A fault autonomous intelligent processing method and system of a sagoe controller

Abstract

The application discloses a kind of fault autonomous intelligent processing method and system of shaggy controller, belong to industrial control technical field, the method includes: constructing hierarchical fault diagnosis system, and the comprehensive confidence of fault is calculated by diagnostic evidence;Establish structured fault rule base, and each rule is defined using triple structure;Fuzzy reasoning mechanism is used to evaluate fault severity level;With extended finite state machine as core architecture, state management and decision execution are realized;Through double communication channel, double processor unit and redundant sensor channel, etc. Functional redundancy configuration supports module switching during fault;Design dynamic task adjustment mechanism based on priority formula to realize degradation reconstruction;Establish progressive fault self-healing and recovery mechanism based on observation time window.The application changes controller from fault stop mode to fault adaptive degradation operation mode, significantly improves the availability and autonomy of industrial control system in extreme environment such as shaggy.

Description

Technical Field

[0001] This application belongs to the field of industrial control technology, and in particular relates to a method and system for autonomous intelligent fault handling of a Shagohuang controller. Background Technology

[0002] The desert and Gobi regions are characterized by extreme heat, severe sandstorms, extreme diurnal temperature variations, complex electromagnetic environments, weak communication infrastructure, and long-term unattended operation. These environmental factors present unprecedented reliability challenges to industrial controllers deployed in such areas. Taking the edge computing nodes of large-scale photovoltaic power plants in Northwest China as an example, these controllers undertake critical functions such as monitoring the status of photovoltaic inverter groups, collecting on-site meteorological data, aggregating equipment operation information, and communicating remotely with the back-end dispatch center. However, in actual operation, the ambient temperature at noon in summer can reach above 45°C, and the internal temperature of the controller chassis can climb to 70°C or even higher. The high-temperature environment significantly increases the risk of thermal failure of power devices; frequent sandstorms cause poor connector contact and sensor probe blockage; the thermal stress cycle caused by diurnal temperature variations accelerates the fatigue aging of electronic component solder joints; lightning activity and electromagnetic interference from transmission lines lead to deterioration or even interruption of communication link quality. At the same time, the remoteness, inconvenient transportation, and sparse population of the desert and Gobi regions dictate that the controllers must have a high degree of autonomous operation capability and cannot rely on frequent manual inspections and on-site maintenance.

[0003] Traditional industrial control systems generally adopt a passive response mode when dealing with equipment failures, with a basic processing logic of "fault detection - shutdown protection - waiting for manual intervention." This strategy is acceptable in conventional industrial environments with manned personnel, but it has serious drawbacks in remote, uninhabited areas such as deserts and wastelands. On the one hand, it often takes several hours or even days from the occurrence of a failure to the arrival of maintenance personnel on-site. During this period, the system completely loses its operational capability, leading to interruption of monitoring data and failure of control functions, which seriously affects the continuous and stable operation of the entire industrial system. For photovoltaic power plants, this can even cause power generation losses and difficulties in grid dispatch. On the other hand, frequent on-site maintenance not only significantly increases operation and maintenance costs but also exposes technicians to multiple safety risks such as heatstroke, dehydration, and traffic accidents. In extreme weather conditions, it may even be impossible to go on site.

[0004] To improve system fault tolerance, existing technologies mainly employ redundant design and simple failover mechanisms. At the hardware redundancy level, dual-machine hot backup systems take over operation from the backup controller when the primary controller fails, while triple-modal redundancy systems achieve fault tolerance through majority voting. At the software level, watchdog timers detect program crashes and trigger system resets, while heartbeat mechanisms monitor the survival status of each functional module. However, these traditional solutions all have significant shortcomings. First, simple dual-machine switching lacks intelligent decision-making capabilities, failing to take differentiated measures based on the severity and specific type of fault, often resulting in unnecessary system interruptions or resource waste. Second, while triple-modal redundancy systems offer strong fault tolerance, they are expensive in hardware, significantly increase system power consumption, and greatly enhance structural complexity, making them unsuitable for cost- and power-sensitive edge control devices in harsh environments. Third, existing systems generally lack fine-grained degradation operation strategies, often adopting a "one-size-fits-all" approach when a fault is detected—either a complete shutdown or a simple restart—failing to achieve gradual system degradation while ensuring the continued operation of core functions. Finally, most systems lack true self-healing capabilities; even temporary or automatically recoverable faults require manual intervention to resolve, creating a sharp contradiction with the unattended operation requirements of the desert environment. From a system reliability theory perspective, the steady-state availability (Asys) of equipment can be expressed as a function of mean time between failures (MTBF) and mean time to repair (MTBT). In the traditional "failure equals downtime" mode, due to the unique characteristics of the desert environment, the mean time to repair (MTBT) is significantly longer than in conventional environments, directly leading to a substantial decrease in system availability.

[0005] Therefore, it is necessary to provide a new autonomous intelligent fault handling method and system for the Shagohuang controller to solve the above-mentioned technical problems. Summary of the Invention

[0006] The purpose of this disclosure is to provide a method and system for autonomous intelligent fault handling of a desert controller in order to solve the above-mentioned problems.

[0007] This disclosure achieves the above objectives through the following technical solutions: A fault autonomous intelligent handling method for a desert controller includes the following steps: Status information is collected from three levels: hardware layer, communication layer, and functional layer. Weighted evidence theory is used to fuse multiple independent information sources and calculate the comprehensive confidence of the fault mode. If the confidence exceeds the diagnostic threshold, the fault is confirmed. A three-level fault rule base of emergency, important and general is pre-built. Each rule is defined by a triplet of triggering condition, processing action and execution constraint. After the fault is confirmed, the corresponding processing strategy is matched. Based on the three dimensions of the comprehensive failure's impact on core functions, the risk of its spread, and the possibility of self-healing, the severity level is output through membership mapping and Mamdani inference to optimize the handling strategy. A decision engine is constructed by extending the finite state machine with a seven-tuple. Based on the current state and fault events, the engine orderly transitions between normal state, multiple degraded states, and state to be repaired and executes the strategy. Relying on dual communication channels, dual processor units, and redundant sensor channels, the backup module takes over the function in case of failure; The execution priority is dynamically adjusted according to the task priority formula, and non-core functions are disabled or reduced in frequency to ensure the continuous operation of core tasks. The system continuously monitors for faults, and once the fault clearance signal stabilizes through the observation window, it gradually and smoothly returns to normal operation.

