Qualification judgment method and system for model link permissions in a digital twin system

Abstract

The application relates to the field of industrial digital twinning, and discloses a qualification judgment method and system for model link permissions in a digital twinning system, wherein the qualification judgment method for model link permissions in the digital twinning system comprises the following steps: constructing a multi-level link permission system in the digital twinning system, and setting corresponding permission levels for different model output links; uniformly organizing state semantic definitions, constraint activation states, observation availability and safety boundary parameters in the system; performing hard threshold inspection on a model requesting permission based on state benchmark data; performing risk threshold inspection on the model passing the hard threshold inspection; generating a corresponding qualification judgment result for the link permission applied by the model; and writing the qualification judgment result into the model management state of the digital twinning object, and releasing control or output blocking of the model output link according to the current effective permission state. The application has the advantage of improving the safety of the industrial digital twinning system.

Description

Technical Field

[0001] This invention relates to the field of industrial digital twins, specifically to a method and system for qualification assessment of model link permissions in a digital twin system. Background Technology

[0002] In industrial digital twin systems, multiple data-driven or physically constrained predictive, diagnostic, and control models are typically deployed. These models exhibit varying performance and reliability under different operating conditions. Simply categorizing models into "online" and "offline" binary states fails to meet the simultaneous requirements of security and availability in complex industrial scenarios. For example, a model might have high prediction accuracy under normal operating conditions but may produce physically impossible predictions under distributed off-system conditions; or a model might be suitable for short-term predictions but not for direct participation in closed-loop control. The industry lacks a fine-grained, dynamic model access control method capable of qualifying each model at runtime based on the current system state and constraints, and assigning corresponding link permissions.

[0003] Furthermore, with standards such as the EU Artificial Intelligence Act (EUAIAct) and ISO / IEC 42001 imposing requirements on the interpretability, auditability, and enforcement of constraints for high-risk AI systems, enterprises need an auditable method to demonstrate that AI models remain compliant and under control throughout deployment. However, existing technologies cannot provide continuous qualification monitoring and permission enforcement at the model level.

[0004] Therefore, it is essential to design a qualification review method and system for model link permissions in digital twin systems to enhance the security of industrial digital twin systems. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method and system for qualification review of model link permissions in a digital twin system, which has the advantage of improving the security of industrial digital twin systems and solves the problems mentioned in the background technology.

[0006] To achieve the aforementioned goal of enhancing the security of industrial digital twin systems, this invention provides the following technical solution: a method for qualification verification of model link permissions in a digital twin system, comprising the following steps: S1: Construct a multi-level link permission system in the digital twin system, set corresponding permission levels for different model output links, and form a model link permission mapping structure based on the risk scope, control capabilities and output restriction relationships corresponding to each permission level; S2: Obtain a snapshot of the current operating status of the digital twin system, and uniformly organize the state semantic definition, constraint activation status, observation availability and security boundary parameters in the system to form state benchmark data for permission adjudication; S3: Based on state baseline data, perform hard threshold checks on the model requesting permissions, and jointly verify the semantic consistency of model input and output, the domain of application of constraints, observation completeness, security boundary and task permission conditions to form the basic admission results of the model; S4: Perform a risk threshold test on the model that has passed the hard threshold test. Based on the model uncertainty calibration status, the degree of out-of-distribution training, the identifiability of model errors, the historical validation failure rate, and the upper bound of control risk, evaluate the risk constraints on the model link permissions. S5: Based on the risk constraint assessment results, generate corresponding qualification judgment results for the link permissions applied for by the model, and output one of the permission statuses of granting, degrading or denying, and generate corresponding qualification judgment results; S6: Write the qualification judgment result into the model governance state of the digital twin object, and release control or block output of the model output link according to the current valid permission state during decision output or control execution.

[0007] Preferably, the process of forming the model link permission mapping structure is as follows: The external output links in the digital twin system are functionally classified, and the predictive output, diagnostic output, control output, background shadow operation and offline verification operation are mapped to different permission levels respectively. Establish a permission risk association table based on the risk propagation scope and control impact intensity corresponding to each permission level; Configure corresponding output restriction rules, security constraint rules, and control authorization rules for different permission levels; Based on the inheritance and degradation relationships between permission levels, a multi-level permission conversion structure is formed; The permission mapping structure of the model link is constructed by combining the permission conversion structure and the permission risk association table.

