A device behavior semantic fingerprint collaborative fault diagnosis method and system suitable for a power forward isolation environment

Abstract

The application discloses a kind of equipment behavior semantic fingerprint collaborative fault diagnosis method and system suitable for electric power positive isolation environment, first production control area carries out multi-source data acquisition and sliding window division, the multi-source time series data obtained is carried out feature extraction, segmented normalization processing and semantic coding processing, and binary semantic bit string is obtained, binary semantic bit string is gradually encapsulated into security fingerprint package and unidirectional transmission to management information area;Management information area constructs cross-factory fingerprint aggregation matrix to calculate fingerprint similarity, and based on fingerprint similarity, clustering recognition is carried out, while knowledge distillation is carried out, and the obtained lightweight update package is safely encapsulated and imported into production control area, after parameter updating based on lightweight update package, production control area carries out fault diagnosis, and obtains fault diagnosis result.The application realizes the collaborative evolution of multi-thermal power plant equipment diagnosis knowledge, and has safety compliance, low communication overhead, privacy protection, cross-factory adaptability and engineering deployability.

Description

Technical Field

[0001] This invention relates to the field of intelligent manufacturing and information security technology in the power industry, specifically a method and system for collaborative fault diagnosis of equipment behavior semantic fingerprints applicable to positive isolation environments in the power industry. Background Technology

[0002] Power monitoring systems are typically deployed according to security zones. The production control zone primarily handles real-time monitoring, protection control, and production operation functions, while the management information zone primarily handles business management, analysis and decision-making, and auxiliary operation and maintenance functions. In accordance with power industry network security protection requirements, data transmission between the production control zone and the management information zone is usually unidirectional, using a dedicated power-specific forward security isolation device. Data can only flow from the production control zone to the management information zone; the management information zone cannot access or control the production control zone via the online network.

[0003] The operating conditions of critical equipment in thermal power plants are complex, generating multi-source data such as vibration, current, temperature, pressure, speed, load rate, alarm records, and maintenance records during operation. Existing fault diagnosis methods mainly include fixed threshold alarms, expert rule diagnosis, statistical feature anomaly detection, and machine learning or deep learning intelligent diagnosis. These methods have certain application value in local diagnosis within a single plant, but they still have significant shortcomings in multi-plant collaborative diagnosis, cross-regional knowledge reuse, and positive isolation compliance deployment, mainly exhibiting the following deficiencies: (1) Limited cross-regional data sharing. Equipment operation data within the production control zone directly reflects the unit's operating status, equipment health level, control strategy, and production load, and is highly sensitive. Uploading raw time-series data, high-frequency waveform data, or complete feature data directly would not only result in a large data volume but also make it difficult to meet the data export security review requirements in the power production environment.

[0004] (2) Traditional centralized diagnostic solutions are difficult to implement. Existing centralized intelligent diagnostic methods usually require the raw data or complete training samples from each plant area to be aggregated to a central server for unified modeling. However, in a forward isolation environment, this approach is prone to problems such as high cross-regional data transmission load, complex format review, and significant privacy and security risks.

[0005] (3) Federated learning solutions rely on bidirectional communication. Traditional federated learning typically requires edge nodes to upload model gradients or parameters, and the central server to aggregate them before distributing the global model parameters offline to each node. This process relies on bidirectional communication links, which does not match the deployment requirements of forward isolation devices, which only allow unidirectional transmission from the production control area to the management information area, making it difficult to use directly in the power production control environment.

[0006] (4) Local models in a single plant area are difficult to reuse cross-plant fault experience. Different thermal power plants have different equipment models, intelligent acquisition unit configurations, operating loads, maintenance strategies and environmental conditions. The normal operating baseline and abnormal evolution mode of the same type of equipment are not completely consistent. If only historical data of a single plant area is relied upon to build a diagnostic model, problems such as insufficient fault samples, weak model generalization ability and high false alarm or false alarm rates are likely to occur.

[0007] (5) The data distribution differences among multiple plant areas lead to insufficient adaptability of the unified model. There are obvious non-independent identically distributed (Non-IID) characteristics between different plant areas. Simply using a unified threshold, unified rules or unified model parameter averaging method can easily lead to a decrease in diagnostic performance in some plant areas or under specific working conditions.

[0008] (6) Fault samples are scarce and labeling costs are high. Critical equipment is in normal operation most of the time, and the number of real fault samples is limited. Moreover, the confirmation of fault type usually requires a combination of maintenance records, expert judgment, and operation logs. If existing intelligent diagnostic models rely too much on a large number of labeled samples, it will be difficult to quickly form stable and reliable diagnostic capabilities in actual engineering.

[0009] (7) Lack of a compliant closed loop for updating diagnostic knowledge. How to safely, auditably, and rollbackably import new rules, new thresholds, fault mode prototypes, or lightweight model increments generated in the management information zone into the production control zone is a common challenge in existing systems. If an online reverse link is established, it does not meet the requirements of forward isolation; if it relies entirely on manual maintenance, the update cycle is long, inefficient, and prone to version inconsistencies. Summary of the Invention

[0010] The technical problem to be solved by the present invention is to provide a collaborative fault diagnosis method and system for device behavior semantic fingerprinting suitable for power positive isolation environments. It can achieve collaborative evolution of diagnostic knowledge of equipment in multiple thermal power plants without breaking the requirements of power positive isolation and security partitioning. It has the advantages of safety compliance, low communication overhead, privacy protection, cross-plant adaptability and engineering deployability.

[0011] The technical solution of this invention is as follows: A device behavior semantic fingerprint collaborative fault diagnosis method applicable to power positive isolation environments specifically includes the following steps: (1) Multi-source data acquisition and sliding window division are carried out in the production control area deployed at each edge node to obtain multi-source time series data of each device in each sliding window; (2) The production control area extracts equipment behavior feature vectors based on multi-source time series data and performs segmented normalization processing to obtain the normalized features of each equipment in each sliding window; (3) The production control area performs semantic encoding on the normalized features of each device in each sliding window to obtain a binary semantic bit string. Then, the binary semantic bit string is encapsulated into a device behavior semantic fingerprint and then encrypted and securely encapsulated to generate a secure fingerprint package. (4) The production control area transmits the security fingerprint package unidirectionally to the management information area through a dedicated power positive security isolation device; (5) The management information area performs fingerprint verification and classification archiving, and then constructs a cross-factory fingerprint aggregation matrix based on the binary semantic bit string in the security fingerprint package; (6) The management information area performs fingerprint similarity calculation based on the cross-factory fingerprint aggregation matrix, thereby clustering the binary semantic bit strings in each cross-factory fingerprint aggregation matrix to identify normal behavior clusters, minor abnormality clusters, suspected fault clusters and unknown abnormality clusters. (7) The management information area performs knowledge distillation to obtain a lightweight update package; (8) After the lightweight update package is securely packaged, it is imported into the production control area. The production control area updates the fault diagnosis parameters based on the imported offline security update package, performs fault diagnosis, and obtains the fault diagnosis results of each device in each time window at each edge node.

[0012] The production control area undergoes multi-source data acquisition and sliding window division, specifically as follows: S11. The intelligent acquisition unit of the production control area uses differentiated sampling frequencies to acquire multi-source data generated during equipment operation according to different signal types. The multi-source data includes high-frequency dynamic signals, medium-frequency electrical parameter signals and low-frequency process variable signals. S12. After cleaning, aligning timestamps, and handling missing values ​​according to a unified time base, set the length and step size of the sliding window, divide the sliding window, and obtain the device... In the sliding window Multi-source time series data within .

