A power grid dispatching support system fault diagnosis method and device

Abstract

The application discloses a kind of power grid dispatching support system fault diagnosis method and device, method includes: obtaining the operation and maintenance index acquisition data of server, process;At preset fixed time, based on index time series prediction algorithm, the index future prediction data of preset time range is obtained;In combination with operation and maintenance index anomaly detection algorithm, identify system operation failure, generate operation failure information;All operation failure information is summarized, complete operation failure detection, and send operation failure alarm.The application realizes the operation and maintenance index time series prediction technology under the condition of mass model, establishes adaptive and self-learning model construction and optimization architecture, based on index prediction automatically sets dynamic threshold, through the multi-technology fusion analysis based on mass operation and maintenance data, real-time, fast, accurately identify system failure, realize experience type to intelligent analysis type management change, realize system failure accurate perception, guarantee control system safe, reliable and stable operation.

Description

Technical Field

[0001] This invention belongs to the field of power grid control technology, and more specifically, relates to a fault diagnosis method and device for a power grid dispatch support system. Background Technology

[0002] With the accelerated construction of new power systems, the new generation of dispatching technology support system has fully inherited the technological achievements of the D5000 system and undergone a comprehensive upgrade. The new system is characterized by "larger system scale, wider data range, richer application types, and services for tens of thousands of people", which puts forward new requirements for system operation and maintenance.

[0003] Traditional manual and semi-automated operation and maintenance methods require a large amount of experience and knowledge from system operation and maintenance personnel and repetitive "human brain labor," resulting in a large workload and low efficiency. Traditional fault detection algorithms based on expert experience values ​​and fixed thresholds are difficult to balance between false alarms and false negatives. When a system failure occurs, it is difficult to identify the source of the fault from massive operation and maintenance monitoring data. The system operation and maintenance work is intensive and has a low level of intelligence. The system operation and maintenance model faces the situation of "difficult fault discovery, slow problem localization, difficult problem analysis, and slow problem resolution."

[0004] Currently, advanced ICT technologies such as big data and artificial intelligence have been widely applied in the field of system operation and maintenance, which can effectively reduce the workload of manual operations and maintenance and improve work efficiency in traditional operation and maintenance models. However, single-dimensional data analysis creates isolated data silos in operation and maintenance, making it impossible to perceive the overall operating status of the system. Summary of the Invention

[0005] The purpose of this invention is to address the above-mentioned shortcomings by providing a fault diagnosis method for a power grid dispatch support system, as well as a diagnostic device for implementing the method. Based on the multi-technology fusion and multi-dimensional analysis of massive operation and maintenance data, it realizes the transformation from experience-based to intelligent analysis-based management, promotes the transformation from passive anomaly detection to proactive fault prevention, meets the needs of rapid system fault diagnosis, rapid location, rapid response, and rapid resolution, achieves accurate system fault detection, and provides technical support for the safe, reliable, and stable operation of the control system, solving problems such as passive anomaly detection, manual operation and maintenance as the main method, and isolated operation and maintenance data in traditional system operation and maintenance.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solution:

[0007] In a first aspect, the present invention provides a fault diagnosis method for a power grid dispatch support system, comprising the following steps:

[0008] Obtain operational metrics data for servers and processes;

[0009] At a preset fixed time, future prediction data for indicators within a preset time range are obtained based on an indicator time series prediction algorithm;

[0010] By combining anomaly detection algorithms for operation and maintenance indicators, system operation faults are identified and operation fault information is generated.

[0011] Summarize all operational fault information, complete operational fault detection, and send operational fault alarms.

[0012] Optionally, the aforementioned indicator future prediction data for a preset time range obtained based on the indicator time series prediction algorithm includes:

[0013] At a preset fixed time, sample data of operation and maintenance indicators are obtained within a preset time range;

[0014] The operation and maintenance indicator sampling data are classified into curves;

[0015] Based on the curve classification results of the operation and maintenance indicator sampling data, update or retrain the time series prediction model according to the time series prediction algorithm.

[0016] Based on the time-series prediction model, predict the sampling data of operation and maintenance indicators for the next preset time range and save them to the data warehouse.

[0017] Optionally, updating or retraining the time series prediction model based on the time series prediction algorithm includes:

[0018] Obtain the time series prediction model of the indicator obtained from the previous preset time training, and determine whether the curve classification result matches the time series prediction model of the indicator.

[0019] If there is no match or the model does not exist, retrain the time series prediction model according to the time series prediction algorithm and save it.

[0020] If a match is found, the time series prediction model is updated and saved according to the time series prediction algorithm.

[0021] Optionally, between two preset fixed times, an iterative update of the time series prediction model and parameters is performed based on a preset period, the predicted data within the period, and the actual collected data, and the subsequent operation and maintenance indicator sampling data within the preset time range is updated.

[0022] Optionally, the above-mentioned curve classification of the operation and maintenance indicator sampling data includes:

[0023] Determine if there is any missing data exceeding a preset range; if so, it is considered a missing data type.

[0024] Determine if the data is a constant value; if so, it belongs to the constant value type.

[0025] Determine if the maximum value is less than a preset multiple of the median; if so, it belongs to the micro-float type.

[0026] To determine whether the stationarity of the sequence is determined based on the ADF test, if so, the presence of periodicity in the time series data is detected based on the Fourier transform and autocorrelation coefficient: if periodicity exists, the data is periodic; if no periodicity exists, the data is stationary.

[0027] This also includes classifying curves based on daily segmentation of operational and maintenance indicator sampling data:

[0028] Determine if there is any missing data exceeding a preset range in recent days; if so, it is classified as recent missing data.

[0029] Determine whether the data for the past few days is a constant value; if so, it belongs to the recent constant value type.

