Fault root cause positioning method and system based on deep mining of PLC log

Abstract

The application discloses a fault root cause positioning method and system based on PLC log deep mining, which decomposes original PLC logs into continuous data streams and discrete event streams through a heterogeneous data shunting mechanism. A time series convolution network is used to capture the time series dynamic changes of high-frequency analog data, and a Transformer encoder is used to extract the semantic logical association of asynchronous discrete events, thereby avoiding the loss of time series accuracy and semantic confusion caused by forced time alignment. On this basis, a multi-level attention fusion mechanism is introduced to preserve the characteristics of each mode while realizing deep interaction and alignment of cross-modal features, and a unified feature representation containing rich space-time dependencies is constructed. The method effectively solves the technical problem of deep fusion of heterogeneous asynchronous data in industrial scenes, and realizes accurate positioning of fault root causes and visualization of fault propagation path.

Description

Technical Field

[0001] This application relates to the fields of industrial automation and intelligent operation and maintenance technology, specifically to a fault root cause localization method and system based on deep mining of PLC logs. Background Technology

[0002] With the rapid development of industrial automation technology, programmable logic controllers (PLCs), as core components of industrial control systems, are widely used in various production and manufacturing processes. During operation, PLCs generate massive amounts of log data. This data includes not only high-frequency sampled continuous analog signals such as temperature, pressure, and current, but also asynchronous discrete event information such as alarm triggers, switch status transitions, and operator commands. When industrial systems malfunction, quickly and accurately locating the root cause of the fault from this vast and heterogeneous log data is crucial for minimizing downtime, ensuring production safety, and reducing economic losses.

[0003] However, existing fault diagnosis technologies still face significant challenges in processing PLC logs, primarily due to insufficient ability to integrate heterogeneous data and asynchronous events. Current mainstream methods typically employ a single model architecture to process data. To adapt to the model's uniform requirements for input data formats, the raw data often requires forced alignment and normalization. For example, a common practice is to force asynchronously triggered discrete events to be mapped to a fixed time window through statistical or aggregation methods, ensuring consistency with the sampling frequency of continuous sensor data. This data processing approach presents technical problems. First, the fixed-time-window aggregation operation leads to the loss of high-precision timing information, blurring the sequence of events within milliseconds. The model struggles to distinguish whether abnormal fluctuations in sensor parameters caused the alarm first, or whether equipment actions caused parameter changes first, severely impacting the determination of causal relationships. Second, continuous analog data contains numerical trend information, while discrete events contain logical state information. Existing technologies simply concatenate or mix the two and input them into the same network, ignoring their significant semantic differences. This makes it difficult for the model to simultaneously capture the long-term dependencies of continuous signals and the instantaneous context of discrete events. The shortcomings of this heterogeneous data fusion mean that existing solutions often struggle to provide accurate root cause localization and credible attribution explanations when faced with faults caused by the complex coupling of physical parameter deviations and logical control behavior.

[0004] Therefore, an optimized log-deep mining-based root cause localization scheme is desired. Summary of the Invention

[0005] To address the aforementioned technical problems, this application is proposed. Embodiments of this application provide a method and system for fault root cause localization based on deep PLC log mining.

[0006] According to one aspect of this application, a fault root cause localization method based on deep mining of PLC logs is provided, which includes: Obtain the raw PLC log; Heterogeneous data preprocessing and stream segmentation are performed on the raw PLC logs to obtain continuous data streams and discrete event streams; Continuous data feature encoding is performed on a continuous data stream to obtain continuous feature embeddings; Discrete event feature encoding is performed on discrete event streams to obtain event feature embeddings; Multi-level attention fusion is performed on continuous feature embeddings and event feature embeddings to obtain cross-modal fused feature representations of PLC logs; Root cause classification and interpretable attribution are performed based on cross-modal fusion feature representation of PLC logs to obtain predicted fault types, root cause attribution scores, and visualized fault propagation paths.

[0007] According to another aspect of this application, a fault root cause localization system based on deep mining of PLC logs is provided, comprising: The log acquisition module is used to acquire raw PLC logs; The data preprocessing and stream segmentation module is used to perform heterogeneous data preprocessing and stream segmentation on the raw PLC logs to obtain continuous data streams and discrete event streams. The continuous data feature encoding module is used to encode continuous data features into a continuous data stream to obtain continuous feature embeddings. The discrete event feature encoding module is used to encode discrete event features into a discrete event stream to obtain event feature embeddings. A multi-level attention fusion module is used to perform multi-level attention fusion on continuous feature embeddings and event feature embeddings to obtain cross-modal fusion feature representations of PLC logs; The root cause classification and interpretable attribution module is used to perform root cause classification and interpretable attribution based on cross-modal fusion feature representation of PLC logs to obtain predicted fault types, root cause attribution scores, and visualized fault propagation paths.

[0008] Compared with existing technologies, this invention decomposes the original PLC log into a continuous data stream and a discrete event stream through a heterogeneous data splitting mechanism. It employs a temporal convolutional network to capture the temporal dynamic changes of high-frequency analog data and a Transformer encoder to extract the semantic logical relationships of asynchronous discrete events, thereby avoiding the loss of temporal accuracy and semantic confusion caused by forced time alignment. Building upon this, a multi-level attention fusion mechanism is introduced to achieve deep interaction and alignment of cross-modal features while preserving the characteristics of each modality, constructing a unified feature representation rich in spatiotemporal dependencies. This method effectively solves the technical problem of deep fusion of heterogeneous asynchronous data in industrial scenarios, enabling accurate location of fault root causes and visualized tracing of fault propagation paths. Attached Figure Description

[0009] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0010] Figure 1 This is a flowchart of a fault root cause localization method based on deep mining of PLC logs according to an embodiment of this application; Figure 2 This is a data flow diagram of the fault root cause localization method based on deep mining of PLC logs according to an embodiment of this application; Figure 3 This is a flowchart illustrating the process of performing heterogeneous data preprocessing and stream segmentation on the original PLC log to obtain a continuous data stream and a discrete event stream, according to the fault root cause localization method based on deep mining of PLC logs in this application embodiment. Figure 4 This is a flowchart illustrating the multi-level attention fusion of continuous feature embedding and event feature embedding to obtain cross-modal fused feature representation of PLC logs, according to the fault root cause localization method based on deep mining of PLC logs in the embodiments of this application. Figure 5 This is a flowchart illustrating the process of performing topology-adaptive gating attention calculation on local fusion feature sequences to obtain an attention matrix based on the system topology diagram of the fault root cause localization method based on deep mining of PLC logs according to the embodiments of this application. Figure 6 This is a block diagram of a fault root cause localization system based on deep mining of PLC logs according to an embodiment of this application. Detailed Implementation

[0011] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0012] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0013] While this application makes various references to certain modules of the systems according to embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The modules described are merely illustrative, and different aspects of the systems and methods may use different modules.

[0014] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0015] Existing PLC fault diagnosis technologies often employ a single-model architecture with forced alignment when processing heterogeneous logs. This leads to the loss of timing accuracy of high-frequency continuous signals and semantic confusion of discrete events, making it difficult to accurately pinpoint the root cause in complex physical-logical coupled faults. This data processing approach ignores the essential differences between different modal data, severely limiting the accuracy and interpretability of the diagnosis. Therefore, this application proposes a fault root cause localization method based on deep mining of PLC logs. This method aims to build an end-to-end diagnostic framework that can natively adapt to heterogeneous asynchronous data. Specifically, the system first decouples the original log into a continuous data stream and a discrete event stream. It then uses a temporal convolutional network to capture the fine temporal fluctuations of analog data and a Transformer that combines temporal-event joint positional encoding to capture the deep semantic logic of asynchronous discrete events. Subsequently, through a multi-level attention fusion mechanism, cross-attention is first used to achieve spatiotemporal alignment and interaction of heterogeneous features within a local window. Long-range dependencies are integrated through multi-level attention (including cross-attention and topology gating), thereby generating a cross-modal unified representation containing rich spatiotemporal information. Ultimately, based on this representation, fault classification and interpretability attribution were performed, outputting accurate root cause scores and propagation paths. This effectively solved the technical problem of heterogeneous data fusion and improved the robustness and transparency of fault diagnosis.