[0013] The production control area extracts equipment behavior feature vectors based on multi-source time-series data and performs segmented normalization processing to obtain the normalized features of each device within each sliding window, specifically: S21, Equipment In the sliding window Multi-source time series data within The device behavior feature vector is obtained by using a multi-source feature extraction function. , see the following formula (1) for details: (1); In equation (1), Representative equipment In the sliding window Internal device behavior feature vectors; This represents a multi-source feature extraction function, which includes time-domain feature extraction sub-functions, frequency-domain feature extraction sub-functions, time-frequency feature extraction sub-functions, higher-order statistical feature extraction sub-functions, and inter-device correlation feature extraction sub-functions; for the intelligent acquisition unit j in the sliding window sampling sequence within The time-domain feature extraction subfunction calculates the mean, standard deviation, peak-to-peak value, root mean square value, kurtosis, skewness, peak factor, waveform factor, and impulse factor. The frequency-domain feature extraction subfunction performs Fourier transform on signals suitable for frequency domain analysis and calculates the dominant frequency, spectral centroid, frequency variance, spectral entropy, and the energy proportion of the preset frequency band. The time-frequency feature extraction subfunction uses wavelet packet decomposition, short-time Fourier transform, or empirical mode decomposition to calculate subband energy and time-frequency energy distribution. The higher-order statistical feature extraction subfunction calculates the mean of the bispectral diagonal slice, bispectral entropy, and third-order cumulant. The equipment correlation feature extraction subfunction calculates the temperature difference, pressure difference, vibration phase difference, load response difference, correlation coefficient, and adjacent window variation between similar equipment in the same unit. S22, According to the equipment In the sliding window The average load rate, unit operating mode, and start-up / shutdown status within the unit will affect the equipment. sliding window The equipment is categorized into one of three operating conditions: low load, medium load, or high load. For each of these three areas, there are characteristic means and standard deviations generated based on historical data. In the sliding window The device behavior feature vector is normalized according to the following formula (2); (2); In equation (2), Representative equipment In the sliding window The normalization characteristics within, Representative equipment sliding window The characteristic mean of the included working condition section, Representative equipment sliding window The standard deviation of the included operating condition range, This represents the smallest positive number that prevents the denominator from being zero.

[0014] The production control area semantically encodes the normalized features of each device within each sliding window to obtain a binary semantic bit string. This binary semantic bit string is then encapsulated into a device behavior semantic fingerprint, followed by encrypted secure encapsulation to generate a secure fingerprint packet. Specifically: S31. Semantically encode the normalized features of each device within each sliding window. The semantic encoding uses random projection, locality-sensitive hashing, segmented quantization, Bloom coding, or a combination of the above methods to map the normalized feature vector into a binary semantic bit string. Under the same device type, the same operating condition segment, the same feature version, and the same fingerprint encoding version, the same version of semantic encoding rules are used. Among them, continuous features or projection results after random projection, locality-sensitive hashing, and segmented quantization are all discretized and symbolically quantized to form a binary semantic bit string. When using a combination method, either a parallel concatenation method or a step-by-step processing method can be adopted. The parallel concatenation method involves performing random projection, local sensitive hashing, segmented quantization, and Bloom coding on the normalized features respectively. The generated random projection bit string, hash bit string, segmented quantization bit string, and Bloom coding bit string are concatenated in a preset order to form the final binary semantic bit string. The step-by-step processing method involves first performing random projection and local sensitive hashing on the normalized feature vector, then performing segmented quantization on the obtained high contribution features or out-of-limit features, and finally performing Bloom coding on the discrete symbols to form the final binary semantic bit string. S32. Encapsulate the binary semantic bit string in each sliding window of each device into a device behavior semantic fingerprint. The device behavior semantic fingerprint encapsulates the device type code, device pseudo-anonymous number, operating condition section code, sliding window number, feature version number, fingerprint code version number, random projection matrix version number, binary semantic bit string, effective bit mask, bit frequency statistical summary, local anomaly score, data quality flag, event window flag and event type code. S33. Encrypt and securely encapsulate the device behavior semantic fingerprint, including the following steps: encrypt the device behavior semantic fingerprint using the public key of the management information area side; verify the integrity of the device behavior semantic fingerprint using a message authentication code or digital signature; bind the device type code, timestamp, fingerprint code version number, and operating condition segment code to the signature range; filter out duplicate uploads, uploads with abnormal frequency, and device behavior semantic fingerprints with abnormal formats to obtain a secure fingerprint package.

[0015] After being filtered by a whitelist and verified for protocol format, the security fingerprint packet is transmitted unidirectionally to the management information area through a dedicated power security isolation device. The whitelist filtering module is deployed on the forward isolation transmission link of the power-dedicated forward security isolation device. The whitelist includes the allowed edge node number, device type code, operating condition segment code, field name set, field length range, fingerprint code version number, random projection matrix version number, allowed event type code, and security algorithm suite number. For fields not in the whitelist, device behavior semantic fingerprints exceeding the length limit, unregistered device types, illegal version numbers, abnormal upload frequencies, or security fingerprint packets containing raw time-series data and complete continuous feature vectors, the whitelist filtering module intercepts them and records them in the audit log.

[0016] The management information area performs fingerprint verification and classification archiving, and then constructs a cross-factory fingerprint aggregation matrix based on the binary semantic bit string in the security fingerprint packet, specifically: S51. First, the security fingerprint package is verified for format, signature, timestamp, version, and duplicate package filtering. After passing the verification, it is classified and archived according to equipment type, operating condition segment, power plant, sliding window, and fingerprint encoding version number. S52. For security fingerprint packages uploaded from production control zones at different plant areas (i.e., different edge nodes) to the management information zone, the management information zone first groups them according to equipment type, operating condition segment, feature version, fingerprint encoding version number, and random projection matrix version number. Based on the binary semantic bit strings in security fingerprint packages of the same equipment type, same operating condition segment, same feature version, same fingerprint encoding version number, and consistent random projection matrix version number, a corresponding cross-plant fingerprint aggregation matrix is ​​constructed. , see the following formula (3) for details: (3); In equation (3), Each bit in the binary semantic bit string can be either 0 or 1; This represents the total number of devices that meet the criteria of the same device type, the same operating condition segment, the same feature version, the same fingerprint encoding version number, and the same random projection matrix version number. Represents the number of sliding windows; This represents the length of the binary semantic bit string.

[0017] The management information area performs fingerprint similarity calculations based on cross-factory fingerprint aggregation matrices, thereby clustering the binary semantic bit strings in each cross-factory fingerprint aggregation matrix to identify normal behavior clusters, minor anomaly clusters, suspected fault clusters, and unknown anomaly clusters. Specifically: S61. For binary semantic bit strings, fingerprint similarity is calculated using Hamming distance, Jaccard distance, cosine distance or weighted mixed distance. S62. Based on the fingerprint similarity calculation results, the binary semantic bit strings in each cross-factory fingerprint aggregation matrix are clustered to identify normal behavior clusters, minor abnormality clusters, suspected fault clusters and unknown abnormality clusters. For suspected fault clusters that appear consistently over a long period and are associated with maintenance records, alarm records, expert annotations, or comprehensive anomaly scores, they are categorized as candidate fault modes. For binary semantic bit strings that are not associated with clear fault labels but deviate significantly from normal behavior clusters, they are categorized as unknown anomaly clusters, and an anomaly mode report awaiting expert confirmation is generated.

