A method and system for secure firmware update of power distribution cabinets based on power grid status awareness

Abstract

This invention discloses a method and system for secure firmware update of power distribution cabinets based on grid state awareness, belonging to the field of power distribution technology. The invention calculates islanding confidence and generates a binary islanding status flag in real time through a background islanding detection task, maintaining it in a real-time state sequence. Upon receiving a firmware update command, it first performs rapid filtering based on the islanding status flag. If an island is detected, the update is immediately suspended; if the grid is connected, the islanding confidence is further verified by combining the protection threshold of the update scenario to decide whether to allow the update. During the update execution, continuous monitoring is performed, and the update is immediately stopped and an incremental snapshot rollback is executed upon a sudden islanding event. This invention links the grid islanding operation status with firmware update decisions, realizing a complete security mechanism from awareness to decision-making to sudden change protection. It effectively avoids the security risks caused by firmware updates under vulnerable islanding conditions, significantly improving the operational reliability of the power distribution cabinet and the intelligence level of firmware updates.

Description

Technical Field

[0001] This invention relates to the field of software update technology, specifically to a method and system for secure firmware update of power cabinets based on power grid status awareness. Background Technology

[0002] Power distribution cabinets, as core equipment for power distribution and protection in low-voltage power distribution systems, are widely used in industrial, commercial, and public utilities. With the large-scale grid connection of distributed photovoltaic, energy storage, and other new energy sources, the operating environment of power distribution cabinets is becoming increasingly complex. Remote firmware update functionality has become a standard feature of intelligent power distribution cabinets, used to fix security vulnerabilities, upgrade protection algorithms, and adapt to new energy access strategies. Existing firmware update technologies primarily focus on the security of the software itself, ensuring firmware integrity and source trustworthiness through digital signatures, encrypted transmission, and version verification. Simultaneously, embedded mechanisms such as breakpoint resumption and heartbeat monitoring ensure the reliability of the update process. However, the security boundaries of these technologies remain confined to the internal workings of the device, never incorporating the external power grid's operating status into the update decision-making process.

[0003] Islanding is a significant safety hazard unique to distributed generation systems. It refers to the uncontrolled islanding operation where distributed power sources continue to supply power to local loads after a grid outage due to faults or maintenance. In islanding, voltage and frequency are uncontrollable, short-circuit capacity is low, and user equipment is easily damaged, endangering the safety of line maintenance personnel. For a long time, islanding detection has been a research area within the power system relay protection field, with its technological achievements only used to trigger grid disconnection tripping. Firmware updates, on the other hand, belong to the embedded software engineering field, and the two have developed completely independently without any connection. This has led to a long-standing technological blind spot: when a power distribution unit is in a vulnerable islanding condition, if a firmware update is initiated, the controller restart and temporary loss of protection functions during the update process may overlap with the islanding grid anomalies, causing the fault to escalate or even a safety accident. Furthermore, if an islanding occurs suddenly during the update process, existing solutions lack real-time sensing and linkage protection mechanisms, making it impossible to safely stop and roll back the update. Therefore, there is an urgent need for a safety method that can deeply link the grid islanding state with firmware updates, breaking down the separation between the two technological fields and filling the safety gap where firmware updates only protect against software and not the environment. Summary of the Invention

[0004] To address the aforementioned problems in the existing technology, this invention provides a power cabinet firmware security update scheme based on power grid status awareness.

[0005] According to a first aspect of the present invention, a method for secure firmware update of a power cabinet based on power grid state awareness is proposed, comprising the following steps: S1: Collect electrical parameter characteristics of the power cabinet at a fixed sampling frequency, and perform islanding detection based on the electrical parameter characteristics to determine the real-time islanding state sequence. The real-time islanding state sequence includes islanding confidence and islanding state flag. The islanding state flag is either grid-connected state or islanding state. S2: In response to the received firmware update command, read the latest islanding state flag and islanding confidence level from the real-time islanding state sequence, and perform a two-level decision-making process: S2A: If the island status flag is island status, it is determined that the current update is in a suspended state, the firmware update is paused, and a timed retry mechanism is triggered; S2B: If the island status flag is in the grid-connected state, perform a second check on the island confidence based on the update protection threshold: if the confidence is lower than the update protection threshold, determine that the current state is allowed to update and execute the firmware update; otherwise, determine that the current state is suspended to update, suspend the firmware update, and trigger the timed retry mechanism. S3: After the firmware update is allowed, the firmware update process is executed, the new firmware is written to the storage area and the firmware switch is completed; S4: During the firmware update process, continuously read the latest status of the real-time island status sequence, make a mutation judgment based on the current update stage, and if the island mutation is determined, stop the current update process and roll back the system status to the running state before the update.

[0006] According to some embodiments, in the method of the first aspect of the present invention, step S4, which involves determining a mutation based on the current update stage, specifically includes: If the latest island status flag is an island status, it is directly determined to be an island mutation; If the latest islanding status flag is grid-connected, then the latest islanding confidence level is checked according to the protection threshold corresponding to the current update stage: if the confidence level is detected to exceed the protection threshold of the current stage, it is determined to be an islanding mutation.

[0007] According to some embodiments, in the method of the first aspect of the present invention, the protection threshold corresponding to the update phase is dynamically adjusted according to the execution phase of the firmware update: The complete firmware update process is divided into three stages: the partition erasure stage, the firmware writing stage, and the verification and reboot stage. The system vulnerability varies at each stage. Different island state confidence protection thresholds are preset for each stage. The protection thresholds are positively correlated with the vulnerability of the stage. Among them, the first protection threshold is the highest for the erase partition stage, the second protection threshold is the second highest for the firmware write stage, and the third protection threshold is the lowest for the verification and restart stage. The values ​​of the first protection threshold, the second protection threshold, and the third protection threshold are all lower than the preset islanding state determination threshold.

[0008] According to some embodiments, in the method of the first aspect of the present invention, step S1 includes: A passive islanding detection algorithm is run based on electrical parameter characteristics to obtain preliminary islanding decision results and their corresponding preliminary confidence levels. Determine the relationship between the initial confidence level and the preset first threshold: If the initial confidence level is higher than the first threshold, the initial confidence level is directly used as the current island confidence level, and the environmental sensor remains in a dormant state. If the initial confidence level is lower than the first threshold, the environmental sensor is activated to collect environmental information. Based on the pre-stored environmental reference information, the interference components in the current environmental information are eliminated to obtain the operating characteristics of the power cabinet itself. The electrical parameter characteristics and operating characteristics are input into the pre-trained fusion detection model to output the final island confidence level. Based on the island confidence score and the preset island state determination threshold, a binary island state flag is generated, and the island confidence score and the island state flag are written together into the real-time island state sequence.

[0009] According to some embodiments, in the method of the first aspect of the present invention, after completing the current round of islanding state detection, the environmental sensor automatically enters a sleep state until the confidence level of the next preliminary islanding decision is lower than a first threshold, at which point it will be reawakened to reduce system power consumption.

[0010] According to some embodiments, in the method of the first aspect of the present invention, triggering the timed retry mechanism includes: setting a retry interval using an exponential backoff algorithm, wherein the first retry interval is a first preset value, and the retry interval is doubled for each subsequent retry until the maximum retry interval is reached; if the island state continues for more than the preset duration, an update failure alarm message is automatically reported to the operation and maintenance platform.

[0011] According to some embodiments, the method of the first aspect of the present invention further includes an optimal update time window scheduling step after receiving the firmware update instruction and before the update execution step is started: Read local power grid status historical data within a preset historical time period. The historical data includes at least the number of islanding occurrences, voltage fluctuation level, and frequency fluctuation level for each time period. Aggregate statistics by time period to calculate the average islanding probability and average power grid fluctuation level for each time period; The time period with the lowest probability of islanding and the least degree of power grid fluctuation is selected by weighted sorting and used as the optimal update time window; Add the firmware update task to the scheduling queue and wait until the optimal update time window before starting the update execution steps.

[0012] According to some embodiments, in the method of the first aspect of the present invention, rolling back the system state to the running state before the update specifically includes: Before the firmware update's erase partition phase and firmware write phase begin, perform an incremental snapshot operation on the current running state to save the state of key data structures and registers in memory; When a sudden change in the island state is detected, the current update process is immediately stopped, and memory and register data are restored based on incremental snapshots; Once the status is restored, there is no need to restart the power cabinet controller, thus ensuring the continuous operation of the protection function.

[0013] According to some embodiments, the method of the first aspect of the present invention further includes a hardware root of trust verification step: Before the firmware update command is executed, a unique root key for the device is generated based on the Physically Unclonable Function (PUF), and the received firmware is digitally signed and verified using the root key. The chip temperature and operating voltage are collected in real time, and the decision threshold of the PUF response is dynamically adjusted according to the pre-stored temperature-voltage calibration table to compensate for the impact of environmental changes on the PUF output. When the island status is marked as islanded, the PUF key access interface is automatically locked, prohibiting any local reading of the root key, until the island status is restored to the grid-connected state and the interface is unlocked.

[0014] According to a second aspect of the present invention, a power cabinet firmware security update system based on power grid state awareness is proposed, comprising: The islanding detection module is used to: collect electrical parameter characteristics of the power cabinet at a fixed sampling frequency, perform islanding detection based on the electrical parameter characteristics, and determine the real-time islanding state sequence. The real-time islanding state sequence includes islanding confidence and islanding state flag, and the islanding state flag is either grid-connected state or islanding state. The update decision module is used to: respond to the received firmware update command, read the latest islanding state flag and islanding confidence in the real-time islanding state sequence, and perform a two-level decision judgment: If the island status flag is set to island status, the current state is determined to be a paused update state, firmware update is suspended, and a timed retry mechanism is triggered. If the island status flag is in the grid-connected state, a second check is performed on the island confidence based on the update protection threshold: if the confidence is lower than the update protection threshold, it is determined that the current state is allowed to update and the firmware update is executed; otherwise, it is determined that the current state is suspended to update, the firmware update is suspended, and a timed retry mechanism is triggered. The update execution module is used to: execute the firmware update process after firmware update is allowed, write the new firmware to the storage area and complete the firmware switch; The island mutation protection module is used to: continuously read the latest status of the real-time island status sequence during the firmware update process, make mutation judgments based on the current update stage, and if an island mutation is determined, stop the current update process and roll back the system status to the running state before the update.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. To address the issue that existing firmware update schemes only focus on the integrity of the software itself and ignore the islanded operation status of the external power grid, this invention calculates the island confidence level and generates a binary island status flag in real time through an independently running background island detection task. In update decision-making and mutation protection, a two-level linkage mechanism is adopted, which first uses the binary flag for rapid filtering and then uses the confidence level for fine verification. This realizes the closed-loop linkage between the power grid status and firmware update, effectively avoiding the security risks caused by performing updates under vulnerable islanded conditions.

