A somatic control method and system

Abstract

The application discloses a kind of body control method and system, comprising: reconstructing multiple source scattered sequence log into standard alignment event tracking set;Time automaton model is combined with physical control equation to construct digital twin model, active inquiry is carried out to digital twin model, retrieves counterexample, and iteratively modifies hypothesis automaton;All CVD process regulations are solved on standard alignment event tracking set simultaneously to form process safety regulation set;Drive Monte Carlo tree search to explore fault path in current hypothesis automaton, generate fault jump chain, and synthesize fault dense simulation log stream together with continuous physical field waveform;Fine-tune body control model using fault dense simulation log stream;The control decision of body control model is checked, and in the case where it is not checked, it is entered to carry out physical retreat, and in the case where it is checked, the control decision is executed;The application has the advantages that: avoid blindly issuing unexecutable control instructions, improve safety response speed.

Description

Technical Field

[0001] This invention relates to the field of industrial intelligent control and safety technology, specifically to an embodied control method and system. Background Technology

[0002] In highly deterministic and high-security industrial scenarios such as semiconductor manufacturing (e.g., chemical vapor deposition, lithography), high-precision multi-axis robotic arm handling, nuclear power plant control, and ultra-high voltage power grid coordination, embodied control models based on large-scale neural networks are enabling online autonomous control of equipment, process sequence scheduling, and real-time parameter optimization. However, when control commands from such black-box decision-making systems are directly integrated into the physical high-precision control loop, the following technical bottlenecks are encountered: First, there is a conflict between probabilistic decision-making and temporal logic and physical conservation. The output of a large-scale neural network model is essentially a probabilistic prediction. When faced with boundary conditions not fully covered by training data or noise interference, it may output erroneous instructions that violate physical conservation laws or PLC control interlocking protocols. This can cause the semiconductor process reaction chamber to deviate from the rated process window, leading to overheating, overpressure, and ultimately, state deadlock or even equipment damage.

[0003] Second, formalized safety specifications rely on manual writing by experts and cannot evolve adaptively. Traditional safety supervision models based on timed automata (TA) or signal temporal logic (STL) require manual modeling by domain experts, which is costly and prone to errors; once the field process is slightly adjusted or upgraded, the manual specifications become invalid.

[0004] Third, existing active learning methods for automata (such as the L* series algorithms) rely on expert prior models capable of answering membership queries and equivalence queries. Performing test path injection on real industrial production lines is neither safe nor feasible. Furthermore, assuming the existence of an accurate model of the controlled object as an expert prior model contradicts the goal of "eliminating expert modeling." How to safely complete active learning without an accurate prior model remains an unsolved problem in current technologies.

[0005] Fourth, runtime verification has three defects: the verification logic running in a general operating system is easily hijacked or bypassed by malware; the time complexity of SMT (Satisfiability Modulo Theories) is uncontrollable under normal circumstances, and its direct use in hard real-time verification lacks a guarantee of the upper limit of latency; and there is a lack of quantitative identification methods with statistical risk guarantees for distributed operating conditions.

[0006] Fifth, the response speed of runaway interruption is limited. Pure software emergency stops require the operating system and driver stack, with a response time of milliseconds or more; while the mechanical action time of traditional electromagnetic relays is also in the millisecond range, which cannot meet the sub-microsecond interruption requirements of high-speed processes (such as RF power modulation and optical path switching). In addition, it should be noted that bistable (magnetically latched) relays are occasionally used in existing technologies for power failure protection. However, bistable relays retain their original contact positions after power failure and do not automatically reset, which is essentially unsuitable for scenarios where power failure is safe.

[0007] The aforementioned technical bottlenecks result in existing embodied control models exhibiting problems such as blindly issuing unexecutable control commands and insufficient response speed. Summary of the Invention

[0008] The technical problem to be solved by this invention is that existing embodied control models have problems such as blindly issuing unexecutable control commands and insufficient response speed.

[0009] The present invention solves the above-mentioned technical problems through the following technical means: an embodied control method, comprising the following steps: S1. Collect equipment information within the plant area and reconstruct multi-source scattered logs into a standard aligned event tracking set; S2. A time automaton model is constructed based on the standard aligned event tracking set as the initial hypothesis automaton. The time automaton model is combined with the physical control equations to construct a digital twin model. The digital twin model is actively queried to retrieve counterexamples and iteratively correct the hypothesis automaton. At the same time, all CVD process specifications are solved on the standard aligned event tracking set to form a process safety specification set. S3. Drive Monte Carlo tree search to explore fault paths in the current hypothesis automaton, generate fault jump chains, and synthesize a fault-dense simulation log stream together with the continuous physical field waveform; use the fault-dense simulation log stream to fine-tune the embodied control model, and embed a reduction consistency penalty term in the loss function of the embodied control model; S4. Verify the control decisions issued by the embodied control model. If the verification fails, proceed to S5. If the verification passes, execute the control decisions to control the equipment. S5. Disconnect the control loop and perform physical retreat.

[0010] Further, S2 includes: Initially, the constructed time automaton model is the initial hypothesis automaton. For any state transition in a hypothetical automaton Extract all times when the redirect occurred from the historical logs, calculate the empirical distribution, and take the time with the minimum value. and maximum time Form a support band and synthesize directly: Defense conditions ; Indicates the current state. Indicates the next state. Indicates that the system has entered a state. The duration that has elapsed since then; State invariants .

