usually only presented as alarm information and are not deeply integrated with subsequent precise timing generation, resulting in an information gap from fault identification to instruction execution. Third, traditional control instruction issuance methods directly store hardware access credentials (such as PLC communication keys) in the control program, posing a risk of credential leakage. Once the control system is maliciously attacked or the program malfunctions, attackers may gain control of the underlying hardware. Finally, existing systems lack the ability to accurately record and trace the status of the entire linkage process. When anomalies occur, it is difficult to reproduce the scene for root cause analysis, failing to provide effective data support for timing optimization. Summary of the Invention

[0005] In response to the needs mentioned in the background art, this invention provides a method for optimizing the linkage timing of the instantaneous fast door during emergency shutdown of the Shaji Pumping Station unit, aiming to solve the problem that the fast door fails to linkage in time or the action timing is disordered during emergency shutdown of the Shaji Pumping Station unit.

[0006] A method for optimizing the timing of instantaneous fast-acting valve linkage during emergency shutdown of units in the Shaji pumping station, comprising the following steps:

[0007] Step 1: Construct an emergency shutdown condition feature template library

[0008] Collect historical operating data of pump station units under various emergency shutdown conditions;

[0009] For each emergency shutdown event, the time window from before the fault occurred to after the high-speed door was fully closed is captured and discretized according to a fixed sampling frequency;

[0010] The data within each time window is organized into matrix blocks, with rows corresponding to sampling times and columns corresponding to sensor channels. Corresponding signal templates are constructed for different types of emergency shutdown causes, and each signal template is a matrix containing non-uniform signal offsets.

[0011] Step 2: Real-time operational flow structured analysis

[0012] Real-time operating data of the pump station units are collected online to form a sliding window data with a sampling window length; the sliding window data is matched online with the template library constructed in step one, and the likelihood ratio statistic between the sliding window data and each signal template is calculated; when the likelihood ratio statistic exceeds the preset information theory detection threshold, the sliding window data is bound into a structured emergency event object.

[0013] Step 3: Trigger Confidence Decision Based on Linkage

[0014] Extract the confidence scalar from the emergency event object obtained in step two. The confidence scalar is obtained by normalizing the likelihood ratio statistic. Compare the confidence scalar with a preset confidence threshold. If the confidence scalar is lower than the confidence threshold, execute the preset conservative safety linkage procedure and issue an early warning. If the confidence scalar is not lower than the confidence threshold, confirm the emergency event and trigger the subsequent linkage sequence.

[0015] Step 4: Parallel linkage timing generation and coordination

[0016] A master control agent and multiple sub-agents are created, each corresponding to a mechanical unit that needs to be controlled independently. The master control agent receives the emergency event object confirmed in step three and sends the event information to each sub-agent. Each sub-agent generates its own linkage control sequence based on the event information and a preset timing parameter table, and records the execution status through an internal state maintenance primitive. The master control agent activates all sub-agents simultaneously through a parallel start primitive, realizing collaborative control of multiple devices. At the same time, an anomaly notification mechanism between the sub-agents and the master control agent is established through a fault propagation link.

[0017] Step 5: Issuance of security hardware commands

[0018] Each hardware interface is configured with a corresponding kernel service, including programmable logic controller register writing and relay on / off. Before performing hardware operations, the agent requests a temporary and unforgeable identity token from the virtual machine host environment. The identity token contains only the device identifier. After verifying the validity of the identity token, the virtual machine host environment loads the actual hardware access credentials from the environment variables and constructs a communication message. Then, it sends precise timing control instructions to the hardware.

[0019] Step Six: Persistent Backtracking of the Linkage Process

[0020] During the execution of steps four and five, persistent checkpoints are inserted before and after key actions. When a persistent checkpoint is reached, the virtual machine automatically serializes the complete running state of all relevant agents into structured data objects and atomically writes them to persistent storage media. When post-analysis is required, the running state of all agents is restored from the specified persistent checkpoint, reproducing the entire process from event triggering to instruction execution.

[0021] Furthermore, in step one, the historical operating data includes time-series data of unit speed, stator current, bearing vibration, volute water pressure, and rapid door opening.

[0022] Furthermore: In step one, the non-uniform signal offset represents the mean or variance change of the matrix elements relative to normal operating conditions.

[0023] Furthermore: In step three, the emergency event object includes the fault type, trigger time, and original matching score fields.

