Multi-protocol homologous acquisition subway ventilation, water supply and power supply integrated monitoring system

Abstract

The application discloses a multi-protocol homologous collection subway ventilation, water supply and drainage power supply integrated monitoring system and relates to the technical field of rail transit electromechanical monitoring.The system comprises a time sequence base collection electromechanical equipment data encapsulation homologous frame, a distribution service module and a log pushing, a permission module calculating a channel trust score, synchronizing permissions and abnormal information, an energy saving module generating a control weight according to permissions and trust scores, an over-standard pushing energy consumption early warning, a fault module judging fault confidence level grading disposal and feeding back results, an audit module storing time sequence logs, grading opening logs and optimizing three types of algorithm parameters;the application uniformly collects subway electromechanical data, guarantees grading safety through hardware isolation storage, dynamically calculates a channel trust score to prevent unauthorized access, traces a complete time sequence log, fuses a trust value and a working condition dynamic energy saving control, distinguishes equipment faults and human disturbance grading disposal, iteratively optimizes an algorithm through an audit module, automatically corrects the system, and reduces operation and maintenance labor costs.

Description

Technical Field

[0001] This invention relates to the field of rail transit electromechanical monitoring technology, specifically a multi-protocol, same-source acquisition integrated monitoring system for subway ventilation, water supply, drainage and power supply. Background Technology

[0002] During the large-scale construction of urban subway lines, station power supply, tunnel ventilation, and station water supply and drainage are core electromechanical systems supporting the safe and stable operation of the subway. These three systems are equipped with independent dedicated monitoring equipment, and the communication protocols used by the underlying equipment differ significantly. Various sensors, main equipment, and high-voltage power supply devices generate massive amounts of real-time operational data. At present, the field of rail transit electromechanical monitoring is gradually developing towards integrated management and control. The industry generally hopes to break down the data silos of multiple professional equipment and achieve unified collection and centralized supervision of data from multiple types of protocol equipment. At the same time, the operational data of subway power supply equipment has high security attributes, and the confidentiality levels of data from different levels of electromechanical equipment are different. During system operation, there are multiple access channels such as local operation, remote maintenance, and centralized platform monitoring. The demand for data hierarchical protection and access behavior control in the scenario of parallel access through multiple channels continues to increase. Long-term continuous operation of electromechanical equipment will generate multiple problems such as energy waste, equipment abnormalities, and external access disturbances. The industry urgently needs an integrated monitoring architecture that can simultaneously complete data collection, access control, energy-saving regulation, fault identification, and full-process auditing to meet the collaborative operation and management needs of multiple professional electromechanical equipment in the subway.

[0003] Traditional subway electromechanical monitoring solutions employ a separate, discipline-specific construction model, with power supply, ventilation, and water supply / drainage systems each equipped with independent acquisition terminals and monitoring platforms. This approach fails to achieve synchronous acquisition from multiple protocol devices, lacks unified time-series identifiers for data across systems, and makes it difficult to align and compare cross-disciplinary data. It also struggles to distinguish between equipment malfunctions and external access interference. Traditional access control mechanisms rely solely on fixed accounts to define access permissions, failing to dynamically adjust channel permissions based on access behavior. Furthermore, there is no continuously updated, reliable assessment mechanism. Cross-level temporary maintenance operations lack standardized control procedures, making it difficult to proactively mitigate the risks of unauthorized access to high-risk data and unauthorized equipment operation. Energy-saving control relies solely on single equipment operating parameters to output control commands, without considering the security status constraints of access channels, potentially leading to aggressive control measures that damage electromechanical equipment. Fault identification relies solely on single equipment parameter fluctuations to determine anomalies, lacking cross-validation logic for multi-disciplinary data from the same source. This easily leads to misinterpreting human access fluctuations as equipment malfunctions, triggering invalid alarms and misoperations. Various operation logs are stored in a scattered manner without unified time-series binding, and the storage media is tamper-proof, making it impossible to achieve complete end-to-end traceability or to use operation logs to optimize system control logic. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a multi-protocol, same-source data acquisition integrated monitoring system for subway ventilation, water supply, drainage, and power supply. The system consists of five functional modules working together: a time-series data base, dynamic access control, collaborative energy-saving control, fault classification and handling, and end-to-end auditing. The time-series data base is compatible with multiple device communication protocols, uniformly encapsulates same-source data frames with time-series identifiers and hierarchical security tags, and stores the data in isolation. Dynamic access control relies on multi-dimensional access indicators to assess the channel's trustworthiness and dynamically adjusts the data reading permissions of each access channel to prevent unauthorized operations. Collaborative energy-saving control combines the channel's trustworthiness to dynamically calculate and adjust weights, optimizing the energy consumption of electromechanical equipment while ensuring safety. Fault classification and handling uses same-source snapshots to fuse multi-dimensional indicators to determine fault confidence, accurately distinguishing between equipment anomalies and human access disturbances and handling them accordingly. End-to-end auditing retains an immutable time-series log throughout the entire process and can also reverse-engineer the operational logic of each module. It combines unified acquisition of multi-professional data, hierarchical security protection, intelligent energy saving, accurate fault identification, and end-to-end traceability capabilities, adapting to the integrated management and control needs of multiple electromechanical systems in subways.

[0005] To solve the above-mentioned technical problems, the present invention provides the following technical solution: a multi-protocol, same-source acquisition integrated monitoring system for subway ventilation, water supply, drainage, and power supply, comprising:

[0006] The timing data base module connects to the communication protocols of power supply, ventilation, and water supply and drainage equipment, collects operating parameters, adds a global timing stamp and a three-level security tag to the operating parameters, encapsulates the operating parameters into homogeneous data frames, sends homogeneous data frames to the dynamic access control module, collaborative energy-saving control module and fault classification and handling module, and sends records to the full-link audit module;

[0007] The dynamic access control module receives data frames from the same source, manages the access permissions of local access channels, SCADA access channels, and remote operation and maintenance access channels, uses access indicators to run a trust decay algorithm to calculate the channel trust score, reduces the access permission when the trust score is lower than the threshold, sends the access permission information, trust score and abnormal flag to the collaborative energy saving control module and the fault classification and handling module, and sends the record to the full-link audit module.

[0008] The collaborative energy-saving control module uses permission information, trust score and cache pool parameters to run the energy-saving weight algorithm to calculate the control weight and issue control instructions. When the control weight exceeds the threshold, it issues an energy consumption warning to the fault classification and handling module, adjusts the control weight according to the fault mark, and sends the record to the end-to-end audit module.

[0009] The fault classification and handling module verifies the same source data frames and abnormal markers and energy consumption warnings, runs the fault confidence judgment algorithm to capture same source snapshots to distinguish between equipment faults and human access disturbances and calculates the fault confidence. Based on the fault confidence, it performs classified handling and sends the fault judgment results to the collaborative energy-saving control module and sends the records to the full-link audit module.

[0010] The fault classification and handling module classifies various equipment abnormal states based on the combination of indicators corresponding to the fault confidence level. A synchronous increase in the timing distortion coefficient of multiple professional data frames from the same source corresponds to a power supply interference state. An increase in the timing distortion coefficient of a single device on a single bus corresponds to a hardware abnormal state. A synchronous increase in the timing distortion coefficient of all devices with no change in the weight fluctuation residual corresponds to a timing synchronization offset state. An increase in the timing distortion coefficient of a single bus with no change in other device parameters corresponds to a bus line interference state. An increase in only the channel risk coefficient with no change in the timing distortion coefficient and weight fluctuation residual corresponds to a human access disturbance state.

[0011] The end-to-end auditing module binds global timestamps to store records sent by each module, opens logs in a hierarchical manner according to trust scores, and adjusts the internal parameters of the trust decay algorithm, energy-saving weight algorithm, and fault confidence judgment algorithm in reverse.

[0012] The records stored in the end-to-end audit module include data encapsulation records, data cache update records, and overdue data cleanup records from the time-series data base module; permission configuration records, trust score calculation records, permission downgrade records, and anomaly marker generation records from the dynamic permission control module; weight calculation records, control parameter distribution records, energy consumption threshold determination records, and early warning output records from the collaborative energy-saving control module; and data verification records, snapshot capture records, confidence calculation records, and graded handling records from the fault classification and handling module. All stored records in the end-to-end audit module are bound to the global time-series stamp output by the time-series data base module. The end-to-end audit module adopts a hardware register read-only storage mode, and the stored records only support write and retrieval operations.