[0016] 2. To address the issues of pure electrical parameter island detection being susceptible to interference and having low confidence in industrial environments, while continuous operation of multimodal sensors leads to excessive power consumption, this invention proposes a low-power multimodal detection method that primarily uses passive electrical parameter detection, only wakes up environmental sensors to collect information when the confidence level is below a threshold, and uses pre-stored environmental reference information to eliminate interference components before fusing and outputting the final confidence level. This method achieves a balance between detection accuracy and system power consumption.

[0017] 3. To address the issue that the vulnerabilities vary greatly at different stages of firmware updates and that a uniform protection threshold cannot balance security and update success rate, this invention achieves an optimal balance between security protection and update efficiency by pre-setting differentiated protection thresholds based on the positive correlation between the vulnerabilities at each stage and dynamically adapting the thresholds of the current stage in update decision-making and mutation protection.

[0018] 4. To address the issues of maintenance personnel lacking information on the daily cycle of power grid status, arbitrarily choosing update times that may result in updates being performed during periods of frequent power grid fluctuations, and the collective loss of protection functions due to multiple devices updating simultaneously during batch updates, this invention achieves intelligent batch maintenance by selecting the optimal update time window based on historical power grid status data and supporting cluster collaborative peak-shifting scheduling. This reduces update risks from the source and avoids gaps in protection functions.

[0019] 5. To address the issues that traditional firmware updates require a controller restart to restore the original state after an interruption, and the risk of temporary loss of protection functions during the restart process, which overlaps with the risk of islanding mutations, this invention performs incremental snapshots to save memory and register states before the vulnerable update phase. In the event of an islanding mutation, the snapshot is directly restored without restarting the controller, achieving millisecond-level safe rollback for continuous operation of protection functions.

[0020] 6. To address the issues of unreliable key generation due to the sensitivity of the PUF hardware root of trust to the environment, and insufficient key protection due to network failure and increased risk of local attacks in isolated states, this invention dynamically compensates the PUF decision threshold by pre-storing a temperature-voltage calibration table, and automatically locks the key access interface when the isolated flag is true, thus achieving physical-level key protection with wide environmental adaptability. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating an embodiment 1000 of the present invention of a power cabinet firmware security update method based on power grid status awareness. Figure 2 for Figure 1 A flowchart illustrating step S1 in Example 1000; Figure 3 for Figure 1 A flowchart illustrating the sub-step S4A of step S4 in Example 1000, which involves determining mutations based on the current update stage. Figure 4 for Figure 1 A flowchart illustrating the sub-step S4B of step S4 in Example 1000, which rolls back the system state to the running state before the update. Figure 5 This is a flowchart illustrating an embodiment 2000 of the present invention of a power cabinet firmware security update method based on power grid state awareness. Figure 6 This is a flowchart illustrating an embodiment 3000 of the present invention, which is a method for secure firmware update of a power cabinet based on power grid status awareness. Figure 7 This is a schematic diagram of an embodiment 4000 of a power cabinet firmware security update system based on power grid status awareness according to the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] Figure 1 This is a flowchart illustrating an embodiment 1000 of the power cabinet firmware security update method based on power grid state awareness according to the present invention. Figure 1 As shown, Example 1000 includes steps S1-S4.

[0024] In step S1, electrical parameter characteristics of the power cabinet are collected at a fixed sampling frequency. Islanding detection is performed based on these electrical parameter characteristics to determine the real-time islanding state sequence. The real-time islanding state sequence includes islanding confidence and an islanding state flag, which indicates either grid-connected status or islanded status. The core function of step S1 is to obtain accurate islanding state information, providing a reliable data foundation for subsequent firmware update decisions. The implementation process of step S1 is based on the following analysis: (1) Passive island detection Passive islanding detection determines islanding status by monitoring changes in electrical parameters at the point of common coupling (PCC). When a distributed generation system is operating normally connected to the main grid, the grid's robust short-circuit capacity effectively restrains the voltage and frequency at the PCC, maintaining stability. However, when the grid is disconnected due to a fault or maintenance, the distributed generation system supplies power to local loads independently, causing a sudden change in system impedance. This results in significant changes in electrical parameters at the PCC, such as voltage, frequency, phase, and harmonics. The passive detection method continuously monitors indicators such as voltage amplitude, frequency, rate of frequency change, voltage phase jump, and harmonic distortion rate, comparing these real-time measurements with preset thresholds. Islanding is determined when any indicator exceeds the threshold range.

[0025] However, passive detection methods have an inherent technical bottleneck: the non-detection zone. When the output power of a distributed power source is basically matched with the local load power, the voltage and frequency at the PCC may still remain within the normal operating range after islanding occurs. The passive detection algorithm cannot identify the islanding state from the electrical parameters, resulting in missed detections. Although the academic community has proposed a variety of improved passive detection methods, it is still difficult to fundamentally eliminate the non-detection zone, and the detection reliability in power matching scenarios cannot be guaranteed.

[0026] (2) Multimodal fusion detection To further eliminate NDZ and improve detection reliability, this solution introduces a multimodal fusion strategy of electrical parameters and environmental perception information. The core principle is that there are distinguishable differences in the electrical parameter characteristics, acoustic signatures, and vibration characteristics of the power cabinet between grid-connected and islanded states. Multi-dimensional information fusion can compensate for the detection blind spots of a single mode in specific scenarios, thereby achieving highly reliable islanded state identification across the entire operating range.

[0027] Acoustic fingerprint information can reflect the operating conditions of electromagnetic equipment such as transformers, switches, and capacitors, while vibration information can reflect the operating state of mechanical structures. Under both grid-connected and islanded operating modes, due to fundamental differences in the equivalent impedance of the power grid and the direction of power flow, the acoustic fingerprint spectrum distribution and vibration spectrum components of the equipment will exhibit measurable changes. By simultaneously acquiring electrical parameters, acoustic fingerprint signals, and vibration signals, extracting the feature sequences of each mode, and then using a fusion model, the decision uncertainty of a single mode under specific boundary conditions can be effectively overcome, significantly improving the accuracy and robustness of islanding detection.

[0028] The engineering implementation of the aforementioned multimodal detection scheme faces objective power consumption challenges: acoustic and vibration sensors require continuous operation to acquire continuous monitoring signals, while power cabinets typically employ an embedded architecture of MCU + sensors. Continuously operating high-sampling-rate multimodal sensors will significantly increase system power consumption. For power cabinets that are unattended for extended periods and rely on their own power supply or have limited power supply, this constitutes a practical deployment obstacle. This is precisely the core engineering problem that the threshold-driven on-demand wake-up strategy of this invention aims to solve.

[0029] (3) Optimization strategy of the present invention To address the aforementioned issues, step S1 of this invention proposes a confidence-driven multimodal sensor on-demand wake-up mechanism. The basic logic is as follows: only when the confidence level of passively detected pure electrical parameters falls below a set threshold, indicating that the current power grid condition may fall within the passively detected NDZ range, and the information from the electrical parameters is insufficient to make a high-confidence islanding decision, is the environmental sensor awakened to collect acoustic and vibration information for auxiliary discrimination. Conversely, when the confidence level of electrical parameter detection is sufficiently high, the environmental sensor remains dormant, and the islanding state can be reliably determined solely by pure electrical parameters. This strategy balances detection accuracy and system power consumption, finding the optimal solution between the accuracy of multimodal fusion detection and engineering feasibility.

[0030] In some specific embodiments, the specific implementation process of step S1 includes: running a passive islanding detection algorithm based on electrical parameter features to obtain a preliminary islanding decision result and its corresponding preliminary confidence level; determining the relationship between the preliminary confidence level and a preset first threshold: if the preliminary confidence level is higher than the first threshold, the preliminary confidence level is directly used as the current islanding confidence level, and the environmental sensor remains in a dormant state; if the preliminary confidence level is lower than the first threshold, the environmental sensor is woken up, environmental information is collected, and interference components in the current environmental information are eliminated based on pre-stored environmental reference information to obtain the operating characteristics of the power cabinet itself; the electrical parameter features and operating characteristics are input into a pre-trained fusion detection model to output the final islanding confidence level; based on the islanding confidence level and the preset islanding state determination threshold, a binary islanding state flag is generated, and the islanding confidence level and the islanding state flag are written together into the real-time islanding state sequence.

[0031] In step S2, in response to the received firmware update command, the latest islanding status flag and islanding confidence level in the real-time islanding status sequence are read, and a two-level decision judgment is performed. After receiving a firmware update command initiated remotely or locally, step S2 performs a two-level decision judgment based on the islanding status information maintained in real time in step S1, first coarsely screening and then finely correcting, to determine whether the current power grid operating conditions meet the security conditions for firmware update.

[0032] In some specific embodiments, the operational logic of the two-level decision-making process in step S2 is as follows: The first-level decision-making coarse screening uses a binary islanding status flag as input. Since step S1 has already discretized the final islanding confidence score into a binary flag, this flag represents a macroscopic conclusion about the current power grid operating state. If the flag indicates that the current state is islanded, it means that the power grid has entered a vulnerable operating condition with uncontrollable voltage and frequency and low short-circuit capacity. Initiating a firmware update under this state would pose an extremely high operational risk. Therefore, the first-level decision uses the islanding status flag as a criterion to quickly filter firmware update commands. Once an islanding status is detected, it is immediately determined to postpone the update without any further verification, and the retry mechanism is directly triggered. The logic of this strategy is that the threshold for identifying islanding status using a binary flag is relatively low. When the confidence score crosses the threshold and is determined to be islanded, the power grid has clearly entered an unsafe operating area, and there is no need to conduct further fine-grained confidence score comparisons; the update should be rejected directly.

