A variable frequency converter communication anomaly detection method based on intelligent diagnosis

Abstract

The application discloses a variable frequency converter communication anomaly detection method based on intelligent diagnosis, relates to the technical field of variable frequency converter communication anomaly detection, and comprises the following steps: acquiring communication message data between a variable frequency converter and a master control unit, and analyzing node addresses, function codes, register addresses, message serial numbers, sending time stamps and response time stamps; constructing a communication time slot fingerprint and a protocol state shadow model; generating an expected response message and an expected response time window according to a current request message, and matching the expected response message with an actual response message; calculating a protocol state deviation value and a time slot deviation value according to a matching result, and generating a communication anomaly syndrome vector; and determining a communication anomaly type according to the communication anomaly syndrome vector. The application can improve the identification accuracy of response mismatch, old frame playback, time slot drift and node communication interruption precursor anomalies.

Description

Technical Field

[0001] This invention relates to the field of inverter communication anomaly detection technology, and in particular to an inverter communication anomaly detection method based on intelligent diagnostics. Background Technology

[0002] With the continuous development of industrial automation, HVAC, electric drive, and intelligent manufacturing equipment, frequency converters have been widely used in scenarios such as motor speed regulation, energy consumption adjustment, and process control. Frequency converters typically interact with the main control unit via communication methods such as Modbus, CAN, RS485, or industrial Ethernet. The main control unit controls and monitors the frequency converter's operating status based on the node address, function code, register address, and response data in the communication messages. Existing frequency converter anomaly detection technologies mostly focus on trend analysis of operating status data such as current, voltage, temperature, and vibration, or on judgments based on whether communication times out, connection is interrupted, or fault codes are triggered. While these technologies can alarm for obvious faults, they lack the ability to identify more subtle anomalies in the communication link, such as response mismatches, old frame playback, time slot drift, and precursors to node communication interruptions. Especially in scenarios with strong electromagnetic interference, multi-node polling, message buffering delays, and asynchronous master-slave device states, relying solely on fault codes or single communication timeout thresholds can easily lead to false alarms, missed alarms, or difficulty in distinguishing anomaly types, making it difficult to meet the needs for refined diagnosis and early warning of inverter communication anomalies.

[0003] CN121615035A discloses a method for detecting abnormal states of frequency converters based on time-series data analysis, belonging to the field of power technology. This method involves the acquisition, preprocessing, feature extraction, anomaly detection, anomaly level determination, and trend analysis of multi-source sensor data, ultimately generating structured abnormal events. This enables accurate prediction and early warning of the operating status of complex systems, solving the technical problems of high real-time performance, low data redundancy, and multi-source feature fusion in frequency converter anomaly monitoring. This invention reduces redundant data, decreases data volume, reduces communication bandwidth pressure, ensures high-frequency, low-frequency, and event data are aligned on the same timeline, prioritizes the transmission of abnormal data, guarantees the integrity and reliability of abnormal information, quickly filters suspicious anomalies, generates local and remote alarms based on anomaly levels, and saves an anomaly database and periodic summary reports, facilitating operation and maintenance and remote monitoring. This solution focuses on the fusion of multi-source sensor time-series data, redundancy reduction, and anomaly level determination. Its anomaly identification targets primarily abnormal events at the inverter's operating status level. However, it lacks a dedicated diagnostic model for the semantic relationships of communication messages between the inverter and the main control unit, the protocol state correspondence between request and response messages, the continuity of message sequence numbers, and the communication time slot characteristics formed by the sending and response timestamps. Therefore, this solution struggles to fine-grainedly distinguish communication anomalies such as inconsistencies between communication response content and protocol expectations, repeated returns of historical response frames, and gradual drift in communication time slots without timeouts.

[0004] CN115963341A discloses a fault detection method, device, and air conditioning unit for frequency converters. The method includes: after activating the fault detection function of the frequency converter, performing communication fault detection and dry contact fault detection; if both the communication fault detection and the dry contact fault detection result are faults, then triggering the frequency converter to shut down; otherwise, further determining whether the frequency converter is abnormal, and adjusting the detection duration of the communication fault detection and / or the dry contact fault detection according to the determination result. This invention avoids the problem of unit shutdown caused by false alarms of frequency converter faults due to external interference or other factors. It enhances unit reliability, reduces the occurrence of false faults, improves user experience, and ensures safety in special operating environments. This solution reduces the risk of false shutdowns through a combination of communication fault detection and dry contact fault detection, and adjusts the detection duration based on the abnormality determination result, making it suitable for frequency converter fault confirmation scenarios in air conditioning units. However, this scheme's communication fault detection still leans towards fault result confirmation and detection duration adjustment, failing to jointly model the node address, function code, register address, message sequence number, sending timestamp, and response timestamp in the communication message, nor does it generate expected response messages and expected response time windows based on request messages. Therefore, this scheme struggles to describe the abnormal evolution of communication from the perspectives of protocol state deviation and time slot offset, and also finds it difficult to identify communication interruption precursors before nodes are completely interrupted. Summary of the Invention

[0005] The purpose of this section is to outline some aspects of the embodiments of the present invention and to briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section, as well as in the abstract and title of the present application, to avoid obscuring the purpose of this section, the abstract and title of the invention. Such simplifications or omissions shall not be used to limit the scope of the present invention.

[0006] In view of the problems that existing inverter anomaly detection technologies focus too much on operational status data analysis or fault result confirmation and lack collaborative diagnosis of communication message protocol status and communication time slot characteristics, this invention is proposed.

[0007] Therefore, the problem to be solved by this invention is how to perform joint analysis on the protocol status correspondence and communication time slot change relationship between request messages and response messages based on the communication message data between the frequency converter and the main control unit, so as to distinguish response mismatch anomalies, old frame playback anomalies, time slot drift anomalies and node communication interruption precursor anomalies.

[0008] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, embodiments of the present invention provide a method for detecting communication anomalies in frequency converters based on intelligent diagnostics, comprising, Acquire communication message data between the frequency converter and the main control unit, and parse the node address, function code, register address, message sequence number, sending timestamp, and response timestamp in the communication message data; A communication time slot fingerprint is constructed based on the sending timestamp and the response timestamp, and a protocol state shadow model is constructed based on the node address, function code, and register address; Input the current request message into the protocol state shadow model to generate the expected response message and the expected response time window, and match the actual response message with the expected response message and the expected response time window; The protocol state deviation value and time slot offset value are calculated based on the matching results, and a communication anomaly syndrome vector is generated from the protocol state deviation value and time slot offset value. The communication anomaly type is determined based on the communication anomaly syndrome vector, which includes response mismatch anomaly, old frame playback anomaly, time slot drift anomaly, and node communication interruption precursor anomaly.

[0009] Compared with existing technologies, the beneficial effects of this invention are as follows: By acquiring communication messages between the frequency converter and the main control unit and parsing multi-dimensional protocol fields, a fine-grained data foundation is provided for subsequent modeling; based on timing characteristics, a communication time slot fingerprint is constructed, and based on protocol fields, a protocol state shadow model is constructed, transforming intangible communication behavior into a quantifiable dynamic baseline, establishing a dual reference benchmark for anomaly detection; on this basis, by inputting the current request message into the model to generate the expected response message and expected response time window, and performing structured matching, accurate perception of the communication interaction state from both protocol semantics and timing characteristics is achieved; by calculating the protocol state deviation value and time slot offset value and generating a communication anomaly syndrome vector, multi-dimensional and multi-type anomaly features are integrated into a unified quantitative index, overcoming the defect of single threshold judgment being susceptible to interference; finally, based on this syndrome vector, four specific types of anomalies are accurately distinguished: response mismatch anomaly, old frame playback anomaly, time slot drift anomaly, and node communication interruption precursor anomaly, and a timing causal judgment is introduced in the case of composite anomalies to clarify the primary and secondary relationships, significantly improving the interpretability of diagnostic results and the guiding value of operation and maintenance decisions. Through the synergistic effect of the above steps, this invention not only achieves early, accurate, and interpretable detection of inverter communication anomalies, but also effectively enhances the security and reliability of industrial communication systems, providing solid technical support for predictive maintenance. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is a flowchart of a frequency converter communication anomaly detection method based on intelligent diagnostics. Detailed Implementation

[0011] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0012] Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without inventive effort should fall within the scope of protection of this invention.

[0013] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0014] As mentioned in the background section, while existing technologies can determine inverter operation anomalies or faults through multi-source sensor time-series data analysis, communication fault detection, and dry contact fault detection, they lack a protocol state model and time slot analysis basis for communication anomaly diagnosis based on node addresses, function codes, register addresses, message sequence numbers, sending timestamps, and response timestamps. This results in low granularity of communication anomaly identification and difficulty in early detection of concealed communication anomalies. To address these issues, this invention provides an inverter communication anomaly detection method based on intelligent diagnostics.

