Power multi-agent anomaly analysis method based on soft and hard cooperation

Abstract

This application relates to the field of intelligent monitoring technology for power systems, specifically disclosing a power multi-agent anomaly analysis method based on hardware-software collaboration. It utilizes an independent data processing unit mounted on a power edge terminal to bypass and capture hardware and software operational data in a zero-copy manner, constructing a time-series snapshot matrix. A built-in lightweight clock counter calculates the deviation between the hardware clock fluctuation phase and the word generation frequency phase, achieving extremely low-power anomaly triggering. Deep analysis tasks are offloaded to the edge server, achieving physical isolation between monitoring computing power and business computing power. On the edge server side, a dual-branch twin network is used to decouple hardware and software features. An adaptive gradient mask based on a hardware fault cascade adjacency matrix and graph propagation belief decay is introduced to replace the static uniform mask for counterfactual causal intervention. Finally, root cause identification and differentiated self-healing strategy matching are performed based on the attribution probability matrix and deviation labels, generating a terminal self-healing control command flow.

Description

Technical Field

[0001] This application relates to the field of intelligent monitoring technology for power systems, and more specifically, to a power multi-agent anomaly analysis method based on software and hardware collaboration. Background Technology

[0002] As new power systems advance towards greater intelligence, multi-agent systems driven by large language models are widely deployed in power terminal equipment with limited computing power, such as distribution room ring network boxes and substation edge nodes, undertaking critical tasks such as real-time inspection and decision-making, and load dispatching reasoning. During the process of these agents connecting to the power system and operating collaboratively, transient physical disturbances in the underlying hardware (such as voltage dips and chip overheating causing frequency reduction) and abnormal cognitive logic in the upper layers (such as reasoning illusions and planning failures) often couple and cross-excite each other. If such concurrent hardware and software anomalies cannot be detected and accurately traced at the edge, the security and reliability of the power grid's core control commands will be directly threatened.

[0003] However, existing hardware-software co-processing anomaly analysis schemes typically run complex, two-branch twin networks and other intensive inference models directly on the main computing unit of the edge terminal. The high-frequency data sampling and tensor operations inevitably lead to severe resource contention on the system bus and cache bandwidth compared to the normal inference process of the business intelligence agent. In power edge scenarios where computing power is already limited, this can easily cause system overload, creating a vicious cycle where the monitoring tool itself generates new anomalies. Furthermore, in the causal attribution stage, existing methods generally use static uniform masks to indiscriminately suppress hardware features when performing counterfactual intervention. This fails to identify the directed cascading propagation relationships between various hardware fault dimensions in the power terminal, determined by the power supply topology and computing pipeline. This results in excessive suppression of independent health dimensions, introducing false anomaly signals, and insufficient suppression of the implicit dependency dimensions downstream of the fault source, leaving cascading residual interference. Ultimately, this blurs the boundaries of different root cause categories in the attribution probability matrix, leading to a risk of mismatch in self-healing strategies.

[0004] Therefore, an optimized power multi-agent anomaly analysis scheme based on software and hardware collaboration is desired. Summary of the Invention

[0005] To address the aforementioned technical problems, this application is proposed. Embodiments of this application provide a power multi-agent anomaly analysis method based on hardware-software collaboration, comprising: S1, through an independent data processing unit mounted on the power edge terminal, performs zero-copy capture and clock synchronization stacking of the original operating data on the end side to obtain the end side software and hardware timing snapshot matrix; S2, based on the lightweight beat comparator built into the independent data processing unit, performs deviation measurement and abnormal trigger determination of the hardware clock fluctuation phase and word generation frequency phase of the end-side soft and hard timing snapshot matrix. When the deviation exceeds the dynamic threshold, the end-side soft and hard timing snapshot matrix at the trigger time is sliced ​​into high density and offloaded to the edge server via a dedicated line to obtain soft and hard beat deviation labels and fault transient context slice packages. S3 uses a dual-branch twin network deployed on an edge server to extract hardware and software branch features in parallel from the fault transient context slice package to obtain hardware vulnerability feature vectors and cognitive failure feature vectors. S4, quantify the causal transmission effect of the hardware hidden danger feature vector and the cognitive failure feature vector to obtain the soft and hard causal attribution probability matrix; S5, based on the peak index of the soft and hard causal attribution probability matrix and the urgency level identifier of the soft and hard beat deviation label, defines the boundary of the abnormal root cause and matches a differentiated self-healing strategy to generate the terminal self-healing control command flow.

[0006] Compared with existing technologies, this application proposes a power multi-agent anomaly analysis method based on hardware and software collaboration. It utilizes a data processing unit independent of the main computing unit mounted on the power edge terminal to bypass and capture edge-side hardware and software operation data in a zero-copy manner and construct a time-series snapshot matrix. Then, a built-in lightweight beat comparator calculates only the deviation between the hardware clock fluctuation phase and the word generation frequency phase to achieve extremely low-power anomaly triggering. This offloads the heavy deep analysis task to a computationally powerful edge server via a dedicated line, thereby achieving complete isolation between monitoring computing power and business computing power at the physical infrastructure level, eliminating the crowding out of edge-side inference resources during the monitoring process. On the edge server side, a dual-branch twin network is used to decouple the hardware risks and cognitive failures in the transient slices of faults in parallel. An adaptive gradient masking mechanism based on the hardware fault cascade adjacency matrix and graph propagation belief decay is introduced to replace the static uniform mask to perform counterfactual causal intervention, so that the suppression intensity is precisely targeted and allocated along the causal propagation graph. Finally, the root cause boundary is defined and differentiated self-healing strategy is matched according to the urgency of the causal attribution probability matrix and the deviation label, and the terminal self-healing control command flow is generated. Attached Figure Description

[0007] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0008] Figure 1This is a flowchart of a power multi-agent anomaly analysis method based on hardware-software collaboration according to an embodiment of this application; Figure 2 This is a data flow diagram of a power multi-agent anomaly analysis method based on software-hardware collaboration according to an embodiment of this application; Figure 3 This is a flowchart illustrating a power multi-agent anomaly analysis method based on hardware-software collaboration according to an embodiment of this application. The method involves using an independent data processing unit mounted on a power edge terminal to perform zero-copy capture and clock synchronization stacking of the original operating data on the edge to obtain a hardware-software timing snapshot matrix on the edge. Figure 4 This document describes a method for power multi-agent anomaly analysis based on hardware-software collaboration, according to an embodiment of this application. It describes a lightweight beat comparator built into an independent data processing unit, which quantifies the deviation between the hardware clock fluctuation phase and the word generation frequency phase of the end-side hardware-software time-series snapshot matrix and determines anomaly triggers. Specifically, when the deviation exceeds a dynamic threshold, the end-side hardware-software time-series snapshot matrix at the trigger time is sliced ​​at high density and offloaded to an edge server via a dedicated line, resulting in a flowchart of the hardware-software beat deviation label and fault transient context slice package. Figure 5 This is a flowchart illustrating a hardware vulnerability feature vector and a cognitive failure feature vector from a fault transient context slice package using a dual-branch twin network deployed on an edge server, based on a hardware-hardware collaborative power multi-agent anomaly analysis method according to an embodiment of this application. Figure 6 This is a flowchart illustrating the causal transmission effect quantification of hardware vulnerability feature vectors and cognitive failure feature vectors to obtain a hardware-software causal attribution probability matrix, according to an embodiment of this application for a power multi-agent anomaly analysis method based on hardware-software collaboration. Figure 7 This is a flowchart illustrating a method for analyzing power multi-agent anomalies based on hardware and software collaboration, according to an embodiment of this application. The method involves performing counterfactual mask topology reconstruction based on virtual intervention on hardware vulnerability feature vectors and cognitive failure feature vectors to obtain a counterfactual virtual association weight matrix. Detailed Implementation

[0009] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0010] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0011] While this application makes various references to certain modules of the systems according to embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The modules described are merely illustrative, and different aspects of the systems and methods may use different modules.

[0012] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0013] Existing power multi-agent hardware-software collaborative anomaly analysis schemes deploy complex dual-branch twin networks directly on the main computing unit of the edge terminal. High-frequency sampling and tensor operations severely strain the computing power available for business inference, creating a vicious cycle where the monitoring tool itself generates new anomalies. Furthermore, the use of static uniform masks for counterfactual intervention in the causal attribution stage fails to identify the directed cascading propagation relationships between various hardware fault dimensions, leading to blurred attribution boundaries and mismatched self-healing strategies. Therefore, this application proposes a hardware-software collaborative power multi-agent anomaly analysis method. This method constructs a time-series snapshot matrix by loading an independent data processing unit on the edge to bypass and capture hardware and software operation data in a zero-copy manner. An internal lightweight beat comparator calculates the deviation between the hardware clock fluctuation phase and the word generation frequency phase to determine anomalies. If the deviation exceeds the limit, the fault transient slice is offloaded to the edge server via a dedicated line. On the edge server side, a dual-branch twin network is used to decouple the parallel features of hardware vulnerabilities and cognitive failures. An adaptive gradient mask based on the hardware fault cascade adjacency matrix and graph propagation belief decay is introduced to replace the static uniform mask to perform counterfactual causal intervention, so that the suppression intensity is precisely targeted and allocated along the causal propagation graph. Finally, the root cause boundary is defined and a differentiated self-healing strategy is matched based on the peak index of the attribution probability matrix and the urgency of the deviation label to generate a terminal self-healing control command flow.