[0033] The second-level decision refinement is triggered only when the islanding status flag is set to grid-connected in the first-level decision. At this point, the grid state superficially meets the update conditions, but the binary flag alone is insufficient to reflect the grid's stability margin. If the current grid is in a grid-connected state but experiences significant fluctuations, its islanding confidence level may be relatively high. In this case, although the grid has not yet been determined to be in an islanded state, its stability is already poor, and initiating a firmware update still carries certain risks. Therefore, the second-level decision introduces a protection threshold for the update scenario, adjusting the islanding confidence level... With this threshold Comparison: If Below This indicates that the current grid connection status is stable and reliable, and the power grid has sufficient short-circuit capacity and regulation capability, allowing for firmware updates; if Higher than However, it is still below the island detection threshold. This indicates that although the power grid has not entered an island state, its stability is insufficient, falling into a gray area. Updates should be postponed until the power grid stabilizes.

[0034] In some specific embodiments, in step S2, the system first receives a firmware update command. This command reception is independent of the power grid status and can still be performed normally even in islanded mode. This is because when the power cabinet is in islanded operation, although the power grid is disconnected from the upstream power grid, the communication module inside the power cabinet can usually still maintain a connection with the remote operation and maintenance platform through an independent communication link. If the update command is not received, the ability to automatically perform updates after islanding is restored will be completely lost, and emergency security patches will not be received. Therefore, the command reception process is not limited by any power grid status conditions; filtering based on the islanded status is only performed during the execution decision stage.

[0035] In some specific embodiments, in step S2, the system sends a query request to the real-time island state sequence to obtain the latest island state flag and island confidence level. To handle concurrent access, the circular buffer employs a mutual exclusion mechanism during read and write operations: when the update decision module or mutation protection module reads the state, if it detects that the island detection module is writing new data, the read operation will be blocked until the write is completed; conversely, if a write operation is being performed while a read operation is in progress, the write operation will be blocked until the read is completed. This mutual exclusion mechanism ensures data consistency and avoids the problem of reading incomplete data.

[0036] Optionally, in some specific embodiments, the bipolar decision-making process in step S2 includes: In step S2A, if the islanding status flag indicates an islanding state, the current state is determined to be a paused update, firmware update is suspended, and a timed retry mechanism is triggered. This determination is based on the following logic: the islanding status flag is generated according to an islanding determination threshold that matches the relay protection scenario. This indicates that the power grid has clearly entered islanded operation. In this state, the grid's voltage and frequency have deviated from the normal range, and its short-circuit capacity is extremely small. Immediately executing the firmware update process carries too high a risk and should be postponed.

[0037] In some specific embodiments, in step S2A, after determining that the update is to be postponed, the system performs the following operations: writes a "postponed" status record to the update task queue, including the determination timestamp, island confidence level, island status flag, and determination basis identifier; sets the update task to a waiting retry state and records the current number of retries; triggers a timed retry process; and returns an update postponement message to the remote operation and maintenance platform, the reply content including the postponement reason, current island confidence level, retry interval duration, and task ID.

[0038] In step S2B, if the islanding status flag indicates a grid-connected state, a secondary verification of the islanding confidence level is performed based on the update protection threshold: if the confidence level is lower than the update protection threshold, the current state is determined to be an allowed update state, and firmware update is executed; otherwise, the current state is determined to be a suspended update state, firmware update is suspended, and a timed retry mechanism is triggered. In step S2B, after the system enters the secondary decision-making stage, the protection threshold for the update scenario is obtained. And the final island confidence level Compare with this threshold.

[0039] In some specific embodiments, the protection threshold in step S2B It is a key criterion for distinguishing between stable grid-connected operating conditions and unstable boundary operating conditions. The value ranges from 0 to the island determination threshold. In between, the system adjusts the load type of the power cabinet, the grid connection conditions, and the on-site measured data. Perform calibration. Optionally, The calibration process is as follows: Phase 1: Determining the upper limit. For the power grid where the target power unit is located, collect data for 30 consecutive days under grid-connected conditions. Real-time values. (Drawn by plotting) Time series curves, statistics The daily average and standard deviation. During normal system operation, The typical value fluctuates in the range of 0 to 0.2. (Take...) That is, the upper bound calibration parameter of the upper limit protection threshold, where and The grid connection status in the past 30 days The recorded mean and standard deviation. The physical meaning of this value is: under normal operating conditions, The probability of exceeding this value is less than 5%, and fluctuations exceeding this value can be considered significant signs of power grid anomalies.

[0040] Phase Two: Determining the lower limit. Based on the ROC curve of the fusion detection model in step S1, calculate the maximum specificity threshold under 100% sensitivity conditions. This threshold is... This value reflects the lowest confidence threshold that can be set to ensure that no isolated events are missed. This serves as the lower bound calibration parameter for adjusting the protection threshold.

[0041] Phase Three: Determination and Calibration of the Final Threshold. If... ,but Select or The specific choice depends on the user's configuration, which prioritizes security over availability. This means there is a gap between the upper limit of confidence during normal operation and the lower limit of the ideal islanding protection threshold; typically, a threshold is selected. This is to ensure that updates can be temporarily suspended in a timely manner when obvious abnormal signs appear in the power grid.

[0042] In some specific embodiments, the secondary decision-making stage in step S2B will With the calibrated Comparison: like This indicates that the current power grid is not only in a grid-connected state but also operating stably and reliably, without any obvious signs of abnormal fluctuations. The system determines that the current state is one where updates are permitted, outputs a control signal to permit updates, the decision-making phase of step S2 ends, and the firmware update process proceeds to step S3 for update execution.

[0043] like This indicates that although the power grid is currently connected to the grid, the islanding confidence level is high, and the grid's operational stability is poor. There may be frequent load switching, harmonic pollution, or the grid may be at the NDZ boundary of power matching. If a firmware update is performed under these conditions, the grid's instability may be compounded by the temporary loss of protection functions during the update process, leading to increased risk. Therefore, the system determines that the update is currently suspended and triggers a retry and alarm handling procedure.

[0044] In some specific embodiments, optionally, the triggering timed retry mechanism in step S2 includes: setting a retry interval using an exponential backoff algorithm, with the first retry interval being a first preset value, and the retry interval doubling each time thereafter until the maximum retry interval is reached; if the island state continues for more than the preset duration, an update failure alarm message is automatically reported to the operation and maintenance platform.

[0045] The firmware update decision scheme of the present invention differs from the prior art in the following essential ways.

[0046] 1. Closed-loop linkage between island detection and firmware update In existing firmware update schemes, the state conditions checked by the device before performing an update are limited to the device's own internal state, without considering the operating state of the external power grid as a decision variable. This invention uses the islanded state as a prerequisite for firmware updates, forming a complete security closed loop of perception → decision → execution.

[0047] In terms of creativity, this distinction reflects the integration of knowledge across technical fields: islanding detection belongs to the field of power system relay protection, while firmware update belongs to the field of embedded software engineering. The two fields have long developed independently. When those skilled in the art are engaged in firmware update design, they usually only focus on the software's own digital signature and encrypted transmission, and do not naturally think of asking whether the current power grid is in an islanded state. Extending the firmware security boundary from the inside of the device to the external power grid environment is the core creative contribution of this invention.

[0048] 2. Originality of the two-tier decision-making architecture The two-level decision-making architecture of this invention—firstly, rapid filtering based on binary island state flags, and then fine-tuning the confidence level based on protection thresholds—is not disclosed in the firmware update field. Existing technologies either perform simple judgments based solely on binary states or perform continuous value judgments based solely on probability / confidence levels, but they do not organically integrate the two in a hierarchical filtering manner.

[0049] According to such Figure 1 In step S2 of the illustrated embodiment, the present invention achieves significant technical effects in the following aspects through the above-mentioned two-level decision-making linkage design: 1. Eliminates the security blind spot where firmware updates are disconnected from the power grid operating environment. Existing solutions make update decisions based solely on the firmware's digital signature and whether encrypted transmission passes, ignoring the external power grid status. This solution, through a two-level decision-making architecture, uses the power grid islanding status as the first security gate for updates, ensuring that firmware updates are only performed when the power grid is in a stable grid-connected condition, thus avoiding the risk of escalating faults that may occur during updates in vulnerable islanding conditions.

[0050] 2. Achieving a fine balance between security and availability. Traditional solutions either use a single decision criterion for all operating conditions or rely solely on the binary output of islanding detection as the sole criterion. This solution introduces a confidence calibration stage through a two-stage decision process, enabling the system to further identify the intermediate state of grid-connected but unstable conditions between the two coarse states of islanding and grid connection, thus achieving more refined risk management. By configuring updated thresholds differently, protection thresholds can be set according to grid characteristics and calibration procedures, flexibly adapting to the security requirements of different application scenarios.

[0051] In step S3, after the firmware update is permitted, the firmware update process is executed, the new firmware is written to the storage area, and the firmware switch is completed. In step S4, during the firmware update process, the latest status of the real-time island state sequence is continuously read, and a mutation judgment is made based on the current update stage. If an island mutation is determined, the current update process is terminated, and the system state is rolled back to the running state before the update.

[0052] Steps S3 and S4 together form a closed loop for firmware update execution and protection. Step S3 starts after step S2 determines that the update is allowed, and is responsible for safely writing the new firmware to the storage area and completing the switch to the running firmware. Step S4 continuously monitors the islanded state during the update process. Once a sudden change in islanded state is detected, the update is immediately stopped and a state rollback is performed. The core design idea of ​​these two steps is to equip the update process with an emergency protection mechanism that is linked to the grid state in real time, while ensuring the reliability of the update. This enables the system to quickly restore to the safe state before the update when the grid operating conditions change suddenly, avoiding the long-term loss of protection functions.

[0053] In some specific embodiments, the implementation process of the sub-step S4A in step S4, which judges the mutation based on the current update stage, includes: if the latest islanding status flag is an islanding status, it is directly judged as an islanding mutation; if the latest islanding status flag is a grid-connected status, the latest islanding confidence is verified according to the protection threshold corresponding to the current update stage; if the confidence is detected to exceed the protection threshold of the current stage, it is judged as an islanding mutation.