[0018] The management information region undergoes knowledge distillation to obtain a lightweight update package, specifically: S71. Knowledge distillation is performed in the management information area: Knowledge distillation mainly includes rule distillation, threshold distillation and prototype distillation. Rule distillation generates fault diagnosis rules for the production control area based on suspected fault clusters. Threshold distillation generates warning distance thresholds, fault distance thresholds, risk score thresholds and alarm level thresholds for fault diagnosis in the production control area based on minor anomaly clusters and suspected fault clusters. Prototype distillation generates the normal behavior prototype set and fault mode prototype set required for fault diagnosis in the production control area based on normal behavior clusters and suspected fault clusters. S72. Based on the distillation results from knowledge distillation, the Management Information Zone generates a lightweight update package. This package includes threshold correction, rule weights, category prior probabilities, risk scoring coefficients, or low-rank adaptation parameters. Threshold correction includes adjustments for four thresholds: warning distance threshold, fault distance threshold, risk scoring threshold, and alarm level threshold. Rule weights represent the contribution of a fault diagnosis rule to risk scoring correction, determined by the rule's confidence, false alarm rate, and recall rate in historical playback. Category prior probabilities represent the ratio of different alarm levels or fault categories appearing in the historical fingerprint set under the same equipment type and operating condition segment. Risk scoring coefficients represent the weighting coefficients and bias terms required to calculate the comprehensive anomaly score during fault diagnosis in the Production Control Zone. Low-rank adaptation parameters are only applicable to scenarios where edge nodes have deployed lightweight models capable of receiving these parameters. If edge nodes have not pre-registered the corresponding model interface, low-rank adaptation parameters are not generated. Meanwhile, the management information area continuously updates the global knowledge base based on the security fingerprint packages constantly uploaded by the production control area at each edge node. The global knowledge base includes equipment type coding table, operating condition segment coding table, feature version information, fingerprint coding version information, random projection matrix version information, normal behavior prototype set, fault mode prototype set, anomaly cluster statistics, deployable rule base, early warning distance threshold, fault distance threshold, risk score threshold, alarm level threshold, rule replay verification results, expert review records, update package version records, compatibility declarations, deactivated version records, and audit logs.

[0019] The lightweight update package is securely encapsulated and then imported into the production control area. Based on the imported offline secure update package, the production control area updates the parameters for fault diagnosis and performs fault diagnosis to obtain the fault diagnosis results for each device at each edge node within each time window. Specifically: S81. The Management Information Zone securely encapsulates the lightweight update package into an offline secure update package containing digital signatures, version numbers, certificate chains, rollback information, and audit information. The offline secure update package is imported into the Production Control Zone via a hardware-encrypted USB flash drive or a controlled offline synchronization method. During the import process, the Production Control Zone of the edge nodes sequentially performs certificate validity verification, digital signature verification, package integrity verification, version compatibility verification, canary loading, failure rollback, and audit log recording. S82. Production control area updates parameters for fault diagnosis based on offline security update packages; S83, the binary semantic bit string of the current sliding window of a certain device, i.e., the current fingerprint is The set of normal behavior prototypes for the same operating condition range of this equipment is as follows: The set of failure mode prototypes is ,in, elements in This represents the i-th binary semantic bit string in the set of normal behavior prototypes. elements in This represents the j-th binary semantic bit string in the fault mode prototype set. and They represent and The total number of elements in the text; S84. Calculate the minimum distance from the current fingerprint to the normal behavior prototype set according to the following formula (5). ; (5); In equation (5), represent and The normalized weighted Hamming distance between them; when calculating Exceeding the set warning distance threshold When this happens, an alert is triggered; The average normal fingerprint distance under the same device type and the same operating condition is Standard deviation is The standardized outlier deviation is calculated using the following formula (6). ; (6); In equation (6), This represents the smallest positive number that prevents the denominator from being zero; S85. Calculate the minimum distance from the current fingerprint to the fault mode prototype set according to the following formula (7). ; (7); In equation (7), represent and The normalized weighted Hamming distance between them; when calculating Below the set fault distance threshold When this occurs, a fault warning is triggered; For a device behavior semantic fingerprint with a valid bitmask, equations (5) and (7) contain... and It is calculated by the following formula (8): (8); In equation (8), For equation (5) Or in equation (7) ; Represents the weight of the k-th element; The representative indicator function is the function that indicates the k-th bit in the current fingerprint. The kth position in the normal behavior prototype or failure mode prototype When the values ​​are different, the value is 1; when the values ​​are the same, the value is 0. The valid bit flag represents the k-th bit; a value of 1 indicates that the bit is involved in the calculation, and a value of 0 indicates that the bit is masked. S86. Calculate the comprehensive anomaly score according to the following formula (9). : (9); In equation (9), These are the weighting coefficients; For bias terms; Represents the fault prototype matching threshold This is used to determine whether the current fingerprint matches the fault mode prototype; The potential term represents the weighted average rate of change of the abnormal deviations of the most recent M sliding windows; This represents a data quality penalty, indicating a combined penalty for missing rate, low confidence ratio, and timestamp drift. Represents the sigmoid normalization function; The value ranges from 1 to 100; S87. Calculate the comprehensive anomaly score based on the risk scoring threshold and alarm level threshold. Make a judgment and output the alarm level; Risk scoring thresholds include: Suspected fault threshold and high-risk fault threshold ,and The alarm level thresholds include Level 1 Abnormal Level, Level 2 Suspected Fault Level, and Level 3 High-Risk Fault Level; when When, it is judged as normal; when When the condition is deemed minor, the alarm level is set to Level 1. When a suspected fault is detected, the alarm level is set to Level 2 suspected fault. When this occurs, it is determined to be a high-risk fault, and the output alarm level is level three high-risk fault level; The corresponding alarm level is output only when at least K windows in M ​​consecutive sliding windows reach the same alarm level.

[0020] A device behavior semantic fingerprint collaborative fault diagnosis system suitable for power positive isolation environment is characterized by comprising an edge perception layer, a fingerprint extraction layer, a cross-regional transmission layer, a knowledge inference layer, an update import layer, and a fault diagnosis layer. The edge sensing layer is deployed in the production control area of ​​each edge node to perform multi-source data acquisition and sliding window division, and to obtain multi-source time-series data of each device in each sliding window. The fingerprint extraction layer is deployed in the production control area of ​​each edge node. It is used to extract the device behavior feature vector, perform segmented normalization and semantic encoding, and gradually encapsulate the encoded binary semantic bit string into a security fingerprint packet. The cross-regional transmission layer transmits the security fingerprint packet unidirectionally to the management information area through a dedicated power-specific forward security isolation device; The knowledge inference layer is deployed in the management information area and is used for fingerprint verification, classification and archiving, construction of cross-factory fingerprint aggregation matrix, cluster recognition, knowledge distillation and generation of offline security update packages; The update import layer is used to import offline security update packages into the production control area; The fault diagnosis layer is deployed in the production control area of ​​each edge node. After updating the fault diagnosis parameters based on the imported offline security update package, fault diagnosis is performed to obtain the fault diagnosis results of each device in each time window at each edge node.

[0021] Advantages of this invention: (1) This invention transforms multi-source time-series data during equipment operation into binary semantic bit strings that are comparable, compact, and cannot be directly restored to sensitive parameters, and uses them as the smallest data unit for cross-regional collaborative diagnosis. While protecting the original multi-source time-series data and sensitive operating parameters, it still retains the similarity structure of equipment behavior, enabling the management information area to perform cross-plant clustering identification and knowledge distillation, thereby reducing the risk of data leaving the area.

[0022] (2) The security fingerprint package constructed on the production control area side of the present invention is transmitted unidirectionally to the management information area through the power-specific forward security isolation device. The fault diagnosis rules, thresholds, normal behavior prototype set and fault mode prototype set generated by the management information area are imported into the production control area through the offline security update package with digital signature. This avoids the problem of traditional federated learning relying on online two-way communication and global model reverse distribution, and is more in line with the requirements of security partitioning and horizontal isolation deployment of power monitoring system.