[0014] Figure 1 This is a flowchart of a power multi-agent anomaly analysis method based on software and hardware collaboration, according to an embodiment of this application. Figure 2This is a data flow diagram illustrating a power multi-agent anomaly analysis method based on hardware-software collaboration according to an embodiment of this application. Figure 1 and Figure 2 As shown, an embodiment of this application provides a power multi-agent anomaly analysis method based on hardware-software collaboration, comprising: S1, using an independent data processing unit mounted on a power edge terminal to perform zero-copy capture and clock synchronization stacking of the original operating data on the edge side to obtain an edge-side hardware-software time-series snapshot matrix; S2, based on a lightweight beat comparator built into the independent data processing unit, quantifying the deviation between the hardware clock fluctuation phase and the word generation frequency phase of the edge-side hardware-software time-series snapshot matrix and determining anomaly triggers, wherein when the deviation exceeds a dynamic threshold, the edge-side hardware-software time-series snapshot matrix at the trigger time is sliced ​​at high density and offloaded to an edge server via a dedicated line. S3, using a dual-branch twin network deployed on the edge server, parallel feature decoupling extraction of hardware and software branches is performed on the fault transient context slice to obtain hardware vulnerability feature vectors and cognitive failure feature vectors; S4, causal transmission effect quantification is performed on the hardware vulnerability feature vectors and cognitive failure feature vectors to obtain the hardware and software causal attribution probability matrix; S5, based on the peak index of the hardware and software causal attribution probability matrix and the urgency level identifier of the hardware and software beat deviation labels, the abnormal root cause is delineated and a differentiated self-healing strategy is matched to generate the terminal self-healing control command flow.

[0015] Specifically, in step S1, an independent data processing unit mounted on the power edge terminal performs zero-copy capture and clock synchronization stacking of the raw operating data on the edge to obtain an edge-side software and hardware time-series snapshot matrix. It should be noted that, given that the cognitive events of the intelligent agent in the power edge terminal operate on a millisecond to second timescale at the application layer, while the micro-events of the underlying hardware, such as voltage fluctuations and cache misses, operate on a nanosecond timescale, and both are produced by different subsystems of the main computing unit, directly executing monitoring data acquisition in the main computing unit kernel would not only cause bus bandwidth contention and context switching overhead, but also lead to timestamp misalignment in the joint feature matrix during alignment due to the mismatch in timescales of the software and hardware data, making it impossible to accurately reconstruct the concurrent software and hardware state at the moment of the fault. Based on this, the technical solution of this application first uses an independent data processing unit mounted on the power edge terminal to perform zero-copy capture and clock synchronization stacking of the raw operating data on the edge to obtain an edge-side software and hardware time-series snapshot matrix. Through the above processing, it is possible to obtain strictly clock-aligned hardware and software joint feature data without consuming any bus bandwidth and cache resources of the main computing unit, providing a high-fidelity data foundation for subsequent anomaly trigger determination and causal attribution.

[0016] Figure 3This is a flowchart illustrating a power multi-agent anomaly analysis method based on hardware-software collaboration, according to an embodiment of this application. It describes how an independent data processing unit mounted on a power edge terminal performs zero-copy capture and clock synchronization stacking of raw operating data from the edge to obtain an edge-side hardware-software timing snapshot matrix. Figure 3 As shown, step S1 includes: S11, bypassing the main computing unit kernel through an independent data processing unit, performing bypass zero-copy capture of the original running data on the edge side to obtain the underlying hardware state buffer stream and the upper cognitive state buffer stream; S12, based on the set global synchronization time step, performing sliding average downsampling on the underlying hardware state buffer stream and pulse frequency accumulation mapping on the upper cognitive state buffer stream to obtain the clock synchronization hardware feature vector and the clock synchronization cognitive feature vector; S13, within the set observation time sliding window range, performing time-by-time vector concatenation and stacking along the time dimension on the clock synchronization hardware feature vector and the clock synchronization cognitive feature vector to obtain the edge-side soft and hard timing snapshot matrix.

[0017] In step S11, an independent data processing unit bypasses the main computing unit kernel to perform bypass zero-copy capture of the raw runtime data on the edge side to obtain the underlying hardware state buffer stream and the upper-layer cognitive state buffer stream. It should be noted that since the raw runtime data on the edge side is distributed across different address spaces of the main computing unit kernel, reading it one by one through the operating system's interface calls would inevitably introduce context switching overhead and data copying latency between kernel mode and user mode, squeezing the bus bandwidth originally used by the main computing unit for business inference. Therefore, the technical solution of this application first bypasses the main computing unit kernel through an independent data processing unit to perform bypass zero-copy capture of the raw runtime data on the edge side to obtain the underlying hardware state buffer stream and the upper-layer cognitive state buffer stream. The raw runtime data on the edge side includes neural network processor clock frequency data, system power supply voltage probe readings, memory page table data, and agent word generation timestamps. Through the above processing, the data acquisition path is effectively completely separated from the kernel scheduling link of the main computing unit, obtaining complete raw hardware and software state data without triggering any kernel interrupts.

[0018] More specifically, in a particular example of this application, the independent data processing unit obtains the memory base address pointers of the hardware register mapping area and the application layer video memory area in main memory through a remote direct memory access protocol, establishing a direct channel with the physical memory of the main computing unit. Based on this, the independent data processing unit directly reads the neural network processor clock frequency data and system power supply voltage probe readings from the hardware register mapping area in a zero-copy manner, storing the aforementioned hardware-level electrical state samples in its own physically isolated buffer, combining them to generate a low-level hardware state buffer stream. Simultaneously, the independent data processing unit directly reads the memory page table data reflecting the agent's current planning state and the agent's word generation timestamp reflecting the cognitive output rhythm from the application layer video memory area in a zero-copy manner, storing the aforementioned application-level cognitive behavior samples in another isolated buffer of the data processing unit, combining them to generate an upper-level cognitive state buffer stream. These two buffer streams are independently cached within the data processing unit, without interference, providing a separate and complete source of raw data for subsequent clock synchronization and feature alignment.

[0019] In step S12, based on the set global synchronization time step, the underlying hardware state buffer stream is downsampled using a moving average, and the upper-layer cognitive state buffer stream is mapped by pulse frequency accumulation to obtain the clock synchronization hardware feature vector and the clock synchronization cognitive feature vector. It should be noted that since the sampling rate of the underlying hardware state buffer stream is at the microsecond or even nanosecond level, while the upper-layer cognitive state buffer stream exists in the form of discrete pulse events at the millisecond to second time scale, there is an order-of-magnitude difference in their time granularity, making direct time-by-time alignment and joint analysis impossible. Therefore, the technical solution of this application further performs downsampling using a moving average on the underlying hardware state buffer stream and maps the upper-layer cognitive state buffer stream by pulse frequency accumulation based on the set global synchronization time step to obtain the clock synchronization hardware feature vector and the clock synchronization cognitive feature vector. Through the above processing, the heterogeneous time-scale hardware and software data are effectively unified to the same time granularity, eliminating the interference of timestamp misalignment on subsequent joint analysis.

[0020] More specifically, in a concrete example of this application, a global synchronization time step is set as a unified time slot partitioning benchmark. The selection of this step step needs to balance the identifiability of hardware state changes and the integrity of the agent's inference rhythm. For the underlying hardware state buffer stream, all hardware sampling points falling into each time slot are extracted, and their arithmetic mean is calculated as the hardware feature representation of that time slot. The specific calculation method is as follows:

[0021] in, For the first Clock synchronization hardware feature vectors output by each time slot To fall into the first A set of indices of all hardware sampling points within a time slot. The total number of samples in the set. The index in the underlying hardware state buffer stream is The single-sample vector contains the voltage reading and clock frequency value at that moment. Through moving average calculation, transient noise in high-frequency sampling is smoothly suppressed while retaining meaningful trend characteristics such as voltage dips or frequency drops. For the upper-layer cognitive state buffer stream, the frequency counts of memory page table update events and word generation triggers are accumulated within the same time slot, transforming discrete timestamps into continuous frequency feature representations. The specific calculation method is as follows:

[0022] in, For the first Clock synchronization cognitive feature vectors output by each time slot To fall into the first A set of indexes of all cognitive impulse events within a time slot. For the upper cognitive state buffer stream, the events occurring at the index The feature representation of a single pulse event, such as the event weight corresponding to a word generation action or a page table write operation. After the above two parallel processing paths, the underlying hardware state and the upper cognitive state are reduced to the same global synchronization time step granularity, forming clock synchronization hardware feature vectors and clock synchronization cognitive feature vectors that can be corresponding to each time step, providing dimensionally consistent input for subsequent matrix stacking along the time dimension.