[0008] As a further optimization of this disclosure, status information is collected at three levels: hardware layer, communication layer, and functional layer. Weighted evidence theory is used to fuse multiple independent information sources, and the comprehensive confidence level of the fault mode is calculated. If the confidence level exceeds a diagnostic threshold, the fault is confirmed. This includes: During operation, the controller collects system status information through three layers: hardware, communication, and functional. It employs a multi-source information fusion algorithm based on weighted evidence theory. Credibility weight of each independent information source and basic probability allocation value ( Calculate fault modes Overall confidence level ( When the overall confidence level exceeds the diagnostic threshold Confirm the occurrence of the fault in a timely manner; The overall confidence level of the multi-source information fusion algorithm is calculated using the following formula: ( )=∑ · ( ),in =1,2,..., Credibility weights of each information source The system is dynamically adjusted based on the historical diagnostic accuracy of the information source and the current self-check status.

[0009] As a further optimization of this disclosure, a three-level fault rule base of emergency, important, and general is pre-built. Each rule is defined by a triplet of triggering condition, processing action, and execution constraint. After fault confirmation, the corresponding processing strategy is matched, including: A rule base containing three levels of fault modes and response strategies is pre-established in the controller firmware. Each rule is defined using a triplet structure of triggering condition, processing action, and execution constraint. When a fault is confirmed, the matching processing strategy is retrieved from the rule base according to the fault type. The emergency fault rule layer has the highest execution priority and handles serious anomalies that may cause equipment damage or safety hazards, including severe equipment overheating, severe main power supply voltage anomalies, and main processor malfunctions. The important fault rule layer handles anomalies that affect the normal operation of core functions, including main communication channel interruption, continuous deterioration of communication link quality, and failure of key sensors. The general fault rule layer handles anomalies that affect system operation but do not endanger core functions, including secondary sensor reading drift and insufficient local storage space.

[0010] As a further optimization of this disclosure, considering the impact of the fault on core functions, the risk of its spread, and the possibility of self-healing, and using membership mapping and Mamdani inference to output severity levels, a preferred handling strategy is selected, including: A fuzzy reasoning mechanism is used to quantitatively assess the severity of a fault, taking into account the impact of the fault on core functions. Risk of fault propagation and the possibility of self-healing and recovery The fault severity level is output using three dimensions, through membership function mapping and the Mamdani inference method. Based on this, the optimal processing strategy is selected; The membership function used in the fuzzy inference determines the degree of impact of the fault on the core function. Dimension is defined as: =max(0,1 2.5 ), ∈[0,0.4]; =1 2.5 1.25|, ∈[0.3,0.7]; =max(0,2.5 1.5), ∈[0.6,1.0], where This represents the normalized impact index value.

[0011] As a further optimization of this disclosure, a decision engine is constructed using a 7-tuple extended finite state machine. Based on the current state and fault events, the engine sequentially transitions between normal states, multiple degraded states, and states awaiting repair, and executes strategies, including: Based on extended finite state machine =( , , , , , , The architecture constructs a fault self-healing decision engine, in which... It is a finite set of states, including normal operation state, various degraded operation states, various fault handling transition states, and maintenance state; It is a collection of events, including various fault detection events, recovery confirmation events, external command events, and timed trigger events; It is a set of state variables used to record the current resource usage status, fault history information, performance statistics and configuration parameters of the system; The state transition function defines the target state that the system should transition to given the current state and the triggering event. The transition guard condition is a Boolean expression based on the state variable. The corresponding state transition is only allowed to be executed if the guard condition evaluates to true. The update function for state variables defines the rules for modifying state variables during state transitions; The initial state of the system is typically set to the normal operating state; based on the current operating state of the controller and fault events, the finite set of states... During the state transition, fault response measures are executed according to the rule base strategy; The extended finite state machine =( , , , , , , It supports a composite state mechanism, allowing the system to simultaneously exist in multiple degraded operating states. The state transition function... Given the current state and the triggering event, the transfer guard condition will only be met if... The state transition is executed only if the evaluation result is true, and the state variable update function is executed accordingly. Update the relevant state variables.

[0012] As a further optimization of this disclosure, relying on dual communication channels, dual processor units, and redundant sensor channels, a backup module takeover function is activated in case of failure, including: The controller is configured with dual communication channels, dual processor units, and redundant sensor channels. When a functional module fails, a backup module is activated through a redundancy switching mechanism to take over the corresponding function. The dual communication channels adopt a heterogeneous redundancy architecture. The main channel uses a 4G / 5G cellular mobile network, while the backup channel uses BeiDou satellite short message communication. The two channels are completely independent in terms of transmission medium, communication protocol, and signal path. In the dual processor unit, the main processor and the backup processor synchronize status data in real time through a shared storage area. The backup processor continuously monitors the health status of the main processor and can take over control in milliseconds after detecting an anomaly.

[0013] As a further optimization of this disclosure, the execution priority is dynamically adjusted according to the task priority formula, and non-core functions are disabled or reduced in frequency to ensure the continuous operation of core tasks, including: The execution priority of each task is dynamically adjusted according to the task priority calculation formula, and non-core functions are disabled or reduced in frequency to ensure the normal operation of core tasks in degraded mode. The task priority calculation formula is as follows: = · + · + · (1 / ) ; in, P i Let i be the dynamic execution priority of the i-th task. I i This is the inherent importance coefficient of the task. U i As a factor of urgency for this task, R i This represents the resource consumption coefficient for this task. W base 、W urgent 、W resource There are three configurable weight parameters.

[0014] This dynamic degradation and reconfiguration mechanism divides controller tasks into three levels: core tasks, important tasks, and secondary tasks. Core tasks include safety status monitoring, remote communication heartbeat maintenance, and emergency control command execution, ensuring normal execution in any degradation mode. Important tasks reduce their execution frequency when system resources are strained. Secondary tasks can be suspended in degradation mode. Task scheduling is based on inherent importance coefficients. Urgency factors and resource consumption coefficient Dynamically calculate the execution priority of each task. .

[0015] As a further optimization of this disclosure, continuous fault monitoring is implemented. After the fault clearance signal stabilizes within the observation window, the system gradually and smoothly recovers to normal operating conditions, including: When the fault clearance signal first appears, the observation timer is started, and relevant parameters are continuously monitored within the observation time window. Whether the internal stability remains within the normal threshold range; after confirming that the fault has been eliminated, perform recovery operations in stages. First, restore the isolated functional modules and verify that they are working properly, and then add the relevant tasks back to the scheduling queue; for cases involving the switching of redundant modules, use a load easing method to migrate the business from the backup module back to the primary module.