[0008] Preferably, the process of forming state baseline data for authorization trials is as follows: Perform semantic parsing on the operational variables in the digital twin system to extract the variable name, physical meaning, unit definition, and value range; Scan the status of constraint cards in the current system to identify constraint objects that are active, suspended, or inactive; A unified verification is performed on the online status of sensors, the integrity of observation data, and the accuracy of observations to form an observation availability set. Based on the current operating conditions, extract the system safety boundary values ​​and control boundary thresholds, and uniformly associate variable semantics, constraint status, observation availability, and boundary parameters to form state benchmark data for permission adjudication.

[0009] Preferably, the process for forming the basic admission results of the model is as follows: The input variable definitions in the request permission model are matched with the semantics of the current system variables to identify missing variables and semantic conflicts. Based on the applicable domain of the constraint card bound to the model, determine whether the current system state is within the scope of the declaration; Perform joint linearity and accuracy checks on the observation data required for constrained verification of the execution model to identify failed observations; Considering the propagation of uncertainty in model predictions, a boundary extrapolation analysis is performed on the worst-case state of the prediction results. If the requested permissions include autonomous control permissions, then the validity of the stability certificate and security certificate corresponding to the model will be verified. Based on the semantic consistency results, applicable domain results, observation completeness results, security boundary results, and certificate verification results, the basic admission results for the model are formed.

[0010] Preferably, the process of risk constraint assessment for model link permissions is as follows: Obtain the uncertainty calibration certificate and coverage range corresponding to the model, and determine whether the current system state is within the coverage range; The degree of outside the model training distribution is calculated by the distance relationship between the current running state and the model training sample distribution; Based on current observation data, the degree of separability between model prediction bias and actual system changes is analyzed to form model error identification parameters; The historical failure rate and duration of failure of the statistical model on the validation benchmark set form a historical risk indicator; If control authority is involved, the worst-case risk upper bound corresponding to the control action is calculated under the condition of uncertainty propagation. Based on the uncertainty calibration results, the degree of out-of-distribution training, the identifiable parameters of model errors, historical risk indicators, and risk upper bound results, risk constraint assessment is performed on the model link permissions.

[0011] Preferably, the process for generating the corresponding qualification judgment result is as follows: Based on the model's basic admission results and risk constraint assessment results, each link of the model application is judged item by item. When the model meets the security and risk conditions of the corresponding permission level, the corresponding permission will be marked as granted. When a model meets some permission conditions but not the higher-level control conditions, the corresponding permissions will be downgraded, while the lower-level output permissions will be retained. When the model does not meet the basic admission or risk conditions corresponding to the current permission, the corresponding permission will be marked as denied. For granted status, the system generates the validity period and additional constraints of permissions; for downgraded status, it generates the reasons for downgrade and explanations of retained permissions; for rejected status, it generates the reasons for rejection and generates the corresponding qualification judgment results.

[0012] Preferably, the process of writing the eligibility determination result into the model governance state of the digital twin object is as follows: Establish a model governance state region for the digital twin object corresponding to the model; Write the authorization status, authorization validity period, additional constraints, and risk indicators from the qualification judgment results into the model governance status area; During the model output process, the permission status corresponding to the output link is read in real time; When output permission is granted, the model output is allowed to be released to the corresponding link; When the output permission is in a downgraded state, the model's output capability is limited according to the downgraded permission range. When the output permission is denied, the model output of the corresponding link is blocked.

[0013] This invention also discloses another technical solution: a qualification review system for model link permissions in a digital twin system, comprising: Link permission definition module: Constructs a multi-level link permission system in the digital twin system; State snapshot acquisition module: Acquires state semantic definitions, constraint states, observation availability, and security boundary parameters in the digital twin system; Hard threshold verification engine: Performs semantic compatibility verification, constraint applicability domain verification, observation completeness verification, security boundary verification, and task permission verification on the model of request permissions; Risk threshold verification engine: Performs risk constraint assessment based on model uncertainty calibration status, training out-of-distribution degree, model error identifiability, historical failure rate, and control risk upper bound; Qualification decision output module: Generates the granting, demotion, or denial results of model link permissions, and executes the corresponding permission control; Interactive interface module: Writes the qualification judgment result into the model governance status of the digital twin object, and controls the model output link according to the current permission status.