[0013] Furthermore, the time-series data base module is compatible with S7, Modbus, BACnet, and LoRa communication protocols, which respectively correspond to the access of subway high-voltage power supply equipment, tunnel ventilation equipment, station water supply and drainage equipment, and terminal sensor instruments. The operating parameters collected by the time-series data base module include high-voltage protection parameters, transformer load parameters, fan operating parameters, water pump operating parameters, pipeline pressure parameters, gas concentration parameters, liquid level parameters, and passenger flow parameters. The time-series data base module uniformly configures a globally unique time stamp for all operating parameters and configures a three-level security label. The global time stamp and the three-level security label are synchronously encapsulated in the header of the same source data frame. The time-series data base module is configured with a 15-minute time-series aligned sliding buffer pool. The buffer pool stores the same source data frames in time sequence, and the buffer pool clears expired data according to a fixed period. The time-series data base module adopts a hardware register partition isolation mode to complete data reading and writing. The same source data frames corresponding to different security labels are independently stored in different register partitions.

[0014] Furthermore, the three-level security tags configured in the time-series data base module include a level 1 power supply confidentiality tag, a level 2 main equipment control tag, and a level 3 end-meter tag; the level 1 power supply confidentiality tag corresponds to the operating parameters of the power supply equipment collected by the S7 protocol; the level 2 main equipment control tag corresponds to the operating parameters of the ventilation equipment and water supply and drainage main equipment collected by the Modbus protocol and BACnet protocol; the level 3 end-meter tag corresponds to the operating parameters of the end-sensor instrument collected by the LoRa protocol; the level 3 security tag and the global time stamp are fixed encapsulation fields of the same source data frame.

[0015] Furthermore, the access channels managed by the dynamic access control module include local access channels, SCADA access channels, and remote operation and maintenance access channels. The local access channel is configured to read Level 1, Level 2, and Level 3 security tag data. The SCADA access channel is configured to read Level 2 and Level 3 security tag data, but prohibits reading Level 1 security tag data. The remote operation and maintenance access channel is configured to read only Level 3 security tag data. The dynamic access control module supports cross-level temporary authorization configurations for durations ranging from 10 minutes to 60 minutes, and restores the default channel data reading configuration after the temporary authorization expires. The dynamic access control module stores channel access frequency data, access time period data, data reading range data, and high-risk operation record data, which serve as input access indicators for the trust decay algorithm.

[0016] Furthermore, the dynamic permission management module's permission reduction includes a three-level degradation configuration: after the temporary cross-level authorization channel is downgraded, the permission to read level 1 security tag data is canceled, while the permission to read level 2 and level 3 security tag data is retained only; after the SCADA access channel is downgraded, the permission to output all device control commands is canceled, while the permission to read level 3 security tag data is retained only; after the remote operation and maintenance access channel is downgraded, all same-source data frame reception links are terminated, and all data reading behavior is terminated; the permission degradation state remains constant until a manual reset command is received.

[0017] Furthermore, the mathematical expression for the trust decay algorithm configured in the dynamic access control module is:

[0018]

[0019] in, This is the channel trust score, with a value range of 0 to 100. This is the access frequency deviation coefficient. Access coefficient during non-compliant periods. This refers to the deviation coefficient for out-of-range data reading. This is the cumulative coefficient for high-risk operation instructions; , All are dimensionless parameters that have been normalized to the interval [0, 1] after being processed by maximum and minimum normalization; β, γ, and δ are the system's preset fixed penalty coefficients.

[0020] Furthermore, the cache pool parameters read by the collaborative energy-saving control module include power supply load parameters, three-phase imbalance parameters, equipment temperature parameters, tunnel gas concentration parameters, ambient temperature difference parameters, equipment energy consumption parameters, liquid level fluctuation parameters, pipeline water pressure parameters, and passenger flow density parameters. The collaborative energy-saving control module outputs fan frequency adjustment parameters, water pump start-stop control parameters, and reactive power compensation switching parameters based on the control weights calculated by the energy-saving weight algorithm. The collaborative energy-saving control module performs parameter limiting configuration on all output control parameters, including fan frequency upper and lower limit configuration, equipment continuous running time configuration, and control command issuance interval configuration. The high-risk control parameters of the collaborative energy-saving control module are configured to be accessed only through local access channels with high trust scores.

[0021] Furthermore, the mathematical expression for the energy-saving weight algorithm configured in the collaborative energy-saving control module is:

[0022]

[0023] in, The final weight is determined by the equipment adjustment. Energy saving weight based on operating condition baseline; Set a preset safety and conservative weight for the system; The channel trust score is obtained by the trust decay algorithm. The system presets a security switching threshold; when the Below When this happens, a forced switch to a conservative weighting is initiated to achieve a cliff-like security protection in the low-trust range.

[0024] Furthermore, the fault classification and handling module verifies the same-source data frame checksum, the complete frame length of the same-source data frame, and the fluctuation range of equipment operating parameters. When the fault classification and handling module detects an abnormal state of a data frame, it extracts same-source data frames from the power supply equipment, ventilation equipment, and water supply and drainage equipment under the same global time stamp to form a same-source snapshot. The fault classification and handling module classifies equipment fault types and human access disturbance types based on the fault confidence level output by the fault confidence discrimination algorithm. The self-healing abnormal type configured by the fault classification and handling module corresponds to the execution of protocol re-handshake operation, timing register reset operation, and acquisition plug-in restart operation. The permanent abnormal type configured by the fault classification and handling module only outputs an alarm identifier and does not configure automatic control output logic.

[0025] Furthermore, the mathematical expression of the fault confidence discrimination algorithm configured in the fault classification and handling module is as follows:

[0026]

[0027] And, when the stated and When both are below their respective preset low-noise thresholds, the Forced assignment to 0; where, The fault confidence level ranges from 0 to 1. This is the message timing distortion coefficient; The real-time fluctuation residual of the control weight is output for the energy-saving weight algorithm; The channel trust score is obtained by the trust decay algorithm. , , A fixed coupling coefficient is preset for the fault dimension of the system.

[0028] Compared with existing technologies, this multi-protocol, same-source acquisition integrated monitoring system for subway ventilation, water supply, drainage, and power supply has the following advantages:

[0029] I. This invention achieves integrated data collection from multiple protocol devices by building a unified time-series data foundation. It uniformly adds global time-series identifiers and hierarchical security tags to all device operation data, and uses a partitioned and isolated hardware storage architecture to achieve physical isolation storage of data at different security levels. This ensures consistency and hierarchical data security for multiple disciplines such as subway power supply, ventilation, and water supply and drainage from the data source level. Based on dynamic access control logic across all channels, it continuously calculates channel trust scores and adaptively adjusts access permissions based on multi-dimensional access indicators. It defines differentiated data read boundaries for different maintenance channels and supports time-limited cross-level temporary authorization. It can accurately identify non-standard access behavior and proactively shrink access permissions, effectively preventing data leakage and system disturbance risks caused by unauthorized reading and high-risk operations. The entire process generates operation logs with unified time-series identifiers and retains them using read-only hardware storage. Logs are accessed hierarchically based on channel trust scores, allowing complete traceability of the entire process of data collection, permission changes, control issuance, and fault handling, providing tamper-proof and complete credentials for system security traceability.

[0030] Second, this invention constructs a dynamic energy-saving control logic by integrating trust scores and equipment operating parameters. It dynamically balances energy-saving control weights and safety conservative weights based on the channel's trust status. Under the premise of ensuring the bottom line of equipment operation safety, it adaptively outputs control commands for equipment such as fans, water pumps, and reactive power compensation. Simultaneously, it sets boundary constraints for control parameters to avoid damage to equipment from extreme control actions, significantly reducing the comprehensive energy consumption of multiple professional electromechanical equipment in the subway. It calculates the trustworthiness of faults based on the fusion of multi-dimensional indicators and distinguishes between equipment hardware anomalies, line interference, and human access disturbances based on unified time-series snapshots. It matches automatic self-healing operations or alarm handling strategies for different anomaly types to avoid misjudging operation and maintenance access fluctuations as equipment faults and causing ineffective control. The audit module can iteratively optimize the three core operation logic parameters of permissions, energy saving, and fault identification to achieve self-correction of system operation status, continuously improve the accuracy of permission control, the adaptability of energy-saving control, and the accuracy of fault identification, and reduce the cost of manual operation and maintenance intervention.