[0024] The beneficial effects of this invention are as follows: By deeply integrating statistical template-based condition identification with agent-based collaborative control, this invention constructs a complete closed loop from signal perception to instruction execution. This enables chaotic sensor data to be accurately mapped into structured events and directly transformed into parallel and controllable timing instructions, breaking down the information barrier between fault diagnosis and coordinated control. Simultaneously, through the coupling of a confidence-based decision-making mechanism and a multi-agent fault-tolerant architecture, fine-grained timing is enabled at high confidence levels to ensure rapid response, while automatically downgrading to a conservative path to ensure a safety baseline at low confidence levels. Furthermore, the fault propagation link enables timely isolation of anomalies and overall rollback, achieving an adaptive balance between security and speed. In addition, the combination of a capability token security mechanism and a persistent backtracking mechanism not only fundamentally eliminates the risk of hardware credential leakage but also provides a reproducible objective data basis for fault root cause analysis and timing parameter optimization, enabling the system to continuously improve itself while ensuring the security of single executions. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 A flowchart of the method of the present invention is shown. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in the present invention are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of the present invention. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this invention illustrate operations implemented according to some embodiments of the present invention. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this invention, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0028] Furthermore, the embodiments described herein are merely some, not all, of the embodiments of the invention. The components of the embodiments of the invention described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0029] It should be noted that the term "comprising" will be used in the embodiments of the present invention to indicate the presence of a feature subsequently declared, but does not preclude the addition of other features. It should also be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In the description of the present invention, it should also be noted that the terms "first," "second," "third," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance.

[0030] The following is a detailed description of this case, in conjunction with the relevant accompanying drawings in the instruction manual.

[0031] This solution aims to address the problem of rapid-action doors failing to activate in a timely manner or exhibiting disordered action sequences during emergency shutdown of the Shaji Pumping Station units. To address this issue, this embodiment proposes an optimization method for the instantaneous activation sequence of rapid-action doors during emergency shutdown of the Shaji Pumping Station units. This method includes the following steps:

[0032] Step 1: Construct an emergency shutdown condition feature template library

[0033] First, historical operating data of the pump station units under various typical emergency shutdown conditions were collected. This historical operating data includes time-series records of key parameters such as unit speed (Hz), stator current (A), bearing vibration (μm), volute water pressure (MPa), and rapid valve opening (%). For each emergency shutdown event, data was extracted from the point before the fault occurred. After the high-speed door closes completely in seconds A full time window of seconds is used to ensure coverage of the entire transient process from fault initiation to action completion. Subsequently, continuous signals within this time window are sampled at a fixed frequency. Equal-interval sampling (e.g., 100Hz) is performed to obtain discretized time-series data.

[0034] Next, the data obtained from each sampling are arranged according to the sensor channels to form a two-dimensional matrix. Specifically, let the sampling window contain a total of At any given moment (i.e.) The number of sensor channels is Then the data for each event can be represented as a matrix. row index Corresponding sampling time, column index Corresponding to different sensor channels.

[0035] Based on this, corresponding signal templates are constructed for different types of emergency shutdown causes (such as electrical faults, hydraulic stall, mechanical jamming, etc.). Assume there are a total of... The first type of fault, for the first Class of faults ( This involves collecting a matrix of historical event data for this type of fault and calculating its mean matrix as a template for this type of fault. To eliminate the influence of normal operating conditions, a baseline data matrix of the unit during stable operation must first be obtained. (Usually obtained by averaging data from a long period of trouble-free operation). Then the... Template matrix of fault types Defined as:

[0036]

[0037] in This refers to the historical number of events related to this type of failure. For the first The data matrix for this event. Matrix elements Indicates the first Time, Number On each sensor, this is the average deviation of the fault condition relative to the normal condition. This deviation can be manifested as a change in the mean (such as a sudden increase in current) or a change in the variance (such as increased vibration). However, this step mainly captures the mean deviation. If variance changes need to be considered, a variance template can be defined similarly.

[0038] To quantify the significance of each template, its signal energy is defined. The sum of squares of all elements in the template matrix, i.e., the square of the Frobenius norm:

[0039]

[0040] The higher the energy value, the stronger the signal characteristics of this fault type, and the easier it is for subsequent detection algorithms to identify it. According to information theory detection theory, to ensure reliable detection of the template in subsequent real-time identification, the following conditions must be met: Equal conditions (where) (This refers to the length of data monitored in real time), but this condition is only used as a reference for template design. In actual construction, the energy of each template can be naturally obtained based on the statistical characteristics of historical data.

[0041] Finally, all template matrix This data was compiled to form an emergency shutdown condition characteristic template library. This library not only includes the average spatiotemporal evolution pattern of each fault type, but also uses energy values... It provides a quantitative measure of its detectability.