[0016] A fault autonomous intelligent handling system for a desert controller includes: The multi-source information fusion fault diagnosis module is used to collect status information from three levels: hardware layer, communication layer and functional layer. It uses weighted evidence theory to fuse multiple independent information sources, calculates the comprehensive confidence of fault modes, and confirms the fault if the comprehensive confidence exceeds the diagnostic threshold. The hierarchical rule base strategy retrieval module is used to pre-build a three-level fault rule base of emergency, important and general. Each rule is defined by a triplet of triggering condition, processing action and execution constraint. After the fault is confirmed, the corresponding processing strategy is matched. The fuzzy inference severity assessment module is used to comprehensively consider the three dimensions of the fault's impact on core functions, the risk of its spread, and the possibility of self-healing. It outputs the severity level through membership mapping and Mamdani inference, and then selects the best handling strategy. The extended finite state machine decision execution module is used to build a decision engine based on the seven-tuple extended finite state machine. It can orderly migrate and execute strategies between normal state, multiple degraded states, and state to be repaired based on the current state and fault events. The functional redundancy switching module is used to enable the backup module to take over the function in case of failure, relying on dual communication channels, dual processor units, and redundant sensor channels. The dynamic degradation and refactoring module is used to dynamically adjust the execution priority according to the task priority formula, and to disable or reduce the frequency of non-core functions to ensure the continuous operation of core tasks. The progressive self-healing recovery module is used to continuously monitor faults during degraded operation. After the fault elimination signal stabilizes through the observation window, it smoothly recovers to the normal operating state in stages.

[0017] An electronic device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor is used to execute the program stored in the memory to implement the autonomous intelligent fault handling method of the Shagohuang controller.

[0018] A computer-readable storage medium storing a computer program, which, when executed by a processor, implements the autonomous intelligent fault handling method of the Shagohuang controller.

[0019] The beneficial effects of this disclosure are as follows: The system availability in unattended environments has been greatly improved. The algorithm transforms the controller from the traditional "failure-based shutdown" mode to the "failure-adaptive degradation operation" mode. The steady-state availability of the controller using the algorithm disclosed in this paper is greatly improved in typical desert fault scenarios. Intelligent fault diagnosis and differentiated processing have been achieved. Through a hierarchical diagnosis system that integrates multi-source information and a severity assessment mechanism based on fuzzy reasoning, the accuracy of fault diagnosis has been improved and the false alarm rate has been reduced. The organic combination of the hierarchical rule base and the extended finite state machine ensures the orderly and controllable decision-making process in complex situations. It makes efficient use of redundant resources to ensure critical functions. Through a carefully designed dual communication channel, dual processor unit and redundant sensor channel architecture, coupled with intelligent fault detection and switching strategies and dynamic degradation and reconstruction mechanism, it ensures that limited system resources are given priority to serve core tasks. It significantly reduces operation and maintenance costs and personnel safety risks, can reduce the number of on-site maintenance visits, and the controllable degradation operation after a failure provides the operation and maintenance team with sufficient response time; The algorithm framework disclosed herein has a good modular design and parameter configurability. With appropriate parameter configuration, it can also be applied to industrial control systems in other extreme working conditions such as high-altitude and cold regions, offshore platforms, and high-radiation environments. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of a method in an embodiment of this disclosure; Figure 2 This is a system structure block diagram of an embodiment of this disclosure; Figure 3 This is a block diagram of the equipment structure disclosed herein. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] like Figure 1 As shown, a fault autonomous intelligent handling method for a desert controller includes the following steps: S1. Status information is collected from three levels: hardware, communication, and functional. Weighted evidence theory is used to fuse multiple independent information sources, and the overall confidence level of the fault mode is calculated. If the confidence level exceeds the diagnostic threshold, the fault is confirmed, including: A three-tiered fault diagnosis system covering the hardware, communication, and functional layers was constructed to achieve comprehensive monitoring and evaluation of the controller's operational status. At the hardware layer, the algorithm assesses the health of core components such as the processor, memory, communication module, and power supply module by monitoring the operating parameters and performance indicators of key components. Monitored parameters include chip junction temperature, supply voltage, operating current, response time, and bit error rate. At the communication layer, the algorithm comprehensively analyzes indicators such as signal strength, link quality, transmission delay, packet loss rate, and retransmission count to determine the availability and reliability of each communication channel in real time, providing a basis for channel switching decisions. At the functional layer, the algorithm identifies functional abnormalities and performance degradation by comparing the actual output of each functional module with the expected results, monitoring task execution status and resource consumption, and verifying data consistency and timing rationality.

[0024] To address the practical problems of noise interference and sporadic anomalies in sensor data in desert environments, this disclosure introduces a multi-source information fusion algorithm based on weighted evidence theory, effectively improving the accuracy and robustness of fault diagnosis. The basic idea of ​​this algorithm is: for the same fault mode, multiple independent information sources provide diagnostic evidence, and then each source is assigned a credibility weight based on its historical reliability and current operating status. Finally, a weighted fusion calculation is used to obtain the comprehensive confidence level of the fault mode. Assume the system is configured with… An independent information source for failure modes Provide diagnostic evidence, the first The credibility weight of each information source is: Its failure modes The basic probability distribution value is ( The overall confidence level of the fused fault is then... ( Calculate using the following formula:

[0025] When the calculated overall confidence level ( Exceeding the preset diagnostic threshold Upon confirmation that this type of fault has occurred, the system triggers subsequent decision-making and processing procedures. The credibility weight of each information source is determined. It is not fixed, but dynamically adjusted based on the historical diagnostic accuracy of the information source and the current self-check status, so as to make the fusion results more accurate and reliable.

[0026] As a further explanation of this disclosure, the basic probability assignment value m of each information source for the failure mode F is... i (F) is obtained by mapping the deviation of the current monitoring quantity of the information source relative to the preset feature template: For the i-th information source, a corresponding feature template is pre-calibrated for the fault mode F. The monitoring features currently collected by the information source are compared with the feature template, and the normalized deviation di between the two is calculated. The value range of di is [0,1]. The basic probability allocation value of the fault mode F supported by the information source is mapped according to the pre-calibrated monotonically increasing mapping function m. i (F) = f(di) is calculated, and the mapping function f(·) satisfies f(0) = 0, f(1) = 1 and takes values ​​in the range [0, 1]. The remaining probability mass is 1. m i (F) is assigned to the uncertain hypothesis to reflect the uncertainty of the information source evidence; when an information source is judged to be unreliable due to self-examination anomalies, its basic probability assignment value is degraded to the uncertain hypothesis as a whole and no longer participates in weighted fusion.

[0027] The diagnostic threshold θ diag The calibration is determined offline based on historical fault sample data. During calibration, the goal is to minimize the weighted cost of false alarm rate and false negative rate. The value θ that minimizes the false alarm rate is selected while ensuring the false negative rate does not exceed a preset allowable upper limit. diag The typical value range for θ is 0.6 to 0.85; for failure modes with higher safety requirements, a lower θ value can be selected. diag To reduce the false negative rate, a higher θ value can be selected for fault modes that are susceptible to environmental noise interference. diag To suppress the false alarm rate; θ diag It can also be periodically updated based on the fault statistics accumulated over a long period of system operation.