[0015] Reference Figure 1 , Figure 1 The flowchart below shows a method for detecting communication anomalies in a frequency converter based on intelligent diagnostics, according to an embodiment of the present invention. The method includes: S1: Obtain communication message data between the frequency converter and the main control unit, and parse the node address, function code, register address, message sequence number, sending timestamp and response timestamp in the communication message data.

[0016] S1.1: Collect communication message data on the communication link between the main control unit and the frequency converter. The communication message data includes request messages sent by the main control unit to the frequency converter and response messages returned by the frequency converter to the main control unit.

[0017] S1.2: According to the preset communication protocol format, the communication message data is frame boundary identified, and the communication message data that meets the frame header, frame length or frame interval rules is divided into request message records and response message records, and written into the communication message buffer queue in the order of collection.

[0018] In this embodiment of the application, the method for frame boundary identification is as follows: read the continuous byte stream in the communication message data, and determine the message start position and message end position according to the preset communication protocol format; when the preset communication protocol format includes a fixed frame header and a frame length field, the fixed frame header is used as the message start position, and the message end position is determined according to the frame length field; otherwise, the message boundary is determined according to the free interval between adjacent bytes, and the position where the free interval is greater than the preset frame interval threshold is used as the separation position between two adjacent frames of communication message data.

[0019] It should be noted that the preset frame interval threshold is determined based on the baud rate, character length, and parity bit length between the main control unit and the inverter, using the following formula: Preset frame interval threshold = (number of characters + number of stop bits + number of parity bits) / baud rate × coefficient, where the coefficient is 3 to 5 to distinguish between the byte interval within the same frame (usually 1 character time) and the inter-frame interval (usually 3.5 character times, conforming to standards such as Modbus).

[0020] The method of segmentation is as follows: After completing frame boundary identification, a message direction identifier is configured for each frame of communication message data based on the communication acquisition port, data transmission direction, and node address in the communication message data. When the message direction identifier indicates that the communication message data is sent from the master control unit to the inverter, the corresponding communication message data is segmented into a request message record. When the message direction identifier indicates that the communication message data is returned from the inverter to the master control unit, the corresponding communication message data is segmented into a response message record. When the communication acquisition port cannot directly distinguish the data transmission direction, the segmentation is based on the order of the communication message data in a master-slave interaction. Communication message data located before the sending timestamp and containing register addresses under the same node address is segmented into request message records, and communication message data located after the sending timestamp and corresponding to the node address and function code is segmented into response message records.

[0021] S1.3: When a request message enters the communication message buffer queue, read the node address, function code, and register address in the request message, and use the time when the request message leaves the main control unit's transmission buffer as the transmission timestamp.

[0022] S1.4: When the response message enters the communication message buffer queue, read the node address and function code in the response message, and use the time when the response message enters the main control unit's receive buffer as the response timestamp.

[0023] S1.5: Configure message sequence numbers for request messages according to the order in which they are sent.

[0024] In this embodiment, the method for configuring message sequence numbers is as follows: A monotonically increasing local sequence number is configured for each request message according to the order in which they enter the communication message buffer queue, and this local sequence number is used as the message sequence number. When the local sequence number reaches a preset maximum sequence number value, the counting is restarted according to a preset initial sequence number value, while simultaneously retaining the corresponding sending timestamp to distinguish request messages within different counting periods. The message sequence number, along with the node address, function code, and register address in the request message, is written into the communication message buffer queue, enabling subsequent request-response pairing to determine the response message corresponding to the current request message based on the message sequence number and time sequence. When the communication message data itself carries a transaction identifier or sequence identifier, the transaction identifier or sequence identifier is used as the message sequence number.

[0025] It should be noted that, in order to control the storage overhead of the communication message cache queue and subsequent historical message record set, this method presets the maximum number of records to be retained and the maximum retention time. When the storage time of records in the communication message cache queue exceeds the maximum retention time, or the number of records exceeds the maximum number of records to be retained, expired records are cleaned up according to the first-in-first-out (FIFO) principle.

[0026] Preferably, for key records used in training the protocol state shadow model (i.e., messages involved in records that have participated in protocol state jump frequency statistics and whose jump probability is higher than a preset jump probability threshold), an anti-expulsion mark is added to these records. Such records are not affected by FIFO cleanup until their storage time exceeds twice the maximum retention time or the model completes incremental updates and the record is no longer the sole support for key jumps. Only then is cleanup allowed to ensure that historical samples required for old frame playback detection are not lost prematurely due to high communication density. The maximum number of records to be retained is any integer between 1,000 and 10,000, with a recommended default value of 5,000. The maximum retention time is any value between 1 hour and 24 hours, with a recommended default value of 6 hours. The specific values ​​are determined by those skilled in the art based on the storage resources of the main control unit and the communication density of the frequency converter, and this invention does not impose a unique limitation.

[0027] S1.6: Based on the node address, function code, message sequence number, and time sequence, pair the request message record with the corresponding response message record to obtain a request-response message pair; for response message records that do not carry register addresses, write the register addresses from the corresponding request message record into the response message record.

[0028] In this embodiment, pairing request message records with corresponding response message records includes: sequentially reading each request message record according to the order of its sending timestamp, and searching for candidate response message records within a preset response waiting range after the request message record; selecting response messages from the candidate response message records whose node address matches the node address of the request message record, whose function code matches the function code of the request message record (if the response function code is the request function code plus 0x80, i.e., an abnormal response, it is also considered a corresponding function code, but an abnormal response identifier needs to be added to the pairing record), and whose response timestamp is later than the sending timestamp. The record serves as the corresponding response message record. When multiple candidate response message records satisfy the correspondence between node address and function code, the response message record with the response timestamp closest to the sending timestamp and not paired with other request message records is selected first. When the response message record carries a transaction identifier or sequence identifier, the response message record with the transaction identifier or sequence identifier matching the message sequence number is selected first. For request message records for which no corresponding response message record is found within the preset response waiting range, the request message record is retained as a non-response request message record, and its node address, function code, register address, message sequence number, and sending timestamp are recorded.

[0029] S1.7: Perform integrity checks on the request and response message pairs, specifically: The request and response message records in the request-response message pair are subject to field validation, time validation, and pairing status validation. Field validation includes verifying the existence of node address, function code, register address, and message sequence number. Time validation includes verifying whether the sending timestamp is earlier than the response timestamp. Pairing status validation includes verifying whether the same response message record corresponds to only one request message record. For response message records that do not carry register addresses but have been paired with request message records, the register addresses from the request message record are written into the response message record. For request-response message pairs that are missing node addresses, function codes, sending timestamps, or response timestamps, the corresponding request-response message pairs are marked as invalid message records. For non-response request message records that have complete fields but no response message record is found, the non-response request message records are retained, and the response timestamp is configured to an empty value or a timeout flag for subsequent identification of abnormal precursors to node communication interruption. Invalid message records with missing node addresses, missing function codes, or missing timestamps are deleted. Valid message records with node addresses, function codes, register addresses, message sequence numbers, sending timestamps, and response timestamps are retained. For message records that do not respond to requests (response timestamps are null or timeout indicators), they are still retained as valid message records in the communication message parsing record set, but a no-response mark is added. In the subsequent training of the protocol state shadow model and physical quantity baseline model, such records do not participate in response delay statistics and register value range estimation, but they participate in the statistics of the protocol state transition frequency matrix (with a transition to an empty state as a transition record) to ensure that the model covers the statistical characteristics of no-response scenarios and provides baseline comparison data for the node communication interruption precursor index.

[0030] It should be noted that the jump to an empty state is only used as a statistical basis in the calculation of the node communication interruption precursor index in S4.4, and is not included in the determination of the legal jump relationship in S2.7. The state transition table of the protocol state shadow model does not include empty state nodes to avoid generating jump paths without physical meaning.

[0031] S1.8: Arrange valid message records in chronological order of sending timestamps to generate a communication message parsing record set. The communication message parsing record set serves as the data foundation for subsequent construction of communication slot fingerprints based on sending and response timestamps, and for constructing protocol state shadow models based on node addresses, function codes, and register addresses.

[0032] S2: Construct a communication slot fingerprint based on the sending timestamp and response timestamp, and construct a protocol state shadow model based on the node address, function code, and register address.

[0033] Preferably, before constructing the communication slot fingerprint and protocol state shadow model based on the communication message parsing record set, the communication message parsing record set is first subjected to confidence screening: outlier records with response delay values ​​greater than three times the median absolute deviation (MAD) are removed to avoid occasional interference noise in the initial training data from polluting the normal communication baseline model; confidence screening is only applied to valid message records with non-empty response timestamps, and unresponded request message records with empty response timestamps or timeout indicators are not included in the response delay outlier removal and are directly retained for subsequent modeling.