[0011] Furthermore, in S2, the digital twin model is actively queried to retrieve counterexamples and iteratively correct the hypothesis automaton, including: Active queries include member queries and equivalence queries. Member queries are used to find a specific test path. Input digital twin model Determine whether the test path is reachable in a physically continuous environment; equivalence query is used to check the current hypothesis automaton. With digital twin model Whether the behaviors are completely consistent; the equivalence query adopts triple bounded processing: The continuous dynamics of the digital twin model are over-approximated as piecewise linear interval constraints using interval envelope abstraction, and together with the guard conditions and invariants of the hypothetical automaton, they are encoded into a wordless linear real number arithmetic logic formula. The retrieval time domain is truncated to a fixed number of steps. Only retrieves counterexample paths where the behavior of the digital twin model is inconsistent with that of the hypothetical automaton within a fixed number of steps; Counterexample retrieval is performed using the SMT solver between the finite sampled trajectory set of the digital twin model and the symbolic reachable set of the hypothetical automaton. The SMT solver outputs that satisfy the assignment criteria constitute a specific counterexample. After retrieving a counterexample, the state nodes are split, the transition edges are completed, and the hypothetical automaton is updated to obtain the final model. When continuous In each iteration, convergence is terminated when there are no counterexamples to the equivalent query and the consistency rate of the retained set exceeds a preset threshold; the symbolic reachable set is a hypothetical automaton. The continuous geometric space bounded by the guarding conditions and state invariants.

[0012] Furthermore, the reserved set is a standard aligned event tracking set. The frozen portion of the dataset that did not participate in step S2 is retained. The consistency rate of the retained set is the ratio of the number of tracks in the retained set that are judged to be consistent by the hypothesis automaton to the total number of tracks in the retained set. The method for the hypothesis automaton to judge whether the tracks are consistent is as follows: the track sequence is input into the hypothesis automaton, and the hypothesis automaton starts from the initial state and performs state transitions according to the discrete event symbols in the track. During the transition, it checks whether the guard condition and state invariant of each step allow the event to occur at the corresponding timestamp. If so, the track is consistent; otherwise, it is inconsistent.

[0013] Furthermore, in S2, all CVD process specifications are solved on the standard aligned event tracking set to form a process safety specification set, including: In the standard alignment event tracking set Solving the robustness maximization problem on continuous parametric surfaces

[0014]

[0015] in, Represents the standard alignment event tracking set The i-th tracking item, This represents the parameter to be solved. Indicated by STL parameterized formulas for variables Representing the trajectory The robustness measure of the STL parameterized formula at the initial time; based on the solved parameters, the CVD process specification is obtained in reverse; all the solved CVD process specifications constitute the set of process safety specifications. .

[0016] Further, S3 includes: Initiating a Monte Carlo tree search in the discrete space of the current hypothetical automaton, using the reduction robustness loss as the reward function, explores fault paths. The fault path refers to the discrete jump path with the largest reduction robustness loss obtained by searching according to the reward function, thus outputting a set of discrete fault jump chains and their corresponding jump time intervals. Solving the physical control equations within the jump time intervals yields continuous physical field waveforms. These continuous physical field waveforms and discrete fault jump chains are then compiled into a standard protocol message sequence, and queued according to delay. By perturbing the software timestamps of the standard protocol message sequence, the latency statistics of the simulation log are made to converge with those of the real log, thus obtaining a fault-dense simulation log stream. ; Using fault-intensive simulation log streams The loss function for training the embodied control model is:

[0017] in, The embodied control model outputs the predicted trajectory of the action obtained through forward extrapolation from the digital twin model. Indicates the predicted trajectory Initial set of process safety regulations The sum of the STL robustness metrics calculated for each specification. This represents the cross-entropy loss between the action probability distribution output by the embodied control model and the corresponding actual actions executed in the historical logs. These are the weighting coefficients.

[0018] Furthermore, during the equipment operation period in S4, the specific control model issues control decisions. The four-stage pipeline is executed sequentially within the hardware isolation zone inside the bypass connector: Level 1: Retrieve the solid-state private key The decision messages output by the embodied control model are accompanied by digital signatures, and the system uses a solid-state private key. Perform digital signature verification and decryption on decision messages, and reject any instructions from unknown sources or that have been tampered with; The second level is to compile process safety regulations. The predicted trajectory obtained by solving the physical control equations using the FNO operator driven by the current control command. The inputs are combined with the inputs to the SMT solver. The SMT solver then determines within a specified timeframe whether the future state after performing the action violates the set theory. If the rules in the set are violated If the reduction or SMT solver output times out, a reduction violation flag will be output. The third stage involves extracting the latent feature vectors from the deep Transformer output of the embodied control model. Calculate the Mahalanobis distance of the latent feature vectors relative to the offline-stored normal baseline distribution. ;Will With ROM stored Compare with a normal benchmark measure and calculate the proportion of non-conformal scores greater than or equal to the current score, i.e., conformal scores. Value, if Output out-of-distribution anomaly flags. Indicates a preset threshold; Level 4: Once either the output protocol violation flag or the distribution out-of-range anomaly flag is displayed, the physical backoff in step S5 is triggered.

[0019] Furthermore, the Mahalanobis distance ,in, , These are the baseline mean and covariance inverse matrix pre-stored in ROM, respectively; The conform Value ,in, For the first i A normal benchmark measure For the characteristic function, when , Select 1 if the value is 1, otherwise select 0.

[0020] Furthermore, the embodied control method also includes step S6, returning to S2 when adjustments to the production line piping or control strategy cause a drift in the statistical characteristics of the standard aligned event tracking set.

[0021] The present invention also provides a body control system for performing the above-described method, comprising: The data alignment and reconstruction module is used to collect equipment information within the plant area and reconstruct multi-source scattered logs into a standard aligned event tracking set; A formal specification inverse self-learning engine is used to construct a time automaton model based on a standard aligned event tracking set as the initial hypothesis automaton. The time automaton model is combined with the physical control equations to construct a digital twin model. The digital twin model is actively queried to retrieve counterexamples and iteratively correct the hypothesis automaton. At the same time, all CVD process specifications are solved on the standard aligned event tracking set to form a process safety specification set. A formally constrained generative simulation synthesis engine is used to drive Monte Carlo tree search to explore fault paths in the current hypothesis automaton, generate fault jump chains, and synthesize a fault-dense simulation log stream together with continuous physics waveforms; the fault-dense simulation log stream is used to fine-tune the embodied control model, and a reduction consistency penalty term is embedded in the loss function of the embodied control model; The hardware isolation verification chip is used to verify the control decisions issued by the specific control model. If the verification fails, it enters the protection module; if the verification passes, it executes the control decisions to control the device. The protection module is used to disconnect the control loop and perform physical retreat. The self-updating module is used to return to the formal reduction inverse self-learning engine when adjustments to production line piping or control strategies cause a drift in the statistical properties of the standard aligned event trace set.

