Abnormal pattern recognition method and system based on PLC operation log

Abstract

The application provides an abnormal mode recognition method and system based on a PLC operation log. The method effectively separates an event ID sequence and a parameter vector sequence from an original log stream, extracts respective time sequence features from the two modalities in parallel, and on this basis, performs deep cross-modal feature fusion on the obtained event feature sequence and parameter feature sequence to generate a multi-modal fusion feature vector capable of comprehensively representing a PLC operation state, thereby providing rich and accurate input for subsequent abnormality judgment. In this way, the shortcomings of existing methods in heterogeneous log fusion are effectively overcome, and the model's ability to recognize complex industrial abnormal patterns is significantly enhanced.

Description

Technical Field

[0001] This invention relates to the field of intelligent identification technology, specifically to an abnormal pattern identification method and system based on PLC operation logs. Background Technology

[0002] In modern industrial control systems, programmable logic controllers (PLCs) serve as the core control unit, and their stable operation is crucial for ensuring production safety and efficiency. With the rapid development of industrial automation and data acquisition technologies, PLCs generate a large amount of operational logs during operation. However, with the increasing complexity of industrial systems and the explosive growth of log data, traditional manual inspections and experience-based fault diagnosis methods are no longer sufficient to meet the demands for real-time, accurate, and early warning of potential faults. This delayed and inefficient fault identification method can not only lead to production stoppages and equipment damage but also trigger safety accidents, severely impacting the economic benefits and reputation of enterprises. Therefore, constructing an automated anomaly pattern recognition scheme based on PLC operational logs to achieve early detection and warning of potential faults is of paramount importance for improving the intelligence level of industrial systems and ensuring production continuity.

[0003] While various methods exist for anomaly detection using PLC operation logs, these techniques generally face significant technical challenges. First, PLC logs are essentially multimodal data streams, containing both discrete event sequences (such as operation commands and alarm codes) and embedded continuously changing numerical parameters (such as temperature, pressure, and current). Existing methods often struggle to effectively integrate the discrete event sequences with the embedded continuously changing numerical parameters when processing this heterogeneous log data, resulting in models failing to comprehensively capture the entire system operation. This limitation leads to low accuracy and poor generalization ability in identifying complex anomaly patterns manifested as "compliant events, abnormal parameters," or "violations of implicit process logic," making it difficult to effectively handle novel faults not explicitly present in the training data.

[0004] Therefore, an optimized method for anomaly pattern recognition based on PLC operation logs is needed. Summary of the Invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art, and provides an abnormal pattern recognition method and system based on PLC operation logs.

[0006] In a first aspect, embodiments of the present invention provide an anomaly pattern recognition method based on PLC operation logs, comprising: Obtain the raw PLC log stream; Log parsing and dual-modal data stream separation are performed on the original PLC log stream to obtain the event ID sequence and parameter vector sequence; Dual-channel parallel temporal feature extraction is performed on the event ID sequence and parameter vector sequence to obtain the event feature sequence and parameter feature sequence; Cross-modal feature fusion is performed on event feature sequences and parameter feature sequences to obtain a multimodal fusion feature vector of PLC logs; The multimodal fusion feature vector of the PLC log is input into the anomaly judgment model to obtain the anomaly score; Based on the comparison between the abnormal score and the preset threshold, it is determined whether there is a fault in the main control PLC of the wind turbine.

[0007] Secondly, embodiments of the present invention provide an anomaly pattern recognition system based on PLC operation logs, comprising: The raw PLC log stream acquisition module is used to acquire the raw PLC log stream; The log parsing and dual-modal data stream separation module is used to parse the original PLC log stream and separate the dual-modal data stream to obtain the event ID sequence and parameter vector sequence; A dual-channel parallel temporal feature extraction module is used to perform dual-channel parallel temporal feature extraction on the event ID sequence and parameter vector sequence to obtain the event feature sequence and parameter feature sequence; The cross-modal feature fusion module is used to perform cross-modal feature fusion on event feature sequences and parameter feature sequences to obtain a multimodal fusion feature vector of PLC logs; The anomaly detection module is used to input the multimodal fusion feature vector of the PLC log into the anomaly detection model to obtain an anomaly score; The fault identification module is used to determine whether there is a fault in the main control PLC of the wind turbine based on the comparison between the abnormal score and the preset threshold.

