A complex equipment digital twin security control method and system based on a hierarchical trust architecture and a heterogeneous redundant dual channel

Abstract

The application discloses a complex equipment digital twin security control method and system based on a hierarchical trust architecture and a heterogeneous redundant double channel. The method constructs a closed-loop control system of "hierarchical trust authorization-heterogeneous redundant double channel review-absolute conservative veto-safety smooth rollback-certificate tamper-proof audit" around the security risks of large complex equipment in the landing of AI assisted decision making. Through the introduction of distribution outside detection and prediction uncertainty evaluation in the sandbox deduction channel, and the time alignment and time delay compensation of the space-time difference of the double channel, when unknown working conditions, high uncertainty or synchronization error exceed the threshold, the interception and rollback are triggered, so as to inhibit the potential risks brought by the excessive self-confidence of the model. The method is suitable for the safe and intelligent operation and maintenance scene of high-value and high-risk equipment such as large telescopes, phased array radars, precision lithography equipment and particle accelerators.

Description

Technical Field

[0001] This invention belongs to the field of operation, maintenance and intelligent control technology of large-scale scientific facilities and complex opto-mechanical equipment. Specifically, it relates to a digital twin security control method and system based on a hierarchical trust architecture and heterogeneous redundant dual channels. It is applicable to the full life cycle intelligent operation and maintenance of complex equipment such as large optical or radio telescopes, large phased array radars, extreme ultraviolet precision lithography equipment, deep space exploration communication antennas and large particle accelerators, which have stringent requirements for the security, controllability and auditability of artificial intelligence-assisted decision-making. Background Technology

[0002] As artificial intelligence technology penetrates deeper into the operation and maintenance of large and complex equipment, utilizing digital twins for condition monitoring, fault prediction, and intelligent decision-making has become an inevitable direction for technological evolution. However, the decisions output by AI models face two fundamental contradictions in the implementation phase.

[0003] First, there is the trust dilemma. AI-assisted decision-making faces a polarized dilemma: either it is not trusted and cannot be implemented, or it enters the execution chain without graded verification, causing security risks. Existing technologies lack a systematic mechanism for graded management of AI decision outputs based on the degree of risk exposure, and also lack a quantifiable method for dynamically adjusting AI permissions based on accumulated operational evidence. Although the field of autonomous driving has established automation grading standards from L0 to L5, and there are public studies on setting risk operation restrictions from T0 to T3 levels according to the degree of hazard in AI agent systems, these solutions mostly use a smooth point accumulation mechanism to realize the upgrading and downgrading of permissions, lacking the strong punitive asymmetric control logic necessary for the safety characteristics of large-scale scientific research equipment.

[0004] Second, the security system is too simplistic. Traditional security protection relies on either hardware interlocking or software protection. Hardware interlocking can only respond to the absolute physical limits at the current moment and cannot predict the potential risks after the command is executed in the future; although software protection can use models for prediction, there is a risk that a single point of failure will lead to the loss of security functions. In the fields of industrial control systems and rail transit scheduling, there is already technical accumulation in the use of dual-channel or even multi-channel security architecture with dynamic heterogeneous redundancy structure. The use of digital twins as bypass sandboxes to pre-simulate control commands and intercept security is also publicly available in the fields of power grid defense and traffic scheduling. However, existing dual-channel solutions mostly adopt the traditional symmetrical approach of "majority voting" or "dual-machine hot standby comparison". The decision logic of the two channels is highly homogeneous and lacks positive interactive compensation design in the time and physical dimensions.

[0005] Specifically, the shortcomings of existing technologies can be summarized in the following aspects:

[0006] First, AI decision-making authority management lacks an asymmetric, punitive, dynamic upgrade and downgrade mechanism. Existing hierarchical authority systems generally adopt symmetrical linear upgrade and downgrade logic, with AI module authority upgrades and downgrades following similar time scales and magnitudes. This cannot provide sufficient safety margin in security scenarios where "a single misoperation of large-scale scientific research equipment could cause losses of tens of millions of yuan."

[0007] Secondly, the security review channel lacks a spatiotemporally orthogonal heterogeneous design. Existing dual-channel solutions mostly rely on input-output mirror comparison or dual-machine hot standby, lacking positive interactive supplementary review of the "current absolute spatial state" and the "future time window evolution trajectory," and also lacking compensation mechanisms for spatiotemporal differences such as timestamp misalignment and communication latency between physical devices and digital twins, leading to misjudgments under delayed and jittery conditions.

[0008] Third, security conflict adjudication lacks definitive, absolutely conservative rules. Existing multi-channel adjudication mechanisms rely heavily on voting or priority agreements, and the logic for handling disagreements between channels is not clear or conservative enough, raising the possibility of introducing "compromise" decisions in security adjudication.

[0009] Fourth, decision-making execution lacks end-to-end auditable and traceable capabilities. The security logs of existing systems are often scattered across various subsystems, lacking a unified audit and traceability system that binds trust upgrade / downgrade events, dual-channel review and judgment, and instruction execution to the digital twin model version number.

[0010] The aforementioned deficiencies have become a bottleneck restricting the transition of large and complex equipment from automation to reliable and intelligent operation and maintenance. Summary of the Invention

[0011] The purpose of this invention is to overcome the aforementioned shortcomings of the prior art and provide a digital twin security control method and system for complex equipment based on a hierarchical trust architecture and heterogeneous redundant dual channels. This method addresses the security issues of implementing AI-assisted decision-making in large and complex equipment by constructing a complete security closed loop of "hierarchical authorization - dual-channel review - absolutely conservative decision-making - full-link auditing".

[0012] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0013] A security control method for digital twins of complex equipment based on a hierarchical trust architecture and heterogeneous redundant dual channels includes the following steps:

[0014] Step 1: Establish a hierarchical trust architecture with several trust levels. Divide the intelligent decisions generated by the digital twin into different levels according to the risk level from low to high. The lowest level does not involve active decision output, while the highest level allows the generation of parameter modification instructions.