[0031] Other advantages, objectives and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination or study, or may be learned from the practice of the invention. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 A flowchart illustrating the overall closed-loop operation of a multi-protocol, same-source monitoring system for subway ventilation, water supply, drainage, and power supply.

[0034] Figure 2 Flowchart of trust score calculation and permission downgrade logic for the dynamic permission control module;

[0035] Figure 3 Flowchart for weight calculation and control instruction issuance for collaborative energy-saving control module. Detailed Implementation

[0036] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0037] Reference Figure 1 This invention proposes a multi-protocol co-source acquisition integrated monitoring system for subway ventilation, water supply, drainage, and power supply. It adopts a data processing mechanism that includes multi-protocol hardware adaptation and time-series co-source frame encapsulation, multi-channel hierarchical permission trust attenuation control, dynamic adjustment of energy-saving weights coupled with operating conditions, multi-dimensional time-series snapshot fault confidence judgment, and full-link time-series binding audit closed loop. Without splitting the independent monitoring platforms for power supply, ventilation, and water supply equipment, it can achieve unified time-series standardized acquisition of data from multiple professional equipment, hierarchical access security isolation, dynamic energy consumption adaptive adjustment, and accurate differentiation between equipment faults and human access disturbances. It also achieves highly stable and reliable integrated online monitoring of the operating status of multiple professional electromechanical equipment in the subway.

[0038] The overall system operation flow described in this embodiment specifically includes:

[0039] The timing data base module is compatible with multiple industrial communication protocols and can access subway power supply, tunnel ventilation, station water supply and drainage, and terminal sensor instruments. It collects operating parameters of all types of equipment, uniformly adds global timing stamps and three-level security tags, and standardizes and encapsulates multi-source heterogeneous operating parameters into homogeneous data frames. It synchronously distributes homogeneous data frames to the dynamic permission management module, collaborative energy-saving control module, and fault classification and handling module, and pushes a complete record of each step of data collection, encapsulation, and caching operation to the full-link audit module.

[0040] The dynamic access control module receives data frames from the same source from each time-series node, performs hierarchical data reading access control on three types of operation channels: local access channel, SCADA access channel, and remote operation and maintenance access channel, extracts multi-dimensional access indicators of the channel and inputs them into the trust decay algorithm to calculate the channel trust score in real time. When the trust score is lower than the system preset threshold, the corresponding channel permission downgrade operation is automatically executed. The real-time access configuration information, channel trust score, and abnormal access mark are synchronously pushed to the collaborative energy-saving control module and the fault classification and handling module, and operation logs are synchronously generated and pushed to the full-link audit module for storage.

[0041] The collaborative energy-saving control module reads the operating parameters of all professional equipment in the time-series data base cache pool, and calculates the final weight of equipment control by combining the channel trust score and permission information input by the dynamic permission control module with the energy-saving weight algorithm. Based on the control weight, it outputs various control commands such as fan frequency, water pump start / stop, and reactive power compensation switching. It sets multiple limit constraints on all output control parameters, such as upper and lower limits, running time, and command issuance interval. When the control weight exceeds the energy consumption warning threshold, it generates an energy consumption warning signal and pushes it to the fault classification and handling module. At the same time, it receives the fault mark issued by the fault classification and handling module to dynamically correct the control weight. The entire process of weight calculation, command issuance, and warning judgment is recorded and pushed to the full-link audit module.

[0042] The fault classification and handling module performs triple verification on the received same-source data frames, including check code, frame length, and parameter fluctuation amplitude. When an abnormal data frame is detected, it extracts same-source data frames from the power supply, ventilation, and water supply and drainage disciplines under the same global time stamp to form a same-source snapshot. The timing distortion coefficient, weight fluctuation residual, and channel trust attenuation score are input into the fault confidence discrimination algorithm to calculate the fault confidence. Based on the confidence value, it distinguishes between abnormal types such as equipment hardware failure, line interference, timing synchronization offset, and human access disturbance. For self-healing abnormalities, it performs automatic handling operations such as protocol re-handshake, register reset, and acquisition plug restart. For permanent abnormalities, it only continuously outputs alarm flags without triggering automatic control logic. The final fault judgment result is sent back to the collaborative energy-saving control module to correct the control strategy. Simultaneously, the verification, snapshot, confidence calculation, and classification handling logs are generated and pushed to the full-link audit module.

[0043] The end-to-end audit module uniformly binds to the global time stamp output by the time-series data base to store all operation records pushed by upstream modules. Log retrieval permissions are granted in a hierarchical manner according to the real-time trust score of the channel. At the same time, the trust decay algorithm, energy-saving weight algorithm, and fault confidence judgment algorithm are optimized by reverse iteration based on the long-term stored end-to-end logs. The module hardware storage adopts read-only register partitioning, which only supports data writing and retrieval, and prohibits log tampering and deletion operations.

[0044] Specifically, the entire system operation logic of this invention relies on a five-layer module closed-loop linkage architecture. This architecture first standardizes and unifies the data acquisition links of four completely heterogeneous devices: subway high-voltage power supply, tunnel ventilation, station water supply and drainage, and terminal sensor instruments. Through a time-series data base module, it completes multi-protocol adaptation, time-series alignment, security label classification, and same-source frame encapsulation, eliminating underlying problems such as time-series misalignment, inconsistent data formats, and mixed security levels among different professional devices. Next, a dynamic access control module isolates the data reading range for three types of on-site maintenance channels, quantifies channel operation risks using multi-dimensional access indicators, and dynamically adjusts channel data access permissions through trust scores, avoiding high-risk unauthorized reading and unauthorized operation risks from the source of access. Finally, a collaborative energy-saving control module combines real-time equipment operating conditions with current... The front channel's reliability level dynamically adjusts the energy-saving control intensity, taking into account both the operational safety of the subway electromechanical system and overall energy consumption optimization. At the same time, multiple parameter limits are set to avoid equipment overload caused by excessive control commands. The fault classification and handling module relies on multi-professional snapshots with the same timestamp to integrate three dimensions: time sequence distortion, energy consumption weight fluctuation, and channel access risk to quantify the fault reliability level. It accurately distinguishes between equipment failures and data disturbances caused by human operation, avoiding false fault reports caused by fluctuations in single equipment parameters. Finally, the full-link audit module binds and retains the entire process operation time sequence, opens logs in a graded manner, and reverse-optimizes the fixed coefficients of the three types of front-end algorithms, forming a complete closed loop of collection-permission-control-fault handling-audit self-iteration.

[0045] Optionally, the timing data base module is compatible with S7, Modbus, BACnet, and LoRa communication protocols and completes the corresponding device access, operation parameter acquisition, and same-source frame encapsulation processes, including:

[0046] The S7 protocol is pre-configured to correspond to the communication interface of the subway high-voltage power supply equipment. The Modbus and BACnet protocols are respectively connected to the main ventilation equipment in the tunnel and the main water supply and drainage equipment in the station. The LoRa wireless protocol is connected to various terminal sensors in the pipeline network, tunnel, and equipment room.

[0047] Configure a standardized list of data collection points, covering all dimensions of operational data including high-voltage protection parameters, transformer load parameters, fan operating parameters, water pump operating parameters, pipeline pressure parameters, tunnel gas concentration parameters, equipment liquid level parameters, and platform passenger flow parameters.

[0048] A globally unique time stamp is generated synchronously for each collected equipment operation parameter. Based on the equipment's professional affiliation and security level, three types of security identifiers are matched: Level 1 power supply confidentiality label, Level 2 main equipment control label, and Level 3 terminal instrument label. The global time stamp and Level 3 security label are used as fixed frame header fields and are uniformly encapsulated with the equipment operation parameter payload to generate a data frame of the same source.