[0008] Compared with existing technologies, this invention provides an anomaly pattern recognition method and system based on PLC operation logs. It effectively separates the event ID sequence and parameter vector sequence from the original log stream, extracts the temporal features of each modality in parallel, and then performs deep cross-modal feature fusion on the resulting event feature sequence and parameter feature sequence to generate a multimodal fused feature vector that comprehensively characterizes the PLC's operating state, providing rich and accurate input for subsequent anomaly judgment. This approach effectively overcomes the shortcomings of existing methods in heterogeneous log fusion and significantly enhances the model's ability to recognize complex industrial anomaly patterns. Attached Figure Description

[0009] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0010] Figure 1 A flowchart of an anomaly pattern recognition method based on PLC operation logs according to an embodiment of the present invention; Figure 2 This is a data flow diagram illustrating the abnormal pattern recognition method based on PLC operation logs according to an embodiment of the present invention. Figure 3 This is a block diagram of an anomaly pattern recognition system based on PLC operation logs according to an embodiment of the present invention. Detailed Implementation

[0011] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0012] Unless otherwise specifically stated, the technical or scientific terms used in the embodiments of this invention should be understood in their ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains. The terms "comprising" or "including," as used in the embodiments of this invention, do not limit the shapes, numbers, steps, actions, operations, components, elements, and / or groups thereof mentioned, nor do they exclude the appearance or addition of one or more other different shapes, numbers, steps, actions, operations, components, elements, and / or groups thereof, or the inclusion of these.

[0013] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale, and techniques, methods, and apparatus known to those skilled in the art may not be discussed in detail; however, where appropriate, the illustrated techniques, methods, and apparatus should be considered part of the specification. In all the examples shown and discussed herein, any other specific example may have different values. It should be noted that similar symbols and letters in the following figures denote similar items; therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0014] In the description of the embodiments of the present invention, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In the embodiments of the present invention, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in the embodiments of the present invention, as well as the features of different embodiments or examples.

[0015] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0016] In the technical solution of this invention, an abnormal pattern recognition method based on PLC operation log is proposed. Figure 1 This is a flowchart of an anomaly pattern recognition method based on PLC operation logs according to an embodiment of the present invention. Figure 2 This is a system architecture diagram of an anomaly pattern recognition method based on PLC operation logs according to an embodiment of the present invention. Figure 1 and Figure 2 As shown, the abnormal pattern recognition method based on PLC operation logs according to an embodiment of the present invention includes the following steps: S1, acquiring the original PLC log stream; S2, performing log parsing and dual-modal data stream separation on the original PLC log stream to obtain an event ID sequence and a parameter vector sequence; S3, performing dual-channel parallel time-series feature extraction on the event ID sequence and parameter vector sequence to obtain an event feature sequence and a parameter feature sequence; S4, performing cross-modal feature fusion on the event feature sequence and parameter feature sequence to obtain a PLC log multimodal fusion feature vector; S5, inputting the PLC log multimodal fusion feature vector into an abnormal decision model to obtain an abnormal score; S6, determining whether there is a fault in the main control PLC of the fan based on the comparison between the abnormal score and a preset threshold.

[0017] Specifically, in step S1, the raw PLC log stream is acquired. The raw PLC log stream refers to the sequence of data generated and output in real time by the programmable logic controller (PLC) during its operation, without any processing or parsing. This log data is continuous and typically unstructured or semi-structured, directly reflecting the execution status of the PLC's internal program, changes in input / output points, real-time values ​​of control parameters, and various events generated by the system (such as alarms and operation instructions). In the technical solution of this invention, acquiring the raw PLC log stream provides indispensable raw data support for identifying potential faults.

[0018] In practical industrial applications, the acquisition of raw PLC log streams is typically achieved through various mature industrial data acquisition technologies. This includes, but is not limited to, direct connection to the PLC device via industrial Ethernet, serial communication (such as Modbus RTU / TCP), or dedicated PLC communication protocols (such as Siemens S7 protocol, Rockwell EtherNet / IP) for real-time data acquisition. During this process, the PLC continuously generates log events and parameter updates according to its programming configuration. This data is then received, buffered, and formed into a continuous data stream by a data acquisition card, industrial gateway, or data server in a SCADA system, and transmitted in real-time to the log management system or data processing platform, thus constituting the raw PLC log stream. This process ensures the integrity, real-time nature, and sequence of the log data, laying a solid foundation for subsequent log parsing and feature extraction.