[0054] Figure 2 for Figure 1 A flowchart illustrating step S1 in Example 1000. (See attached diagram.) Figure 2 As shown, step S1 further includes steps S11-S14.

[0055] Step S11 involves running a passive islanding detection algorithm based on electrical parameter characteristics to obtain preliminary islanding decision results and their corresponding preliminary confidence levels. In some specific embodiments, step S11 is executed periodically as an independent background task, and its function is to independently perform the first round of islanding state prediction based on electrical parameters at the common coupling point within each sampling period.

[0056] In step S11, the system first samples the three-phase voltage and current at the grid connection point in real time at a fixed sampling frequency. Optionally, the recommended sampling frequency is not less than 4 kHz. The sampled data is obtained through voltage transformers and current transformers inside the power cabinet and undergoes hardware filtering circuitry to eliminate high-frequency noise.

[0057] Based on the acquired real-time data, the system performs parallel calculations on the following core electrical parameters: voltage amplitude Vrms, calculated using a half-cycle sliding window method, and the measured value is compared with the rated voltage in real time; system frequency f, calculated by measuring the time interval between adjacent zero crossings; frequency change rate ROCOF, obtained by differential calculation of frequency sampling values ​​over multiple consecutive cycles; voltage change rate ROCOV, obtained by differential calculation of the effective voltage values ​​of adjacent sampling cycles; voltage harmonic distortion rate THDv, extracted from the fundamental to the 50th harmonic using a fast Fourier transform algorithm, and the total harmonic distortion rate is calculated; and voltage phase angle θ, tracked by a phase-locked loop to monitor the voltage phase at the grid connection point and the phase angle change is monitored in real time.

[0058] The system's passive detection algorithm will initially determine that the current state is an island and output a corresponding high confidence level when any of the following conditions are met: Over / under voltage criterion: If the effective value of a phase voltage Vrms exceeds 85%~110% of the rated value, i.e. Vrms<0.85 pu or Vrms>1.10 pu, and the duration exceeds the set delay; Over / under frequency criterion: If the system frequency f exceeds the range of 49.5 Hz to 50.5 Hz (for 50 Hz systems) or 59.3 Hz to 60.5 Hz (for 60 Hz systems) and the duration exceeds the set delay; ROCOF (Rate of Change in Frequency) criterion: If the absolute value of df / dt exceeds a set threshold. The threshold can be set according to the system's inertial characteristics: for wind power systems, the typical threshold is 0.5 Hz / s; for photovoltaic systems, the typical threshold is 1 Hz / s to 2.5 Hz / s. If df / dt exceeds the threshold for three consecutive cycles, transient islanding protection is directly triggered. ROCOV (Rate of Change in Voltage) criterion: If the absolute value of dV / dt exceeds a set threshold, it is determined to be an islanded state; Harmonic distortion rate criterion: If THDv increases significantly and is accompanied by obvious abnormalities in electrical parameters; Combined criteria: When both ROCOF > threshold and Vrms < 0.9 pu are satisfied, it is determined to be an island state.

[0059] The above multiple criteria can be combined into a single confidence level using a weighted approach. A typical implementation method is as follows: taking the over / under frequency criterion as an example, a frequency deviation factor is defined. .when At that time, confidence components ;when hour, For the ROCOF criterion, the absolute value of df / dt is mapped to the confidence component. The final overall confidence level is calculated using a weighted average formula.

[0060] For the preliminary judgment result, a simple majority strategy is adopted: if p_elec > 0.5, the preliminary judgment is an islanded state; otherwise, it is a grid-connected state. This confidence level p_elec will be used for the wake-up decision of the multimodal sensor in step S12.

[0061] It should be noted that the above criteria do not all operate independently—the system can be configured with the enable status of multiple criteria and their respective action thresholds. For example, in locations equipped with high-efficiency filters and harmonic suppression devices, the harmonic criterion can be disabled to reduce the risk of false positives.

[0062] Step S12: Determine the relationship between the initial confidence level and the preset first threshold. Step S12 completes the evaluation of the initial confidence level and determines whether to wake up the environmental sensor based on this. The system uses the confidence level generated in step S11... Compare with a pre-calibrated first threshold T1.

[0063] In step S12A, if the initial confidence level is higher than the first threshold, the initial confidence level is directly used as the current islanding confidence level, and the environmental sensor remains in sleep mode. In step S12A, the system considers the current electrical parameters to be sufficiently reliable to reflect the grid connection / islanding status. At this time, the environmental sensor remains in sleep mode and does not participate in detection. The confidence level generated in step S11... It is directly output as the final island confidence score. Then proceed to step S13. Optionally, the environmental sensors include acoustic sensors and vibration sensors.

[0064] In step S12B, if the initial confidence level is lower than the first threshold, the environmental sensor is activated to collect environmental information. Based on the pre-stored environmental reference information, the interference components in the current environmental information are eliminated to obtain the operating characteristics of the power cabinet itself. The electrical parameter characteristics and operating characteristics are input into the pre-trained fusion detection model to output the final island confidence level.

[0065] In some specific embodiments, in step S12B, if the initial confidence level is lower than the first threshold, it indicates a high degree of power matching, and the passive detection is within the decision ambiguity region or NDZ. At this time, the system first enters a delay waiting phase and continuously monitors... Three cycles, only if within three cycles The wake-up process is only formally executed when all values ​​are ≤ the first threshold. This delay mechanism effectively avoids false sensor wake-ups caused by transient noise. After confirming the need for environmental auxiliary detection, the system performs the following operations: Sensor wake-up: A wake-up command is sent to the acoustic and vibration sensors via the GPIO control pins to switch them from sleep mode to operating mode. The system reads the sensor ID via the I2C or SPI bus to confirm that the wake-up status is normal.

[0066] Environmental information acquisition: Within a 1-second window, acoustic and vibration sensors are synchronously acquired at a sampling rate of 20 kHz. Data from each sensor is labeled and aligned with electrical parameter data at the same time to form a multimodal raw dataset.

[0067] Environmental interference elimination: The raw signals collected by the sensors include both the power cabinet's own operating signals and environmental noise. The system obtains from a pre-stored environmental interference baseline: the acoustic signature calibration table stores the frequency domain representation of the fixed noise spectrum. The vibration calibration table stores the time-frequency parameters of the fundamental frequency and harmonic components of the vibration. Optionally, in this scheme, interference cancellation adopts a normalized least mean square adaptive filtering algorithm: the filter coefficient vector is initialized to w(0) = 0, the regularization factor δ = 0.001, and the step size μ = 0.1; at each sampling time t, the reference noise signal x(t) is filtered by w(t) to generate the estimated noise signal y(t) = w^T(t)·x(t); the error signal e(t) = - y(t) is the estimated operating signal after noise removal; the filter coefficients are updated according to the formula w(t+1) = w(t) + μ·e(t)·x(t) / (δ + ‖x(t)‖²).

[0068] The algorithm runs continuously for a complete acquisition window, and finally outputs a one-dimensional sequence. This refers to the pure signal generated by the power cabinet itself without environmental interference. Furthermore, during algorithm execution, once the filter coefficients converge, updates cease, and the system enters steady-state tracking mode.

[0069] Feature extraction: from Extract the following time-frequency domain features: Time-domain characteristics: maximum value Minimum value Peak-to-peak value Root mean square energy, waveform factor, impulse factor, kurtosis, zero-crossing rate, and energy.

[0070] Frequency domain characteristics: Perform a 1024-point FFT to obtain the power spectral density PSD(k), and statistically analyze the centroid frequency, mean square frequency, frequency variance, spectral entropy, and bandpass energy ratio.

[0071] Joint features: The time-domain signal is mapped to a time-frequency distribution image using continuous wavelet transform, and then input into a pre-trained feature encoder to extract a 64-dimensional deep feature vector.

[0072] At this point, the self-operation feature extraction is complete. The system concatenates the electrical parameter features with the self-operation features into a multi-dimensional feature vector, ready to be input into the fusion detection model.

[0073] In some specific embodiments, the core of multimodal fusion detection in step S12 is to jointly analyze electrical parameter features and self-running features to generate a final island confidence score with higher accuracy than that of a single mode. The system employs a pre-trained confidence-guided feature-level fusion network to achieve this function. This network uses three parallel branches to process data from different modalities: the electrical feature processing branch uses a two-layer fully connected network with Dropout to map electrical parameters into 32-dimensional latent feature vectors; the acoustic signature feature processing branch extracts key time-frequency units through an attention mechanism, outputting a 32-dimensional acoustic signature feature vector; and the vibration feature processing branch uses a similar structure, also outputting a 32-dimensional vibration feature vector.

[0074] The feature vectors output from the three branches are concatenated into a 96-dimensional joint feature vector at the feature fusion layer. The fusion layer performs deep feature extraction through two sets of fully connected layers (128 neurons → 64 neurons → 32 neurons), each using the ReLU activation function. Batch normalization and whitening are employed during training to reduce the correlation between features. The final classification head is a fully connected layer with two output nodes, using the softmax activation function to output the network probabilities. And the probability of being an island Then the final island confidence level .

[0075] Optionally, the training phase of the fusion detection model requires a large amount of labeled data. During the data acquisition phase, the system synchronously records electrical parameters, acoustic signatures, and vibration sensor data under various operating conditions, and labels the true state of each sample manually or through simulation. Before training, all features are Z-score standardized: x' = (x - μ) / σ, where μ and σ are the mean and standard deviation of the training set, respectively. Model training uses the cross-entropy loss function and the Adam optimizer. To obtain a model with good generalization ability, an early stopping strategy is adopted during training: when the validation set loss does not decrease for 20 consecutive epochs, training is terminated and the model parameters are rolled back to the optimal state. During the inference phase, for new feature vectors, the system uses the trained model to calculate... After each test is completed, the decision record is saved to the local cache. Once the cache accumulates to a certain amount, it can be used for incremental fine-tuning of the model, enabling it to adapt to long-term changes in field operating conditions.