[0030] Determine whether the maximum value in recent days is less than 1.1 times the median. If so, it belongs to the recent slight fluctuation type.

[0031] Determine whether the sequence has been stationary in recent days based on the ADF test. If so, it belongs to the recent stationary type.

[0032] If none of the above apply, then it is an irregular type.

[0033] Optionally, the above time series prediction algorithms include, but are not limited to, LGB algorithm, LSTM algorithm, and exponential average algorithm; wherein, the LGB algorithm corresponds to the periodic type; the LSTM algorithm corresponds to the irregular type; and the exponential average algorithm corresponds to the missing type, constant type, slightly fluctuating type, stationary type, recent missing type, recent constant type, recent slightly fluctuating type, and recent stationary type.

[0034] Optionally, the above-mentioned anomaly detection algorithm for operation and maintenance indicators includes:

[0035] An algorithm for detecting missing or abnormal operation and maintenance indicator data based on real-time collection;

[0036] An algorithm for detecting slow ramp-up anomalies in operational metrics based on the Mann-Kendall method;

[0037] An algorithm for detecting jumps and sudden changes in operation and maintenance indicators based on multi-algorithm ensemble learning.

[0038] Optionally, the above-mentioned algorithm for detecting slow ramp-up anomalies in operational metrics based on the Mann-Kendall method includes:

[0039] Obtain sampling data of operation and maintenance indicators within a preset time period;

[0040] Using the Mann-Kendall method to examine the trends of operation and maintenance indicator data;

[0041] Repeat the above steps according to the preset detection time window size. If the trend of operation and maintenance indicator data is monotonically increasing within several consecutive time windows, it is determined that there is a slow ramp-up anomaly in the operation and maintenance indicator, and a slow ramp-up operation fault information is generated.

[0042] Optionally, the above-mentioned algorithm for detecting jumps and abrupt changes in operation and maintenance metrics based on multi-algorithm ensemble learning includes:

[0043] Based on the sampling period of operation and maintenance indicators, the sampling data sequence of operation and maintenance indicators is obtained in real time;

[0044] The operation and maintenance indicator sampling data is used to detect outliers based on multiple algorithms. If more than half of the new data are judged to be outliers, then the data may be considered to be outliers, and an indicator jump and sudden change operation fault information is generated.

[0045] The multiple algorithms include, but are not limited to, N-sigma, TukeyTest, and LOF.

[0046] Optionally, the above summarizes all operational fault information, completes operational fault detection, and sends operational fault alarms, including:

[0047] Real-time acquisition of operational fault alarm information, and sending operational fault classification alarms based on multi-threshold alarm classification;

[0048] At a preset fixed time, acquire operational fault alarm information, summarize alarms for multiple indicators, save and send operational fault summary alarms;

[0049] A multi-dimensional alarm analysis algorithm based on correlation coefficients is used to save and send operational fault analysis alarms.

[0050] Optionally, the above multiple thresholds include:

[0051] The baseline threshold is obtained based on multi-algorithm ensemble learning;

[0052] Dynamic thresholds derived from future forecast indicators;

[0053] The red line threshold is derived from expert experience.

[0054] Optionally, the above alarm levels include:

[0055] When the collected indicator value is less than the benchmark threshold, save it as a prompt alarm;

[0056] When the collected index value is greater than the baseline threshold but less than the dynamic threshold, it is saved as a minor alarm.

[0057] When the collected indicator value is greater than the dynamic threshold but less than the red line threshold, save and send an important alarm.

[0058] When the collected indicator value exceeds the red line threshold, save it and send an emergency alarm.

[0059] Optionally, the above multi-dimensional alarm analysis includes:

[0060] (a) Real-time acquisition of operational fault information, and correlation analysis based on historical operational fault information to suppress repetitive alarms of operational indicators and generate alarms for sudden operational anomalies; including:

[0061] Real-time and historical operational fault information data are strongly correlated, suppressing repetitive alarms from operational indicators;

[0062] Real-time and historical operational fault information data are weakly correlated to generate alarms for sudden operational anomalies;

[0063] (b) Based on the correlation analysis of server and process operation failure information, generate process impact chain alarms.

[0064] The correlation coefficients include, but are not limited to, Pearson correlation coefficient, Kendall tau correlation coefficient, and Spearman rho correlation coefficient.

[0065] Secondly, the present invention also provides a fault diagnosis device for a power grid dispatch support system, used to implement the above-mentioned diagnosis method, comprising the following modules:

[0066] The operation and maintenance indicator data acquisition module is used to acquire operation and maintenance indicator data for servers and processes.

[0067] The indicator future prediction data generation module is used to obtain indicator future prediction data within a preset time range based on the indicator time series prediction algorithm according to a preset fixed time.

[0068] The operation and maintenance indicator anomaly detection algorithm module is used to generate operational fault information based on the anomaly detection algorithm;

[0069] The runtime fault alarm generation module is used to summarize all runtime fault information and send runtime fault alarms.

[0070] Optionally, the module for generating future forecast data for the above indicators includes:

[0071] The indicator sampling curve classification submodule is used to classify the collected operation and maintenance indicator data;

[0072] The operation and maintenance metric time series prediction submodule is used to train and update the operation and maintenance metric prediction model and generate metric prediction data based on the model.

[0073] Optionally, the above-mentioned anomaly detection algorithm module for operation and maintenance indicators includes:

[0074] The operation and maintenance indicator missing detection submodule is used to generate indicator missing fault information;

[0075] The Operation and Maintenance Indicator Slow Rise Detection Submodule is used to generate slow rise fault information of indicators based on the Operation and Maintenance Indicator Slow Rise Anomaly Detection Algorithm.

[0076] The Operation and Maintenance Indicator Jump and Abrupt Change Detection Submodule is used to generate indicator jump and abrupt change fault information based on the Operation and Maintenance Indicator Jump and Abrupt Change Anomaly Detection Algorithm.