[0023] (3) The present invention constrains the binary semantic bit string according to equipment type, operating condition section, feature version and fingerprint encoding version, so that the binary semantic bit string of the same type of equipment under the same operating condition section is comparable, weakening the impact of differences in unit capacity, ambient temperature, operation strategy and sensor configuration in different thermal power plant areas, and improving the reliability and adaptability of cross-plant knowledge fusion.

[0024] (4) The management information area of ​​this invention constructs a cross-plant fingerprint aggregation matrix without touching the original data, and uses Hamming distance, Jaccard distance, cosine distance or weighted mixed distance to calculate fingerprint similarity and cluster recognition, which can discover common fault modes, unknown abnormal clusters and equipment prototype sets in multiple plants, and improve the ability to accumulate fault experience and reuse across plants.

[0025] (5) The management information area of ​​this invention does not directly aggregate model parameters, but distills fault diagnosis rules, thresholds, normal behavior prototype sets and fault mode prototype sets through knowledge distillation, reducing the dependence on large models and high computing power edge nodes, and facilitating stable deployment, rapid updates and interpretable fault diagnosis at edge nodes in the production control area.

[0026] (6) This invention uses unlabeled or weakly labeled binary semantic bit strings to perform clustering and identification to form candidate fault patterns. It is suitable for engineering scenarios where real fault samples of key equipment in thermal power plants are scarce and labeling standards are inconsistent. It can continuously improve diagnostic capabilities under limited labeling conditions.

[0027] (7) The offline security update package generated by the management information zone of this invention includes digital signature, version number, certificate chain, rollback information and audit information, and is actively verified and loaded by the production control zone, which facilitates security review, version tracking, fault rollback and responsibility audit by operation and maintenance personnel, and enhances the long-term maintainability of the power monitoring system in the power production environment. Attached Figure Description

[0028] Figure 1 This is a flowchart of the device behavior semantic fingerprint collaborative fault diagnosis method of the present invention.

[0029] Figure 2This is a schematic diagram of the principle of the device behavior semantic fingerprint collaborative fault diagnosis system of the present invention. Detailed Implementation