[0034] Furthermore, when the number of valid message records corresponding to any node address is less than the preset minimum statistical sample size, the protocol state shadow model enters the cold start phase. During the cold start phase, the state transition table of the protocol state shadow model generates all possible state nodes (node ​​address, function code, register address) based on all legal function codes defined in the preset communication protocol format and the standard register address space. It also constructs an initial jump matrix based on the legal function code sequence constraints specified by the protocol standard (e.g., in Modbus, there is usually no fixed order between read register function codes 03 and 04 and write register function codes 06 and 16, so uniform initial jump probabilities are assigned). The initial jump probabilities of each state node are set to uniform distribution (i.e., the jump probabilities of all legal target nodes are equal). For jumps that are explicitly prohibited in the protocol standard (e.g., jumps from write register request to read register response), the corresponding probabilities are set to zero.

[0035] During the cold start phase, if the difference between the highest and second-highest jump probabilities of the current source node under uniform distribution is less than the preset minimum probability difference threshold (recommended value is 0.05), the current prediction confidence is considered insufficient. In this case, the generated expected response message is only for reference and does not trigger anomaly detection in S5 (i.e., no false alarms are generated during the cold start). Once the valid message records accumulate to the preset minimum statistical sample size, the initial jump matrix is ​​replaced and updated based on the actual statistical results, restoring normal anomaly detection functionality. This process ensures that the protocol state shadow model still possesses basic expected response generation capabilities in the early stages of system deployment and in data-sparse scenarios. S2.1: Extract the sending timestamp and response timestamp of each valid message record from the communication message parsing record set, and group the valid message records according to the node address to obtain the message record group corresponding to each node address.

[0036] In this embodiment, the method for extracting the sending timestamp and response timestamp is as follows: Valid message records in the communication message parsing record set are read sequentially according to the order of sending timestamps. For each valid message record, its corresponding node address is read, and the valid message record is grouped into the corresponding message record group based on the node address. For non-responding request message records with response timestamps configured as null or timeout flags, the non-responding request message records are separately grouped into the non-responding record subset of the corresponding node address. They are not included in the statistical modeling of communication slot fingerprints, but are retained for subsequent identification of communication interruption precursor anomalies.

[0037] S2.2: For each valid message record in the message record group, calculate the response delay value based on the sending timestamp and the response timestamp, and calculate the message sending interval value between adjacent request messages according to the order of sending timestamps under the same node address, so as to obtain the response delay sequence and message sending interval sequence corresponding to each node address.

[0038] In this embodiment, the response latency value is calculated by subtracting the sending timestamp from the response timestamp to obtain the response latency value of a single request-response interaction; the message sending interval value is calculated by subtracting the sending timestamp of the previous request message record under the same node address from the sending timestamp of the current request message record to obtain the message sending interval value between adjacent request messages; when the number of valid message records under the same node address is less than the preset minimum statistical sample number, the message records of the corresponding node address are grouped and marked as insufficient sample group, and are not temporarily included in the modeling of communication slot fingerprints, and modeling is carried out after the subsequent valid message records accumulate to the preset minimum statistical sample number.

[0039] It should be noted that the preset minimum statistical sample size is pre-set based on the normal communication cycle between the frequency converter and the main control unit to ensure that the response delay sequence and message transmission interval sequence have statistical representativeness. The preset minimum statistical sample size can be any integer between 30 and 100, and can be determined by those skilled in the art based on the communication acquisition frequency of the frequency converter and the requirements of the central limit theorem of statistics. This invention does not impose a unique limitation on this value.

[0040] S2.3: Perform statistical analysis on the response delay sequence and the message sending interval sequence respectively, calculate the mean response delay, standard deviation of response delay, mean message sending interval, and standard deviation of message sending interval for each node address, and construct a communication time slot fingerprint for each node address.

[0041] In this embodiment, the method for constructing the communication slot fingerprint is as follows: The normal response delay interval is determined by centering on the mean response delay and using 1 to 3 times the standard deviation of the response delay as half-width; the normal message transmission interval is determined by centering on the mean message transmission interval and using 1 to 3 times the standard deviation of the message transmission interval as half-width; the normal response delay interval and the normal message transmission interval together constitute the communication slot fingerprint of the corresponding node address; the communication slot fingerprint is stored with the node address as an index and bound to the message record group of the corresponding node address.

[0042] Preferably, the average response delay and the average message transmission interval are calculated using a sliding window average. The window length is fixed to the N most recent valid message records, with N being an integer between 50 and 200, and a default value of 100 is recommended. This allows the communication slot fingerprint to be dynamically adjusted as the communication message parsing record set is continuously updated, preventing the communication slot fingerprint from becoming invalid due to equipment aging or changes in the communication environment. The sliding window is updated using an incremental update mechanism: whenever the number of newly added valid message records reaches 10% of the window length N (i.e., every time 0.1N records are added), a batch update is triggered, and the statistics within the window are recalculated. The physical quantity baseline model uses the same update trigger mechanism, and the version number is used to ensure that the data versions of the two models are consistent at the same time, avoiding timing mismatch during prediction.

[0043] In an optional embodiment, when there are outlier response delay values ​​in the response delay sequence that deviate significantly from the mean response delay, the outlier response delay values ​​are removed using the interquartile range method before calculating the mean response delay and the standard deviation of the response delay, so as to improve the statistical robustness of the communication slot fingerprint.

[0044] S2.4: Extract the node address, function code, and register address of each valid message record from the communication message parsing record set, and perform secondary grouping of the valid message records according to the combination of node address and function code to obtain the function code record group corresponding to each combination of node address and function code.

[0045] In this embodiment, the two-level grouping method is as follows: First, valid message records are divided into corresponding message record groups based on node addresses. Then, within each message record group, further subdivision is performed based on function codes to obtain function code record groups corresponding to each function code under each node address. When there are multiple different function codes under the same node address, an independent function code record group is established for each function code. The function code record groups are stored with the combination of node address and function code as an index for subsequent construction of the protocol state shadow model.

[0046] S2.5: Divide the register addresses in each function code record group to obtain the regular register address and the low-frequency register address.

[0047] In this embodiment of the application, the method for dividing the register addresses in each function code record group is as follows: extract all register addresses and their corresponding frequencies that appear under the combination of each node address and function code. If the frequency of a register address is higher than a preset frequency threshold, then this register address is determined as a regular register address. If the frequency of a register address is lower than the preset frequency threshold, then the register address is determined as a low-frequency register address. The regular register address serves as the main state node of the protocol state shadow model, and the low-frequency register address serves as the extended state node of the protocol state shadow model.

[0048] It should be noted that the preset frequency threshold is pre-set based on the communication scheduling strategy during normal operation of the frequency converter. It is used to distinguish between periodic polling registers and non-periodic access registers, so that the distribution of state nodes in the protocol state shadow model matches the actual communication scheduling behavior.

[0049] S2.6: Based on the order of the sending timestamps of the valid message records in each function code record group, extract the jump relationships of node addresses, function codes and register addresses in adjacent valid message records, count the frequency of occurrence of each jump relationship, and construct a protocol state jump frequency matrix.

[0050] In this embodiment, the method for constructing the protocol state transition frequency matrix is ​​as follows: a combination of node address, function code, and register address is defined as a protocol state node; the protocol state node corresponding to the current valid message record is taken as the source node, and the protocol state node corresponding to the next valid message record is taken as the target node, and a transition relationship from the source node to the target node is established; the transition relationships of all adjacent valid message records in the communication message parsing record set are traversed and statistically analyzed to obtain the protocol state transition frequency matrix; the row index of the protocol state transition frequency matrix is ​​the source node, the column index is the target node, and the matrix elements are the occurrence frequency of the corresponding transition relationship.

[0051] It should be noted that the jump relationship between adjacent valid message records across node addresses is counted separately based on the node address, and is not merged across node addresses, so as to ensure that the protocol state shadow model corresponding to each node address is independent of each other.

[0052] S2.7: Based on the protocol state transition frequency matrix, calculate the transition probability of each transition relationship and determine the legal transition relationship. Using each protocol state node as the state node and the legal transition relationship and the corresponding transition probability as the state transition edge, construct the protocol state shadow model corresponding to each node address.

[0053] In this embodiment of the application, the method for calculating the jump probability is as follows: normalize the occurrence frequency of each row in the protocol state jump frequency matrix, use the sum of the occurrence frequencies of each row as the denominator, and use the occurrence frequency of each column in each row as the numerator to calculate the jump probability of the source node to jump to each target node.