[0028] S2. Pre-build a three-level fault rule base of emergency, important, and general. Each rule is defined by a triplet of triggering condition, handling action, and execution constraint. After fault confirmation, the corresponding handling strategy is matched, including: A structured fault mode-response rule base is embedded in the controller firmware. This rule base adopts a hierarchical organizational architecture, divided into three levels according to the urgency of the fault and its impact on the system. The first level is the emergency fault rule layer, specifically handling severe abnormal situations that may cause permanent equipment damage or safety hazards. Typical fault types include severe equipment overheating, severe main power supply voltage abnormalities, and main processor malfunctions. These rules have the highest execution priority; once the trigger condition is met, other processing flows are immediately interrupted, and corresponding protective actions are executed first. The second level is the important fault rule layer, handling abnormal situations that affect the normal operation of core functions but do not yet endanger equipment safety. Typical fault types include main communication channel interruption, continuous deterioration of communication quality, failure of critical sensors, and abnormalities of important functional modules. These rules are executed sequentially according to priority after emergency fault handling is completed. The third level is the general fault rule layer, handling abnormal situations that have some impact on system operation but do not endanger core functions. Typical fault types include secondary sensor reading drift, insufficient local storage space, timed task execution timeouts, and performance degradation of backup modules. These rules are processed sequentially when system resources allow.

[0029] Each rule in the rule base is formally defined using a triple structure of "trigger condition - processing action - execution constraint", represented as follows: ={ , , }. Among them, the set of triggering conditions. It can include threshold judgments and logical combinations of multiple monitoring indicators, supports logical operations such as "AND", "OR", and "NOT", as well as time window constraints; and processes action sequences. The detailed steps for fault handling are defined, and each step is executed sequentially according to a predetermined order. Each step includes elements such as execution content, timeout limits, and failure handling; execution constraint set. The rules specify the preconditions, resource requirements, timing requirements, and mutual exclusion relationships with other rules required for the execution of the rule, in order to avoid rule conflicts and resource competition.

[0030] S3. Based on the three dimensions of the comprehensive failure's impact on core functions, its spread risk, and its self-healing potential, a severity level is output through membership mapping and Mamdani inference. The optimal handling strategy is then selected, including: Considering the complexity and ambiguity of actual fault scenarios, a fuzzy reasoning mechanism is introduced to quantitatively assess fault severity and select the optimal handling scheme from multiple alternative strategies. The fuzzy assessment of fault severity comprehensively considers three core dimensions: the degree of impact of the fault on core functions. The risk of the fault spreading to other modules. And the possibility of self-healing and recovery from malfunctions. For each evaluation dimension, three fuzzy linguistic variables—"low," "medium," and "high"—are defined. A carefully designed membership function maps the raw monitoring data to the fuzzy domain. This is based on the degree of impact of the fault on core functions. For example, let the normalized impact index value be... Given a value range of [0,1], the membership functions of the three fuzzy sets "low influence", "medium influence", and "high influence" are defined as follows: =max(0,1 2.5 ), ∈[0,0.4]; =1 2.5 1.25|, ∈[0.3,0.7]; =max(0,2.5 1.5), ∈[0.6,1.0]. The fuzzy inference engine employs the classic Mamdani inference method, with a rule base containing 27 fuzzy rules to cover all combinations of the three input variables. The inference output is the fault severity level. The levels are divided into four categories: "minor," "moderate," "serious," and "urgent," each corresponding to different handling strategies, priorities, and system resource allocation schemes.

[0031] As a further explanation of this disclosure, for the fault propagation risk Rspread dimension, let the normalized propagation risk index value be y, y∈[0,1], then the membership functions of the three fuzzy sets "low risk", "medium risk", and "high risk" are defined as: μ_low(y) = max(0,1) 2.5y), y∈[0,0.4]; (y)=1 in μ 2.5y 1.25|, y∈[0.3,0.7];μ height (y)=max(0,2.5y 1.5), y∈[0.6,1.0]. For the Precover dimension of fault self-healing recovery probability, let the normalized self-healing probability index value be z, z∈[0,1], then the membership functions of the three fuzzy sets "low", "medium", and "high" are defined as: μlow(z)=max(0,1) 2.5z), z∈[0,0.4]; (z)=1 in μ |2.5z 1.25|, z∈[0.3,0.7]; μheight(z)=max(0,2.5z) 1.5), z∈[0.6,1.0].

[0032] The fuzzy rule base consists of 27 fuzzy rules, covering all 3×3×3 combinations of the three input variables—Ifunc (impact level), Rspread (spread risk), and Precover (self-healing probability)—each taking one of the three linguistic values: "low," "medium," or "high." Each combination corresponds to one rule. Each rule is defined in the form "If Ifunc is A, Rspread is B, and Precover is C, then Slevel is D," where A, B, and C are all taken from {low, medium, high}, and D is taken from {minor, moderate, severe, urgent}. The value of the consequent D follows the following construction principle: the higher the impact of the fault on core functions, the greater the spread risk, and the lower the self-healing probability, the higher the fault severity level. Representative rule examples are as follows: If Ifunc is high, Rspread is high, and Precover is low, then Slevel is urgent; if Ifunc is high, Rspread is medium, and Precover is medium, then Slevel is severe; if Ifunc is medium, Rspread is medium, and Precover is medium, then Slevel is moderate; if Ifunc is low, Rspread is low, and Precover is high, then Slevel is mild; the remaining rules are determined by analogy according to the above construction principles.

[0033] For each activated rule, the fuzzy inference engine takes the minimum value of the membership degree of each fuzzy set in its antecedent as the activation strength of the rule, and synthesizes the output fuzzy sets of all rules using the maximum value method to obtain the output fuzzy set of fault severity. Then, the centroid method is used to defuzzify the output fuzzy set, and the centroid abscissa of the region enclosed by its membership degree curve and the horizontal axis is used as the sharp value Scrisp of the fault severity, where Scrisp∈[0,1]. Finally, Scrisp is mapped to the fault severity level Slevel according to the preset level interval, where Scrisp∈[0,0.25) corresponds to "minor", Scrisp∈[0.25,0.5) corresponds to "moderate", Scrisp∈[0.5,0.75) corresponds to "severe", and Scrisp∈[0.75,1.0] corresponds to "urgent".