[0049] Set up a 15-minute time-aligned sliding cache pool. All data frames from the same source are stored in the cache pool partition according to the global time stamp in the frame header. Expired data with a storage time of more than 15 minutes is automatically retrieved and cleared according to a fixed period.

[0050] The hardware register partitioning isolation read / write architecture is adopted, with three independent physical register partitions. The same frames of the first-level power supply confidential tags, the second-level master equipment control tags, and the third-level terminal instrument tags are stored in their respective dedicated register partitions. The read / write buses of different partitions are physically isolated to prevent data leakage across security levels.

[0051] Specifically, firstly, corresponding protocol acquisition hardware interfaces are deployed for the four types of electromechanical equipment on the subway site. High-voltage switchgear, transformers, and other power supply equipment are uniformly configured with S7 bus acquisition modules. Main ventilation equipment such as tunnel axial flow fans and exhaust valves use Modbus and BACnet dual-protocol compatible acquisition boards. Water pumps, sewage pumps, and water tank level controllers within the station use BACnet bus acquisition. Tunnel CO concentration sensors, pipeline pressure transmitters, and platform passenger flow counting terminals use LoRa wireless acquisition terminals. All acquisition hardware is uniformly connected to the underlying bus of the time-series data base. Secondly, a preset list of acquisition points across all disciplines is imported. The acquisition program polls and reads real-time values ​​from all points, with each polling cycle synchronized with the global time-series stamp generation clock. Each time a set of equipment parameters is read, the time-series stamp generation unit is immediately invoked to add a unified time stamp. Then, corresponding security tags are matched according to the equipment type: high-voltage power supply equipment parameters are automatically attached with a Level 1 power supply confidentiality tag; fan and pump main equipment parameters are attached with a Level 2 main equipment control tag; and various end-sensor instrument data are attached with a Level 3 end-sensor instrument tag. Following this, a same-source data frame encapsulation process is executed. The frame header has two fixed fields: a global time stamp and a level 3 security tag. This is followed by the device number, device type, parameter name, real-time value, and checksum payload. After encapsulation, the data is synchronously distributed to the three downstream functional modules, and a copy of the encapsulation record is pushed to the audit module. At the hardware storage level, three disconnected register physical partitions are used. When writing a same-source frame, the security tag field in the frame header is read, and the data is routed to the corresponding partition based on the tag. Read operations can only access the register partition matching the current channel's permissions, thus blocking cross-security-level data reads at the hardware level. A cache pool continuously maintains all same-source frames within the last fifteen minutes. Overdue data is retrieved every minute. Data frames with a time stamp difference exceeding fifteen minutes are directly hardware erased to release register storage space and prevent long-term data accumulation from consuming hardware resources.

[0052] For example, in the complete process of acquiring and encapsulating multi-protocol same-source frames in the time-series data base module, the system synchronously polls the acquisition points of four types of equipment: high-voltage transformer, tunnel main ventilation fan, station drainage pump, and tunnel CO sensor. For the load parameters acquired by the high-voltage transformer using the S7 protocol, the hardware unit automatically generates a global time stamp 20260714153022, attaches a level-one power supply confidentiality tag, encapsulates it into a complete same-source data frame, and stores it in the level-one register partition; the fan frequency parameters acquired by the tunnel main ventilation fan using the Modbus protocol are appended with the same batch of global time stamp 20260714153022, attached with a level-two main equipment control tag, and stored in the level-two register partition; the start / stop status parameters acquired by the station drainage pump using BACnet are synchronously attached with a level-two tag, and the same-source frame is stored in the level-two partition; the concentration values ​​wirelessly transmitted by the tunnel CO sensor are attached with a level-three end-meter tag and stored in the level-three register partition. All frames of the same origin are uniformly stored in a 15-minute sliding buffer pool. When the system reaches 20260714154522, the buffer pool automatically retrieves the batch of data from 20260714153022 whose timestamp difference reaches 15 minutes, performs an expired data erasure operation, and retains only newly acquired frames of the same origin within 15 minutes. The hardware read and write channels of the three types of register partitions are independently isolated. The hardware read bus of the remote operation and maintenance access channel can only connect to the third-level register partition and cannot read the same-origin data frames stored in the first and second-level partitions, thus achieving hierarchical security isolation from the underlying hardware level.

[0053] Optionally, the implementation process of the dynamic permission control module managing three types of access channels, extracting access indicators, running a trust decay algorithm, and executing hierarchical permission downgrades includes:

[0054] Three independent operation and maintenance access channels are defined: local access channel, SCADA access channel, and remote operation and maintenance access channel. Default data reading permissions are preset for each channel: the local access channel can read all data frames of the same source corresponding to all security tags of levels one, two, and three; the SCADA access channel only supports reading data of level two and three security tags, and hardware blocks the data reading link of level one power supply confidential tags; the remote operation and maintenance access channel only allows read-only permissions for level three end-meter tag data.

[0055] Configure a cross-level temporary authorization function with a customizable range of 10 minutes to 60 minutes. When the temporary authorization takes effect, the corresponding level of data reading permission is temporarily released. When the authorization time expires, the temporary reading link is automatically cut off and the default permission configuration of each channel is restored.

[0056] Four types of channel operation data are continuously collected as input access indicators for the trust decay algorithm: channel access frequency data, access data during non-compliant periods, data reading deviation data beyond the scope, and cumulative data of high-risk operation commands.

[0057] The four types of access indicators are incorporated into the mathematical expression of the trust decay algorithm to calculate the channel trust score T in real time. T takes values ​​from 0 to 100, and α, β, γ, and δ are the system's factory-preset fixed penalty coefficients. The mathematical expression for the iterative update of the fixed penalty coefficients is: , , ,in , , These are the four types of penalty coefficients after iterative updates. , , , The original penalty coefficient before iteration. , , , These are the constants for adjusting the coefficients of four types of indicators: access frequency, access during non-compliant periods, out-of-range reading, and high-risk operations. The standard trust score threshold for the channel. The actual trust score is calculated in real time for the channel. This represents the absolute deviation between the standard trust threshold and the actual trust score.

[0058] Three-level permission downgrade rules are set up. When the channel trust score is lower than the preset threshold, the corresponding downgrade operation is executed: After the temporary cross-level authorization channel is downgraded, the first-level tag data reading permission is revoked, and only the second and third-level data read-only is retained; after the SCADA access channel is downgraded, all device control command output functions are turned off, and only the third-level tag data read-only is retained; after the remote operation and maintenance access channel is downgraded, all receiving links of the same source data frames are terminated directly, and all data reading is prohibited.

[0059] The downgraded permission status remains locked, and the channel's initial default permission configuration can only be restored after receiving a dedicated reset command issued manually.

[0060] Every operation involving permission configuration change, trust score calculation, permission downgrade, and abnormal access flag generation synchronously generates a complete log and pushes it to the end-to-end audit module. Figure 2 As shown.

[0061] Specifically, during the system initialization phase, the hardware read / write link permissions for the three access channels are solidified. The local operation terminal hardware bus simultaneously connects to the first, second, and third-level register partitions, the local SCADA monitoring host bus only connects to the second and third-level partitions, and the external remote maintenance terminal hardware link only connects to the third-level register partition, thus locking the basic read range at the hardware level. Maintenance personnel can enter any duration from 10 to 60 minutes in the system configuration interface to enable cross-level temporary authorization. For example, granting a 30-minute temporary read permission for second-level tag data to the remote maintenance channel. The timing unit continuously counts down; the hardware cuts off the second-level partition read bus the moment the countdown reaches zero, automatically restoring the default rule that the remote channel only reads third-level data. The system background collects four types of access indicators in real time: ΔF represents the deviation coefficient of the number of accesses per unit time compared to the regular maintenance frequency; the more frequent the access, the larger the value. ΔT represents the conversion coefficient for accesses during non-compliant periods outside of the early morning and maintenance shutdown periods. ΔD represents the deviation value of the channel's read data exceeding the preset business range. This represents the cumulative conversion coefficient for issuing high-risk operation commands such as equipment shutdown, high-voltage switching, and full-frequency start / stop of wind turbines. The real-time trust score T is obtained by multiplying the four indicators by the preset penalty coefficients and summing the results, then using a base score of 100 as the difference. The system presets three levels of trust thresholds, with each channel corresponding to a specific threshold. When T falls below a threshold, the corresponding degradation logic is triggered: For temporary authorized channels, degradation disconnects the first-level register reading link; for SCADA channels, degradation blocks all control command issuance interfaces, retaining only third-level data viewing; for remote maintenance channels, degradation directly disconnects all data receiving buses, and the terminal returns no data. The degradation state has a latching characteristic; regardless of whether subsequent access indicators return to normal and the trust score recovers, channel permissions will not automatically recover. Maintenance personnel must manually reset the hardware link by issuing a local terminal. Every channel permission change, score refresh, and degradation action records the access terminal number, operation time, indicator value, final trust score, and degradation type, and binds a global time stamp to the audit module for storage.