[0054] The method for determining a valid jump relationship is as follows: if the jump probability is higher than a preset jump probability threshold, the jump relationship is determined to be a valid jump relationship, and the valid jump relationship and the corresponding jump probability are written into the state transition table of the protocol state shadow model; if the jump probability is lower than the preset jump probability threshold, the jump relationship is determined to be a low probability jump relationship, and the low probability jump relationship and the corresponding jump probability are written into the low probability jump record table of the protocol state shadow model. The preset jump probability threshold can be any real number between 0.1 and 0.3, with a recommended default value of 0.15. It can be determined by those skilled in the art based on the node size of the protocol state shadow model and the sparsity of the jump matrix, and this invention does not impose a unique limitation.

[0055] Preferably, each protocol state node in the protocol state shadow model is also associated with a corresponding communication time slot fingerprint. Specifically, the association method is as follows: a pointer or index field is added to the data structure of the protocol state node to point to the storage location of the communication time slot fingerprint of the corresponding node address; when the communication time slot fingerprint changes due to the sliding window update, the pointer in the protocol state node does not need to be modified, and the current value of the communication time slot fingerprint is read in real time during the query to ensure data consistency; while recording the protocol state transition behavior, the protocol state shadow model carries the normal response delay interval and normal message sending interval corresponding to each protocol state node, which can be used to synchronously generate the expected response time window when the current request message is input into the protocol state shadow model.

[0056] In an optional embodiment, when the number of valid message records in the communication message parsing record set increases over time, the protocol state jump frequency matrix is ​​incrementally updated based on the newly added valid message records, and the jump probability of the affected jump relationship is recalculated so that the protocol state shadow model can be adaptively updated with the changes in actual communication behavior without having to perform a full re-statistics on the communication message parsing record set.

[0057] S2.8: Construct a physical quantity baseline model based on the communication message parsing record set, which is used to store the data type, legal value range, rate of change constraint and statistical distribution characteristics corresponding to each register address.

[0058] In this embodiment, the method for constructing the physical quantity baseline model is as follows: extract the register addresses and corresponding response data fields (register values) of all valid message records from the communication message parsing record set, group them according to the combination of node address and register address, and perform the following operations on each group: Based on the register mapping table defined in the preset communication protocol format, determine the physical quantity type corresponding to the register address, including: numerical continuous quantities (such as frequency, voltage, current), numerical discrete quantities (such as speed series), bit-mapped status words (such as fault status bits, running status bits), and enumerated status codes (such as fault codes). For both continuous and discrete numerical quantities, the minimum and maximum register values ​​within the group are statistically analyzed, and the mean and standard deviation of all register values ​​are calculated. The range of values ​​from the minimum to the maximum register value is defined as the range of valid values ​​corresponding to the register address. This range of valid values ​​is stored in the physical quantity baseline model using a combination of node address and register address as an index. Simultaneously, the regression slope is calculated based on the linear regression of all register values ​​against the transmission timestamp. This regression slope is stored as the rate of change baseline in the physical quantity baseline model. This baseline is used in subsequent step S3.2 to generate trend predictions for expected register values ​​(i.e., when register values ​​show a monotonically increasing or decreasing trend, the expected value at the current moment is extrapolated based on the linear regression slope, rather than simply using the historical mean). For bit-mapped state words, instead of calculating the maximum / minimum value, we count the frequency of each bit being 0 and 1 to form the legal state distribution for each bit. For enumerated status codes, count the frequency of each enumeration value and record the enumeration values ​​that appear more than the preset frequency threshold (recommended to be 5 times or 5% of the total number of samples) as the set of valid enumeration values. For groups with insufficient historical samples (less than the preset minimum statistical sample size, set to 30), the valid value range of the register address defined in the preset communication protocol format (i.e., the lower and upper limits of the physical range) is used as the initial valid value range, which is updated after the samples are accumulated.

[0059] The physical quantity baseline model is stored with (node ​​address, register address) as an index, independent of the protocol state shadow model, and provides a basis for predicting the range of register values ​​when generating subsequent expected response messages. The physical quantity baseline model also adopts a sliding window update mechanism, with the window length consistent with the communication time slot fingerprint, in order to maintain adaptability to dynamic changes in operating conditions.

[0060] S3: Input the current request message into the protocol state shadow model, generate the expected response message and the expected response time window, and match the actual response message with the expected response message and the expected response time window.

[0061] S3.1: Read the current request message record from the communication message buffer queue, extract the node address, function code, register address and message sequence number from the current request message record, and locate the protocol state node corresponding to the current request message record in the protocol state shadow model based on the node address to obtain the current protocol state node.

[0062] In this embodiment, the method for locating the current protocol state node is as follows: using the combination of node address, function code, and register address recorded in the current request message as the query key, a protocol state node matching the query key is searched in the state transition table of the protocol state shadow model; when a protocol state node that is completely consistent with the query key exists in the state transition table, the protocol state node is determined as the current protocol state node; when no completely consistent protocol state node exists, a downgrade matching is performed using the combination of node address and function code (discarding the register address) as the query key; if it still does not exist, further downgrade is abandoned (no longer using only the node address as the query key), the current query key is recorded as an unregistered protocol state node identifier, and the current protocol state node is set as an empty node. At the same time, based on the jump relationship closest to the node address and function code in the low probability jump record table, the target node with the highest probability is selected as the temporary expected state node by probability weighting, and a downgrade matching mark is added in subsequent steps.

[0063] It should be noted that downgrade matching is only used to ensure the continuity of the subsequent expected response message generation process when the protocol state shadow model has not yet covered the corresponding protocol state node of the current request message record. The unregistered protocol state node identifier will be used as the input basis for protocol state deviation in subsequent steps, rather than being regarded as normal communication behavior. If no valid state node can be obtained after downgrade matching, the current request message will be marked as an unknown protocol state abnormality and will directly enter the communication abnormality type determination.

[0064] S3.2: Based on the current protocol state node, search for all legal jump relationships corresponding to the current protocol state node and the jump probability corresponding to each jump relationship in the state transition table of the protocol state shadow model. Determine the target protocol state node pointed to by the legal jump relationship with the highest jump probability as the expected target protocol state node, and generate the expected response message based on the function code and register address in the expected target protocol state node.

[0065] In this embodiment of the application, the method for generating the expected response message is as follows: Based on the current protocol state node (if not empty), search the state transition table of the protocol state shadow model for all legal jump relationships corresponding to the current protocol state node and the jump probability corresponding to each jump relationship. The target protocol state node pointed to by the legal jump relationship with the highest jump probability is determined as the expected target protocol state node (if the current protocol state node is empty, then based on the jump relationship that matches the current node address and function code in the low probability jump record table, randomly select a target node as the expected target protocol state node according to probability weighting, and attach a downgrade matching mark). Based on the function code and register address in the expected target protocol state node, and combined with the physical quantity baseline model, the field content of the expected response message is generated: the node address field in the expected response message is filled with the node address of the current request message record, the function code field is filled with the function code corresponding to the expected target protocol state node, and the register address field is filled with the register address corresponding to the expected target protocol state node; the register value field is predicted based on the legal value range or legal enumerated value set of the corresponding (node ​​address, register address) group in the physical quantity baseline model, and combined with the rate of change baseline: for numerical continuous quantities showing a monotonic trend, the most recent historical mean plus the slope of the rate of change multiplied by the time offset is used as the expected register value, and the expected register value range is ±1.5 times the standard deviation of the predicted value; for no For numerical discrete quantities with significant trends, the most recent historical mean or median is used as the expected register value, and the range of legal values ​​for that group is used as the expected register value range. For bit-mapped status words, the expected register value range is formed by combining the most common states (the states that occur most frequently) of each bit into an expected bit pattern, allowing changes in non-critical bits. For enumerated status codes, the expected register value is the most frequent legal enumerated value, and the expected register value range is the set of legal enumerated values. The above steps generate the expected register value and the expected value range, thus realizing the prediction of the expected change trend of the response data field. When the sample of that group in the physical quantity baseline model is insufficient, the range of legal values ​​(lower and upper limits of the physical quantity range) of the register address defined in the preset communication protocol format is used as the expected register value range.

[0066] Preferably, when the current protocol state node has multiple legitimate jump relationships with similar jump probabilities in the state transition table, all target protocol state nodes corresponding to legitimate jump relationships with jump probabilities higher than the preset candidate jump threshold (recommended value is 0.8 times the highest probability) are included in the candidate expected target protocol state node set, and a corresponding candidate expected response message is generated for each candidate expected target protocol state node for multi-candidate comparison when matching subsequent actual response messages.

[0067] S3.3: Based on the communication time slot fingerprint associated with the current protocol state node, extract the corresponding normal response delay interval and normal message sending interval, and determine the expected response time window based on the sending timestamp of the current request message record, according to the normal response delay interval.