[0014] Compared with existing technologies, the present invention provides a method and system for qualification review of model link permissions in a digital twin system, which has the following beneficial effects: This invention introduces a hierarchical qualification review mechanism for model output links into a digital twin system, unifying and coupling model capability assessment, operational status constraints, and risk control processes to achieve dynamic and trustworthy access control for models in different business links. Compared to existing technical solutions that manage model calls based solely on fixed permission configurations or static whitelists, this invention combines the current system state, observation integrity, constraint applicability, and security boundary changes to determine in real time whether a model is qualified to participate in prediction, diagnosis, or control tasks. This effectively avoids the problem of models continuing to participate in critical business outputs under conditions of missing observations, out-of-bounds states, or mismatched applicable domains. By introducing a two-layer qualification screening structure of hard threshold checks and risk threshold checks, it pre-constrains the semantic consistency of model input and output, the validity of control certificates, and the risk of security boundary propagation. Combining the degree of model training out-of-distribution, uncertainty calibration status, and historical failure rate, it dynamically quantifies the potential failure risk of models under complex operating conditions, enabling model permissions to be granted, downgraded, or denied based on actual trustworthiness, thus improving the security stability and risk isolation capabilities of the digital twin system in highly dynamic operating scenarios. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the method of the present invention; Figure 2 This is a schematic diagram of the structure of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Example 1: Please refer to Figure 1 The qualification assessment method for model link permissions in the digital twin system of this invention includes the following steps: S1: Construct a multi-level link permission system in the digital twin system, set corresponding permission levels for different model output links, and form a model link permission mapping structure based on the risk scope, control capabilities and output restriction relationships corresponding to each permission level; The process of forming the model link permission mapping structure in S1 is as follows: The external output links in the digital twin system are functionally classified, and the predictive output, diagnostic output, control output, background shadow operation and offline verification operation are mapped to different permission levels respectively. Establish a permission risk association table based on the risk propagation scope and control impact intensity corresponding to each permission level; Configure corresponding output restriction rules, security constraint rules, and control authorization rules for different permission levels; Based on the inheritance and degradation relationships between permission levels, a multi-level permission conversion structure is formed; The permission mapping structure of the model link is constructed by combining the permission conversion structure and the permission risk association table.

[0018] S2: Obtain a snapshot of the current operating status of the digital twin system, and uniformly organize the state semantic definition, constraint activation status, observation availability and security boundary parameters in the system to form state benchmark data for permission adjudication; The process of forming state baseline data for authorization trials in S2 is as follows: Perform semantic parsing on the operational variables in the digital twin system to extract the variable name, physical meaning, unit definition, and value range; Scan the status of constraint cards in the current system to identify constraint objects that are active, suspended, or inactive; A unified verification is performed on the online status of sensors, the integrity of observation data, and the accuracy of observations to form an observation availability set. Based on the current operating conditions, extract the system safety boundary values ​​and control boundary thresholds, and uniformly associate variable semantics, constraint status, observation availability, and boundary parameters to form state benchmark data for permission adjudication.

[0019] S3: Based on state baseline data, perform hard threshold checks on the model requesting permissions, and jointly verify the semantic consistency of model input and output, the domain of application of constraints, observation completeness, security boundary and task permission conditions to form the basic admission results of the model; The process of forming the basic admission results for the model in S3 is as follows: The input variable definitions in the request permission model are matched with the semantics of the current system variables to identify missing variables and semantic conflicts. Based on the applicable domain of the constraint card bound to the model, determine whether the current system state is within the scope of the declaration; Perform joint linearity and accuracy checks on the observation data required for constrained verification of the execution model to identify failed observations; Considering the propagation of uncertainty in model predictions, a boundary extrapolation analysis is performed on the worst-case state of the prediction results. If the requested permissions include autonomous control permissions, then the validity of the stability certificate and security certificate corresponding to the model will be verified. Based on the semantic consistency results, applicable domain results, observation completeness results, security boundary results, and certificate verification results, the basic admission results for the model are formed.