[0016] Figure 1 This is a flowchart of a fault root cause localization method based on deep mining of PLC logs according to an embodiment of this application. Figure 2 This is a data flow diagram illustrating the fault root cause localization method based on deep mining of PLC logs according to an embodiment of this application. Figure 1 and Figure 2 As shown, the fault root cause localization method based on deep mining of PLC logs according to an embodiment of this application includes the following steps: S100, obtaining the original PLC logs; S200, performing heterogeneous data preprocessing and stream segmentation on the original PLC logs to obtain continuous data streams and discrete event streams; S300, performing continuous data feature encoding on the continuous data streams to obtain continuous feature embeddings; S400, performing discrete event feature encoding on the discrete event streams to obtain event feature embeddings; S500, performing multi-level attention fusion on the continuous feature embeddings and event feature embeddings to obtain cross-modal fusion feature representations of PLC logs; S600, performing root cause classification and interpretable attribution based on the cross-modal fusion feature representations of PLC logs to obtain predicted fault types, root cause attribution scores, and visualized fault propagation paths.

[0017] Specifically, in step S100, the original PLC logs are acquired. It is understood that equipment failures in industrial settings are often not sudden occurrences at a single moment, but rather the result of a long-term accumulation and evolution of a series of equipment condition deteriorations, abnormal parameter fluctuations, and logical control conflicts. A transient snapshot at the moment of failure is insufficient to reconstruct the complete physical and logical causal chain. Therefore, in the technical solution of this application, the original PLC logs covering a preset time window before and after the failure are acquired to capture full historical data containing the trends of continuous process variables and the trigger sequences of discrete control events. This provides a detailed and unedited data foundation for subsequent reconstruction of the complex failure evolution process, ensuring that no crucial early warning information is missed at the source.

[0018] More specifically, in a concrete example of this application, implementing this step involves three progressive processes: establishing a data communication connection, defining the acquisition scope, and performing data extraction. First, a stable one-way reading channel is established with the on-site historical database server or data acquisition and monitoring system via an industry-standard communication protocol. Next, based on the fault alarm trigger time point reported from the field, the system traces back to a set duration of normal operation and extends forward to the shutdown and maintenance phase, thereby accurately determining the time span of the logs to be extracted. Simultaneously, it identifies a complete list of variable reference numbers related to the fault-related subsystems. This list covers analog sensor readings reflecting the physical process and digital switch states reflecting control logic. Finally, strictly following the determined time span and reference number list, raw records containing high-precision timestamps, variable names, and corresponding variable values ​​are exported in batches. For example, in a shutdown scenario caused by overload of the agitator motor in a chemical reactor, the system connects to the factory's real-time database via the OPC unified architecture protocol. It then locks onto the time interval from one hour before the fault to half an hour after the shutdown and extracts all raw log records, including the three-phase current of the agitator motor, real-time temperature and pressure sensor values ​​inside the reactor, motor start / stop control commands, and inverter fault alarm codes. This forms an initial dataset without any cleaning or aggregation operations, providing raw material for subsequent analysis of the temporal coupling relationship between current fluctuations and temperature anomalies.

[0019] Specifically, in step S200, the original PLC log undergoes heterogeneous data preprocessing and stream segmentation to obtain a continuous data stream and a discrete event stream. It is understandable that, since the original PLC log is essentially an unstructured data set composed of a mixture of high-frequency sampled continuous analog signals and asynchronously triggered discrete digital states, the two exhibit significant heterogeneity in data sampling frequency, physical meaning representation, and underlying storage format. Directly mixing and processing them or forcibly performing coarse-grained aggregation within a unified time window would not only lead to the smooth loss of subtle trend information in the analog signals but also obliterate the precise triggering sequence of discrete events on a millisecond-level time scale. This would make it difficult for the model to distinguish the causal sequence between changes in physical parameters and logical control actions during the fault evolution process.

[0020] Therefore, in the technical solution of this application, the original PLC log is further subjected to heterogeneous data preprocessing and stream segmentation to obtain continuous data streams and discrete event streams. Specifically, the original log is parsed and cleaned to generate standardized interpolation entries. Then, based on the physical properties of the variables, it is accurately divided into continuous analog quantities and discrete digital quantities, and reconstructed into timestamp-aligned continuous data sequences and discrete event tuples retaining the original trigger times, respectively. This removes the coupling interference between different modal data, transforming the mixed original records into two sets of dedicated data streams with clear structures, explicit semantics, and no interference between them. This provides a high-quality input foundation for subsequent independent coding models that adapt to the timing fluctuation characteristics and logical semantic characteristics. In this way, the waveform integrity of continuous sensor data in the time domain and the instantaneous accuracy of discrete control events in the time axis can be preserved to the greatest extent. This ensures that subsequent analysis can effectively capture the real physical-logical coupling relationship between, for example, the continuous overload of the stirring motor current and the alarm triggering of the frequency converter without losing key timing details, thereby significantly improving the data fidelity and diagnostic reliability of fault root cause location.

[0021] Figure 3 This is a flowchart illustrating the process of heterogeneous data preprocessing and stream segmentation of the original PLC logs to obtain continuous data streams and discrete event streams, according to the fault root cause localization method based on deep mining of PLC logs in embodiments of this application. Figure 3 As shown, step S200 includes: S210, parsing and cleaning the original PLC log to obtain imputed log entries; S220, identifying and preliminarily classifying the variable types of the imputed log entries to obtain a temporary continuous data list and a temporary discrete event list; S230, reconstructing the data flow of the temporary continuous data list and the temporary discrete event list to obtain a continuous data flow and a discrete event flow.

[0022] In step S210, the original PLC log is parsed and cleaned to obtain interpolated log entries. It is understandable that due to the complex electromagnetic environment and unstable network transmission in industrial settings, directly acquired original PLC logs often suffer from data quality issues such as non-standardized format, redundant and repetitive records, discrete outliers caused by sensor malfunctions, and time-series breakpoints due to communication packet loss. Directly inputting this noisy and missing data into subsequent models would severely distort the physical characteristics of the data and disrupt the continuity of the time series, leading to failure in fault feature extraction. Therefore, in the technical solution of this application, the original PLC log is further parsed and cleaned to obtain interpolated log entries. This transforms the messy original records into a high-quality data foundation with a unified structure, accurate values, and continuous time series, and repairs information gaps caused by acquisition anomalies. This effectively eliminates the interference of environmental noise and transmission errors on data authenticity, ensuring that subsequent analyses of the stirring motor current fluctuations and reactor temperature changes are based on objective and complete physical facts.

[0023] More specifically, in a concrete example of this application, this step strictly follows a progressive processing flow of parsing and structuring, cleaning and denoising, and imputation of missing values. First, using a pre-built log parsing engine or regular expression rules, the unstructured raw text or binary log stream is decoded into a structured list of entries containing standard timestamps, variable reference numbers, and physical values. Next, based on the unique combination of timestamps and variable reference numbers, duplicate records caused by retransmission mechanisms are eliminated, and all entries are strictly rearranged in chronological order. Subsequently, the statistical three-standard-deviation criterion is applied to scan the values, automatically identifying and eliminating abnormal noise points obviously caused by sensor interference, such as the instantaneous jump of the current reading of the stirring motor to a physically impossible extreme value. Finally, for the data gaps caused by communication interruptions that still exist after cleaning, a linear interpolation algorithm is used to calculate and fill the missing points of continuous variables such as reactor temperature or pressure based on the effective observations before and after, or the last observation carry-over method is used to fill the gaps of discrete variables such as control switch states, thereby generating a set of imputed log entries that is continuous and uninterrupted in the time dimension and smooth and reliable in the numerical dimension.

[0024] In step S220, the imputed log entries are subjected to variable type identification and preliminary classification to obtain a temporary continuous data list and a temporary discrete event list. It is understandable that, since the imputed log entries contain a mixture of analog data representing continuous changes in physical processes and digital data representing instantaneous states of control logic, their numerical meanings and analytical paradigms differ fundamentally. Direct mixing can easily lead to the model misinterpreting discrete state codes as continuous values ​​with physical gradients, or misjudging minute oscillations in continuous waveforms as logical state transitions. Therefore, in the technical solution of this application, the imputed log entries are further subjected to variable type identification and preliminary classification to obtain a temporary continuous data list and a temporary discrete event list. This allows for the precise decomposition of the mixed dataset into two temporary storage queues with single attributes based on the underlying physical properties and data characteristics of the variables. This eliminates semantic ambiguity in the subsequent reconstruction process from the source, ensuring that continuous waveforms such as the current of a stirring motor and discrete trigger signals of overload alarms are correctly diverted to their respective appropriate preprocessing channels, laying a classification foundation for the subsequent construction of high-fidelity dedicated data streams.