[0015] Step 2: Establish an asymmetric dynamic upgrade and downgrade mechanism for trust levels. The AI ​​decision-making module in the digital twin starts operating from the lowest trust level. Upgrades require meeting preset assessment conditions, and the assessment strictness increases with the increase of trust level. When a security over-limit event is triggered, a cross-level downgrade is executed and the trust record is cleared.

[0016] Step 3: For any decision command that attempts to change the operating state of complex equipment, it must pass through two independent review channels in parallel before being issued and executed. The first channel is the hardware interlocking channel, which performs rigid bottom line over-limit protection judgment based on the absolute state of the complex equipment at the current moment. The second channel is the twin software predictive protection channel, which predicts the future state based on the digital twin model and performs safety judgment.

[0017] Step 4: A veto rule is adopted. The decision instruction can only be issued to the execution mechanism of the complex equipment if both the first channel and the second channel are determined to be safe to pass. If at least one channel is determined to be unsafe or the determination conclusions of the two channels conflict, the decision instruction will be blocked.

[0018] Furthermore, the hierarchical trust architecture is preferably four levels, T0 to T3, corresponding to four risk levels: retrieval assistance, report generation, diagnostic suggestions, and parameter modification, respectively. In the asymmetric dynamic upgrade / downgrade mechanism, the assessment period strictly increases with the trust level, and during downgrade, it jumps back to the lowest level and triggers a security rollback. In the dual-channel review, the second channel performs out-of-distribution detection and uncertainty assessment in parallel during the advance simulation process, and performs time alignment and confidence decay compensation for the spatiotemporal differences between the two channels. The method also includes end-to-end credential-based audit traceability based on cryptographic hash chains and digital signatures. Detailed implementation methods for the above technical features are described below.

[0019] Furthermore, the complex equipment is an opto-electro-mechanical system with strong coupling of multiple physical fields and stringent requirements for operational control safety, including at least one of a large-aperture optical or infrared telescope, a large phased array radar system, an extreme ultraviolet precision lithography device, a deep space exploration communication antenna, and a large particle accelerator; when the complex equipment is a large-aperture optical-infrared telescope with a spliced ​​primary mirror design, the key performance indicators include at least one of axis tracking error, optical wavefront quality, full width at half maximum (FWHM) value of the star image, and imaging energy concentration; the advanced extrapolation of the second channel is performed along the structure-thermal-optical integrated performance link, and the dynamic safety envelope boundary is adaptively adjusted according to the current observation mode and atmospheric seeing conditions.

[0020] A digital twin safety control system for complex equipment based on a hierarchical trust architecture and heterogeneous redundant dual channels achieves safety control by employing the aforementioned method. The system includes:

[0021] The hierarchical trust intelligent decision-making module is configured to manage the intelligent decision-making output permissions of the digital twin according to a hierarchical trust architecture containing several trust levels, and to execute an asymmetric dynamic upgrade and downgrade mechanism. The AI ​​decision-making module starts running from the lowest trust level, and promotion requires meeting assessment conditions with increasing assessment strictness. When a security over-limit event is triggered, a cross-level downgrade is executed.

[0022] The hardware interlocking review module includes a hardware safety execution unit that runs independently of the upper-level software environment. It is used to perform rigid bottom line over-limit protection judgment based on the absolute state of the complex equipment at the current moment.

[0023] The twin software prediction and protection module includes a sandbox computing environment that runs a digital twin model, used to make security judgments on decision instructions based on future state predictions.

[0024] The veto decision module is connected to both the hardware interlock review module and the twin software prediction and protection module. It receives the judgment results from both modules and issues the release command only when both modules determine that the system is safe; otherwise, it performs an interception.

[0025] The security rollback control module is used to switch the execution link to the certified deterministic rollback controller to execute the security rollback policy when a cross-level degradation or dual-channel review rejection is triggered.

[0026] Furthermore, it also includes an audit log module, which generates and stores audit logs for trust upgrade / downgrade events and review decision events.

[0027] Compared with the prior art, the beneficial effects of the present invention are:

[0028] First, it enables the safe and gradual implementation of AI decision-making. Through the asymmetric upgrade and downgrade mechanism of the T0-T3 four-level trust architecture, AI is gradually upgraded from retrieval assistance to parameter modification. Each upgrade is based on quantifiable operational evidence. Once the limit is exceeded, it immediately downgrades back to the T0 level, avoiding the polarized dilemma of AI-assisted decision-making being "either not trusted or over-trusted".

[0029] Secondly, a redundant system was constructed that does not affect safety in the event of a single-channel failure. The hardware interlocking channel and the twin software predictive protection channel are completely independent in terms of criteria, links, and execution mechanisms. They are oriented towards two orthogonal dimensions: the current spatial state and the future temporal evolution, respectively. The spatiotemporal differences are handled through time alignment and delay compensation. A single channel failure or communication jitter will not lead to the loss of safety functions.

[0030] Third, it establishes a definitive and absolutely conservative ruling rule. The veto mechanism eliminates the possibility of "compromise" decisions in security rulings, ensuring that the most conservative conclusion is always reached in security determinations.

[0031] Fourth, it achieves full-chain auditability and traceability. Each trust upgrade / downgrade, dual-channel review and judgment, and instruction execution generates a voucher-style audit receipt bound to the model version number. Tamper-proofing is achieved through hash chains and digital signatures, supporting cross-team post-event review and accountability. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of the overall process and security control architecture of the method described in this invention, illustrating the logical relationship between the T0-T3 four-level trust architecture, the asymmetric dynamic upgrade and downgrade mechanism, and the heterogeneous redundant dual-channel review system.

[0033] Figure 2 The dynamic upgrade and downgrade state transition diagram of the four-level trust architecture from T0 to T3 shows the step-by-step progressive promotion path (T0→T1→T2→T3) and the abrupt downgrade path across levels (any level→T0), as well as the increasing relationship of the assessment cycle for each level.