[0034] S4. Construct a decision engine using a 7-tuple extended finite state machine. Based on the current state and fault events, orderly transition between normal states, various degraded states, and states awaiting repair, and execute strategies, including: To ensure the consistency and predictability of the decision-making process under complex failure scenarios, an extended finite state machine (EPF) is adopted as the core architecture of the decision engine. The EPF is formally defined as a seven-tuple. =( , , , , , , ).in, It is a finite set of states, including normal operation state, various degraded operation states, various fault handling transition states, and maintenance state; It is a collection of events, including various fault detection events, recovery confirmation events, external command events, and timed trigger events; It is a set of state variables used to record the current resource usage status, fault history information, performance statistics and configuration parameters of the system; The state transition function defines the target state that the system should transition to given the current state and the triggering event. The transition guard condition is a Boolean expression based on the state variable. The corresponding state transition is only allowed to be executed if the guard condition evaluates to true. The update function for state variables defines the rules for modifying state variables during state transitions; The initial state of the system is typically set to the normal operating state. The extended finite state machine disclosed herein supports a composite state mechanism, allowing the system to exist in multiple degraded operating states simultaneously. The ordered transition mechanism of the state machine ensures that even in complex scenarios where multiple failures occur concurrently or consecutively, the system's decision-making process remains orderly, preventing logical conflicts or decision deadlocks.

[0035] S5, relying on dual communication channels, dual processor units, and redundant sensor channels, enables the backup module to take over in case of failure, including: A systematic functional redundancy design is introduced at the controller hardware architecture level, providing a solid material foundation for self-healing switching and degraded operation in the event of a failure. The redundancy configuration covers the following three key modules: In the communication subsystem, a heterogeneous redundancy architecture with dual communication channels is adopted. The main channel uses a 4G / 5G cellular mobile network, while the backup channel uses BeiDou satellite short message communication. The two channels are completely independent in terms of transmission medium, communication protocol, and signal path, effectively avoiding the risk of information silos caused by the failure of a single communication method. In the processing subsystem, a dual-processor unit hot backup architecture is adopted. The main processor is responsible for daily business processing, while the backup processor synchronizes key status data in real time through a shared storage area and continuously monitors the health status of the main processor. It can take over system control in milliseconds after detecting an anomaly in the main processor. In the sensing subsystem, redundant sensor channels are configured for key environmental parameters such as temperature, voltage, and irradiance. Cross-validation and data fusion technologies are used to improve the reliability and accuracy of measurements.

[0036] S6. Dynamically adjust execution priority according to the task priority formula, disable or reduce the frequency of non-core functions, and ensure the continuous operation of core tasks, including: The dynamic degradation and refactoring mechanism is one of the core innovations of this disclosure. Its basic idea is that when the system detects a fault and cannot fully recover through self-healing, it automatically adjusts the system's operating mode based on the currently available system resources and the importance level of each task. While ensuring the continuous operation of core functions, it orderly reduces or suspends non-critical functions, achieving a "graceful degradation" rather than a "total collapse." Degradation and refactoring follows the basic principles of "preserving the core, abandoning the secondary, and conserving resources." Regarding the dynamic adjustment of task priorities, the system maintains a task importance matrix, dividing all operational tasks undertaken by the controller into three levels: core tasks, important tasks, and secondary tasks. Core tasks include security status monitoring, remote communication heartbeat maintenance, and emergency control command execution, which must be guaranteed to execute normally in any degradation mode without delay or interruption. Important tasks include routine data acquisition, periodic status reporting, and general control logic processing; their execution frequency can be appropriately reduced when system resources are strained, but they should not be completely stopped. Secondary tasks include data statistical analysis, detailed log recording, and non-critical optimization algorithm calculations; their execution can be suspended in degradation mode to release system resources. The task scheduler dynamically calculates the real-time execution priority of each task based on the current system state. The calculation formula is as follows: = · + · + ·(1 / In the formula, For the first Dynamic execution priority of each task This is the inherent importance coefficient of the task. As a factor of urgency for this task, This represents the resource consumption coefficient for this task. , , There are three configurable weight parameters.

[0037] S7. Continuously monitor faults. After the fault clearance signal stabilizes through the observation window, gradually and smoothly restore the system to normal operating condition, including: This disclosure presents a comprehensive fault self-healing and system recovery mechanism, enabling the controller to automatically return to normal operation after a fault is eliminated, minimizing reliance on manual intervention. The self-healing mechanism includes two modes: active self-healing and passive self-healing. Active self-healing refers to the system proactively attempting to eliminate the root cause of the fault or restore damaged functions through software means after detecting a fault. Specific measures include software reset of the faulty module, reinitialization and reconnection of abnormal communication links, caching and retransmission of failed data, and online recalibration of drifting sensor parameters. Passive self-healing refers to the system continuously monitoring fault-related state parameters during degraded operation. When the fault factor naturally disappears due to an improved external environment, the system automatically senses this change and triggers the recovery process. The recovery process adopts a gradual strategy, avoiding drastic fluctuations and repeated switching of system states by setting reasonable observation waiting periods and performing recovery operations in stages. Specifically, when the monitoring signal indicating fault elimination first appears, the system does not immediately perform recovery operations but starts an observation timer to continuously monitor relevant parameters within a preset observation time window. The system must be able to stably maintain its operation within the normal threshold range. Only when all parameters meet the threshold requirements for normal operation and do not fluctuate significantly throughout the entire observation period can the system be officially confirmed as having truly eliminated the fault. Then, a phased recovery operation will begin: first, the isolated or disabled functional modules will be restored, and after verifying their normal operation, the relevant tasks will be re-added to the scheduling queue; for cases involving redundant module switching, after fully verifying that the primary module has recovered and is operating stably, the business load will be gradually migrated from the backup module back to the primary module, using a gradual traffic transition to ensure a smooth transition; finally, the system status flag will be updated, the degraded operation mode will be exited, and the system will return to normal operation. .

[0038] The solution of this disclosure will be described in conjunction with the embodiments: This embodiment relates to an edge control node deployed in a 100-megawatt photovoltaic power station in the Gobi Desert region of Northwest China. The power station covers an area of ​​approximately 3 square kilometers, with thousands of photovoltaic modules and dozens of grid-connected inverters. It is about 80 kilometers from the nearest manned substation, experiencing over 3200 hours of effective sunshine annually. Summer temperatures can reach above 45°C, while winter temperatures can drop to -25°C, and there are over 60 days of sandstorms per year. Operating in this harsh environment, the edge control node performs key functions including monitoring the operational status of the photovoltaic inverter group, collecting on-site meteorological data, aggregating and processing equipment alarm information, and remotely communicating with the power station monitoring center. The hardware platform of this control node is based on an industrial-grade ARM Cortex-A72 quad-core processor with a clock speed of 1.5GHz, equipped with 2GB of DDR4 memory and 32GB of eMMC storage. Its wide-temperature design allows for stable operation within a range of -40°C to +85°C. The communication subsystem is configured with dual communication channels: the main channel uses a 4G-LTE communication module supporting full network compatibility, and the backup channel uses a BeiDou-3 short message communication module. The processing subsystem adopts a dual-processor unit architecture. The main control MCU is responsible for daily business logic processing, while the backup MCU is connected to the main control MCU via the SPI bus and shares 32KB dual-port RAM for status synchronization. The sensing subsystem is configured with multiple redundant sensor channels, including two temperature sensors, two voltage sensors, and two irradiance sensors.