[0023] In step S13, within the set observation time window, the clock synchronization hardware feature vector and the clock synchronization cognitive feature vector are concatenated and stacked along the time dimension on a time-by-time basis to obtain the end-side hardware and software time-series snapshot matrix. It should be noted that since the clock synchronization hardware feature vector and the clock synchronization cognitive feature vector are still two independent sequences within each time slot, they have not yet formed a unified data structure that can be directly manipulated for subsequent anomaly detection and causal analysis. Furthermore, a single-time snapshot cannot reflect the state evolution trend and temporal correlation. Based on this, the technical solution of this application further concatenates and stacks the clock synchronization hardware feature vector and the clock synchronization cognitive feature vector on a time-by-time basis within the set observation time window to obtain the end-side hardware and software time-series snapshot matrix. Through the above processing, the dispersed hardware and software features are effectively integrated into a two-dimensional tensor structure containing temporal evolution information, providing a complete spatiotemporal input for the subsequent phase deviation calculation of the beat comparator.

[0024] More specifically, in a concrete example of this application, for each global synchronization time slot, a vector concatenation operation is performed on the clock synchronization hardware feature vector and the clock synchronization cognitive feature vector corresponding to that moment in the spatial dimension to form the joint hardware and software state row vector for that moment. Subsequently, an observation time sliding window covering a single complete inference cycle of the agent is set, and this sliding window includes continuous... Each time slot generates a joint state row vector at each time step within the sliding window, which is then stacked row by row along the temporal sequence dimension to construct a dimension... The two-dimensional time-series feature matrix, i.e., the edge-side hardware and software time-series snapshot matrix, is constructed as follows:

[0025] in, This is the final output of the end-side hardware and software timing snapshot matrix. The number of consecutive time steps included in the observation time window. This is the latest observation time. This represents the clock synchronization hardware feature vector at the corresponding moment. This represents the clock synchronization cognitive feature vector at the corresponding moment. This is a vector concatenation operator. and These represent the dimensions of the hardware features and cognitive features, respectively. Each row of this matrix records the joint state of the hardware and software at a specific moment, and the sequential arrangement between rows preserves the complete trajectory information of the state's evolution over time, enabling the subsequent beat comparator to directly extract the temporal variation patterns of the hardware clock fluctuation phase and the word generation frequency phase from this matrix.

[0026] Specifically, in step S2, based on the lightweight beat comparator built into the independent data processing unit, the deviation between the hardware clock fluctuation phase and the word generation frequency phase of the edge-side soft and hard time-series snapshot matrix is ​​quantified and anomaly trigger determination is performed. When the deviation exceeds the dynamic threshold, the edge-side soft and hard time-series snapshot matrix at the trigger time is sliced ​​at high density and offloaded to the edge server via a dedicated line, resulting in soft and hard beat deviation labels and fault transient context slice packages. It should be noted that, given that the edge-side soft and hard time-series snapshot matrix contains complete joint time-series information of hardware physical state and agent cognitive behavior, uploading the entire matrix to the edge server for analysis would not only cause continuous occupation of communication bandwidth but also fail to meet the real-time requirements of power services for anomaly response. Executing a complete dual-branch twin network on the edge would also crowd out service inference computing power. Therefore, a pre-judgment mechanism with extremely low computing power consumption is needed, which triggers data offloading and deep analysis only when an anomaly actually occurs. Based on this, the technical solution of this application further utilizes a lightweight beat comparator built into the independent data processing unit to quantify the deviation between the hardware clock fluctuation phase and the word generation frequency phase of the edge-side soft and hard timing snapshot matrix and determine the anomaly trigger. When the deviation exceeds a dynamic threshold, the edge-side soft and hard timing snapshot matrix at the trigger time is sliced ​​at high density and offloaded to the edge server via a dedicated line, resulting in soft and hard beat deviation labels and fault transient context slice packets. Through the above processing, rapid screening of edge-side anomalies can be achieved using the single lightweight indicator of phase deviation. Data transmission is only initiated when soft and hard beat out of sync is detected, ensuring both the timeliness of anomaly capture and avoiding the ineffective consumption of communication resources and edge server computing power during anomaly-free periods.

[0027] Figure 4 This document describes a method for power multi-agent anomaly analysis based on hardware-software collaboration, according to an embodiment of this application. It utilizes a lightweight beat comparator built into an independent data processing unit to quantify the deviation between the hardware clock fluctuation phase and the word generation frequency phase of the end-side hardware-software time-series snapshot matrix and determine anomaly triggers. When the deviation exceeds a dynamic threshold, the end-side hardware-software time-series snapshot matrix at the trigger time is sliced ​​at high density and offloaded to an edge server via a dedicated line, resulting in a flowchart of the hardware-software beat deviation label and fault transient context slice package. (See flowchart for details.) Figure 4As shown, step S2 includes: S21, based on a lightweight beat comparator, extracting hardware and software instantaneous phase features from the end-side hardware and software timing snapshot matrix using Hilbert transform to obtain hardware fluctuation instantaneous phase sequence and cognitive generation instantaneous phase sequence; S22, performing deviation quantification aggregation on the hardware fluctuation instantaneous phase sequence and cognitive generation instantaneous phase sequence to obtain hardware and software dynamic timing deviation value; S23, comparing the hardware and software dynamic timing deviation value with a dynamic threshold and mapping it to an urgency level identifier to obtain hardware and software beat deviation label, and unloading high-density slices before and after the trigger moment from the end-side hardware and software timing snapshot matrix when the limit is exceeded to obtain fault transient context slice package.

[0028] In step S21, based on a lightweight beat comparator, the hardware and software time-series snapshot matrix is ​​subjected to Hilbert transform-based instantaneous phase feature extraction to obtain the hardware fluctuation instantaneous phase sequence and the cognitive generation instantaneous phase sequence. It should be noted that since the hardware and cognitive states in the hardware and software time-series snapshot matrix still exist in amplitude form, and the essential criterion for whether the hardware and software beats are out of sync lies in the phase relationship of their oscillation rhythms rather than the magnitude of their amplitudes, directly comparing amplitudes cannot characterize the degree of synchronization or deviation between the two in terms of temporal rhythm. Therefore, the technical solution of this application further uses a lightweight beat comparator to perform Hilbert transform-based instantaneous phase feature extraction on the hardware and software time-series snapshot matrix to obtain the hardware fluctuation instantaneous phase sequence and the cognitive generation instantaneous phase sequence. Through the above processing, the amplitude domain signal is effectively converted into a phase domain representation, providing a feature input that directly reflects the temporal beat relationship for subsequent deviation quantification.

[0029] More specifically, in a concrete example of this application, the lightweight beat comparator first separates the hardware feature component sequence and the cognitive feature component sequence from the spatial dimension of the edge-side hardware and software timing snapshot matrix. The hardware feature component sequence reflects the fluctuation trajectory of the neural network processor clock frequency and supply voltage over time, while the cognitive feature component sequence reflects the changes in the agent's word generation frequency and memory page table access frequency over time. Subsequently, Hilbert transforms are applied to the two feature component sequences to construct corresponding analytic signals. At each observation time point, the arctangent values ​​of the imaginary and real parts of the analytic signal are calculated to obtain the instantaneous phase angle. For the hardware feature component sequence, the instantaneous phase is calculated as follows:

[0030] in, For the first The instantaneous phase value of hardware fluctuation at a given moment. The hardware feature component sequence extracted from the hardware and software timing snapshot matrix at time step amplitude, This is the Hilbert transform operator, used to obtain the imaginary part of the analytic signal corresponding to the real signal. For the cognitive feature component sequence, the instantaneous phase is calculated as follows:

[0031] in, For the first The instantaneous phase value of cognitive generation at each moment. The cognitive feature component sequence extracted from the edge-side soft and hard time-series snapshot matrix at time step The amplitude of the hardware instantaneous phase values ​​at all observation times is arranged in time sequence to form the hardware fluctuation instantaneous phase sequence, and the cognitive instantaneous phase values ​​at all observation times are arranged in time sequence to form the cognitive generation instantaneous phase sequence. In the power edge terminal, when the hardware is operating normally and the agent's inference rhythm is stable, the phase change of the hardware clock cycle and the phase change of the word generation frequency maintain a synchronous locking relationship. However, once physical disturbances such as a voltage dip or chip overheating and frequency reduction occur, the hardware fluctuation instantaneous phase sequence will experience a sudden jump, resulting in a quantifiable phase deviation between it and the cognitive generation instantaneous phase sequence.