[0034] Figure 3 This diagram illustrates the spatiotemporal positive interaction of the heterogeneous redundant dual-channel review mechanism, showcasing the orthogonal decision logic, time alignment and delay confidence attenuation compensation process, veto rules, and the independence of the two channels on the hardware platform and communication bus between the first channel (PLC hardware interlocking based on the current spatial absolute state) and the second channel (twin software prediction and deduction based on future time windows).

[0035] Figure 4 This diagram illustrates the advanced simulation workflow for predictive protection channels in twin software, showcasing the specific steps involved in loading state snapshots, injecting decision instructions, forward simulation, verifying the security envelope, detecting out-of-distribution issues, and assessing uncertainties.

[0036] Figure 5 This is a data flow diagram of the end-to-end audit traceability mechanism, showing how trust upgrade / downgrade events, dual-channel review and judgment, and instruction execution records are bound to the model version number and generated into a voucher-style audit receipt written to tamper-proof storage. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0038] This invention provides a digital twin security control method for complex equipment based on a hierarchical trust architecture and heterogeneous redundant dual channels. The method includes establishing a four-level trust architecture from T0 to T3 and an asymmetric dynamic upgrade and downgrade mechanism; establishing a dual-channel review system including distributed off-site detection and uncertainty assessment; performing time alignment compensation for the spatiotemporal differences between the two channels; adopting an absolutely conservative veto decision rule; implementing a safe and stable rollback strategy with an certified rollback controller during downgrade; and establishing a tamper-proof credential-based audit traceability mechanism.

[0039] This invention also provides a digital twin safety control system for complex equipment based on a hierarchical trust architecture and heterogeneous redundant dual channels, including a hierarchical trust intelligent decision-making module, a hardware interlocking review module, a twin software predictive protection module, a veto decision-making module, a safety rollback control module, and an audit recording module. To facilitate understanding of the collaborative working relationship of the above system in this embodiment, the following is combined with... Figure 1 and Figure 3 The logical relationships and data flow between the modules are further explained.

[0040] Physical connections and logical data flow between system modules (see) Figure 1 and Figure 3 )

[0041] The above six modules achieve data interaction through the system's internal communication mechanism: the hierarchical trust intelligent decision-making module and the dual-channel review module transmit instructions and judgment results through inter-process communication; the audit record module subscribes to key events generated by each module through the event bus and generates audit records in real time; and the communication link design between each module follows the principle of least privilege.

[0042] This embodiment uses the control system of a large ground-based optical-infrared telescope with a diameter of 14.5 meters as an example. The telescope adopts a horizontal gantry structure, consisting of an azimuth axis system and a pitch axis system; the primary mirror system is a modular design, composed of dozens of hexagonal segment mirrors; the servo drive system uses multiple direct-drive torque motors in parallel to drive the azimuth and pitch axes, and uses a steel strip grating ruler as a high-precision position feedback element; the distributed control system is built on EtherCAT industrial real-time Ethernet, with a motion controller as the core control node. The telescope operates in the optical to infrared band, and a multi-fidelity digital twin model has been pre-built along the structure-thermal-optical integrated performance link (STOP link).

[0043] The technical method implemented in this embodiment is as follows: Figure 1 As shown, it includes the following steps:

[0044] Step 1: Establishment and Deployment of a Four-Tier Trust Architecture (T0 to T3)

[0045] A hierarchical trust manager is deployed in the AI ​​decision-making module of the digital twin. The hierarchical trust manager maintains a trust state machine, which contains four state nodes (T0, T1, T2, and T3) and two types of state transition edges: upgrade and downgrade.

[0046] Level T0 (Retrieval Assistance Level): In the initial stage of system deployment, all AI-assisted functions are activated at Level T0. At this level, the digital twin only provides historical data retrieval and information query services to on-duty operators. For example, operators can query tracking error statistics for a certain elevation angle range over the past 30 days, historical pose records of a certain segment of mirror actuators, etc. Level T0 functions do not involve any active analysis or decision output, and their operational risk is zero.

[0047] Level T1 (Report Generation Level): At this level, the digital twin can autonomously generate draft operational status analysis reports. For example, based on the previous night's observation data, it can automatically generate a nighttime operational summary report that includes tracking accuracy statistics, thermal deformation compensation effect evaluation, and wavefront quality trend analysis. Level T1 reports are for operator review and reference only and do not directly trigger the issuance of any control commands.

[0048] Level T2 (Diagnostic Recommendation Level): At this level, the digital twin outputs a fault diagnosis ranking list and handling recommendations based on real-time status data. For example, when the system detects a persistently large azimuth axis tracking error, the AI ​​module outputs the following fault diagnosis list: 1. Abnormal azimuth bearing friction (87% confidence); 2. Wind load disturbance exceeding expectations (62% confidence); 3. Grating ruler reading head deviation (35% confidence). Each diagnostic item is accompanied by a comparative analysis of the normal baseline and the current abnormal state generated by the digital twin's STOP model, as well as the uncertainty range and evidence source identification. Level T2 recommendations must be confirmed and signed off by authorized experts before implementation.

[0049] Level T3 (Parameter Modification Level): At this level, the digital twin can generate simulation parameter modification suggestions or control parameter adjustment instructions. For example, suggestions may include adjusting the closed-loop gain of the active optical surface shape or modifying the feedforward compensation coefficient of the servo controller. Before being issued, Level T3 instructions must be verified through advanced simulation in a sandbox environment, followed by a dual-signature authentication and approval process. This requires at least two personnel with independent authorization to complete identity verification and signature before entering the dual-channel review process.

