Large secondary active cockpit operation and maintenance method based on distribution automation system

Abstract

The invention relates to a large secondary active cockpit operation and maintenance method based on a power distribution automation system, and belongs to the field of automatic operation and maintenance of power systems. According to the method, a'hardware-software-terminal-service link 'full-dimension stereoscopic monitoring system is constructed. Specifically, an SNMPv3 protocol and edge calculation are adopted to collect equipment operation data in real time, and a core index calculation formula (such as a distribution network secondary active defect elimination rate and a morning operation application rate) is adopted to realize data quantitative analysis; a four-level alarm mechanism is constructed based on a severity-urgency matrix, and potential faults are pre-warned 72 hours in advance in combination with an LSTM prediction model; a defect closed-loop management and control process is innovated, master station type defect one-key defect elimination and terminal type defect cross-platform linkage are supported, and the defect disposal period is shortened by 60% or above. Meanwhile, the operation and maintenance state is visually presented through a system health index quantitative model (basic score 100-alarm score deduction), data can be seamlessly connected with a cloud platform, and intelligent operation and maintenance support is provided for a novel electric power system.

Description

Technical Field

[0001] This invention belongs to the field of power system automation operation and maintenance, and specifically relates to a large secondary active operation and maintenance cockpit method based on distribution automation system. Background Technology

[0002] With the accelerated construction of power distribution networks, secondary systems are characterized by "numerous equipment, complex links, and scattered data": First, the number of distribution terminals (FTU / TTU) is increasing by an average of 20% annually, making manual inspection difficult to cover; second, the discovery of faults in the main station's hardware and software (servers, switches, core services) relies on manual investigation, with an average response time of over 8 hours; third, there is a lack of unified monitoring for cross-system links (main network, cloud platform, and user acquisition), requiring multiple systems to be involved in locating data loss or interruption; and fourth, existing operation and maintenance methods are mostly "passive response," resulting in delayed defect discovery and increased power outage duration.

[0003] Existing technologies suffer from three major shortcomings: First, they lack a quantitative indicator system; for example, proactive defect elimination rates and morning exercise application rates rely solely on manual statistics, resulting in low accuracy. Second, there is no unified standard for defect identification; for instance, the "number of times exceeding the limit" for frequent terminal online / offline cycles is not clearly defined, leading to significant differences in judgments across different regions. Third, the automation level of closed-loop management is low; work order generation, dispatching, and acceptance require manual intervention, resulting in low efficiency. Therefore, a proactive operation and maintenance method based on "quantitative data collection - intelligent analysis - automatic closed-loop" is urgently needed to address these pain points. Summary of the Invention

[0004] The purpose of this invention is to address the pain points of low operation and maintenance efficiency, difficulty in multi-system coordination, and poor data quality caused by the expansion of power distribution network scale, and to provide a large-scale secondary active operation and maintenance dashboard method based on power distribution automation system.

[0005] To achieve the above objectives, the technical solution of the present invention is: a large-scale secondary active operation and maintenance cockpit method based on power distribution automation system, which constructs a three-dimensional monitoring system of "hardware-software-terminal-business link" to realize the transformation of operation and maintenance from "passive response" to "active prevention".

[0006] Furthermore, real-time equipment operation data is collected, and data quantification analysis is achieved through core indicator calculation formulas; a four-level alarm mechanism is constructed based on the "severity-urgency" matrix, and potential faults are warned 72 hours in advance by combining an LSTM prediction model; a defect closed-loop management process is constructed; at the same time, the operation and maintenance status is presented intuitively through a system health index quantification model.