[0077] Optionally, the above-mentioned operational fault alarm generation module includes:

[0078] The real-time generation submodule for operational fault classification alarms is used to obtain operational fault alarm information in real time, save and send operational fault classification alarms based on multi-threshold alarm classification.

[0079] The operation fault summary alarm generation submodule is used to obtain operation fault alarm information according to a preset fixed time, summarize alarms for multiple indicators, save and send operation fault summary alarms.

[0080] The runtime fault analysis alarm generation submodule is used to obtain runtime fault alarm information, perform multi-dimensional alarm analysis based on correlation coefficients, save and send runtime fault analysis alarms.

[0081] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0082] The fault diagnosis method for power grid dispatch support system based on artificial intelligence described in this invention realizes the time-series prediction technology of operation and maintenance indicators under massive model conditions, establishes an adaptive and self-learning model construction and optimization architecture, automatically sets dynamic thresholds based on indicator prediction, and identifies system faults in real time, quickly and accurately through multi-technology fusion analysis based on massive operation and maintenance data, realizing the transformation from experience-based to intelligent analysis-based management.

[0083] The diagnostic method described in this invention realizes multi-threshold alarm classification, multi-index alarm summarization, and multi-dimensional alarm noise reduction, establishing a comprehensive real-time fault diagnosis system to meet the needs of rapid system fault diagnosis, rapid location, rapid response, and rapid resolution, achieving accurate perception of system faults and ensuring the safe, reliable, and stable operation of the control system.

[0084] This invention automatically iterates the time-series prediction model and parameters based on the evaluation results of real-time collected data and predicted data of operation and maintenance indicators, and updates dynamic thresholds in real time, effectively reducing the false alarm rate of system faults and improving the accuracy of system fault diagnosis.

[0085] This invention sets dynamic thresholds by learning the operational patterns of indicators in real time, and quickly and accurately identifies system faults through real-time fault diagnosis, thus solving the problem of false alarms and missed alarms in fault detection algorithms based on expert experience values ​​and fixed thresholds. Attached Figure Description

[0086] Figure 1 This is a flowchart of the steps in a fault diagnosis method for a power grid dispatch support system provided in Embodiment 1 of the present invention;

[0087] Figure 2 The flowchart is shown in Embodiment 1 of the present invention.

[0088] Figure 3 This is a flowchart illustrating the iterative update process of the indicator future prediction data as described in Embodiment 1 of the present invention.

[0089] Figure 4 This is the multi-threshold alarm classification diagram described in Embodiment 1 of the present invention. Detailed Implementation

[0090] Preferred embodiments of the present invention will now be described in more detail with reference to the accompanying drawings and specific examples.

[0091] Example 1

[0092] This embodiment provides a fault diagnosis method for a power grid dispatch support system based on artificial intelligence, the process of which is as follows: Figure 1 As shown, the specific steps include the following.

[0093] Step S1: Collect operational metrics data for servers and processes.

[0094] Operation and maintenance metric data is time-series data collected through professional tools, such as memory usage sampled every minute. The collected data includes the collection time and the collection value. In the operation monitoring system, any operation monitoring metric is described by a combination of server name, component name, metric name and metric group name.

[0095] This invention is based on the collection of operation and maintenance index data and uses technologies such as multi-dimensional data association and artificial intelligence algorithms to achieve comprehensive real-time operation fault detection of basic hardware, platform components and application software. The basic hardware takes the server where the power grid control system is located as the operation monitoring object, and the platform components and application software take the process as the operation monitoring object. Common operation monitoring indicators are shown in Table 1.

[0096] Table 1 Common Operation Monitoring Indicators

[0097]

[0098] Step S2: At a preset fixed time, obtain future prediction data of indicators within a preset time range based on the indicator time series prediction algorithm, specifically including the following steps.

[0099] Step S21: At a preset fixed time, obtain sampling data of operation and maintenance indicators within a preset time range.

[0100] In this embodiment, the future prediction data of the indicators for the day is preset to 0:01 each day, based on the indicator time series prediction algorithm.

[0101] Step S22: Perform curve classification on the operation and maintenance indicator sampling data obtained in step S21.

[0102] The specific classification steps are as follows:

[0103] S22.1 Determine if there is any missing data exceeding the preset range; if so, it is considered a missing type.

[0104] S22.2 Determine whether the data is a constant value. If it is, then it belongs to the constant value type.

[0105] S22.3 Determine whether the maximum value is less than a preset multiple of the median. If so, it belongs to the micro-float type.

[0106] S22.4 Determine whether the stationarity of the sequence is determined based on the ADF test. If yes:

[0107] Detecting the presence of periods in time series data based on Fourier transform and autocorrelation coefficient.

[0108] S22.4.1 If a period exists, it belongs to the periodic type;

[0109] S22.4.2 If there is no period, it is a stationary type.

[0110] S22.5 classifies daily maintenance indicator sampling data into curves:

[0111] S22.5.1 Determine if there is any missing data in recent days that exceeds the preset range. If so, it belongs to the recent missing type.

[0112] S22.5.2 Determine whether the data for the past few days is a constant value. If so, it belongs to the recent constant value type.

[0113] S22.5.3 Determine whether the maximum value in recent days is less than 1.1 times the median. If so, it belongs to the recent slight fluctuation type.

[0114] S22.5.4 Determine whether the sequence has been stationary in recent days based on the ADF test. If so, it belongs to the recent stationary type.

[0115] If none of the conditions are met in steps S22.1 to S22.5, then it belongs to the irregular type.