[0032] In step S22, the instantaneous phase sequence of hardware fluctuation and the instantaneous phase sequence of cognitive generation are aggregated using deviation metric to obtain the software-hardware dynamic timing deviation value. It should be noted that since the absolute phase values ​​of the instantaneous phase sequences of hardware fluctuation and cognitive generation at each moment are affected by initial conditions and are not directly comparable, and the instantaneous phase difference at a single moment is easily affected by random noise, leading to misjudgment, a scalar metric that can reflect the difference in the rate of change of the two sequences and has time smoothing characteristics is needed. Based on this, the technical solution of this application further aggregates the instantaneous phase sequences of hardware fluctuation and cognitive generation using deviation metric to obtain the software-hardware dynamic timing deviation value. Through the above processing, the degree of timing misalignment between the two phase sequences is effectively compressed into a physically interpretable scalar index, providing a direct numerical basis for subsequent threshold comparison and anomaly trigger determination.

[0033] More specifically, in a concrete example of this application, the temporal gradients are first calculated for the instantaneous phase sequence of hardware fluctuations and the instantaneous phase sequence of cognitive generation, respectively. This involves calculating the phase increment between adjacent moments and converting the phase sequence into an instantaneous frequency sequence. The instantaneous frequency on the hardware side reflects the instantaneous rate of change of the neural network processor clock cycle, while the instantaneous frequency on the cognitive side reflects the instantaneous rate of change of the agent's word generation rhythm. Subsequently, within a set local evaluation time window, the absolute difference between the instantaneous hardware frequency and the instantaneous cognitive frequency is calculated moment by moment. The arithmetic mean of all differences within the window is then taken to obtain the soft-hard dynamic timing deviation value at that moment. The specific calculation method is as follows:

[0034] in, For the first The soft and hard dynamic timing deviation values ​​calculated at each time point To assess the length of the local evaluation time window, For time auxiliary variables within the window, For the instantaneous phase sequence of hardware fluctuations at time... The time gradient is the instantaneous frequency of the hardware. Generate instantaneous phase sequences for cognition at time [time]. The time gradient is the cognitive instantaneous frequency. This formula smooths transient noise through mean calculation within a window, while preserving the cumulative effect of persistent timing deviations such as hardware throttling or cognitive inference stuttering. Under normal operation of the power edge terminal, the hardware clock change rate is consistent with the word generation change rate, and the software-hardware dynamic timing deviation value approaches zero. However, when the power supply voltage drops, causing the processor to forcibly throttle, the hardware instantaneous frequency drops sharply, while the cognitive instantaneous frequency maintains its original request rate due to the inertia of the inference task. The difference between the two accumulates continuously within the window, causing a clear jump in the software-hardware dynamic timing deviation value.

[0035] In step S23, the soft and hard dynamic timing deviation values ​​are compared with dynamic thresholds and mapped to urgency indicators to obtain soft and hard beat deviation labels. When a limit is exceeded, the edge-side soft and hard timing snapshot matrix undergoes high-density slice unloading before and after the trigger moment to obtain a fault transient context slice packet. It should be noted that since the soft and hard dynamic timing deviation values ​​are continuous values, they cannot be directly used as a criterion for abnormal states and a discrete classification basis for subsequent self-healing strategy matching. Furthermore, during normal periods without anomalies, it is still necessary to avoid the continuous occupation of communication bandwidth by invalid data transmission. Based on this, the technical solution of this application further compares the soft and hard dynamic timing deviation values ​​with dynamic thresholds and maps them to urgency indicators to obtain soft and hard beat deviation labels. When a limit is exceeded, the edge-side soft and hard timing snapshot matrix undergoes high-density slice unloading before and after the trigger moment to obtain a fault transient context slice packet. Through the above processing, the discretization and on-demand data unloading of abnormal events are effectively realized, ensuring that data transmission to the edge server is only initiated when beat synchronization failure actually occurs.

[0036] More specifically, in a specific example of this application, the soft and hard dynamic temporal deviation value calculated at each moment is compared with a threshold dynamically updated based on recent deviation sliding window statistics. When the deviation value does not exceed the threshold, it is determined that the current moment is in normal operation, and a label with a value of zero is generated to indicate no abnormality. When the deviation value exceeds the threshold, it is determined that a soft or hard beat synchronization event has occurred, and a corresponding danger level numerical label is assigned according to the magnitude of the deviation value through an urgency mapping function, generating a soft or hard beat deviation label. The specific determination logic is as follows:

[0037] in, For the first The soft and hard beat deviation labels generated at each moment This represents the soft and hard dynamic timing deviation value at that moment. The preset dynamic threshold value is updated in real time according to the mean and standard deviation of the deviation within the observation sliding window, using the formula 𝜃=𝜇+k·𝜎. This is an urgency mapping function responsible for converting out-of-limit deviation values ​​into discrete hazard level indicators. Upon detecting a non-zero value for the soft / hard beat deviation label, indicating an abnormal trigger, a high-dimensional sub-matrix is ​​extracted from the edge-side soft / hard time-series snapshot matrix, tracing forward and backward along the time dimension, using the trigger time as the central timestamp. High-density slice extraction is then performed, specifically as follows:

[0038] in, To obtain the transient high-dimensional submatrix, This is the current hardware and software timing snapshot matrix on the edge side. The central timestamp for the exception trigger. The historical data time offset used to trace back is used to capture early signs of failure. The time offset for future data is used to confirm the scope of the cascading failure. After the segmentation is completed, the transient high-dimensional submatrix is ​​losslessly compressed and encapsulated into a dedicated data packet, which is then directly transmitted to the edge server node through the high-speed physical network interface of the independent data processing unit in an asymmetric computing power offloading manner, forming a fault transient context slice packet, thus completing the data bridge between end-side triggering and edge-side analysis.

[0039] Specifically, in step S3, a dual-branch twin network deployed on an edge server is used to extract hardware and software branches of the fault transient context slice package in parallel to obtain hardware hazard feature vectors and cognitive failure feature vectors. It should be noted that, given that the fault transient context slice package contains mixed coupled information of hardware physical state and agent cognitive state, directly feeding this mixed data into a single network for feature extraction would cause the statistical characteristics of physical signals such as voltage dips and temperature rises at the bottom layer to interfere with the sequence dependency characteristics of cognitive signals such as word generation beat collapse and inference context breakage at the upper layer. This would make it difficult to obtain pure and interpretable feature representations, thus affecting the accurate determination of the root cause direction of anomalies in subsequent causal attribution. Therefore, the technical solution of this application further uses a dual-branch twin network deployed on an edge server to extract hardware and software branches of the fault transient context slice package in parallel to obtain hardware hazard feature vectors and cognitive failure feature vectors. Through the above processing, the hardware vulnerability patterns at the physical level and the agent failure patterns at the cognitive level can be mapped to independent feature spaces, providing semantically clear and mutually uncontaminated dual-channel feature inputs for subsequent counterfactual causal inference.

[0040] Figure 5 This document presents a flowchart illustrating a hardware-software collaborative power multi-agent anomaly analysis method according to an embodiment of this application. It describes how a dual-branch twin network deployed on an edge server performs parallel feature decoupling extraction of hardware and software branches from fault transient context slices to obtain hardware vulnerability feature vectors and cognitive failure feature vectors. Figure 5 As shown, step S3 includes: S31, using the data receiving engine of the edge server, performing deserialization protocol decoding and spatial dimension channel decoupling separation on the fault transient context slice packet to obtain the original hardware transient sub-matrix and the original software transient sub-matrix; S32, performing hardware physical hazard feature extraction based on multi-scale convolution on the original hardware transient sub-matrix to obtain hardware hazard feature vector; S33, performing agent cognitive failure feature extraction based on self-attention on the original software transient sub-matrix to obtain cognitive failure feature vector.

[0041] In step S31, the fault transient context slice packet is deserialized and its spatial dimension channel is decoupled and separated using the data receiving engine of the edge server to obtain the original hardware transient sub-matrix and the original software transient sub-matrix. It should be noted that since the fault transient context slice packet arrives at the edge server as a serialized binary data packet after lossless compression and encapsulation by the end-side data processing unit and dedicated line transmission, it cannot be directly used by the neural network for computation. Furthermore, its internal structure is still a joint tensor structure with mixed hardware and software features, requiring restoration to an operable numerical matrix and separation of the two types of features. Based on this, the technical solution of this application further utilizes the data receiving engine of the edge server to deserialize and separate the fault transient context slice packet to obtain the original hardware transient sub-matrix and the original software transient sub-matrix. Through the above processing, the binary data in the transmission state is effectively restored to an independent numerical matrix in the computation state, providing a clearly structured branch input for the subsequent parallel processing of the two-branch twin network.