[0007] Furthermore, the method includes the following steps: S1. Based on the power distribution master station DMS, a "multi-level data acquisition system" is constructed to conduct regular inspections and real-time monitoring of the power distribution secondary terminal equipment, master station hardware and software and external system interaction links to obtain operating status data. S2. Perform quantitative analysis and defect identification on the collected data. Determine equipment defects, data anomalies and link failures by using preset core indicator calculation formulas and thresholds, and generate multi-level alarm information. S3. Automatically generate defect work orders based on alarm levels, and link with the cloud platform to achieve closed-loop management of defects throughout the entire process of "generation-dispatch-handling-acceptance-archiving"; S4. Displays inspection results, alarm information, and system health index through a visual interface, supporting drill-down analysis of indicators and one-click defect elimination.

[0008] Furthermore, in step S1, the cycle of the scheduled inspection can be configured.

[0009] Furthermore, in step S1, the multi-level data acquisition system specifically includes: Hardware layer data collection: Using SNMPv3 protocol and operating system commands, the operating parameters of physical servers, virtualization servers, switches and forward and reverse isolation devices are collected every 30 seconds. The disk space utilization threshold is set as follows: >90% triggers an emergency alarm, 80%-90% triggers a major alarm, and 70%-80% triggers a medium alarm. Terminal layer data collection: According to the DL / T634.5101 / 634.5104 standard protocol, power distribution terminal data is collected at a predetermined time every day, including frequent terminal online / offline status, protection setting consistency, and switch remote control success rate. Among them, in the case of frequent terminal online / offline status, a channel status change count > 15 times yesterday is considered a defect. In the case of protection setting consistency, a deviation from the notification setting > 5% is considered an anomaly. In the case of switch remote control success rate, a remote control failure count / total operation count > 10% is considered a defect. Graphic model layer acquisition: Using graphic model database technology, the graphic model library of the distribution system is self-checked at a predetermined time every day to verify parameter integrity, graphic model consistency, and topology islands. Among them, in parameter integrity, the number of switch terminals ≠ 2 is judged as abnormal. In graphic model consistency, the presence of graphics without models or models without graphics is judged as defective. In topology islands, the proportion of devices not connected to the power supply range > 5% triggers an alarm. Link layer collection: For external links including the main network, cloud platform, and user collection system, a heartbeat message is sent every 5 seconds for the main network, an SFTP file transfer is checked every 30 seconds for the cloud platform, and the integrity of WebService messages is verified every 10 minutes for the user collection system. If there is no response for more than 3 timeouts, it is considered a link failure.

[0010] Further, step S2 specifically includes: (1) Calculation of core indicators: Distribution network secondary active defect elimination rate = number of defects initiated within the period / [number of defects actively inspected by DMS daily + number of defects actively initiated by DMS but not inspected within the period + number of defects manually initiated within the period]; Morning exercise application rate = number of morning exercise switches initiated within the cycle / total number of remote control switches; Remote preset inspection application rate = number of remote preset switches initiated within the cycle / total number of remote three-remote switches; System Health Index = 100 - (Number of Emergency Alarms × 50 + Number of Important Alarms × 10 + Number of Medium Alarms × 2 + Number of General Alarms × 1), with a base score of 100 and a minimum score of 0. (2) Defect classification: Alarms are classified into four levels based on their severity and urgency. Alarm severity includes high risk, medium risk, and low risk, and urgency includes 0.5h response, 4h response, and >4h response. Emergency alerts, i.e., high risk + 0.5h handling: including main station core service interruption, forward and reverse isolation faults; Important alarms, i.e., high risk + 4 hours to handle or medium risk + 0.5 hours to handle: including terminal remote control success rate < 90% and main network data interruption > 10 minutes; Medium-risk alarms, i.e., medium risk + 4 hours of handling or low risk + 0.5 hours of handling: include switch port packet loss rate > 5% and number of inconsistencies in the diagram > 10; General alarms, i.e., low risk + > 4 hours of handling: include server CPU utilization of 70%-80% and terminal software remote signal jitter > 5 times / day.