[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] See Figure 1 A collaborative fault diagnosis method based on device behavior semantic fingerprinting suitable for power positive isolation environments includes the following steps: (1) Multi-source data acquisition and sliding window division are performed on the production control areas deployed at each edge node to obtain multi-source time-series data of each device within each sliding window, specifically: S11. The intelligent acquisition unit in the production control area acquires multi-source data generated during equipment operation using differentiated sampling frequencies according to different signal types. The multi-source data includes high-frequency dynamic signals, medium-frequency electrical parameter signals, and low-frequency process variable signals. For high-frequency dynamic signals such as bearing vibration, shaft vibration, and housing vibration, the sampling frequency is set to 2kHz to 20kHz, preferably 5kHz or 12kHz. For medium-frequency electrical parameter signals such as motor three-phase current, voltage, and torque pulsation, the sampling frequency is set to 1kHz to 10kHz, preferably 2kHz. For low-frequency process variable signals such as bearing temperature, winding temperature, lubricating oil temperature, inlet pressure, outlet pressure, valve opening, speed, load rate, and ambient temperature, the sampling frequency is set to 1Hz to 10Hz, preferably 1Hz. S12. After cleaning, aligning timestamps, and handling missing values ​​according to a unified time base, set the length and step size of the sliding window, divide the sliding window, and obtain the device... In the sliding window Multi-source time series data within Length of the sliding window The time is set to 30 to 300 seconds, preferably 60 seconds; the sliding step size of adjacent sliding windows is set to 10% to 50% of the window length, preferably 15 seconds; for events such as equipment start-up and shutdown, load change, and alarm triggering, an additional event trigger window is generated as a sliding window, and the length of the event trigger window is from 30 seconds before the event to 120 seconds after the event. (2) The production control area extracts equipment behavior feature vectors based on multi-source time-series data and performs segmented normalization processing to obtain the normalized features of each device within each sliding window, specifically: S21, Equipment In the sliding window Multi-source time series data within The device behavior feature vector is obtained by using a multi-source feature extraction function. , see the following formula (1) for details: (1); In equation (1), Representative equipment In the sliding window For device behavior feature vectors within the current device or signal, the valid flag of the corresponding feature is set to 0, and it is masked by a valid bit mask during subsequent semantic encoding and distance calculation. This represents a multi-source feature extraction function, which includes time-domain feature extraction sub-functions, frequency-domain feature extraction sub-functions, time-frequency feature extraction sub-functions, higher-order statistical feature extraction sub-functions, and inter-device correlation feature extraction sub-functions; for the intelligent acquisition unit j in the sliding window sampling sequence within The time-domain feature extraction subfunction calculates the mean, standard deviation, peak-to-peak value, root mean square value, kurtosis, skewness, peak factor, waveform factor, and impulse factor to characterize the operating amplitude, impact degree, and waveform stability of the equipment. The frequency-domain feature extraction subfunction performs Fourier transform on signals suitable for frequency domain analysis to calculate the dominant frequency, spectral centroid, frequency variance, spectral entropy, and preset frequency band energy proportion to characterize spectral anomalies and energy distribution changes in rotating parts, bearings, motors, and other equipment. The time-frequency feature extraction subfunction uses wavelet packet decomposition, short-time Fourier transform, or empirical mode decomposition to calculate subband energy and time-frequency energy distribution to capture transient impacts, intermittent anomalies, and non-stationary fault signs. The higher-order statistical feature extraction subfunction calculates the mean of bispectral diagonal slices, bispectral entropy, and third-order cumulant to characterize nonlinear impacts and complex coupling fault characteristics. The equipment correlation feature extraction subfunction calculates the temperature difference, pressure difference, vibration phase difference, load response difference, correlation coefficient, and adjacent window changes between similar equipment in the same unit to reflect the cooperative behavior and abnormal deviations between equipment groups. S22, According to the equipment In the sliding window The average load rate, unit operating mode, and start-up / shutdown status within the unit will affect the equipment. sliding window The equipment is categorized into one of three operating conditions: low load, medium load, or high load. For each of these three areas, there are characteristic means and standard deviations generated based on historical data. In the sliding window The device behavior feature vector is normalized according to the following formula (2); (2); In equation (2), Representative equipment In the sliding window The normalization characteristics within, Representative equipment sliding window The characteristic mean of the included working condition section, Representative equipment sliding window The standard deviation of the included operating condition range, This represents the smallest positive number that prevents the denominator from being zero; through the normalization process of equation (2), the impact of differences in load levels of different units, seasonal environment and operating baseline on fingerprint similarity analysis can be reduced; (3) The production control area performs semantic encoding on the normalized features of each device within each sliding window to obtain a binary semantic bit string. Then, the binary semantic bit string is encapsulated into a device behavior semantic fingerprint, and then encrypted and securely encapsulated to generate a secure fingerprint package, specifically: S31. Semantically encode the normalized features of each device within each sliding window. The semantic encoding uses random projection, locality-sensitive hashing, segmented quantization, Bloom coding, or a combination of the above methods to map the normalized feature vector into a binary semantic bit string. Under the same device type, the same operating condition segment, the same feature version, and the same fingerprint encoding version, the same version of semantic encoding rules is used to make the binary semantic bit strings uploaded from different factories comparable. Among them, the continuous features or projection results after random projection, locality-sensitive hashing, and segmented quantization are all discretized and symbolically quantized to form a binary semantic bit string. When using a combination method, either a parallel concatenation method or a step-by-step processing method can be adopted. The parallel concatenation method involves performing random projection, local sensitive hashing, segmented quantization, and Bloom coding on the normalized features respectively. The generated random projection bit string, hash bit string, segmented quantization bit string, and Bloom coding bit string are concatenated in a preset order to form the final binary semantic bit string. The step-by-step processing method involves first performing random projection and local sensitive hashing on the normalized feature vector, then performing segmented quantization on the obtained high contribution features or out-of-limit features, and finally performing Bloom coding on the discrete symbols to form the final binary semantic bit string. For example, for Perform random projection and symbolic quantization to obtain a binary semantic bit string. ,in, The random projection matrix represents the corresponding working condition section. Represents the random projection bias vector; Represents the sign quantization function; S32. Encapsulate the binary semantic bit string in each sliding window of each device into a device behavior semantic fingerprint. The device behavior semantic fingerprint encapsulates the device type code, device pseudo-anonymous number, operating condition segment code, sliding window number, feature version number, fingerprint code version number, random projection matrix version number, binary semantic bit string, valid bit mask, bit frequency statistical summary, local anomaly score, data quality flag, event window flag, and event type code. Except for the binary semantic bit string, the other fields in the device behavior semantic fingerprint are obtained from the device ledger, desensitization mapping relationship, operating condition judgment result, window generation order, version configuration file, local diagnostic result, and data quality assessment result. S33. Encrypt and securely encapsulate the device behavior semantic fingerprint, including the following steps: encrypt the device behavior semantic fingerprint using the public key of the management information area side; verify the integrity of the device behavior semantic fingerprint using a message authentication code or digital signature; bind the device type code, timestamp, fingerprint code version number, and operating condition segment code to the signature range; filter out duplicate uploads, uploads with abnormal frequency, and device behavior semantic fingerprints with abnormal format to obtain a secure fingerprint package; (4) The production control area transmits the security fingerprint package to the management information area unidirectionally through the power-dedicated forward security isolation device. During transmission, the security fingerprint package is filtered by the whitelist and verified by the protocol format before being transmitted unidirectionally to the management information area. The whitelist filtering module is deployed on the forward isolation transmission link of the power-dedicated forward security isolation device. The whitelist includes the allowed edge node number, device type code, operating condition section code, field name set, field length range, fingerprint code version number, random projection matrix version number, allowed event type code, and security algorithm suite number. For fields not in the whitelist, device behavior semantic fingerprints exceeding the length limit, unregistered device types, illegal version numbers, abnormal upload frequencies, or security fingerprint packets containing raw time-series data and complete continuous feature vectors, the whitelist filtering module intercepts them and records them in the audit log. (5) The management information area performs fingerprint verification and classification archiving, and then constructs a cross-factory fingerprint aggregation matrix based on the binary semantic bit string in the security fingerprint package, specifically: S51. First, the security fingerprint package is verified for format, signature, timestamp, version, and duplicate package filtering. After passing the verification, it is classified and archived according to equipment type, operating condition segment, power plant, sliding window, and fingerprint encoding version number. S52. For security fingerprint packages uploaded from production control zones at different plant areas (i.e., different edge nodes) to the management information zone, the management information zone first groups them according to equipment type, operating condition segment, feature version, fingerprint encoding version number, and random projection matrix version number. Based on the binary semantic bit strings in security fingerprint packages of the same equipment type, same operating condition segment, same feature version, same fingerprint encoding version number, and consistent random projection matrix version number, a corresponding cross-plant fingerprint aggregation matrix is ​​constructed. (Three-dimensional matrix), see equation (3) below: (3); In equation (3), Each bit in the binary semantic bit string can be either 0 or 1; This represents the total number of devices that meet the criteria of the same device type, the same operating condition segment, the same feature version, the same fingerprint encoding version number, and the same random projection matrix version number. Represents the number of sliding windows; Represents the length of the binary semantic bit string; (6) The management information area performs fingerprint similarity calculation based on the cross-factory fingerprint aggregation matrix, thereby clustering the binary semantic bit strings in each cross-factory fingerprint aggregation matrix to identify normal behavior clusters, minor abnormality clusters, suspected fault clusters, and unknown abnormality clusters, specifically: S61. For binary semantic bit strings, fingerprint similarity is calculated using Hamming distance, Jaccard distance, cosine distance, or weighted mixed distance. The specific calculation of fingerprint similarity using Hamming distance is shown in the following formula (4): (4); In equation (4), Among multiple devices representing the same device type, the same operating condition segment, the same feature version, the same fingerprint encoding version number, and with the same random projection matrix version number, the devices With equipment Fingerprint similarity between them; Represents the length of the binary semantic bit string; and They represent two binary semantic bit strings respectively. and In the The value at each bit; This is an indicator function, which takes the value 1 when the condition is true and 0 otherwise. When the binary semantic bit string is obtained by Bloom coding or combined semantic coding, the fingerprint similarity is calculated by Jaccard distance. When the binary semantic bit string contains continuous summary statistics, the fingerprint similarity is calculated by cosine distance or weighted mixed distance. S62. Based on the fingerprint similarity calculation results, cluster the binary semantic bit strings of multiple devices with the same equipment type, the same working condition section, the same feature version, the same fingerprint encoding version number, and the same random projection matrix version number (the clustering algorithm adopts K-means, DBSCAN, hierarchical clustering or spectral clustering algorithm), thereby clustering the binary semantic bit strings in the cross-factory fingerprint aggregation matrix and identifying normal behavior clusters, slightly abnormal clusters, suspected fault clusters and unknown abnormal clusters; For suspected fault clusters that appear consistently over a long period and are associated with maintenance records, alarm records, expert annotations, or comprehensive anomaly scores, they are categorized as candidate fault modes; for binary semantic bit strings that are not associated with clear fault labels but deviate significantly from normal behavior clusters, they are categorized as unknown anomaly clusters, and an anomaly mode report awaiting expert confirmation is generated. (7) The management information zone performs knowledge distillation to obtain a lightweight update package, specifically: S71. Knowledge distillation is performed in the management information area: Knowledge distillation mainly includes rule distillation, threshold distillation and prototype distillation. Rule distillation generates fault diagnosis rules for the production control area based on suspected fault clusters. Threshold distillation generates warning distance thresholds, fault distance thresholds, risk score thresholds and alarm level thresholds for fault diagnosis in the production control area based on minor anomaly clusters and suspected fault clusters. Prototype distillation generates the normal behavior prototype set and fault mode prototype set required for fault diagnosis in the production control area based on normal behavior clusters and suspected fault clusters. S72. Based on the distillation results from knowledge distillation, the Management Information Zone generates a lightweight update package. This package includes threshold correction, rule weights, category prior probabilities, risk scoring coefficients, or low-rank adaptation parameters. Threshold correction includes adjustments for four thresholds: warning distance threshold, fault distance threshold, risk scoring threshold, and alarm level threshold. Rule weights represent the contribution of a fault diagnosis rule to risk scoring correction, determined by the rule's confidence, false alarm rate, and recall rate in historical playback. Category prior probabilities represent the ratio of different alarm levels or fault categories appearing in the historical fingerprint set under the same equipment type and operating condition segment. Risk scoring coefficients represent the weighting coefficients and bias terms required to calculate the comprehensive anomaly score during fault diagnosis in the Production Control Zone. Low-rank adaptation parameters are only applicable to scenarios where edge nodes have deployed lightweight models capable of receiving these parameters. If edge nodes have not pre-registered the corresponding model interface, low-rank adaptation parameters are not generated. Meanwhile, the management information area continuously updates the global knowledge base based on the security fingerprint packages constantly uploaded by the production control areas at each edge node. The global knowledge base is used to store and manage the diagnostic knowledge generated during cross-plant semantic fingerprint analysis. It includes equipment type coding tables, operating condition segment coding tables, feature version information, fingerprint coding version information, random projection matrix version information, normal behavior prototype set, fault mode prototype set, anomaly cluster statistics, a rule base that can be distributed, warning distance threshold, fault distance threshold, risk score threshold, alarm level threshold, rule replay verification results, expert review records, update package version records, compatibility statements, deactivated version records, and audit logs. (8) After the lightweight update package is securely packaged, it is imported into the production control area. The production control area updates the fault diagnosis parameters based on the imported offline secure update package, and then performs fault diagnosis to obtain the fault diagnosis results of each device and each time window at each edge node. Specifically: S81. The Management Information Zone securely encapsulates the lightweight update package into an offline secure update package containing digital signatures, version numbers, certificate chains, rollback information, and audit information. The offline secure update package is imported into the Production Control Zone via a hardware-encrypted USB flash drive or a controlled offline synchronization method. During the import process, the Production Control Zone of the edge nodes sequentially performs certificate validity verification, digital signature verification, package integrity verification, version compatibility verification, canary loading, failure rollback, and audit log recording. S82. Production control area updates parameters for fault diagnosis based on offline security update packages; S83, the binary semantic bit string of the current sliding window of a certain device, i.e., the current fingerprint is The set of normal behavior prototypes for the same operating condition range of this equipment is as follows: The set of failure mode prototypes is ,in, elements in This represents the i-th binary semantic bit string in the set of normal behavior prototypes. elements in This represents the j-th binary semantic bit string in the fault mode prototype set. and They represent and The total number of elements in the text; S84. Calculate the minimum distance from the current fingerprint to the normal behavior prototype set according to the following formula (5). ; (5); In equation (5), represent and The normalized weighted Hamming distance between them; when calculating Exceeding the set warning distance threshold When this happens, an alert is triggered; The average normal fingerprint distance under the same device type and the same operating condition is Standard deviation is The standardized outlier deviation is calculated using the following formula (6). ; (6); In equation (6), This represents the smallest positive number that prevents the denominator from being zero; S85. Calculate the minimum distance from the current fingerprint to the fault mode prototype set according to the following formula (7). ; (7); In equation (7), represent and The normalized weighted Hamming distance between them; when calculating Below the set fault distance threshold When this occurs, a fault warning is triggered; For a device behavior semantic fingerprint with a valid bitmask, equations (5) and (7) contain... and It is calculated by the following formula (8): (8); In equation (8), For equation (5) Or in equation (7) ; Represents the weight of the k-th element; The representative indicator function is the function that indicates the k-th bit in the current fingerprint. The kth position in the normal behavior prototype or failure mode prototype When the values ​​are different, the value is 1; when the values ​​are the same, the value is 0. The valid bit flag represents the k-th bit; a value of 1 indicates that the bit is involved in the calculation, and a value of 0 indicates that the bit is masked. S86. Calculate the comprehensive anomaly score according to the following formula (9). : (9); In equation (9), These are the weighting coefficients; For bias terms; Represents the fault prototype matching threshold This is used to determine whether the current fingerprint matches the fault mode prototype; The potential term represents the weighted average rate of change of the abnormal deviations of the most recent M sliding windows; This represents a data quality penalty, indicating a combined penalty for missing rate, low confidence ratio, and timestamp drift. Represents the sigmoid normalization function; The value ranges from 1 to 100; S87. Calculate the comprehensive anomaly score based on the risk scoring threshold and alarm level threshold. Make a judgment and output the alarm level; Risk scoring thresholds include: Suspected fault threshold and high-risk fault threshold The alarm level thresholds include Level 1 Abnormal Level, Level 2 Suspected Fault Level, and Level 3 High-Risk Fault Level; when When, it is judged as normal; when When the condition is deemed minor, the alarm level is set to Level 1. When a suspected fault is detected, the alarm level is set to Level 2 suspected fault. When this occurs, it is determined to be a high-risk fault, and the output alarm level is level three high-risk fault level; The corresponding alarm level is output only when at least K windows in M ​​consecutive sliding windows reach the same alarm level; M takes the value of 4 to 8, and K takes the value of 3 to 5. See Figure 2 A device behavior semantic fingerprint collaborative fault diagnosis system suitable for power positive isolation environment includes an edge perception layer, a fingerprint extraction layer, a cross-regional transmission layer, a knowledge inference layer, an update import layer and a fault diagnosis layer. The edge sensing layer is deployed in the production control area of ​​each edge node to perform multi-source data acquisition and sliding window division, and to obtain multi-source time-series data of each device in each sliding window. The fingerprint extraction layer is deployed in the production control area of ​​each edge node to extract the device behavior feature vector, perform segmented normalization and semantic encoding, and gradually encapsulate the encoded binary semantic bit string into a security fingerprint package. The cross-regional transmission layer transmits the security fingerprint packet unidirectionally to the management information area via a dedicated power-specific forward security isolation device; The knowledge inference layer is deployed in the management information area and is used for fingerprint verification, classification and archiving, construction of cross-plant fingerprint aggregation matrix, cluster recognition, knowledge distillation and generation of offline security update packages; The update import layer is used to import offline security update packages into the production control area; The fault diagnosis layer is deployed in the production control area of ​​each edge node. After updating the fault diagnosis parameters based on the imported offline security update package, fault diagnosis is performed to obtain the fault diagnosis results of each device in each time window at each edge node.