[0039] 1. Construction of a hierarchical rule base and examples of typical rules Based on the actual operating characteristics of the Shagohuang photovoltaic power station, combined with the statistical analysis of historical fault data and the systematic sorting of expert experience and knowledge, this embodiment establishes a hierarchical fault response strategy library containing 42 specific rules, including 11 emergency fault rules, 17 important fault rules, and 14 general fault rules.

[0040] Typical rule in the emergency fault rule layer—Rule U1: Severe over-temperature protection of the device: The trigger condition is the reading of the internal temperature sensor of the chassis. If the temperature exceeds 85℃ for three consecutive sampling periods, or the temperature rise rate d If the temperature rises by more than 2°C / min and the current temperature exceeds 75°C, the following actions will be taken: immediately reduce the main processor frequency from 1.5GHz to 750MHz to reduce heat generation, shut down the power supply to unnecessary peripherals, start the chassis cooling fan at its highest speed, mark the system status as "emergency cooling" and send a high-priority alarm to the background. If the temperature continues to rise and exceeds the 95°C safety threshold within 15 minutes, the orderly shutdown protection program will be activated.

[0041] Typical rule of critical fault rule layer - Rule I1 Main communication channel interruption: The trigger condition is that the 4G-LTE module cannot establish a data connection with the backend server for 30 consecutive seconds, or the connection has been established but 10 consecutive data transmissions report failure and retransmission is ineffective; The handling action is to immediately activate the Beidou satellite communication module and complete the initialization, sort the data in the data queue to be sent according to importance and switch to satellite channel transmission. Due to the limited bandwidth of the satellite channel, the data compression algorithm is enabled at the same time and the critical data priority transmission strategy is adopted. The system enters the "satellite communication degradation" state, and the background task attempts to re-establish the 4G connection every 5 minutes.

[0042] Typical rule in the general fault rule layer—Rule G1: Secondary sensor reading drift: The trigger condition is that the deviation between the outdoor ambient humidity sensor reading and the reference data of the nearby weather station exceeds 10%RH and the deviation lasts for more than 1 hour; The processing action is to record the trend curve of the sensor reading drift for subsequent analysis, add a correction factor to the sensor reading in the reported data for compensation, if the system is configured with redundant sensor channels of the same type, enable the cross-validation mode to perform a weighted average of the two sensor readings as the final output, and add the sensor to the list of sensors to be calibrated and maintained.

[0043] 2. State definition and transition rules for extended finite state machines The extended finite state machine in this embodiment =( , , , , , , The following set of states is defined: normal operating state The initial state and target steady state represent the system's initial state and target steady state, indicating that all controller functions are working normally and no degradation measures are in effect; communication degradation state. This indicates that the main communication channel is unavailable, and the system is maintaining data interaction with the backend through a backup satellite channel; over-temperature degradation state. This indicates that the device temperature is too high, and the system has initiated frequency and power reduction measures to control the temperature rise; processor switching state. This indicates that the main control MCU has malfunctioned and the system has switched to the backup MCU; the sensor is in degraded state. This indicates that one or more sensors have failed, and the system is using redundant sensor channels or estimated values ​​as replacements; resource-constrained state. This indicates that the system has severely insufficient available resources, and some non-core tasks have been suspended; pending maintenance. This indicates a hardware failure that cannot be self-healed; the system has issued a repair request and is awaiting manual intervention. The state machine supports compound states, such as... + This indicates that the system is simultaneously in a state of communication degradation and over-temperature degradation.

[0044] 3. Complete handling process for typical fault scenarios Scenario: In late July of a certain year, the Gobi Desert in Northwest China experienced a prolonged period of high temperatures, with daily highs exceeding 42°C for several consecutive days. On the afternoon of July 23, the area where the control node was located was hit by a thunderstorm, causing a power outage for a nearby 4G base station due to a lightning strike.

[0045] System response process: At 14:27, the fault diagnosis module detected the internal temperature of the chassis. Upon reaching 78℃, the warning condition of rule U1 was triggered. The system immediately increased the temperature monitoring frequency to once per second and started the cooling fan at full speed. At 14:31, the 4G communication module reported a connection loss, and the fault diagnosis module confirmed the main communication channel interruption and generated an event. The decision engine executes rule I1, activating the BeiDou satellite communication module, and the system state changes from normal operation. Migrate to communication degraded state At 2:35 PM, the internal temperature of the chassis continued to rise to 83°C, meeting the main trigger condition of rule U1. The decision engine immediately implemented over-temperature protection measures, the main processor frequency dropped to 750MHz, and the system entered over-temperature degradation state. The state machine enters a composite state. + From 2:35 PM to 3:40 PM, the system continued to operate in a composite degraded state. Core tasks maintained their normal execution cycles, important tasks had reduced execution frequency, and secondary tasks were suspended. At 3:42 PM, the 4G module detected that the network signal had been restored and the connection test was successful, and the fault diagnosis module generated an event. However, the main channel recovery time has not yet exceeded the observation time window. =5 minutes, the system continues to observe. 15:48, observe the guarding conditions. If the condition is met, the decision engine executes a communication recovery transition action, and the state machine transitions from the composite state. + Migrate to a single downgrade state At 16:25, the internal temperature of the chassis stabilized between 68℃ and 70℃, and the monitoring and guarding conditions were assessed. If the condition is met, the decision engine executes the over-temperature recovery transfer action, and the system state transitions back to normal operation. Throughout the entire fault handling process, the core data acquisition and remote communication functions of the control node were never interrupted.

[0046] 4. Statistical Analysis of On-site Operation Results The intelligent self-healing algorithm in this embodiment underwent 18 months of continuous field operation verification, and statistical data fully demonstrated its effectiveness and practical value. During the statistical period, the system handled a total of 4,127 fault events, including 193 emergency faults, 1,356 important faults, and 2,578 general faults. The fault diagnosis accuracy rate reached 97.8%, and the false alarm rate was controlled within 1.9%. Faults that were automatically processed and successfully handled through the rule base accounted for 82.3% of the total, of which 63.7% were completely self-healed and recovered, and 18.6% continued to operate in degraded mode until manual planned maintenance; only 5.3% required on-site manual handling. The overall steady-state availability of the system reached 99.76%, an improvement of 3.36 percentage points compared to 96.4% with the traditional solution before deployment. The average annual unplanned downtime decreased from approximately 315 hours to approximately 21 hours. The number of on-site maintenance visits decreased by 67% compared to before deployment, and the average response time per fault was shortened from 4.2 hours to 0.3 hours.