[0042] Referring to Tables 1 to 4, several terminal blocks are defined:

[0043] Table 1

[0044]

[0045] Table 2

[0046]

[0047] Table 3

[0048]

[0049] Table 4

[0050]

[0051] The table shows the electrical schematic diagram and terminal block definitions of the quick-release gate control cabinet at Shaji Pumping Station, mainly including the following key information:

[0052] Define AC power supply connections A / B / C / N;

[0053] Define the U / V / W wiring of the motor main circuit and the distribution of multiple DC220V power supplies;

[0054] Define digital inputs and outputs, including "Upper Limit of Working Gate Master Command" (25A / 25), "Lower Limit of Working Gate Master Command" (26A / 26), "Upper Limit of Accident Gate Master Command" (27A / 27), "Lower Limit of Accident Gate Master Command" (28A / 28), as well as 12V / 5V sensor power supply, CLK / DAT communication line, etc.

[0055] Define the interfaces between the control host and the host, such as "host switch control signal" and "door status signal sent to host switch";

[0056] The wire number correspondence of 40 terminals is defined for field wiring.

[0057] Connect the upper limit switch signal of the high-speed gate to terminal 25A (working gate master command upper limit) and terminal 25 of X3 to collect the gate's fully open position;

[0058] Connect the lower limit switch signal to terminals 26A and 26 to collect the gate's fully closed position;

[0059] Connect the upper and lower limit signals of the emergency door to terminals 27A / 27 and 28A / 28 respectively;

[0060] Connect the gate load sensor to the corresponding digital input module;

[0061] The upstream and downstream water level gauges of the gate are powered by 12V / V+ and 12V / V- through the X3 terminal, and the digital signals are connected to the controller through the S+ / S- or CLK / DAT terminals.

[0062] All the above signals are collected via the X3 terminal block to the programmable logic controller or edge computing unit inside the control cabinet. These digital and analog signals are acquired at a fixed sampling frequency (e.g., 100Hz) to form a multi-dimensional timing data matrix. ,in This refers to the total number of connected sensor channels (including upper and lower limits, load, water level, current, etc.). This represents the sampling window length. By accumulating data from multiple historical emergency shutdown events, a corresponding non-uniform signal feature template library can be constructed for different operating conditions such as electrical faults, hydraulic stalls, and mechanical jamming. .

[0063] The main motor of the high-speed door obtains three-phase power through the 1U / 1V / 1W of the X2 terminal.

[0064] Step 2: Real-time operational flow structured analysis

[0065] Building upon the emergency shutdown condition feature template library established in Step 1, this step aims to transform continuously collected real-time operational data streams into structured event objects that can be rigorously processed by the computer system. The specific implementation process is as follows:

[0066] First, real-time operating data of the pump station units is collected online to form a sliding window matrix. Let the current time be... Take from to The time window in which The window length (compared to the sampling window length in step one) Consistency, that is ). For continuous signals within this window, according to the sampling frequency Resampling is performed to obtain a matrix with the same dimensions as in step one. row index Column index corresponding to each sampling time within the window Corresponding to different sensor channels. To eliminate the influence of dimensions, it is necessary to... Each element is standardized so that it follows a standard normal distribution with a mean of 0 and a variance of 1 when there are no faults (this can be achieved by subtracting the mean of historical normal operating conditions and dividing by the standard deviation, which is assumed to have been preprocessed here).

[0067] Next, the matching score between the real-time window data and each template is calculated. For the template in the template library... Template Define its linear inner product statistic with the current window:

[0068]

[0069] The physical meaning of this statistic is the projection of the window data onto the template direction, reflecting the current operating conditions and the first... The degree of similarity between the fault templates. Based on step one, the template... The energy is Under the null assumption of no failures, Each element obeys independently ,therefore Follows a mean of 0 and a variance of The normal distribution is:

[0070]

[0071] To eliminate the impact of differences in template energy on the detection threshold, Standardization is performed to obtain the standardized matching score:

[0072]

[0073] As can be seen from equation (4), under fault-free conditions Follows a standard normal distribution .

[0074] Then, set the significance level. (For example The information theory detection threshold is then... Determined by the upper quantile of the standard normal distribution:

[0075]

[0076] in This is the inverse function of the standard normal distribution function. This threshold represents the threshold value under fault-free conditions. Exceed The probability is exactly That is, the false alarm rate.

[0077] Standardized score With threshold Comparison: If there exists a certain Make Then it is considered that the current window data is the same as the first... A significant match to the fault template indicates that an emergency shutdown event of that type has occurred. Considering that simultaneous testing of multiple templates may increase the overall false alarm rate, Bonferroni correction can be further employed, adjusting the threshold to... However, for the sake of simplicity, the single-template threshold of equation (6) is still used here.