[0025] More specifically, in a concrete example of this application, this step is implemented through a process of constructing a variable mapping knowledge base, scanning and identifying each variable one by one, and targeted distribution and classification. First, a configuration table or mapping dictionary containing the tag numbers of all monitored variables in the industrial site and their corresponding data attributes is pre-loaded. This mapping table explicitly defines variables such as reactor temperature and three-phase current of the stirring motor as continuous analog quantities, while variables such as motor start button status, inverter fault codes, and emergency stop commands are discrete digital quantities or event types. Next, each interpolated log entry is traversed, its variable name field is extracted, and the corresponding variable type tag is retrieved from the mapping table using this field as an index. Finally, a distribution operation is performed based on the retrieved type tags. Entries marked as analog quantities are appended to a temporary continuous data list, while entries marked as digital quantities or events are strategically stored in a temporary discrete event list. This achieves preliminary decoupling of physical process data and control logic data at the logical level. For example, entries recording a continuous rise in reactor temperature are categorized into the continuous list, while "overheating" alarm entries triggered within the same time period are categorized into the discrete list.

[0026] In step S230, the temporary continuous data list and the temporary discrete event list are reconstructed into a continuous data stream and a discrete event stream. It is understood that since the temporary continuous data list and the temporary discrete event list are merely loosely categorized records, lacking the structured features and unified format necessary for deep learning models, and the temporal correspondence between different variables is not yet clearly established, directly inputting them into a neural network will lead to dimensionality misalignment and feature extraction failure. Therefore, in the technical solution of this application, the temporary continuous data list and the temporary discrete event list are further reconstructed into a continuous data stream and a discrete event stream. This converts the unstructured temporary list into a normalized time series set that meets the input requirements of a temporal convolutional network, and a normalized event tuple sequence that meets the input requirements of a Transformer. This endows the original data with a clear tensor structure and semantic specification, ensuring that the continuous fluctuation trend of a stirring motor current is reconstructed into a clear multi-dimensional time series signal, while discrete behaviors such as overload alarms are reconstructed into semantic entities with rich attributes, thus seamlessly connecting to the subsequent dual-stream feature encoding process.

[0027] More specifically, in a concrete example of this application, this step involves a parallel reconstruction and standardized encapsulation process for two different modalities of data. On one hand, for a temporary continuous data list, a multivariate time series construction operation is performed. The system traverses each numerical entry in the list, aggregating the scattered records into independent time series tracks based on the variable reference number. For example, entries belonging to the three-phase current of the reactor agitator motor and the internal temperature of the reactor are respectively grouped, arranged in ascending order by timestamp, and finally encapsulated into a standardized triplet set containing timestamp, variable reference number, and physical value, forming a continuous data stream. On the other hand, for the temporary discrete event list, semantic parsing and tuple reconstruction operations of event attributes are performed. The system deeply analyzes the original payload of each discrete record, extracts key semantic elements, converts low-level signals such as setting specific memory bit addresses into standardized quadruplets with business meaning, clearly defines its event type as alarm trigger or operation command, identifies the event source as frequency converter or temperature control valve, and parses specific effective payloads such as overload error codes or opening set values. Finally, a discrete event stream consisting of timestamp, event type, event source and effective payload is generated, thus completing the structured transformation from raw log fragments to high-level semantic data stream.

[0028] Specifically, in step S300, continuous data feature encoding is performed on the continuous data stream to obtain continuous feature embedding. It is understandable that since the continuous data stream contains various physical quantities such as the current of the reactor agitator motor, internal pressure, and temperature, these variables not only have different sampling frequencies but also exhibit significant differences in physical dimensions. If the original scalar values ​​are directly used for modeling, the model is easily dominated by large numerical variables, neglecting small but crucial fluctuation features, and failing to effectively capture the long-term dependencies and evolutionary trends implicit in the time-series data. Therefore, in the technical solution of this application, continuous data feature encoding is further performed on the continuous data stream to obtain continuous feature embedding. Specifically, data normalization and multivariate time-series construction are performed on the continuous data stream to generate a time-aligned resampling matrix. Then, the matrix undergoes dimensionless feature normalization processing. Finally, the normalized time-series data is input into a pre-trained time-series convolutional network for deep feature extraction. This unifies the original sensor readings with varying physical properties into a high-dimensional, standardized, and richly contextualized hidden feature space. This ensures that the model is not affected by inconsistent sampling step sizes or differences in numerical magnitudes when understanding dynamic behaviors such as slow temperature drift in the reactor or instantaneous current spikes in the motor. This allows for the accurate extraction of deep temporal features that reflect the health status of the equipment, providing a highly representative continuous temporal foundation for subsequent cross-modal correlation analysis with discrete events.

[0029] More specifically, in a specific example of this application, continuous data feature encoding of a continuous data stream to obtain continuous feature embedding includes: performing data warping and multivariate temporal construction on the continuous data stream to obtain a resampled temporal matrix; performing feature standardization on the resampled temporal matrix to obtain a standardized temporal matrix; and performing temporal feature extraction on the standardized temporal matrix to obtain continuous feature embedding.

[0030] Accordingly, data normalization and multivariate time series construction are performed on the continuous data stream to obtain a resampled time series matrix. It is understandable that different types of sensors in industrial settings have vastly different sampling characteristics. For example, the current signal of a reactor agitator motor may be acquired at a high frequency on the order of milliseconds, while the temperature signal inside the reactor may be updated at a low frequency on the order of seconds. Coupled with the uneven sampling time caused by network transmission jitter, the original continuous data stream presents as multiple asynchronous and non-uniform discrete time sequences. This temporal misalignment severely hinders the synchronous correlation analysis between multiple variables. Therefore, in the technical solution of this application, data normalization and multivariate time series construction are further performed on the continuous data stream to obtain a resampled time series matrix. This forces all dispersed univariate sequences to be mapped onto a unified, high-precision global time axis, and mathematical interpolation is used to fill the sampling gaps. This eliminates the temporal deviation caused by inconsistent sampling frequencies, ensuring that each row of data seen by the model represents an accurate snapshot of the system state, such as motor current, temperature, and pressure, at the same physical moment, thus establishing a rigorous spatiotemporal alignment foundation for capturing the instantaneous coupling relationships between variables.

[0031] More specifically, in a concrete example of this application, this step strictly adheres to the standardized process of global time base definition, univariate resampling, and matrix stacking construction. First, the system generates a discrete, equally spaced global time axis covering the entire time period, based on a preset fault analysis window length and a sampling period (e.g., 100 milliseconds) that meets the requirements for capturing the highest frequency signal features. Next, it iterates through each independent variable in the continuous data stream, such as the three-phase current of the stirring motor and the temperature of the reactor, mapping their original non-uniform timestamp sequences onto the global time axis. For time points lacking direct observations on the global time axis, a linear interpolation algorithm is used to calculate the estimated value of that time based on the two nearest real sampling points in the original data, thus generating a resampled sequence strictly aligned in the time dimension. Finally, according to a predefined variable index order, all resampled univariate sequences are concatenated in parallel along the feature dimension to construct a two-dimensional resampled time series matrix. Each row of this matrix corresponds to a time step on the global time axis, and each column corresponds to a specific physical sensor variable, thus completing the conversion from asynchronous streaming data to a synchronous tensor structure.

[0032] Accordingly, the resampled time series matrix is ​​feature-standardized to obtain a standardized time series matrix. It is understandable that the resampled time series matrix contains variables with drastically different physical properties, such as the current of the reactor agitator motor, internal pressure, and temperature. The numerical magnitudes and physical dimensions of these variables differ significantly; for example, pressure values ​​may be as high as millions of Pascals, while the minute fluctuations in current may only be a few tenths of an ampere. If these raw values ​​are directly input into the neural network, the large-scale variables will dominate the gradient descent direction of the loss function, preventing the model from effectively learning the key fault features contained in the small-scale variables. Therefore, in the technical solution of this application, the resampled time series matrix is ​​further feature-standardized to obtain a standardized time series matrix. This eliminates the dimensional influence between different sensor variables, uniformly mapping the numerical distribution of all physical quantities to a standard space with the same statistical properties. This ensures that the deep learning model treats each physical variable equally during training, accelerates gradient convergence, and improves the model's sensitivity to small but crucial fluctuations in physical parameters, thereby guaranteeing the comprehensiveness and accuracy of fault feature extraction.