[0042] More specifically, in a concrete example of this application, after the edge server's data receiving engine captures the fault transient context slice packet transmitted via the dedicated line, it calls the deserialization algorithm corresponding to the end-side encapsulation protocol to decode it at the protocol layer, removing the transmission header information and verification fields, and restoring the original two-dimensional temporal feature tensor matrix captured at the moment the anomaly was triggered. Subsequently, according to the pre-agreed data structure index mapping table, a channel stripping operation is performed on the restored two-dimensional temporal feature tensor matrix in the spatial dimension. The dimension slice representing the underlying physical state is independently divided into a sub-matrix. Each column of this sub-matrix corresponds to the numerical records of hardware channels such as the neural network processor clock frequency and system power supply voltage at various times before and after the fault transient, forming the original hardware transient sub-matrix. The dimension slice representing the upper-layer intelligent agent application state is independently divided into another sub-matrix. Each column of this sub-matrix corresponds to the numerical records of cognitive channels such as the memory page table access frequency and word generation frequency at various times before and after the fault transient, forming the original software transient sub-matrix. After the above decoding and separation operations, the mixed-state transmission data is transformed into two physically independent transient sub-matrices, which respectively have the conditions to enter the hardware encoder branch and the software encoder branch for dedicated feature extraction.

[0043] In step S32, hardware physical hazard features are extracted from the original hardware transient sub-matrix using multi-scale convolution to obtain a hardware hazard feature vector. It should be noted that since the physical hazard signals contained in the original hardware transient sub-matrix, such as voltage drop edges, clock descent slopes, and temperature rise rates, span different time scales, microsecond-level voltage transient spikes and millisecond-level temperature rise trends require feature extraction capabilities with different receptive field ranges to capture. A single fixed-scale convolution kernel cannot simultaneously cover physical hazard patterns at multiple time granularities. Therefore, the technical solution of this application further extracts hardware physical hazard features from the original hardware transient sub-matrix using multi-scale convolution to obtain a hardware hazard feature vector. Through the above processing, hardware anomaly patterns at multiple time scales are effectively compressed into a unified fixed-length vector expression, providing a compact and comprehensive hardware-side feature input for subsequent causal attribution.

[0044] More specifically, in a concrete example of this application, the original hardware transient submatrix is ​​fed into the hardware encoder branch of a two-branch Siamese network, which employs a multi-layer one-dimensional temporal convolutional network structure. Multiple sets of one-dimensional convolutional kernels of different sizes are set in the convolutional layers. Smaller kernels are used to capture fast physical events with short time spans, such as transient voltage drops and clock frequency mutations, while larger kernels are used to capture slower physical trends with longer time spans, such as sustained temperature rises and gradual voltage drops. A nonlinear activation function is applied after each convolutional operation to introduce nonlinear expressive power, and batch normalization is used to stabilize the numerical distribution of the outputs of each layer. After progressive abstraction through multiple convolutions, a global average pooling operation is applied to the feature map of the last layer's output, folding the distributed feature information in the temporal dimension into a fixed-length one-dimensional dense vector, i.e., the hardware hazard feature vector. This vector condenses the physical hazard feature patterns in the original hardware transient submatrix across all time scales before and after fault triggering, with each dimension encoding the activation intensity information of different types of hardware anomalies.

[0045] In step S33, the original software transient sub-matrix is ​​subjected to self-attention-based agent cognitive failure feature extraction to obtain a cognitive failure feature vector. It should be noted that, because the agent cognitive failure information recorded in the original software transient sub-matrix has long-distance temporal dependency characteristics—for example, the collapse of word generation rhythm may originate from the accumulation of abnormal memory page table accesses dozens of time steps prior—convolution operations with local receptive fields are difficult to effectively capture such cognitive logic break patterns spanning long time spans. Based on this, the technical solution of this application further performs self-attention-based agent cognitive failure feature extraction on the original software transient sub-matrix to obtain a cognitive failure feature vector. Through the above processing, the global dependencies between any time steps in the cognitive event sequence are effectively captured, and the cognitive failure patterns distributed throughout the entire transient time window are aggregated into a fixed-length vector representation.

[0046] More specifically, in a concrete example of this application, the original software transient submatrix is ​​fed into the software encoder branch of a two-branch Siamese network, which employs an encoder structure based on a self-attention mechanism. First, the features at each time step in the original software transient submatrix are mapped to representations in three projection spaces—the query matrix, the key matrix, and the value matrix—through a linear transformation. Then, the scaled dot product of the query matrix and the transpose of the key matrix is ​​calculated, and after normalization using an exponential function, it is transformed into an attention weight distribution. This distribution is then multiplied by the value matrix to obtain the weighted context feature representation. The specific calculation method is as follows:

[0047] in, The query matrix is ​​obtained by mapping the original software transient submatrix to the query projection weight matrix. The key matrix is ​​obtained after mapping by the key projection weight matrix. This is the value matrix obtained after mapping by the value projection weight matrix. The dimension of the key space vector is used to scale the dot product result to prevent excessively large values ​​from causing gradient saturation. This self-attention operation enables the cognitive state at each time step in the sequence to establish direct information interaction with all other time steps, thereby capturing the causal relationship across multiple time steps between word generation beat collapse and previous memory page table anomalies. After multi-head attention encoding and superimposed residual connections, average pooling is performed on the output temporal feature matrix along the time axis, compressing and aggregating the feature information of each time step into a fixed-length one-dimensional dense vector, i.e., the cognitive failure feature vector. This vector encodes comprehensive representation information of various cognitive failure modes within the transient time window of the failure, such as agent reasoning context breakage, abnormal acceleration or stagnation of word generation.

[0048] Specifically, in step S4, the causal transmission effect of the hardware defect feature vector and the cognitive failure feature vector is quantified to obtain a soft and hard causal attribution probability matrix. It should be noted that although the hardware defect feature vector and the cognitive failure feature vector have encoded abnormal patterns at the physical and cognitive levels respectively, the statistical correlation between them is not equivalent to causality. When hardware temperature rise and abnormal agent inference output are detected simultaneously, it is impossible to determine solely based on the co-occurrence of feature vector values ​​whether hardware overheating caused floating-point operation truncation leading to inference errors, or whether the infinite loop operation caused by the agent's own logical defects led to chip temperature rise. In the power industry, if the causal attribution direction is reversed, completely opposite self-healing measures will be taken, resulting in ineffective intervention or even exacerbating the fault. Based on this, the technical solution of this application further quantifies the causal transmission effect of the hardware defect feature vector and the cognitive failure feature vector to obtain a soft and hard causal attribution probability matrix. Through the above processing, the unidirectional causal transmission effect of hardware physical disturbances to cognitive failure of intelligent agents can be strictly quantified at the mathematical level through counterfactual inference. The probability boundaries of the three types of root causes—pure physical anomalies, hardware-induced hallucinations, and pure software logic errors—are clearly defined, providing a reliable decision-making basis for the accurate matching of subsequent differentiated self-healing strategies.

[0049] Figure 6 This is a flowchart illustrating the causal transmission effect quantification of hardware defect feature vectors and cognitive failure feature vectors to obtain a hardware-software causal attribution probability matrix, according to an embodiment of this application's power multi-agent anomaly analysis method based on hardware-software collaboration. Figure 6 As shown, step S4 includes: S41, calculating the baseline soft-hard correlation weight matrix between the hardware defect feature vector and the cognitive failure feature vector; S42, performing counterfactual mask topology reconstruction based on virtual intervention on the hardware defect feature vector and the cognitive failure feature vector to obtain the counterfactual virtual correlation weight matrix; S43, performing causal transmission effect quantification and probability space mapping on the baseline soft-hard correlation weight matrix and the counterfactual virtual correlation weight matrix to obtain the soft-hard causal attribution probability matrix.

[0050] In step S41, a baseline soft-hard correlation weight matrix is ​​calculated between the hardware defect feature vector and the cognitive failure feature vector. It should be noted that since subsequent counterfactual causal inference requires comparing the impact of hardware features on cognitive features under actual observation and virtual intervention conditions, a baseline correlation between the two under actual observation conditions must first be established as a reference. Based on this, the technical solution of this application further calculates the baseline soft-hard correlation weight matrix between the hardware defect feature vector and the cognitive failure feature vector. Through the above processing, the actual impact weight distribution of the hardware physical state on the agent's cognitive state under real failure scenarios is effectively obtained, providing a baseline for subsequent counterfactual comparison.

[0051] More specifically, in a concrete example of this application, the hardware vulnerability feature vector is mapped to a query matrix through linear projection weights in the cross-layer attention query space, and the cognitive failure feature vector is mapped to a key matrix through linear projection weights in the cross-layer attention key space. Then, the dot product of the query matrix and the transpose of the key matrix is ​​calculated, scaled by the square root of the projection space dimension, and transformed into a probabilistic attention weight distribution using a normalized exponential function to obtain the baseline soft-hard correlation weight matrix. The specific calculation method is as follows:

[0052] in, The baseline hardware-software correlation weight matrix represents the attentional weights allocated by each hardware vulnerability dimension to each cognitive failure dimension under actual observation conditions. This is a feature vector for hardware vulnerabilities. This is the feature vector of cognitive failure. For the linear projection weights of the cross-layer attention query space, For the linear projection weights of the cross-layer attention key space, This represents the size of the projected spatial dimension. The positions of elements with larger values ​​in this matrix indicate a strong correlation between the corresponding hardware vulnerability dimension and the specific cognitive failure dimension in actual failures. This provides a necessary numerical benchmark for subsequent counterfactual intervention to distinguish whether the correlation is a genuine causal transmission or a spurious correlation.

