Fault warning method and system for power dispatching system

Abstract

The invention discloses a fault alarm method and system for a power dispatching system, and the method comprises the steps: carrying out the anomaly detection of an obtained node time sequence data set through a 3sigma algorithm based on an adjustable sliding window, and obtaining a first anomaly detection result; performing anomaly detection on the node time sequence data set through an SR algorithm based on an adjustable sliding window to obtain a second anomaly detection result; performing superposition judgment on the first anomaly detection result and the second anomaly detection result to obtain a node fault analysis result; and generating alarm information of the power dispatching system according to the node fault analysis result and a preset alarm priority. The method solves the problem of repeated feedback of alarm information, and improves the alarm accuracy.

Description

Technical Field

[0001] The present application belongs to the technical field of power grid fault analysis, and specifically relates to a fault alarm method and system for a power dispatching system. Background Art

[0002] In modern highly complex information system architectures, fault correlation analysis plays a vital role, especially in power grids, where it is a key strategy to ensure system stability and accelerate problem diagnosis and resolution. However, traditional fault correlation analysis methods and their supporting systems are often limited by preset static rules and threshold judgment mechanisms, which show obvious limitations in the face of the increasingly complex and changeable power dispatching system environment.

[0003] Specifically, when an abnormality occurs within the system and triggers an alarm, since data flows between multiple interconnected nodes, each node may independently generate alarm information based on its unique business logic and monitoring standards. This decentralized alarm generation mechanism can easily lead to redundant accumulation and repeated reporting of alarm information, which not only increases the processing burden of operation and maintenance personnel, but may also cover up the real root cause of the fault, leading to misjudgment and delays. Traditional rule-based judgment methods are difficult to accurately identify such situations, causing operation and maintenance personnel to spend a lot of time and energy to investigate and confirm the authenticity of the alarm. Summary of the invention

[0004] The present application proposes a fault alarm method and system for an electric power dispatching system, which solves the problem of repeated feedback of alarm information and improves the accuracy of the alarm.

[0005] A first aspect of the present application provides a fault alarm method for a power dispatching system, the method comprising:

[0006] Anomaly detection is performed on the acquired node time series data set by using a 3sigma algorithm based on an adjustable sliding window to obtain a first anomaly detection result;

[0007] Performing anomaly detection on the node time series data set by using an SR algorithm based on an adjustable sliding window to obtain a second anomaly detection result;

[0008] The first abnormality detection result and the second abnormality detection result are superimposed and determined to obtain a node fault analysis result;

[0009] Generate alarm information for the power dispatching system based on the node fault analysis results and the preset alarm priority.

[0010] The above scheme uses the 3sigma algorithm and SR algorithm based on an adjustable sliding window to perform anomaly detection on the node time series data set, obtains the first anomaly detection result and the second anomaly detection result, and then superimposes the two anomaly detection results to make a more accurate and rigorous judgment on the abnormal situation of the node, so as to avoid repeated alarms or missed abnormal situations, and can also classify the abnormal situation of the node. According to the level of the abnormal situation, the node fault analysis results and the preset alarm priority, the alarm information is prioritized to ensure that more serious abnormal situations can be resolved first and the timeliness of the alarm is achieved.

[0011] In a possible implementation method of the first aspect, the node time series data set is specifically:

[0012] Collect node operation data from various nodes in the power dispatching system;

[0013] The node operation data is sequentially cleaned, normalized, denoised, processed for outliers, and reduced in dimension to obtain the node operation data after dimension reduction;

[0014] The time information is extracted from the node operation data after dimension reduction, and the time series structure of the node operation data after dimension reduction is converted according to the time information to obtain a node time series data set.

[0015] The above scheme first pre-processes the node operation data to improve the data quality and reduce data redundancy while ensuring the main features of the data, thereby reducing the complexity of subsequent data processing. Then, the node operation data after dimension reduction is converted into a time series structure to facilitate subsequent data processing and analysis.

[0016] In a possible implementation method of the first aspect, anomaly detection is performed on the node time series data set by a 3sigma algorithm based on an adjustable sliding window to obtain a first anomaly detection result, specifically:

[0017] Calculate the mean and standard deviation of the node time series data set;

[0018] Determine a first threshold range according to the principle of the 3sigma algorithm, the mean and the standard deviation;

[0019] The node time series data set is analyzed according to the first threshold range and the first sliding window of the 3sigma algorithm to obtain a first anomaly detection result.

[0020] In a possible implementation method of the first aspect, analyzing the node time series data set according to the first threshold range and the first sliding window of the 3sigma algorithm to obtain a first anomaly detection result further includes:

[0021] Adjusting the size of the first sliding window according to the data change speed of the node time series data set;

[0022] Updating the first threshold range according to the size of the first sliding window;

[0023] When the data in the first sliding window exceeds the first threshold range, it is marked as abnormal data;

[0024] A first abnormality detection result is obtained according to the abnormal data.