[0022] The advantages of this invention are: (1) This invention extracts physical laws into a set of process safety regulations, introduces a regulation consistency penalty term in the model fine-tuning loss, forces the model to learn to avoid physical violations during training, performs verification before the instruction is executed, and rejects any instruction that fails verification, thereby eliminating the conflict between logic and physics from the root and avoiding the blind issuance of unexecutable control instructions; if the control decision issued by the embodied control model fails verification, the control loop is cut off and physical retreat is performed, thereby improving the safety response speed.

[0023] (2) This invention utilizes an evolutionary algorithm to automatically solve the robustness maximization problem from historical logs (standard alignment event tracking set), and reverse-induces specific parameterized specifications, completely eliminating the need for manual experience. By calculating the consistency rate of the retained set in real time as a drift detector, once the consistency rate drops due to pipeline or control strategy adjustments, steps S2 to S5 are automatically triggered, realizing the online, imperceptible self-evolution of the specification, and solving the problem that safety specifications rely on manual intervention and cannot adapt.

[0024] (3) This invention clearly replaces the query object from the physical production line to the digital twin, and the process does not generate any on-site safety risks. Since the digital twin itself is obtained by log bootstrapping, it does not rely on expert prior models, fundamentally solving the dilemma of having no expert prior models to ask or the cost of asking the entity is too high, and solving the problem of lacking feasible expert prior models for active learning.

[0025] (4) This invention constructs a triple pipeline of anti-tampering (PUF), logical proof (bounded SMT), and out-of-distribution detection (conformal prediction). PUF solves identity forgery; bounded SMT solves known rule violations (and timeouts are defaulted to insecure, eliminating latency vulnerabilities); conformal prediction solves unknown anomalies—and conformal theory guarantees that the misjudgment rate does not exceed the preset limit. It has statistical guarantees independent of distribution. The three levels complement each other, eliminating the structural blind spots of a single verification mechanism and solving multiple defects in the verification during the operation of existing technologies. Attached Figure Description

[0026] Figure 1 This is a flowchart of an embodiment of the control method disclosed in this invention. Figure 2 This is a flowchart of a two-stage formal specification self-learning process in an embodied control method disclosed in an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] Example 1 like Figure 1 As shown, Embodiment 1 of the present invention provides a personal control method, including the following steps: S1. Collect equipment information within the plant area and reconstruct the multi-source scattered logs into a standard aligned event trace set; the specific process is as follows: In the CVD reaction chamber and wafer transport robot control area within the semiconductor cleanroom, bypass connectors are physically connected in series on the process bus to collect information from various devices. When the physical layer transceiver of the bypass connector detects the rising edge of the Start-of-Frame Delimiter (SFD) physical layer, a dedicated latching circuit latches a hardware timestamp using the local crystal oscillator count. This latching path does not pass through any operating system software stack, and the jitter is less than 40 nanoseconds; the protocol parsing microcode also extracts the software timestamp from the application layer message. Software timestamps are affected by operating system scheduling, and their errors exhibit a one-sided positive skewness (they can only be late, never early). This causes the recorded time of the same event in the log to be distorted, making it impossible to accurately determine the actual physical moment of the event. Directly concatenating logs based on these timestamps during event generation will reverse the causal relationship of the events. Therefore, it is necessary to perform log timestamp alignment to reconstruct the chaotic and biased discrete logs from various nodes into a standard aligned event tracking set. This allows engineers to accurately analyze the precise sequence and time intervals of actions such as the opening of the inlet valve and the retraction of the robotic arm in the CVD process, ensuring the high real-time requirements of semiconductor manufacturing. The specific time alignment method is as follows: For operating system queuing delays skewed model Construct the following convex optimization first-norm minimization equation with the following envelope as the boundary condition.

[0029]

[0030] In the formula, For equipment Send data packets Queuing delays For equipment Send data packets The unsynchronized software timestamp is added locally at that time. Data packets latched for bypass connectors The absolute physical transmission time, For equipment The temperature drift rate of the crystal oscillator For equipment The initial phase offset. This represents the number of data packets in the sliding window.

[0031] Solve the convex optimization first-norm minimization equation within a sliding window to obtain the device. Crystal oscillator temperature drift rate and equipment initial phase bias Using mapping operators Align the log events by time. For equipment Log events generated Unsynchronized timestamps added locally For equipment Log events generated Unbiased projection restores the actual physical moment of occurrence on the standard absolute timeline.

[0032] After the above operations, the timestamp of each log entry is restored to the actual physical moment of occurrence on the standard absolute timeline, thereby reconstructing the multi-source scattered log into a standard aligned event trace set with globally unbiased absolute timestamps. Standard Alignment Event Tracking Set It contains multiple tracking records, each representing a sequence of events for a specific physical entity (such as a single wafer, a wafer batch, or a robotic arm operation cycle) throughout its entire lifecycle or a specific process, linked together in chronological order. Each tracking record is expressed as...

[0033] in, For the first Discrete event symbols (such as "intake valve opens" and "robotic arm retracts"). for The corresponding global unbiased absolute timestamp (i.e., the actual physical moment of occurrence).

[0034] S2. A time automaton model is constructed based on a standard aligned event tracking set as the initial hypothesis automaton. This time automaton model is combined with the physical control equations to construct a digital twin model. The digital twin model is actively queried to retrieve counterexamples, and the hypothesis automaton is iteratively revised. Simultaneously, all CVD process specifications are solved on the standard aligned event tracking set to form a process safety specification set. Figure 2 As shown, the specific process is as follows: S21, Standard Alignment-Based Event Tracking Set A timed automata model is constructed using existing technology, referring to the existing literature "Alur, R., & Dill, DL (1994). A theory of timed automata. Theoretical Computer Science, 126(2), 183-235." The timed automata model is defined as follows: ,in, For a finite set of states, This is the initial state. For the event alphabet, For a set of real number clock variables, This is a state invariant mapping used to... Each state is mapped to its allowed clock constraints. It is a set of transition relationships that includes jump events, clock guards, and clock resets.