[0076] Step S13: Based on the island confidence score and a preset island state determination threshold, a binary island state flag is generated, and the island confidence score and island state flag are jointly written into the real-time island state sequence. In some specific embodiments, the implementation process of step S13 includes: First, Islanding state determination threshold widely used in relay protection scenarios Compare them. The typical value is 0.7, used to... This probability value translates to a binary island state in an engineering sense: if ,but That is, an isolated state; if ,but This refers to the grid-connected state.

[0077] After generating the binary flag, the system will and As combined data, it is written to the real-time island state sequence. The real-time island state sequence is a fixed-length circular buffer data structure that stores the N most recent detection results, with a timestamp appended to each detection result. The circular buffer contains three key pointers: a write pointer, a read pointer, and an overflow pointer. This sequence supports the following standard query interfaces: returning the latest island confidence; returning the latest island state flag; and batch queries.

[0078] Optionally, after completing the current round of islanding state detection, the environmental sensor automatically enters a sleep state and will only be woken up again when the confidence level of the next preliminary islanding decision is lower than the first threshold, so as to reduce system power consumption.

[0079] The island detection scheme of this invention differs from existing technologies in the following essential ways: 1. Introduce a confidence-driven multimodal on-demand wake-up mechanism into the field of island detection. In existing multimodal islanding detection literature, acoustic / vibration sensors are typically required to operate continuously to monitor device status. While this continuous mode ensures data continuity, it consumes excessive power, and the signals collected most of the time are not effectively used for islanding criteria, resulting in a waste of computing power and energy. This solution first detects electrical parameters and evaluates their confidence level, only waking up the sensor for auxiliary discrimination when the confidence level falls below a threshold, forming a dynamic strategy that prioritizes electrical detection and is supplemented by environmental perception.

[0080] 2. A confidence-driven fusion deterministic multimodal detection framework was constructed. Unlike existing technologies that stack multimodal detection without refining confidence level linkage, this solution introduces a confidence evaluation mechanism from the passive detection stage. This mechanism is used not only to determine whether the islanding threshold has been reached but also to decide whether to activate the acoustic / vibration sensor. The final confidence level output by the multimodal fusion network is further used for mutation protection and update verification in the secondary decision-making process. A two-level confidence structure is constructed: the initial confidence level is used for power consumption optimization decisions, and the final confidence level is used for subsequent decisions.

[0081] According to such Figure 2 The embodiment shown in the invention improves the accuracy under all operating conditions and eliminates the non-detection zone of the passive method in power matching scenarios. At the same time, the confidence-driven on-demand wake-up mechanism reduces the proportion of the operating time of the acoustic / vibration sensor, and the overall power consumption is only slightly increased compared to pure electrical parameter detection, which meets the requirements of long-term unattended operation of the power cabinet.

[0082] Figure 3 for Figure 1 A flowchart illustrating the sub-step S4A of step S4 in Example 1000, which involves determining mutations based on the current update stage. (See attached flowchart.) Figure 3 As shown, step S4A further includes steps SA1 and SA2.

[0083] In some specific embodiments, the mutation determination in step S4 adopts a two-level architecture similar to that in step S2, but with different objectives: step S2 is used for admission decisions before the update, while step S4 is used for real-time monitoring during the update process. The system reads the latest data in the real-time island state sequence at fixed intervals and performs the following determinations: Step SA1: If the latest islanding status flag indicates islanding, it is directly determined as an islanding transition. Step SA1 completes the first-level judgment based on the islanding status flag: if the latest islanding status flag is true, it means that the power grid has clearly entered islanding operation. Regardless of the current update stage, the update must be stopped immediately. This is because the voltage and frequency of the power grid in islanding mode have deviated significantly from the normal range, and any temporary loss of protection functions during the firmware update process could lead to a serious accident.

[0084] Step SA2: If the latest islanding status flag indicates grid connection, then verify the latest islanding confidence level based on the protection threshold corresponding to the current update stage. If the confidence level exceeds the protection threshold for the current stage, it is determined to be an islanding mutation. Step SA2 completes the second-level judgment based on the comparison between the confidence level and the stage threshold: If the islanding status flag is true or false, further check whether the latest islanding confidence level exceeds the protection threshold corresponding to the current update stage. If it does, it means that although the power grid has not reached the islanding determination standard, its stability has deteriorated to the point that it cannot safely complete the operation of the current stage, thus triggering an abort.

[0085] Optionally, the protection threshold corresponding to the update stage is dynamically adjusted according to the execution stage of the firmware update: the complete firmware update process is divided into the erase partition stage, the firmware write stage, and the verification and restart stage, and the system vulnerability varies in different stages; different island state confidence protection thresholds are preset for each stage, and the protection thresholds are positively correlated with the vulnerability of the stage. Among them, the first protection threshold is the highest in the erase partition stage, the second protection threshold is the second highest in the firmware write stage, and the third protection threshold is the lowest in the verification and restart stage; the values ​​of the first protection threshold, the second protection threshold, and the third protection threshold are all lower than the preset island state judgment threshold.

[0086] In some specific embodiments, this invention employs a classic AB partition update architecture. The internal Flash memory of the power cabinet controller is divided into two independent physical partitions: running partition A and backup partition B. Under normal circumstances, the system boots from partition A and runs the current firmware. When an update is required, the new firmware is written to partition B. After the writing is complete, a hardware switching signal points the boot pointer to partition B, and the device resets and boots from partition B, completing the firmware switch. This architecture ensures that even if an unexpected interruption occurs during the update process, the original firmware in partition A remains intact, and the system can roll back to partition A to continue running.

[0087] However, the AB partitioning architecture cannot completely eliminate the risks during the update process. Based on the internal logic of the update operation, the entire process can be divided into three phases with varying degrees of vulnerability: Wipe partition stage: Before writing new firmware, the system must first erase the old data stored in the target partition. If an interruption occurs during this stage, partition B may be partially erased, rendering it completely unusable. Although partition A can still boot normally at this point, the backup partition is corrupted and cannot be updated further, requiring manual recovery. Therefore, this stage is the most vulnerable.

[0088] Firmware write phase: New firmware data is written to the erased partition B in pages or byte streams. During the write process, the running firmware of partition A remains intact, and the system can still operate its protection logic normally. Even if the write process is interrupted, the data already written to partition B may be lost or incomplete, but since partition A is unaffected, the system can safely roll back to the original firmware, and can be erased and rewritten again during the next update. Therefore, the vulnerability of this phase is moderate.

[0089] Verification and Reboot Phase: After the firmware is written, the system performs an integrity verification on the new firmware in partition B. If the verification passes, it modifies the boot pointer to set partition B as the source partition for the next boot, and then performs a software reset. This phase is extremely short, and even if it is interrupted during this phase, the boot pointer may not have been completely modified, and the system will still boot from partition A on the next boot. Therefore, this phase has the lowest vulnerability.

[0090] Based on the differences in vulnerability at each stage, this invention presets different islanding confidence protection thresholds for each stage: the most stringent threshold is used for the erase partition stage, followed by the firmware write stage, and the lowest for the verification and reboot stage. The protection thresholds for all stages are lower than the threshold used in step S1 to determine the islanding state. This ensures that a halt is triggered only when the island confidence level has exceeded the stage tolerance limit but the explicit island standard has not been reached.

[0091] According to such Figure 3 In the implementation shown, the proposed solution dynamically matches the vulnerability differences during the update phase with the island protection threshold: While existing AB partitioning firmware update schemes differentiate between erasing, writing, and verification stages, their security measures typically apply a uniform approach to all stages. This scheme identifies the significant differences in the consequences of interruptions at different stages and accordingly presets different islanding confidence protection thresholds for each stage—the thresholds are more stringent for stages with higher vulnerabilities. This ensures security while avoiding overly conservative approaches that could lead to a decrease in update success rates. The innovation of this technical feature lies in its quantitative understanding of the vulnerabilities in the firmware update process and its deep coupling with power grid state awareness.

[0092] Figure 4 for Figure 1 A flowchart illustrating sub-step S4B of step S4 in Example 1000, which rolls back the system state to its running state before the update. (See attached flowchart.) Figure 4 As shown, step S4B includes steps SB1-SB2.

[0093] Traditional firmware update rollback schemes typically rely on A / B partition switching: after the update is aborted, it is only necessary to ensure that the boot pointer still points to the original running partition, and then the system is restarted via hardware reset. However, this approach has a drawback: the reset process causes the controller to restart, during which the protection functions are completely lost. Under abnormal power grid conditions such as islanding abrupt changes, the temporary loss of protection functions may directly lead to the expansion of the fault.

[0094] To address this issue, this solution introduces an incremental snapshot and state recovery mechanism. The principle is as follows: before the erase and write phases of the firmware update, an incremental snapshot of the current controller's operating state is performed. Only data that might be modified during the update process and is crucial for recovery is saved, rather than the entire memory image. When an islanding event is detected and triggers an abort, the system does not perform a reset. Instead, it directly restores the memory and register data based on the snapshot, allowing the controller to return to its pre-update operating state within microseconds to milliseconds, thus maintaining the continuity of protection functions.

[0095] Specifically, the execution process of step S4B includes: In step SB1, before the firmware update's erase partition phase and firmware write phase begin, an incremental snapshot operation is performed on the current running state to save key data structures and register states in memory. In some specific embodiments, step SB1 saves the controller's complete running state before the update so that it can be restored to the same state during rollback without a restart. The specific implementation steps are as follows: (1) Determine the snapshot content: Incremental snapshots save the following key data: Memory data includes the current values ​​of all global and static variables, as well as critical data structures in the heap and stack. Specifically, the system predefines critical data segments that need to be protected via the linker script; these segments contain variables related to the protection logic. Only the entire contents of this segment are copied during snapshotting.

[0096] Register status, including the status of CPU core registers, interrupt controller, and peripheral registers.

[0097] Task context: If the system is running a real-time operating system, it needs to save the handle of the currently running task, the task stack pointer, and the list of tasks to be run.

[0098] (2) Perform snapshot operation: The system disables all maskable interrupts to prevent the state from being changed during the snapshot process. Critical data segments are copied to a pre-reserved snapshot storage area. CPU register values ​​are obtained through hardware-provided register read instructions and stored in the snapshot area. The current task handle is obtained by calling the API, and the task context is saved. Interrupts are re-enabled.