[0047] like Figure 2 As shown, embodiments of this disclosure provide an autonomous intelligent fault handling system for a desert controller, comprising: The multi-source information fusion fault diagnosis module is used to collect status information from three levels: hardware layer, communication layer and functional layer. It uses weighted evidence theory to fuse multiple independent information sources, calculates the comprehensive confidence of fault modes, and confirms the fault if the comprehensive confidence exceeds the diagnostic threshold. The hierarchical rule base strategy retrieval module is used to pre-build a three-level fault rule base of emergency, important and general. Each rule is defined by a triplet of triggering condition, processing action and execution constraint. After the fault is confirmed, the corresponding processing strategy is matched. The fuzzy inference severity assessment module is used to comprehensively consider the three dimensions of the fault's impact on core functions, the risk of its spread, and the possibility of self-healing. It outputs the severity level through membership mapping and Mamdani inference, and then selects the best handling strategy. The extended finite state machine decision execution module is used to build a decision engine based on the seven-tuple extended finite state machine. It can orderly migrate and execute strategies between normal state, multiple degraded states, and state to be repaired based on the current state and fault events. The functional redundancy switching module is used to enable the backup module to take over the function in case of failure, relying on dual communication channels, dual processor units, and redundant sensor channels. The dynamic degradation and refactoring module is used to dynamically adjust the execution priority according to the task priority formula, and to disable or reduce the frequency of non-core functions to ensure the continuous operation of core tasks. The progressive self-healing recovery module is used to continuously monitor faults during degraded operation. After the fault elimination signal stabilizes through the observation window, it smoothly recovers to the normal operating state in stages.

[0048] The implementation process of the functions and roles of each module in the above system is detailed in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0049] For the system embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The system embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0050] See Figure 3 The electronic device provided in the embodiments of this disclosure includes a processor 1110, a communication interface 1120, a memory 1130 and a communication bus 1140, wherein the processor 1110, the communication interface 1120 and the memory 1130 communicate with each other through the communication bus 1140. Memory 1130 is used to store computer programs; The processor 1110, when executing the program stored in the memory 1130, implements the above-mentioned autonomous intelligent fault handling method of the Shagohuang controller.

[0051] The aforementioned communication bus 1140 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus 1140 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, it is represented by only one thick line in the figure, but this does not indicate that there is only one bus or one type of bus.

[0052] The communication interface 1120 is used for communication between the above-mentioned electronic device and other devices.

[0053] The memory 1130 may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory 1130 may also be at least one storage device located remotely from the aforementioned processor 1110.

[0054] Embodiments of this disclosure also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the autonomous intelligent fault handling method for the desert controller as described above.

[0055] The embodiments described above are merely examples of several implementations of this disclosure, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent disclosure. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this disclosure, and these modifications and improvements all fall within the protection scope of this disclosure.

Claims

1. A fault autonomous intelligent handling method for a desert controller, characterized in that, Includes the following steps: Status information is collected from three levels: hardware layer, communication layer, and functional layer. Weighted evidence theory is used to fuse multiple independent information sources and calculate the comprehensive confidence of the fault mode. If the confidence exceeds the diagnostic threshold, the fault is confirmed. A three-level fault rule base of emergency, important and general is pre-built. Each rule is defined by a triplet of triggering condition, processing action and execution constraint. After the fault is confirmed, the corresponding processing strategy is matched. Based on the three dimensions of the comprehensive failure's impact on core functions, the risk of its spread, and the possibility of self-healing, the severity level is output through membership mapping and Mamdani inference to optimize the handling strategy. A decision engine is constructed by extending the finite state machine with a seven-tuple. Based on the current state and fault events, the engine orderly transitions between normal state, multiple degraded states, and state to be repaired and executes the strategy. Relying on dual communication channels, dual processor units, and redundant sensor channels, the backup module takes over the function in case of failure; The execution priority is dynamically adjusted according to the task priority formula, and non-core functions are disabled or reduced in frequency to ensure the continuous operation of core tasks. The system continuously monitors for faults, and once the fault clearance signal stabilizes through the observation window, it gradually and smoothly returns to normal operation.

2. The method for autonomous intelligent fault handling of a desert controller according to claim 1, characterized in that, Status information is collected at three levels: hardware, communication, and functional. Weighted evidence theory is used to fuse multiple independent information sources, and the overall confidence level of the fault mode is calculated. If the confidence level exceeds a diagnostic threshold, the fault is confirmed, including: During operation, the controller collects system status information through three layers: hardware, communication, and functional. It employs a multi-source information fusion algorithm based on weighted evidence theory. Credibility weight of each independent information source and basic probability allocation value ( Calculate Failure Mode Overall confidence level ( When the overall confidence level exceeds the diagnostic threshold Confirm the occurrence of the fault in a timely manner; The overall confidence level of the multi-source information fusion algorithm is calculated using the following formula: ( )=∑ · ( ),in =1,2,..., Credibility weights of each information source The system is dynamically adjusted based on the historical diagnostic accuracy of the information source and the current self-check status.

3. The method for autonomous intelligent fault handling of a desert controller according to claim 1, characterized in that, A three-tiered fault rule base (emergency, critical, and general) is pre-built. Each rule is defined by a triplet of triggering condition, handling action, and execution constraint. After fault confirmation, the corresponding handling strategy is matched, including: A rule base containing three levels of fault modes and response strategies is pre-established in the controller firmware, including an emergency fault rule layer, an important fault rule layer, and a general fault rule layer. Each rule is defined using a triplet structure of triggering condition, processing action, and execution constraint. When a fault is confirmed, the matching processing strategy is retrieved from the rule base according to the fault type. The emergency fault rule layer has the highest execution priority and handles serious anomalies that may cause equipment damage or safety hazards, including severe equipment overheating, severe main power supply voltage anomalies, and main processor malfunctions. The important fault rule layer handles anomalies that affect the normal operation of core functions, including main communication channel interruption, continuous deterioration of communication link quality, and failure of key sensors. The general fault rule layer handles anomalies that affect system operation but do not endanger core functions, including secondary sensor reading drift and insufficient local storage space.