[0035] S22. Initial setup: Standard alignment event tracking set It has not been updated; the constructed time automaton model is the initial hypothesis automaton. If subsequent updates occur, the corresponding time automaton model will be a hypothetical automaton. , Let represent the hypothesis automaton corresponding to the k-th iteration update process.

[0036] For any state transition in the hypothetical automaton Extract all times when the redirect occurred from the historical logs, calculate the empirical distribution, and take the time with the minimum value. and maximum time Form a support band and synthesize directly: Defense conditions (This means that the jump will only occur if the specified time range is met). Indicates the current state. Indicates the next state. Indicates that the system has entered a state. The duration that has elapsed since then.

[0037] State invariants (This indicates that the maximum time spent in this state is not permitted.) This stage runs completely offline and does not interact with the physical production line.

[0038] S23. To answer active learning queries without touching the physical production line, this invention uses a currently hypothetical automaton. It provides a discrete skeleton, characterizing the discrete states and transition logic of each stage of the process. It provides continuous dynamics, characterizing the continuous physical evolution within each discrete state, using known physical control equations (such as heat transfer partial differential equations and mass transfer partial differential equations, whose structure is determined a priori by the process type and whose undetermined coefficients are identified by the physical information neural network PINN from continuous measurement data in historical logs). This involves transforming the hypothetical automata... Each state is mapped to a specific set of boundary conditions or source term parameters of the physical governing equations. State transitions trigger the switching of the corresponding physical governing equation parameters, thereby constructing a hypothetical automaton. Synchronously updated digital twin model .

[0039] S24. Perform member and equivalence queries on the digital twin model to identify its vulnerabilities and continuously revise the hypothesis automaton.

[0040] Member query: This will retrieve a specific test path. Input digital twin model The twin determines whether the test path is reachable in a physically continuous environment.

[0041] Equivalence search: Check the current hypothetical automaton With digital twin model Whether the behaviors are completely consistent. Equivalence queries are implemented using bounded counterexample retrieval. It should be noted that, assuming the general equivalence determination problem between automata and digital twin models containing continuous dynamics is undecidable, to make this step feasible and time-controllable, this invention applies the following triple bounded processing: First, the continuous dynamics of the digital twin model are over-applied as piecewise linear interval constraints using an interval envelope abstraction method. These constraints, along with the guard conditions and invariants of the hypothetical automata, are encoded into a decision problem of quantifierless linear real arithmetic (QF_LRA) decidable segments. Specifically, for each continuous variable in the digital twin model, its maximum and minimum values ​​under specific conditions are calculated as a function of time. These two boundary curves constitute an envelope, encompassing all possible behavioral trajectories. The entire time axis is divided into multiple continuous small intervals. Within each small interval, a linear function approximates the original curve. Thus, the originally complex curve constraints are transformed into a set of simple linear inequalities. This results in two types of constraints: one is the piecewise linear interval constraint from the digital twin model (representing the over-approximation behavior of the continuous physical world), and the other is the guard condition and state invariant from the time automata (representing the rules of the discrete logical world). Then, both types of constraints are written into a universal language that the SMT solver can understand—quantifierless linear real arithmetic (QF_LRA) logical formulas. This is a set of linear polynomials combined using logical operators (AND, OR, NOT) without quantifiers. , The mathematical formula for linear real number arithmetic logic formulas without quantifiers is as follows: For continuous variables, the physical quantities (temperature, pressure, etc.) in the digital twin model and the clock variables in the time automaton are uniformly declared as real variables of QF_LRA.

[0042] For interval constraints, the piecewise linear interval constraint a*t + b ≤ x ≤ c*t + d can be directly written as two linear inequalities a*t + b ≤ x and x ≤ c*t + d.

[0043] For guards and invariants, the guards (e.g., x ≥ 5) and invariants (e.g., x ≤ 10) of time automata are themselves linear inequalities and can be directly embedded.

[0044] Finally, logical combination is performed, connecting all constraints with a logical "AND" to indicate that the system must simultaneously satisfy all these conditions. Ultimately, the behavior of the entire system (continuous + discrete) is encoded into a large, but decidable, QF_LRA formula.

[0045] Second, the retrieval time domain is truncated into a fixed number of steps. (In the example) Discrete jumps (step-by-step jumps) mean that only within a fixed number of steps are negative example paths where the two models behave inconsistently retrieved; Third, the finite set of sampling trajectories of the digital twin model (sampled in each round of the example). The SMT solver is used to search for counterexamples between the trajectory and the symbolic reachability set of the hypothetical automaton. A specific counterexample is formed by satisfying the assignment in the SMT solver output. The symbolic reachability set is the set of values ​​for the hypothetical automaton. The guard conditions and state invariants define a continuous geometric space (e.g., in state A, the air pressure P must ≤ 500Pa). The finite sampled trajectory set of the digital twin model is a sequence of discrete points simulated by the digital twin model under specific initial conditions and parameters (e.g., air pressure 450Pa in the 1st second, 470Pa in the 2nd second, etc.). After the above reduction, each round of equivalent query becomes a bounded model verification problem on the QF_LRA segment, which has decisionability and controllable solution time. After retrieving counterexamples—for example, retrieving "when the transport delay..." Furthermore, the system enters emergency obstacle avoidance mode when the air valve opens prematurely. A counterexample—the engine splits state nodes and completes jump edges. ( ), and update to obtain the hypothetical automaton Assuming automata As a current hypothetical automaton Return to execute S23 to S24. When consecutive The process terminates upon round-by-round iteration when no counterexamples are found in the equivalent query and the consistency rate of the retained set exceeds a preset threshold (99.5% in this example). Since the query object is a digital twin model rather than a physical device, this process does not pose any on-site safety risks; and since the digital twin model itself is obtained through log bootstrapping, this process does not rely on expert prior models, thus eliminating circular dependencies.