[0019] Specifically, in step S2, the original PLC log stream is parsed and separated into two modal data streams to obtain an event ID sequence and a parameter vector sequence. This step aims to transform the raw, complex PLC log data into a structured and classified two-modal data stream that can be directly processed by machine learning models. It should be understood that existing methods often struggle to effectively integrate discrete event sequences with embedded, continuously changing numerical parameters when processing such heterogeneous log data, resulting in models failing to fully capture the overall picture of system operation. Therefore, effectively parsing the logs and separating these two modalities is crucial for subsequent feature extraction and anomaly detection. It ensures that the model can process and ultimately integrate information from different data dimensions, thereby gaining a more comprehensive understanding of the system state.

[0020] In practice, the original PLC log stream is first parsed to obtain a structured log stream. That is, through structured parsing, the original, usually text-based, unstructured or semi-structured log entries are converted into a standardized, machine-processable structured format. Specifically, by identifying fixed patterns (i.e., log templates) and variable parts (i.e., parameters) in the log, log parsing algorithms (such as template matching, clustering, or regular expression-based methods) are used to extract the timestamp, log level, event template, and all embedded numerical and text parameters for each log entry, thereby generating a structured log stream.

[0021] Next, based on the event dictionary, an event ID sequence is extracted from the structured log stream. During this process, the system maintains a pre-built or dynamically updated event dictionary, which maps each unique log template to a unique integer identifier, i.e., the event ID. Therefore, each structured log entry is assigned a corresponding event ID based on its matching template, forming a discrete sequence of event IDs arranged chronologically. This step provides an abstract representation of operations and state changes in the log.

[0022] Simultaneously, based on global parameter patterns and normalized parameters, a parameter vector sequence is extracted from the structured log stream. That is, all numerical parameters identified from the structured log are uniformly extracted according to a preset global parameter pattern (i.e., the general location and type rules of parameters in the log). Then, the extracted parameters are normalized (e.g., commonly used Min-Max normalization or Z-score normalization) to eliminate differences in units, scales, and ranges between different parameters to a unified standard range, ultimately forming a parameter vector sequence containing continuous numerical features. In this way, the mixed information in the original log is effectively decoupled, providing a clear and standardized input for subsequent dual-channel parallel time-series feature extraction.

[0023] Specifically, in step S3, dual-channel parallel temporal feature extraction is performed on the event ID sequence and parameter vector sequence to obtain the event feature sequence and parameter feature sequence. It should be understood that PLC log data is typical multimodal data, containing both discrete event sequences and embedded continuously changing numerical parameters. Relying solely on the original IDs or values ​​is insufficient to reveal its dynamic patterns and deep correlations. Therefore, in the technical solution of this invention, dual-channel parallel temporal feature extraction is performed on the event ID sequence and parameter vector sequence through parallel feature extraction channels to fully exploit the temporal characteristics of these two different modalities, enabling the model to more comprehensively understand the complex context of system operation. In this way, the system can capture the inherent temporal patterns, dependencies, and deep semantic information from the decoupled discrete event stream and continuous parameter stream, respectively, laying a high-quality feature foundation for subsequent cross-modal feature fusion.

[0024] In practice, the process begins with temporal feature extraction from the event ID sequence. This involves deeply mining the inherent semantic information, temporal patterns, and inter-event relationships from the extracted discrete event ID sequences, transforming them into high-dimensional, continuous, and expressive event feature sequences. This provides high-quality input for subsequent feature fusion and anomaly detection. Specifically, this process includes: First, event embedding is performed on each event ID in the event ID sequence to obtain an event embedding vector sequence. Event embedding is a technique that maps discrete event IDs to a continuous, low-dimensional vector space. In this process, each unique event ID (e.g., an identifier representing a specific operation or state such as "motor start" or "sensor alarm") is transformed into a fixed-length real-valued vector. These embedding vectors capture the semantic similarity between events through learning (e.g., through a trainable embedding layer), ensuring that semantically related or functionally similar events in the vector space have closer embedding vectors. This allows the model to abstract deeper semantic representations from the event IDs themselves, going beyond simple discrete identifiers, thus laying the foundation for subsequent complex pattern recognition.