[0011] Furthermore, step S3 specifically includes: S31. Automatic Work Order Generation: Based on the defect type matching template, main station defects (such as the template error shown in the figure) generate work orders locally in DMS, while terminal defects (such as remote control failure) are synchronized to the cloud platform GOMS. The work order includes a fault description (such as "10kV Yangtze River Line #21-5 switch remote control return failure"), the scope of impact (such as "involving 3 distribution substations and 500 users"), and historical handling cases (such as "similar defects were resolved by reinstalling the fault table in March 2024"). S32. Intelligent Dispatch: Based on the skill tags of maintenance personnel (such as "terminal debugging" and "main site maintenance") and geographical location, a greedy algorithm is used to optimize the dispatch path. The objective function is to minimize (dispatch distance × 0.3 + skill matching degree × 0.7). Skill matching degree ≥ 80% is given priority for dispatch. S33. Automatic Acceptance: After the process is completed, the system automatically verifies the recovery status of the indicators. Hardware defects: Server disk space utilization <80% is considered acceptable upon acceptance. Terminal defects: Acceptance is deemed complete only if the success rate of remote control for switching is restored to 100% and there are no faults after three consecutive operations. Link defects: Acceptance is deemed successful if the main network heartbeat message receives 10 consecutive normal responses. If the acceptance test fails, a rework process will be triggered, and the work order will be reassigned to the original maintenance personnel.

[0012] Furthermore, in step S4, the visualization interface includes: The cockpit homepage displays the system health index (pie chart), 72-hour alarm count (bar chart), core indicators (proactive troubleshooting rate, morning exercise application rate), and module status lights (hardware / software / terminal / link, red = emergency, orange = important, yellow = medium, blue = normal). Second-level details page: Supports drill-down of indicators, including clicking "Morning Exercise Application Rate" to view "Total Number of Morning Exercises for Main Switches", "Successful Number of Communication Switches", and a detailed list of switches (including operation time and executor); clicking "Hardware Alarms" to view real-time CPU / memory curves of abnormal servers (data from the past hour, sampling interval of 1 minute); Report generation: Automatically generates daily reports (8:00 AM daily), weekly reports (9:00 AM every Monday), and monthly reports (10:00 AM on the 1st of each month), including defect statistics (by type / region), defect elimination efficiency (average handling time), and indicator trends (changes in proactive defect elimination rate over the past 30 days), and supports Excel export.

[0013] Furthermore, it also includes step S5, network security protection steps, as follows: S51. The AES-256 encryption algorithm is used to encrypt the transmitted data. Key operations (such as work order deletion and parameter modification) generate blockchain evidence (hash value is uploaded to the consortium blockchain). S52, built-in intrusion detection rules, such as if the same IP attempts to log in more than 10 times within 5 minutes, it is judged as a brute-force attack, triggering IP blocking (24 hours) and sending SMS alert to the security administrator; S53. Conduct security audits regularly (every Sunday at 2:00 AM) and generate audit reports (including login logs, operation logs, and statistics on abnormal behavior), and support integration with cybersecurity platforms.

[0014] The present invention also provides a computer-readable storage medium having stored thereon computer program instructions that can be executed by a processor, wherein when the processor executes the computer program instructions, it can implement the steps of the method described above.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. Real-time monitoring and intelligent early warning of all elements The distribution master station (DMS) enables real-time monitoring of secondary terminals and master station hardware and software. Combined with a multi-level threshold alarm mechanism, it can quickly detect equipment faults and anomalies, and significantly improve the operation and maintenance response speed.

[0016] 2. Intelligent verification of image model data By automatically scanning the graph and model of the allocation system using a graph database, problems such as topological errors and data inconsistencies can be identified, ensuring the quality of basic data and reducing the cost of manual verification.

[0017] 3. Cross-system link monitoring Implement bidirectional heartbeat detection on the data interaction links with external systems to promptly detect anomalies such as link interruption and data loss, ensuring reliable operation of cross-system business collaboration.

[0018] 4. Dynamic network security protection By integrating intrusion detection, data encryption, and blockchain evidence storage technologies, real-time monitoring and auditing of network security information can be achieved, ensuring the safety of power production.