[0033] More specifically, in a concrete example of this application, this step strictly adheres to statistical principles in performing a standardized process of parameter calculation and element-by-element transformation. First, based on the historical training dataset, the system independently calculates the statistical distribution parameters for each column of the resampled time-series matrix—that is, each independent physical variable—obtaining the mean and standard deviation of the three-phase current of the reactor's stirring motor, and the mean and standard deviation of the reactor's internal temperature and pressure. These statistical parameters are then stored for subsequent online inference. Next, the Z-Score normalization algorithm is used to transform the matrix element-by-element, traversing each time step and each variable channel in the matrix, subtracting the statistical mean of the variable from the original physical value, and then dividing by its standard deviation. Finally, all the transformed values ​​are recombine to generate a standardized time-series matrix with dimensions identical to the original matrix. In this matrix, both large fluctuations in pressure and small changes in current are transformed into dimensionless values ​​following a standard normal distribution, thus completing the mathematical mapping from the physical numerical space to the statistical feature space.

[0034] Accordingly, temporal feature extraction is performed on the standardized time series matrix to obtain continuous feature embeddings. It is understandable that although the standardized time series matrix eliminates dimensional differences numerically, it is essentially still low-dimensional raw data composed of a series of discrete scalar values ​​at different time points. A simple numerical sequence lacks a high-dimensional abstract expression of complex dynamic relationships, periodic patterns, and long- and short-term evolutionary trends among multiple variables. It is difficult to capture deep physical laws, such as the hysteretic rise in temperature following a small oscillation in the current of a reactor agitator motor, solely based on raw numerical values. Therefore, in the technical solution of this application, temporal feature extraction is further performed on the standardized time series matrix to obtain continuous feature embeddings. Specifically, the standardized time series matrix is ​​input into a pre-constructed and trained temporal convolutional network for deep encoding operations. The network's internal convolutional kernels and nonlinear activation functions are used to peel away noise layer by layer and extract time-varying features. This maps the low-dimensional physical observation sequence into a high-dimensional hidden state vector sequence containing rich contextual information. In this way, simple numerical changes can be transformed into semantic features that the model can understand, ensuring that the model not only perceives the current physical state, but also understands its historical evolution path and future trends, providing a continuous feature foundation with high representational capabilities for subsequent semantic space alignment with discrete events.

[0035] More specifically, in a concrete example of this application, this step involves a deep processing flow of network architecture deployment, dilated causal convolution operations, and high-dimensional feature mapping. First, a temporal convolutional network containing multiple layers of residual connected blocks is deployed. This network architecture is specifically configured with dilated causal convolutional layers to handle continuous process variables such as the current, internal pressure, and temperature of the reactor agitator motor. This ensures that when extracting features at the current moment, it rigorously relies solely on historical information, preventing the leakage of future information. Furthermore, the receptive field is significantly expanded by setting an exponentially increasing dilation factor to cover the complete evolutionary cycle from the moment the motor starts to the occurrence of a fault. Next, a normalized temporal matrix is ​​fed as a tensor input into the network, driving it to perform sliding convolution operations in the time dimension. Using convolutional kernels trained and optimized with a large amount of historical fault data, the network automatically captures transient spike patterns in the current waveform and long-term integral trends in the temperature curve. Finally, through deep nonlinear transformation and residual aggregation of the network, a high-dimensional feature vector sequence that strictly corresponds to the input time step is generated in the output layer of the network. Each vector in this sequence is no longer a simple physical reading, but a highly condensed abstract code of the device health status at that moment and in its historical context, thus completing the transformation from raw time series data to deep feature embedding.

[0036] Specifically, in step S400, discrete event features are encoded to obtain event feature embeddings from the discrete event stream. It is understood that since the discrete event stream contains symbolic information with clear semantics but highly uncertain trigger times, such as stirring motor start commands, inverter overload alarms, and emergency shutdown operations, this information is sparsely distributed along the timeline, and there are complex logical causal chains between events. Traditional numerical processing or simple one-hot encoding cannot capture the deep semantic relationships behind the events and the crucial impact of their precise absolute occurrence time on fault evolution. Therefore, in the technical solution of this application, discrete event features are further encoded to obtain event feature embeddings from the discrete event stream. Specifically, a standardized event sequence is constructed from the discrete event stream, and the original event embedding is performed to generate an initial vector containing basic semantic information. Subsequently, a time-series-event joint location encoding that integrates absolute timestamps and modal identifiers is superimposed. Finally, the generated event input vector is fed into a Transformer-based multi-head self-attention encoder for deep contextual interaction. This transforms discrete symbolic records into high-dimensional semantic feature representations containing global dependencies and precise temporal positioning. In this way, the model can not only understand the meaning of the motor overload event itself, but also keenly capture the inherent logical connection between the alarm and the high speed setting command a few seconds ago through the self-attention mechanism. This provides a discrete feature basis with logical reasoning ability for subsequent cross-modal causal analysis of continuous physical signals.

[0037] More specifically, in a specific example of this application, discrete event feature encoding is performed on a discrete event stream to obtain event feature embeddings, including: constructing a normalized event sequence and original event embeddings from the discrete event stream to obtain original event embeddings; performing time-series-event joint position encoding on the original event embeddings to obtain event input vectors; and inputting the event input vectors into a Transformer-based multi-head self-attention encoder to obtain event feature embeddings.

[0038] Accordingly, the discrete event stream is standardized by constructing event sequences and embedding original events to obtain the original event embeddings. It is understandable that the discrete event stream consists of symbolic records with rich semantics but unstructured formats, such as motor start-up, inverter overload, or emergency stop button press. These records, in their original state, are merely simple text labels or numerical codes, lacking mathematical geometric meaning. Furthermore, a single event is often defined by multiple heterogeneous attributes such as event type, trigger source, and specific parameter values. Directly inputting these into a deep learning model cannot effectively express their complex semantic connotations. Therefore, in the technical solution of this application, the discrete event stream is further standardized by constructing event sequences and embedding original events to obtain the original event embeddings. This reorganizes the loose log records into an ordered queue according to a strict chronological order and maps the discrete symbolic attributes of each event into a dense real-valued vector. This endows each discrete event with mathematical computability, ensuring that the model can accurately distinguish the distance and differences between motor overload alarms and normal shutdown commands in the semantic space, laying a numerical foundation for subsequent mining of logical relationships between events.

[0039] More specifically, in a concrete example of this application, this step involves a standardized processing flow of sequence sorting, multi-dimensional attribute independent embedding, and feature fusion projection. First, the system receives a pre-processed discrete event stream and, strictly according to the precise trigger timestamp of each event record, sorts all events in ascending order, thereby constructing a standardized event sequence reflecting the true logical order of fault evolution. For example, the operator setting speed, motor start, and overload alarm are arranged in chronological order. Next, for each event in the sequence, its event type field and event source field are extracted. A pre-trained embedding matrix is ​​used to find the corresponding feature vector. For example, the alarm type is mapped to a specific semantic vector, and the stirring motor source address is mapped to the corresponding device vector. Simultaneously, the effective payload data carried by the event, such as the overload current threshold or fault code, is numerically encoded. Finally, the multiple feature vectors representing the event nature, location, and specific parameters are concatenated along the channel dimension and fused and compressed through a fully connected linear layer to generate the original event embedding vector corresponding to the event. This vector serves as a primary mathematical expression containing complete semantic information of the event, ready for integration into the subsequent advanced feature encoding network.

[0040] Accordingly, the original event embedding is subjected to temporal-event joint location encoding to obtain the event input vector. It is understandable that, due to the inherent permutation invariance of the Transformer architecture, its self-attention mechanism naturally ignores the order and time intervals of the input sequence during computation. The original event embedding vector, containing only semantic information, lacks crucial temporal location information for fault diagnosis. For example, the precise millisecond-level time difference between the start command of the stirring motor and the subsequent overload alarm often determines the causal determination of the fault, and the model needs to explicitly distinguish whether the input vector represents discrete events or continuous sampling points. Therefore, in the technical solution of this application, the original event embedding is further subjected to temporal-event joint location encoding to obtain the event input vector. This explicitly encodes the absolute time of the event, its relative time span, and its corresponding data modality attributes into learnable vector signals and injects them into the semantic embedding. This endows the model with a keen temporal awareness, enabling it to accurately reconstruct the logical chain of fault evolution based on the time sequence and interval length when processing complex alarm sequences occurring in parallel, rather than simply processing a bunch of disordered semantic labels.