[0062] For example, in a scenario where the dynamic access control module calculates channel trust scores in real time and triggers access downgrades, a remote maintenance channel is granted a 30-minute temporary authorization with a secondary tag. Maintenance personnel continuously and frequently read pipeline pressure and liquid level data outside of the subway's compliant shutdown period, and simultaneously issue three high-risk emergency pump shutdown commands. The system collects four access indicators in real time, including the access frequency deviation coefficient. F=12, access coefficient during non-compliant periods T=8, out-of-range reading deviation coefficient D=5, cumulative coefficient for high-risk operations The system has a preset penalty coefficient. .

[0063] Substitute into the formula:

[0064]

[0065]

[0066] The remote maintenance channel's trust threshold is preset to 75. Currently, T=71.3 is below the threshold, so the system immediately executes the remote channel degradation logic, directly terminating all same-source data frame reception links. The maintenance terminal page shows no data refresh. The degradation state remains locked. Even if maintenance personnel subsequently cease high-risk operations and access during compliant periods, and the trust score rises to 82, the channel read link remains disconnected until an administrator issues a manual reset command from the local monitoring terminal. Only then does the hardware bus reconnect to the level 3 register partition, restoring the remote channel's basic read-only permissions. This degradation event synchronously generates an audit log, bound to a corresponding global time stamp, fully recording the values ​​of four indicators, penalty coefficients, calculation process, final trust score, and degradation action type, permanently stored in the audit module's read-only register.

[0067] Optionally, the process of the collaborative energy-saving control module reading the buffer pool operating parameters, running the energy-saving weight algorithm, issuing the limit control command, and receiving the fault mark correction weight includes: reading the operating parameters of all professional equipment from the 15-minute sliding buffer pool of the time-series data base. The parameter list includes power supply load parameters, three-phase imbalance parameters, main equipment temperature parameters, tunnel gas concentration parameters, station environment temperature difference parameters, equipment real-time energy consumption parameters, water tank level fluctuation parameters, pipeline water pressure parameters, and platform passenger flow density parameters.

[0068] Receive the channel trust score T issued by the dynamic access control module, and assign the operating condition baseline energy saving weight. The system has a preset conservative safety weight. The channel trust score T is input into the energy-saving weighting algorithm to calculate the final weight for equipment regulation. , The mathematical expression for the safe and conservative weight iterative update is: ,in For the safety and conservative weights after iterative updates, The original conservative weights before iteration. The step size constant for safety weight adjustment, where N is the total number of samples for weight adjustment within the statistical period. Let be the actual final control weight corresponding to the i-th sample group. The system is preset with standard control target weights. This is the average deviation of all control weights from the standard target weights within the statistical period;

[0069] Based on the final control weight, three types of on-site control commands are output: fan frequency adjustment parameters, water pump start / stop control parameters, and power supply reactive power compensation switching parameters.

[0070] Configure multiple limiting constraints for all output control parameters, including the maximum / minimum operating frequency limit of the fan, the maximum duration of continuous operation of the equipment in a single operation, and the minimum interval between two adjacent control commands.

[0071] Configure high-risk control parameters so that only local access channels with qualified trust scores can call them, and SCADA and remote operation and maintenance channels have no permission to issue high-risk control commands.

[0072] The final weight value is monitored and adjusted in real time. When the weight exceeds the preset energy consumption warning threshold of the system, an energy consumption warning signal is generated and pushed to the fault classification and handling module.

[0073] Receive the equipment fault markers returned by the fault classification and handling module, and adjust the corresponding equipment control weight according to the fault type to reduce the control intensity of the faulty equipment and avoid equipment damage caused by forced energy saving under fault conditions;

[0074] The original parameters for weight calculation, the final control weight, the control command after limiting, the energy consumption early warning judgment, and the fault weight correction record are all pushed to the end-to-end audit module for storage, such as Figure 3 As shown.

[0075] Specifically, the collaborative energy-saving control module continuously reads multi-disciplinary operating condition data synchronized in the cache pool, and dynamically matches benchmark energy-saving weights based on subway operating hours, passenger flow, tunnel air quality, and power supply load. During periods of low passenger volume and low load, the baseline weight value is set too high, prioritizing energy conservation in equipment. During morning and evening rush hours and periods with excessive tunnel gas concentrations, the baseline weight value is lowered to prioritize operational safety. The system incorporates a fixed, conservative safety weight. This represents the minimum control level required for safe equipment operation, unaffected by operating conditions. The final control weight is calculated based on the channel's real-time trust score T: the higher the channel trust score, the lower the control weight. The higher the value, the greater the weight of the operating condition baseline, and the larger the energy-saving adjustment range; the lower the channel trust score, the higher the weight of safety and conservatism, automatically narrowing the control range and reducing operational risks. (Calculation results) Post-mapping generates commands for wind turbine frequency conversion, water pump start / stop, and reactive power compensation switching. All commands undergo multi-layer limiting verification: wind turbine frequency is locked in the 20Hz~50Hz range, prohibiting low-frequency idling and ultra-high-frequency overload; continuous operation of wind turbines and water pumps at any one time must not exceed 4 hours, and automatic shutdown buffering is triggered upon reaching the time limit; the interval between two control commands issued by any device must not be less than 30 seconds to avoid frequent start-stop impact on equipment. For high-risk control parameters such as full-frequency adjustment of wind turbines and large-scale switching of high-voltage reactive power compensation, the backend hardware interface is only open to the local access channel; commands issued through SCADA and remote operation and maintenance channels will be directly intercepted and discarded by the module. The system presets upper and lower warning thresholds for control weights. Exceeding the upper limit threshold indicates excessive energy-saving control and a risk of equipment overload. An energy consumption warning is immediately sent to the fault classification and handling module. When the fault classification and handling module reports a fault flag for the fan, water pump, or power supply equipment, the module automatically reduces the corresponding energy consumption level for that equipment. The numerical values ​​are used to reduce the final control weight, weaken energy-saving operations, and prioritize the stable operation of faulty equipment. Standardized logs are generated for each round of weight calculation, instruction issuance, early warning triggering, and fault weight correction operation, and are uploaded to the audit module with a global time stamp.

[0076] For example, in an operational scenario where the collaborative energy-saving control module dynamically calculates the control weights and issues limit control commands, during the morning peak passenger flow period, the tunnel ventilation fan's baseline energy-saving weight is... The system has a preset conservative weight. The current on-site access channel trust score is T=90. Substituting this into the formula, the result is:

[0077]

[0078] Based on a final control weight of 0.56, the module outputs a 42Hz control command for the wind turbine. A limiting check determines that 42Hz falls within the legal range of 20-50Hz. The equipment has been running continuously for 2 hours, which is less than the 4-hour limit. The interval since the last command was issued is 45 seconds, greater than the minimum interval of 30 seconds. Therefore, the command is successfully sent to the wind turbine control unit. At this point, maintenance personnel attempt to issue a high-risk 50Hz full-frequency control command for the wind turbine via a remote maintenance channel. The module identifies the channel type as a remote maintenance channel, directly intercepts the command, and generates an abnormal operation log, which is then pushed to the audit module. Subsequently, the fault classification and handling module pushes a hardware fault flag for the tunnel wind turbine, and the module adjusts the wind turbine's baseline energy-saving weight. The adjustment is lowered to 0.2, and the final regulatory weight is recalculated.