[0050] Step Two: Asymmetric Dynamic Upgrading and Downgrading Mechanism of Trust Level (e.g.) Figure 2 (As shown)

[0051] Trust Promotion Rules: The trust state machine operates according to the following step-by-step promotion path. From T0 to T1: After the AI ​​decision-making module has accumulated more than 100 uses at T0 without major retrieval errors, the first assessment cycle is completed, allowing promotion to T1. From T1 to T2: After the AI ​​decision-making module has run continuously at T1 for 30 observation nights with a reporting accuracy rate of no less than 95% and no missed key risks, the second assessment cycle is completed, allowing promotion to T2. From T2 to T3: After the AI ​​decision-making module has achieved a suggestion accuracy rate of no less than 90% and no misleading suggestions for two consecutive quarters at T2, the third assessment cycle is completed, allowing promotion to T3. The first assessment cycle is significantly shorter than the second assessment cycle, and the second assessment cycle is significantly shorter than the third assessment cycle, reflecting the principle of increasing assessment rigor with each level.

[0052] The specific values ​​for the aforementioned assessment cycles are preferred values ​​in this embodiment. In a general implementation, the typical value ranges for each assessment cycle are as follows: the first assessment cycle (T0→T1) is 1 to 4 weeks or 50 to 200 operations, corresponding to the initial verification of low-risk functions; the second assessment cycle (T1→T2) is 1 to 3 months or 20 to 60 complete operating cycles, corresponding to the stability verification of medium-risk functions; the third assessment cycle (T2→T3) is 3 to 12 months or 100 to 500 complete operating cycles, corresponding to the long-term reliability verification of high-risk functions. The specific values ​​for the assessment cycles should be determined based on the equipment's operating frequency, safety level requirements, and industry standards. The core constraint is that the first assessment cycle is strictly shorter than the second assessment cycle, and the second assessment cycle is strictly shorter than the third assessment cycle.

[0053] The performance evaluation data is measured by three key elements: runtime, number of operations, and error logs. All three conditions must be met simultaneously for the evaluation to be considered successful. When runtime and number of operations meet the targets and there are zero error logs, the system automatically generates a promotion review evidence package containing a summary of key performance indicators and audit record verification results. Promotion can only be triggered after review by authorized management personnel. All performance evaluation data is stored in a protected database and is accessible for audit traceability.

[0054] Trust Degradation Rules: Degradation employs a cross-level cliff-like mechanism. At any stage of operation, if the AI ​​decision-making module's decision causes any key performance indicator of the physical telescope (including but not limited to tracking error, optical wavefront quality, full width at half maximum (FWHM) of the star image, and imaging energy concentration) to exceed the preset safety envelope boundary of that indicator, or if the second-channel model's capability monitoring determines it to be an out-of-distribution high-risk and high-uncertainty condition, the trust state machine will immediately trigger a degradation. Regardless of whether the module is currently at level T1, T2, or T3, it will directly downgrade to level T0 and clear all historical trust records. After the degradation is triggered, the execution link will switch to the certified fallback controller within a preset time limit, prioritizing the maintenance of the last known safe state and performing limited deceleration.

[0055] The certified deterministic rollback controller is a pre-programmed deterministic control logic running on a dedicated safety PLC. Its control parameters are written to and locked in non-volatile memory during system deployment, and are not subject to parameter modifications from the AI ​​module during operation. The rollback controller autonomously takes over axis control after receiving a degradation trigger command via an independent hardwired signal. During rollback, a dual mechanism of hardware write protection and software permission shielding locks AI parameter write permissions, ensuring defense in depth.

[0056] When the retraction controller performs limited deceleration, it adopts an S-shaped velocity curve to avoid impact damage to the precision mechanical structure of the equipment caused by sudden acceleration. The maximum deceleration and jerk limits are determined based on the allowable moment of inertia and vibration modes of the equipment frame structure, and the target speed is zero speed or a predefined safe creeping speed.

[0057] The aforementioned asymmetric promotion and demotion mechanism embodies the safety control principle of "strict promotion and swift demotion": promotion requires the continuous accumulation of reliable operational evidence, while demotion is immediately reversed after triggering a limit violation, in order to meet the conservative control requirements of large-scale scientific research equipment for high-risk decision-making.

[0058] Step 3: Heterogeneous Redundant Dual-Channel Review System (e.g.) Figure 3 (As shown)

[0059] Any underlying control command that attempts to change the telescope's motion state or optical configuration (whether the command originates from the automatic output of the AI ​​decision module or is a manual command from the operator optimized by AI) must pass through two completely independent review channels in parallel before being sent to the physical telescope's actuators.

[0060] The first channel—the PLC hardware interlock channel—is executed by an independent programmable logic controller (PLC), with its decision-making logic completely isolated from the upper-level software environment. The PLC uses only hard-wired sensor signals and preset hardware parameter boundaries to perform rigid baseline over-limit protection judgments on the absolute state of the physical telescope at the current moment. Specific judgments include: whether the azimuth axis absolute position exceeds the hardware limit of ±270 degrees; whether the pitch axis absolute position exceeds the hardware limit of 15 to 89.5 degrees; whether the axis movement speed exceeds the hardware limit speed of 2 degrees / second for the azimuth axis or 1 degree / second for the pitch axis; whether the drive motor torque exceeds the rated limit; and whether the hard-wired signals from external environmental sensors (such as wind speed sensors) trigger emergency stop conditions (e.g., instantaneous wind speed exceeding 18 m / s). When any of the above judgments triggers an over-limit, the PLC independently executes strong physical intervention protection actions directly, including cutting off the drive bus power supply, triggering the electromagnetic brake, and cutting off at least one of the main power circuit, and generates a hardware-level alarm signal to display the emergency stop status on the main control interface. The core feature of the PLC hardware interlocking channel is that its judgment logic does not rely on any software calculation results, but only implements protection based on the physical absolute state at the hardware level. Even if the upper-level software system fails or is subjected to abnormal interference, the channel can still independently guarantee the physical safety baseline.