[0053] In step S42, the hardware defect feature vector and the cognitive failure feature vector are reconstructed using a counterfactual mask topology based on virtual intervention to obtain a counterfactual virtual correlation weight matrix. It should be noted that, given that the baseline soft-hard correlation weight matrix only reflects the statistical correlation strength between hardware defects and cognitive failure under actual observation conditions, and correlation is not equivalent to causation, it is impossible to determine whether the impact of the hardware anomaly dimension on the cognitive failure dimension is a true physical causal transmission or a spurious correlation driven by the same external factor. Therefore, a counterfactual inference framework is needed to construct a parallel control scenario assuming the hardware anomaly never occurred to quantify the true causal effect. Based on this, the technical solution of this application further reconstructs the hardware defect feature vector and the cognitive failure feature vector using a counterfactual mask topology based on virtual intervention to obtain a counterfactual virtual correlation weight matrix. Through the above processing, the cognitive attention distribution state under the virtual premise that the hardware physical disturbance is artificially eliminated can be obtained, forming a comparable causal control group with the baseline soft-hard correlation weight matrix, thus providing a counterfactual reference baseline for subsequently quantifying the true causal transmission effect through the difference between the two.

[0054] Figure 7This is a flowchart illustrating a method for power multi-agent anomaly analysis based on hardware-software collaboration, according to an embodiment of this application, involving the reverse fact mask topology reconstruction of hardware vulnerability feature vectors and cognitive failure feature vectors based on virtual intervention to obtain a reverse fact virtual correlation weight matrix. (See flowchart for example.) Figure 7 As shown, step S42 includes: S421, based on the conditional mutual information estimator, performing pairwise pairwise unidirectional causal dependency strength calculation and directed matrix assembly on each feature dimension of the hardware defect feature vector to obtain the hardware fault cascade adjacency matrix; S422, by locating the dimension with the largest activation amplitude in the hardware defect feature vector as the initial fault source node, performing layer-by-layer graph propagation belief decay quantization on the hardware fault cascade adjacency matrix to generate a cascade perception adaptive mask vector; S423, based on the cascade perception adaptive mask vector, performing antifactual cross-layer attention reconstruction based on adaptive mask on the hardware defect feature vector and the cognitive failure feature vector to obtain the antifactual virtual association weight matrix.

[0055] In step S421, based on the conditional mutual information estimator, the unidirectional causal dependency strength of each feature dimension in the hardware hazard feature vector is calculated by pairwise pairing and a directed matrix is ​​assembled to obtain the hardware fault cascade adjacency matrix. It should be noted that, given that the hardware components within the power edge terminal do not operate independently but form a directed cascade propagation relationship through the power supply topology and computing pipeline, if the aforementioned counterfactual intervention uses a static uniform mask to apply indiscriminate suppression to all dimensions of the hardware hazard feature vector, it will, on the one hand, excessively mask independent healthy dimensions that are causally unrelated to the initial fault, thus introducing false abnormal signals; on the other hand, it will miss the associated suppression of the implicitly dependent dimensions downstream of the initial fault, resulting in an incomplete counterfactual scenario construction. The fundamental reason is that the static mask does not possess prior information about the causal transmission relationship between dimensions. Based on this, the technical solution of this application further uses the conditional mutual information estimator to calculate the unidirectional causal dependency strength of each feature dimension in the hardware hazard feature vector by pairwise pairing and a directed matrix is ​​assembled to obtain the hardware fault cascade adjacency matrix. Through the above processing, the directed causal transmission topology between various hardware fault dimensions can be effectively and explicitly characterized from the data level, providing a structural basis for accurately locating all causal downstreams of a certain initial fault source and implementing differentiated suppression.

[0056] More specifically, in a concrete example of this application, each feature dimension in the hardware vulnerability feature vector is paired up, and a conditional mutual information estimator is used to calculate the unidirectional causal dependency strength score between each pair of dimensions. For any pair of dimensions... and Using all other dimensions as the set of condition variables, evaluate the dimensions. Dimension The one-way information gain is calculated as follows:

[0057] in, For the cascaded adjacency matrix of hardware faults, the first... Line number The element values ​​of the column, and The first and second parts of the hardware vulnerability feature vectors are respectively the first and second parts. and the Each dimension component To remove dimensions and The set of all other dimensions after that, Let be the conditional mutual information estimation function. Assemble the calculation results of all dimension pairs into a complete square matrix to obtain the hardware fault cascade adjacency matrix.

[0058] In the power edge scenario, each non-zero element of this matrix corresponds to a physical cascade propagation edge. Taking a typical voltage drop event as an example, its physical propagation path exhibits a clear chain-like causal structure: the system power supply voltage drop first causes the floating-point arithmetic precision of the neural network processor to be truncated. The precision truncation leads to numerical corruption when intermediate activation values ​​are written to memory. The abnormal memory access then triggers the chip's thermal protection logic, causing the clock frequency to be forcibly reduced. In the hardware fault cascade adjacency matrix, if the element value pointing from the power supply voltage dimension to the clock frequency dimension is large, it indicates that the voltage fluctuation has a strong causal propagation effect on frequency stability through the power supply-computing power physical coupling link, providing a topological foundation for subsequent accurate location of cascaded downstream components. The output of this step allows subsequent counterfactual interventions to no longer treat all hardware feature dimensions equally, but instead establishes a quantitative causal graph reflecting the real physical coupling structure, solving the fundamental information gap of static masks that do not know which components are related to which components.

[0059] In step S422, the dimension with the largest activation amplitude in the hardware defect feature vector is used as the initial fault source node. Layer-by-layer graph propagation belief decay quantization is then performed on the hardware fault cascade adjacency matrix to generate a cascade-aware adaptive mask vector. It should be noted that since the hardware fault cascade adjacency matrix only provides topological information about the causal transmission relationship between dimensions and has not yet been transformed into a numerical tool that can be directly applied to feature suppression operations, and static uniform masks apply equal suppression to all dimensions, they will both forcibly mask independent healthy dimensions that are not causally related to the initial fault, introducing false abnormal signals, and insufficiently suppress implicitly dependent dimensions that numerically exhibit independent fluctuations but are actually downstream products of the initial fault cascade, leaving residual cascade interference. Based on this, the technical solution of this application further uses the dimension with the largest activation amplitude in the hardware defect feature vector as the initial fault source node and performs layer-by-layer graph propagation belief decay quantization on the hardware fault cascade adjacency matrix to generate a cascade-aware adaptive mask vector. Through the above processing, the suppression intensity is effectively adjusted in a gradient manner according to the causal transmission distance between each dimension and the initial fault source, eliminating the two types of biases caused by static uniform mask: over-suppression and under-suppression.

[0060] More specifically, in a concrete example of this application, the dimension index with the largest activation amplitude is first located from the hardware vulnerability feature vector as the initial fault source node. In the power edge scenario, this node corresponds to the root physical event that triggered the anomaly. Subsequently, on the hardware fault cascade adjacency matrix, a layer-by-layer graph propagation belief decay operation is performed starting from this source node. The specific calculation method is as follows:

[0061] in, For the cascaded sensing adaptive mask vector, the first... One element, The index of the dimension with the largest activation amplitude in the hardware defect feature vector is the initial fault source node. To start from the source node on the hardware fault cascaded adjacency matrix To dimension The weighted shortest path distance in the graph is used; if two nodes are unreachable, the distance is set to positive infinity to make the mask value approach 1. This is a regularization hyperparameter used to control the rate at which the suppression intensity decays with causal distance.

[0062] It should be noted that when the dimension When the source node is itself, the graph path distance is zero, the exponent term is 1, and the mask value is 0, indicating complete suppression; when the dimension is zero... When the path distance is short and the mask value is close to zero, it indicates strong suppression; when the dimension is... When the path distance is increased for indirect downstream connections, the mask value becomes an intermediate value, indicating partial suppression; when the dimension... When there is no connected path between the source node and the source node on the graph, the distance is positive infinity, and the mask value is 1, meaning it is completely preserved. This gradient structure accurately reproduces the physical conduction attenuation law that the closer the cascaded downstream is to the initial physical fault, the greater the impact; the farther away, the smaller the impact; and if it is irrelevant, there is no impact. This fundamentally eliminates the two types of biases caused by static uniform masks: over-suppression and under-suppression.

[0063] Taking a voltage drop event as an example, the initial fault source node is located in the power supply voltage dimension. This dimension is directly connected to the computing power decline dimension in the hardware fault cascade adjacency matrix, and the path distance is relatively short. Therefore, the mask value of the computing power decline dimension is close to zero, applying strong suppression. The temperature rise dimension caused by computing power overload is an indirect downstream dimension with a larger path distance, and the mask value is an intermediate value, applying partial suppression. The communication state dimension of the data processing unit powered by an independent power supply is unreachable from the power supply voltage dimension in the graph, and the mask value is 1, allowing it to be completely preserved. The resulting cascaded perception adaptive mask vector accurately reflects the causal dependence of each dimension relative to the initial fault source, providing a gradient intervention tool for subsequent counterfactual cross-layer attention reconstruction.