[0078] Finally, when a match is found to be successful, the current window data is bound to the template information to generate a structured emergency event object. This object must contain at least the following fields:

[0079]

[0080] Where type is the index of the matched fault type, timestamp is the current time, score is the original inner product score, and confidence is the standardized confidence score (i.e., ).

[0081] Step 3: Trigger Confidence Decision Based on Linkage

[0082] In standardized matching score Based on the confidence level measurement, different linkage control paths are triggered according to the comparison result between the confidence level and the preset threshold. The specific implementation process is as follows:

[0083] First, clarify the statistical significance of the confidence level. As shown in step two, under the null hypothesis of no faults... Below, standardized score Follows a standard normal distribution:

[0084]

[0085] In the faulty alternative hypothesis (Assuming the actual occurrence of the first) (Class of fault), derived from step two, Follow the mean Normal distribution:

[0086]

[0087] in For the first The signal energy of the template class (defined by equation (2)). This reflects the strength of the fault type signal relative to the background noise; the larger the value, the stronger the signal. The smaller the overlap between the distribution of the positive hypothesis and the null hypothesis distribution, the easier it is to detect.

[0088] Next, a decision threshold is introduced. This threshold serves as the dividing line for confidence level determination. It needs to be calibrated based on the actual operational needs of the pumping station, typically based on a trade-off between two types of error probabilities: false alarms (i.e., misjudging a fault as present when there is none, triggering an emergency response and causing unnecessary shutdown), and missed alarms (i.e., failing to identify and trigger an emergency response when a fault is present, potentially leading to equipment damage). The false alarm probability is defined as follows: From equation (8), we can obtain:

[0089]

[0090] in Let be the cumulative distribution function of the standard normal distribution. Similarly, define the detection probability. From equation (9), we can obtain:

[0091]

[0092] in Let be the probability of a false negative. For a given... The threshold can be obtained by inverse solving equation (10). For example, take ,but ;Pick ,but In practical applications, appropriate options can be selected based on the pump station's requirements for safety and continuous operation. Value: If more emphasis is placed on avoiding accidental activation, then a smaller value should be selected. (e.g., 0.01) corresponds to a relatively high threshold; if the focus is more on ensuring timely response in case of faults, the threshold can be appropriately relaxed. (e.g., 0.05), which corresponds to a lower threshold.

[0093] Then, taking into account the signal energy of different fault types The differences may be significant. Equation (11) shows that for faults with lower energy, even the threshold... Even with a fixed threshold, the detection probability may still be low. To balance the detection performance of various faults, the threshold can be adjusted differentially. One feasible method is to set the threshold as a function related to the template energy, for example... ,in This is a correction term that increases the false negative probability for all fault types. To maintain consistency, however, for the sake of simplicity, this step uses a uniform threshold. And by default, the template library has already ensured the various templates through step one. All are large enough that, in the selected Detection probability of all faults All are close to 1.

[0094] Furthermore, the standardized score obtained in step two... With threshold Compare and execute branch decisions:

[0095] like If the current operating condition does not significantly match any fault type in the template library, the system is considered to have insufficient confidence. At this point, the system automatically enters a deterministic degradation path: executing a preset conservative safety linkage procedure, such as following a fixed delay sequence (e.g., issuing an alarm first, waiting 0.5 seconds, and then closing the high-speed door), while simultaneously sending a warning message to the central control room stating "Insufficient confidence, execute conservative procedure" to prompt maintenance personnel to intervene and check.

[0096] like Then it is confirmed that the first occurrence has occurred. An emergency shutdown event occurs, and the confidence level reaches or exceeds the threshold. In this case, the system continues execution along the high-confidence path, immediately reporting the identified fault type. and the corresponding event object (Including timestamps, scores, and other information) is passed to subsequent steps to trigger precise, optimized linkage timings for that fault type.

[0097] Finally, to ensure the robustness of the decision-making process, a multi-time consistency verification mechanism can be introduced. For example, continuous consistency verification is required. A sliding window All greater than Only then is the occurrence of the event confirmed, thus avoiding false triggering caused by single-point noise. Let the current time be... Take the past Standardized score of each window If they all satisfy right If the result is true, the event is finally confirmed; otherwise, it is still treated as insufficient confidence. This mechanism is equivalent to setting a threshold. Combined with counting rules, this further reduces the probability of false alarms.

[0098] By statistical confidence With preset threshold By comparing and introducing multi-time consistency checks, a safe switch from probabilistic identification to deterministic control flow is achieved.

[0099] Step 4: Parallel linkage timing generation and coordination

[0100] Based on the fault type confirmed in step three and event object By creating a master intelligent agent and multiple sub-intelligent agents, a parallel linkage control sequence for this fault type is generated and coordinated to ensure that each mechanical unit operates in an orderly manner according to preset logic. The specific implementation process is as follows:

[0101] First, the main control agent is initialized and timing parameters are queried.