[0032] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A device behavior semantic fingerprint collaborative fault diagnosis method suitable for power forward isolation environments, characterized in that: Specifically, it includes the following steps: (1) Multi-source data acquisition and sliding window division are carried out in the production control area deployed at each edge node to obtain multi-source time series data of each device in each sliding window; (2) The production control area extracts equipment behavior feature vectors based on multi-source time series data and performs segmented normalization processing to obtain the normalized features of each equipment in each sliding window; (3) The production control area performs semantic encoding on the normalized features of each device in each sliding window to obtain a binary semantic bit string. Then, the binary semantic bit string is encapsulated into a device behavior semantic fingerprint and then encrypted and securely encapsulated to generate a secure fingerprint package. (4) The production control area transmits the security fingerprint package unidirectionally to the management information area through a dedicated power positive security isolation device; (5) The management information area performs fingerprint verification and classification archiving, and then constructs a cross-factory fingerprint aggregation matrix based on the binary semantic bit string in the security fingerprint package; (6) The management information area performs fingerprint similarity calculation based on the cross-factory fingerprint aggregation matrix, thereby clustering the binary semantic bit strings in each cross-factory fingerprint aggregation matrix to identify normal behavior clusters, minor abnormality clusters, suspected fault clusters and unknown abnormality clusters. (7) The management information area performs knowledge distillation to obtain a lightweight update package; (8) After the lightweight update package is securely packaged, it is imported into the production control area. The production control area updates the fault diagnosis parameters based on the imported offline security update package, performs fault diagnosis, and obtains the fault diagnosis results of each device in each time window at each edge node.

2. The device behavior semantic fingerprint collaborative fault diagnosis method applicable to a power forward isolation environment according to claim 1, characterized in that: The production control area undergoes multi-source data acquisition and sliding window division, specifically as follows: S11. The intelligent acquisition unit of the production control area uses differentiated sampling frequencies to acquire multi-source data generated during equipment operation according to different signal types. The multi-source data includes high-frequency dynamic signals, medium-frequency electrical parameter signals and low-frequency process variable signals. S12. After cleaning, aligning timestamps, and handling missing values ​​according to a unified time base, set the length and step size of the sliding window, divide the sliding window, and obtain the device... In the sliding window Multi-source time series data within .