[0025] Secondly, after injecting positional information into each event embedding vector in the event embedding vector sequence, it is input into the Transformer encoder to obtain the event feature sequence. In this process, since the Transformer model itself does not have the ability to process sequence order, positional information needs to be injected into the event embedding vector sequence. This is typically achieved by generating positional encoding vectors that match the dimensions of the event embedding vectors and then superimposing (adding) or concatenating them with the embedding vector of each event. These positional encoding vectors can be pre-computed (e.g., using sine and cosine functions) or are learnable. By injecting positional information, the model can understand the relative or absolute order of events in the sequence. Finally, the event embedding vector sequence injected with positional information is input into the Transformer encoder. The Transformer encoder effectively captures long-range dependencies in the event sequence using its multi-head self-attention mechanism and feedforward network layers, understanding the global correlations and contextual information between different events, thereby outputting an event feature sequence containing event temporal patterns and semantic relationships.

[0026] Furthermore, temporal feature extraction is performed on the parameter vector sequence to deeply explore its inherent temporal dynamics, trends, and potential anomaly patterns from these continuously changing numerical parameters. Specifically, this process includes: First, a dimension-matched convolution is performed on the parameter vector sequence to obtain a dimension-matched parameter vector sequence. This step aims to handle the dimensionality diversity or potential inconsistencies of the original parameter vector sequence and to perform preliminary temporal feature extraction of the original parameter features. Specifically, the original parameter vector sequence may consist of different numbers of real-time measured parameters, or its dimensions may not be suitable for direct input into subsequent deep networks. By applying a one-dimensional convolution operation, the parameter vector at each time step can be mapped to a new, unified dimensional space through a small sliding window and a series of convolution kernels. This process not only achieves dimension matching, ensuring that the parameter representations at all time steps have the same dimension, facilitating subsequent processing, but the convolution operation itself also locally captures the correlations and short-term change patterns within adjacent parameters or parameter groups. For example, it can identify instantaneous changes or interactions of specific parameter combinations through weight sharing.

[0027] Secondly, the parameter vector sequence after dimension matching is subjected to multi-layer dilated causal convolutional encoding to obtain the parameter feature sequence. It should be understood that causal relationships and state influences often exhibit strong temporal concentration; the occurrence of an event is often highly correlated with the dynamic parameters within its immediate time window. Therefore, in the technical solution of this invention, the parameter vector sequence after dimension matching is subjected to multi-layer dilated causal convolutional encoding to capture long-range temporal dependencies and causal relationships in the parameter sequence, forming highly condensed parameter temporal features. In this process, "multi-layer" refers to stacking multiple dilated causal convolutional layers, each of which can learn higher-level, more abstract temporal patterns based on the previous layer. Through progressive feature extraction, the model can gradually abstract more discriminative temporal features from the original parameters. Causal convolution is a crucial characteristic for temporal data, ensuring that when calculating the output features at the current time step, the model only utilizes the input information from the current and past time steps. This strict temporal causality, by simulating the unidirectional flow of information in a real system, prevents future information leakage from interfering with current predictions or anomaly judgments. Furthermore, by introducing the concept of holes, the convolutional kernel can cover a larger input region (i.e., have a larger receptive field) without increasing the number of parameters or sacrificing resolution. This means that the model can capture the influence of parameter values ​​far from the current time point on the current state at a shallower level, effectively solving the efficiency problem of traditional convolution in capturing long-range dependencies. Thus, this encoder can extract a parameter feature sequence from the dimension-matched parameter vector sequence that contains both local details and global long-range dependencies, and strictly follows the temporal causal order. This feature sequence highly condenses the health and anomaly patterns of parameters over time, providing a high-quality continuous data representation for subsequent fusion with event features.

[0028] Specifically, in S4, cross-modal feature fusion is performed on the event feature sequence and parameter feature sequence to obtain a multimodal fusion feature vector of the PLC log. It should be understood that in specific industrial scenarios involving the processing of programmable logic controller (PLC) operation logs, traditional cross-modal attention mechanisms have inherent limitations. Their core problem stems from a context-independent global similarity calculation model, leading to two key technical weaknesses in understanding complex industrial processes: First, a lack of temporal locality bias. Causal relationships and state influences in industrial processes often exhibit strong temporal concentration; the occurrence of an event is often highly correlated with the dynamic parameters within its immediate time window. Traditional mechanisms treat parameter features at all positions in the time series equally when calculating attention, which can dilute the model's attention to distant and irrelevant historical parameter fluctuations, thus weakening its sensitivity to detecting anomalies that occur instantaneously or evolve rapidly. Second, it ignores the inherent event-parameter semantic affinity. In control systems, specific event types naturally exhibit varying degrees of correlation with specific subsets of parameters. For example, motor starting events are closely related to current and speed parameters, but almost unrelated to ambient humidity. Traditional mechanisms rely entirely on implicitly learning this correlation from scratch using data, failing to effectively utilize the prior knowledge inherent in physical laws or technological processes. This not only may lead to the model's inability to establish reliable correlations when training data is sparse, but also reduces the model's learning efficiency and final discrimination accuracy.