[0116] In the field of power grid control, real-time business applications monitor and analyze the power grid in real time. The core processes typically operate in a one-master-multiple-standby mode. The operational indicator sampling data of the master process fluctuates with the usage of the business applications. If the fluctuation is large, the curve data type is irregular, and it is a key focus in actual operation and maintenance. If the fluctuation is small, the curve data type is slightly fluctuating. The operational indicator sampling data of the standby process is relatively stable, and the data type is stable.

[0117] Offline analysis applications in the power grid control field analyze historical data. Data analysis begins at a fixed time each day. The sampling data of the operation and maintenance indicators of the core process will fluctuate significantly with the use of the application. After the data analysis is completed, the process ends and resources are released. The curve data type is periodic.

[0118] Real-time business application processes may undergo primary / standby failover at any time. Afterward, the characteristics of the operational metrics sampling data for the primary and standby processes will interchange; that is, the new primary process may change from stable to irregular, and the new standby process may change from irregular to stable. Therefore, it is necessary to determine the recent operational metric sampling data characteristics. Curve data types also include: recently missing, recently constant, recently slightly fluctuating, and recently stable.

[0119] This invention adopts a method of one operation and maintenance data collection indicator corresponding to one time series prediction model. In view of the large differences in the characteristics of operation and maintenance data collection indicators in power grid control system, it can effectively solve the problem that a single model cannot meet the model evaluation requirements of all operation and maintenance data collection indicator curves.

[0120] This invention, combining the characteristics of operation and maintenance indicator sampling data with actual business application scenarios, categorizes the operation and maintenance indicator sampling data of servers and business application processes into: missing, constant, slightly fluctuating, stable, periodic, and irregular types, as well as recently missing, recently constant, recently slightly fluctuating, and recently stable types. Considering the large number of operation monitoring indicators in power grid control systems, training time-series prediction models only for periodic and irregular types effectively reduces the number of model training iterations, improves model building efficiency, and meets the real-time requirements of system operation monitoring.

[0121] In this embodiment, at 0:01:00 on March 8, 2022, the memory operation and maintenance index sampling data of the core process of a certain application host on a certain server for the previous 7 days is obtained, and the curve classification result is obtained through step S22: the data is an irregular time series.

[0122] Step S23: Based on the curve classification results of the operation and maintenance index sampling data in step S22, update or retrain the model according to the time series prediction algorithm.

[0123] S231. Obtain the indicator time series prediction model obtained from the previous preset time training, and determine whether the curve classification result matches the indicator time series prediction model.

[0124] S232. If there is no match or the model does not exist, retrain the model according to the time series prediction algorithm and save it.

[0125] S233. If a match is found, update the model according to the time series prediction algorithm and save it.

[0126] Time series forecasting algorithms include, but are not limited to: LGB algorithm, LSTM algorithm, and exponential average algorithm. Among them, periodicity corresponds to the LGB algorithm; irregularity corresponds to the LSTM algorithm; and missing, constant, slightly fluctuating, stationary, recently missing, recently constant, recently slightly fluctuating, and recently stationary types correspond to the exponential average algorithm.

[0127] like Figure 3 As shown, if the time series prediction model of the index obtained by training at the previous preset time does not meet the preset threshold after repeated iterations and updates, the model needs to be retrained according to the time series prediction algorithm.

[0128] In response to the characteristic that the time-series data curves remain unchanged under stable operation conditions in the power grid control field, the method of classifying data curves collected by operation and maintenance indicators, model iteration and parameter updates effectively reduces the number of training models for LGB and LSTM algorithms, greatly improves the efficiency of model building, and can meet the real-time requirements of system operation monitoring.

[0129] In this embodiment, the time series prediction model version V1 for the indicator on March 7, 2022 is obtained. If version V1 is an LSTM model, then the two are matched, and the LSTM model parameters are iteratively updated and optimized according to the LSTM algorithm, and saved as version V2. If version V1 is an LGB model, then the two are not matched, and the LSTM model is trained according to the LSTM algorithm to obtain an LSTM model, and saved as version V2.

[0130] Step S24: Based on the time series prediction model obtained in step S23, predict the sampling data of operation and maintenance indicators for the next preset time range and save it to the data warehouse.

[0131] In this embodiment, the predicted data of 1,440 sampling points for the entire day of March 8, 2022, are obtained through model prediction and saved to the model repository.

[0132] Furthermore, between two preset fixed times, the time series prediction model and parameters obtained in step S23 are iteratively updated based on the preset period, the predicted data within the period, and the actual collected data, and the subsequent operation and maintenance indicator sampling data within the preset time range are updated.

[0133] In this embodiment, at each hour from 1 to 23 on March 8, the predicted data and actual collected data for the previous hour are obtained, the time series prediction model is iteratively updated, and the operation and maintenance indicator sampling prediction data from that hour to 00:00 on March 9 are updated.

[0134] Furthermore, by combining the data characteristics of different operation and maintenance indicators, the time series prediction algorithm dynamically adjusts itself based on the evaluation results of the time series model, and iterates repeatedly to find the optimal parameters.

[0135] This invention automatically iterates the time-series prediction model and parameters based on the evaluation results of real-time collected data and predicted data of operation and maintenance indicators, and updates dynamic thresholds in real time, effectively reducing the false alarm rate of system faults and improving the accuracy of system fault diagnosis.

[0136] This invention breaks through the time-series prediction technology of operation and maintenance indicators under massive model conditions, establishes an adaptive and self-learning model construction and optimization architecture, sets dynamic thresholds by learning the operation rules of indicators in real time, and quickly and accurately identifies system faults through real-time fault diagnosis, thus solving the pain points of fault detection algorithms based on expert experience values ​​and fixed thresholds that are prone to false alarms and false alarms.

[0137] Step S3: Combine the anomaly detection algorithm of operation and maintenance indicators to identify system operation faults and generate operation fault information.