[0020] S4: Perform a risk threshold test on the model that has passed the hard threshold test. Based on the model uncertainty calibration status, the degree of out-of-distribution training, the identifiability of model errors, the historical validation failure rate, and the upper bound of control risk, evaluate the risk constraints on the model link permissions. The process of risk constraint assessment for model link permissions in S4 is as follows: Obtain the uncertainty calibration certificate and coverage range corresponding to the model, and determine whether the current system state is within the coverage range; The degree of outside the model training distribution is calculated by the distance relationship between the current running state and the model training sample distribution; Based on current observation data, the degree of separability between model prediction bias and actual system changes is analyzed to form model error identification parameters; The historical failure rate and duration of failure of the statistical model on the validation benchmark set form a historical risk indicator; If control authority is involved, the worst-case risk upper bound corresponding to the control action is calculated under the condition of uncertainty propagation. Based on the uncertainty calibration results, the degree of out-of-distribution training, the identifiable parameters of model errors, historical risk indicators, and risk upper bound results, risk constraint assessment is performed on the model link permissions.

[0021] S5: Based on the risk constraint assessment results, generate corresponding qualification judgment results for the link permissions applied for by the model, and output one of the permission statuses of granting, degrading or denying, and generate corresponding qualification judgment results; The process of generating the corresponding qualification judgment result in S5 is as follows: Based on the model's basic admission results and risk constraint assessment results, each link of the model application is judged item by item. When the model meets the security and risk conditions of the corresponding permission level, the corresponding permission will be marked as granted. When a model meets some permission conditions but not the higher-level control conditions, the corresponding permissions will be downgraded, while the lower-level output permissions will be retained. When the model does not meet the basic admission or risk conditions corresponding to the current permission, the corresponding permission will be marked as denied. For granted status, the system generates the validity period and additional constraints of permissions; for downgraded status, it generates the reasons for downgrade and explanations of retained permissions; for rejected status, it generates the reasons for rejection and generates the corresponding qualification judgment results.

[0022] S6: Write the qualification judgment result into the model governance state of the digital twin object, and release control or block output of the model output link according to the current valid permission state during decision output or control execution.

[0023] The process of writing the eligibility determination result into the model governance state of the digital twin object in S6 is as follows: Establish a model governance state region for the digital twin object corresponding to the model; Write the authorization status, authorization validity period, additional constraints, and risk indicators from the qualification judgment results into the model governance status area; During the model output process, the permission status corresponding to the output link is read in real time; When output permission is granted, the model output is allowed to be released to the corresponding link; When the output permission is in a downgraded state, the model's output capability is limited according to the downgraded permission range. When the output permission is denied, the model output of the corresponding link is blocked.

[0024] Example 2: Figure 2 As shown, the qualification review system for model link permissions in a digital twin system includes: Link permission definition module: Constructs a multi-level link permission system in the digital twin system; State snapshot acquisition module: Acquires state semantic definitions, constraint states, observation availability, and security boundary parameters in the digital twin system; Hard threshold verification engine: Performs semantic compatibility verification, constraint applicability domain verification, observation completeness verification, security boundary verification, and task permission verification on the model of request permissions; Risk threshold verification engine: Performs risk constraint assessment based on model uncertainty calibration status, training out-of-distribution degree, model error identifiability, historical failure rate, and control risk upper bound; Qualification decision output module: Generates the granting, demotion, or denial results of model link permissions, and executes the corresponding permission control; Interactive interface module: Writes the qualification judgment result into the model governance status of the digital twin object, and controls the model output link according to the current permission status.

[0025] Example 3: In the simulation and real-world scenario transfer of a quadruped robot, multiple models were deployed: a linear prediction model A based on the Koopman operator and a contact force field prediction model B based on the Fourier neural operator (FNO). Link permissions were defined. Initially, model A, validated on hardened ground, passed both hard and risk thresholds and was granted production prediction, production diagnostics, and shadow permissions, but could not be used for production control (due to a lack of long-term contact stability certification). Model B, calibrated on soft sand terrain, was granted production prediction, production diagnostics, diagnostics, and production control permissions (because its contact force predictions were validated on multiple terrains).