[0102] The controlling agent receives the event object transmitted in step three. (Includes fault types) and trigger time After that, immediately load the data for the fault type from persistent storage. Timing parameter table This parameter table is pre-defined structured data that describes the timing requirements of all mechanical units that need to be controlled. The timing parameter table can be represented in matrix form:

[0103]

[0104] row index For different mechanical units, such as For high-speed doors, For hydraulic stabilizers, For backup power switch, etc.; column index The timing attributes corresponding to each unit typically include:

[0105] Action start delay time (relative to the event trigger time) (Offset, in seconds);

[0106] : Duration or holding time of the action (in seconds);

[0107] The target state after the action is completed (e.g., "fully open", "fully closed", "started").

[0108] Other attributes can be expanded according to actual control needs, such as execution speed, output percentage, etc.

[0109] Next, sub-agents are created and instructions are distributed.

[0110] The main control agent, according to the parameter table Number of rows in Created via the spawn primitive Each sub-agent is assigned a unique identifier. This corresponds to one mechanical unit. The master intelligent agent sends the `send` primitive to each sub-intelligent agent. Send a message whose content includes the event object. and the corresponding timing parameter row vector of this unit. This process can be expressed in parallel as follows: for all , and execute

[0111]

[0112] Ensure that each sub-agent obtains complete execution guidelines.

[0113] Then, the sub-agents generate local time sequences and maintain their states.

[0114] After receiving the message, each sub-agent first uses the remember primitive to... The parameters are written to its own persistent memory so that they can be retrieved again during subsequent recovery. Then, the sub-agent uses the start delay time from the parameters. Set a timer locally, requiring it to run for a certain period of time. The specific action will begin execution after a few seconds. The execution of the action will be completed by calling the hardware interface of subsequent steps. During the waiting and execution process, the sub-agent updates its own state variables in real time using the recall primitive; these variables constitute a state vector. Its components may include: whether it has been started, remaining waiting time, action completion progress, current output value, etc. For example, it can be defined as follows: .

[0115] Furthermore, parallel startup and synchronous coordination are achieved.

[0116] To ensure that all sub-agents act on the same time reference (the time of event triggering) For reference, after completing message distribution, the master agent waits for all sub-agents to confirm that the timers have been set through a synchronization barrier, and then sends a unified start signal. After start, each sub-agent runs independently, and its actual action begins at [time missing]. Because there may be physical dependencies between different mechanical units (e.g., the hydraulic pressure can only be cut off if the fast-acting door must be closed first), the timing parameter table... It has been approved during the design phase. The value of guarantees this order constraint. Specifically, if the element The action must be within the unit The action must be completed before it can begin, and the following conditions must be met:

[0117]

[0118] The inequality is satisfied in the predefined parameter table and does not require dynamic calculation at runtime, thus simplifying the coordination logic.

[0119] At the same time, establish a fault propagation link and anomaly handling mechanism.

[0120] When creating each sub-agent, the master agent establishes a two-way fault propagation link with it through the spawn_link primitive. This means that when any sub-agent terminates during execution due to an irrecoverable error (such as hardware non-response, parameter verification failure), the sub-agent will generate a ProcessExit signal that contains the termination reason. This signal is automatically sent to the mailbox of the master agent through the link. The master agent continuously monitors the mailbox and immediately triggers a preset security rollback procedure once it detects any ProcessExit signal.

[0121] The rollback procedure includes: broadcasting an emergency termination instruction to all unfinished sub-agents and forcing them to enter a conservative linkage process (such as closing all devices in a fixed delay sequence). The reliability of this mechanism can be described by the fault coverage rate: Assume the failure rate of each sub-agent is then the probability that the system as a whole has at least one failure is:

[0122]

[0123] Through the fault propagation link, the master agent can perceive the failure of any sub-agent with a probability of 1, so as to intervene in a timely manner.

[0124] Finally, insert persistent checkpoints before and after critical actions.

[0125] To support the full-process backtracking of the linkage in step six later, each sub-agent executes the suspend primitive once before about to call the hardware interface and after receiving the hardware confirmation. The suspend operation will trigger the virtual machine to serialize the complete running state of the current sub-agent (including program counter, variable bindings, memory data, unprocessed messages, etc.) into structured data and atomically write it to the persistent storage medium. These checkpoints record the exact state before and after the action execution, providing an atomic snapshot for subsequent state recovery.

[0126] Step Five: Secure Hardware Instruction Issuance

[0127] Based on the parallel linkage timing, by introducing an access control mechanism based on capability tokens, ensure that when each agent drives a physical device, its operation instructions are executed safely and reliably, while eliminating the risk of leakage of sensitive credentials. The specific implementation process is as follows:

[0128] First, register the isolated storage of hardware resources and credentials.