[0138] The anomaly detection algorithm in step S3 specifically includes the following algorithms:

[0139] Algorithm A performs missing anomaly detection based on real-time collected operation and maintenance indicator data. It determines whether the sampled operation and maintenance indicator data is empty; if so, it generates missing indicator operation fault information.

[0140] Algorithm B: An algorithm for detecting slow ramp-up anomalies in operational metrics based on the Mann-Kendall method.

[0141] When the operational metrics are server memory usage, disk partition inode usage, operating system handle usage, process memory usage, handle usage, number of client connection calls, and number of core files, Algorithm B is used to identify system operational faults and generate information on slow-ramping operational faults.

[0142] The specific steps of Algorithm B include:

[0143] Step B01: Obtain the operation and maintenance indicator sampling data P within the preset time period, which is [P1, P2, ..., P...]. n ].

[0144] Preset time periods include, but are not limited to, minutes, hours, days, weeks, months, quarters, or years.

[0145] In this embodiment, it is assumed that the operational metric to be monitored is the memory metric data of node Node1. For a data collection period of 1 minute and a metric detection window of 1 hour, the memory metric data of node Node1 from 0:01 to 1:00 is obtained at 1:00 on a certain day: [P1, P2, ..., P...]. 60 ].

[0146] Step B02: Verify the trend of operation and maintenance indicator data based on the Mann-Kendall method.

[0147] The Mann-Kendall trend test (MK) is a non-parametric test that does not require the data to be normally distributed or the trend to be linear. The MK trend test has been widely used in fields such as environment, climate, and geography.

[0148] A tau value close to 1 in the MK trend test indicates a strong positive correlation, meaning the indicator shows a monotonically increasing trend over time. Based on a preset test threshold, values ​​above this threshold are considered indicative of a slow, gradual upward trend in the indicator. A narrow window is suitable for scenarios where the indicator's upward trend is rapid; a wide window is suitable for scenarios where the indicator's upward trend is slow but takes a long time.

[0149] In this embodiment, the memory index data of process 1 and process 2 on a certain server from 1:01 to 2:00 on a certain day, and the TAU value calculated by examining the trend of the past hour at 2:00 on the same day are shown in Table 2. It can be seen that under the same time length, the larger the index climb amount, that is, the faster the climb speed, the larger the TAU value.

[0150] Table 2

[0151] process Data starting value End value of data Data growth tau value Process 1 1025MB 1917MB 892MB 0.99 Process 2 3203MB 3187MB 16MB 0.7

[0152] In this embodiment, the TAU value calculated by process 2 on a certain server from 10:01 to 11:00 on a certain day is checked at 11:00 on that day to verify the trend of the past hour. The TAU value calculated by process 2 from 0:01 to 0:00 on the next day is checked at 0:00 on the next day to verify the trend of the past day. As shown in Table 3, it can be seen that under the same climbing speed, the longer the climbing time of the continuous indicator, the larger the TAU value.

[0153] Table 3

[0154] Data start time Data starting value Data end time End value of data Data growth tau value 10:01 3272MB 11:00 3282MB 10MB 0.71 0:01 3182MB 0:00 the next day 3405MB 223MB 0.98

[0155] Step B03: Repeat steps B01 and B02 according to the preset detection time window size. If the trend of operation and maintenance indicator data is monotonically increasing within several consecutive time windows, it is determined that there is a slow ramp-up anomaly in the operation and maintenance indicator, and a slow ramp-up operation fault information is generated.

[0156] Periodic trend detection based on a sliding window refers to judging the trend of an indicator within only one window at a time. That is, for a sequence [P1, P2, ..., P...] n ], calculate the tau value of the sequence and determine the trend. The preset step size is k, that is, the window moves k units to the right each time, while the width remains unchanged. 1+k ,P 2+k ,......,P n+k The tau value is calculated and the trend is determined. If the trend is monotonically increasing for m consecutive windows, then a slow upward anomaly is identified within the last k*m units.

[0157] Narrow windows with small step sizes are often used to judge short- to medium-term trends and are suitable for scenarios where indicators climb rapidly; wide windows with large step sizes are often used to judge long-term trends and are suitable for scenarios where indicators climb slowly but for a long period of time.

[0158] In this embodiment, it is assumed that the detection time window is 15 minutes and the number of consecutive time windows is 4. Process Proc1 checks the tau value calculated from the trend of the past hour every 15 minutes from 1:00 to 2:15 on a certain day, as shown in Table 4. At 2:15, process Proc1 satisfies the condition of generating 4 consecutive operational fault information, and determines that the trend of the operation and maintenance indicator data within the time window is monotonically increasing, indicating that the indicator has a slow ramp-up anomaly, and generates operational fault information for the indicator slow ramp-up.

[0159] Table 4

[0160] Detection time Data start time Data end time tau value 1:00 0:01 1:00 -0.64 1:15 0:16 1:15 -0.13 1:30 0:31 1:30 0.61 1:45 0:46 1:45 0.98 2:00 1:01 2:00 0.98 2:15 1:16 2:15 0.98

[0161] Algorithm C, an algorithm for detecting jumps and mutations in operational metrics based on multi-algorithm ensemble learning, includes the following steps:

[0162] Step C1: Obtain the sampling data sequence of operation and maintenance indicators in real time according to the sampling period of operation and maintenance indicators.

[0163] Step C2: Perform outlier detection on the sampled operation and maintenance indicator data using multiple algorithms. If more than half of the new data is judged as abnormal, then the data may be considered abnormal, and an indicator jump and sudden change operation fault information is generated.

[0164] The multiple algorithms include, but are not limited to, N-sigma, TukeyTest, and LOF.