[0061] The second channel—the predictive protection channel for digital twin software—operates within an isolated sandbox environment of the digital twin. Its workflow is as follows: Figure 4 As shown. First, a snapshot of the current physical state of the digital twin model is loaded into the sandbox environment, including the current axis position and velocity, structural temperature field distribution, optical wavefront state, and environmental condition data. Then, the decision command to be reviewed is injected into the snapshot model as input stimulus. Next, forward simulation is performed along the STOP integrated performance link within a preset future time window, and the out-of-distribution detection score and prediction uncertainty boundary of the input condition are calculated in parallel. If the future trajectory exceeds the dynamic safety envelope boundary, or the OOD score exceeds the threshold, or the uncertainty boundary exceeds the threshold, the channel directly outputs an "unsafe" judgment.

[0062] Out-of-distribution (OOD) detection employs a method based on feature space density estimation: during the offline model training phase, normal operating condition training data is collected, and a reference distribution is fitted in the feature space; during online simulation, the Mahalanobis distance of the current input operating condition is calculated and mapped to a normalized OOD score (value from 0 to 1). When the OOD score exceeds a preset threshold τ_(OOD), it is determined to be a high-risk out-of-distribution scenario. In this embodiment, τ_(OOD) = 0.75, which can be lowered to 0.6 during extreme weather seasons and relaxed to 0.9 during non-observation periods. The above-mentioned OOD detection method belongs to the existing technology in the field of machine learning. The innovation of this invention lies in integrating it into a dual-channel security review framework.

[0063] Uncertainty estimation employs a deep ensemble method to estimate cognitive uncertainty (measured by the ensemble variance of multi-model predictions) and a quantile regression method to estimate random uncertainty (measured by the width of the predicted quantile interval). The two methods are combined to form a comprehensive uncertainty boundary U_(total). When U_(total) exceeds a preset threshold τ_(U) (in this embodiment, τ_(U) = 0.8 arcseconds), the second channel is still deemed unsafe, even if the predicted values ​​of key performance indicators do not exceed the limit.

[0064] Values ​​of the dynamic safety envelope boundary under different observation modes:

[0065] Observation mode; upper limit of tracking error; upper limit of wavefront mass (RMS); upper limit of star image FWHM; lower limit of energy concentration

[0066] Star tracking; 0.5″; 150nm; 0.8″; 80%

[0067] Sky survey scan; 2.0″; 300nm; 1.5″; 60%

[0068] Target switching; 5.0″; Not applicable; Not applicable; Not applicable

[0069] Hibernation / Maintenance; 10.0″; Not applicable; Not applicable; Not applicable

[0070] The dynamic safety envelope boundary is adaptively adjusted based on the measured atmospheric seeing value: when the seeing is worse than the reference value (ε_(ref)=1.0″), the boundary is widened proportionally; when the seeing exceeds the limit threshold (ε_(max)=3.0″), the system automatically suggests pausing observation and switching to sleep mode.

[0071] The heterogeneity and independence of the two channels are guaranteed: the first and second channels are completely independent in terms of hardware computing platform (the PLC is independent hardware and does not share any computing resources with the server running the digital twin), completely independent in terms of communication bus (the PLC transmits the judgment result through a dedicated hard-wired signal path, without going through EtherCAT or Ethernet), and completely independent in terms of software operating environment (the ladder logic of the PLC has no code dependency on the software stack of the digital twin). A single point of failure in either channel (whether it is PLC hardware failure or sandbox software crash) will not affect the normal operation of the other channel. When the second channel cannot complete verification due to software failure, the PLC hardware interlock of the first channel can still independently guarantee the safety baseline.

[0072] Step Four: Absolutely Conservative Veto Decision

[0073] The veto decision-making module receives the judgment results from both channels and executes the following deterministic decision-making logic: First, it aligns the timestamps of the real-time sampling of the first channel with the state snapshot of the second channel, and performs confidence attenuation compensation based on communication latency; when the synchronization error after compensation exceeds the threshold, it is directly determined to be unsafe. Only when the first channel determines that the "current state is safe" and the second channel determines that the "future evolution trajectory is safe and the model capability is reliable" under a unified time base is the decision instruction released and sent to the execution mechanism of the physical telescope via the EtherCAT bus. The decision instruction is statically intercepted and prohibited from being sent in any of the following situations: the first channel determines that it is unsafe; the second channel determines that it is unsafe; the conclusions of the two channels conflict; or the synchronization error exceeds the threshold.

[0074] Time-aligned interpolation method: The veto decision module selects the most recent sampling time of the first channel as the decision time base, and uses linear interpolation to map the status snapshot data of the second channel to a unified time base (cubic spline interpolation can be used to improve accuracy when the snapshot refresh cycle is long). In this embodiment, the PLC sampling frequency is 1kHz, the sandbox snapshot refresh frequency is 10-100Hz, and linear interpolation meets the accuracy requirements.

[0075] The confidence level decay compensation adopts an exponential decay method: the original confidence level of the second channel's deduction conclusion decays exponentially according to the time deviation, and the decay coefficient is configured with two levels, fast and slow, based on the rate of change of the state variable. When the decayed confidence level is lower than the acceptable threshold, the adjudication module no longer accepts the second channel conclusion and directly determines that it is unsafe.

[0076] In this embodiment, the remaining synchronization error threshold ε_(sync) is configured according to the equipment's motion characteristics: 20 milliseconds for high-speed tracking mode and 100 milliseconds for low-speed sky-scanning mode, ensuring that the axis displacement does not exceed 10% of the safety envelope margin within the ε_(sync) time. If the threshold is exceeded, it is directly determined to be unsafe and the command is intercepted.

[0077] Step 5: End-to-end audit and traceability (e.g.) Figure 5 (As shown)

[0078] The audit logging module automatically generates audit logs when the following events occur:

[0079] Trust upgrade / downgrade event audit: An audit record is generated each time the trust level is upgraded or downgraded. The content includes the trust level before and after the upgrade or downgrade, the triggering event (if it is an upgrade, the completion time of the assessment cycle and the cumulative error-free operation evidence are recorded; if it is a downgrade, the name of the performance indicator that triggered the downgrade, the value of the limit exceeding the limit and the time stamp of the limit exceeding the limit, or the OOD and uncertainty exceeding the threshold evidence are recorded), and the identifier of the approver.