[0046] For example, we need to find counterexamples where the hypothetical automata are reachable, but the digital twin model is reachable: Assume the guard condition of the automaton: in state B, the clock x can be between [5, 10] seconds.

[0047] Assume the invariant of the automaton: under state B, the air pressure must be ≤ 500Pa.

[0048] Envelope constraint of the finite sampled trajectory set of the digital twin model: due to physical inertia, when the clock is in the [5, 10] second range, the air pressure is necessarily greater than 600Pa.

[0049] Connect all the above conditions with ∧ (logical AND), and query the SMT solver: "Is there a set of real number assignments that can make all the above conditions hold simultaneously". If the solver outputs unsatisfiable, it indicates that the hypothetical automaton can bound the physical reality, there is no counterexample in this round, and the verification passes. If the solver outputs satisfiable, it means that there exists a specific set of real number assignments. At this point, the solver will output a set of specific variable values. This set of values is the specific counterexample.

[0050] The retention set referred to in the above process is a part of the frozen data set that does not participate in the process of step S2, and the retention set consistency rate is the ratio of the number of traces judged to be consistent by the hypothetical automaton in the retention set to the total number of traces in the retention set. The method for the hypothetical automaton to judge whether a trace is consistent is: input the trace sequence into the hypothetical automaton, let the hypothetical automaton start from the initial state and perform state transitions according to the discrete event symbols in the trace, and during the transition process, check whether the guard condition and state invariant at each step allow the event to occur at the corresponding timestamp. If yes, the trace is consistent; otherwise, it is inconsistent.

[0051] S25. On the continuous parameters (such as the cavity air pressure , radio frequency power ) to mine parameterized STL formulas based on evolutionary algorithms (such as genetic algorithms) , solve the robustness maximization problem

[0052] subject to .

[0053] Wherein, represents the parameters to be solved (such as the air pressure threshold, time window), represents the parameterized STL formula with as variables, for example, the air pressure threshold, the air pressure in the entire time domain shall not exceed a certain value ( = Always (Pressure<p1), where p1 is the parameter representing the air pressure threshold), and for another example, after the intake valve is opened, the air pressure must converge to a steady state within a certain time p2 ( =(Valve_Open ->Eventually_[0, p2] (Pressure within Stable_Range)), where p2 is a parameter representing the convergence time window. Representing the trajectory The robustness measure of the STL parameterization formula at the initial time, with a positive value indicating satisfaction; for the air pressure threshold, The calculation is the minimum difference between the calculated air pressure threshold and the measured air pressure within a preset time window. The calculation is to calculate the difference between p2 and the actual time it takes for the air pressure to converge to a steady state.

[0054] Based on the parameters obtained from the solution, the CVD process specifications are derived in reverse. For example, when the pressure threshold is 500 Pa and the time window is 5 seconds, the corresponding CVD process specifications are that the chamber pressure must not exceed 500 Pa throughout the entire time domain, and the pressure must converge to the steady-state range within 5 seconds after the inlet valve is opened. All CVD process specifications obtained through the above method constitute the set of process safety specifications. .

[0055] S3. Formal constraint-driven fault-dense log generation and embodied control model training; the specific process is as follows: Initiate Monte Carlo Tree Search (MCTS) in the discrete space of the current hypothetical automaton, exploring faulty paths with the reduction robustness loss as the reward function:

[0056] The fault path refers to the discrete jump path with the largest reduction robustness loss obtained by searching according to the above reward function. During normal operation... (Strength is a positive value), so Smaller is better; when violating the rules , This path yields extremely high rewards. MCTS will greedily choose paths that might lead to... Fault jump chains that drop sharply (or even turn negative) This outputs a set of discrete fault jump chains and their corresponding jump time intervals. During the jump time interval The internal function solves the physical control equations, calculating, for example, the air pressure exceeding 500 Pa and reaching a peak of 820 Pa, thus obtaining a high-fidelity continuous physical field waveform. The continuous physical field waveform and the discrete fault jump chain are compiled into a standard protocol message sequence. That is, the continuous physical field waveform and the discrete fault jump chain are used as joint inputs and encapsulated into a data frame conforming to an industrial protocol format. For example, upon measuring 820 Pa, the transmitter converts it to a 4-20mA electrical signal, which is then sampled by the PLC's AI module AD, and encapsulated into a standard protocol message such as Modbus / EtherCAT. The queuing delay mentioned in step S1 is then considered. By perturbing the software timestamps of the standard protocol message sequence, the latency statistics of the simulation log are made to converge with those of the real log, thus obtaining a fault-dense simulation log stream. .

[0057] Using fault-intensive simulation log streams The embodied control model is trained, with the current sensor observation window data as input and the next specific control action as output. The model is fine-tuned through training, and training stops when the loss function no longer decreases over several consecutive rounds, resulting in a well-trained embodied control model. The loss function during training is:

[0058] in, The model outputs the predicted trajectory obtained by forward extrapolation of the action using a digital twin model. Indicates the predicted trajectory Initial set of process safety regulations The sum of the STL robustness metrics calculated for each specification is used. A positive value indicates that the predicted trajectory satisfies all safety specifications with the corresponding margin; a negative value indicates that the predicted trajectory violates the specifications, and the larger the absolute value of the negative value, the more severe the violation. The first term represents the cross-entropy loss between the action probability distribution output by the embodied control model and the corresponding actual executed actions (supervision labels) in the historical real logs. The second term penalizes the degree to which the predicted trajectory violates the specification. This is the weighting coefficient (0.5 in this example).

[0059] S4, PUF-TEE hardware isolation online verification and conformal OOD detection, verifies the control decisions issued by the embodied control model. If the verification fails, proceed to S5; if the verification passes, execute the control decisions to control the equipment. Specifically, during equipment operation, the embodied control model issues control decisions. The four-stage flow is executed sequentially in the PUF-TEE hardware isolation zone inside the bypass connector.