[0025] The above scheme adjusts the size of the first sliding window according to the data change speed of the node time series data set to ensure that the accuracy of anomaly detection will not be affected regardless of the speed of data change. Then, the first threshold range is dynamically adjusted based on the size of the sliding window, which is actually a corresponding adjustment of the range of abnormal data to ensure the accuracy of anomaly detection.

[0026] In a possible implementation method of the first aspect, anomaly detection is performed on the node time series data set by using an SR algorithm based on an adjustable sliding window to obtain a second anomaly detection result, specifically:

[0027] Adjusting the size of the second sliding window of the SR algorithm according to the data volume change speed of the node time series data set;

[0028] According to a second threshold range preset in the second sliding window, the node time series data set is analyzed to obtain a second anomaly detection result.

[0029] In a possible implementation method of the first aspect, the first abnormality detection result and the second abnormality detection result are superimposed and determined to obtain a node fault analysis result, specifically:

[0030] The first anomaly detection result and the second anomaly detection result are superimposed by a preset superposition algorithm to obtain a superposition result of each node;

[0031] Determining whether the superposition result is normal according to a preset judgment standard;

[0032] When the first abnormality detection result and the second abnormality detection result in the superposition result are both normal, the node corresponding to the superposition result is in a normal state;

[0033] When only one of the first abnormality detection result and the second abnormality detection result in the superposition result is abnormal, the node corresponding to the superposition result is in a first-level abnormal state;

[0034] When the first abnormality detection result and the second abnormality detection result in the superposition result are both abnormal, the node corresponding to the superposition result is in a secondary abnormal state;

[0035] According to the status information of all nodes, the node fault analysis results are obtained.

[0036] In the above scheme, the two abnormal detection results are superimposed and fault judgment is performed to obtain the abnormal state corresponding to each node and classify the abnormal state, determine the priority of the abnormal state, and ensure that the abnormal alarm of each node will only appear once, and there will be no redundant situation of multiple alarms for a node due to different abnormal situation judgments, thus solving the problem of redundant and repeated alarms.

[0037] In a possible implementation method of the first aspect, whether the superposition result is normal is determined according to a preset judgment criterion, specifically:

[0038] Determining a first judgment criterion according to the fault type detected by the 3sigma algorithm;

[0039] Determining a second judgment criterion according to the fault type detected by the SR algorithm;

[0040] Determining a first abnormality detection result in the superposition result according to a first judgment criterion;

[0041] The second abnormality detection result in the superposition result is judged according to a second judgment standard.

[0042] In order to distinguish the abnormal state after superposition, the above scheme sets corresponding judgment criteria according to the detected fault type to obtain a more accurate judgment result.

[0043] In a possible implementation method of the first aspect, alarm information of the power dispatching system is generated according to the node fault analysis result and the preset alarm priority, specifically:

[0044] Generate alarm information for nodes in abnormal state based on the node fault analysis results.

[0045] Determining the abnormality level of the node in the abnormal state according to the alarm priority;

[0046] The alarm information is sorted according to the abnormality level, and the alarm information is processed in sequence according to the sorting result.

[0047] After generating the alarm information, the above scheme also sorts the alarm information according to the alarm priority to ensure that the alarm information with higher priority can be processed in time, so that more serious faults can be solved immediately, thereby improving the timeliness of the alarm.

[0048] In a possible implementation method of the first aspect, the method further includes:

[0049] Input the alarm information into a preset fault relationship analysis model, and locate the root cause of the fault through the relationship between nodes;

[0050] The fault is repaired according to the root cause of the fault, and a corresponding repair report is generated.

[0051] The above solution locates the root cause of the fault more accurately through the relationship between nodes and gives corresponding repair suggestions, shortening the troubleshooting time. In addition, the generated repair report will record the fault repair process and provide data support for subsequent fault prevention.

[0052] A second aspect of the present application provides a fault alarm system for a power dispatching system, the system comprising: a first abnormality detection result generation module, a second abnormality detection result generation module, a fault analysis module and an alarm information generation module;

[0053] The first anomaly detection result generating module is used to perform anomaly detection on the node time series data set by using a 3sigma algorithm based on an adjustable sliding window to obtain a first anomaly detection result;

[0054] The second anomaly detection result generating module is used to perform anomaly detection on the node time series data set by using an SR algorithm based on an adjustable sliding window to obtain a second anomaly detection result;

[0055] The fault analysis module is used to perform superposition determination on the first abnormality detection result and the second abnormality detection result to obtain a node fault analysis result;

[0056] The alarm information generation module is used to generate alarm information of the power dispatching system according to the node fault analysis result and the preset alarm priority. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the implementation manner will be briefly introduced below. Obviously, the drawings described below are only some implementation manners of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0058] Figure 1 This is a specific flow chart of a fault alarm method for a power dispatching system provided by a certain embodiment of the present application;

[0059] Figure 2 It is a specific structural diagram of a fault alarm system of an electric power dispatching system provided in a certain embodiment of the present application. DETAILED DESCRIPTION

[0060] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0061] It should be understood that the step numbers used in this article are only for the convenience of description and are not intended to limit the order in which the steps are executed.