[0129] In the system initialization stage, register a unique resource identifier in the virtual machine kernel for each hardware interface that needs to be controlled (such as the programmable logic controller register of the rapid door, the relay of the oil pressure stabilizer, the communication port of the backup power supply, etc.) where Corresponding to the Each mechanical unit. Simultaneously, sensitive credentials required to access this hardware (such as the PLC's IP address, port number, communication protocol type, and authentication key) are stored in an isolated storage area of ​​the virtual machine host environment, existing as environment variables, denoted as... These credentials will never be passed to the memory space of any intelligent agent, thus eliminating the possibility of leakage at the source.

[0130] Next, the agent requests a temporary capability token.

[0131] When a certain sub-agent in step four (Corresponding mechanical unit) ) Reaching its preset start time At this time, it first needs to acquire operating hardware resources. The agent requests a temporary token by invoking the kernel primitive `grant_identity`.

[0132]

[0133] This primitive is implemented by the virtual machine kernel and returns a token object of type Identity. Internally, this token is represented in memory as a tuple:

[0134]

[0135] in It is a high-entropy random number generated by the kernel's secure random number generator, ensuring the token's unpredictability and uniqueness. The token object has the following key properties: it cannot be coerced into a string type, cannot be serialized (such as to JSON), and cannot be copied or passed to other processes. Therefore, even if an attacker gains control of the agent's program logic, the token's content cannot be leaked.

[0136] Then, the kernel verifies the validity of the token.

[0137] After obtaining the token, the agent calls a hardware operation function in the standard library, such as std / plc.write(register, value, token). This function eventually triggers a kernel trap __sys_plc_write(token, register, value). The kernel trap first executes the token verification process.

[0138] The necessary conditions for successful verification are: the resource identifier in the token matches the target hardware of the current call, and the token is indeed issued by the current calling process. The request was made via `grant_identity` and has not yet exceeded its preset validity period (for example, the validity period can be set to the length of the current event processing cycle, automatically expiring after the operation is completed). Only if all conditions are met... If the kernel fails to execute, it will continue; otherwise, it will return a permission denial error. Upon receiving the error, the agent will trigger an exception handling process (such as retrying or reporting a fault).

[0139] Then, the kernel constructs and issues hardware instructions.

[0140] After successful verification, the kernel reads resources from the host environment's secure storage. Associated credentials These credentials contain all the parameters required for hardware communication. The kernel, based on the protocol type in the credentials (such as ModbusTCP, OPCUA, or simple relay on / off levels), encapsulates the agent's requested operation (such as writing register values) into a communication message conforming to the hardware specification. This process can be abstracted as follows:

[0141]

[0142] in Protocol type, This is the target address (e.g., IP:port) parsed from the credentials. After construction, the kernel sends the packet to the physical device via the network protocol stack or direct I / O and waits for the device's response. If a successful response is received within the specified timeout period, the kernel will return a success status to the agent; if a timeout occurs or an error occurs, the corresponding error code will be returned.

[0143] Finally, the agent updates the state and releases the token.

[0144] Based on the results returned by the kernel, the agent updates its own state vector using the remember primitive. The system records whether the operation was successfully completed. For example, if the write is successful, the status flag `progress_i` is updated to "completed"; if it fails, the number of errors is recorded, and a decision is made based on a pre-defined retry policy to re-apply for a token. Regardless of success or failure, the agent should notify the kernel to release the token after the operation is completed (or after its expiration date), thus invalidating the token and preventing accidental reuse. This release operation is performed automatically by the kernel (e.g., by terminating the process associated with the token or by explicitly calling `revoke_identity`), ensuring that each token is valid only for the shortest necessary time.

[0145] Step Six: Persistent Backtracking of the Linkage Process

[0146] After the hardware commands are securely issued and execution feedback is received, this step aims to store and restore the operational status of all intelligent agents throughout the entire emergency shutdown process, thereby providing a complete digital twin record for subsequent fault analysis, timing optimization, and accountability. The specific implementation process is as follows:

[0147] First, define the complete state space of the agent.

[0148] During the execution of steps four and five, the internal state of each agent (including the master agent and all sub-agents) consists of multiple dimensions. To fully reconstruct the system state at any given moment, all these dimensions must be captured. Define the... An intelligent agent at time Complete state vector for:

[0149]

[0150] The meanings of each component are as follows:

[0151] Represents the program counter, which records the current position of the instruction being executed by the agent;

[0152] The lexical environment represents the binding of variable names and values ​​within the current scope.