[0060] Level 1: PUF hardware encryption verification. The secure area retrieves a 256-bit solid-state private key specifically generated by the differential impedance of the silicon microstructure and the clock pulse. The decision messages output by the embodied control model are accompanied by digital signatures, and the system uses a solid-state private key. Perform digital signature verification and decryption on decision messages, and reject any instructions from unknown sources or that have been tampered with.

[0061] Level 2, Bounded SMT formal proof. (The set...) The predicted trajectory obtained by solving the physical control equations using the FNO operator driven by the current control command. The input is then fed into the SMT solver. Within a specified timeframe, the SMT solver determines whether the future state following the action violates the set theory. The specifications in the paper. To ensure the upper bound of hard real-time latency, this invention imposes three constraints on the SMT determination problem: First, it sets... Reduced and predicted trajectories The decision encoding is limited to quantifierless linear real arithmetic (QF_LRA) decisionable segments, and the prediction time domain is truncated to a fixed number of steps. (In the example) This process can be referenced above regarding the explanation of the quantifier-free linear real arithmetic (QF_LRA) logic formula in the equivalence query process; second, the upper bound of the circuit-level pipeline delay of the hardware acceleration circuit of the bounded SMT solver is determined by static timing analysis (85 microseconds in the embodiment); third, the hardware watchdog timer is set. (In this example, 200 microseconds) Once the SMT solver outputs a timeout, a reduction violation flag is immediately output. If the SMT solver exceeds the watchdog timer limit... The internal output will violate the set rule if the future state after performing this action is not executed. The rules in the code also output a rule violation flag.

[0062] The third level, conformal prediction and OOD detection: extracting the latent feature vectors from the deep Transformer output of the embodied control model. Calculate the latent feature vectors relative to the offline-stored normal baseline distribution (mean). with the inverse of covariance matrix Mahalanobis distance ;Will With ROM stored Compare with a normal benchmark measure and calculate the proportion of non-conformal scores greater than or equal to the current score, i.e., conformal scores. Value. If Output out-of-distribution anomaly flags. This represents a preset threshold. The specific process is as follows: Extracting latent feature vectors from the output of the deep Transformer encoding layer of the model Retrieve the baseline average value pre-stored in ROM with the inverse of covariance matrix Calculate Mahalanobis distance

[0063] Comparison of offline writing A normal benchmark measure (This benchmark metric set is calculated offline and written to ROM after extracting latent features from the normal operation logs through forward inference using the same embodied control model), calculating conformal features. value

[0064] in, For the indicative function (implemented in parallel by a gate comparator array in this embodiment, but the mathematical definition of the indicative function does not depend on the specific implementation), when , Select 1 if the value is 1, otherwise select 0. (In the example) The algorithm determines that the current decision is out of distribution and outputs an out-of-distribution anomaly flag as true. Based on conformal prediction theory, under the assumption of data commutability, the false positive rate of this test does not exceed [percentage missing]. It has the statistical guarantee of being distribution-independent.

[0065] Level 4: Once either the output protocol violation flag or the out-of-distribution exception flag is displayed, the TEE hardware state machine will pull the GPIO safety latch pin level down from 3.3 V to 0 V within less than 100 nanoseconds, triggering the physical backoff in step S5.

[0066] S5, Layered electromechanical elastic reset hard cut-off and robust retreat, the physical state of the equipment changes, return to step S1 for resampling and alignment.

[0067] This invention employs a two-layer normally closed elastic reset mechanism that ensures safety upon power failure.

[0068] First layer: Normally closed MEMS electrostatic torsion fiber micromirror (submicrosecond level, used for fiber optic control links). When energized, the micromirror's deflection and conduction are maintained by an electrostatic torque, controlling the optical path. When the GPIO is pulled to zero and de-energized, the electrostatic force disappears, and the micromirror recovers its position as a torsion cantilever beam. Driven by damping mechanical equations

[0069] Parametric design implementation example (with dual verification of mechanical response and electrostatic drive capability).

[0070] Geometric and inertia parameters: The micromirrors are fabricated using a polycrystalline silicon structure layer, forming square mirrors with sides of 40 micrometers and a thickness of 2 micrometers. The polycrystalline silicon density is approximately... The mirror quality is approximately The moment of inertia about the central torsional axis is

[0071] Stiffness and Natural Frequency: Design Stiffness of Torsional Cantilever Beam (This corresponds to a polycrystalline silicon torsion beam with a beam width of 2 to 3 micrometers, a beam thickness of 2 micrometers, and a single-sided beam length of approximately 15 to 25 micrometers, which is within the range that mature MEMS optical switch technology can manufacture.) Therefore, the inherent angular frequency...

[0072] The corresponding mechanical resonant frequency is approximately 796 kHz.

[0073] Damping design: The damping coefficient is increased through the design of the air damping gap in the diaphragm.

[0074] Satisfying the critical damping condition The system exhibits no oscillation or rebound.

[0075] Response time derivation: The free decay response of a critically damped second-order system at the deflection angle is as follows: The time to decay to 5% of the initial value is approximately microseconds, the time to decay to 1% is approximately Microseconds. In this embodiment, the angle tolerance of the through optical path is designed with a 5% residual offset angle, so the micromirror resets to its original position in less than 1 microsecond. Normally closed through angle, the physical level connects the safety through optical path and cuts off the model writing optical path.

[0076] Electrostatic drive capability verification: The deflection angle of the micromirror under power is designed as follows: (Approximately 0.035 rad), the electrostatic holding torque required to maintain this deflection angle is

[0077] This torque is provided by the vertical comb tooth electrostatic drive electrode array: taking the number of comb tooth pairs Structural layer thickness micrometers, gaps micrometers, driving voltage V, the electrostatic tangential force generated by a single-sided comb array is approximately

[0078] With a lever arm of 25 micrometers, it can provide a driving torque of approximately To maintain the required torque This is consistent with the principle that under an 80 V driving voltage, the electrostatic torque is sufficient to maintain the deflection. After power loss, the electrostatic torque disappears, and the elastic restoring torque dominates the reset, which is consistent with the normally closed working principle of "deflection and conduction when powered on, and elastic reset and cut-off when powered off". All the above parameters (40 micrometers mirror side length, 2 to 3 micrometers beam width, comb structure, 80 V drive) are within the manufacturable range of mature MEMS optical switch body silicon / surface silicon technology.