[0068] In this embodiment, the method for determining the expected response time window is as follows: the start time of the expected response time window is obtained by adding the lower limit of the normal response delay interval to the sending timestamp; the end time of the expected response time window is obtained by adding the upper limit of the normal response delay interval to the sending timestamp; the time range from the start time to the end time of the expected response time window is defined as the expected response time window; the expected response time window and the expected response message together constitute a complete expected response description of the current request message record, which is stored in the expected response record and indexed by the message sequence number for subsequent matching of actual response messages.

[0069] It should be noted that when the communication slot fingerprint associated with the current protocol state node is calculated by the sliding window mean, the normal response delay interval has been dynamically adjusted with the continuous update of the communication message parsing record set. Therefore, the expected response time window also changes dynamically, and there is no need to manually correct the expected response time window separately.

[0070] In an optional embodiment, when the current protocol state node hits an unregistered protocol state node identifier, the expected response time window is determined based on the communication time slot fingerprint associated with the protocol state node obtained by the downgrade matching, and the upper limit of the expected response time window is extended outward by a preset delay tolerance to compensate for the delay estimation uncertainty introduced by the downgrade matching.

[0071] S3.4: Within the expected response time window, read the response message record corresponding to the node address and function code of the current request message record from the communication message cache queue, determine the response message record as the actual response message, and perform field-by-field structural matching between the node address, function code and register address of the actual response message and the node address, function code and register address of the expected response message to obtain the structural matching result.

[0072] In this embodiment, the structure matching method is as follows: First, it is determined whether the actual response message is an abnormal response frame, that is, whether its function code is the result of a bitwise OR operation between the request function code and 0x80. If so, the structure matching result is marked as an abnormal response frame, and the abnormal code field is extracted and recorded in the current message matching record. At this time, no subsequent field matching is performed, and the time slot matching process is directly entered. When calculating the protocol state deviation value in S4.1, the abnormal response frame is regarded as a special structure matching deviation, and its deviation value is preset to 0.5 (fixed additional deviation). If the actual response message is not an abnormal response frame, the node address field, function code field, register address field, and response data (register value) field in the actual response message are compared with those in the expected response message in sequence. If the values ​​of the node address field, function code field, register address field, and response data field of the actual response message fall within the expected register value range and are consistent with the corresponding fields of the expected response message, then the structure matching result is marked as a structure matching result. If the node address field or function code field of the actual response message is inconsistent with the corresponding field of the expected response message, the structure matching result will be marked as a structure matching deviation, and the name of the inconsistent field and the corresponding field value will be recorded. If the register address field of the actual response message is inconsistent with the register address field of the expected response message, but the node address field and the function code field are consistent, then the structure matching result will be marked as register address deviation. If the node address, function code, and register address of the actual response message are all consistent, but the value of the response data field does not fall within the expected register value range, then the structure matching result will be marked as data value exceeding the limit deviation, and the actual value and the expected value range will be recorded.

[0073] Preferably, when there is a set of candidate expected target protocol state nodes for the expected response message, the actual response message is sequentially matched with each candidate expected response message in the candidate expected response message set, and the candidate expected response message with a consistent structure is identified as the hit candidate expected response message, and the corresponding candidate expected target protocol state node is identified as the actual target protocol state node. At the same time, if the structure matching result is a consistent structure, the current state of the protocol state shadow model is updated to the actual target protocol state node for prediction of subsequent request messages. If the structure matching result is a structure matching deviation, register address deviation, data value exceeding the limit deviation, or abnormal response frame, the current state is not updated and the original state is continued to be used to avoid pollution of subsequent predictions by a single abnormality. When there is no candidate expected response message with a consistent structure in the candidate expected response message set, the structure matching result is marked as a structure matching deviation, and the current state is not updated.

[0074] S3.5: Match the response timestamp of the actual response message with the expected response time window to obtain the time slot matching result. Store the structure matching result and the time slot matching result together in the current message matching record, using the message sequence number as the index, for use in the subsequent calculation of protocol state deviation value and time slot offset value.

[0075] In this embodiment, the time slot matching method is as follows: read the response timestamp of the actual response message and determine whether the response timestamp falls within the expected response time window; if the response timestamp is earlier than the start time of the expected response time window, mark the time slot matching result as an early response and calculate the difference between the start time of the expected response time window and the response timestamp to obtain the time slot advance; if the response timestamp falls within the expected response time window, mark the time slot matching result as normal time slot matching; if the response timestamp is later than the end time of the expected response time window, mark the time slot matching result as a time slot lag and calculate the difference between the response timestamp and the end time of the expected response time window to obtain the time slot lag; if the response timestamp of the actual response message is null or timeout (i.e., no response), mark the time slot matching result as no response and record both the time slot advance and the time slot lag as a preset timeout flag value (recommended value is 10 times the upper limit of the normal response delay interval).

[0076] It should be noted that the time slot advance and time slot lag are collectively referred to as the time slot offset. The time slot offset, together with the time slot matching result, is written into the current message matching record. The time slot offset is used as a quantization input in the calculation of subsequent time slot offset values, and the structure matching result is used as a quantization input in the calculation of subsequent protocol state deviation values. Together, they constitute the data basis for the generation of subsequent communication anomaly syndrome vectors.

[0077] S4: Calculate the protocol state deviation value and time slot offset value based on the matching results, and generate a communication anomaly syndrome vector from the protocol state deviation value and time slot offset value.

[0078] S4.1: Read the structure matching result from the current message matching record, and calculate the deviation of each field according to the matching status of each field in the structure matching result and the preset field weight to obtain the protocol status deviation value.

[0079] In this embodiment, the method for calculating the protocol state deviation value is as follows: Pre-configure field weights for the node address field, function code field, register address field, and response data field, wherein the weight of the node address field is denoted as... The weight of the function code field is denoted as The weight of the register address field is denoted as The weight of the response data field is denoted as All four conditions are met. ; As one specific implementation of this application, the weight of the node address field can be 0.25, the weight of the function code field can be 0.25, the weight of the register address field can be 0.2, and the weight of the response data field can be 0.3; or it can be determined by those skilled in the art based on the sensitivity of each field in the preset communication protocol format to the representation of communication anomalies through hierarchical analysis or entropy weight method. This invention does not impose a unique limitation.

[0080] Configure a deviation flag value for each field in the structure matching result. If the corresponding field matches, the deviation flag value is recorded as 0; if the corresponding field deviates, the deviation flag value is recorded as 1. Calculate the protocol state deviation value according to the following formula. : ; in , , , These are the deviation flag values ​​for the node address field, function code field, register address field, and response data field, respectively. If the structure matching result is marked as a structure match, the protocol status deviation value is 0. If the structure matching result is marked as a structure match deviation, register address deviation, or data value exceeding the limit deviation, the protocol status deviation value is greater than 0. If the structure matching result is marked as an abnormal response frame, the protocol status deviation value is directly set to 0.3 (without adding deviations from other fields) to distinguish it from other types of deviations.

[0081] Preferably, when a jump relationship exists in the low-probability jump record table that matches the combination of node address, function code, and register address in the current request message record, a low-probability jump additional deviation value is added to the protocol state deviation value. (A value of 0.2 is recommended) to obtain the corrected protocol state deviation value. That is, the upper limit of the correction value is 1, so that low-probability jump behavior can be quantified in the protocol state deviation value.

[0082] S4.2: Read the time slot matching result and the corresponding time slot offset from the current message matching record, configure the sign of the time slot offset according to the type of the time slot matching result to obtain the signed time slot offset, and perform normalization calculation based on the signed time slot offset and the half width of the normal response delay interval to obtain the time slot offset value.

[0083] In this embodiment, the method for configuring the signed time slot offset is as follows: if the time slot matching result is marked as an early response, the time slot advance is configured to a negative sign to obtain the signed time slot offset; if the time slot matching result is marked as a time slot lag, the time slot lag is configured to a positive sign to obtain the signed time slot offset; if the time slot matching result is marked as a normal time slot match, the signed time slot offset is recorded as 0; if the time slot matching result is marked as no response, the signed time slot offset is set to a preset no response offset value, wherein the preset no response offset value is a positive value and is higher than the normal calculation upper limit of the time slot lag.

[0084] Time slot offset value The calculation method is as follows: normalize the result using the signed time slot offset as the numerator and the half-width of the normal response delay interval as the denominator, and calculate according to the following formula: ; in, This is the signed time slot offset. This is the upper limit of the normal response latency range. This is the lower limit of the normal response delay range; if If the difference is less than the preset minimum time precision value, then the half-width of the normal response delay interval will be reduced. A preset minimum time precision value is forcibly set to avoid calculation overflow caused by the denominator approaching zero. The preset minimum time precision value can be any value between 1 millisecond and 10 milliseconds, determined by those skilled in the art based on the system clock resolution of the main control unit. However, it should be noted that when this forced setting is used, the time slot offset value calculated at this time should be multiplied by an attenuation factor (the ratio of the actual value of the denominator to the minimum time precision value, with an upper limit of 1) to prevent oversensitivity due to extremely small communication jitter. When the absolute value of the time slot offset value is greater than 1, it indicates that the response timestamp of the actual response message exceeds the range of the normal response delay interval. When the absolute value of the time slot offset value is less than or equal to 1, it indicates that the response timestamp of the actual response message falls within the normal response delay interval.