[0099] In step SB1, the system performs a snapshot before the erase phase begins and an incremental snapshot before the write phase begins, saving only data blocks that have changed since the last snapshot to reduce snapshot overhead. For simplicity, a full snapshot can also be performed only before the erase phase, with no further snapshot updates in subsequent phases, as the state before the erase phase is sufficient for rollback.

[0100] In step SB2, when an islanding state change is detected, the current update process is immediately stopped, and memory and register data are restored based on incremental snapshots. State restoration is completed without restarting the power cabinet controller, ensuring continuous operation of the protection function. Specifically, in step SB2, when step S4A determines an islanding change, the system immediately performs the following operations: Abort the update process: Set a global abort flag. The erase or write loop in step S3 will detect this flag in the next iteration and exit the loop. At the same time, the system stops any ongoing Flash operations.

[0101] Restore snapshot state: Disable interrupts again. Copy data back to critical data segments from the snapshot memory, restoring global and static variables. Restore peripheral register configurations, restoring peripherals such as timers, ADCs, and GPIOs to their pre-update state. Restore CPU registers and jump to the address pointed to by the program counter saved in the snapshot to continue execution. Note that because the stack pointer is also restored, the system can seamlessly return to the task context that was interrupted before the update. Re-enable interrupts.

[0102] No reset required: Since all critical states have been restored, the controller can continue to operate normally for protection functions without performing a hardware reset. The time taken for the entire rollback process is mainly determined by memory copying and register restoration.

[0103] Log recording: The system will record this isolated incident event in the non-volatile log, including the time of occurrence, update stage, isolated confidence level at the time, and trigger type. Simultaneously, an update abort-isolated incident alert will be sent to the operations and maintenance platform.

[0104] According to such Figure 4 The implementation shown in this solution saves the key data segments and peripheral register states, and directly restores the field when an islanding change is detected, avoiding the interruption window of protection functions caused by reset, and significantly improving the survivability of power equipment under abnormal grid conditions.

[0105] Figure 5 This is a flowchart illustrating an embodiment 2000 of the power cabinet firmware security update method based on power grid state awareness according to the present invention. Figure 5As shown, Embodiment 2000 includes steps S201-S204, which are the same as steps S1-S4 in Embodiment 1000, and will not be described again here. Embodiment 2000 also includes an optimal update time window scheduling step ST after step S202 and before step S203, as follows: Figure 5 As shown, step ST further includes steps ST1-ST4.

[0106] In some specific embodiments, step ST is a pre-emptive intelligent scheduling stage in the firmware update process, located between the decision-making in step S202 and the update execution in step S203. Step ST utilizes the daily cycle pattern of the power grid operation status and selects the time period with the lowest islanding probability and the least power grid fluctuation based on historical statistical data to perform the firmware update, thereby reducing the probability of triggering islanding mutation protection during the update process and improving the update success rate.

[0107] The operating status of the power grid is not randomly distributed, but exhibits a clear daily cyclical pattern. Taking a distribution network with high penetration of distributed photovoltaic (PV) power as an example, the probability of islanding is usually lowest at night and in the early morning. At this time, PV output is zero, the grid is entirely powered by the main grid, there is no NDZ (No Power Displacement) problem under power matching scenarios, and the load is at its lowest, resulting in the most stable grid operation. During the day, especially in the afternoon, PV output fluctuates continuously, the grid's equivalent short-circuit capacity decreases, and the risk of islanding increases significantly. In addition, industrial power distribution units are often installed in factories or distribution rooms, and the voltage and frequency fluctuations of their lines also show a strong correlation with the production cycle. For example, during periods when large equipment is frequently started, short-term fluctuations in grid voltage and frequency increase significantly.

[0108] This invention utilizes historical data mining to automatically calculate the safest update time window for each power cabinet, eliminating the need for maintenance personnel to rely on subjective judgment or risky choices based on experience. Upon receiving an update command, the equipment does not execute it immediately but adds the update task to a scheduling queue, waiting for the optimal window before initiating the actual update process. This strategy reduces the probability of isolated incidents during the update process, forming a dual protection system of pre-emptive prevention and in-process protection together with the mutation protection mechanism in step S204.

[0109] Unlike existing solutions that determine power equipment upgrade windows based on historical load, which aim to reduce the impact of equipment upgrades on user electricity consumption and rely solely on load size as the core indicator, this invention's scheduling decisions revolve around two core security indicators: islanding risk and grid stability. It comprehensively assesses grid security through three dimensions: islanding probability, voltage, and frequency fluctuations, rather than focusing solely on load. The technical problems addressed and the decision-making logic of the two solutions differ significantly. The optimal update time window in this invention refers to the period with the lowest islanding probability and minimal grid fluctuations. The fundamental purpose of selecting this window for updates is to reduce the security risks of firmware updates, rather than optimizing user experience or load balancing.

[0110] In some specific embodiments, in step ST1, historical data of the local power grid status within a preset historical time period is read. The historical data includes at least the number of islanding occurrences, voltage fluctuation levels, and frequency fluctuation levels for each time period. When step S202 determines that an update is allowed, the system immediately enters the optimal window scheduling phase.

[0111] First, the system reads historical power grid status data within a preset historical period from local non-volatile memory. In some specific embodiments, the duration covered by the historical data is determined by the system configuration parameter HISTORYDAYS, typically 30 days. The data is organized in a two-dimensional structure of date + time period: with a basic recording period of days, each day is further divided into K time periods of fixed duration. The fineness of the time period division directly affects the scheduling accuracy. This scheme adopts a non-equal interval time period division strategy, using finer time granularity during periods of drastic changes in power grid status and coarser granularity during periods of relatively stable power grid status. Optionally, a specific embodiment of a time period division method is shown in Table 1 below: Table 1. Implementation Examples of Time Period Division Methods in the Optimal Update Time Window Scheduling Steps

[0112] In some specific embodiments, in step ST1, for each time period, the system records the following three types of data: (1) Number of isolated events. Every day, within each time period, the system records isolated events where the island confidence level first reaches the island determination threshold. The data structure of the isolated event record includes: time period identifier, date, occurrence time, island duration, and peak island confidence level. The number of isolated events is cumulatively counted by time period. If multiple isolated events occur within the same time period, the system records all information for each event sequentially.

[0113] (2) Voltage Fluctuation Level. During each sampling period, the system calculates the root mean square of the sliding window of the effective value of the three-phase voltage on the power cabinet input side in real time. The effective value of the three-phase voltage within the window is calculated every 5 seconds for the actual sampling sequence, and its average value is taken. The average value is compared with the rated voltage to calculate the voltage deviation percentage. At the end of each time period, the system calculates the standard deviation of the voltage deviation at all sampling points within that time period. The magnitude of the standard deviation directly reflects the severity of the voltage fluctuation within that time period. The value recorded in the Voltage Fluctuation Level field is the standard deviation of the voltage deviation percentage within that time period.

[0114] (3) Frequency fluctuation degree. At the grid connection point on the system side, the fundamental frequency f of the power grid is continuously monitored through a phase-locked loop. The frequency value is read every 5 seconds in the actual sampling sequence, and the percentage of frequency deviation is calculated. At the end of each time period, the system calculates the standard deviation of the frequency deviation of all sampling points in that time period, and the calculation logic is the same as that of the voltage deviation standard deviation. The value recorded in the frequency fluctuation degree field is the standard deviation of the frequency deviation.

[0115] In step ST2, statistics are aggregated by time period to calculate the average islanding probability and average grid fluctuation level for each time period. In some specific embodiments, in step ST2, the system summarizes historical data from the past 30 days by time period number and calculates three core statistics for each time period within the statistical period: average number of islanding occurrences, average voltage fluctuation level, and average frequency fluctuation level. Optionally, the specific processing logic is described as follows: The system iterates through the historical data records of the most recent HISTORYDAYS days.

[0116] For each time period number i (i = 0, 1, 2, …, 9), filter out all data records for that time period to form a set containing all valid historical data for that time period. Calculate the following statistical indicators for this set: Average island probability: The average occurrence rate of historical island events during this period.

[0117] Average voltage fluctuation: Calculate the mean of the standard deviation of the voltage deviation during this period.

[0118] Average frequency fluctuation: Calculate the mean of the standard deviation of the frequency deviation during this period.

[0119] Step ST3 involves using weighted sorting to select the time period with the lowest islanding probability and the least grid fluctuation as the optimal update time window. Based on the aggregated statistics calculated in step ST2, the system calculates a comprehensive security score for each time period and uses weighted sorting to select the time period with the lowest islanding probability and the least grid fluctuation as the optimal update time window.

[0120] Comprehensive Safety Scoring Model. The comprehensive safety score uses a weighted summation method, normalizing the three dimensions and combining them into a single evaluation score. The specific formula of the scoring model is as follows: First, the three indicators for each time period are normalized, mapping all indicators to the [0, 1] interval for weighted combination. Normalization aims to eliminate the influence of differences in the dimensions and magnitudes of different indicators on the scoring results. The weighting coefficients reflect the relative importance of different security indicators. Islanding has the most severe impact on updates; once islanding occurs during the update process, the system must perform a rollback, and the update task completely fails. Therefore, the islanding probability should have the highest weight. Although voltage and frequency fluctuations do not directly cause update failure like islanding events, excessive fluctuations increase the risk of missing protection functions during updates and also need to be included in the evaluation.

[0121] Optionally, in some specific embodiments, it is recommended to configure the weighting coefficients as follows: islanding probability w1 = 0.6, voltage fluctuation w2 = 0.2, and frequency fluctuation w3 = 0.2. This weighting allocation reflects the security assessment principle of prioritizing islanding risk and considering grid fluctuation as a secondary factor.

[0122] Step ST4 involves adding the firmware update task to the scheduling queue and waiting until the optimal update time window is reached before initiating the update execution process. In some specific embodiments, after selecting the optimal update time window in step ST4, the system adds the update task to the scheduling queue, sets the execution status to waiting for the optimal window, and records the window start time and window end time. The time complexity of the update task queue is O(1), eliminating the need to maintain complex data structures.