[0041] More specifically, in a concrete example of this application, this step involves a composite encoding process of time position vector generation, modal identifier vector retrieval, and multi-dimensional feature fusion and overlay. First, for each discrete event in the standardized event sequence, the system extracts its precise trigger timestamp. Using a position encoding algorithm constructed with sine and cosine functions or a learnable temporal embedding layer, it calculates and generates a time-encoded vector representing its absolute position within the global fault time window and its relative distance to other events. For example, it precisely quantifies the time interval between the start-up time of the mixer motor and the alarm time of the frequency converter. Next, based on the specific data attribute that the input data belongs to a discrete event stream, the corresponding modal encoding vector is retrieved from a predefined modal embedding matrix. This vector serves as a global identifier, used to declare to the model that the data being processed is a logical event rather than a continuous analog quantity. Finally, the generated original event embedding vector, time encoding vector, and modality encoding vector are subjected to linear projection operations by element-wise addition or concatenation in their corresponding dimensions to synthesize the final event input vector. This vector retains the semantic content of motor overload, carries the temporal imprint of occurring in the Xth millisecond, and the modal identity of belonging to discrete alarm, providing a holographic input representation for subsequent spatiotemporal joint inference by the Transformer network.

[0042] Accordingly, the event input vector is input into a Transformer-based multi-head self-attention encoder to obtain the event feature embedding. It is understandable that discrete events in PLC control logic often have complex causal dependencies spanning varying time spans. For example, the root cause of an overloaded mixer motor might be a speed setpoint modification command that occurred minutes ago, interspersed with numerous unrelated routine state switching signals. Traditional recurrent neural networks tend to forget crucial historical information when processing such long-distance, discontinuous sparse dependencies and struggle to capture many-to-many relationships between multiple events in parallel. Therefore, in this application's technical solution, the event input vector is further input into a Transformer-based multi-head self-attention encoder to obtain the event feature embedding. Specifically, the multi-head self-attention mechanism is used to calculate the correlation strength weight between any two events in the sequence, and global context information is dynamically aggregated based on this weight. Subsequently, a feedforward neural network is used for nonlinear feature transformation. This breaks the limitation of sequence distance, allowing the model to directly focus on the most relevant start and end nodes in the logic chain, generating a deep semantic representation that incorporates the global fault context. In this way, the model can automatically incorporate the semantic information of illegal parameter setting instructions from the remote end when encoding the feature of motor overload alarm, thereby accurately reconstructing the fault logic causal chain that spans the time gap.

[0043] More specifically, in a concrete example of this application, this step involves a deep coding process involving multi-head attention computation, nonlinear transformation, and residual connection optimization. First, the system constructs a Transformer encoder with a multi-layer stacked structure. The sequence of event input vectors containing temporal and modal information generated in the preceding steps is fed as the input matrix into the first layer of this encoder. In the processing of each layer, the dot product of the query vector and the key vector is computed in parallel by a multi-head self-attention sublayer to generate an attention weight matrix. This matrix quantifies the logical correlation between historical events such as a mixer motor overload alarm and a frequency converter start command, speed adjustment operation, etc., and the value vectors are weighted and summed accordingly to extract contextual features of specific logical patterns of interest. Next, the output of the self-attention sublayer is processed through residual connections and layer normalization, and then fed into a position-based feedforward neural network for nonlinear mapping to enhance the expressive power of the features. Finally, through iterative transmission and deep abstraction of multiple encoders, the final layer outputs an event feature embedding vector sequence that corresponds one-to-one with the input event sequence. Each vector in this sequence not only retains the independent semantics of the original event, but also deeply embeds its role in the entire failure evolution script and its causal relationship with other events, providing a logical feature foundation with a global perspective for subsequent root cause localization.

[0044] Specifically, in step S500, multi-level attention fusion is performed on continuous feature embedding and event feature embedding to obtain a cross-modal fusion feature representation of the PLC log. It is understandable that although continuous feature embedding and event feature embedding each complete deep feature extraction within a single modality, they remain in independent semantic spaces and are misaligned in time scale. Simple feature concatenation cannot effectively characterize the complex nonlinear causal coupling between physical parameter fluctuations and logical event triggering. For example, it is difficult to definitively determine whether the continuous rise in the current of the stirring motor directly caused the subsequent inverter overload alarm. Furthermore, existing methods often ignore the strong constraint effect of the inherent physical topology between devices on the fault propagation path. Therefore, in the technical solution of this application, multi-level attention fusion is further performed on continuous feature embedding and event feature embedding to obtain a cross-modal fusion feature representation of the PLC log. Specifically, a cross-attention mechanism is first used to achieve fine-grained alignment and interaction between continuous signals and discrete events within a local time window. Then, a system topology graph reflecting the physical connection relationship of the devices is introduced as prior knowledge, and topology adaptive gating attention calculation and weighted fusion are performed. This approach breaks down the modal barriers between physical process data and logic control data, mapping heterogeneous information to a unified feature space that combines temporal dynamics and structural a priori information. This ensures that the model not only accurately captures the temporal correlation between abnormal increases in motor current and overload alarms, but also confirms the necessary causal link between the two based on the topology. This generates a holographic feature profile that can fully reproduce the transmission of the fault from the physical layer to the logic layer, providing highly interpretable cross-modal evidence for the final root cause localization.

[0045] Figure 4 This is a flowchart illustrating the multi-level attention fusion of continuous feature embedding and event feature embedding to obtain a cross-modal fused feature representation of PLC logs, according to the fault root cause localization method based on deep mining of PLC logs in embodiments of this application. Figure 4 As shown, step S500 includes: S510, performing cross-attention fusion on continuous feature embedding and event feature embedding to obtain a local fusion feature sequence; S520, performing topology adaptive gating attention calculation on the local fusion feature sequence based on the system topology graph to obtain an attention matrix; S530, performing feature fusion on the local fusion feature sequence based on the attention matrix to obtain a cross-modal fusion feature representation of PLC logs.

[0046] In step S510, the continuous feature embedding and event feature embedding are fused using cross-attention to obtain a locally fused feature sequence. It is understood that since continuous feature embedding represents the smooth evolution trend of a physical process, while event feature embedding represents the instantaneous state transition of control logic, the two are not only orthogonal in semantic dimension but also exhibit dense-sparse non-aligned characteristics on the time axis. If a simple splicing or full fusion is directly performed, the model will find it difficult to distinguish the close coupling relationship between specific physical fluctuations and surrounding discrete events. For example, it will be difficult to accurately determine whether an abnormal rise in motor current at a certain moment is the direct cause of triggering an overload alarm within hundreds of milliseconds. Therefore, in the technical solution of this application, the continuous feature embedding and event feature embedding are further fused using cross-attention to obtain a locally fused feature sequence. Specifically, the sparse event embedding is mapped onto a continuous time axis, and within the local neighborhood window of each continuous time step, the semantic correlation between the continuous state and surrounding events is calculated using a cross-attention mechanism. Then, highly correlated event information is weighted and aggregated into the continuous features. This allows for the alignment and interaction of cross-modal information within fine-grained time windows, giving physical features a logical context for interpretation. This ensures that the generated fused feature sequence at each time point not only encodes the current physical state but also dynamically integrates the closely related control logic context before and after that moment, thereby accurately capturing the microsecond-level causal interaction between current surges and overload alarms.

[0047] More specifically, in a concrete example of this application, this step strictly follows the standardized processing flow of time index alignment, local window definition, and attention-weighted aggregation. First, a timeline mapping operation for sparse events is performed. The system traverses each event feature embedding in the discrete event stream and, based on its precise absolute timestamp, indexes it to the sampling time step with the closest temporal distance in the continuous feature embedding sequence, thereby establishing a preliminary correspondence between sparse events and dense time-series data. Next, for each time step in the continuous feature sequence, such as the feature vector of the reactor agitator motor current at time T, a local attention window covering several time steps before and after is defined. The width of this window is set according to the typical delay time of fault propagation, aiming to encompass all potential events that may have a causal relationship before and after that time. Finally, multi-head cross-attention calculation is performed within this local window. The continuous feature vector at time T is used as the query vector, and all event feature vectors falling within the window are used as key and value vectors. The attention weight of each event to the current physical state is calculated through dot product operation, quantifying the explanatory power of events such as overload alarm events to the current current waveform. Based on this, the event vectors within the window are weighted and summed, and the aggregated event context information is fused into the current continuous feature vector, thereby generating a local fusion feature sequence that contains both physical fluctuation details and embedded logical causal clues.