[0085] It should be noted that the time slot offset value is normalized to eliminate the impact of the difference in the dimensions of the normal response delay interval between different node addresses on the generation of the subsequent communication anomaly syndrome vector, making the time slot offset values ​​of different node addresses comparable. Its value range is not limited to [-1, 1]. When the time slot offset value is greater than 1, it indicates that the response timestamp of the actual response message is outside the normal response delay interval, and the larger the absolute value, the more severe the time slot deviation. When the time slot offset value is less than or equal to 1, it indicates that the response timestamp of the actual response message falls within the normal response delay interval. The actual calculated value of the time slot offset (including any positive and negative values ​​within the real number domain) directly participates in the generation of the subsequent communication anomaly syndrome vector to fully preserve the quantitative information of extreme time slot deviation behavior without truncating its boundaries.

[0086] S4.3: Based on the current message matching records of a consecutive preset number of windows under the same node address, count the number of times the structure matching result is marked as structure matching deviation or register address deviation within the preset number of windows, calculate the protocol status deviation frequency, and count the number of times the time slot matching result is marked as time slot lag or no response within the preset number of windows, calculate the time slot abnormal frequency.

[0087] In this embodiment, the protocol state deviation frequency is calculated as follows: Under the same node address, the most recent consecutive preset window number of current message matching records are taken, and the number of records marked as structure matching deviation or register address deviation is counted. This number is then divided by the preset window number to obtain the protocol state deviation frequency. Time slot anomaly frequency The calculation method and the frequency of protocol state deviation The calculation method is the same: the number of records marked as time slot lag or no response by the time slot matching result is divided by the preset window number to obtain the time slot anomaly frequency. .

[0088] It should be noted that the preset number of windows is pre-set based on the normal communication cycle between the inverter and the main control unit and the state transition cycle of the protocol status shadow model. Different node addresses can be configured with different numbers of windows. The recommended calculation method is: number of windows = average number of requests for the node address within 1 minute × coefficient (coefficient is 3 to 5), and the minimum is not less than 30 and the maximum is not more than 200, so as to ensure that the frequency of protocol status deviation and time slot abnormality is statistically representative and has sufficient time-series perception capability for the cumulative trend of communication abnormalities.

[0089] In an optional embodiment, when the number of current message matching records under the same node address is less than the preset window number, the number of existing current message matching records is used instead of the preset window number to participate in the calculation of protocol state deviation frequency and time slot anomaly frequency, and an insufficient sample flag is added to the communication anomaly syndrome vector for use in subsequent communication anomaly type determination to reduce the corresponding weight.

[0090] S4.4: Count the number of times the time slot matching result is marked as unresponsive within a consecutive preset window number under the same node address, calculate the cumulative count of unresponsiveness, and calculate the unresponsiveness rate based on the ratio of the cumulative count of unresponsiveness to the preset window number to obtain the node communication interruption precursor index.

[0091] In this embodiment, the method for calculating the node communication interruption precursor index is as follows: Under the same node address, take the most recent consecutive preset window number of current message matching records, count the number of unresponsive request message records with null response timestamps or timeout flags, and record it as the cumulative count of no response. The precursor index for node communication interruption is calculated using the following formula. : ; in, The preset window number is used; the value range of the node communication interruption precursor index is [0,1]. When the node communication interruption precursor index approaches 1, it means that the inverter corresponding to the node address has no response within the preset window number and there is a communication interruption precursor for the inverter corresponding to the node address; when the node communication interruption precursor index is 0, it means that all inverters corresponding to the node address within the preset window number have normal response.

[0092] Preferably, when calculating the node communication interruption precursor index, the time-series weights of the no-response records within the preset window number are configured according to the order of their sending timestamps. The closer the no-response record is to the current time, the higher the time-series weight is configured. This can make the node communication interruption precursor index more sensitive to recent no-response behavior and have a lower weight contribution to early occasional no-response behavior, thereby reducing the interference of historical occasional no-response records on the node communication interruption precursor index.

[0093] S4.5: Based on the protocol state deviation value, time slot offset value, protocol state deviation frequency, time slot anomaly frequency, and node communication interruption precursor index, the components are weighted and combined according to the preset component weights to generate a communication anomaly syndrome vector.

[0094] In this embodiment of the application, the method for generating the communication anomaly syndrome vector is as follows: the protocol state deviation value... Time slot offset value Protocol status deviation frequency Time slot anomaly frequency Precursor index for node communication interruption Arranged sequentially, they form the communication anomaly syndrome vector. : ; The communication anomaly syndrome vector is stored with the message sequence number and node address as indexes, for subsequent use in determining the communication anomaly type based on the communication anomaly syndrome vector; the dimensions of each component in the communication anomaly syndrome vector are normalized and fall within the range of [0,1] or [-1,1] to ensure the comparability of each component in the subsequent determination of the communication anomaly type.

[0095] It should be noted that each component in the communication anomaly syndrome vector collectively reflects the comprehensive deviation of the communication interaction corresponding to the current request message record at both the protocol state level and the time slot level. Among them, the protocol state deviation value and protocol state deviation frequency reflect the structural deviation of protocol behavior, the time slot offset value and time slot anomaly frequency reflect the time slot level deviation of communication timing, and the node communication interruption precursor index reflects the communication availability degradation trend of the node address relative to the frequency converter. Each of the five components corresponds to anomaly characteristics in different dimensions, and together they provide multi-dimensional quantitative basis for the subsequent determination of communication anomaly types.

[0096] In an optional embodiment, when multiple consecutive message sequence numbers under the same node address in the communication message parsing record set trigger any component in the communication anomaly syndrome vector to exceed the corresponding preset component threshold, the continuous anomaly cumulative weight is superimposed on the corresponding component in the communication anomaly syndrome vector so that the communication anomaly syndrome vector has higher quantification sensitivity to persistent communication anomalies, while not over-responding to occasional single deviations.

[0097] S5: Determine the communication anomaly type based on the communication anomaly syndrome vector. The communication anomaly types include response mismatch anomaly, old frame playback anomaly, time slot drift anomaly, and node communication interruption precursor anomaly.

[0098] S5.1: Read the protocol state deviation value and protocol state deviation frequency in the communication anomaly syndrome vector, and determine the response mismatch anomaly in the communication anomaly syndrome vector.

[0099] In this embodiment, the determination of response mismatch anomaly includes whether the protocol state deviation value exceeds a preset protocol deviation threshold and whether the protocol state deviation frequency exceeds a preset frequency threshold. When the protocol state deviation value is higher than the preset protocol deviation threshold and the protocol state deviation frequency is higher than the preset frequency threshold, the communication interaction corresponding to the current communication anomaly syndrome vector is determined to be a response mismatch anomaly. When the protocol state deviation value is higher than the preset protocol deviation threshold but the protocol state deviation frequency does not exceed the preset frequency threshold, the current communication interaction is marked as a protocol state deviation observation record and is not directly determined to be a response mismatch anomaly. The determination will be made after the protocol state deviation frequency continues to accumulate within a preset window number. When the protocol state deviation value does not exceed the preset protocol deviation threshold, the current communication interaction does not trigger the response mismatch anomaly determination and enters the subsequent communication anomaly type determination process.

[0100] It should be noted that the preset protocol deviation threshold is preset based on the configuration of field weights and the distinguishability of each field in the preset communication protocol format. Its value range is any real number between 0.1 and 0.5, with a recommended default value of 0.3. It should be determined by those skilled in the art based on the calculation dimension of the protocol status deviation value and the communication reliability requirements. The preset frequency threshold is preset based on the normal communication scheduling strategy between the frequency converter and the main control unit. Its value range is any real number between 0.3 and 0.7, with a recommended default value of 0.5, in order to distinguish between occasional protocol status deviation and continuous response mismatch anomalies.

[0101] Preferably, when the structure matching result is marked as register address deviation and the frequency of protocol status deviation exceeds the preset frequency threshold, the response mismatch anomaly is further subdivided into register address mismatch subclasses, and the deviation register address field value is added to the response mismatch anomaly record for subsequent operation and maintenance diagnosis.

[0102] S5.2: Read the time slot offset value in the communication anomaly syndrome vector, and read the message sequence number of the actual response message from the current message matching record. Based on the message sequence number, search for historical valid message records in the communication message parsing record set that are completely consistent with the node address, function code, and register address of the actual response message. Determine whether the actual response message is duplicated with the historical valid message record, and obtain the historical duplicate matching result.