[0062] First embodiment

[0063] Because there are many nodes in the power dispatching platform and the relationship between the nodes is complex, when a node is abnormal, the abnormal data generated will flow between multiple interrelated nodes, which will cause multiple nodes to report errors during fault analysis, resulting in duplication and redundancy of alarm information, increasing the processing burden of operation and maintenance personnel. In addition, multiple nodes will feedback fault information due to the flow of abnormal data, which will also cover up the real root cause of the fault, increase the work of troubleshooting, and require a lot of time and effort to confirm the authenticity of the alarm, which reduces the accuracy of the alarm.

[0064] like Figure 1 As shown, Figure 1 A specific flow chart of a fault alarm method of a power dispatching system is provided for a certain embodiment of the present application. The fault alarm method of the power dispatching system of this embodiment includes steps S1 to S4, which are described in detail as follows:

[0065] Step S1, performing anomaly detection on the node time series data set by using a 3sigma algorithm based on an adjustable sliding window to obtain a first anomaly detection result.

[0066] In the embodiment of the present application, data is first collected from each node in the power dispatching system through a preset interface and protocol. The collected data includes the status information of the equipment in the node, various parameters during operation, etc. Real-time data is obtained from various devices through these interfaces and protocols to better understand and control the operating status of the equipment on the node.

[0067] Then, the acquired node operation data is preprocessed, mainly including data denoising, normalization, outlier processing, data dimension reduction, etc. The specific contents are as follows:

[0068] 1) Data denoising

[0069] Since there may be various noise sources in the power dispatching operation system, such as sensor errors, interference in the data transmission process, etc., these noises will have an adverse effect on subsequent data analysis. Therefore, in the data preprocessing stage, it is necessary to adopt appropriate denoising techniques, such as filtering methods, wavelet transform, etc., to reduce or eliminate the impact of noise on data quality.

[0070] 2) Outlier processing

[0071] There may be some outliers in the collected node operation data, which may be caused by equipment failure, measurement error, or data transmission error. The existence of outliers will interfere with normal detection. Therefore, the embodiment of the present application adopts a statistical method to identify and process these outliers, and then correct them by replacement, deletion, or interpolation.

[0072] 3) Data Dimensionality Reduction

[0073] There are a large number of nodes in the power dispatching and operation system, and each node may contain multiple operating parameters, resulting in very high data dimensions. High-dimensional data not only increases the complexity of data calculation, but also may introduce redundant information and interfere with anomaly detection. Therefore, in the data preprocessing stage, it is necessary to use appropriate dimensionality reduction techniques, such as principal component analysis (PCA), linear discriminant analysis (LDA) or autoencoders, to convert high-dimensional data into low-dimensional representations to retain the main features of the data and remove redundant information.

[0074] Data preprocessing can significantly improve the quality of node operation data and reduce the complexity of subsequent data processing.

[0075] In addition, because the subsequent anomaly detection algorithm is implemented based on time series data, it is also necessary to convert the pre-processed node operation data into a time series structure to obtain a node time series data set. The specific process is: first clean the data and remove duplicate, erroneous or irrelevant records. Make sure that each row or each item of data is associated with a clear time point. Then extract the time information from the cleaned node operation data. If the data already contains a timestamp, use the timestamp directly. If there is no direct timestamp in the data, but information that can be converted to a timestamp is provided (such as a separate field for date and time), merge this information into a complete timestamp. If the time information in the data is ambiguous (such as only date or only time), it is necessary to decide how to fill the missing time part according to the actual situation to obtain the corresponding timestamp. After determining the timestamp of the data by time formatting, it is also necessary to ensure that all timestamps follow the same format for subsequent processing and analysis. The format used in the embodiment of the present application is the ISO 8601 standard. Then convert the time series data structure, use appropriate tools or programming languages ​​to use the timestamp as an index, and use the data value as the value corresponding to the index. If the data is arranged in chronological order, ensure that this order is maintained during the conversion process. In the embodiment of the present application, the pandas library in Python is used to participate in the conversion. After completing the conversion of the time series data structure, check whether there are missing time points or values ​​in the data. You can choose to fill missing values, ignore missing values, or perform other processing, where the missing values ​​can be filled with the value of the previous time point, the average value, the interpolation, etc. Finally, check the periodicity of the data. If the data is periodic (such as daily, weekly, monthly, etc.), ensure that this is taken into account when converting to time series data, so that the periodic data can be correctly processed in subsequent analysis. After checking the periodicity of the data again, a node time series data set that can participate in anomaly detection is obtained.

[0076] There are two anomaly detection methods provided in the embodiment of the present application, which do not interfere with each other and can be performed in parallel. In this step, a 3sigma algorithm based on an adjustable sliding window and an automatically updated threshold is presented.