[0048] In step S520, based on the system topology graph, topology-adaptive gated attention calculation is performed on the locally fused feature sequences to obtain the attention matrix. It is understandable that the global self-attention fusion mechanism faces a technical problem when processing industrial system data: topological agnosticness. This mechanism treats the locally fused feature sequences as flat, isolated sequences, ignoring the physical location and inherent connections in the process flow of the source variables corresponding to each feature vector within the overall industrial system topology. Industrial scenarios differ fundamentally from general scenarios; their system variables exhibit strong deterministic topological relationships determined by physical connections, process flows, or energy transfer. For example, the current fluctuations of the stirring motor in a reactor directly affect the fluid state inside the reactor through the mechanical transmission shaft, thereby altering the temperature distribution. This physical connection is deterministic and objectively exists. Simply applying a general self-attention network here is tantamount to forcing the model to learn the system structure, which should be prior knowledge, from scratch. This not only results in a huge waste of valuable structured information but also makes the model highly susceptible to learning spurious correlations at the data level during training—that is, two variables are statistically correlated but have no relation in the physical or causal chain. This severely affects the accuracy and robustness of fault root cause localization. Furthermore, due to the lack of guidance from topological knowledge, the distribution of its attention weights often fails to correspond to the actual physical propagation path of the fault, weakening the interpretability and credibility of the diagnostic results.

[0049] Therefore, in the technical solution of this application, based on the system topology graph, topology adaptive gating attention calculation is performed on the local fusion feature sequence to obtain the attention matrix. The static system topology structure is introduced as a learnable bias into the calculation of the attention score, and the influence of this topology bias is intelligently adjusted through a dynamic gating unit driven by real-time data. This achieves adaptive fusion of data-driven semantic association and knowledge-driven structural association. This ensures that when the model evaluates the causal relationship between the overload of the stirring motor and the increase in the temperature inside the vessel, it is not only based on the statistical correlation of the data fluctuations of the two, but also strongly constrained by the prior knowledge that there is a direct connection between them in the physical topology graph. This effectively eliminates false interferences that, although numerically synchronized, are physically unrelated, forcing the focus of attention back to the actual physical fault propagation path, significantly improving the physical compliance and expert readability of the diagnostic results.

[0050] Figure 5 This is a flowchart illustrating the process of calculating an attention matrix by performing topology-adaptive gating attention on local fused feature sequences based on a system topology graph, according to the fault root cause localization method based on deep mining of PLC logs in this application. Figure 5As shown, step S520 includes: S521, constructing a topology bias matrix based on the system topology graph; S522, calculating standard attention scores on the local fusion feature sequences to obtain a standard attention score matrix; S523, dynamically gating the standard attention score matrix based on the topology bias matrix to obtain an attention matrix.

[0051] In step S521, a topological bias matrix is ​​constructed based on the system topology diagram. It is understandable that, because general deep learning models often assume a potential fully connected relationship between all input variables and lack the ability to perceive the physical connection structure of industrial systems, the model is prone to capturing statistically relevant but physically uncausally related pseudo-associations during training. For example, it might misjudge the causal relationship between fan vibration and valve opening in unrelated production lines, while ignoring the truly decisive pipeline connections. Therefore, in the technical solution of this application, a topological bias matrix is ​​further constructed based on the system topology diagram. This transforms the deterministic system structure in the engineer's domain knowledge into numerical prior information that the model can understand and utilize. This technique first requires constructing a bias matrix containing system topological knowledge. This allows the construction of a structured prior knowledge base that reflects the physical reality of the industrial system, laying a solid foundation for subsequent more constrained and informative attention calculations. This forces the model to search for the root cause of the fault along paths permitted by physical laws, significantly reducing the risk of overfitting and improving the interpretability of the diagnosis.

[0052] More specifically, in a concrete example of this application, this step involves a standardized processing flow of topological relationship quantification, embedding mapping, and matrix generation. During execution, the system receives a locally fused feature sequence and a system topology graph describing the physical or causal connections between variables. This topology graph is digitally constructed based on a factory piping and instrumentation flow diagram, clearly defining direct physical couplings such as between a stirring motor and a reactor temperature sensor. Based on this topology graph, the structural relationship between any two variable nodes is first quantified, for example, their shortest path distance. In this scenario, the shortest path distance between the stirring motor current variable and the reactor temperature variable might be calculated as 1 due to their direct physical interaction, while the distance to the counter variable of the remote packaging machine, due to the lack of physical connection, is marked as infinity or a specific large value. Subsequently, this quantified structural relationship is input into a learnable topology embedding layer, learning a scalar bias value for each relationship. All these bias values ​​together constitute a learnable topology bias matrix. This step successfully transforms discrete, symbolic topological concepts such as direct connections or distances of 3 into continuous numerical values ​​that can be optimized during model training. Through learning, the model can autonomously determine the degree to which different topological relationships affect the intensity of attention between variables. For example, it assigns a larger positive bias to directly connected variables and a larger negative bias to unconnected variables. Specifically, during training, the model automatically increases the bias value bij between the stirring motor and the temperature sensor, making it a large positive number, thus naturally amplifying the weight between them when calculating attention. Conversely, for pairs of variables without physical connections, the model lowers their bias value to a negative number, thereby suppressing interference from invalid information.

[0053] In step S522, standard attention scores are calculated on the locally fused feature sequences to obtain a standard attention score matrix. It is understood that simple topological bias stacking is too rigid to adapt to the dynamic changes in industrial processes. For example, in a physically connected pipeline, the information flow and causal chain are essentially interrupted when a valve is closed. Therefore, a dynamic mechanism is needed to adaptively adjust the influence strength of the static topology based on the real-time data context. Before introducing dynamic adjustment, the pure correlation strength based solely on the current operating data must be obtained as the benchmark for adjustment. In the technical solution of this application, standard attention scores are further calculated on the locally fused feature sequences to obtain a standard attention score matrix. This matrix is ​​then used to generate a query matrix Q, a key matrix K, and a value matrix V based on the input feature sequences through linear transformation, and standard attention scores, purely based on data semantics, are calculated. This allows for the measurement of the semantic similarity of variable states in the current data batch, thereby capturing the immediate statistical correlation in numerical trends, such as the surge in current of the reactor agitator motor and the increase in temperature inside the reactor, providing original data-driven evidence for subsequent gating filtering combined with topological structure.

[0054] More specifically, in a concrete example of this application, this step involves a standard self-attention computation process of linear projection, dot product operation, and scaling. During execution, a query matrix Q, a key matrix K, and a value matrix V are first generated based on the input feature sequence through linear transformation. For example, the locally fused feature vector of the stirring motor current is mapped to the query space, and feature vectors such as reactor pressure and outlet valve opening are mapped to the key space. Subsequently, matrix multiplication is performed to calculate the dot product of the query matrix and the transposed key matrix to quantify the angle or matching degree of different variable feature vectors in the vector space. To avoid the dot product result being too large and causing the subsequent Softmax function to enter the saturation region of minimal gradients, the dot product result is scaled by dividing by the square root of the key vector dimension. This step is used to measure the semantic similarity of variable states in the current batch of data. Even if two variables are physically far apart, if they exhibit highly synchronized abnormal fluctuations in the current fault scenario, this step will generate a high score at the corresponding position in the semantic attention score matrix (Ssem), thus accurately reflecting the strong correlation at the data level, and waiting for subsequent steps to use topology gating for further logical verification and weight adjustment.

[0055] In step S523, the standard attention score matrix is ​​dynamically gated based on the topology bias matrix to obtain the attention matrix. It is understandable that simple topology bias stacking is too rigid and cannot adapt to the dynamic changes in industrial processes. For example, in a physically connected pipeline, when the valve is closed, the information flow and causal chain are essentially interrupted. If the model still forcibly assigns high attention weights based on the static topology graph, it will violate physical facts and introduce noise. Therefore, a dynamic mechanism must be introduced that can adaptively adjust the influence intensity of the static topology according to the real-time data context. In the technical solution of this application, the standard attention score matrix is ​​further dynamically gated based on the topology bias matrix to obtain the attention matrix. Specifically, the concatenation features of the query matrix and the key matrix are used to drive a learnable gating network to generate soft gating weights that reflect the connection activation state. These weights are then used to perform element-wise weighted adjustment of the topology bias, and finally, the topology bias is fused with the purely data-driven semantic score. In this way, the adaptive fusion of data-driven semantic association and knowledge-driven structural association can be achieved, ensuring that the model can intelligently suppress the causal inference of the raw material tank level on the reactor pressure when the reactor feed valve is closed. This achieves an attention mechanism that respects the physical laws of the system and can flexibly adapt to changes in operating conditions, and the attention distribution it generates is more accurate and logical.