[0165] In this embodiment, a server Node1 obtains a real-time operational indicator sampling data sequence [P1...P] at 22:00 on a certain day. 60 Assuming that outlier detection is performed based on multiple algorithms such as N-sigma, TukeyTest, and LOF, the judgment results are shown in Table 5. More than half of the new data are judged as outliers, indicating that the data may be abnormal, and generating information on index jump and sudden change in operation failure.

[0166] Table 5

[0167] algorithm Judgment result N-sigma abnormal TukeyTest abnormal LOF normal

[0168] Step S4: Summarize all operational fault information, complete operational fault detection, and send operational fault alarms.

[0169] Step S41: Obtain the operational fault alarm information obtained in step S3 in real time, and send operational fault classification alarms based on multi-threshold alarm classification, such as... Figure 4 As shown.

[0170] S411. The multiple thresholds include:

[0171] S411.1 The baseline threshold is obtained based on multi-algorithm ensemble learning;

[0172] S411.2 Dynamic threshold obtained based on the future prediction index obtained in step S2;

[0173] S411.3 Redline threshold obtained based on expert experience;

[0174] S412. The alarm classification includes:

[0175] S412.1 When the collected index value is less than the benchmark threshold, save it as a prompt alarm;

[0176] S412.2 When the collected index value is greater than the baseline threshold and less than the dynamic threshold, it is saved as a minor alarm;

[0177] S412.3 When the collected indicator value is greater than the dynamic threshold and less than the red line threshold, save and send an important alarm;

[0178] S412.4 When the collected indicator value is greater than the red line threshold, save and send an emergency alarm.

[0179] In this embodiment, at 22:00 on a certain day, a server Node1 generates an indicator jump mutation operation fault information where the indicator collection value is greater than the baseline threshold and less than the dynamic threshold. The system saves and sends a minor jump mutation alarm.

[0180] Step S42: At a preset fixed time, obtain the operation fault alarm information obtained in step S3, summarize the alarms for multiple indicators, save and send the operation fault summary alarm.

[0181] The multiple indicators include, but are not limited to, all the operation and maintenance data collection indicator types in Table 1.

[0182] The alarm summary also includes statistical alarms based on historical operational fault alarms.

[0183] The alarm summary also includes alarms detected based on historical operational fault information compared to the previous detection period.

[0184] In this embodiment, the alarm is first summarized based on the operation fault alarm information obtained in step S3 at 0:00 every day, and an operation fault summary alarm is sent.

[0185] In this embodiment, it is assumed that a certain server Node2 collects operational fault alarm information from 0:00 on March 1st to 0:00 on March 2nd, 2022 at 0:00. The alarms are summarized as follows: "On March 1st, 2022, the sampling rate of Node2 node indicators was 99.5%, with a total of 14 missing indicators, including 6 missing memory usage indicators and 8 missing disk partition usage indicators; the indicator jump mutation rate was 99.3%, with a total of 21 indicator jump mutations, including 15 jump mutations in CPU usage indicators and 6 jump mutations in 1-minute average load indicators; the memory usage indicator leaked a cumulative 2G from 9:00 to 19:00, with an average leakage rate of 200M / hour."

[0186] Step S43: Based on the multi-dimensional alarm analysis algorithm of correlation coefficient, save and send the running fault analysis alarm.

[0187] The correlation coefficients include, but are not limited to, Pearson correlation coefficient, Kendall tau correlation coefficient, and Spearman rho correlation coefficient.

[0188] S431. Acquire operational fault information in real time, perform correlation analysis based on historical operational fault information, suppress repetitive alarms of operational indicators, and generate alarms for sudden operational anomalies.

[0189] Specifically, it includes:

[0190] S431.1 Real-time and historical operational fault information data are strongly correlated, suppressing repetitive alarms of operational indicators;

[0191] S431.2 generates alarms for sudden operational anomalies by generating real-time and historical operational fault information data with a weak correlation.

[0192] In the field of power grid control, offline analysis applications analyze historical data at fixed times every day. Operation and maintenance data are strongly correlated with time. Correlation analysis based on historical operation alarm information can help reduce duplicate alarm information.

[0193] In this embodiment, it is assumed that the historical running failure information data of process 2 on a certain server has the following characteristics: an average daily memory usage leakage of 8.1G from 2:00 to 10:00, with an average leakage rate of 1G / hour.

[0194] In this embodiment, it is assumed that the indicator slowly ramps up and runs fault information obtained by process 2 at 8:00 on the same day: memory usage leaked by 6.2G from 2:00 to 8:00 on the same day, with an average leakage rate of 1G / hour, which is strongly correlated with historical running fault information data, so the repetitive alarm of running indicator is suppressed.

[0195] In this embodiment, assuming that the indicator obtained by process 2 at 8:30 on the same day is a slow ramp-up operation fault information: the memory usage leaked by 13G from 2:00 to 8:30 on the same day, with an average leakage rate of 2G / hour, and is weakly correlated with historical operation fault information data, then a sudden operation abnormality fault alarm is generated.

[0196] S432. Based on the correlation analysis of server and process running failure information, generate process impact chain alarms.

[0197] In the field of power grid control, some business applications adopt a dedicated server deployment method. The server and process operation and maintenance data are highly correlated, and process operation failures directly affect the server's operating status.

[0198] In this embodiment, it is assumed that a correlation analysis of the historical 30-day running alarm information of a certain server Node3 and process Proc3 on the server shows that the two are strongly correlated, and then a process influence chain alarm is generated.

[0199] This invention significantly reduces the number of real-time operation and maintenance monitoring alarms and the workload of fault analysis by using multi-threshold alarm classification, multi-index alarm summarization, and multi-dimensional alarm noise reduction. It effectively reduces the difficulty of system operation and maintenance, achieves accurate perception of system faults, meets the needs of rapid diagnosis, rapid location, rapid response, and rapid resolution of system faults, establishes a comprehensive real-time fault diagnosis system, achieves accurate perception of system faults, and ensures stable system operation.