[0019] 5. Intelligent Analysis and Decision Making It supports correlation analysis of device data and alarm information through rule engine and machine learning algorithms, automatically generates handling suggestions, and accelerates fault location and repair.

[0020] 6. Defect closed-loop automation Build a fully automated management and control system to achieve standardized closed-loop management of defects from discovery to handling, reduce manual intervention, and improve operation and maintenance efficiency and quality. Detailed Implementation

[0021] The technical solution of the present invention will now be described in detail.

[0022] This invention provides a method for proactive operation and maintenance (O&M) of a large secondary system based on distribution automation, belonging to the field of power system automation O&M. The method constructs a comprehensive monitoring system encompassing hardware, software, terminals, and business links. Through three major innovations—quantitative formula definition, hierarchical threshold control, and intelligent algorithm linkage—it achieves a transformation from "passive response" to "proactive prevention" in O&M. Specifically, it uses the SNMPv3 protocol and edge computing to collect equipment operation data in real time. Core indicator calculation formulas (such as distribution network secondary proactive defect elimination rate and morning operation application rate) enable quantitative data analysis. A four-level alarm mechanism is constructed based on a "severity-urgency" matrix, combined with an LSTM prediction model to provide 72-hour advance warning of potential faults. An innovative closed-loop defect management process supports one-click defect elimination for master station defects and cross-platform linkage for terminal defects, shortening the defect handling cycle by more than 60%. Simultaneously, the O&M status is intuitively presented through a system health index quantification model (base score 100 - alarm deduction points), and the data can be seamlessly integrated with the provincial company's cloud platform, providing intelligent O&M support for new power systems.

[0023] The following is a detailed implementation process of the present invention.

[0024] This invention discloses a method for active maintenance dashboard for large secondary systems based on power distribution automation systems, comprising the following steps: 1. Multi-level data collection: From "general data collection" to "precise quantification" ① Hardware layer: Real-time data acquisition with configurable parameters For physical servers, CPU utilization, memory usage, and disk space utilization are collected every 30 seconds using the SNMPv3 protocol, with three levels of thresholds set (as shown in Table 1). When an anomaly occurs, it is highlighted and an alarm is triggered. For virtualized servers, virtual machine online rate and host load are collected. For switches, network port traffic (threshold: single port traffic > 100Mbps triggers a medium alarm), port packet loss rate (threshold: > 5% triggers a critical alarm), and heartbeat response time of forward and reverse isolation devices are collected. The running parameters corresponding to the OID are obtained through the snmpwalk command.

[0025] Table 1 Server Hardware Alarm Thresholds ②Terminal layer: Protocol-based timed inspection At 4:00 AM daily, terminal data is collected using the DL / T634.5104 protocol to identify three types of defects: Terminal frequently goes online and offline: The number of channel status changes yesterday was >15 times (statistics from the DMS front-end database "channel change log"); Protection setting deviation: The deviation between the terminal returned setting and the notification setting is >5% (e.g., if the overcurrent I segment setting notification is 10A, but the terminal returns 9.4A, it is considered abnormal). Switch remote control defects: number of remote control failures / total number of operations > 10%, failure types are divided into return-to-calibration defects (no response to remote control return-to-calibration) and execution defects (successful return-to-calibration but failed execution).

[0026] ③Graphic Model Layer: Full-Dimensional Self-Check Formula The image library undergoes a self-check every day at 5 AM. The core formulas are as follows: Parameter integrity pass rate = (number of devices with complete parameters / total number of devices) × 100%. Parameter integrity is defined as "number of switch terminals = 2, voltage level ≠ empty, and corresponding feeder ≠ empty". The consistency rate of the drawing and model is calculated as follows: (Number of devices with consistent drawing and model / Total number of devices) × 100%. The consistency of the drawing and model is defined as "the drawing ID and the model ID are associated and there is no redundancy". Topology islanding rate = (number of topology islanded devices / total number of devices) × 100%. Topology islands are defined as "devices that cannot be reached from the substation busbar".