[0123] The system enters a waiting loop. During the waiting period, the system maintains the following operations: Periodically read the local system clock and calculate the difference between the current time and the window start time.

[0124] If the current time has entered the optimal window, the system exits the waiting loop and starts the firmware update execution process in step S3.

[0125] If the current time has exceeded the optimal window end time and the update has not yet started, the system will adopt the default update strategy and execute the update immediately, or return to steps ST2-ST3 according to the configuration, recalculate the next optimal window based on the latest historical data, and perform a new round of scheduling.

[0126] The two decision-making modes mentioned above can be flexibly configured in the system parameters. It is recommended to use the default window waiting mode in most application scenarios because, according to historical statistics, this window mode does indeed provide the best grid security. The delay caused by waiting a short period before updating is acceptable, and continuing to recalculate and schedule would only increase system complexity. However, for certain urgent update tasks, the operation and maintenance platform can include a flag when issuing update commands, forcing the system to skip the ST step scheduling and directly proceed to step S3 execution, ensuring rapid response capabilities in emergency situations.

[0127] In some specific embodiments, in step ST4, the exception handling process during the waiting process includes: During the waiting window, the system continues to execute the island detection task of step S1. If an island state is detected during the waiting process, the system will reset the state of the current update task, re-make the scheduling decision according to the retry mechanism of step S2, and record all information of this waiting process in the local log for post-event auditing and analysis by operation and maintenance personnel.

[0128] According to such Figure 5 The embodiment shown in this invention selects the period with the lowest probability of islanding and the least grid fluctuation to perform the update, proactively scheduling the update task's exposure time within the safest time window for grid operation. Compared to randomly selecting the update time, the probability of triggering islanding mutation protection during the firmware update process is reduced, and the delay caused by the waiting window is also controlled to within a few hours. For the vast majority of non-urgent update tasks, this delay is completely acceptable.

[0129] Figure 6 This is a flowchart illustrating an embodiment 3000 of the power cabinet firmware security update method based on power grid state awareness according to the present invention. Figure 6 As shown, Embodiment 3000 includes steps S301-S305. Steps S301-S304 are the same as steps S1-S4 in Embodiment 1000, and will not be repeated here. Step S305 is a hardware root of trust verification step, further including steps S51-S53. Step S305 of this invention integrates the physical unclonable function with the national cryptographic algorithm, constructing a defense-in-depth system through design. The main principles involved include: (1) Physically Unclonable Function (PUF) PUF (Programmable Array Fingerprint) utilizes uncontrollable process variations in integrated circuit manufacturing to generate a unique fingerprint for a device. During chip manufacturing, random physical fluctuations exist in processes such as photolithography, doping, and etching. Even identical circuit designs on the same wafer will exhibit non-replicable differences in their microscopic electrical characteristics. PUF circuits transform these microscopic differences into measurable digital responses, leveraging the physical unclonability to provide a unique hardware identifier for the chip, thus preventing device identity forgery.

[0130] Unlike traditional methods that store keys in non-volatile memory, the core advantage of PUF technology is that the root key is not stored anywhere, but is dynamically generated from the physical characteristics of the chip only when needed. Even if an attacker physically cuts open the chip, performs focused ion beam operations, or probes the internal bus, they will not be able to extract the root key because the key does not exist in any readable storage structure.

[0131] (2) Integration framework of PUF and national cryptographic algorithms The unique device identifier generated solely by PUF is insufficient for direct application to secure boot and firmware verification; it requires system integration with cryptographic algorithms. This solution employs an architecture that integrates the national cryptographic algorithms SM2 and SM3 with PUF.

[0132] SM3 is a Chinese national cryptographic hash algorithm, similar to SHA-256, which compresses messages of arbitrary length into a 256-bit hash value. SM2 is a Chinese national cryptographic public-key cryptographic algorithm, based on the elliptic curve discrete logarithm problem, using 256-bit elliptic curve parameters, providing security strength comparable to RSA-3072, but with a shorter key length and higher computational efficiency. The combination of PUF and SM2 / SM3 constitutes a complete hardware root of trust: SM3 is used to perform integrity hashing on the firmware, calculating the digital fingerprint of the firmware content; PUF generates a unique root key for the device, used to protect the secure generation and storage of the SM2 private key; SM2 uses the PUF-derived key for digital signature verification, confirming the firmware's credible origin and tamper-proof content. This combination highly unifies physical unclonability with cryptographic self-control.

[0133] (3) Enhancement mechanisms of environmental compensation and working condition perception The response of the same PUF circuit may exhibit slight differences under different temperatures and voltages. While these differences do not affect the macroscopic uniqueness of the device identity, in precise signature applications, any uncertain noise can lead to signature verification failure. To address this challenge, this solution pre-collects PUF responses at different temperatures and operating voltages during the factory manufacturing process, generating a temperature-voltage calibration table. With the aid of this calibration table, the system dynamically adjusts the PUF's decision threshold based on real-time sensed environmental parameters, ensuring consistent response under different operating conditions and significantly improving PUF reliability.

[0134] Meanwhile, this solution links islanded operation with PUF key protection. When the power cabinet is in islanded mode, the power grid is disconnected, remote monitoring fails, and the risk of local attacks increases significantly. Under this condition, the system automatically locks the PUF key access interface, prohibiting any read operation of the local root key. Even if an attacker gains control of the device's casing, they cannot export the root key or derived keys generated by the PUF through any software interface. The key interface is automatically unlocked only when the device returns to grid connection. This condition-aware key locking strategy adds an extra layer of physical protection in the highly vulnerable islanded operating mode.

[0135] Step S51: Before executing the firmware update command, a unique root key for the device is generated based on the Physically Unclonable Function (PUF). The received firmware is then digitally signed and verified using this root key. Step S51 is executed after step S302 determines that the update is allowed. The firmware update command includes a new firmware data package and an accompanying digital signature. The digital signature is generated by the firmware maintainer using their private key. The generation process is as follows: the new firmware data is hashed using SM3 to obtain a 256-bit firmware digest; this digest is then encrypted using the maintainer's SM2 private key to generate the digital signature.

[0136] In step S51, after receiving the firmware update command, the device first calls the PUF driver interface to obtain the current raw PUF response. The system inputs the raw PUF response into the key derivation function to generate a 256-bit device root key Kroot. This root key serves as the highest-level key for the device's hardware trust anchor point, never leaving the chip and cannot be read or written in plaintext by any software.

[0137] In some specific embodiments, step S51 completes the SM2 key pair generation and firmware signature verification. Based on the device root key Kroot, the system generates a unique SM2 public-private key pair for the device. After obtaining the SM2 key, the system uses the SM2 public key to verify the received firmware digital signature: first, it recalculates the new digest value of the new firmware data using the SM3 algorithm; then, it decrypts the digital signature using the SM2 public key to obtain the original digest value; finally, it compares whether the new digest value and the original digest value are completely consistent. If the verification passes, it indicates that the firmware source is trustworthy and the content has not been tampered with, and the firmware update process can continue to the subsequent scheduling and waiting stage; if the verification fails, the system should immediately reject this update request and return an alarm message indicating that the firmware signature is invalid to the operation and maintenance platform through a secure channel, while recording the failure event in the local security log.

[0138] Step S52: Real-time acquisition of chip temperature and operating voltage; dynamic adjustment of PUF response decision threshold based on pre-stored temperature-voltage calibration table to compensate for the impact of environmental changes on PUF output.

[0139] The raw PUF response is sensitive to fluctuations in temperature and supply voltage. In industrial environments with wide temperature ranges and fluctuating supply voltages, bit flipping can occur in the PUF response, meaning that the PUF output of the same device under extreme conditions differs from that under normal temperature conditions by several bits, directly affecting the accuracy of subsequent signature verification. To address this issue, in step S52, this solution designs a temperature-voltage calibration process before shipment and a dynamic compensation mechanism during operation, specifically including: (1) Generation of factory calibration table.

[0140] During the factory testing phase of the power cabinet control chip, the equipment is placed in a temperature-controlled test chamber, and combined scans are performed at preset temperature and voltage sampling points. At each (temperature, voltage) combination point, the system applies a fixed excitation to the PUF module, acquires the raw PUF response, and records this response as the reference value for that calibration point. Simultaneously, the system fits the temperature and voltage coefficients based on these sampling point data, compresses and stores this data into a compact calibration lookup table, and burns it into the on-chip non-volatile memory.

[0141] (2) Dynamic compensation process during runtime.

[0142] During actual operation, the device reads the current chip junction temperature through an integrated temperature sensor and monitors the chip's power supply voltage via an ADC. Based on the real-time collected temperature and voltage values, the system searches the calibration table to find the two nearest temperature sampling points and two nearest voltage sampling points, and uses a bilinear interpolation method to calculate the expected PUF response benchmark under the current operating conditions.

[0143] With the assistance of the calibration table, the PUF reading process is implemented as follows: When outputting each response bit, the PUF control logic inside the chip first refers to the statistical information of the corresponding bit in the nearest neighbor operating point in the calibration table. If a response bit is found to be in an unstable range, the control logic introduces a decision threshold offset factor to improve the stability of that bit. If necessary, the same PUF response can be sampled multiple times and the majority vote result can be taken, or the original response can be corrected using error correction codes. After dynamic compensation and error correction, the system finally reads a stable and unique original response from the PUF module, ensuring that the root key Kroot output under different operating temperatures and voltages remains consistent.

[0144] Step S53: When the island status flag is in island status, the PUF key access interface is automatically locked, prohibiting any local reading of the root key, until the island status is restored to the grid-connected status and the interface is unlocked.

[0145] Step S53 is a unique design feature of this scheme that links the hardware root of trust with the power grid state awareness. The specific implementation process includes: (1) Key interface locking in islanded state. During normal operation of the power cabinet, the islanded state flag output in step S301 is continuously monitored. When the islanded state flag changes from grid-connected state to islanded state, it indicates that the power cabinet is currently in islanded operation mode. At this time, the remote monitoring function may fail due to network interruption, and the risk of local physical attacks increases significantly. To address this risk, this solution automatically disconnects or blocks the connection between the PUF key interface and any software driver when the islanded state is triggered. All operations initiated by software, such as reading PUF responses, exporting derived keys, and accessing SM2 private keys, will be forcibly rejected by the hardware and an access prohibition status code will be returned.