[0200] Furthermore, the fault detection method for power grid control systems provided by this invention supports automatic periodic detection and also supports the detection of historical data.

[0201] The historical data detection process is as follows: Based on the historical data detection requirements of the Aiop intelligent operation and maintenance platform, specify the start and end times for detection, and repeat steps S1 to S4 to generate historical operational fault alarms. Historical data detection effectively helps to discover operation and maintenance issues that were missed due to the limitations of manual inspections.

[0202] Example 2

[0203] This invention provides a fault diagnosis device for a power grid dispatch support system based on artificial intelligence, comprising the following modules:

[0204] Module M1, the Operation and Maintenance Indicator Data Acquisition Module, is used to acquire operation and maintenance indicator data for servers and processes.

[0205] Module M2, the indicator future prediction data generation module, is used to obtain indicator future prediction data within a preset time range based on the indicator time series prediction algorithm according to a preset fixed time.

[0206] Module M201, the index sampling curve classification submodule, is used to classify the collected operation and maintenance index data.

[0207] Module M202, the Operation and Maintenance Indicator Time Series Prediction Submodule, is used to train and update the operation and maintenance indicator prediction model and generate indicator prediction data based on the model.

[0208] Module M3, the anomaly detection algorithm module for operation and maintenance indicators, is used to generate operational fault information based on the anomaly detection algorithm.

[0209] Module M301, the Operation and Maintenance Indicator Missing Detection Submodule, is used to generate fault information for missing indicators.

[0210] Module M302, the Operation and Maintenance Indicator Slow Rise Detection Submodule, is used to generate slow rise fault information of indicators based on the operation and maintenance indicator slow rise anomaly detection algorithm.

[0211] Module M303, the Operation and Maintenance Indicator Jump and Sudden Change Detection Submodule, is used to generate indicator jump and sudden change fault information based on the Operation and Maintenance Indicator Jump and Sudden Change Anomaly Detection Algorithm.

[0212] Module M4, the runtime fault alarm generation module, is used to summarize all runtime fault information and send runtime fault alarms.

[0213] Module M401, Real-time Generation Submodule for Operational Fault Classification Alarms, is used to acquire operational fault alarm information in real time, save and send operational fault classification alarms based on multi-threshold alarm classification.

[0214] Module M402, the Operation Fault Summary Alarm Generation Submodule, is used to obtain operation fault alarm information according to a preset fixed time, summarize alarms for multiple indicators, save and send operation fault summary alarms.

[0215] Module M403, the Operation Fault Analysis Alarm Generation Submodule, is used to obtain operation fault alarm information, perform multi-dimensional alarm analysis based on correlation coefficients, save and send operation fault analysis alarms.

[0216] Module M403 includes the following functions:

[0217] Correlation analysis function for real-time and historical operational fault alarm information;

[0218] Correlation analysis function for server and process operation failure alarm information;

[0219] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0220] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0221] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0222] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0223] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and principles of the described embodiments, and these modifications and variations should also be considered within the scope of protection of the present invention.

Claims

1. A power grid dispatching support system failure diagnosis method, characterized by, Includes the following steps: Obtain operational metrics data for servers and processes; At a preset fixed time, based on the indicator time series prediction algorithm, future prediction data of indicators within a preset time range is obtained; including: at a preset fixed time, obtaining operation and maintenance indicator sampling data within a preset time range; performing curve classification on the operation and maintenance indicator sampling data; updating or retraining the time series prediction model according to the curve classification results of the operation and maintenance indicator sampling data and the time series prediction algorithm; predicting the operation and maintenance indicator sampling data for the next preset time range according to the time series prediction model and saving it to the data warehouse; By combining operation and maintenance indicator anomaly detection algorithms, system operation faults are identified and operation fault information is generated; the operation and maintenance indicator anomaly detection algorithms include: an algorithm for detecting missing operation and maintenance indicator data based on real-time collection; an algorithm for detecting slow ramp-up anomalies in operation and maintenance indicators based on the Mann-Kendall method; and an algorithm for detecting jump and sudden changes in operation and maintenance indicators based on multi-algorithm ensemble learning. It summarizes all operational fault information, completes operational fault detection, and sends operational fault alarms; including: real-time acquisition of operational fault alarm information, alarm classification based on multiple thresholds, and sending operational fault classification alarms; at preset fixed times, acquiring operational fault alarm information, summarizing alarms based on multiple indicators, saving and sending operational fault summary alarms; and using a multi-dimensional alarm analysis algorithm based on correlation coefficients to save and send operational fault analysis alarms.

2. The power grid dispatching support system fault diagnosis method according to claim 1, characterized in that, The step of updating or retraining the time series prediction model according to the time series prediction algorithm includes: Obtain the time series prediction model of the indicator obtained from the previous preset time training, and determine whether the curve classification result matches the time series prediction model of the indicator. If there is no match or the model does not exist, retrain the time series prediction model according to the time series prediction algorithm and save it. If a match is found, the time series prediction model is updated and saved according to the time series prediction algorithm.

3. The power grid dispatching support system fault diagnosis method of claim 1, wherein, The process of classifying the operation and maintenance indicator sampling data into curves includes: Determine if there is any missing data exceeding a preset range; if so, it is considered a missing data type. Determine if the data is a constant value; if so, it belongs to the constant value type. Determine if the maximum value is less than a preset multiple of the median; if so, it belongs to the micro-float type. To determine whether the stationarity of the sequence is determined based on the ADF test, if so, the presence of periodicity in the time series data is detected based on the Fourier transform and autocorrelation coefficient: if periodicity exists, the data is periodic; if no periodicity exists, the data is stationary. This also includes classifying curves based on daily segmentation of operational and maintenance indicator sampling data: Determine if there is any missing data exceeding a preset range in recent days; if so, it is classified as recent missing data. Determine whether the data for the past few days is a constant value; if so, it belongs to the recent constant value type. Determine whether the maximum value in recent days is less than 1.1 times the median. If so, it belongs to the recent slight fluctuation type. Determine whether the sequence has been stationary in recent days based on the ADF test. If so, it belongs to the recent stationary type. If none of the above apply, then it is an irregular type.