[0103] In this embodiment, the method for obtaining historical duplicate matching results is as follows: using the combination of the node address, function code, and register address of the actual response message as the query key, search for historical valid message records in the communication message parsing record set whose sending timestamp is earlier than the response timestamp of the actual response message; to accelerate the comparison, calculate the hash value (such as MD5 or CRC64) of the response data field for each record in the communication message parsing record set in advance, and establish an inverted index from (node ​​address, function code, register address) to the hash value set; extract the hash value of the response message data field from the historical valid message records and compare it with the hash value of the current actual response message data field; if the hash values ​​match, perform a byte-by-byte comparison to confirm complete matching. If the hash values ​​match but the byte-by-byte comparison is inconsistent, it is considered a hash collision. The historical duplicate matching result is marked as a no-replay hit, and a hash collision log is recorded for subsequent operation and maintenance reference. When the data field of the actual response message is completely consistent with the response message data field of any historical valid message record, and the difference between the response timestamp of the actual response message and the response timestamp of the corresponding historical valid message record is less than the preset replay detection time window, the historical duplicate matching result is marked as a suspected replay hit, and the message sequence number and response timestamp of the hit historical valid message record are recorded for subsequent old frame replay anomaly judgment. When no historical valid message record that meets the above conditions is found, the historical duplicate matching result is marked as a no-duplicate hit.

[0104] It should be noted that the preset replay detection time window is preset based on the normal communication cycle between the frequency converter and the main control unit and the upper limit of the normal response delay interval. The specific value is any multiple between 1.5 times and 3 times the upper limit of the normal response delay interval, with a recommended default value of 2 times. It can be set by those skilled in the art according to the timeout retransmission time of the communication retransmission mechanism. This invention does not impose a unique limitation.

[0105] S5.3: Based on historical duplicate matching results and time slot offset values, determine the old frame playback anomaly in the communication anomaly syndrome vector.

[0106] In this embodiment, the method for determining old frame playback anomalies is as follows: when a historical duplicate matching result is marked as a suspected replay hit and the slot offset value is negative, i.e., the slot matching result is marked as an early response, the current communication interaction is determined to be an old frame playback anomaly. The criteria for determining an old frame playback anomaly are: the old frame playback behavior is manifested in the timing of the response message arriving before the start time of the expected response time window, i.e., the response timestamp of the actual response message is earlier than the start time of the expected response time window, and at the same time, the data field of the actual response message is completely consistent with the response message data field of the historical valid message record. Both conditions must be met simultaneously to determine an old frame playback anomaly. When a historical duplicate matching result is marked as a suspected replay hit but the slot offset value is not negative, the current communication interaction is marked as a data duplication to be observed record and is not directly determined to be an old frame playback anomaly. When a historical duplicate matching result is marked as no replay hit, the current communication interaction does not trigger the old frame playback anomaly determination and enters the subsequent communication anomaly type determination process.

[0107] Preferably, when an anomaly is determined in the old frame playback, the difference between the sequence number of the historical valid message record suspected of being replayed and the sequence number of the current request message record is further checked. When the difference exceeds the preset sequence number difference threshold (the recommended value is twice the average number of requests per minute under the current node address), the confidence level of the old frame playback anomaly is increased to distinguish between normal data duplication caused by the communication retransmission mechanism and real old frame playback behavior.

[0108] S5.4: Read the time slot offset value and time slot anomaly frequency in the communication anomaly syndrome vector, and determine the time slot drift anomaly in the communication anomaly syndrome vector.

[0109] In this embodiment, the determination of time slot drift anomaly includes whether the absolute value of the time slot offset exceeds a preset time slot offset threshold and whether the time slot anomaly frequency exceeds a preset frequency threshold. When the absolute value of the time slot offset is higher than the preset time slot offset threshold and the time slot anomaly frequency is higher than the preset frequency threshold, the current communication interaction is determined to be a time slot drift anomaly. When the absolute value of the time slot offset is higher than the preset time slot offset threshold but the time slot anomaly frequency does not exceed the preset frequency threshold, the current communication interaction is marked as a time slot offset observation record, and the determination is made after the time slot anomaly frequency continues to accumulate within a preset window number. When the absolute value of the time slot offset does not exceed the preset time slot offset threshold, the current communication interaction does not trigger the time slot drift anomaly determination and enters the subsequent communication anomaly type determination process.

[0110] It should be noted that both time slot drift anomaly and old frame playback anomaly manifest as time slot offset values ​​deviating from the normal range at the time slot level. The difference between the two is that old frame playback anomaly is accompanied by historical repeated matching results being marked as suspected replay hits, while time slot drift anomaly is not accompanied by historical repeated matching results being marked as suspected replay hits. Therefore, the determination of time slot drift anomaly is performed after the determination of old frame playback anomaly to ensure that the two do not have overlapping determinations.

[0111] Preferably, when determining a time slot drift anomaly, the time slot drift anomaly is further subdivided into directions based on the sign of the time slot offset value: when the time slot offset value is continuously positive, the time slot drift anomaly is subdivided into a continuous lag type time slot drift anomaly; when the time slot offset value is continuously negative, the time slot drift anomaly is subdivided into a continuous advance type time slot drift anomaly; when the time slot offset value alternates between positive and negative values ​​and the absolute value is continuously higher than the preset time slot offset threshold, the time slot drift anomaly is subdivided into a jitter type time slot drift anomaly, so as to provide more targeted time slot anomaly direction information for subsequent operation and maintenance diagnosis.

[0112] It should be noted that the value of the preset time slot offset threshold corresponds to the dimension of the time slot offset value, and its value range is any real number between 0.8 and 1.2. The recommended default value is 1.0, which should be determined by those skilled in the art based on the statistical confidence level of the normal response delay interval. This invention does not limit it to a single value. When the absolute value of the time slot offset value is higher than the preset time slot offset threshold, and the frequency of time slot anomalies is higher than the preset frequency threshold, the current communication interaction is judged as a time slot drift anomaly.

[0113] S5.5: Read the node communication interruption precursor index in the communication anomaly syndrome vector, determine whether the node communication interruption precursor is abnormal based on whether the node communication interruption precursor index exceeds the preset interruption precursor threshold, and output the determination result of the communication anomaly type.

[0114] In this embodiment of the application, the method for determining the abnormality of the node communication interruption precursor is as follows: when the node communication interruption precursor index is higher than the preset interruption precursor threshold, the inverter corresponding to the current node address is determined to be an abnormality of the node communication interruption precursor; otherwise, the inverter corresponding to the current node address does not trigger the determination of the abnormality of the node communication interruption precursor; the preset interruption precursor threshold is in the range of [0,1], and is preset according to the communication reliability requirements between the inverter and the main control unit.

[0115] The output method for determining the communication anomaly type is as follows: The determination conclusions for response mismatch anomaly, old frame playback anomaly, time slot drift anomaly, and node communication interruption precursor anomaly are sequentially written into the communication anomaly type determination record. This record is stored indexed by message sequence number and node address. When two or more communication interactions corresponding to the same communication anomaly syndrome vector are simultaneously established in the communication anomaly type determination, the record is marked as a composite communication anomaly, and all established communication anomaly types are listed in the record. If one type of anomaly is directly caused by another type (e.g., deviation caused by an abnormal response frame occurs simultaneously with node communication interruption precursor), the primary and secondary relationships are determined according to the time order: the anomaly type that occurred earlier is marked as the primary cause, and the other as the secondary cause, with the primary-secondary cause relationship noted in the record. When the determinations for response mismatch anomaly, old frame playback anomaly, time slot drift anomaly, and node communication interruption precursor anomaly are all invalid, the record is marked as normal communication.

[0116] It should be noted that the determination of each communication anomaly type in steps S5.1 to S5.5 is performed in the following order: response mismatch anomaly, old frame playback anomaly, time slot drift anomaly, and node communication interruption precursor anomaly. The determination of old frame playback anomaly is performed before the determination of time slot drift anomaly to ensure that the determination of time slot drift anomaly does not include old frame playback behavior in the scope of time slot drift anomaly. The determination of each communication anomaly type is independent of each other. Except for the execution order constraint between time slot drift anomaly and old frame playback anomaly, the determination conclusions of other communication anomaly types do not affect each other.

[0117] In an optional embodiment, when there is a node communication interruption precursor abnormality in the communication anomaly type determination record, the non-response record subset of the corresponding node address is further read, and the number of consecutive occurrences of the non-response request message record in the non-response record subset is counted. When the number of consecutive occurrences exceeds the preset consecutive non-response count threshold, the node communication interruption precursor abnormality is upgraded to node communication suspected interruption in the communication anomaly type determination record, so as to distinguish between two different severity levels of node communication availability anomalies: intermittent non-response and persistent communication interruption.