[0080] Dual-channel review event audit: Each time a decision instruction enters the dual-channel review, an audit record is generated, which includes the specific parameters of the instruction to be reviewed, the judgment conclusion of the first channel and the specific judgment items triggered, the deduction result of the second channel and the security envelope verification conclusion, the out-of-distribution detection score, the uncertainty boundary, the final decision result (release or block) of the veto decision module, and the timestamp of the actual execution after the instruction is released.

[0081] Interception event audit: An audit log is generated each time an instruction is intercepted, which includes the channel identifier that triggered the interception, a detailed description of the reason for the interception (including exceeding the limit, high risk outside the distribution, uncertainty exceeding the threshold or synchronization error exceeding the threshold), and a snapshot of the state of the digital twin model at the time of interception.

[0082] All audit records are bound to the version number of the currently running digital twin model and generate credential-based audit receipts based on "current event hash + previous event hash + digital signature + trusted timestamp," which are then written to immutable append-only storage. When an abnormal event occurs and needs to be reviewed, the original data, model state, and operation context that triggered the event can be traced back along the version chain; if any historical record is modified, a tampering alarm will be immediately triggered due to a break in the hash chain.

[0083] In this embodiment, the cryptographic hash chain adopts the SHA-256 algorithm, the digital signature of the credential audit receipt adopts the ECDSA-P256 algorithm, and the signature private key is stored in a hardware security module (HSM) that has passed security certification.

[0084] The auditing system performs dual integrity checks: during write operations, it verifies the consistency between the preceding hash of a new receipt and the previously stored last receipt; periodically, it recalculates the hashes and verifies the signatures by backtracking from the genesis block. If an inconsistency is detected, a tampering alarm is immediately triggered, and high-trust-level commands are blocked from being released.

[0085] A complete working example of heterogeneous redundancy security verification

[0086] The following example illustrates the complete workflow of this invention. Assume that the telescope is currently performing star tracking observations, the AI ​​decision module is running at T3 level, and the Model Predictive Controller (MPC) outputs a control command based on the latest calibrated STOP dynamics reduced-order model: the azimuth axis is accelerated to 1.5 degrees / second.

[0087] The instruction first undergoes parallel review via dual channels. The first channel (PLC hardware interlock) reads the current absolute position of the azimuth axis (assumed to be +120 degrees) and the current speed (assumed to be 0.8 degrees / second) in real time, and compares the target speed of 1.5 degrees / second with the hardware limit speed of 2 degrees / second, determining that "the current state is safe, and the instruction has not violated the hardware limit." The second channel (twin software simulation) loads a snapshot of the current state (azimuth angle +120 degrees, speed 0.8 degrees / second, current wind speed 8 m / s, structural temperature field distribution), injects the "accelerate to 1.5 degrees / second" instruction into the snapshot model, and performs a forward simulation for the next 10 seconds along the STOP link. The simulation results show that the azimuth angle will reach +135 degrees within the next 10 seconds (far from the ±270 degree limit), the peak structural stress during the axis acceleration process does not exceed the fatigue limit, the pointing deviation does not enter the collision area, and the optical wavefront quality remains within an acceptable range, therefore, it is determined that "the future evolution trajectory is safe." After the veto module confirms that both channels are deemed safe, it releases the command and sends it to the azimuth axis servo driver via EtherCAT for execution. The audit log module simultaneously records the audit information.

[0088] If, in the above scenario, the second channel's simulation finds that the predicted pointing deviation reaches 2.8 arcseconds in the 7th second, exceeding the 2.0 arcsecond safety envelope boundary in star tracking mode, and the OOD score is 0.83 (above the threshold of 0.75) and the prediction uncertainty boundary is ±1.2 arcseconds (above the threshold of ±0.8 arcseconds), then the second channel determines it as "unsafe." Even if the first channel determines it as "safe," the veto module will still execute an interception.

[0089] If the AI ​​decision-making module continues to output unreasonable control parameter suggestions due to software defects, causing the telescope's tracking error to exceed the safety envelope boundary at a certain moment, the trust state machine immediately triggers a cross-level degradation: the AI ​​module is directly downgraded from T3 to T0, all trust evaluation records are cleared, and the certified rollback controller is triggered to take over the execution link, prioritizing the maintenance of the last known safe state and decelerating the axis system to a safe operating condition, subsequently generating a degradation event report. Afterward, the AI ​​module can only provide historical data retrieval services and must undergo the complete T0→T1→T2→T3 trust reconstruction process again. All the above-mentioned interception and degradation events are recorded in real-time by the audit log module. This record includes the event type, timestamp, parameters of the instruction to be audited, the judgment conclusions and basis of each of the two channels, the ruling result, the trust levels before and after degradation, and the associated model version number. After generating a voucher-style receipt through a hash chain and digital signature, it is written to append storage.

[0090] In summary, the main technological innovations of this invention include:

[0091] First, a multi-level (T0 to T3, four levels) trust architecture is established. Based on the degree of risk exposure, AI decision-making output is divided into four levels, from retrieval assistance to parameter modification. An asymmetric dynamic promotion and demotion mechanism is designed, featuring "step-by-step gradual promotion and abrupt demotion across levels." Promotion requires meeting error-free operation assessment cycles that increase with each level, while demotion, regardless of the current level, directly reverts to T0 and resets all trust records. Simultaneously, upon demotion, the system automatically switches to a certified deterministic rollback controller to perform a safe and smooth rollback, preventing control instability under high-speed operating conditions.

[0092] Second, a heterogeneous, redundant, dual-channel review system is established. The first channel is a hardware interlocking channel, independently executed by a programmable logic controller (PLC) based on the current physical absolute state, providing rigid baseline protection. The second channel is a twin software predictive protection channel, which performs forward simulation and advance extrapolation based on future time windows within a digital twin sandbox, and concurrently performs out-of-determination (OOD) detection of input conditions and assessment of predictive uncertainties. When unknown conditions or high uncertainties occur, even if the trajectory has not yet exceeded the limits, it is directly determined to be unsafe.