4. The method for autonomous intelligent fault handling of a desert controller according to claim 1, characterized in that, Considering the impact of the fault on core functionality, the risk of its spread, and the possibility of self-healing, the severity level is output through membership mapping and Mamdani inference to optimize the handling strategy, including: A fuzzy reasoning mechanism is used to quantitatively assess the severity of a fault, taking into account the impact of the fault on core functions. Risk of fault propagation and the possibility of self-healing and recovery The fault severity level is output using three dimensions, through membership function mapping and the Mamdani inference method. Based on this, the optimal processing strategy is selected; The membership function used in the fuzzy inference determines the degree of impact of the fault on the core function. Dimension is defined as: =max(0,1 2.5 ), ∈[0,0.4]; =1 2.5 1.25|, ∈[0.3,0.7]; =max(0,2.5 1.5), ∈[0.6,1.0], where This represents the normalized impact index value.

5. The method for autonomous intelligent fault handling of a desert controller according to claim 1, characterized in that, A decision engine is constructed using a finite state machine extended with seven tuples. Based on the current state and fault events, it sequentially transitions between normal states, various degraded states, and states awaiting repair, and executes strategies, including: Based on extended finite state machine =( , , , , , , The architecture constructs a fault self-healing decision engine, in which... It is a finite set of states, including normal operation state, various degraded operation states, various fault handling transition states, and maintenance state; It is a collection of events, including various fault detection events, recovery confirmation events, external command events, and timed trigger events; It is a set of state variables used to record the current resource usage status, fault history information, performance statistics and configuration parameters of the system; The state transition function defines the target state that the system should transition to given the current state and the triggering event. The transition guard condition is a Boolean expression based on the state variable. The corresponding state transition is only allowed to be executed if the guard condition evaluates to true. The update function for state variables defines the rules for modifying state variables during state transitions; The initial state of the system is typically set to the normal operating state; based on the current operating state of the controller and fault events, the finite set of states... During the state transition, fault response measures are executed according to the rule base strategy; The extended finite state machine =( , , , , , , It supports a composite state mechanism, allowing the system to simultaneously exist in multiple degraded operating states. The state transition function... Given the current state and the triggering event, the transfer guard condition will only be met if... The state transition is executed only if the evaluation result is true, and the state variable update function is executed accordingly. Update the relevant state variables.

6. The method for autonomous intelligent fault handling of a desert controller according to claim 1, characterized in that, Leveraging dual communication channels, dual processor units, and redundant sensor channels, a backup module takeover function is activated in case of failure, including: The controller is configured with dual communication channels, dual processor units, and redundant sensor channels. When a functional module fails, a backup module is activated through a redundancy switching mechanism to take over the corresponding function. The dual communication channels adopt a heterogeneous redundancy architecture. The main channel uses a 4G / 5G cellular mobile network, while the backup channel uses BeiDou satellite short message communication. The two channels are completely independent in terms of transmission medium, communication protocol, and signal path. In the dual processor unit, the main processor and the backup processor synchronize status data in real time through a shared storage area. The backup processor continuously monitors the health status of the main processor and can take over control in milliseconds after detecting an anomaly.

7. The method for autonomous intelligent fault handling of a desert controller according to claim 1, characterized in that, The execution priority is dynamically adjusted according to the task priority formula, and non-core functions are disabled or reduced in frequency to ensure the continuous operation of core tasks, including: The execution priority of each task is dynamically adjusted according to the task priority calculation formula, and non-core functions are disabled or reduced in frequency to ensure the normal operation of core tasks in degraded mode. The task priority calculation formula is as follows: = · + · + · (1 / ) ； in, P i Let i be the dynamic execution priority of the i-th task. I i This represents the inherent importance coefficient of the task. U i As a factor of urgency for this task, R i This represents the resource consumption coefficient for this task. W base 、W urgent 、W resource There are three configurable weight parameters; This dynamic degradation and reconfiguration mechanism divides controller tasks into three levels: core tasks, important tasks, and secondary tasks. Core tasks include safety status monitoring, remote communication heartbeat maintenance, and emergency control command execution, ensuring normal execution in any degradation mode. Important tasks reduce their execution frequency when system resources are strained. Secondary tasks can be suspended in degradation mode. Task scheduling is based on inherent importance coefficients. Urgency factors and resource consumption coefficient Dynamically calculate the execution priority of each task. .

8. The method for autonomous intelligent fault handling of a desert controller according to claim 1, characterized in that, Continuous fault monitoring; once the fault clearance signal stabilizes through the observation window, a phased and smooth recovery to normal operation is achieved, including: When the fault clearance signal first appears, the observation timer is started, and relevant parameters are continuously monitored within the observation time window. Whether the internal stability remains within the normal threshold range; after confirming that the fault has been eliminated, perform recovery operations in stages. First, restore the isolated functional modules and verify that they are working properly, and then add the relevant tasks back to the scheduling queue; for cases involving the switching of redundant modules, use a load easing method to migrate the business from the backup module back to the primary module.

9. A fault autonomous intelligent processing system for a desert controller, characterized in that, include: The multi-source information fusion fault diagnosis module is used to collect status information from three levels: hardware layer, communication layer and functional layer. It uses weighted evidence theory to fuse multiple independent information sources, calculates the comprehensive confidence of fault modes, and confirms the fault if the comprehensive confidence exceeds the diagnostic threshold. The hierarchical rule base strategy retrieval module is used to pre-build a three-level fault rule base of emergency, important and general. Each rule is defined by a triplet of triggering condition, processing action and execution constraint. After the fault is confirmed, the corresponding processing strategy is matched. The fuzzy inference severity assessment module is used to comprehensively consider the three dimensions of the fault's impact on core functions, the risk of its spread, and the possibility of self-healing. It outputs the severity level through membership mapping and Mamdani inference, and then selects the best handling strategy. The extended finite state machine decision execution module is used to build a decision engine based on the seven-tuple extended finite state machine. It can orderly migrate and execute strategies between normal state, multiple degraded states, and state to be repaired based on the current state and fault events. The functional redundancy switching module is used to enable the backup module to take over the function in case of failure, relying on dual communication channels, dual processor units, and redundant sensor channels. The dynamic degradation and refactoring module is used to dynamically adjust the execution priority according to the task priority formula, and to disable or reduce the frequency of non-core functions to ensure the continuous operation of core tasks. The progressive self-healing recovery module is used to continuously monitor faults during degraded operation. After the fault elimination signal stabilizes through the observation window, it smoothly recovers to the normal operating state in stages.

10. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor is used to execute a program stored in a memory to implement the fault autonomous intelligent processing method of the Shagohuang controller as described in any one of claims 1-8.

11. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the fault autonomous intelligent processing method of the Shagohuang controller as described in any one of claims 1-8.

Images