[0064] In step S423, based on the cascaded sensing adaptive mask vector, the hardware defect feature vector and the cognitive failure feature vector are reconstructed using a counterfactual cross-layer attention method based on the adaptive mask to obtain a counterfactual virtual correlation weight matrix. It should be noted that, given that the cascaded sensing adaptive mask vector has encoded the causal propagation distance between each dimension and the initial fault source as gradient-based numerical weights, it needs to replace the original static mask in the counterfactual attention reconstruction operation to construct a virtual cognitive state that strictly follows the principle of precise intervention based on a single initial fault source and its causal closure. The original static mask, however, can only answer the overly extreme and physically unrealistic assumption that all hardware dimensions disappear simultaneously. Therefore, the technical solution of this application further reconstructs the hardware defect feature vector and the cognitive failure feature vector using a counterfactual cross-layer attention method based on the cascaded sensing adaptive mask vector to obtain a counterfactual virtual correlation weight matrix. Through the above processing, the counterfactual intervention process is effectively upgraded from the original indiscriminate uniform masking to precise targeted suppression along the causal propagation graph, ensuring that the subsequent calculation of the causal attribution probability matrix is ​​based on physical consistency.

[0065] More specifically, in a concrete example of this application, the cascaded sensing adaptive mask vector and the hardware defect feature vector are multiplied element-wise by a Hadamard product. Differential gradient suppression determined by causal propagation distance is applied to each dimension to generate a virtual hardware query source vector under cascaded causal sensing conditions. This virtual query source vector is then mapped to a query matrix through a linear transformation, and a scaled dot product and normalized exponent operation are performed with the key matrix mapped to the cognitive failure feature vector. The specific calculation method is as follows:

[0066] in, For counterfactual virtual correlation weight matrix, This is a feature vector for hardware vulnerabilities. For cascaded sensing adaptive mask vectors The Hadamard product is an element-wise multiplication operation. For the linear projection weights of the cross-layer attention query space, This is the feature vector of cognitive failure. For the linear projection weights of the cross-layer attention key space, This represents the dimension of the projection space.

[0067] In the power edge scenario, the counterfactual virtual correlation weight matrix reconstructed through this step answers the physical question: if the voltage drop had never occurred—along with all subsequent thermal effects, frequency reduction effects, and memory pollution caused by its cascading conduction—what would the agent's cognitive attention distribution look like? Compared to the original static mask, which can only answer the overly extreme and physically unrealistic assumption that all hardware dimensions disappear simultaneously, the improved counterfactual construction strictly adheres to the principle of precise intervention of a single initial fault source and its causal closure, ensuring that the calculation of the subsequent causal attribution probability matrix is ​​based on physical consistency. In the complex operating scenario of multiple concurrent faults at the power edge terminal, the counterfactual virtual correlation weight matrix can realistically restore the ideal cognitive state by removing only the initial physical fault and all its causal consequences, eliminating false abnormal signals introduced by over-suppression and cascading residual interference left by insufficient suppression. As a result, when calculating the causal attribution probability matrix downstream, the probability boundaries between the three types of root causes—pure physical anomalies, hardware-induced hallucinations, and pure software logic errors—are sharper and clearer. This effectively avoids the mismatch problem of self-healing strategies caused by attribution direction deviation, and ensures the accuracy of causal tracing and the reliability of self-healing decisions for power multi-agent systems under uncertain operating environments such as power quality fluctuations and extreme temperature changes.

[0068] In step S43, the baseline soft-hard correlation weight matrix and the counterfactual virtual correlation weight matrix are subjected to causal transmission effect quantification and probability space mapping to obtain the soft-hard causal attribution probability matrix. It should be noted that since the baseline soft-hard correlation weight matrix and the counterfactual virtual correlation weight matrix respectively characterize the distribution of the influence of the hardware physical state on the cognitive state under actual observation conditions and virtual intervention conditions, the difference between the two is the true causal contribution of hardware disturbance to cognitive failure. However, this difference still exists in matrix form and has not yet been transformed into a discrete probabilistic classification result that can be directly used for self-healing strategy matching. Based on this, the technical solution of this application further quantifies the causal transmission effect and performs probability space mapping on the baseline soft-hard correlation weight matrix and the counterfactual virtual correlation weight matrix to obtain the soft-hard causal attribution probability matrix. Through the above processing, the causal effects revealed by the counterfactual comparison are effectively transformed into conditional probability distributions of three root causes: pure physical anomalies, hardware-induced hallucinations, and pure software logic errors, providing a clear classification decision basis for the accurate selection of subsequent self-healing strategies.

[0069] More specifically, in a concrete example of this application, firstly, element-wise matrix subtraction is performed on the baseline soft-hard correlation weight matrix and the counterfactual virtual correlation weight matrix to obtain a difference residual map representing the degree of counterfactual variation. Regions with larger values ​​in this difference residual map indicate a clear change in the impact of the corresponding hardware vulnerability dimension on the cognitive failure dimension before and after counterfactual intervention, meaning that the hardware dimension has a real causal transmission effect on cognitive failure; regions with values ​​close to zero indicate that the correlation between the corresponding dimensions is a spurious correlation, and removing the hardware perturbation did not change the attention distribution of the cognitive state. Subsequently, the Frobenius norm is calculated for this difference residual map, compressing the matrix-level difference information into a scalar value. This scalar directly represents the absolute magnitude of the causal effect of hardware physical perturbation transmitting to cognitive failure. Finally, this causal effect scalar is fed into a fully connected multilayer perceptron for nonlinear dimensional stretching, and the output is mapped to a conditional probability distribution with a sum of 1 using a normalized exponential function to obtain the soft-hard causal attribution probability matrix. The specific calculation method is as follows:

[0070] in, This is a probability matrix for attribution of soft and hard causality, where each element corresponds to the probability of attribution for three types of root causes: purely physical anomalies, hardware-induced hallucinations, and purely software logic errors. As the baseline soft and hard correlation weight matrix, For counterfactual virtual correlation weight matrix, The Frobenius norm is used to measure the total energy of the deviation between two matrices in numerical space. This is used in a multilayer perceptron to perform nonlinear feature space mapping on causal effect scalars and output a logical score equal to the number of attribution categories. The normalized exponential function is used to transform the logical scores into a probability distribution. When the Frobenius norm is large, it indicates that the cognitive attention distribution has been drastically restructured after removing hardware perturbations, and the probability of the hardware-induced hallucination category will dominate; when the norm is small, it indicates that the hardware state change has a limited impact on the cognitive process, and the probability of the pure software logical error category will increase accordingly.

[0071] Specifically, the trainable modules involved in the above scheme need to undergo an offline training phase to determine their parameters before actual deployment. The training set consists of fault transient context slices collected by the power edge terminal during historical operation, covering hardware fault types such as artificially injected voltage sags, chip overheating and frequency reduction, and memory bit flips, as well as software anomaly types such as agent reasoning hallucinations and planning infinite loops. Each sample is labeled by domain experts based on equipment logs and physical inspection reports as one of three root cause labels: pure physical anomaly, hardware-induced hallucination, or pure software logic error, and the severity level of the anomaly is also labeled simultaneously. During training, the hardware encoder and software encoder of the dual-branch Siamese network use supervised cross-entropy loss to drive classification ability learning, while introducing contrastive loss to cluster the feature representations of similar anomaly samples and push away the feature representations of different categories. The total loss function is a weighted sum of cross-entropy loss and contrastive loss. Cross-layer mutual attention projection weights and multilayer perceptrons, as components of the causal attribution path, are jointly trained end-to-end with the dual-branch encoder. Their training objective is to minimize the cross-entropy between the predicted distribution of the soft and hard causal attribution probability matrices and the true root cause labels. The conditional mutual information estimator employs a neural network-based variational mutual information estimation method for independent pre-training. Its training objective is to maximize the lower bound estimate of the conditional mutual information between each pair of dimensions of the hardware vulnerability feature vector. Training stops when the change in the estimate between adjacent training epochs is less than a set convergence threshold. The overall training uses the Adam optimizer, with an initial learning rate set to [value missing]. The weight decay coefficient is set to The batch size is set to 32. Training is terminated when the accuracy of the three root cause classifications on the validation set no longer improves for several consecutive cycles. After the parameters of each module are solidified, they are deployed to the edge server for online inference.