[0079]

[0080] The control weight was significantly reduced, and the module only output a low-frequency safety control command of 30Hz to reduce the adjustment range of the faulty wind turbine. The entire process of the two weight calculations, command issuance records, high-risk command interception records, and fault weight correction records were all bound to a global time stamp and stored in the end-to-end audit module.

[0081] Optionally, the implementation process of the fault classification and handling module, which verifies data frames from the same source, captures snapshots from the same source, runs a fault confidence discrimination algorithm, distinguishes anomaly types, and performs graded self-healing handling, includes:

[0082] Perform triple verification on each received data frame from the same source: frame check code integrity verification, complete frame length matching verification, and real-time fluctuation of device operating parameters exceeding limits verification.

[0083] If any verification fails during the verification process, the data frame is deemed abnormal. Immediately retrieve the same source data frames from all disciplines (power supply, ventilation, water supply and drainage) under the same global time stamp in the time series data base cache pool, and integrate them to generate a complete time series snapshot.

[0084] Extract the timing distortion coefficient ΔS of the snapshot message and the real-time fluctuation residual of the control weight output by the collaborative energy-saving module. The dynamic permission module channel trust score T is used to calculate the fault confidence level P by substituting the three types of parameters into the formula:

[0085]

[0086] Where P is the fault confidence level, with a value range of 0 to 1; ΔS is the message timing distortion coefficient; The real-time fluctuation residual of the control weight is output by the energy-saving weight algorithm; T is the channel trust score obtained by the trust decay algorithm; X, Y, and Z are the system's preset fault dimension fixed coupling coefficients; and, when ΔS is... When the noise level is below the respective preset low-noise threshold, P is forcibly assigned a value of 0;

[0087] The mathematical expression for the iterative update of the fault coupling coefficient is:

[0088]

[0089]

[0090]

[0091] in, , , The coupling coefficients for the three fault dimensions of temporal distortion, weight fluctuation, and channel risk after iterative updates; These are the original coupling coefficients before iteration; , , These are the constants for adjusting the coupling coefficients corresponding to the temporal distortion, weight fluctuation, and channel risk dimensions, respectively; M is the total number of fault discrimination samples within the statistical period. The fault confidence level is actually calculated for the j-th fault sample. This represents the standard confidence baseline value for the corresponding fault type. This represents the average deviation between the actual confidence level and the standard baseline confidence level of all fault samples within the statistical period.

[0092] Based on the P-value and the combined characteristics of three types of indicators, multiple abnormal states are classified: Synchronous increase in timing distortion coefficients of multiple professional frames from the same source indicates power supply interference; increased timing distortion coefficients of a single device on a single bus indicate equipment hardware abnormality; synchronous increase in timing distortion of all devices with no change in weight fluctuation residuals indicates timing synchronization offset; increased timing distortion of a single bus with no fluctuation in other parameters indicates bus line interference; increased risk coefficients of only the channel with no change in timing distortion and weight residuals indicate human access disturbance.

[0093] The handling of anomalies is divided into two categories: self-healing anomalies and permanent anomalies. For self-healing anomalies, the protocol re-handshake, timing register reset, and acquisition plug-in restart operations are automatically executed. For permanent anomalies, only audible and visual alarms are continuously output, and no automatic control output commands are issued.

[0094] The fault determination results are synchronously sent back to the collaborative energy-saving control module to correct the corresponding equipment control weights;

[0095] All data frame verification records, same-source snapshot storage records, fault confidence calculation parameters, anomaly type determination, and graded handling actions are generated into logs and pushed to the end-to-end audit module.

[0096] Specifically, for each received frame of data from the same source, the fault classification and handling module first reads the frame end checksum and compares it with the standard checksum value. Then, it checks whether the complete byte length from the frame header to the payload matches the preset standard frame length. Finally, it monitors whether the fluctuation range of equipment parameters exceeds the normal operating range of the equipment within a short period. Only if all three checks pass is the data considered valid. If any check fails, it immediately retrieves all frames from the same source—high-voltage power supply, tunnel ventilation fan, station water pump, and terminal instrument—from the sliding buffer pool using the current frame's global timestamp as the search condition. These frames are then packaged into a permanent cache of source snapshots for subsequent fault tracing. The timing distortion coefficient ΔS within the snapshot is extracted to characterize the degree of timing misalignment of data from multiple devices, and the weighted fluctuation residual is used. Characterizing the magnitude of drastic fluctuations in energy consumption control commands. The risk level of the current access channel is represented by a weighted sum of preset coupling coefficients X, Y, and Z to obtain the fault confidence level P. The closer P is to 1, the higher the probability of actual device failure; the closer P is to 0, the higher the probability of human intervention. The system synchronously distinguishes the root cause of anomalies based on the combined changes of the three indicators, avoiding direct judgment of device failure based on fluctuations in a single parameter: if only the channel risk indicator changes, and the timing and weights remain unchanged, it is directly judged as human intervention caused by unauthorized access or high-frequency reading by maintenance personnel, and the device's self-healing operation is not triggered; if the timing distortion of multiple devices' synchronous operation indicates that the overall power supply voltage is unstable, it is judged as power interference; if the timing distortion of a single fan or water pump bus, while the parameters of other devices are stable, it is judged that the device is hardware damaged. For self-healing anomalies such as power supply interference, timing synchronization offset, and bus line interference, the module automatically issues corresponding handling instructions: for communication interruptions, it executes protocol re-handshake; for timing errors, it resets register timestamps; for garbled data, it restarts the corresponding acquisition plugin. For permanent anomalies such as permanent hardware damage, it only pushes platform alarms and on-site audible and visual alarms, without automatically starting or stopping the equipment or adjusting fans and pumps, to prevent secondary damage to the equipment under fault conditions. After fault determination, the module pushes the abnormal equipment number and fault type to the collaborative energy-saving module to lower the control weight. Simultaneously, it fully records the verification results, snapshot timestamp, three operational indicators, coupling coefficient, confidence level, and handling actions, and uploads them to the audit module via a global timestamp.

[0097] For example, in an operational scenario where the fault classification and handling module calculates fault confidence and distinguishes anomaly types, the remote operation and maintenance channel violates regulations by frequently reading data, triggering an anomaly flag in the dynamic permission module. The current snapshot message timing distortion coefficient ΔS = 0.02, and the weight fluctuation residual is adjusted. Channel trust attenuation coefficient The system defaults to coupling coefficients X=0.1, Y=0.2, and Z=0.9. Substituting these values ​​into the formula yields:

[0098]

[0099] Synchronous analysis of the combined characteristics of the indicators: Only the channel risk coefficient increased significantly, while the timing distortion and weight residual values ​​were extremely low. The system determined that this anomaly was due to human access disturbance to the remote maintenance channel, not a fault in the equipment itself. Therefore, the self-healing logic was not activated, and only an access anomaly alarm was pushed. Under another set of operating conditions, the timing distortion coefficient ΔS of the tunnel ventilation fan single bus was 0.8, and the weight fluctuation residual was adjusted. Channel trust attenuation coefficient Substitute into the formula:

[0100]

[0101] The key indicator is a significant increase in single-bus timing distortion, while other parameters of various specialized equipment remain unchanged. This indicates a hardware anomaly in the wind turbine, classified as a permanent anomaly. The module continuously outputs hardware fault alarms, performs no automatic control operations, and simultaneously pushes the wind turbine fault marker to the collaborative energy-saving module to lower the wind turbine control weight. All corresponding snapshots, verification data, calculation parameters, confidence scores, anomaly type determination results, and handling actions for both sets of anomalies are generated into audit logs, bound to a global timing stamp, and stored in a read-only memory register.