[0118] In summary, this invention provides a fine-grained data foundation for subsequent modeling by acquiring communication messages between the frequency converter and the main control unit and parsing multi-dimensional protocol fields. It constructs communication time slot fingerprints based on timing characteristics and a protocol state shadow model based on protocol fields, transforming intangible communication behavior into a quantifiable dynamic baseline and establishing a dual reference benchmark for anomaly detection. Furthermore, by inputting the current request message into the model to generate expected response messages and expected response time windows, and performing structured matching, it achieves accurate perception of communication interaction status from both protocol semantics and timing characteristics. By calculating protocol state deviation values ​​and time slot offset values ​​and generating a communication anomaly syndrome vector, it integrates multi-dimensional and multi-type anomaly features into a unified quantitative indicator, overcoming the vulnerability of single threshold judgments to interference. Finally, based on this syndrome vector, it accurately distinguishes four specific types: response mismatch anomaly, old frame playback anomaly, time slot drift anomaly, and node communication interruption precursor anomaly. In the case of composite anomalies, it introduces timing causality judgment to clarify the primary and secondary relationships, significantly improving the interpretability of diagnostic results and the guiding value for operation and maintenance decisions. Through the synergistic effect of the above steps, this invention not only achieves early, accurate, and interpretable detection of inverter communication anomalies, but also effectively enhances the security and reliability of industrial communication systems, providing solid technical support for predictive maintenance.

[0119] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for detecting communication anomalies in frequency converters based on intelligent diagnostics, characterized in that, include: Obtain communication message data between the frequency converter and the main control unit, and parse the node address, function code, register address, message sequence number, sending timestamp and response timestamp in the communication message data; A communication slot fingerprint is constructed based on the sending timestamp and the response timestamp, and a protocol state shadow model is constructed based on the node address, the function code, and the register address; The current request message is input into the protocol state shadow model to generate the expected response message and the expected response time window, and the actual response message is matched with the expected response message and the expected response time window. The protocol state deviation value and time slot offset value are calculated based on the matching results, and a communication anomaly syndrome vector is generated from the protocol state deviation value and the time slot offset value. The communication anomaly type is determined based on the communication anomaly syndrome vector, wherein the communication anomaly type includes response mismatch anomaly, old frame playback anomaly, time slot drift anomaly, and node communication interruption precursor anomaly.

2. The inverter communication anomaly detection method based on intelligent diagnostics as described in claim 1, characterized in that, The method for determining the type of communication anomaly includes: The determination conclusions of the response mismatch anomaly, the old frame playback anomaly, the time slot drift anomaly, and the node communication interruption precursor anomaly are sequentially written into the communication anomaly type determination record, wherein the communication anomaly type determination record is stored with the message sequence number and the node address as indexes. When the communication interaction corresponding to the same communication anomaly syndrome vector is simultaneously established in two or more categories in the communication anomaly type determination, the communication anomaly type determination record is marked as a composite communication anomaly, and all established communication anomaly types are listed in the communication anomaly type determination record; if one type of anomaly in the communication anomaly type is caused by the direct causal relationship of another type of anomaly, the primary and secondary relationships are determined according to the time order: the anomaly type that occurred earlier is marked as the primary cause, and the other type is marked as the secondary cause, and the primary cause-secondary cause relationship is noted in the record; If none of the following communication anomaly types are determined: response mismatch anomaly, old frame playback anomaly, time slot drift anomaly, and node communication interruption precursor anomaly, then the communication anomaly type determination record is marked as normal communication.

3. The inverter communication anomaly detection method based on intelligent diagnostics as described in claim 2, characterized in that, The determination of the response mismatch anomaly includes whether the protocol state deviation value exceeds a preset protocol deviation threshold and whether the protocol state deviation frequency exceeds a preset frequency threshold; the determination of the time slot drift anomaly includes whether the absolute value of the time slot offset value exceeds a preset time slot offset threshold and whether the time slot anomaly frequency exceeds the preset frequency threshold.

4. The inverter communication anomaly detection method based on intelligent diagnostics as described in claim 2, characterized in that, The method for determining the old frame playback anomaly is as follows: when the historical repeated matching result is marked as a suspected replay hit and the time slot offset value is negative, that is, when the time slot matching result is marked as an early response, the current communication interaction is determined to be an old frame playback anomaly. The method for determining the node communication interruption precursor anomaly is as follows: when the node communication interruption precursor index is higher than the preset interruption precursor threshold, the inverter corresponding to the current node address is determined to be a node communication interruption precursor anomaly; otherwise, the inverter corresponding to the current node address does not trigger the node communication interruption precursor anomaly determination.

5. The inverter communication anomaly detection method based on intelligent diagnostics as described in claim 2, characterized in that, The generation of the communication anomaly syndrome vector includes: Read the structure matching result from the current message matching record, and calculate the deviation of each field according to the matching status of each field in the structure matching result and the preset field weight to obtain the protocol state deviation value. Read the time slot matching result and the corresponding time slot offset from the current message matching record. Configure the sign of the time slot offset according to the type of the time slot matching result to obtain the signed time slot offset. Normalize the signed time slot offset with the half width of the normal response delay interval to obtain the time slot offset value. Based on the current message matching records of a consecutive preset number of windows under the same node address, count the number of times the structure matching result is marked as structure matching deviation or register address deviation within the preset number of windows, calculate the protocol status deviation frequency, and count the number of times the time slot matching result is marked as time slot lag or no response within the preset number of windows, calculate the time slot abnormal frequency. The number of times the time slot matching result is marked as unresponsive within the same preset window number under the same node address is counted, the cumulative count of unresponsiveness is calculated, and the unresponsiveness rate is calculated based on the ratio of the cumulative count of unresponsiveness to the preset window number to obtain the node communication interruption precursor index. Based on the protocol state deviation value, the time slot offset value, the protocol state deviation frequency, the time slot anomaly frequency, and the node communication interruption precursor index, a communication anomaly syndrome vector is generated by weighting and combining each component according to its preset component weight.

6. The inverter communication anomaly detection method based on intelligent diagnostics as described in claim 5, characterized in that, The method for configuring the signed time slot offset is as follows: If the time slot matching result is marked as an early response, the time slot advance is configured to a negative sign to obtain a signed time slot offset; if the time slot matching result is marked as a time slot lag, the time slot lag is configured to a positive sign to obtain a signed time slot offset. If the time slot matching result is marked as normal, the signed time slot offset is recorded as 0; if the time slot matching result is marked as no response, the signed time slot offset is set to a preset no response offset value.

7. The inverter communication anomaly detection method based on intelligent diagnostics as described in claim 1, characterized in that, The method for generating the expected response message includes: Read the current request message record from the communication message cache queue, extract the node address, function code, register address and message sequence number from the current request message record, and locate the protocol state node corresponding to the current request message record in the protocol state shadow model based on the node address to obtain the current protocol state node; Based on the current protocol state node, search the state transition table of the protocol state shadow model for all legal jump relationships corresponding to the current protocol state node and the jump probability corresponding to each jump relationship. Determine the target protocol state node pointed to by the legal jump relationship with the highest jump probability as the expected target protocol state node, and generate the expected response message based on the function code and register address in the expected target protocol state node.

8. The inverter communication anomaly detection method based on intelligent diagnostics as described in claim 7, characterized in that, The construction of the protocol state shadow model includes: Based on the protocol state transition frequency matrix, the transition probability of each transition relationship is calculated, and the legal transition relationship is determined. Using each of the protocol state nodes as state nodes and the legal transition relationship and the corresponding transition probability as state transition edges, a protocol state shadow model corresponding to each node address is constructed.

9. The inverter communication anomaly detection method based on intelligent diagnostics as described in claim 8, characterized in that, The method for constructing the protocol state transition frequency matrix includes: The combination of the node address, the function code, and the register address is defined as a protocol status node. A jump relationship from the source node to the target node is established, with the protocol status node corresponding to the current valid message record as the source node and the protocol status node corresponding to the next valid message record as the target node. The jump relationships of all adjacent valid message records in the communication message parsing record set are traversed and statistically analyzed to obtain a protocol state jump frequency matrix, wherein the row index of the protocol state jump frequency matrix is ​​the source node, the column index is the target node, and the matrix elements are the occurrence frequency of the corresponding jump relationship.

10. The inverter communication anomaly detection method based on intelligent diagnostics as described in claim 8, characterized in that, Methods for determining valid redirect relationships include: If the jump probability is higher than the preset jump probability threshold, the jump relationship is determined to be a legal jump relationship, and the legal jump relationship and the corresponding jump probability are written into the state transition table of the protocol state shadow model; If the jump probability is lower than the preset jump probability threshold, the jump relationship is determined to be a low-probability jump relationship, and the low-probability jump relationship and the corresponding jump probability are written into the low-probability jump record table of the protocol state shadow model.

Images