[0029] To address the aforementioned technical issues, this invention proposes a dual-gated spatiotemporal attention fusion mechanism. This mechanism introduces a time decay gate and a semantic affinity gate in parallel within the standard attention computation process. Through a multiplicative gating interaction, it guides the model to intelligently focus attention on the correct time and the correct parameter dimensions.

[0030] In practice, firstly, a linear transformation is performed on the event feature sequence to obtain the query sequence, and a linear transformation is also performed on the parameter feature sequence to obtain the key sequence and value sequence. It should be understood that although both the event feature sequence and the parameter feature sequence contain rich temporal information, they are generated by the Transformer encoder and the multi-layer dilated causal convolutional encoder, respectively, and their internal physical semantics and dimensionality may differ. The role of the linear transformation is to assign different roles to the features of each modality within the attention mechanism. Specifically, the event feature sequence is linearly mapped to the query sequence, which represents the problem for which the model is currently seeking information of interest; simultaneously, the parameter feature sequence is linearly mapped to the key sequence and value sequence, where the key sequence represents the index of information available for querying, and the value sequence contains the information content to be extracted.

[0031] Next, a time decay matrix is ​​constructed based on the query sequence and key sequence. This step aims to introduce a mechanism into the model that prioritizes parameter states that are temporally adjacent to the current event, thereby overcoming the time independence defect. Specifically, for each possible query-key time step pair, a distance decay weight is generated using a Gaussian function centered on the query time step; the closer the distance, the higher the weight, and the farther the distance, the more exponentially the weight decays. This process is expressed by the formula:

[0032] in, This represents the time decay weight between query time step t and key time step j; t and j are the time step indices in the query sequence and key sequence, respectively. This is a hyperparameter that controls the decay rate and determines the width of the time attention window. This step embeds the temporal locality prevalent in industrial processes as prior knowledge into the model. This forces the model to prioritize parameter dynamics closely related to the current event when allocating attention, thereby significantly improving its ability to capture transient changes or rapid-response anomalies.

[0033] Furthermore, based on the event feature sequence, parameter feature sequence, and time decay matrix, a gated attention weight matrix is ​​calculated. This step aims to establish a mechanism that can explicitly model the strength of the intrinsic correlation between specific event types and specific parameter types, thus compensating for the semantic irrelevance of the original mechanism. In this process, firstly, a basic attention score matrix is ​​calculated based on the event feature sequence and parameter feature sequence; the calculation of the basic attention score follows the standard dot product model. Next, a semantic affinity gate matrix is ​​calculated based on the event feature sequence and parameter feature sequence; the calculation of the semantic affinity gate introduces learnable parameters. Finally, the gated attention weight matrix is ​​determined based on the basic attention score matrix, the semantic affinity gate matrix, and the time decay matrix. Specifically, the basic attention score, the time decay weight obtained in the previous step, and the semantic affinity gate calculated in this step are multiplicatively fused using Hadamard multiplication. This step constructs a strict logical gate. For a query-key pair to obtain a high final attention score, it must simultaneously satisfy three conditions: basic semantic similarity, temporal proximity, and strong type correlation. The absence of any one of these conditions will significantly suppress its score. In this way, through this ingenious multiplicative gating design, a high degree of selectivity and precision in attention allocation is achieved, enabling the model to focus on truly critical information, thereby greatly improving its ability to identify complex industrial anomalies and the interpretability of the model itself. Finally, the gating attention weights are obtained by applying the softmax function to S_final.

[0034] Subsequently, based on the gated attention weight matrix, weighted feature fusion is performed on the query sequence and value sequence to obtain the PLC log multimodal fusion feature vector. That is, after calculating the precise attention weights, these weights are applied to generate a unified feature representation rich in key contextual information. In this process, the gated attention weights obtained in the previous step are first used to weight and sum the parameter feature sequence V, which serves as the value, to obtain the context vector C; then, this context vector is fused with the original event feature sequence through a residual connection and subjected to layer normalization.