[0153] Represents persistent memory storage, i.e., a collection of key-value pairs written using the remember primitive;

[0154] The context window represents the historical messages received by the agent (such as event objects sent by the master). );

[0155] Represents the mailbox queue, a list of messages that have not yet been received and processed.

[0156] The vector representing the time-series parameter table associated with the current agent (a complete matrix for the controlling agent). For sub-agents as );

[0157] This represents a custom state vector of the agent, such as execution progress, remaining time of the waiting timer, etc.

[0158] The above state vector It is the core object for all subsequent persistent operations, and its completeness ensures that the agent can seamlessly resume its previous work after recovery from the checkpoint.

[0159] Next, determine the insertion position of the persistent checkpoint.

[0160] To achieve accurate backtracking, several persistent checkpoints need to be inserted into the agent's execution flow. When the execution flow passes through these points, state capture is automatically triggered. According to the design in step four, each sub-agent executes the suspend primitive once before calling the hardware interface and once after receiving hardware confirmation; these two locations constitute two natural checkpoints. Furthermore, to capture critical decision moments, the master agent should also insert a checkpoint before completing the creation of all sub-agents and before sending the start signal. The moments corresponding to these checkpoints are denoted as... ,in This represents the total number of checkpoints. At each checkpoint, the system needs to save the state vectors of all active agents. .

[0161] Furthermore, a state serialization and atomic writing mechanism was designed.

[0162] When the execution flow reaches the checkpoint At this time, the virtual machine kernel automatically pauses the execution of all relevant agents and calls the serialization function to convert the state vector of each agent. Convert to a platform-independent intermediate representation, such as JSON format. Let the length of the serialized byte stream be... The total serialized data volume (including a main controller and) (Individual intelligent agents). To ensure data consistency, write operations must satisfy "atomicity," meaning either all writes succeed or all writes fail; partial writes leading to state corruption are not allowed. This is achieved through the following two steps:

[0163] 1. Write the serialized data to a temporary file first. ;

[0164] 2. Invoke a file system-level atomic rename operation (such as POSIX's rename) to atomically move the temporary file to its final path. .

[0165] If any error occurs during the write process (such as a full disk or power failure), the temporary file is discarded, and the system retains the previous full checkpoint.

[0166] Then, establish a checkpoint index associated with the timestamp.

[0167] To enable the restoration of any historical point in time as needed, a mapping relationship between checkpoints and time needs to be established. Let checkpoints be defined... The corresponding time is Then create an index entry:

[0168]

[0169] in This is the file path where the checkpoint data is stored. It is a hash checksum (such as SHA256) of the file content, used to verify data integrity during recovery. The index entries themselves also need to be persistently stored in reliable storage media (such as databases or structured files).

[0170] Next, the state recovery process is defined.

[0171] When post-event analysis or auditing is required, the operations and maintenance personnel specify a target recovery time. The system first searches the index for a match. The largest This means finding the checkpoint that is closest to and no later than the target time. Let the found checkpoint be... The system will perform the following recovery steps:

[0172] 1. From Read the serialized data and verify it. Check if it matches; if not, report data corruption.

[0173] 2. Deserialize the data and reconstruct the state vectors of all agents. ;

[0174] 3. Restore each agent's program counter, lexical environment, memory, context, mailbox, etc., to the exact state at the checkpoint;

[0175] 4. From Starting at time 1, the agent's code continues to execute in "replay" mode until the target time is reached. During playback, all effects on external hardware are simulated (i.e., the device is not actually driven), and only internal state changes are recorded.

[0176] Furthermore, the completeness of traceability information is quantified.

[0177] To evaluate the quality of the persistence mechanism, we define "state information integrity". Let the similarity between the restored state and the original state be denoted as . Let the original state vector be . The recovered state vector is For numerical components, the normalized root mean square error (RMSE) metric can be used; for signed components (such as a program counter), a direct comparison of equality is performed. Completeness Defined as the proportion in which all components are perfectly matched:

[0178]

[0179] in The total number of agents. This is an indicator function. Since serialization is a deterministic lossless conversion, and atomic writes guarantee memory integrity, theoretically, in the absence of hardware failures, it should have... That is, complete recovery.

[0180] Finally, archiving and auditing applications.

[0181] All checkpoint files and indexes constitute the complete "black box" data of an emergency shutdown event. When unexpected equipment responses or abnormal linkage timing occur, the above recovery process can be used to recreate the scene, tracing back each message received by the agent, the decisions made, the hardware instructions invoked, and their return results. For example, if it is found that the actual closing time of the high-speed door is later than the design requirement, the state vector of the sub-agent "high-speed door controller" can be checked after recovery. By checking the remaining time of the wait timer or examining the mailbox for delayed response messages, the root cause of the problem can be located. This archived data also provides information for subsequent optimization of the timing parameter table. It provides a simulation foundation based on real-world operating data—by injecting parameter changes between different checkpoints, the optimization effect can be simulated offline.