[0093] Third, an absolutely conservative veto rule is adopted, and time alignment and delay confidence attenuation compensation are introduced to address the objective spatiotemporal differences between the two channels. No majority voting or master-slave protocol is used; instructions can only be issued when both synchronized channels are deemed safe. If either channel is deemed unsafe or the synchronization error exceeds the threshold, the instruction is blocked.

[0094] Fourth, establish an audit traceability mechanism that runs through the entire process. For each trust upgrade / downgrade, dual-channel review and judgment, and instruction execution, generate audit records that are bound to the model version number and the approver. And form a voucher-style audit receipt through hash chain and digital signature, which supports full-link reverse traceability and prevents log tampering.

[0095] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the claims of the present invention. In order to clarify the technical breadth and anti-circumvention effectiveness of the present invention, the following catch-all extended statement is hereby made:

[0096] First, regarding the equivalent generalization of the core security mechanism. The four-level division from T0 to T3 described in this embodiment is a preferred specific implementation. Without changing the core technical concept of "managing AI decision-making authority according to risk level and executing asymmetric dynamic upgrades and downsizing," adjusting the number of trust levels to three or five, or redefining the specific functional scope of each level, all constitute equivalent variations of the technical solution of this invention. Similarly, the PLC programmable logic controller described in this embodiment can be equivalently replaced by a field-programmable gate array (FPGA) security logic controller or a dedicated safety instrumented system (SIS), or other hardware security execution units with the ability to operate independently of the software system.

[0097] Second, regarding the equivalent replacement of the advanced simulation model and capability monitoring in the dual-channel review. In this embodiment, the digital twin model used in the second channel sandbox environment can be a high-fidelity model based on finite element analysis, a reduced-order model derived based on intrinsic orthogonal decomposition, Krylov subspace method, or balanced truncation method, a data-driven model based on deep neural networks, or a fusion model thereof; the corresponding out-of-distribution detection and uncertainty assessment methods can be equivalently replaced without changing the safety principle of "prioritizing the interception of unknown operating conditions".

[0098] Third, regarding the cross-domain expansion of applications. Although the embodiments of this invention specifically illustrate a 14.5-meter large-aperture optical-infrared telescope, the security control paradigm created by this invention—"hierarchical trust architecture + heterogeneous redundant dual channels + veto decision + full-link audit"—has technically transcended the limitations of single astronomical equipment. Any complex opto-mechanical-electrical equipment that requires "AI-assisted decision-making to gradually replace manual control" and has stringent requirements for operational safety falls within the applicable scope of the method of this invention. Therefore, the method and system of this invention can be directly applied, without creative effort, to the intelligent operation and maintenance and safety closed-loop control systems of major national scientific and technological infrastructures such as large-scale high-precision phased array radar systems, extreme ultraviolet precision lithography equipment control systems, deep space exploration communication antenna clusters, and large-scale high-energy particle accelerators.

Claims

1. A digital twin security control method for complex equipment based on a hierarchical trust architecture and heterogeneous redundant dual channels, characterized in that, Includes the following steps: Step 1: Establish a hierarchical trust architecture with several trust levels. Divide the intelligent decisions generated by the digital twin into different levels according to the risk level from low to high. The lowest level does not involve active decision output, while the highest level allows the generation of parameter modification instructions. Step 2: Establish an asymmetric dynamic upgrade and downgrade mechanism for trust levels. The AI ​​decision-making module in the digital twin starts operating from the lowest trust level. Upgrades require meeting preset assessment conditions, and the assessment strictness increases with the increase of trust level. When a security over-limit event is triggered, a cross-level downgrade is executed and the trust record is cleared. Step 3: For any decision command that attempts to change the operating state of complex equipment, it must pass through two independent review channels in parallel before being issued and executed. The first channel is the hardware interlocking channel, which performs rigid bottom line over-limit protection judgment based on the absolute state of the complex equipment at the current moment. The second channel is the twin software predictive protection channel, which predicts the future state based on the digital twin model and performs safety judgment. Step 4: A veto rule is adopted. The decision instruction can only be issued to the execution mechanism of the complex equipment if both the first channel and the second channel are determined to be safe to pass. If at least one channel is determined to be unsafe or the determination conclusions of the two channels conflict, the decision instruction will be blocked.

2. The method according to claim 1, characterized in that, The hierarchical trust architecture includes levels T0, T1, T2, and T3. Level T0 is the retrieval assistance level, where the digital twin only provides historical data retrieval and information query services to operators. Level T1 is the report generation level, where the digital twin autonomously generates draft operational status analysis reports for operators to review. Level T2 is the diagnostic suggestion level, where the digital twin outputs a fault diagnosis ranking list and handling suggestions based on real-time status data. These suggestions include confidence scores for potential fault sources, comparative analysis results of the normal baseline generated by the digital twin model and the current abnormal state, and... The uncertainty range and evidence source identification of the fault handling suggestions must be confirmed and signed by an authorized expert with the corresponding authority level before they can be issued to the implementing agency; Level T3 is the parameter modification level. The digital twin generates simulation parameter modification suggestions or control parameter adjustment instructions. After the parameter modification suggestions are performed in the sandbox environment of the digital twin and the prediction results are visualized, the dual-signature authentication and approval process is triggered. At least two people with independent authorization are required to complete independent identity verification and confirmation before the parameter modification instructions can enter the dual-channel review process.

3. The method according to claim 1, characterized in that, The AI ​​decision-making module initially operates at level T0. When the module runs continuously at the current trust level for a preset assessment cycle without any error records, its trust level is allowed to be upgraded by one level. The first assessment cycle, second assessment cycle, and third assessment cycle corresponding to upgrading from level T0 to level T1, from level T1 to level T2, and from level T2 to level T3 increase sequentially. When the module triggers a safety limit violation event in the decision output at any trust level, its trust level drops back to level T0 without going through intermediate levels and the accumulated trust record is cleared. At the same time, a safe and smooth rollback mechanism is automatically triggered, and the control is switched to the certified deterministic rollback controller within a preset switching time limit. The rollback controller executes at least one of the following strategies: maintain the last known safe state, reduce the speed of the critical actuators to a safe stopping point, maintain the equipment in a predefined safe operating condition, and lock the AI ​​parameter write permission during the rollback until manual review is completed before re-authorization.