[0027] ④ Link Layer: Multi-protocol heartbeat monitoring Differentiated monitoring strategies are adopted for different external systems: Main network: Sends a 1-byte heartbeat message (content is "0x01") every 5 seconds. If there is no response for more than 3 timeouts, it is considered a link interruption. GOMS cloud platform: Every 30 seconds, it attempts to upload a 1KB test file (named "test_YYYYMMDDHHMMSS.txt") via SFTP. If the upload fails more than 3 times, it is considered abnormal. The data collection system checks the number of telemetry data entries in the WebService message every 10 minutes. If the deviation from the historical average is greater than 20%, it is considered a data anomaly.

[0028] 2. Intelligent Defect Analysis: From "Qualitative Judgment" to "Quantitative Classification" ① Quantitative calculation of core indicators Distribution network secondary proactive defect elimination rate: reflects the efficiency of proactive defect initiation, and the formula is: Proactive defect elimination rate = Number of defects initiated within the period / [Number of defects proactively inspected by DMS daily + Number of defects proactively initiated by DMS but not inspected within the period + Number of manually initiated defects within the period] Example: In a certain period, DMS actively inspects 50 defects, actively initiates 10 uninspected defects, and manually initiates 20 defects, for a total of 40 defect initiations. Then, the active defect elimination rate = 40 / (50 + 10 + 20) = 50%.

[0029] Morning exercise application rate: Reflects the effectiveness of the morning exercise module application, the formula is: Morning exercise application rate = Number of morning exercise switches initiated within the cycle / Total number of remote control switches System Health Index: Provides a clear overview of the overall operational status; the formula is: Health Index = 100 - (Number of Emergency Alarms × 50 + Number of Important Alarms × 10 + Number of Medium Alarms × 2 + Number of General Alarms × 1) Example: If there is 1 emergency alarm, 2 important alarms, 3 medium alarms, and 4 general alarms at a certain moment, then the health index = 100 - (50×1 + 10×2 + 2×3 + 1×4) = 100 - 70 = 30 points (judged as "poor").

[0030] ② Four-level alarm precise classification Based on the "severity × urgency" matrix (as shown in Table 2), the problem of "ungraded alarms" in existing technologies is addressed, ensuring that key defects are addressed first. Table 2 Alarm Classification Matrix 3. Defect Closed-Loop Management: From "Manual Intervention" to "Automatic Processing" ①Automatic work order generation: Template-based + data-driven Based on a pre-defined template that matches the defect type, no manual input is required. An example is shown below: Main station drawing model defect template: "Defect type: Inconsistent drawing model; Equipment name: 10kV Yangtze River Line #21-5 switch; Defect description: Model exists but no graphic (Model ID: 12345, Graphic ID: empty); Scope of impact: The FA function of this switch cannot be enabled; Handling suggestion: Re-import the graphic file and associate it with the model." Terminal remote control defect template: "Defect type: Remote control execution defect; Equipment name: 10kV distribution room terminal; Defect description: No feedback during remote control execution (Operation time: 2024-05-20 10:30, Operator: Zhang San); Scope of impact: The two transformer substations to which this terminal belongs cannot be remotely operated; Handling suggestion: Check the terminal control circuit or reinstall the remote control parameters."

[0031] ②Automatic acceptance: Index-based verification After the process is completed, the system automatically verifies the recovery status without requiring manual confirmation. Hardware defects: If the server disk space utilization rate drops from 92% to 75% (<80%), the acceptance test is considered passed. Terminal defects: If the switch is successfully operated three times in a row by remote control (100% success rate), it is considered to have passed the acceptance test. Link defect: If the main network heartbeat message responds normally 10 times in a row (response time < 100ms), it is considered to have passed the acceptance test; If the acceptance fails, a rollback process is triggered. For example, if the remote control defect acceptance fails, a new order will be dispatched with the message "Recent failure reason: terminal parameter error".