[0077] Specifically, the steps of using the 3sigma algorithm to perform anomaly detection include:

[0078] 1) Calculate the mean and standard deviation of the node time series data set;

[0079] 2) The mean plus and minus 3 standard deviations are used as the first threshold range, because according to the 3sigma principle, normal data should fall within the range of plus or minus three standard deviations of the mean, that is, 99.73% of the data should be within this range;

[0080] 3) Provide an adjustable sliding window to continuously detect abnormal data in the node time series data set; wherein, during the detection process, as the node time series data set continues to add new data, the setting of the sliding window size also changes. If the data volume changes quickly, the window size needs to be set smaller; if the data volume changes slowly, the window size can be set larger to adapt to the data volume of the current node time series data set and maintain detection accuracy; in addition, based on the sliding window size, it is also necessary to continuously update the mean and standard deviation, so as to dynamically adjust the first threshold range to adapt to the current sliding window size;

[0081] 4) When it is detected that the data in the sliding window exceeds the first threshold range, the data is marked as abnormal data and recorded in the first abnormality detection result.

[0082] Exemplarily, common sliding window sizes are 5, 10, 30, etc., depending on the sampling frequency of the data and the speed of data volume change. The adjustment of the first threshold range is usually based on the statistical characteristics of historical data, and is adjusted accordingly according to the adjustment trend of historical data to ensure that abnormal situations can be effectively identified.

[0083] The first anomaly detection result obtained can help identify abnormal points that are beyond the normal range, thereby monitoring and warning the operating status of the node.

[0084] Step S2, performing anomaly detection on the node time series data set by using an SR algorithm based on an adjustable sliding window to obtain a second anomaly detection result.

[0085] In the embodiment of the present application, an SR algorithm with an adjustable sliding window is used to detect anomalies in the node time series data set. The SR algorithm is also called a residual spectrum algorithm. In the embodiment of the present application, by combining a convolutional neural network to effectively and continuously monitor time series data, it can suppress the response to frequently occurring features, while being sensitive to features that deviate from the norm, and significantly reflects the presence of abnormal data in normal data, ensuring that abnormal situations can be effectively identified.

[0086] The parameters set in the SR algorithm include the sliding window size and the second threshold. The second threshold and the sliding window size are related to the speed of change of the data volume of the node time series data set. Specifically, if the data volume changes quickly, the window size needs to be set smaller; if the data volume changes slowly, the window size can be set larger. The adjustment of the second threshold is usually based on the statistical characteristics of historical data, and is adjusted accordingly according to the adjustment trend of historical data to ensure that abnormal situations can be effectively identified.

[0087] Furthermore, the SR algorithm and the neural network model are combined to detect anomalies in the node time series data set. In the process of building the neural network model, the Transformer architecture is adopted. The model consists of multiple key components, including an input layer, an embedding layer, multiple feedforward layers, a combination of LayerNorm and residual connection, a multi-head self-attention mechanism, and an output layer. The input layer is responsible for receiving input data into the model. If the amount of input data is relatively limited, the data dimension will be relatively low. The embedding layer is to convert the input data into a high-dimensional embedding expression, which is intended to more effectively capture the intrinsic correlation and interaction between data. The feedforward layer, as the first fully connected layer, is responsible for preliminary feature extraction. In the feature extraction process, ReLU can be selected as the activation function to enhance the nonlinear processing capability of the model. The combination of LayerNorm and residual connection is divided into Layer Normalization and residual connection. LayerNormalization is used after each feedforward layer and self-attention mechanism, which can help accelerate the training process and improve the convergence speed of the model. The residual connection effectively avoids the problem of gradient disappearance and explosion by adding the input directly to the output, thereby improving the stability of the training process and the overall performance of the model. The multi-head self-attention mechanism is the core component of the model, which can capture the global dependencies between input data and improve the model's ability to extract complex features. This mechanism can capture the global dependencies between input data, thereby improving the model's ability to extract features. The output layer appears in the form of a fully connected layer, whose responsibility is to map high-dimensional features back to the target space and output the predicted percentage indicator.

[0088] For example, the embodiment of the present application constructs a neural network model based on CNN, and the model structure is ABCDEFGHI. A is the input layer; B is the embedding layer; C is the feedforward layer 1; D is LayerNorm+residual connection; E is the multi-head self-attention mechanism; F is LayerNorm+residual connection; G is the feedforward layer 2; H is LayerNorm+residual connection; I is the output layer.

[0089] Based on the sliding window and the second threshold set by the SR algorithm, anomaly detection is performed on the node time series data set by combining the SR algorithm and the neural network model to obtain the second anomaly detection result.

[0090] Step S3: Superimpose the first abnormality detection result and the second abnormality detection result to obtain a node fault analysis result.

[0091] First, the first abnormal detection result and the second abnormal detection result are superimposed. A common data superposition method is to merge two or more data sets into one data set. The embodiment of the present application uses a logical operation method for superposition, such as logical AND, logical OR, etc. to combine the two normal detection results to obtain a superposition result.

[0092] Then the superposition results are judged to determine the running status of the node. In order to distinguish and judge the abnormalities after superposition, different status judgment criteria need to be set. Generally, they are determined according to the characteristics of the algorithm and the detection target.