4. The method according to claim 1, characterized in that, The two review channels are independent of each other in terms of hardware computing platform, communication bus and software operating environment and are not coupled by common cause failure. A single point of failure in one channel will not affect the normal operation of the other channel. The rigid bottom line over-limit protection judgment of the hardware interlocking channel includes at least one of the following: judgment on whether the absolute position of the shaft system of complex equipment exceeds the hardware limit position, judgment on whether the shaft system movement speed exceeds the hardware limit speed, judgment on whether the drive motor torque exceeds the rated limit torque, and judgment on whether the hard-wired signal of the external environment sensor triggers the emergency stop condition. When any judgment triggers the over-limit, the first channel independently executes at least one strong physical intervention protection action, namely cutting off the power supply to the drive bus, triggering the electromagnetic brake and cutting off the main power supply circuit, independently of any software system.

5. The method according to claim 1, characterized in that, In step 3, the digital twin model makes predictions through advanced extrapolation. In the digital twin sandbox environment, forward time-series trajectory simulation is performed along a future preset time window, and model capability monitoring is performed in parallel during the extrapolation process.

6. The method according to claim 5, characterized in that, The advanced simulation includes: loading a snapshot of the current physical state of the digital twin model in the sandbox environment, injecting the decision instructions to be reviewed as input stimuli into the snapshot model, and performing forward temporal trajectory simulation along the structure-thermal-optical integrated performance link; the digital twin model used in the forward temporal trajectory simulation includes at least one or a combination of the following models: a high-fidelity mechanism model constructed based on full-order finite element analysis and optical path tracing, a reduced-order model derived from the high-fidelity mechanism model using intrinsic orthogonal decomposition, Krylov subspace method, or balanced truncation method, and a model constructed based on a deep neural network. The data-driven agent model, wherein the sandbox environment dynamically selects one of the models to perform inference calculations according to the preset selection rules of the current task; the model capability monitoring includes at least: out-of-distribution detection based on feature density estimation or distance metric, cognitive uncertainty estimation based on deep integration or Monte Carlo random deactivation, and accidental uncertainty estimation based on quantile intervals; when the inference results indicate that the key performance indicators will exceed the dynamic safety envelope boundary within a preset time window, or the out-of-distribution detection score is higher than the threshold, or the uncertainty boundary exceeds the threshold, the second channel outputs an insecurity judgment and triggers instruction interception.

7. The method according to claim 5, characterized in that, When there is a timestamp misalignment or communication delay between the real-time high-frequency sampling data of the first channel and the state snapshot loaded by the second channel, the system performs spatiotemporal difference compensation: time alignment interpolation is used to map the multi-source data to a unified adjudication time base, and confidence attenuation is applied to the second channel's deduction conclusion based on the estimated delay; When the remaining time error after compensation exceeds the preset upper limit, the veto decision module directly outputs an unsafe judgment and intercepts the instruction.

8. The method according to claim 1, characterized in that, The method also includes an audit traceability step: for trust level upgrade or downgrade events, dual-channel review judgment results and execution actions, and instruction interception events, the system forcibly generates audit records; the audit record includes an event trigger timestamp, the original input data digest that triggered the event, the corresponding digital twin model version number, the identity identifier of the dual-signature authentication signatory, and the final execution result; and generates a credential audit receipt based on a cryptographic hash chain and digital signature. The credential audit receipt includes at least an event digest hash, a preceding event hash, a model version identifier, an authentication identity signature, and a trusted timestamp, and is written to immutable append-only storage; when any historical record is modified, a tampering alarm is triggered through hash chain break verification, and subsequent high-trust-level instructions are blocked from being released.

9. The method according to claim 1, characterized in that, The complex equipment is an opto-mechanical-electrical system with strong multi-physics coupling and stringent requirements for operational control safety, including at least one of a large-aperture optical or infrared telescope, a large phased array radar system, an extreme ultraviolet precision lithography device, a deep space exploration communication antenna, and a large particle accelerator; when the complex equipment is a large-aperture optical-infrared telescope with a mosaic primary mirror design, the key performance indicators include at least one of axis tracking error, optical wavefront quality, full width at half maximum (FWHM) value of star image, and imaging energy concentration; the advanced extrapolation of the second channel is executed along the multi-physics coupling link of the equipment, and the dynamic safety envelope boundary is adaptively adjusted according to the current observation mode and atmospheric seeing conditions.

10. A digital twin safety control system for complex equipment based on a hierarchical trust architecture and heterogeneous redundant dual channels, wherein safety control is achieved by employing the method described in any one of claims 1 to 9, characterized in that, The system includes: a hierarchical trust intelligent decision-making module, used to manage the intelligent decision-making output permissions of the digital twin according to a hierarchical trust architecture containing several trust levels, and to execute an asymmetric dynamic upgrade and downgrade mechanism; a hardware interlocking review module, used to perform rigid bottom-line over-limit protection judgment based on the absolute state of the complex equipment at the current moment; a twin software prediction and protection module, used to predict the future state of the decision instruction based on the digital twin model in a sandbox environment and to perform a security judgment; a veto decision module, used to receive the judgment results of the hardware interlocking review module and the twin software prediction and protection module, and to allow the instruction to be issued only when both are judged to be safe, otherwise to intercept it; a security rollback control module, used to switch the execution link to the certified deterministic rollback controller to execute the security rollback strategy when a cross-level downgrade or dual-channel review rejection is triggered; and an audit log module, used to generate and store audit logs for trust upgrade and downgrade events and review judgment events.

Images