[0146] (2) Exception handling during the lockout. When the PUF interface is locked, only the core security process for firmware updates running inside the device is allowed to continue. This type of access is authenticated through hardware signatures or a dedicated secure channel, and ordinary tasks or unauthorized software drivers cannot access the PUF module at all.

[0147] (3) Unlocking Conditions and Recovery Mechanism. After the islanded state returns to the grid-connected state, the system continues to monitor for a delay to ensure that the grid status is stable and the islanding flag is confirmed to be correct. Then, the hardware automatically unlocks the key access interface. After unlocking, PUF key access returns to normal. No key data is cleared or reset during the unlocking process, and the root key generated by PUF remains the device's unique hardware fingerprint. The entire locking-unlocking process is completed autonomously by the hardware logic without going through any tamperable software layer, fundamentally ensuring the security and anti-attack capability of the root of trust.

[0148] According to such Figure 6 The embodiments shown in the present invention have the following beneficial effects: 1. Improved PUF reliability under different environments. Through temperature-voltage calibration and dynamic compensation mechanisms, the reliability of the PUF response under different temperature and voltage conditions is significantly improved. The bit error rate of the calibrated and compensated PUF is lower than that of the uncompensated scheme, ensuring the stability of signature verification.

[0149] 2. Achieve dynamic security protection that adapts to operating conditions. In islanded mode, the PUF key interface is automatically locked, preventing all local key reading operations at the hardware level. During vulnerable periods of power grid disconnection, it provides additional physical protection for the equipment, compensating for the security gap caused by the failure of remote monitoring in islanded mode.

[0150] Figure 7 This is a schematic diagram of an embodiment 4000 of a power cabinet firmware security update system based on power grid state awareness according to the present invention. Figure 7As shown, embodiment 4000 includes an island detection module 401, an update decision module 402, an update execution module 403, and an island mutation protection module 404.

[0151] Islanding detection module 401 is used to: collect electrical parameter characteristics of the power cabinet at a fixed sampling frequency, perform islanding detection based on the electrical parameter characteristics, and determine the real-time islanding state sequence. The real-time islanding state sequence includes islanding confidence and islanding state flag, and the islanding state flag is either grid-connected state or islanding state.

[0152] The update decision module 402 is used to: respond to the received firmware update command, read the latest islanding state flag and islanding confidence in the real-time islanding state sequence, and perform a two-level decision judgment: If the island status flag is set to island status, the current state is determined to be a paused update state, firmware update is suspended, and a timed retry mechanism is triggered.

[0153] If the island status flag is in the grid-connected state, a second verification of the island confidence is performed based on the update protection threshold: if the confidence is lower than the update protection threshold, it is determined that the current state is allowed to update and the firmware update is executed; otherwise, it is determined that the current state is suspended to update, the firmware update is suspended, and a timed retry mechanism is triggered.

[0154] The update execution module 403 is used to: after firmware update is allowed, execute the firmware update process, write the new firmware to the storage area and complete the firmware switch.

[0155] The island mutation protection module 404 is used to: continuously read the latest status of the real-time island status sequence during the firmware update process, make mutation judgments based on the current update stage, and if an island mutation is determined, stop the current update process and roll back the system status to the running state before the update.

[0156] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0157] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for secure firmware update of power distribution cabinets based on power grid status awareness, characterized in that, Includes the following steps: S1: Collect electrical parameter characteristics of the power cabinet at a fixed sampling frequency, and perform islanding detection based on the electrical parameter characteristics to determine the real-time islanding state sequence. The real-time islanding state sequence includes islanding confidence and islanding state flag, and the islanding state flag is grid-connected state or islanding state. S2: In response to the received firmware update command, read the latest islanding state flag and islanding confidence level in the real-time islanding state sequence, and perform a two-level decision judgment: S2A: If the island status flag is in the island status, it is determined that the current update is in a suspended state, the firmware update is paused, and a timed retry mechanism is triggered; S2B: If the island status flag is in the grid-connected state, perform a second check on the island confidence based on the update protection threshold: if the confidence is lower than the update protection threshold, determine that the current state is allowed to update and execute the firmware update; otherwise, determine that the current state is suspended to update, suspend the firmware update, and trigger the timed retry mechanism. S3: After the firmware update is allowed, the firmware update process is executed, the new firmware is written to the storage area and the firmware switch is completed; S4: During the firmware update process, continuously read the latest status of the real-time island state sequence, make a mutation judgment based on the current update stage, and if an island mutation is determined, stop the current update process and roll back the system status to the running state before the update.

2. The method according to claim 1, characterized in that, The mutation determination based on the current update stage in step S4 specifically includes: If the latest island status flag is an island status, it is directly determined to be an island mutation; If the latest islanding status flag is grid-connected, then the latest islanding confidence level is checked according to the protection threshold corresponding to the current update stage: if the confidence level is detected to exceed the protection threshold of the current stage, it is determined to be an islanding mutation.

3. The method according to claim 2, characterized in that, The protection threshold corresponding to the update phase is dynamically adjusted according to the execution phase of the firmware update: The complete firmware update process is divided into three stages: the partition erasure stage, the firmware writing stage, and the verification and reboot stage. The system vulnerability varies at each stage. Different island state confidence protection thresholds are preset for each stage. The protection thresholds are positively correlated with the vulnerability of the stage. The first protection threshold is the highest for the erase partition stage, followed by the second protection threshold for the firmware writing stage, and the third protection threshold is the lowest for the verification and restart stage. The values ​​of the first protection threshold, the second protection threshold, and the third protection threshold are all lower than the preset islanding state determination threshold.

4. The method according to claim 1, characterized in that, Step S1 includes: Based on the electrical parameter characteristics, a passive islanding detection algorithm is run to obtain preliminary islanding decision results and their corresponding preliminary confidence levels; Determine the relationship between the initial confidence level and the preset first threshold: If the initial confidence level is higher than the first threshold, the initial confidence level is directly used as the current island confidence level, and the environmental sensor remains in a dormant state. If the initial confidence level is lower than the first threshold, the environmental sensor is activated to collect environmental information. Based on the pre-stored environmental reference information, the interference components in the current environmental information are eliminated to obtain the operating characteristics of the power cabinet itself. The electrical parameter features and the operational features are input into a pre-trained fusion detection model, and the final island confidence score is output. Based on the island confidence score and the preset island state determination threshold, a binary island state flag is generated, and the island confidence score and the island state flag are written together into the real-time island state sequence.

5. The method according to claim 4, characterized in that, After completing the current round of islanding state detection, the environmental sensor automatically enters a sleep state and will only be woken up again when the confidence level of the next preliminary islanding decision is lower than the first threshold, in order to reduce system power consumption.

6. The method according to claim 1, characterized in that, The triggering timed retry mechanism includes: using an exponential backoff algorithm to set the retry interval, with the first retry interval being a first preset value, and the retry interval doubling each time thereafter until the maximum retry interval is reached; if the island state continues for more than the preset time, an update failure alarm message will be automatically reported to the operation and maintenance platform.

7. The method according to claim 1, characterized in that, After receiving the firmware update command but before the update execution steps begin, an optimal update time window scheduling step is also included: Read local power grid status historical data within a preset historical time period. The historical data includes at least the number of islanding occurrences, voltage fluctuation level, and frequency fluctuation level for each time period. Aggregate statistics by time period to calculate the average islanding probability and average power grid fluctuation level for each time period; The time period with the lowest probability of islanding and the least degree of power grid fluctuation is selected by weighted sorting and used as the optimal update time window; The firmware update task is added to the scheduling queue, and the update execution steps are started after the optimal update time window is reached.

8. The method according to claim 1, characterized in that, The process of rolling back the system state to its previous running state specifically includes: Before the firmware update's erase partition phase and firmware write phase begin, perform an incremental snapshot operation on the current running state to save the state of key data structures and registers in memory; When a sudden change in the island state is detected, the current update process is immediately stopped, and the memory and register data are restored according to the incremental snapshot. Once the status is restored, there is no need to restart the power cabinet controller, thus ensuring the continuous operation of the protection function.

9. The method according to claim 1, characterized in that, It also includes a hardware root of trust verification step: Before the firmware update command is executed, a unique root key for the device is generated based on the Physically Unclonable Function (PUF), and the received firmware is digitally signed and verified using the root key. The chip temperature and operating voltage are collected in real time, and the decision threshold of the PUF response is dynamically adjusted according to the pre-stored temperature-voltage calibration table to compensate for the impact of environmental changes on the PUF output. When the island status is marked as islanded, the PUF key access interface is automatically locked, prohibiting any local reading of the root key, until the island status is restored to the grid-connected state and the interface is unlocked.

10. A power cabinet firmware security update system based on power grid status awareness, characterized in that, include: The islanding detection module is used to: collect electrical parameter characteristics of the power cabinet at a fixed sampling frequency, perform islanding detection based on the electrical parameter characteristics, and determine the real-time islanding state sequence. The real-time islanding state sequence includes islanding confidence and islanding state flag, and the islanding state flag is either grid-connected state or islanding state. The update decision module is used to: respond to a received firmware update command, read the latest islanding state flag and islanding confidence level in the real-time islanding state sequence, and perform a two-level decision judgment: If the island status flag is in an island state, it is determined that the current update is in a suspended state, the firmware update is paused, and a timed retry mechanism is triggered. If the island status flag is in the grid-connected state, the island confidence is checked a second time based on the update protection threshold: if the confidence is lower than the update protection threshold, it is determined that the current state is allowed to update and the firmware update is executed; otherwise, it is determined that the current state is suspended to update, the firmware update is suspended, and a timed retry mechanism is triggered. The update execution module is used to: execute the firmware update process after firmware update is allowed, write the new firmware to the storage area and complete the firmware switch; The island mutation protection module is used to: continuously read the latest status of the real-time island status sequence during the firmware update process, make mutation judgments based on the current update stage, and if an island mutation is determined, stop the current update process and roll back the system status to the running state before the update.

Images