[0093] Exemplarily, the embodiment of the present application sets different state judgment criteria according to each abnormality detection algorithm and the fault type detected by the algorithm. In addition, if the fault types detected by the two algorithms are the same, the same judgment criteria can be used. If they are different, different criteria need to be set for each type, and these differences need to be considered when superimposed. If the fault types detected by the two algorithms are different, then a priority needs to be set for each fault type when making a judgment, and then the final abnormality level is determined based on the priority to ensure that the final judgment can accurately reflect the actual situation.

[0094] In the embodiment of the present application, the first judgment standard is determined according to the fault type detected by the 3sigma algorithm, and the second judgment standard is determined according to the fault type detected by the SR algorithm. Then, the first abnormal detection result in the superposition result is judged according to the first judgment standard, and the second abnormal detection result in the superposition result is judged according to the second judgment standard.

[0095] When the first abnormality detection result and the second abnormality detection result in the superposition result are both normal, the node corresponding to the superposition result is in a normal state; when only one of the first abnormality detection result and the second abnormality detection result in the superposition result is abnormal, the node corresponding to the superposition result is in a first-level abnormal state; when both the first abnormality detection result and the second abnormality detection result in the superposition result are abnormal, the node corresponding to the superposition result is in a second-level abnormal state. Among them, the second-level abnormal state indicates that a more serious fault occurs at the node, which is more serious than the first-level abnormal state and requires emergency treatment.

[0096] It is worth mentioning that in the embodiment of the present application, the purpose of using two anomaly detection algorithms respectively is to improve the accuracy and reliability of anomaly detection. By combining different detection algorithms, the anomalies in the data can be captured more comprehensively, reducing the anomalies that may be missed by a single algorithm. Specifically, the 3sigma algorithm with a sliding window and automatic threshold update can identify anomalies that are beyond the normal range, while the SR algorithm can effectively identify anomalies based on the statistical characteristics of historical data. Superimposing the detection results of these two algorithms can more accurately judge the state of the node, thereby distinguishing between normal state, primary anomaly and secondary anomaly, and improving the accuracy and efficiency of fault detection.

[0097] After determining the operating status of all nodes in the power dispatching system, the node fault analysis results are obtained.

[0098] Optionally, the node fault analysis results can be displayed in the form of a chart or a dashboard.

[0099] Step S4, generating alarm information of the electric power dispatching system according to the node fault analysis result and the preset alarm priority.

[0100] In the embodiment of the present application, an alarm message is first generated for the node in an abnormal state based on the node fault analysis results. Generally, once any abnormality is detected, the system will immediately trigger the alarm mechanism and generate detailed alarm messages, which include not only specific abnormality descriptions, but also key information such as the specific location, time, and severity of the abnormality. These alarm messages will be quickly distributed to relevant operation and maintenance personnel and management through preset communication channels, such as SMS, email, and system pop-up windows, so that they can respond and take measures in a timely manner.

[0101] In order to improve the efficiency of operation and maintenance and enable nodes with more serious faults to be corrected in time, it is also necessary to arrange the order of sending alarm information in combination with the preset alarm priority, and process the alarm information in sequence, and ensure the timeliness of the alarm information by classifying the alarms. The alarm priority will take into account multiple dimensions such as the severity, scope of impact, and urgency of the alarm information for hierarchical processing. For example, for serious faults that may cause equipment shutdown or power grid collapse, the system will mark it as the highest level alarm and give priority to processing. Through alarm classification and priority sorting, it can ensure that operation and maintenance personnel can focus on dealing with the most urgent and important issues, thereby effectively reducing the impact of faults on the power dispatching operation platform.

[0102] Furthermore, in order to improve the efficiency of troubleshooting, after receiving the alarm information, the trained fault relationship analysis model is used to conduct a comprehensive analysis of multiple alarm information, find out the potential correlation and causal relationship between the alarm information, and quickly locate the root cause of the fault based on the relationship between the nodes. For common fault causes, corresponding repair suggestions or solutions can also be given. This can not only shorten the troubleshooting time, but also improve the success rate and efficiency of fault repair.

[0103] After determining the root cause of the fault, the operation and maintenance personnel will take appropriate measures to repair the fault. During this process, the operating status of the relevant nodes can be continuously monitored to ensure the smooth progress of the repair work. Once the fault is repaired, a repair report will be automatically generated and record the entire process of fault occurrence, troubleshooting, and repair. This information is of great reference value for subsequent fault prevention, system optimization, etc. In addition, the repaired nodes will be tracked and observed for a period of time to ensure that the fault will not occur again or cause new problems.

[0104] Implementing the embodiments of the present application has the following beneficial effects:

[0105] This application reduces data redundancy while improving data quality by reducing the dimension and time series conversion of the acquired node operation data, and obtains a node time series data set to provide data support for the subsequent anomaly detection algorithm based on time series data. Then, the 3sigma algorithm and the SR algorithm are used respectively to perform anomaly detection on the node time series data set based on a sliding window with adjustable length, and the first anomaly detection result and the second anomaly detection result are obtained. In order to accurately obtain the operation status information of the node, the two results are superimposed to clarify whether the node fails and the severity of the failure, and the corresponding alarm information is generated, which effectively reduces the multiple alarms of the node and solves the problems of redundant and repeated alarms of alarm information. Then, the alarm information is graded according to the preset alarm priority so that more serious faults can be handled in time. And by analyzing the potential relationship between the alarm information and the node, the root cause of the fault is accurately located, and the success rate and efficiency of fault repair are improved.