[0026] When the robot moves from hardened ground to soft sand, the system state snapshot changes. The hard threshold detects that the constraint applicability domain of model A (hardened ground contact model constraints) does not match the current state, marking its constraints as not_applicable (suspended). Simultaneously, the safety boundary pre-check shows that the uncertainty of model A on the sand leads to a worst-case out-of-bounds scenario. Therefore, model A's production control permission request is directly rejected; its production prediction and diagnostic permissions are downgraded to diagnostics and shadowing (only allowed for background comparison, not for control). Model B's constraint applicability domain matches, and it holds a valid uncertainty certificate for the terrain, therefore retaining all its permissions. The eligibility decision is written to TwinObject. When Bridge subsequently generates the action space, it will prohibit the use of any output from model A for control and prompt the operator that model B is currently the trusted control model.

[0027] Example 4: The reactor was equipped with a data-driven temperature prediction model C and a physics-based equilibrium model D. During normal operation, model C demonstrated high accuracy and was granted production prediction privileges. When catalyst activity monitoring showed it was outside the training distribution of model C, the OOD (Out of Detail) detection and constraint applicability domain matching detection in HardGate flagged model C as non-compliant. Model C's production prediction privileges were downgraded to diagnostic (for comparative analysis only), and production prediction was instead performed using the conservative physics model D. Simultaneously, since model D lacked optimization control capabilities, the production control privilege request was rejected, triggering a safety fallback strategy. The entire process was fully audited and complies with interpretable AI regulations.

[0028] Example 5: For models applying for production control authority, an intervention effectiveness review is added to the risk threshold: checking whether the model has been trained or validated on data containing changes in control actions, and whether it can distinguish between correlation and causation. If the model only has passive observation fitting ability and no counterfactual evidence for intervention, then even if the hard threshold is passed, the control authority is downgraded to diagnostic or shadow control.

[0029] As can be understood from the above specific implementation methods, the present invention achieves decoupling and automated governance of the security and availability of model applications in digital twin systems through a fine-grained link permission system and two-phase verification.

[0030] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0031] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A qualification assessment method for model link permissions in a digital twin system, characterized in that, Includes the following steps: S1: Construct a multi-level link permission system in the digital twin system, set corresponding permission levels for different model output links, and form a model link permission mapping structure based on the risk scope, control capabilities and output restriction relationships corresponding to each permission level; S2: Obtain a snapshot of the current operating status of the digital twin system, and uniformly organize the state semantic definition, constraint activation status, observation availability and security boundary parameters in the system to form state benchmark data for permission adjudication; S3: Based on state baseline data, perform hard threshold checks on the model requesting permissions, and jointly verify the semantic consistency of model input and output, the domain of application of constraints, observation completeness, security boundary and task permission conditions to form the basic admission results of the model; S4: Perform a risk threshold test on the model that has passed the hard threshold test. Based on the model uncertainty calibration status, the degree of out-of-distribution training, the identifiability of model errors, the historical validation failure rate, and the upper bound of control risk, evaluate the risk constraints on the model link permissions. S5: Based on the risk constraint assessment results, generate corresponding qualification judgment results for the link permissions applied for by the model, and output one of the permission statuses of granting, degrading or denying, and generate corresponding qualification judgment results; S6: Write the qualification judgment result into the model governance state of the digital twin object, and release control or block output of the model output link according to the current valid permission state during decision output or control execution.

2. The qualification assessment method for model link permissions in a digital twin system according to claim 1, characterized in that, The process of forming the model link permission mapping structure is as follows: The external output links in the digital twin system are functionally classified, and the predictive output, diagnostic output, control output, background shadow operation and offline verification operation are mapped to different permission levels respectively. Establish a permission risk association table based on the risk propagation scope and control impact intensity corresponding to each permission level; Configure corresponding output restriction rules, security constraint rules, and control authorization rules for different permission levels; Based on the inheritance and degradation relationships between permission levels, a multi-level permission conversion structure is formed; The permission mapping structure of the model link is constructed by combining the permission conversion structure and the permission risk association table.

3. The qualification assessment method for model link permissions in a digital twin system according to claim 2, characterized in that, The process of generating state baseline data for authorization trials is as follows: Perform semantic parsing on the operational variables in the digital twin system to extract the variable name, physical meaning, unit definition, and value range; Scan the status of constraint cards in the current system to identify constraint objects that are active, suspended, or inactive; A unified verification is performed on the online status of sensors, the integrity of observation data, and the accuracy of observations to form an observation availability set. Based on the current operating conditions, extract the system safety boundary values ​​and control boundary thresholds, and uniformly associate variable semantics, constraint status, observation availability, and boundary parameters to form state benchmark data for permission adjudication.