[0032] 4. Visual Interface: From "Data Computation" to "Interactive Analysis" ① Cockpit Homepage: A Complete View on One Screen The layout uses a combination of a pie chart, bar chart, and status lights to showcase the core elements: System health index (ring chart, red < 40 points, yellow 40-70 points, green > 70 points); 72-hour alarm count (bar chart, color-coded by severity level); Key metrics (proactive defect elimination rate, morning exercise application rate, updated in real time); Module status lights (hardware / software / terminal / link, click to drill down to details).

[0033] ② Second-level details page: drill down to define details Supports three-level drill-down: "Indicator-Equipment-Parameter". Example: Click “Morning Exercise Application Rate” → View “Total Number of Morning Exercises for Main Switches (100) and Successful Number of Interconnection Switches (80)” → Click “List of Failed Switches” → View the operation log of the specific switch (e.g., 10kV Yangtze River Line #21-5 switch) (operation time, reason for failure: no response upon returning to school); Click "Hardware Alarms" → View the list of abnormal servers (e.g., server A) → View the real-time CPU curve (data from the past hour, peak 95%) → View process usage (e.g., the "java.exe" process uses 60% of the CPU).

[0034] 5. System Expansion and Security Protection ①Network security design: The forward and reverse isolation device adopts a dual-end monitoring program. When an anomaly occurs, it prioritizes checking the service online status. After confirming the channel failure, it triggers the security audit log to record the access source and operation trajectory.

[0035] Communication data is transmitted using AES-256 encryption. Critical operations (such as work order deletion and parameter modification) support uploading for evidence storage, meeting the Level 4 requirements of the Information Security Protection Assessment 2.0.

[0036] ② Scalable architecture: It adopts a microservice architecture, supports hot loading of communication protocol plugins for new device types (such as distributed power terminals), and dynamic expansion of hardware resources (servers / storage) to adapt to the needs of power distribution network growth.

[0037] Features of this invention: 1. Comprehensive monitoring system covering all elements of the secondary system: Construct a three-dimensional monitoring network of "hardware equipment + software services + terminal devices + business links" to achieve second-level data collection and real-time monitoring of more than 20 types of equipment such as power distribution master station servers, power distribution terminals (FTU / TTU), and forward and reverse isolation devices, as well as multiple indicators such as CPU utilization, remote control success rate, and pattern consistency.

[0038] An innovative "three-level linkage mechanism for status lights" (such as hardware inspection status lights → server list → specific abnormal indicators) is introduced, enabling rapid positioning from the overall situation to the details of the equipment through the six major modules of the cockpit homepage and the transparent interface design.

[0039] 2. Intelligent defect management drives the transformation to proactive operation and maintenance. Based on a rule engine and machine learning algorithms, it has 150+ built-in defect judgment rules and automatically identifies various defects such as communication interruption, setpoint drift, and topology islands.

[0040] Establish a four-dimensional alarm matrix based on "severity × urgency" to respond to emergency alarms (such as interruption of core services on the main site) within 0.5 hours and handle important alarms (such as frequent online and offline of terminals) within 4 hours, improving efficiency by more than 50% compared to traditional manual response.

[0041] Cross-system closed-loop management improves operational and maintenance collaboration efficiency. Defect work orders are automatically generated and synchronized to the provincial company's cloud platform GOMS. Main station defects (such as model errors) are closed locally, while terminal defects (such as remote control failures) are processed across systems, achieving a process automation coverage rate of 70%.

[0042] The present invention proposes a large-scale secondary active operation and maintenance cockpit method based on the power distribution master station. Practical application shows that the method is correct and effective, realizing real-time monitoring, fault early warning and closed-loop management of power distribution secondary equipment, master station hardware and software and business interaction links, thereby improving the operational stability of the power distribution automation system.