[0056] More specifically, in a concrete example of this application, this step strictly follows the computational flow of gating weight generation, topology bias adjustment, and final score fusion. Next, a dynamic gating unit is introduced, which also takes the query matrix Q and key matrix K as input and dynamically generates a gating weight matrix G. During this process, the system deeply interacts with the real-time state features (i.e., queries and keys) of the reactor and pipeline valves at the current moment, autonomously determining whether the current physical connection is active through a neural network. Each element in the matrix acts as a context-aware switch; its value represents the extent to which the model considers the static topology connection between variables i and j to be active and relevant in the current data state. In the scenario where the valve is closed, the model can learn to make the corresponding element in the matrix approach 0, thereby dynamically disabling the influence of that physical connection in the attention calculation. For example, when the feed valve is detected to be closed, the attention channel between the raw material tank and the reactor is automatically cut off. Finally, the semantic score, topology bias, and gating weights are fused to obtain the final attention score. This step embodies the intelligent fusion of data-driven and knowledge-driven approaches: the final attention intensity is jointly determined by the purely data-driven semantic attention score matrix Ssem and the knowledge-driven topological bias Btopo, and the influence of the latter is precisely adjusted by a dynamic gating G that depends on the real-time data state.

[0057] In step S530, feature fusion is performed on the local fusion feature sequence based on the attention matrix to obtain the cross-modal fusion feature representation of the PLC log. It is understood that since the ultimate technical goal of this improved mechanism is to significantly improve the accuracy, robustness, and interpretability of deep learning-based fault root cause localization models in the industrial field, simply calculating the attention score only completes an intermediate evaluation step. If it is not applied to the substantial update of features, the model still cannot fuse physical topology priors and dynamic data features. By introducing an adaptive gating attention fusion mechanism based on system topology, the deficiency of topology agnosticism in traditional self-attention networks is fundamentally overcome. Therefore, in the technical solution of this application, feature fusion is further performed on the local fusion feature sequence based on the attention matrix to obtain the cross-modal fusion feature representation of the PLC log, thereby ultimately performing feature fusion and output. After calculating the attention score containing rich information, these scores need to be applied to weighted aggregate of information to generate the final feature representation. In this way, the system topology representing domain expert knowledge can be deeply and organically integrated with the data dynamics representing real-time operating conditions. This ensures that when the model is reasoning, its attention is no longer aimlessly searching for correlations in the sea of ​​data, but rather focusing on a reasonable space constrained by physical and technological processes. This allows it to more accurately capture fault chains propagating along real physical paths and effectively suppress the learning of spurious correlations.

[0058] More specifically, in a concrete example of this application, this step strictly follows the standard process of normalized weighting, feature aggregation, and post-processing optimization. Specifically, firstly, the fused attention score Sfused is normalized using the Softmax function to obtain the final attention weights. This operation transforms the score values ​​into a probability distribution, ensuring that the sum of the weights of all attention points is 1. In this step, A represents the final attention weight matrix. Then, the value matrix V is weighted and summed using this weight matrix to obtain the output of the attention mechanism. During this process, the model assigns high weights to the reactor agitator motor and temperature sensor based on the strong physical connection and high data correlation, thus deeply integrating the motor's current fluctuation characteristics into the feature representation of the temperature variable during feature aggregation. AttentionOutput is a weighted feature that incorporates topological information; it represents the aggregation result of all other time-step information at each time step. This aggregation is highly intelligent because it considers both the dynamic patterns of the data and the static structure of the system. This step ultimately processes the attention output through residual connections, layer normalization, and feedforward networks to generate globally fused features. This produces a highly condensed unified feature sequence that not only encodes the temporal patterns of the original data but also embeds the physical and causal structure of the industrial system, providing unprecedented high-quality input for downstream fault diagnosis tasks. Ultimately, this mechanism not only outputs a more accurate fault diagnosis result, but the attention weight matrix it generates internally also becomes a valuable diagnostic basis, clearly visualizing the propagation path of the fault in the system topology. This greatly enhances the model's interpretability, enabling domain experts to trust and understand the model's decision-making process.

[0059] Specifically, in step S600, root cause classification and interpretable attribution are performed based on the cross-modal fusion feature representation of the PLC logs to obtain the predicted fault type, root cause attribution score, and visualized fault propagation path. It is understandable that while the cross-modal fusion feature representation obtained through deep neural network processing mathematically highly condenses the spatiotemporal pattern information of the fault, it is essentially still an abstract high-dimensional tensor. For on-site maintenance personnel lacking an algorithmic background, it is like a black box that is difficult to interpret and cannot be directly converted into specific maintenance instructions or a basis for liability determination. Furthermore, in industrial production accident investigations, only providing a qualitative conclusion that a fault has occurred without providing a conclusive chain of evidence regarding where the fault originated and how it evolved will require manual investigation of all relevant equipment, severely slowing down the progress of production recovery. Therefore, in the technical solution of this application, root cause classification and interpretable attribution are further performed based on the cross-modal fusion feature representation of PLC logs to obtain predicted fault types, root cause attribution scores, and visualized fault propagation paths. Specifically, the fused features are mapped to explicit fault category probabilities, and the gradient information and attention weights within the model are used in reverse to quantify the contribution of each original input variable and discrete event to the final fault determination, thereby reconstructing a visualized fault causal chain. In this way, abstract feature vectors can be decoded into diagnostic reports that engineers can directly understand. This not only accurately indicates whether the fault is in the stirring motor itself or an upstream control command error, but also graphically reproduces the dynamic propagation process of the fault in the equipment network, thereby significantly shortening the average fault repair time and improving the reliability of the diagnostic results.

[0060] More specifically, in a concrete example of this application, this step strictly follows a progressive implementation process of fault probability inference, feature contribution backtracking, and propagation path graph construction. First, fault category probability prediction is performed. The system inputs a fused feature sequence containing global spatiotemporal information into a classification network composed of a global average pooling layer and a fully connected layer. This compresses and maps the high-dimensional feature space to a predefined fault category space. The Softmax function is used to calculate the confidence probability that the current state belongs to a specific fault type, such as wear of the stirring motor bearing, drift of the reactor temperature sensor, or improper PID parameter tuning, and the category with the highest probability is output as the prediction result. Next, root cause attribution analysis based on interpretability algorithms is performed. The system uses the integral gradient method or hierarchical correlation propagation algorithm to calculate the gradient contribution value of the output value relative to each original input feature (i.e., specific continuous sampling points and discrete event embeddings) from the predicted target fault node, propagating back along the network. This calculates the root cause attribution score for each variable. For example, if a speed setpoint modification event from several minutes ago is found to have the highest positive contribution score, it is identified as the root cause. Finally, the system generates a visualized fault propagation path. Combining the preset system topology diagram with the calculated high contribution characteristics, the system connects nodes with high attribution scores (such as operator stations, frequency converters, motors, and temperature probes) with directed arrows according to the chronological order of occurrence. The system also highlights key abnormal waveform segments and triggering events in the diagram, thus drawing a clear panoramic evolution path diagram showing how the fault is propagated from the initial parameter missetting to current abnormality and then to temperature alarm.

[0061] In summary, the fault root cause localization method based on deep mining of PLC logs according to the embodiments of this application is explained. It decomposes the original PLC logs into continuous data streams and discrete event streams through a heterogeneous data splitting mechanism. Temporal convolutional networks are used to capture the temporal dynamic changes of high-frequency analog data, and a Transformer encoder is used to extract the semantic logical relationships of asynchronous discrete events, thereby avoiding the loss of temporal accuracy and semantic confusion caused by forced time alignment. Based on this, a multi-level attention fusion mechanism is introduced to achieve deep interaction and alignment of cross-modal features while preserving the characteristics of each modality, constructing a unified feature representation containing rich spatiotemporal dependencies. This method effectively solves the technical problem of the difficulty in deep fusion of heterogeneous asynchronous data in industrial scenarios, realizing accurate fault root cause localization and visualized tracing of fault propagation paths.

[0062] Furthermore, a fault root cause localization system 100 based on deep mining of PLC logs is also provided.