[0106] Second embodiment

[0107] Furthermore, in order to execute the fault alarm system of the electric power dispatching system corresponding to the above method embodiment to achieve the corresponding functions and technical effects, Figure 2 A structural diagram of a fault alarm system of a power dispatching system is provided. For ease of description, only the parts related to this embodiment are shown. The fault alarm system of the power dispatching system provided by the embodiment of the present application includes:

[0108] The first anomaly detection result generating module 201 is used to perform anomaly detection on the acquired node time series data set by using a 3sigma algorithm based on an adjustable sliding window to obtain a first anomaly detection result.

[0109] In the embodiment of the present application, node operation data is first collected from each node of the power dispatching system, and the node operation data is preprocessed to improve the data quality. Then, the preprocessed node operation data is converted into a time series structure to obtain a node time series data set.

[0110] Based on the obtained node time series data set, anomaly detection is performed using the 3sigma algorithm to obtain a first anomaly detection result.

[0111] The second anomaly detection result generating module 202 is used to perform anomaly detection on the node time series data set by using an SR algorithm based on an adjustable sliding window to obtain a second anomaly detection result.

[0112] In an embodiment of the present application, the size of the second sliding window of the SR algorithm is adjusted according to the speed of change of the data volume of the node time series data set; based on the second sliding window, the node time series data set is analyzed to obtain a second anomaly detection result.

[0113] The fault analysis module 203 is used to perform superposition determination on the first abnormality detection result and the second abnormality detection result to obtain a node fault analysis result.

[0114] In the embodiment of the present application, the first abnormality detection result and the second abnormality detection result are superimposed by a preset superposition algorithm to obtain the superposition result of each node; and whether the superposition result is normal is judged according to a preset judgment standard. According to different abnormality detection algorithms and different fault types, corresponding abnormality judgment standards are formulated, and then according to the abnormality judgment standards, the corresponding superposition results are judged to obtain the status information of all nodes and the node fault analysis results.

[0115] The alarm information generation module 204 is used to generate alarm information of the power dispatching system according to the node fault analysis results and the preset alarm priority.

[0116] In some embodiments, the first abnormality detection result generating module 201 further includes:

[0117] The data preprocessing unit is used to collect node operation data from each node of the power dispatching system; perform data cleaning, normalization, data denoising, outlier processing and data dimension reduction on the node operation data in sequence to obtain the node operation data after dimension reduction; extract time information from the node operation data after dimension reduction, and perform time series structure conversion on the node operation data after dimension reduction according to the time information to obtain a node time series data set.

[0118] The preprocessing mainly includes data denoising, normalization, outlier processing, data dimension reduction, etc. The specific contents are as follows:

[0119] 1) Data denoising

[0120] Since there may be various noise sources in the power dispatching operation system, such as sensor errors, interference in the data transmission process, etc., these noises will have an adverse effect on subsequent data analysis. Therefore, in the data preprocessing stage, it is necessary to adopt appropriate denoising techniques, such as filtering methods, wavelet transform, etc., to reduce or eliminate the impact of noise on data quality.

[0121] 2) Outlier processing

[0122] There may be some outliers in the collected node operation data, which may be caused by equipment failure, measurement error, or data transmission error. The existence of outliers will interfere with normal detection. Therefore, the embodiment of the present application adopts a statistical method to identify and process these outliers, and then correct them by replacement, deletion, or interpolation.

[0123] 3) Data Dimensionality Reduction

[0124] There are a large number of nodes in the power dispatching and operation system, and each node may contain multiple operating parameters, resulting in very high data dimensions. High-dimensional data not only increases the complexity of data calculation, but also may introduce redundant information and interfere with anomaly detection. Therefore, in the data preprocessing stage, it is necessary to use appropriate dimensionality reduction techniques, such as principal component analysis (PCA), linear discriminant analysis (LDA) or autoencoders, to convert high-dimensional data into low-dimensional representations to retain the main features of the data and remove redundant information.

[0125] Data preprocessing can significantly improve the quality of node operation data and reduce the complexity of subsequent data processing.