[0182] The complete execution trajectory of each emergency shutdown event is securely stored, allowing for in-depth analysis without interference at any subsequent time, thus providing a data loop for continuous optimization of the pump station linkage sequence.

[0183] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for optimizing the timing of instantaneous fast-acting door linkage during emergency shutdown of the unit in the operating conditions of the Shaji Pumping Station, characterized in that, This method combines physical and mathematical approaches, and its specific steps include: Step 1: Construct an emergency shutdown condition feature template library; Step 2: Based on the emergency shutdown condition feature template library built in Step 1, perform real-time condition flow structured parsing; Step 3: Based on the structured emergency event objects obtained in Step 2, make a decision on the confidence level for linkage triggering; Step 4: Based on the emergency events confirmed in Step 3, execute parallel linkage timing generation and coordination; Step 5: Issue security hardware commands according to the linkage sequence generated in Step 4; Step Six: During the execution of Steps Four and Five, persistent backtracking of the linkage process is performed; thereby realizing optimized linkage control of the fast door when the Shaji Pumping Station unit is shut down in an emergency.

2. The method according to claim 1, characterized in that, The specific method for constructing the emergency shutdown condition feature template library in step one is as follows: Historical operating data of the pump station unit under various emergency shutdown conditions are collected. This historical operating data includes physical time-series data of unit speed, stator current, bearing vibration, volute water pressure, and rapid door opening. For each emergency shutdown event, a time window from before the fault occurs to after the rapid door is fully closed is extracted and discretized at a fixed sampling frequency. A logical processing method is used to organize the physical data within each time window into matrix blocks, with rows corresponding to sampling times and columns corresponding to sensor channels. Corresponding signal templates are constructed for different types of emergency shutdown causes, with each signal template containing a non-uniform offset of the physical signal relative to normal operating conditions.

3. The method according to claim 1, characterized in that, The specific method for real-time operational flow structured analysis in step two is as follows: real-time operating data of the pump station units are collected online to form a sliding window data with a sampling window length; the sliding window data is matched with the template library constructed in step one using a logical processing method, and the matching statistics between the sliding window data and each signal template are calculated; when the matching statistics exceed the preset information theory detection threshold, the sliding window data is bound as a structured emergency event object, which includes the fault type, trigger time, and original matching score fields.

4. The method according to claim 1, characterized in that, The specific method for triggering the confidence decision in step three is as follows: extract a confidence scalar from the emergency event object obtained in step two. The confidence scalar is obtained by logical normalization of the matching statistics. Logically compare the confidence scalar with a preset confidence threshold. If the confidence scalar is lower than the confidence threshold, execute the preset conservative safety linkage procedure and issue an early warning. If the confidence scalar is not lower than the confidence threshold, confirm the emergency event and trigger the subsequent linkage sequence.

5. The method according to claim 1, characterized in that, The specific method for generating and coordinating parallel linkage timing in step four is as follows: A master control agent and multiple sub-agents are created, each agent corresponding to a mechanical unit that needs independent control; the master control agent receives the emergency event object confirmed in step three and sends the event information to each sub-agent; each sub-agent generates its own linkage control timing using logical processing methods based on the event information and a preset timing parameter table, and records the execution status through internal state maintenance primitives; the master control agent simultaneously activates all sub-agents through parallel start primitives to achieve collaborative control of multiple devices; simultaneously, an anomaly notification mechanism is established between the sub-agents and the master control agent through a fault propagation link.

6. The method according to claim 1, characterized in that, The specific method for issuing security hardware instructions in step five is as follows: configure a corresponding kernel service for each hardware interface, including programmable logic controller register writing and relay switching; before performing hardware operations, the intelligent agent requests a temporary and unforgeable identity token from the virtual machine host environment, and the identity token contains only the device identifier; After verifying the validity of the identity token, the virtual machine host environment loads the actual hardware access credentials from the environment variables and constructs a communication message; then it sends precise timing control instructions to the hardware.

7. The method according to claim 1, characterized in that, The specific method for persistent backtracking of the linkage process described in step six is ​​as follows: During the execution of steps four and five, persistent checkpoints are inserted before and after key actions; when a persistent checkpoint is reached, the virtual machine automatically serializes the complete running state of all relevant agents into structured data objects and atomically writes them to the persistent storage medium; when post-analysis is required, the running state of all agents is restored from the specified persistent checkpoint, and the entire process from event triggering to instruction execution is reproduced.

Images