[0079] The second layer consists of a monostable normally closed electromagnetic isolation relay (millisecond level, operating on the electrical differential link, providing current isolation redundancy). When energized, this relay opens its contacts to ensure a safe direct connection; upon de-energization, a return spring drives the armature to fall back, and the contacts close within less than 5 milliseconds, shorting the bus differential pair and providing current-level physical isolation to the model output channel. It should be noted that this invention explicitly uses a monostable (spring-return) structure rather than a bistable (magnetically latched) structure because a bistable relay remains in its original position after de-energization, which does not conform to the "safety upon de-energization" principle. This layer does not handle sub-microsecond performance but serves as electrical redundancy and persistent isolation assurance for the first layer.

[0080] After the switching is completed, the backoff control unit inside the connector retrieves the unbiased state estimate calculated by the local Kalman filter. Substitute hard-coded Robust state feedback matrix Issue intrinsic safety control quantity

[0081] The control equipment self-heals back to the steady-state range.

[0082] S6, online self-evolution of specifications When adjustments to production line piping or control strategies lead to When the statistical properties drift (detected by a decrease in the consistency rate of the retained set), the system automatically re-triggers the two-stage learning process in step S2 to update... and The updated specification is then signed and written into the TEE secure storage, enabling the online self-evolution of formal security constraint rules.

[0083] Through the above technical solutions, this invention extracts physical laws into a set of process safety regulations, introduces a regulation consistency penalty term into the model fine-tuning loss, forces the model to learn to avoid physical violations during training, performs verification before instruction execution, and rejects any instruction that fails verification, thereby eliminating the conflict between logic and physics at the root and avoiding the blind issuance of unexecutable control instructions; if the control decision issued by the embodied control model fails verification, the control loop is cut off and physical retreat is performed, thereby improving the safety response speed.

[0084] Example 2 Embodiment 2 of the present invention provides a body-on-body control system that executes the method of Embodiment 1, including: The data alignment and reconstruction module is used to collect equipment information within the plant area and reconstruct multi-source scattered logs into a standard aligned event tracking set; A formal specification inverse self-learning engine is used to construct a time automaton model based on a standard aligned event tracking set as the initial hypothesis automaton. The time automaton model is combined with the physical control equations to construct a digital twin model. The digital twin model is actively queried to retrieve counterexamples and iteratively correct the hypothesis automaton. At the same time, all CVD process specifications are solved on the standard aligned event tracking set to form a process safety specification set. A formally constrained generative simulation synthesis engine is used to drive Monte Carlo tree search to explore fault paths in the current hypothesis automaton, generate fault jump chains, and synthesize a fault-dense simulation log stream together with continuous physics waveforms; the fault-dense simulation log stream is used to fine-tune the embodied control model, and a reduction consistency penalty term is embedded in the loss function of the embodied control model; The hardware isolation verification chip is used to verify the control decisions issued by the specific control model. If the verification fails, it enters the protection module; if the verification passes, it executes the control decisions to control the device. The protection module is used to disconnect the control loop and perform physical retreat. The self-updating module is used to return to the formal reduction inverse self-learning engine when adjustments to production line piping or control strategies cause a drift in the statistical properties of the standard aligned event trace set.

[0085] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for controlling an embodied being, characterized in that, Includes the following steps: S1. Collect equipment information within the plant area and reconstruct multi-source scattered logs into a standard aligned event tracking set; S2. Construct a time automaton model based on a standard aligned event tracking set as the initial hypothesis automaton. Combine the time automaton model with the physical control equations to construct a digital twin model. Actively query the digital twin model to retrieve counterexamples and iteratively revise the hypothesis automaton. Simultaneously, all CVD process specifications are solved on the standard aligned event tracking set to form a set of process safety specifications; S3. Drive Monte Carlo tree search to explore fault paths in the current hypothesis automaton, generate fault jump chains, and synthesize a fault-dense simulation log stream together with the continuous physical field waveform; use the fault-dense simulation log stream to fine-tune the embodied control model, and embed a reduction consistency penalty term in the loss function of the embodied control model; S4. Verify the control decisions issued by the embodied control model. If the verification fails, proceed to S5. If the verification passes, execute the control decisions to control the equipment. S5. Disconnect the control loop and perform physical retreat.

2. The embodied control method according to claim 1, characterized in that, S2 includes: Initially, the constructed time automaton model is the initial hypothesis automaton. For any state transition in a hypothetical automaton Extract all times when the redirect occurred from the historical logs, calculate the empirical distribution, and take the time with the minimum value. and maximum time Form a support band and synthesize directly: Defense conditions ; Indicates the current state. Indicates the next state. Indicates that the system has entered a state. The duration that has elapsed since then; State invariants .

3. The embodied control method according to claim 2, characterized in that, The S2 process involves actively querying the digital twin model, retrieving counterexamples, and iteratively refining the hypothesis automaton, including: Active queries include member queries and equivalence queries. Member queries are used to find a specific test path. Input digital twin model Determine whether the test path is reachable in a physically continuous environment; equivalence query is used to check the current hypothesis automaton. With digital twin model Whether the behaviors are completely consistent; the equivalence query adopts triple bounded processing: The continuous dynamics of the digital twin model are over-approximated as piecewise linear interval constraints using interval envelope abstraction, and together with the guard conditions and invariants of the hypothetical automaton, they are encoded into a wordless linear real number arithmetic logic formula. The retrieval time domain is truncated to a fixed number of steps. Only retrieves counterexample paths where the behavior of the digital twin model is inconsistent with that of the hypothetical automaton within a fixed number of steps; Counterexample retrieval is performed using the SMT solver between the finite sampled trajectory set of the digital twin model and the symbolic reachable set of the hypothetical automaton. The SMT solver outputs that satisfy the assignment criteria constitute a specific counterexample. After retrieving a counterexample, the state nodes are split, the transition edges are completed, and the hypothetical automaton is updated to obtain the final model. When continuous In each iteration, convergence is terminated when there are no counterexamples to the equivalent query and the consistency rate of the retained set exceeds a preset threshold; the symbolic reachable set is a hypothetical automaton. The continuous geometric space bounded by the guarding conditions and state invariants.