[0102] Optionally, the implementation process of the end-to-end audit module, which binds the storage of three types of algorithm parameters—time-series data, hierarchical open logs, and reverse iterative optimization—includes the following: unified reception of full-process operation records pushed by four modules: a time-series data base, a dynamic permission control module, a collaborative energy-saving control module, and a fault-based hierarchical handling module. The time-series data base records include data encapsulation records, cache pool update records, and expired data cleanup records; the dynamic permission control module records include permission configuration records, trust score calculation records, permission downgrade records, and abnormal access marker records; the collaborative energy-saving control module records include weight calculation records, control parameter distribution records, energy consumption threshold determination records, and early warning output records; and the fault-based hierarchical handling module records include data frame verification records, same-source snapshot capture records, fault confidence calculation records, and hierarchical handling action records. Recording; all received operation records are forcibly bound to the global time stamp output by the time-series data base as a unique retrieval index. The log storage hardware adopts a partitioned read-only register architecture, and the registers only support write, retrieval, and read operations. Deletion, overwriting, and tampering of logs are prohibited at the hardware level. Log retrieval permissions are opened in stages according to the real-time updated channel trust score T: local access channels with high trust scores can retrieve complete logs of the entire module; SCADA access channels can only retrieve operation logs related to level 2 and level 3 security tags; remote operation and maintenance channels can only open log retrieval permissions for level 3 end instruments. The long-term stored full-link time-series logs are read periodically to extract historical access indicators, adjust the weight operation effect, and determine the correctness of fault confidence judgment samples. The trust decay algorithm penalty coefficients α, β, γ, and δ are iteratively optimized in reverse to optimize the energy-saving weight algorithm and the safety conservative weight. The coupling coefficients X, Y, and Z of the fault confidence discrimination algorithm are fixed parameters within the three types of algorithms. Each log retrieval and algorithm parameter iteration optimization operation synchronously generates an audit sub-log, which is bound to a global time stamp and stored in a register for permanent retention.

[0103] Specifically, the end-to-end audit module is equipped with four independent log receiving buses, each connecting to one of the four upstream functional modules. It continuously receives real-time operation text logs and numerical calculation logs pushed by each module, with the log content fully reproducing the original parameters, calculation process, and output results of each step of the operation. Before each log entry is written to the register, the corresponding global timestamp of the same source frame is automatically read, and the timestamp is used as the log's primary key for binding. Subsequent operations and maintenance personnel can only retrieve logs using three criteria: timestamp, device number, and channel number; batch deletion of logs is not possible. Hardware storage uses read-only register units. After a log is written, the register storage unit is locked, preventing any terminal or operations and maintenance operation from modifying the log storage content, ensuring the audit logs are tamper-proof and meeting the subway electromechanical monitoring safety audit standards. Log retrieval permissions are linked to the real-time trust score of the channel. Local channels maintain a consistently high trust score, allowing access to complete data from power supply-related classified level 1 tag collection logs, permission downgrade records, and fault-source snapshots. SCADA channels can only view logs related to ventilation and water supply / drainage main equipment, and cannot access original high-voltage power supply collection records. Remote maintenance channels can only retrieve logs from end-point sensors and basic control systems, shielding detailed snapshot data of power supply and main equipment faults. The system automatically performs big data analysis of logs during the subway shutdown period every morning, extracting all sample data from the past 24 hours regarding unauthorized access, energy consumption control overload, false alarms, and missed faults. It calculates the adaptation deviation of trust decay penalty coefficients, energy-saving conservative weights, and fault coupling coefficients, automatically iteratively correcting the fixed parameters within the three types of algorithms to optimize the system's operational accuracy for the next day. Each iteration of algorithm parameter updates generates an independent sub-log, recording the original coefficients before optimization, the coefficients after optimization, and the number of historical log samples used for iteration, synchronously bound to a global time stamp for permanent storage.

[0104] For example, in the scenario where the end-to-end audit module stores logs, performs tiered open retrieval, and iteratively optimizes algorithm parameters, during the shutdown period in the early morning of the same day, the module reads 120,000 end-to-end log samples from the past 24 hours. Statistical analysis reveals that the original penalty coefficient δ=1.0 of the trust decay algorithm is insufficient for penalizing high-risk operations, resulting in multiple instances where control commands were issued in violation of regulations but the trust score did not trigger a downgrade. The system automatically iteratively adjusts δ to 1.3. The fault confidence discrimination coupling coefficient X=0.1 has low sensitivity to timing distortion, leading to multiple instances of low bus fault confidence values ​​causing missed detections. X is adjusted to 0.18. This parameter iteration operation generates an independent audit sub-log, fully recording the original coefficients, optimized coefficients, total number of reference log samples, and iteration trigger timing stamp, and stores them in a read-only register. During daytime operation, the local access channel has a trust score of T=92. Maintenance personnel can retrieve high-voltage power supply level 1 tag collection and encapsulation records, complete logs of permission downgrade, and full data of fan fault snapshots by searching logs. During the same period, the remote maintenance channel has a trust score of T=68. When performing log retrieval operations, the system automatically blocks log entries related to power supply and main equipment. The page only displays the collection records of terminal pressure and liquid level sensors, and it is not possible to view high-voltage equipment and fan pump fault snapshot data, thus fully realizing hierarchical isolation and control of logs.

[0105] Optionally, the pre-implementation steps for multi-protocol synchronous acquisition and global timing unified triggering before system operation include: deploying multiple types of field sensors such as current, voltage, pressure, liquid level, gas, and passenger flow to collect the original operating analog signals of subway electromechanical equipment; configuring a unified hardware master clock to synchronously trigger all sensor analog-to-digital conversion units, multi-protocol acquisition boards, and timing stamp generation units; and setting the hardware sampling frequency to be higher than the fundamental frequency of the subway electromechanical equipment's operating circuit to ensure synchronous alignment of multi-protocol acquired data and eliminate acquisition timing jitter.

[0106] Specifically, corresponding sensing hardware is deployed in the subway high-voltage power supply cabinet, tunnel fans, station water supply and drainage machine rooms, tunnel sections, and platforms. Voltage and current sensors collect electrical parameters of the power supply equipment, wind speed and temperature sensors collect operating conditions of the ventilation equipment, pressure and level transmitters collect data from the water supply and drainage network and water tanks, and CO and passenger flow counting terminals collect passenger flow data from the tunnel and platform environment. The entire system deploys a global hardware master clock, and the clock signal is synchronously connected to all S7, Modbus, BACnet, and LoRa acquisition boards, sensor analog-to-digital conversion modules, and timing stamp generation hardware units. All device analog-to-digital conversion, data reading, and timing stamp attachment actions are triggered synchronously in the same clock cycle, eliminating millisecond-level timing offsets in data collected by devices with different protocols. The hardware sampling frequency is uniformly set to 10kHz, which is much higher than the fundamental frequency of the subway fans and transformers, enabling complete capture of instantaneous load fluctuations and short-term parameter changes, ensuring the timing alignment accuracy of data frames from the same source, and providing a time-consistent and jitter-free raw data foundation for downstream permission calculations, energy-saving control, and fault diagnosis.

[0107] For example, after the system's front-end acquisition hardware is deployed, the global hardware master clock synchronously sends out trigger signals at a frequency of 10kHz. Within the same clock cycle, the S7 acquisition board reads the analog signal of the high-voltage transformer load and completes analog-to-digital conversion, the Modbus board acquires the frequency value of the tunnel fan, the BACnet terminal reads the start / stop status of the drainage pump, the LoRa wireless terminal synchronously receives the tunnel CO concentration data, and the time stamp generation unit synchronously adds the same global time stamp to the four sets of heterogeneous data. All data are time-aligned and uniformly encapsulated into a homogeneous data frame for distribution to downstream modules, ensuring the homogeneity of the time sequence of data from multiple professional devices from the source of acquisition.