3. The device behavior semantic fingerprint collaborative fault diagnosis method applicable to a power forward isolation environment according to claim 1, characterized in that: The production control area extracts equipment behavior feature vectors based on multi-source time-series data and performs segmented normalization processing to obtain the normalized features of each device within each sliding window, specifically: S21, Equipment In the sliding window Multi-source time series data within The device behavior feature vector is obtained by using a multi-source feature extraction function. , see the following formula (1) for details: （1）； In equation (1), Representative equipment In the sliding window Internal device behavior feature vectors; This represents a multi-source feature extraction function, which includes time-domain feature extraction sub-functions, frequency-domain feature extraction sub-functions, time-frequency feature extraction sub-functions, higher-order statistical feature extraction sub-functions, and inter-device correlation feature extraction sub-functions; for the intelligent acquisition unit j in the sliding window sampling sequence within The time-domain feature extraction subfunction calculates the mean, standard deviation, peak-to-peak value, root mean square value, kurtosis, skewness, peak factor, waveform factor, and impulse factor. The frequency-domain feature extraction subfunction performs Fourier transform on signals suitable for frequency domain analysis and calculates the dominant frequency, spectral centroid, frequency variance, spectral entropy, and the energy proportion of the preset frequency band. The time-frequency feature extraction subfunction uses wavelet packet decomposition, short-time Fourier transform, or empirical mode decomposition to calculate subband energy and time-frequency energy distribution. The higher-order statistical feature extraction subfunction calculates the mean of the bispectral diagonal slice, bispectral entropy, and third-order cumulant. The equipment correlation feature extraction subfunction calculates the temperature difference, pressure difference, vibration phase difference, load response difference, correlation coefficient, and adjacent window variation between similar equipment in the same unit. S22, According to the equipment In the sliding window The average load rate, unit operating mode, and start-up / shutdown status within the unit will affect the equipment. sliding window The equipment is categorized into one of three operating conditions: low load, medium load, or high load. For each of these three areas, there are characteristic means and standard deviations generated based on historical data. In the sliding window The device behavior feature vector is normalized according to the following formula (2); （2）； In equation (2), Representative equipment In the sliding window The normalization characteristics within, Representative equipment sliding window The characteristic mean of the included working condition section, Representative equipment sliding window The standard deviation of the included operating condition range, This represents the smallest positive number that prevents the denominator from being zero.

4. The device behavior semantic fingerprint collaborative fault diagnosis method applicable to a power forward isolation environment according to claim 1, characterized in that: The production control area semantically encodes the normalized features of each device within each sliding window to obtain a binary semantic bit string. This binary semantic bit string is then encapsulated into a device behavior semantic fingerprint, followed by encrypted secure encapsulation to generate a secure fingerprint packet. Specifically: S31. Semantically encode the normalized features of each device within each sliding window. The semantic encoding uses random projection, locality-sensitive hashing, segmented quantization, Bloom coding, or a combination of the above methods to map the normalized feature vector into a binary semantic bit string. Under the same device type, the same operating condition segment, the same feature version, and the same fingerprint encoding version, the same version of semantic encoding rules are used. Among them, continuous features or projection results after random projection, locality-sensitive hashing, and segmented quantization are all discretized and symbolically quantized to form a binary semantic bit string. When using a combination method, either a parallel concatenation method or a step-by-step processing method can be adopted. The parallel concatenation method involves performing random projection, local sensitive hashing, segmented quantization, and Bloom coding on the normalized features respectively. The generated random projection bit string, hash bit string, segmented quantization bit string, and Bloom coding bit string are concatenated in a preset order to form the final binary semantic bit string. The step-by-step processing method involves first performing random projection and local sensitive hashing on the normalized feature vector, then performing segmented quantization on the obtained high contribution features or out-of-limit features, and finally performing Bloom coding on the discrete symbols to form the final binary semantic bit string. S32. Encapsulate the binary semantic bit string in each sliding window of each device into a device behavior semantic fingerprint. The device behavior semantic fingerprint encapsulates the device type code, device pseudo-anonymous number, operating condition section code, sliding window number, feature version number, fingerprint code version number, random projection matrix version number, binary semantic bit string, effective bit mask, bit frequency statistical summary, local anomaly score, data quality flag, event window flag and event type code. S33. Encrypt and securely encapsulate the device behavior semantic fingerprint, including the following steps: encrypt the device behavior semantic fingerprint using the public key of the management information area side; verify the integrity of the device behavior semantic fingerprint using a message authentication code or digital signature; bind the device type code, timestamp, fingerprint code version number, and operating condition segment code to the signature range; filter out duplicate uploads, uploads with abnormal frequency, and device behavior semantic fingerprints with abnormal formats to obtain a secure fingerprint package.

5. The device behavior semantic fingerprint collaborative fault diagnosis method applicable to a power forward isolation environment according to claim 1, characterized in that: After being filtered by a whitelist and verified for protocol format, the security fingerprint packet is transmitted unidirectionally to the management information area through a dedicated power security isolation device. The whitelist filtering module is deployed on the forward isolation transmission link of the power-dedicated forward security isolation device. The whitelist includes the allowed edge node number, device type code, operating condition segment code, field name set, field length range, fingerprint code version number, random projection matrix version number, allowed event type code, and security algorithm suite number. For fields not in the whitelist, device behavior semantic fingerprints exceeding the length limit, unregistered device types, illegal version numbers, abnormal upload frequencies, or security fingerprint packets containing raw time-series data and complete continuous feature vectors, the whitelist filtering module intercepts them and records them in the audit log.

6. The device behavior semantic fingerprint collaborative fault diagnosis method applicable to a power forward isolation environment according to claim 1, characterized in that: The management information area performs fingerprint verification and classification archiving, and then constructs a cross-factory fingerprint aggregation matrix based on the binary semantic bit string in the security fingerprint packet, specifically: S51. First, the security fingerprint package is verified for format, signature, timestamp, version, and duplicate package filtering. After passing the verification, it is classified and archived according to equipment type, operating condition segment, power plant, sliding window, and fingerprint encoding version number. S52. For security fingerprint packages uploaded from production control zones at different plant areas (i.e., different edge nodes) to the management information zone, the management information zone first groups them according to equipment type, operating condition segment, feature version, fingerprint encoding version number, and random projection matrix version number. Based on the binary semantic bit strings in security fingerprint packages of the same equipment type, same operating condition segment, same feature version, same fingerprint encoding version number, and consistent random projection matrix version number, a corresponding cross-plant fingerprint aggregation matrix is ​​constructed. , see the following formula (3) for details: （3）； In equation (3), Each bit in the binary semantic bit string can be either 0 or 1; This represents the total number of devices that meet the criteria of the same device type, the same operating condition segment, the same feature version, the same fingerprint encoding version number, and the same random projection matrix version number. Represents the number of sliding windows; This represents the length of the binary semantic bit string.

7. The device behavior semantic fingerprint collaborative fault diagnosis method applicable to a power forward isolation environment according to claim 6, characterized in that: The management information area performs fingerprint similarity calculations based on cross-factory fingerprint aggregation matrices, thereby clustering the binary semantic bit strings in each cross-factory fingerprint aggregation matrix to identify normal behavior clusters, minor anomaly clusters, suspected fault clusters, and unknown anomaly clusters. Specifically: S61. For binary semantic bit strings, fingerprint similarity is calculated using Hamming distance, Jaccard distance, cosine distance or weighted mixed distance. S62. Based on the fingerprint similarity calculation results, the binary semantic bit strings in each cross-factory fingerprint aggregation matrix are clustered to identify normal behavior clusters, minor abnormality clusters, suspected fault clusters and unknown abnormality clusters. For suspected fault clusters that appear consistently over a long period and are associated with maintenance records, alarm records, expert annotations, or comprehensive anomaly scores, they are categorized as candidate fault modes. For binary semantic bit strings that are not associated with clear fault labels but deviate significantly from normal behavior clusters, they are categorized as unknown anomaly clusters, and an anomaly mode report awaiting expert confirmation is generated.