[0035] Through the aforementioned mechanism, an anomaly detection model was constructed that can deeply understand the complex spatiotemporal and semantic relationships between events and parameters in PLC operation logs, thereby significantly improving the accuracy and generalization ability of anomaly pattern recognition in real industrial environments. Specifically, by introducing a dual-gated spatiotemporal attention mechanism, the time-independence and semantic-independence defects of the original mechanism when dealing with industrial data were successfully overcome. This allows the model to automatically focus attention on a short time window before and after an event, paying attention only to parameters that are physically or technologically strongly correlated with the event type. This not only makes the model more sensitive to complex anomaly patterns that manifest as compliant events, abnormal parameters, or violations of implicit process logic, but also, due to the greatly enhanced precision and logic of attention allocation, makes the model's decision-making process more interpretable, providing valuable clues for fault diagnosis and tracing. Furthermore, embedding prior knowledge into the model in the form of soft constraints (i.e., gating mechanisms) accelerates the model's convergence process, enabling it to learn more robust feature representations even with limited training data.

[0036] Specifically, in step S5, the multimodal fusion feature vector of the PLC log is input into the anomaly judgment model to obtain an anomaly score. Although the fusion feature vector highly condenses the complex information of system operation, it does not directly indicate what is normal and what is abnormal. In the technical solution of this invention, by inputting the multimodal fusion feature vector of the PLC log into the anomaly judgment model, the abstract feature representation can be transformed into a concrete anomaly signal, thereby achieving early detection and warning of potential faults. It is worth mentioning that the anomaly judgment model can be, but is not limited to, the following types: classification models based on supervised learning (such as support vector machines (SVM), neural networks, etc.), and anomaly detection models based on unsupervised learning (such as isolation forest, one-class SVM, autoencoder, etc.), which learn normal operating modes and identify data points that deviate from the normal mode as anomalies.

[0037] In practice, firstly, under normal circumstances, the anomaly judgment model is trained on a large amount of normal operating data (i.e., historical log data that does not include known faults) to allow the model to learn and remember the characteristic patterns, distribution rules, or reconstruction behaviors under normal conditions. Secondly, after the model is trained, the multimodal fusion feature vector of the PLC log is input into the trained anomaly judgment model. The model will evaluate the degree of matching or deviation between the input vector and the normal pattern based on the normal pattern it has learned internally, and output a continuous value, namely the anomaly score. This score intuitively quantifies the degree of anomaly of the current system state: the higher the score, the greater the degree of deviation of the current state from the normal pattern, and the higher the probability of an anomaly.

[0038] Specifically, step S6 determines whether a fault exists in the wind turbine main control PLC based on a comparison between the anomaly score and a preset threshold. That is, a continuous, quantified anomaly level indicator is transformed into a clear binary decision (i.e., whether a fault exists or not). Specifically, the system receives the anomaly score output from the previous step, which represents the quantified degree to which the current PLC operating state deviates from the normal mode. Then, this anomaly score is compared with a predefined preset threshold. Specifically, if the current anomaly score is greater than the preset threshold, the system determines that the current wind turbine main control PLC may have a fault or has already experienced a fault, and immediately triggers the corresponding early warning or alarm mechanism. Conversely, if the anomaly score is less than or equal to the preset threshold, the system is considered to be operating within the normal range, and no significant anomaly has been detected. This threshold-based decision-making mechanism is a common and effective means of achieving automated fault identification in industrial control systems.

[0039] The preset threshold is a critical value set manually or determined through data analysis. It serves as the decision boundary distinguishing between "normal" and "abnormal". The setting of this threshold usually requires careful calibration by comprehensively considering factors such as historical data analysis (e.g., the distribution of abnormal scores during fault-free operation), expert experience and knowledge, and tolerance for false positive rate and false negative rate, so as to ensure timely detection of potential faults while avoiding excessive unnecessary alarms. The final wind turbine main control PLC fault refers to any abnormal condition that occurs inside the wind turbine main controller that may affect its normal function, performance or stability. This includes software logic errors, hardware sensor failures, communication anomalies, or any deviation that causes the operating condition to deviate from the expected behavior.