[0063] Figure 6 This is a block diagram of a fault root cause localization system based on deep mining of PLC logs according to an embodiment of this application. Figure 6As shown, the fault root cause localization system 100 based on deep mining of PLC logs according to an embodiment of this application includes: a log acquisition module 110 for acquiring raw PLC logs; a data preprocessing and stream segmentation module 120 for performing heterogeneous data preprocessing and stream segmentation on the raw PLC logs to obtain continuous data streams and discrete event streams; a continuous data feature encoding module 130 for performing continuous data feature encoding on the continuous data streams to obtain continuous feature embeddings; a discrete event feature encoding module 140 for performing discrete event feature encoding on the discrete event streams to obtain event feature embeddings; a multi-level attention fusion module 150 for performing multi-level attention fusion on the continuous feature embeddings and event feature embeddings to obtain a cross-modal fusion feature representation of the PLC logs; and a root cause classification and interpretable attribution module 160 for performing root cause classification and interpretable attribution based on the cross-modal fusion feature representation of the PLC logs to obtain predicted fault types, root cause attribution scores, and visualized fault propagation paths.

[0064] The data preprocessing and stream segmentation module 120 includes a log parsing and cleaning unit, used to parse and clean the original PLC logs to obtain imputed log entries; a variable type identification and preliminary classification unit, used to identify and preliminarily classify the variable types of the imputed log entries to obtain a temporary continuous data list and a temporary discrete event list; and a data stream reconstruction unit, used to reconstruct the temporary continuous data list and the temporary discrete event list to obtain a continuous data stream and a discrete event stream.

[0065] The multi-level attention fusion module 150 includes a cross-attention fusion unit for performing cross-attention fusion on continuous feature embeddings and event feature embeddings to obtain a local fusion feature sequence; a topology adaptive gating attention calculation unit for performing topology adaptive gating attention calculation on the local fusion feature sequence based on the system topology graph to obtain an attention matrix; and a feature fusion unit for performing feature fusion on the local fusion feature sequence based on the attention matrix to obtain a cross-modal fusion feature representation of PLC logs.

[0066] As described above, the fault root cause localization system 100 based on deep mining of PLC logs according to embodiments of this application can be implemented in various types of computing devices or control units. For example, it can be implemented in industrial personal computers deployed in industrial production sites, intelligent edge computing gateways connected to PLC networks, or high-performance data analysis servers integrated into SCADA systems. In one possible implementation, the fault root cause localization system 100 based on deep mining of PLC logs according to embodiments of this application can be integrated into the computing device as a software module and / or hardware module. For example, the fault root cause localization system 100 based on deep mining of PLC logs can be an intelligent analysis module in the operating system of the computing device or edge node. This software module is configured to perform heterogeneous stream segmentation of raw PLC logs, dual-stream feature encoding based on temporal convolutional networks and Transformers, and cross-modal attention fusion inference based on topology adaptive gating, or it can be a dedicated industrial fault diagnosis algorithm program developed for the computing device. Of course, the fault root cause localization system 100 based on deep mining of PLC logs can also be one of the many hardware modules of the computing device or control unit, or it can be embedded in the field programmable gate array circuit to accelerate the real-time parsing and tensor matrix operation of massive log streams in parallel, or it can be an AI acceleration integrated circuit for a specific application.

[0067] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A fault root cause localization method based on deep mining of PLC logs, characterized in that, include: Obtain the raw PLC log; Heterogeneous data preprocessing and stream segmentation are performed on the raw PLC logs to obtain continuous data streams and discrete event streams; Continuous data feature encoding is performed on a continuous data stream to obtain continuous feature embeddings; Discrete event feature encoding is performed on discrete event streams to obtain event feature embeddings; Multi-level attention fusion is performed on continuous feature embeddings and event feature embeddings to obtain cross-modal fused feature representations of PLC logs; Root cause classification and interpretable attribution are performed based on cross-modal fusion feature representation of PLC logs to obtain predicted fault types, root cause attribution scores, and visualized fault propagation paths.

2. The fault root cause localization method based on deep mining of PLC logs according to claim 1, characterized in that, Heterogeneous data preprocessing and stream segmentation are performed on the raw PLC logs to obtain continuous data streams and discrete event streams, including: The original PLC log is parsed and cleaned to obtain the inserted log entries; The imputed log entries are identified by variable type and preliminarily classified to obtain a temporary continuous data list and a temporary discrete event list; Data flow reconstruction is performed on the temporary continuous data list and the temporary discrete event list to obtain the continuous data flow and the discrete event flow.

3. The fault root cause localization method based on deep mining of PLC logs according to claim 1, characterized in that, Continuous data feature encoding of a continuous data stream to obtain continuous feature embeddings includes: Data warping and multivariate time series construction are performed on continuous data streams to obtain the resampled time series matrix; The resampled time series matrix is ​​feature-normalized to obtain a normalized time series matrix; Temporal features are extracted from the standardized time series matrix to obtain continuous feature embeddings.

4. The fault root cause localization method based on deep mining of PLC logs according to claim 3, characterized in that, Temporal feature extraction of a standardized temporal matrix to obtain continuous feature embeddings includes: inputting the standardized temporal matrix into a pre-trained temporal convolutional network to obtain continuous feature embeddings.

5. The fault root cause localization method based on deep mining of PLC logs according to claim 1, characterized in that, Discrete event feature encoding is performed on a discrete event stream to obtain event feature embeddings, including: The discrete event stream is standardized to construct event sequences and embed the original events to obtain the original event embeddings; The original event embedding is subjected to time-series-event joint positional encoding to obtain the event input vector; The event input vector is fed into a Transformer-based multi-head self-attention encoder to obtain the event feature embedding.

6. The fault root cause localization method based on deep mining of PLC logs according to claim 1, characterized in that, Multi-level attention fusion is performed on continuous feature embeddings and event feature embeddings to obtain cross-modal fused feature representations of PLC logs, including: Cross-attention fusion of continuous feature embeddings and event feature embeddings is performed to obtain a local fused feature sequence; Based on the system topology graph, topology-adaptive gating attention is calculated on the local fused feature sequences to obtain the attention matrix; Based on the attention matrix, feature fusion is performed on the local fusion feature sequence to obtain the cross-modal fusion feature representation of PLC logs.

7. The fault root cause localization method based on deep mining of PLC logs according to claim 6, characterized in that, Based on the system topology graph, topology-adaptive gated attention is calculated on the locally fused feature sequences to obtain the attention matrix, including: Construct a topology bias matrix based on the system topology graph; Standard attention scores are calculated on the local fusion feature sequences to obtain the standard attention score matrix; The attention matrix is ​​obtained by dynamically gating the standard attention score matrix based on the topological bias matrix.

8. A fault root cause localization system based on deep mining of PLC logs, characterized in that, include: The log acquisition module is used to acquire raw PLC logs; The data preprocessing and stream segmentation module is used to perform heterogeneous data preprocessing and stream segmentation on the raw PLC logs to obtain continuous data streams and discrete event streams. The continuous data feature encoding module is used to encode continuous data features into a continuous data stream to obtain continuous feature embeddings. The discrete event feature encoding module is used to encode discrete event features into a discrete event stream to obtain event feature embeddings. A multi-level attention fusion module is used to perform multi-level attention fusion on continuous feature embeddings and event feature embeddings to obtain cross-modal fusion feature representations of PLC logs; The root cause classification and interpretable attribution module is used to perform root cause classification and interpretable attribution based on cross-modal fusion feature representation of PLC logs to obtain predicted fault types, root cause attribution scores, and visualized fault propagation paths.

9. The fault root cause localization system based on deep mining of PLC logs according to claim 8, characterized in that, The data preprocessing and stream segmentation module includes: The log parsing and cleaning unit is used to parse and clean the original PLC logs to obtain the inserted log entries. The variable type identification and preliminary classification unit is used to identify and preliminarily classify the variable types of the imputed log entries to obtain a temporary continuous data list and a temporary discrete event list. The data stream reconstruction unit is used to reconstruct the temporary continuous data list and the temporary discrete event list to obtain the continuous data stream and the discrete event stream.

10. The fault root cause localization system based on deep mining of PLC logs according to claim 8, characterized in that, A multi-level attention fusion module, including: The cross-attention fusion unit is used to perform cross-attention fusion on continuous feature embeddings and event feature embeddings to obtain a local fused feature sequence; The topology-adaptive gated attention computation unit is used to perform topology-adaptive gated attention computation on the local fused feature sequence based on the system topology graph to obtain the attention matrix; The feature fusion unit is used to perform feature fusion on the local fusion feature sequence based on the attention matrix to obtain the cross-modal fusion feature representation of PLC logs.

Images