[0126] In addition, because the subsequent anomaly detection algorithm is implemented based on time series data, it is also necessary to convert the pre-processed node operation data into a time series structure to obtain a node time series data set. The specific process is: first clean the data and remove duplicate, erroneous or irrelevant records. Make sure that each row or each item of data is associated with a clear time point. Then extract the time information from the cleaned node operation data. If the data already contains a timestamp, use the timestamp directly. If there is no direct timestamp in the data, but information that can be converted to a timestamp is provided (such as a separate field for date and time), merge this information into a complete timestamp. If the time information in the data is ambiguous (such as only date or only time), it is necessary to decide how to fill the missing time part according to the actual situation to obtain the corresponding timestamp. After determining the timestamp of the data by time formatting, it is also necessary to ensure that all timestamps follow the same format for subsequent processing and analysis. The format used in the embodiment of the present application is the ISO 8601 standard. Then convert the time series data structure, use appropriate tools or programming languages ​​to use the timestamp as an index, and use the data value as the value corresponding to the index. If the data is arranged in chronological order, ensure that this order is maintained during the conversion process. In the embodiment of the present application, the pandas library in Python is used to participate in the conversion. After completing the conversion of the time series data structure, check whether there are missing time points or values ​​in the data. You can choose to fill missing values, ignore missing values, or perform other processing, where the missing values ​​can be filled with the value of the previous time point, the average value, the interpolation, etc. Finally, check the periodicity of the data. If the data is periodic (such as daily, weekly, monthly, etc.), ensure that this is taken into account when converting to time series data, so that the periodic data can be correctly processed in subsequent analysis. After checking the periodicity of the data again, a node time series data set that can participate in anomaly detection is obtained.

[0127] Then, anomaly detection is performed on the node time series data set based on the 3sigma algorithm with an adjustable sliding window. The steps of performing anomaly detection using the 3sigma algorithm include:

[0128] 1) Calculate the mean and standard deviation of the node time series data set;

[0129] 2) The mean plus and minus 3 standard deviations are used as the first threshold range, because according to the 3sigma principle, normal data should fall within the range of plus or minus three standard deviations of the mean, that is, 99.73% of the data should be within this range;

[0130] 3) Provide an adjustable sliding window to continuously detect abnormal data in the node time series data set; wherein, during the detection process, as the node time series data set continues to add new data, the setting of the sliding window size also changes. If the data volume changes quickly, the window size needs to be set smaller; if the data volume changes slowly, the window size can be set larger to adapt to the data volume of the current node time series data set and maintain detection accuracy; in addition, based on the sliding window size, it is also necessary to continuously update the mean and standard deviation, so as to dynamically adjust the first threshold range to adapt to the current sliding window size;

[0131] 4) When it is detected that the data in the sliding window exceeds the first threshold range, the data is marked as abnormal data and recorded in the first abnormality detection result.

[0132] Exemplarily, common sliding window sizes are 5, 10, 30, etc., depending on the sampling frequency of the data and the speed of data volume change. The adjustment of the first threshold range is usually based on the statistical characteristics of historical data, and is adjusted accordingly according to the adjustment trend of historical data to ensure that abnormal situations can be effectively identified.

[0133] The first anomaly detection result obtained can help identify abnormal points that are beyond the normal range, thereby monitoring and warning the operating status of the node.

[0134] In some embodiments, the second abnormality detection result generating module 202 further includes:

[0135] The parameters usually set in the SR algorithm include the sliding window size and the second threshold. The second threshold and the sliding window size are related to the speed of change of the data volume of the node time series data set. Specifically, if the data volume changes quickly, the window size needs to be set smaller; if the data volume changes slowly, the window size can be set larger. The adjustment of the second threshold is usually based on the statistical characteristics of historical data, and is adjusted accordingly according to the adjustment trend of historical data to ensure that abnormal situations can be effectively identified.

[0136] Furthermore, the SR algorithm and the neural network model are combined to detect anomalies in the node time series data set. In the process of building the neural network model, the Transformer architecture is adopted. The model consists of multiple key components, including an input layer, an embedding layer, multiple feedforward layers, a combination of LayerNorm and residual connection, a multi-head self-attention mechanism, and an output layer. The input layer is responsible for receiving input data into the model. If the amount of input data is relatively limited, the data dimension will be relatively low. The embedding layer is to convert the input data into a high-dimensional embedding expression, which is intended to more effectively capture the intrinsic correlation and interaction between data. The feedforward layer, as the first fully connected layer, is responsible for preliminary feature extraction. In the feature extraction process, ReLU can be selected as the activation function to enhance the nonlinear processing capability of the model. The combination of LayerNorm and residual connection is divided into Layer Normalization and residual connection. LayerNormalization is used after each feedforward layer and self-attention mechanism, which can help accelerate the training process and improve the convergence speed of the model. The residual connection effectively avoids the problem of gradient disappearance and explosion by adding the input directly to the output, thereby improving the stability of the training process and the overall performance of the model. The multi-head self-attention mechanism is the core component of the model, which can capture the global dependencies between input data and improve the model's ability to extract complex features. This mechanism can capture the global dependencies between input data, thereby improving the model's ability to extract features. The output layer appears in the form of a fully connected layer, whose responsibility is to map high-dimensional features back to the target space and output the predicted percentage indicator.

[0137] Finally, based on the sliding window and the second threshold set by the SR algorithm, the node time series data set is subjected to anomaly detection by combining the SR algorithm with the neural network model to obtain the second anomaly detection result.

[0138] In some embodiments, the fault analysis module 203 further includes:

[0139] First, the first abnormal detection result and the second abnormal detection result are superimposed. A common data superposition method is to merge two or more data sets into one data set. The embodiment of the present application uses a logical operation method for superposition, such as logical AND, logical OR, etc. to combine the two normal detection results to obtain a superposition result.