[0043] The present invention also provides a computer-readable storage medium having stored thereon computer program instructions that can be executed by a processor, wherein when the processor executes the computer program instructions, it can implement the steps of the method described above.

[0044] The above are preferred embodiments of the present invention. Any changes made to the technical solution of the present invention that do not exceed the scope of the technical solution of the present invention shall fall within the protection scope of the present invention.

Claims

1. A method for a big secondary active operation and maintenance cockpit based on a power distribution automation system, characterized in that, Build a "hardware-software-terminal-service link" full-dimensional three-dimensional monitoring system to realize the transformation of operation and maintenance from "passive response" to "active prevention".

2. The method of claim 1, wherein, Real-time acquisition of equipment operation data, quantitative analysis of data through core index calculation formula; based on the "severity-urgency" matrix, a four-level alarm mechanism is constructed, combined with the LSTM prediction model to predict potential failures 72 hours in advance; Build a defect closed-loop control process; at the same time, the operation and maintenance state is intuitively presented through the system health index quantitative model.

3. The method of claim 1 or 2, wherein the method is based on a power distribution automation system. The method comprises the following steps: S1, based on the power distribution master station DMS, a "multi-level data acquisition system" is constructed, and the operation state data is obtained by regularly inspecting and real-time monitoring the power distribution secondary terminal equipment, the master station software and hardware and the external system interaction link; S2, quantitative analysis and defect identification are performed on the collected data, and the device defects, data anomalies and link failures are determined through the preset core index calculation formula and threshold value to generate multi-level alarm information; S3, automatically generate defect work orders according to the alarm level, and realize the "generation-dispatch-disposal-acceptance-archiving" full-process defect closed-loop control through the linkage of the cloud platform; S4, through the visual interface, the inspection results, alarm information and system health index are displayed to support index drilling analysis and one-key defect elimination operation.

4. The method of claim 3, wherein the method is based on a power distribution automation system. In step S1, the period of regular inspection can be configured.

5. The method of claim 3, wherein the method is based on a power distribution automation system. In step S1, the multi-level data acquisition system specifically comprises: Hardware layer acquisition: SNMPv3 protocol and operating system commands are used to collect the operating parameters of physical servers, virtual servers, switches and forward and reverse isolation devices every 30 seconds, wherein the threshold value of disk space usage rate is set to: > 90% to trigger an emergency alarm, 80%-90% to trigger an important alarm, and 70%-80% to trigger a medium alarm; Terminal layer acquisition: according to the DL / T634.5101 / 634.5104 standard protocol, the power distribution terminal data is collected at a predetermined time every day, including terminal frequent online and offline, protection setting value consistency, and switch remote control success rate, wherein in the terminal frequent online and offline, if the number of channel state changes yesterday is > 15 times, it is determined as a defect, in the protection setting value consistency, if the deviation of the setting value from the notification is > 5%, it is determined as an anomaly, and in the switch remote control success rate, if the number of remote control failures / total operation times > 10%, it is determined as a defect; Figure module layer acquisition: using figure module database technology, the power distribution system figure module library is self-checked at a predetermined time every day to verify parameter integrity, figure module consistency and topology island, wherein in the parameter integrity, if the number of switch terminals ≠ 2, it is determined as an anomaly, in the figure module consistency, if there is a figure without a model or a model without a figure, it is determined as a defect, and in the topology island, if the proportion of devices not connected to the power supply range > 5%, an alarm is triggered; Link layer acquisition: the external links of the main network, cloud platform and use collection system are collected, for the main network, a heartbeat message is sent every 5 seconds, for the cloud platform, SFTP file transmission is detected every 30 seconds, and for the use collection system, WebService message integrity is verified every 10 minutes, and if the timeout response > 3 times, it is determined as a link failure.