[0040] In summary, the abnormal pattern recognition method based on PLC operation logs according to embodiments of the present invention is explained. It effectively separates the event ID sequence and parameter vector sequence from the original log stream, and extracts their respective temporal features in parallel. Based on this, deep cross-modal feature fusion is performed on the obtained event feature sequence and parameter feature sequence to generate a multimodal fused feature vector that comprehensively characterizes the PLC's operating state, providing rich and accurate input for subsequent abnormal judgment. In this way, the shortcomings of existing methods in heterogeneous log fusion are effectively overcome, and the model's ability to recognize complex industrial abnormal patterns is significantly enhanced.

[0041] Furthermore, an anomaly pattern recognition system based on PLC operation logs is also provided.

[0042] Figure 3 This is a block diagram of an anomaly pattern recognition system based on PLC operation logs according to an embodiment of the present invention. Figure 3 As shown, the abnormal pattern recognition system 300 based on PLC operation logs according to an embodiment of the present invention includes: a raw PLC log stream acquisition module 310, used to acquire the raw PLC log stream; a log parsing and dual-modal data stream separation module 320, used to perform log parsing and dual-modal data stream separation on the raw PLC log stream to obtain an event ID sequence and a parameter vector sequence; a dual-channel parallel time-series feature extraction module 330, used to perform dual-channel parallel time-series feature extraction on the event ID sequence and the parameter vector sequence to obtain an event feature sequence and a parameter feature sequence; a cross-modal feature fusion module 340, used to perform cross-modal feature fusion on the event feature sequence and the parameter feature sequence to obtain a PLC log multimodal fusion feature vector; an abnormality judgment module 350, used to input the PLC log multimodal fusion feature vector into an abnormality judgment model to obtain an abnormality score; and a fault identification module 360, used to determine whether there is a fault in the main control PLC of the fan based on the comparison between the abnormality score and a preset threshold.

[0043] Furthermore, the log parsing and dual-modal data stream separation module 320 is specifically used for: performing log structure parsing on the original PLC log stream to obtain a structured log stream; extracting an event ID sequence from the structured log stream based on an event dictionary; and extracting a parameter vector sequence from the structured log stream based on a global parameter mode and normalized parameters.

[0044] Furthermore, the dual-channel parallel temporal feature extraction module 330 is specifically used to: embed each event ID in the event ID sequence to obtain an event embedding vector sequence; inject position information into each event embedding vector in the event embedding vector sequence, and then input it into the Transformer encoder to obtain an event feature sequence.

[0045] As described above, the PLC operation log-based anomaly pattern recognition system 300 according to embodiments of the present invention can be implemented in various wireless terminals, such as servers with PLC operation log-based anomaly pattern recognition algorithms. In one possible implementation, the PLC operation log-based anomaly pattern recognition system 300 according to embodiments of the present invention can be integrated into the wireless terminal as a software module and / or a hardware module. For example, the PLC operation log-based anomaly pattern recognition system 300 can be a software module in the operating system of the wireless terminal, or it can be an application developed for the wireless terminal; of course, the PLC operation log-based anomaly pattern recognition system 300 can also be one of many hardware modules of the wireless terminal.

[0046] Alternatively, in another example, the PLC operation log-based anomaly pattern recognition system 300 and the wireless terminal can also be separate devices, and the PLC operation log-based anomaly pattern recognition system 300 can be connected to the wireless terminal via wired and / or wireless networks, and transmit interactive information in accordance with an agreed data format.

[0047] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying abnormal patterns based on PLC operation logs, characterized in that, include: Obtain the raw PLC log stream; Log parsing and dual-modal data stream separation are performed on the original PLC log stream to obtain the event ID sequence and parameter vector sequence; Dual-channel parallel temporal feature extraction is performed on the event ID sequence and parameter vector sequence to obtain the event feature sequence and parameter feature sequence; Cross-modal feature fusion is performed on event feature sequences and parameter feature sequences to obtain a multimodal fusion feature vector of PLC logs; The multimodal fusion feature vector of the PLC log is input into the anomaly judgment model to obtain the anomaly score; Based on the comparison between the abnormal score and the preset threshold, it is determined whether there is a fault in the main control PLC of the wind turbine.

2. The abnormal pattern recognition method based on PLC operation logs according to claim 1, characterized in that, The original PLC log stream is parsed and separated into two modal data streams to obtain the event ID sequence and parameter vector sequence, including: Perform log structure parsing on the original PLC log stream to obtain a structured log stream; Based on the event dictionary, extract the event ID sequence from the structured log stream; Based on global parameter patterns and normalized parameters, parameter vector sequences are extracted from structured log streams.