4. The power grid dispatching support system fault diagnosis method according to claim 3, characterized in that, The time series prediction algorithms include, but are not limited to, LGB algorithm, LSTM algorithm, and exponential average algorithm; wherein, LGB algorithm corresponds to periodic type; LSTM algorithm corresponds to irregular type; and exponential average algorithm corresponds to missing type, constant type, slightly fluctuating type, stationary type, recent missing type, recent constant type, recent slightly fluctuating type, and recent stationary type.

5. The power grid dispatching support system fault diagnosis method of claim 1, wherein, The algorithm for detecting slow ramp-up anomalies in operational metrics based on the Mann-Kendall method includes: Obtain sampling data of operation and maintenance indicators within a preset time period; Using the Mann-Kendall method to examine the trends of operation and maintenance indicator data; Repeat the above steps according to the preset detection time window size. If the trend of operation and maintenance indicator data is monotonically increasing within several consecutive time windows, it is determined that there is a slow ramp-up anomaly in the operation and maintenance indicator, and a slow ramp-up operation fault information is generated.

6. The power grid dispatching support system fault diagnosis method according to claim 1, characterized in that, The algorithm for detecting jumps and abrupt changes in operational metrics based on multi-algorithm ensemble learning includes: Based on the sampling period of operation and maintenance indicators, the sampling data sequence of operation and maintenance indicators is obtained in real time; The operation and maintenance indicator sampling data is used to detect outliers based on multiple algorithms. If more than half of the new data are judged to be outliers, then the data may be considered to be outliers, and an indicator jump and sudden change operation fault information is generated. The multiple algorithms include, but are not limited to, N-sigma, TukeyTest, and LOF.

7. The power grid dispatching support system fault diagnosis method of claim 1, wherein, The multiple thresholds include: The baseline threshold is obtained based on multi-algorithm ensemble learning; Dynamic thresholds derived from future forecast indicators; The red line threshold is derived from expert experience.

8. The power grid dispatching support system fault diagnosis method of claim 1, wherein, The alarm classification includes: When the collected indicator value is less than the benchmark threshold, save it as a prompt alarm; When the collected index value is greater than the baseline threshold but less than the dynamic threshold, it is saved as a minor alarm. When the collected indicator value is greater than the dynamic threshold but less than the red line threshold, save and send an important alarm. When the collected indicator value exceeds the red line threshold, save it and send an emergency alarm.

9. The grid dispatch support system fault diagnosis method of claim 1, wherein, The multi-dimensional alarm analysis includes: (a) Acquire operational fault information in real time, perform correlation analysis based on historical operational fault information, suppress repetitive alarms of operational indicators, and generate alarms for sudden operational anomalies; including: Real-time and historical operational fault information data are strongly correlated, suppressing repetitive alarms from operational indicators; Real-time and historical operational fault information data are weakly correlated to generate alarms for sudden operational anomalies; (b) Based on the correlation analysis of server and process operation failure information, generate process impact chain alarms.

10. A power system dispatch support system failure diagnosis device for carrying out the diagnosis method according to any one of claims 1 to 9, characterized by Includes the following modules: The operation and maintenance indicator data acquisition module is used to acquire operation and maintenance indicator data for servers and processes. The indicator future prediction data generation module is used to obtain indicator future prediction data within a preset time range based on the indicator time series prediction algorithm according to a preset fixed time. The operation and maintenance indicator anomaly detection algorithm module is used to generate operational fault information based on the anomaly detection algorithm; The runtime fault alarm generation module is used to summarize all runtime fault information and send runtime fault alarms.

11. The power system dispatch support system fault diagnostic apparatus according to claim 10, characterized by, The future prediction data generation module for the aforementioned indicator includes: The indicator sampling curve classification submodule is used to classify the collected operation and maintenance indicator data; The operation and maintenance metric time series prediction submodule is used to train and update the operation and maintenance metric prediction model and generate metric prediction data based on the model.

12. The fault diagnosis device for the power grid dispatch support system according to claim 10, characterized in that, The anomaly detection algorithm module for operational and maintenance metrics includes: The operation and maintenance indicator missing detection submodule is used to generate indicator missing fault information; The Operation and Maintenance Indicator Slow Rise Detection Submodule is used to generate slow rise fault information of indicators based on the Operation and Maintenance Indicator Slow Rise Anomaly Detection Algorithm. The Operation and Maintenance Indicator Jump and Abrupt Change Detection Submodule is used to generate indicator jump and abrupt change fault information based on the Operation and Maintenance Indicator Jump and Abrupt Change Anomaly Detection Algorithm.

13. The power grid dispatch support system fault diagnostic apparatus according to claim 10, characterized by, The operational fault alarm generation module includes: The real-time generation submodule for operational fault classification alarms is used to obtain operational fault alarm information in real time, save and send operational fault classification alarms based on multi-threshold alarm classification. The operation fault summary alarm generation submodule is used to obtain operation fault alarm information according to a preset fixed time, summarize alarms for multiple indicators, save and send operation fault summary alarms. The runtime fault analysis alarm generation submodule is used to obtain runtime fault alarm information, perform multi-dimensional alarm analysis based on correlation coefficients, save and send runtime fault analysis alarms.

Images