4. The embodied control method according to claim 3, characterized in that, The reserved set is a standard aligned event tracking set. The frozen portion of the dataset that did not participate in step S2 is retained. The consistency rate of the retained set is the ratio of the number of tracks in the retained set that are judged to be consistent by the hypothesis automaton to the total number of tracks in the retained set. The method for the hypothesis automaton to judge whether the tracks are consistent is as follows: the track sequence is input into the hypothesis automaton, and the hypothesis automaton starts from the initial state and performs state transitions according to the discrete event symbols in the track. During the transition, it checks whether the guard condition and state invariant of each step allow the event to occur at the corresponding timestamp. If so, the track is consistent; otherwise, it is inconsistent.

5. The embodied control method according to claim 1, characterized in that, In S2, all CVD process specifications are solved on the standard aligned event tracking set to form a set of process safety specifications, including: In the standard alignment event tracking set Solving the robustness maximization problem on continuous parametric surfaces in, Represents the standard alignment event tracking set The i-th tracking item, This represents the parameter to be solved. Indicated by STL parameterized formulas for variables Representing the trajectory The robustness measure of the STL parameterized formula at the initial time; based on the solved parameters, the CVD process specification is obtained in reverse; all the solved CVD process specifications constitute the set of process safety specifications. .

6. The embodied control method according to claim 1, characterized in that, S3 includes: Initiating a Monte Carlo tree search in the discrete space of the current hypothetical automaton, using the reduction robustness loss as the reward function, explores fault paths. The fault path refers to the discrete jump path with the largest reduction robustness loss obtained by searching according to the reward function, thus outputting a set of discrete fault jump chains and their corresponding jump time intervals. Solving the physical control equations within the jump time intervals yields continuous physical field waveforms. These continuous physical field waveforms and discrete fault jump chains are then compiled into a standard protocol message sequence, and queued according to delay. By perturbing the software timestamps of the standard protocol message sequence, the latency statistics of the simulation log are made to converge with those of the real log, thus obtaining a fault-dense simulation log stream. ; Using fault-intensive simulation log streams The loss function for training the embodied control model is: in, The embodied control model outputs the predicted trajectory of the action obtained through forward extrapolation from the digital twin model. Indicates the predicted trajectory Initial set of process safety regulations The sum of the STL robustness metrics calculated for each specification. This represents the cross-entropy loss between the action probability distribution output by the embodied control model and the corresponding actual actions executed in the historical logs. These are the weighting coefficients.

7. The embodied control method according to claim 1, characterized in that, During the equipment operation period in S4, the specific control model issues control decisions. The following four verification stages are performed sequentially within the hardware isolation area inside the bypass connector: Level 1: Retrieve the solid-state private key The decision messages output by the embodied control model are accompanied by digital signatures, and the system uses a solid-state private key. Perform digital signature verification and decryption on decision messages, and reject any instructions from unknown sources or that have been tampered with; The second level is to compile process safety regulations. The predicted trajectory obtained by solving the physical control equations using the FNO operator driven by the current control command. The inputs are combined with the inputs to the SMT solver. The SMT solver then determines within a specified timeframe whether the future state after performing the action violates the set theory. If the rules in the set are violated If the reduction or SMT solver output times out, a reduction violation flag will be output. The third stage involves extracting the latent feature vectors from the deep Transformer output of the embodied control model. Calculate the Mahalanobis distance of the latent feature vectors relative to the offline-stored normal baseline distribution. ;Will With ROM stored Compare with a normal benchmark measure and calculate the proportion of non-conformal scores greater than or equal to the current score, i.e., conformal scores. Value, if Output out-of-distribution anomaly flags. Indicates a preset threshold; Level 4: Once either the output protocol violation flag or the distribution out-of-range anomaly flag is displayed, the physical backoff in step S5 is triggered.

8. The embodied control method according to claim 7, characterized in that, Mahalanobis distance ,in, , These are the baseline mean and covariance inverse matrix pre-stored in ROM, respectively; The conform Value ,in, For the i-th normal baseline measure, For the characteristic function, when , Select 1 if the value is 1, otherwise select 0.

9. The embodied control method according to claim 1, characterized in that, It also includes step S6, which returns to S2 when adjustments to the production line piping or control strategy cause a drift in the statistical properties of the standard alignment event tracking set.

10. A body-on-body control system, characterized in that, The method of any one of claims 1-8 comprises: The data alignment and reconstruction module is used to collect equipment information within the plant area and reconstruct multi-source scattered logs into a standard aligned event tracking set; A formal specification inverse self-learning engine is used to construct a time automaton model based on a standard aligned event tracking set as the initial hypothesis automaton. The time automaton model is combined with the physical control equations to construct a digital twin model. The digital twin model is actively queried to retrieve counterexamples and iteratively correct the hypothesis automaton. At the same time, all CVD process specifications are solved on the standard aligned event tracking set to form a process safety specification set. A formally constrained generative simulation synthesis engine is used to drive Monte Carlo tree search to explore fault paths in the current hypothesis automaton, generate fault jump chains, and synthesize a fault-dense simulation log stream together with continuous physics waveforms; the fault-dense simulation log stream is used to fine-tune the embodied control model, and a reduction consistency penalty term is embedded in the loss function of the embodied control model; The hardware isolation verification chip is used to verify the control decisions issued by the specific control model. If the verification fails, it enters the protection module; if the verification passes, it executes the control decisions to control the device. The protection module is used to disconnect the control loop and perform physical retreat. The self-updating module is used to return to the formal reduction inverse self-learning engine when adjustments to production line piping or control strategies cause a drift in the statistical properties of the standard aligned event trace set.

Images