6. The method of claim 3, wherein the method is based on a power distribution automation system. Step S2 specifically comprises: (1) Core index calculation: Distribution network secondary active defect elimination rate = number of defects initiated within the period / [number of defects actively inspected by DMS daily + number of defects actively initiated by DMS but not inspected within the period + number of defects manually initiated within the period]; Morning exercise application rate = number of morning exercise switches initiated within the cycle / total number of remote control switches; Remote preset inspection application rate = number of remote preset switches initiated within the cycle / total number of remote three-remote switches; System Health Index = 100 - (Number of Emergency Alarms × 50 + Number of Important Alarms × 10 + Number of Medium Alarms × 2 + Number of General Alarms × 1), with a base score of 100 and a minimum score of 0. (2) Defect classification: Alarms are classified into four levels based on their severity and urgency. Alarm severity includes high risk, medium risk, and low risk, and urgency includes 0.5h response, 4h response, and >4h response. Emergency alerts, i.e., high risk + 0.5h handling: including main station core service interruption, forward and reverse isolation faults; Important alarms, i.e., high risk + 4 hours to handle or medium risk + 0.5 hours to handle: including terminal remote control success rate < 90% and main network data interruption > 10 minutes; Medium-risk alarms, i.e., medium risk + 4 hours of handling or low risk + 0.5 hours of handling: include switch port packet loss rate > 5% and number of inconsistencies in the diagram > 10; General alarms, i.e., low risk + > 4 hours of handling: include server CPU utilization of 70%-80% and terminal software remote signal jitter > 5 times / day.

7. The method of claim 3, wherein the method is based on a power distribution automation system. Step S3 specifically includes: S31. Automatic work order generation: Based on the defect type matching template, main station defects generate work orders locally in DMS, and terminal defects are synchronized to the cloud platform GOMS. The work order includes fault description, scope of impact and historical handling cases. S32. Intelligent Dispatch: Based on the skill tags and geographical location of maintenance personnel, a greedy algorithm is used to optimize the dispatch path. The objective function is to minimize (dispatch distance × 0.3 + skill matching degree × 0.7). Orders with a skill matching degree ≥ 80% are dispatched first. S33. Automatic Acceptance: After the process is completed, the system automatically verifies the recovery status of the indicators. Hardware defects: Server disk space utilization <80% is considered acceptable upon acceptance. Terminal defects: Acceptance is deemed complete only if the success rate of remote control for switching is restored to 100% and there are no faults after three consecutive operations. Link defects: Acceptance is deemed successful if the main network heartbeat message receives 10 consecutive normal responses. If the acceptance test fails, a rework process will be triggered, and the work order will be reassigned to the original maintenance personnel.

8. The method of claim 3, wherein the method is based on a power distribution automation system. In step S4, the visual interface includes: The cockpit homepage displays the system health index, 72-hour alarm count, core indicators, and module status lights. Second-level details page: Supports drill-down of indicators, including clicking "Morning Exercise Application Rate" to view "Total Number of Morning Exercises for Main Branch Switches" and "Successful Number of Communication Switches" as well as a detailed list of switches; clicking "Hardware Alarms" to view real-time CPU / memory curves for abnormal servers; Report generation: Automatically generates daily, weekly, and monthly reports, including defect statistics, defect elimination efficiency, and indicator trends, and supports Excel export.

9. The method of claim 3, wherein the method is based on a power distribution automation system. It also includes step S5, network security protection steps, as follows: S51. The AES-256 encryption algorithm is used to encrypt the transmitted data, and key operations generate blockchain evidence. S52, built-in intrusion detection rules, including determining brute-force attacks if the same IP attempts to log in more than 10 times within 5 minutes, triggering IP blocking and sending an SMS alert to the security administrator; S53. Conduct regular security audits, generate audit reports, and support integration with cybersecurity platforms.

10. A computer-readable storage medium having stored thereon computer program instructions executable by a processor, wherein when the processor executes the computer program instructions, it is able to implement the steps of the method as described in any one of claims 1-9.

Images