8. The device behavior semantic fingerprint collaborative fault diagnosis method applicable to a power forward isolation environment according to claim 7, characterized in that: The management information region undergoes knowledge distillation to obtain a lightweight update package, specifically: S71. Knowledge distillation is performed in the management information area: Knowledge distillation mainly includes rule distillation, threshold distillation and prototype distillation. Rule distillation generates fault diagnosis rules for the production control area based on suspected fault clusters. Threshold distillation generates warning distance thresholds, fault distance thresholds, risk score thresholds and alarm level thresholds for fault diagnosis in the production control area based on minor anomaly clusters and suspected fault clusters. Prototype distillation generates the normal behavior prototype set and fault mode prototype set required for fault diagnosis in the production control area based on normal behavior clusters and suspected fault clusters. S72. Based on the distillation results generated by knowledge distillation, the Management Information Zone generates a lightweight update package. This package includes threshold correction, rule weights, category prior probabilities, and risk scoring coefficients or low-rank adaptation parameters. Threshold correction includes corrections for four thresholds: warning distance threshold, fault distance threshold, risk scoring threshold, and alarm level threshold. Rule weights represent the contribution of a fault diagnosis rule to risk scoring correction, determined based on the rule's confidence, false alarm rate, and recall rate in historical playback. Category prior probabilities represent the ratio of different alarm levels or fault categories appearing in the historical fingerprint set under the same equipment type and operating condition segment. Risk scoring coefficients represent the weighting coefficients and bias terms required to calculate the comprehensive anomaly score during fault diagnosis in the Production Control Zone. Low-rank adaptation parameters are only applicable to scenarios where edge nodes have already deployed lightweight models that can receive such parameters. If the edge nodes have not pre-registered the corresponding model interface, low-rank adaptation parameters will not be generated. Meanwhile, the management information area continuously updates the global knowledge base based on the security fingerprint packages constantly uploaded by the production control area at each edge node. The global knowledge base includes equipment type coding table, operating condition segment coding table, feature version information, fingerprint coding version information, random projection matrix version information, normal behavior prototype set, fault mode prototype set, anomaly cluster statistics, deployable rule base, early warning distance threshold, fault distance threshold, risk score threshold, alarm level threshold, rule replay verification results, expert review records, update package version records, compatibility declarations, deactivated version records, and audit logs.

9. The device behavior semantic fingerprint collaborative fault diagnosis method applicable to a power forward isolation environment according to claim 8, characterized in that: The lightweight update package is securely encapsulated and then imported into the production control area. Based on the imported offline secure update package, the production control area updates the parameters for fault diagnosis and performs fault diagnosis to obtain the fault diagnosis results for each device at each edge node within each time window. Specifically: S81. The Management Information Zone securely encapsulates the lightweight update package into an offline secure update package containing digital signatures, version numbers, certificate chains, rollback information, and audit information. The offline secure update package is imported into the Production Control Zone via a hardware-encrypted USB flash drive or a controlled offline synchronization method. During the import process, the Production Control Zone of the edge nodes sequentially performs certificate validity verification, digital signature verification, package integrity verification, version compatibility verification, canary loading, failure rollback, and audit log recording. S82. Production control area updates parameters for fault diagnosis based on offline security update packages; S83, the binary semantic bit string of the current sliding window of a certain device, i.e., the current fingerprint is The set of normal behavior prototypes for the same operating condition range of this equipment is as follows: The set of failure mode prototypes is ,in, elements in This represents the i-th binary semantic bit string in the set of normal behavior prototypes. elements in This represents the j-th binary semantic bit string in the fault mode prototype set. and They represent and The total number of elements in the text; S84. Calculate the minimum distance from the current fingerprint to the normal behavior prototype set according to the following formula (5). ; （5）； In equation (5), represent and The normalized weighted Hamming distance between them; when calculating Exceeding the set warning distance threshold When this happens, an alert is triggered; The average normal fingerprint distance under the same device type and the same operating condition is Standard deviation is The standardized outlier deviation is calculated using the following formula (6). ; （6）； In equation (6), This represents the smallest positive number that prevents the denominator from being zero; S85. Calculate the minimum distance from the current fingerprint to the fault mode prototype set according to the following formula (7). ; （7）； In equation (7), represent and The normalized weighted Hamming distance between them; when calculating Below the set fault distance threshold When this occurs, a fault warning is triggered; For a device behavior semantic fingerprint with a valid bitmask, equations (5) and (7) contain... and It is calculated by the following formula (8): （8）； In equation (8), For equation (5) Or in equation (7) ; Represents the weight of the k-th element; The representative indicator function is the function that indicates the k-th bit in the current fingerprint. The kth position in the normal behavior prototype or failure mode prototype When the values ​​are different, the value is 1; when the values ​​are the same, the value is 0. The valid bit flag represents the k-th bit; a value of 1 indicates that the bit is involved in the calculation, and a value of 0 indicates that the bit is masked. S86. Calculate the comprehensive abnormality score according to the following formula (9). : （9）； In equation (9), These are the weighting coefficients; For bias terms; Represents the fault prototype matching threshold This is used to determine whether the current fingerprint matches the fault mode prototype; The potential term represents the weighted average rate of change of the abnormal deviations of the most recent M sliding windows; This represents a data quality penalty, indicating a combined penalty for missing rate, low confidence ratio, and timestamp drift. Represents the sigmoid normalization function; The value ranges from 1 to 100; S87. Calculate the comprehensive anomaly score based on the risk scoring threshold and alarm level threshold. Make a judgment and output the alarm level; Risk scoring thresholds include: Suspected fault threshold and high-risk fault threshold ,and The alarm level thresholds include Level 1 Abnormal Level, Level 2 Suspected Fault Level, and Level 3 High-Risk Fault Level; when When, it is judged as normal; when When the condition is deemed minor, the alarm level is set to Level 1. When a suspected fault is detected, the alarm level is set to Level 2 suspected fault. When this occurs, it is determined to be a high-risk fault, and the output alarm level is level three high-risk fault level; The corresponding alarm level is output only when at least K windows in M ​​consecutive sliding windows reach the same alarm level.

10. A diagnostic system applicable to the device behavior semantic fingerprint collaborative fault diagnosis method of claim 1, characterized in that: It includes an edge perception layer, a fingerprint extraction layer, a cross-regional transmission layer, a knowledge inference layer, an update import layer, and a fault diagnosis layer; The edge sensing layer is deployed in the production control area of ​​each edge node to perform multi-source data acquisition and sliding window division, and to obtain multi-source time-series data of each device in each sliding window. The fingerprint extraction layer is deployed in the production control area of ​​each edge node. It is used to extract the device behavior feature vector, perform segmented normalization and semantic encoding, and gradually encapsulate the encoded binary semantic bit string into a security fingerprint packet. The cross-regional transmission layer transmits the security fingerprint packet unidirectionally to the management information area through a dedicated power-specific forward security isolation device; The knowledge inference layer is deployed in the management information area and is used for fingerprint verification, classification and archiving, construction of cross-factory fingerprint aggregation matrix, cluster recognition, knowledge distillation and generation of offline security update packages; The update import layer is used to import offline security update packages into the production control area; The fault diagnosis layer is deployed in the production control area of ​​each edge node. After updating the fault diagnosis parameters based on the imported offline security update package, fault diagnosis is performed to obtain the fault diagnosis results of each device in each time window at each edge node.

Images