4. The qualification assessment method for model link permissions in a digital twin system according to claim 3, characterized in that, The process of forming the basic admission results for the model is as follows: The input variable definitions in the request permission model are matched with the semantics of the current system variables to identify missing variables and semantic conflicts. Based on the applicable domain of the constraint card bound to the model, determine whether the current system state is within the scope of the declaration; Perform joint linearity and accuracy checks on the observation data required for constrained verification of the execution model to identify failed observations; Considering the propagation of uncertainty in model predictions, a boundary extrapolation analysis is performed on the worst-case state of the prediction results. If the requested permissions include autonomous control permissions, then the validity of the stability certificate and security certificate corresponding to the model will be verified. Based on the semantic consistency results, applicable domain results, observation completeness results, security boundary results, and certificate verification results, the basic admission results for the model are formed.

5. The qualification assessment method for model link permissions in a digital twin system according to claim 4, characterized in that, The process of risk constraint assessment for model link permissions is as follows: Obtain the uncertainty calibration certificate and coverage range corresponding to the model, and determine whether the current system state is within the coverage range; The degree of outside the model training distribution is calculated by the distance relationship between the current running state and the model training sample distribution; Based on current observation data, the degree of separability between model prediction bias and actual system changes is analyzed to form model error identification parameters; The historical failure rate and duration of failure of the statistical model on the validation benchmark set form a historical risk indicator; If control authority is involved, the worst-case risk upper bound corresponding to the control action is calculated under the condition of uncertainty propagation. Based on the uncertainty calibration results, the degree of out-of-distribution training, the identifiable parameters of model errors, historical risk indicators, and risk upper bound results, risk constraint assessment is performed on the model link permissions.

6. The qualification assessment method for model link permissions in a digital twin system according to claim 5, characterized in that, The process of generating the corresponding qualification judgment result is as follows: Based on the model's basic admission results and risk constraint assessment results, each link of the model application is judged item by item. When the model meets the security and risk conditions of the corresponding permission level, the corresponding permission will be marked as granted. When a model meets some permission conditions but not the higher-level control conditions, the corresponding permissions will be downgraded, while the lower-level output permissions will be retained. When the model does not meet the basic admission or risk conditions corresponding to the current permission, the corresponding permission will be marked as denied. For granted status, the system generates the validity period and additional constraints of permissions; for downgraded status, it generates the reasons for downgrade and explanations of retained permissions; for rejected status, it generates the reasons for rejection and generates the corresponding qualification judgment results.

7. The qualification assessment method for model link permissions in a digital twin system according to claim 6, characterized in that, The process of writing the eligibility determination result into the model governance status of the digital twin object is as follows: Establish a model governance state region for the digital twin object corresponding to the model; Write the authorization status, authorization validity period, additional constraints, and risk indicators from the qualification judgment results into the model governance status area; During the model output process, the permission status corresponding to the output link is read in real time; When output permission is granted, the model output is allowed to be released to the corresponding link; When the output permission is in a downgraded state, the model's output capability is limited according to the downgraded permission range. When the output permission is denied, the model output of the corresponding link is blocked.

8. A qualification assessment system for model link permissions in a digital twin system, applied to the qualification assessment method for model link permissions in a digital twin system as described in any one of claims 1-7, characterized in that, include: Link permission definition module: Constructs a multi-level link permission system in the digital twin system; State snapshot acquisition module: Acquires state semantic definitions, constraint states, observation availability, and security boundary parameters in the digital twin system; Hard threshold verification engine: Performs semantic compatibility verification, constraint applicability domain verification, observation completeness verification, security boundary verification, and task permission verification on the model of request permissions; Risk threshold verification engine: Performs risk constraint assessment based on model uncertainty calibration status, training out-of-distribution degree, model error identifiability, historical failure rate, and control risk upper bound; Qualification decision output module: Generates the granting, demotion, or denial results of model link permissions, and executes the corresponding permission control; Interactive interface module: Writes the qualification judgment result into the model governance status of the digital twin object, and controls the model output link according to the current permission status.

Images