3. The abnormal pattern recognition method based on PLC operation logs according to claim 1, characterized in that, Dual-channel parallel temporal feature extraction is performed on the event ID sequence and parameter vector sequence to obtain the event feature sequence and parameter feature sequence, including: Perform event embedding on each event ID in the event ID sequence to obtain an event embedding vector sequence; After injecting positional information into each event embedding vector in the event embedding vector sequence, it is input into the Transformer encoder to obtain the event feature sequence.

4. The abnormal pattern recognition method based on PLC operation logs according to claim 2, characterized in that, Dual-channel parallel temporal feature extraction is performed on the event ID sequence and parameter vector sequence to obtain the event feature sequence and parameter feature sequence, including: Perform dimension-matched convolution on the parameter vector sequence to obtain a dimension-matched parameter vector sequence; Multi-layer dilated causal convolutional encoding is performed on the parameter vector sequence after dimension matching to obtain the parameter feature sequence.

5. The abnormal pattern recognition method based on PLC operation logs according to claim 1, characterized in that, Cross-modal feature fusion is performed on event feature sequences and parameter feature sequences to obtain a multimodal fusion feature vector of PLC logs, including: A linear transformation is performed on the event feature sequence to obtain the query sequence, and a linear transformation is performed on the parameter feature sequence to obtain the key sequence and value sequence; Construct a time decay matrix based on the query sequence and key sequence; Calculate the gating attention weight matrix based on the event feature sequence, parameter feature sequence, and time decay matrix; Based on the gating attention weight matrix, the query sequence and value sequence are weighted feature fusion to obtain the PLC log multimodal fusion feature vector.

6. The abnormal pattern recognition method based on PLC operation logs according to claim 5, characterized in that, Based on the query sequence and the key sequence, a time decay matrix is ​​constructed, including: constructing the time decay matrix using the following formula, where the formula is: in, This represents the time decay weight between query time step t and key time step j; t and j are the time step indices in the query sequence and key sequence, respectively. It is a hyperparameter that controls the decay rate.

7. The abnormal pattern recognition method based on PLC operation logs according to claim 5, characterized in that, Based on the event feature sequence, parameter feature sequence, and time decay matrix, the gated attention weight matrix is ​​calculated, including: The basic attention score matrix is ​​calculated based on the event feature sequence and parameter feature sequence; Calculate the semantic affinity gate matrix based on the event feature sequence and parameter feature sequence; The gated attention weight matrix is ​​determined based on the basic attention score matrix, the semantic affinity gate matrix, and the time decay matrix.

8. An anomaly pattern recognition system based on PLC operation logs, characterized in that, include: The raw PLC log stream acquisition module is used to acquire the raw PLC log stream; The log parsing and dual-modal data stream separation module is used to parse the original PLC log stream and separate the dual-modal data stream to obtain the event ID sequence and parameter vector sequence; A dual-channel parallel temporal feature extraction module is used to perform dual-channel parallel temporal feature extraction on the event ID sequence and parameter vector sequence to obtain the event feature sequence and parameter feature sequence; The cross-modal feature fusion module is used to perform cross-modal feature fusion on event feature sequences and parameter feature sequences to obtain a multimodal fusion feature vector of PLC logs; The anomaly detection module is used to input the multimodal fusion feature vector of the PLC log into the anomaly detection model to obtain an anomaly score; The fault identification module is used to determine whether there is a fault in the main control PLC of the wind turbine based on the comparison between the abnormal score and the preset threshold.

9. The anomaly pattern recognition system based on PLC operation logs according to claim 8, characterized in that, The log parsing and dual-modal data stream separation module is specifically used for: Perform log structure parsing on the original PLC log stream to obtain a structured log stream; Based on the event dictionary, extract the event ID sequence from the structured log stream; Based on global parameter patterns and normalized parameters, parameter vector sequences are extracted from structured log streams.

10. The anomaly pattern recognition system based on PLC operation logs according to claim 8, characterized in that, The dual-channel parallel temporal feature extraction module is specifically used for: Perform event embedding on each event ID in the event ID sequence to obtain an event embedding vector sequence; After injecting positional information into each event embedding vector in the event embedding vector sequence, it is input into the Transformer encoder to obtain the event feature sequence.

Images