[0108] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A multi-protocol, same-source integrated monitoring system for subway ventilation, water supply, drainage, and power supply, characterized in that: The system includes: The timing data base module connects to the communication protocols of power supply, ventilation, and water supply and drainage equipment, collects operating parameters, adds a global timing stamp and a three-level security tag to the operating parameters, encapsulates the operating parameters into homogeneous data frames, sends homogeneous data frames to the dynamic access control module, collaborative energy-saving control module and fault classification and handling module, and sends records to the full-link audit module; The dynamic access control module receives data frames from the same source, manages the access permissions of local access channels, SCADA access channels, and remote operation and maintenance access channels, uses access indicators to run a trust decay algorithm to calculate the channel trust score, reduces the access permission when the trust score is lower than the threshold, sends the access permission information, trust score and abnormal flag to the collaborative energy saving control module and the fault classification and handling module, and sends the record to the full-link audit module. The collaborative energy-saving control module uses permission information, trust score and cache pool parameters to run the energy-saving weight algorithm to calculate the control weight and issue control instructions. When the control weight exceeds the threshold, it issues an energy consumption warning to the fault classification and handling module, adjusts the control weight according to the fault mark, and sends the record to the end-to-end audit module. The fault classification and handling module verifies the same source data frames and abnormal markers and energy consumption warnings, runs the fault confidence judgment algorithm to capture same source snapshots to distinguish between equipment faults and human access disturbances and calculates the fault confidence. Based on the fault confidence, it performs classified handling and sends the fault judgment results to the collaborative energy-saving control module and sends the records to the full-link audit module. The end-to-end auditing module binds global timestamps to store records sent by each module, opens logs in a hierarchical manner according to trust scores, and adjusts the internal parameters of the trust decay algorithm, energy-saving weight algorithm, and fault confidence judgment algorithm in reverse.

2. The integrated monitoring system for subway ventilation, water supply, drainage, and power supply based on multi-protocol co-source acquisition as described in claim 1, characterized in that, The time-series data base module is compatible with S7, Modbus, BACnet, and LoRa communication protocols, which respectively correspond to the access of subway high-voltage power supply equipment, tunnel ventilation equipment, station water supply and drainage equipment, and terminal sensor instruments. The operating parameters collected by the time-series data base module include high-voltage protection parameters, transformer load parameters, fan operating parameters, water pump operating parameters, pipeline pressure parameters, gas concentration parameters, liquid level parameters, and passenger flow parameters. The time-series data base module uniformly configures a globally unique time stamp for all operating parameters and configures a three-level security label. The global time stamp and the three-level security label are synchronously encapsulated in the frame header of the same source data frame. The time-series data base module is configured with a 15-minute time-series aligned sliding buffer pool. The buffer pool stores the same source data frames in time sequence, and the buffer pool clears expired data according to a fixed period. The time-series data base module adopts a hardware register partition isolation mode to complete data reading and writing. The same source data frames corresponding to different security labels are independently stored in different register partitions.

3. The integrated monitoring system for subway ventilation, water supply, drainage, and power supply based on multi-protocol co-source acquisition as described in claim 1, characterized in that, The time-series data base module is configured with a three-level security tag, including a level 1 power supply confidentiality tag, a level 2 main equipment control tag, and a level 3 end-meter tag. The level 1 power supply confidentiality tag corresponds to the operating parameters of the power supply equipment collected by the S7 protocol; the level 2 main equipment control tag corresponds to the operating parameters of the ventilation equipment and water supply and drainage main equipment collected by the Modbus protocol and BACnet protocol; the level 3 end-meter tag corresponds to the operating parameters of the end-sensor instrument collected by the LoRa protocol; the level 3 security tag and the global time stamp are fixed encapsulation fields of the same source data frame.

4. The integrated monitoring system for subway ventilation, water supply, drainage, and power supply based on multi-protocol co-source acquisition as described in claim 1, characterized in that, The dynamic access control module manages access channels including local access channels, SCADA access channels, and remote operation and maintenance access channels. Local access channels are configured to read Level 1, Level 2, and Level 3 security tag data. SCADA access channels are configured to read Level 2 and Level 3 security tag data, but prohibit reading Level 1 security tag data. Remote operation and maintenance access channels are configured to read only Level 3 security tag data. The dynamic access control module supports cross-level temporary authorization configurations ranging from 10 to 60 minutes, reverting to the default channel data reading configuration after the temporary authorization expires. The dynamic access control module stores channel access frequency data, access time period data, data reading range data, and high-risk operation record data—four types of data used as input access indicators for the trust decay algorithm.

5. The integrated monitoring system for subway ventilation, water supply, drainage, and power supply based on multi-protocol co-source acquisition as described in claim 1, characterized in that, The dynamic permission management module's permission reduction includes a three-level degradation configuration: after the temporary cross-level authorization channel is downgraded, the permission to read level 1 security tag data is canceled, while the permission to read level 2 and level 3 security tag data is retained; after the SCADA access channel is downgraded, the permission to output all device control commands is canceled, while the permission to read level 3 security tag data is retained; after the remote operation and maintenance access channel is downgraded, all same-source data frame reception links are terminated, and all data reading behavior is terminated. The privilege downgrade status remains constant until a manual reset instruction is received.

6. The integrated monitoring system for subway ventilation, water supply, drainage, and power supply based on multi-protocol co-source acquisition as described in claim 1, characterized in that, The mathematical expression for the trust decay algorithm configured in the dynamic access control module is: , in, This is the channel trust score, with a value range of 0 to 100. This is the access frequency deviation coefficient. Access coefficient during non-compliant periods. This refers to the deviation coefficient for out-of-range data reading. This is the cumulative coefficient for high-risk operation instructions; , All are dimensionless parameters that have been normalized to the interval [0, 1] after being processed by maximum and minimum normalization; β, γ, and δ are the system's preset fixed penalty coefficients.

7. The integrated monitoring system for subway ventilation, water supply, drainage, and power supply based on multi-protocol co-source acquisition as described in claim 1, characterized in that, The buffer pool parameters read by the collaborative energy-saving control module include power supply load parameters, three-phase imbalance parameters, equipment temperature parameters, tunnel gas concentration parameters, ambient temperature difference parameters, equipment energy consumption parameters, liquid level fluctuation parameters, pipeline water pressure parameters, and passenger flow density parameters. The collaborative energy-saving control module outputs fan frequency adjustment parameters, water pump start-stop control parameters, and reactive power compensation switching parameters based on the control weights calculated by the energy-saving weight algorithm. The collaborative energy-saving control module performs parameter limiting configuration on all output control parameters, including fan frequency upper and lower limit configuration, equipment continuous running time configuration, and control command issuance interval configuration. The high-risk control parameters of the collaborative energy-saving control module are configured to be invoked only through local access channels with high trust scores.

8. The integrated monitoring system for subway ventilation, water supply, drainage, and power supply based on multi-protocol co-source acquisition as described in claim 1, characterized in that, The mathematical expression for the energy-saving weight algorithm configured in the collaborative energy-saving control module is: , in, The final weight is determined by the equipment adjustment. Energy saving weight based on operating condition baseline; Set a preset safety and conservative weight for the system; The channel trust score is obtained by the trust decay algorithm. The system presets a security switching threshold; when the Below When this happens, a forced switch to a conservative weighting is initiated to achieve a cliff-like security protection in the low-trust range.

9. The integrated monitoring system for subway ventilation, water supply, drainage, and power supply based on multi-protocol co-source acquisition as described in claim 1, characterized in that, The fault classification and handling module verifies the same-source data frame checksum, the complete frame length of the same-source data frame, and the fluctuation range of equipment operating parameters. When the fault classification and handling module detects an abnormal state of a data frame, it extracts same-source data frames from power supply equipment, ventilation equipment, and water supply and drainage equipment under the same global time stamp to form a same-source snapshot. The fault classification and handling module classifies equipment fault types and human access disturbance types based on the fault confidence level output by the fault confidence discrimination algorithm. The self-healing abnormal type configured by the fault classification and handling module corresponds to the execution of protocol re-handshake operation, time register reset operation, and acquisition plug restart operation. The permanent abnormal type configured by the fault classification and handling module only outputs an alarm identifier and does not configure automatic control output logic.

10. The integrated monitoring system for subway ventilation, water supply, drainage, and power supply based on multi-protocol co-source acquisition as described in claim 1, characterized in that, The mathematical expression for the fault confidence discrimination algorithm configured in the fault classification and handling module is: , And, when the stated and When both are below their respective preset low-noise thresholds, the Forced assignment of 0; where, The fault confidence level ranges from 0 to 1. This is the message timing distortion coefficient; The real-time fluctuation residual of the control weight is output for the energy-saving weight algorithm; The channel trust score is obtained by the trust decay algorithm. , , A fixed coupling coefficient is preset for the fault dimension of the system.

Images