[0072] Specifically, in step S5, based on the peak index of the soft and hard causal attribution probability matrix and the urgency level identifier of the soft and hard beat deviation label, the abnormal root cause is delineated and a differentiated self-healing strategy is matched to generate a terminal self-healing control command flow. It should be noted that since the soft and hard causal attribution probability matrix provides probabilistic classification information of the abnormal root cause but has not yet been transformed into specific executable recovery actions, and different combinations of root cause categories and different urgency levels require completely different self-healing paths, if a purely software-level knowledge base rollback is mistakenly executed for hardware-induced hallucinations, it will not be able to cut off the continuous poisoning of cognition by physical disturbances; conversely, if a hardware-level cross-node migration is mistakenly executed for purely software logic errors, it will cause unnecessary business interruption. Based on this, the technical solution of this application further delineates the boundaries of the abnormal root cause and matches a differentiated self-healing strategy based on the peak index of the soft and hard causal attribution probability matrix and the urgency level identifier of the soft and hard beat deviation label to generate a terminal self-healing control command flow. Through the above processing, a complete closed-loop transformation from causal attribution results to executable instructions at the terminal physical layer is effectively achieved, ensuring that self-healing actions correspond precisely to the root causes of anomalies.

[0073] More specifically, in a concrete example of this application, a maximum value index extraction operation is first performed along the probability distribution dimension of the soft and hard causal attribution probability matrix to obtain the anomaly category index with the highest score. This index identifies whether the anomaly belongs to a purely physical anomaly, a hardware-induced hallucination, or a purely software logic error. Simultaneously, the embedded urgency level numerical label is parsed from the soft and hard beat deviation labels, which reflects the severity of the current soft and hard beat misalignment. The anomaly category index and the urgency level numerical label are concatenated in the feature space to construct the anomaly root cause classification boundary vector. This vector simultaneously encodes the nature and danger level information of the anomaly in a two-dimensional discrete state.

[0074] Subsequently, based on a pre-built self-healing strategy mapping knowledge base, the anomaly root cause classification boundary vector is used as the query key for recovery path key-value lookup and strategy parameter extraction. This knowledge base uses a combination of anomaly category and urgency as the index key, corresponding to the storage of differentiated recovery strategy parameters. For hardware-induced hallucinations, the matched strategy is to perform atomic-level cross-device cognitive context migration at the data processing unit network layer, migrating the agent's inference state to a healthy node to cut off the continuous impact of the abnormal hardware. For pure software logic errors, the matched strategy is to perform agent context rollback and knowledge base re-retrieval, restoring the agent to the most recent normal inference state locally. For pure physical anomalies, the matched strategy is to trigger dynamic frequency reduction or power management adjustments at the hardware level. All control parameters corresponding to the hit strategy paths are extracted and encapsulated into a differentiated self-healing strategy parameter set.

[0075] Finally, based on the constraints of the current edge terminal hardware architecture descriptor, the differentiated self-healing strategy parameter set undergoes low-level instruction cross-compilation and real-time priority queue loading and distribution. The instruction compilation process reads the current power edge terminal's hardware architecture descriptor, converts the abstract strategy parameters into machine code or binary control frames that can be directly recognized by the underlying hardware control bus or operating system kernel, and loads them into the execution queue according to timing priority for formal distribution, generating a terminal self-healing control instruction stream, completing the entire closed-loop process from anomaly detection and causal attribution to self-healing recovery.

[0076] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A power multi-agent anomaly analysis method based on software-hardware collaboration, characterized in that, include: S1, through an independent data processing unit mounted on the power edge terminal, performs zero-copy capture and clock synchronization stacking of the original operating data on the end side to obtain the end side software and hardware timing snapshot matrix; S2, based on the lightweight beat comparator built into the independent data processing unit, performs deviation measurement and abnormal trigger determination of the hardware clock fluctuation phase and word generation frequency phase of the end-side soft and hard timing snapshot matrix. When the deviation exceeds the dynamic threshold, the end-side soft and hard timing snapshot matrix at the trigger time is sliced ​​into high density and offloaded to the edge server via a dedicated line to obtain soft and hard beat deviation labels and fault transient context slice packages. S3 uses a dual-branch twin network deployed on an edge server to extract hardware and software branch features in parallel from the fault transient context slice package to obtain hardware vulnerability feature vectors and cognitive failure feature vectors. S4, quantify the causal transmission effect of the hardware hidden danger feature vector and the cognitive failure feature vector to obtain the soft and hard causal attribution probability matrix; S5, based on the peak index of the soft and hard causal attribution probability matrix and the urgency level identifier of the soft and hard beat deviation label, defines the boundary of the abnormal root cause and matches a differentiated self-healing strategy to generate the terminal self-healing control command flow.

2. The power multi-agent anomaly analysis method based on software-hardware collaboration according to claim 1, characterized in that, The raw operating data on the edge includes neural network processor clock frequency data, system power supply voltage probe readings, memory page table data, and agent lexical generation timestamps.

3. The power multi-agent anomaly analysis method based on software-hardware collaboration according to claim 2, characterized in that, Step S1 includes: By bypassing the main computing unit kernel through an independent data processing unit, the raw running data on the edge side is captured by a bypass zero-copy method to obtain the underlying hardware state buffer stream and the upper cognitive state buffer stream. Based on the set global synchronization time step, the underlying hardware state buffer stream is downsampled by moving average and the upper cognitive state buffer stream is accumulated and mapped by pulse frequency to obtain the clock synchronization hardware feature vector and the clock synchronization cognitive feature vector. Within the set observation time window, the clock synchronization hardware feature vector and the clock synchronization cognitive feature vector are concatenated and stacked along the time dimension on a time-by-time basis to obtain the end-side hardware and software timing snapshot matrix.

4. The power multi-agent anomaly analysis method based on software-hardware collaboration according to claim 1, characterized in that, Step S2 includes: Based on a lightweight beat comparator, soft and hard instantaneous phase features are extracted from the end-side soft and hard timing snapshot matrix using Hilbert transform to obtain the hardware fluctuation instantaneous phase sequence and the cognitive generation instantaneous phase sequence. Deviation quantification aggregation is performed on the instantaneous phase sequence of hardware fluctuations and the instantaneous phase sequence of cognitive generation to obtain the dynamic temporal deviation value of hardware and software. The soft and hard dynamic timing deviation values ​​are compared with the dynamic threshold and mapped to the urgency level identifier to obtain the soft and hard beat deviation label. When the limit is exceeded, the high-density slices before and after the trigger moment of the end-side soft and hard timing snapshot matrix are unloaded to obtain the fault transient context slice package.

5. The power multi-agent anomaly analysis method based on software-hardware collaboration according to claim 1, characterized in that, Step S3 includes: By using the data receiving engine of the edge server, the fault transient context slice packets are deserialized, decoded, and decoupled from the spatial dimension channel to obtain the original hardware transient sub-matrix and the original software transient sub-matrix. Hardware physical hazard features are extracted from the original hardware transient submatrix using multi-scale convolution to obtain hardware hazard feature vectors; The cognitive failure feature vector is obtained by extracting cognitive failure features from the original software transient submatrix based on self-attention.

6. The power multi-agent anomaly analysis method based on software-hardware collaboration according to claim 1, characterized in that, Step S4 includes: Calculate the baseline soft-hard correlation weight matrix between the hardware vulnerability feature vector and the cognitive failure feature vector; The hardware vulnerability feature vector and the cognitive failure feature vector are reconstructed using a counterfactual mask topology based on virtual intervention to obtain a counterfactual virtual correlation weight matrix; Causal transmission effect quantification and probability space mapping are performed on the baseline soft and hard correlation weight matrix and the counterfactual virtual correlation weight matrix to obtain the soft and hard causal attribution probability matrix.

7. The power multi-agent anomaly analysis method based on software-hardware collaboration according to claim 1, characterized in that, Step S5 includes: The maximum index of the soft and hard causal attribution probability matrix is ​​extracted to obtain the anomaly category index, and the urgency level numerical label is parsed from the soft and hard beat deviation label. The two are then concatenated to obtain the anomaly root cause classification boundary vector. Based on a pre-built self-healing strategy mapping knowledge base, a recovery path key-value query and strategy parameter extraction are performed on the abnormal root cause classification boundary vector to obtain a differentiated self-healing strategy parameter set. Based on the constraints of the current edge terminal hardware architecture descriptor, the differential self-healing strategy parameter set is cross-compiled with underlying instructions and loaded and distributed in real-time priority queue to generate the terminal self-healing control instruction stream.

8. The power multi-agent anomaly analysis method based on software-hardware collaboration according to claim 6, characterized in that, The hardware vulnerability feature vector and the cognitive failure feature vector are reconstructed using a counterfactual mask based on virtual intervention to obtain a counterfactual virtual correlation weight matrix, including: Based on the conditional mutual information estimator, the unidirectional causal dependency strength of each feature dimension in the hardware fault feature vector is calculated by pairwise pairing and the directed matrix is ​​assembled to obtain the hardware fault cascade adjacency matrix. By locating the dimension with the largest activation amplitude in the feature vector of hardware hidden dangers as the initial fault source node, layer-by-layer graph propagation belief decay quantization is performed on the hardware fault cascaded adjacency matrix to generate cascaded perception adaptive mask vector. Based on the cascaded sensing adaptive mask vector, the hardware defect feature vector and the cognitive failure feature vector are reconstructed by the counterfactual cross-layer attention based on the adaptive mask to obtain the counterfactual virtual correlation weight matrix.

Images