[0140] Then the superposition results are judged to determine the running status of the node. In order to distinguish and judge the abnormalities after superposition, different status judgment criteria need to be set. Generally, they are determined according to the characteristics of the algorithm and the detection target.

[0141] Exemplarily, different state judgment criteria can be set according to each anomaly detection algorithm and the type of fault detected by the algorithm. In addition, if the fault types detected by the two algorithms are the same, the same judgment criteria can be used. If they are different, different criteria need to be set for each type, and these differences need to be considered when superimposed. If the fault types detected by the two algorithms are different, then a priority needs to be set for each fault type when making the judgment, and then the final anomaly level is determined based on the priority to ensure that the final judgment can accurately reflect the actual situation.

[0142] Optionally, a first judgment standard is determined according to the fault type detected by the 3sigma algorithm; a second judgment standard is determined according to the fault type detected by the SR algorithm. Then, the first abnormal detection result in the superposition result is judged according to the first judgment standard, and the second abnormal detection result in the superposition result is judged according to the second judgment standard.

[0143] When the first abnormality detection result and the second abnormality detection result in the superposition result are both normal, the node corresponding to the superposition result is in a normal state; when only one of the first abnormality detection result and the second abnormality detection result in the superposition result is abnormal, the node corresponding to the superposition result is in a first-level abnormal state; when both the first abnormality detection result and the second abnormality detection result in the superposition result are abnormal, the node corresponding to the superposition result is in a second-level abnormal state. Among them, the second-level abnormal state indicates that a more serious fault occurs at the node, which is more serious than the first-level abnormal state and requires emergency treatment.

[0144] After determining the operating status of all nodes in the power dispatching system, the node fault analysis results are obtained.

[0145] Optionally, the node fault analysis results can be displayed in the form of a chart or a dashboard.

[0146] In some embodiments, the warning information generation module 204 further includes:

[0147] An alarm information generation unit is used to generate alarm information of a node in an abnormal state according to a node fault analysis result, determine the abnormal level of the node in an abnormal state according to the alarm priority, sort the alarm information according to the abnormal level, and process the alarm information in sequence according to the sorting result.

[0148] Among them, in order to improve the efficiency of operation and maintenance, so that nodes with more serious faults can be corrected in time, it is also necessary to arrange the order of sending alarm information in combination with the preset alarm priority, and process the alarm information in sequence, and ensure the timeliness of the alarm information by classifying the alarm. The alarm priority will take into account multiple dimensions such as the severity, scope of impact, and urgency of the alarm information for hierarchical processing. For example, for serious faults that may cause equipment shutdown or power grid collapse, the system will mark it as the highest level alarm and give priority to processing. Through alarm classification and priority sorting, it can ensure that operation and maintenance personnel can focus on dealing with the most urgent and important problems, thereby effectively reducing the impact of faults on the power dispatching operation platform.

[0149] The fault location unit is used to perform a comprehensive analysis on multiple alarm information using a trained fault relationship analysis model after receiving the alarm information, find out the potential correlation and causal relationship between the alarm information, and quickly locate the root cause of the fault based on the relationship between the nodes.

[0150] The fault repair unit is used to determine the root cause of the fault, and the operation and maintenance personnel will take appropriate measures to repair the fault. During this process, the operating status of the relevant nodes can be continuously monitored to ensure the smooth progress of the repair work. Once the fault is repaired, a repair report will be automatically generated and record the entire process of fault occurrence, troubleshooting, and repair.

[0151] Implementing the embodiments of the present application has the following beneficial effects:

[0152] The embodiment of the present application first pre-processes the acquired node operation data, significantly improves the quality of the operation data in the power dispatching operation platform, and then converts the node operation data into a node time series data set of the time series type, so that the abnormality detection algorithm can correctly process the periodic data in the subsequent analysis. Then, the 3sigma algorithm and the SR algorithm based on the adjustable sliding window are used to perform abnormality detection on the node time series data set, respectively, to obtain the first abnormality detection result and the second abnormality detection result, and then the two abnormality detection results are superimposed to make a more accurate and rigorous judgment on the abnormal situation of the node, so as to avoid repeated alarms or missing abnormal situations, and to grade the abnormal situation of the node. According to the level of the abnormal situation, the node fault analysis results and the preset alarm priority, the alarm information is prioritized to ensure that more serious abnormal situations can be resolved first and the timeliness of the alarm is achieved.

[0153] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of protection of the present application.

Claims

1. A fault alarm method for a power dispatching system, characterized in that: include: Anomaly detection is performed on the acquired node time series data set by using a 3sigma algorithm based on an adjustable sliding window to obtain a first anomaly detection result; Performing anomaly detection on the node time series data set by using an SR algorithm based on an adjustable sliding window to obtain a second anomaly detection result; The first abnormality detection result and the second abnormality detection result are superimposed and determined to obtain a node fault analysis result; Generate alarm information for the power dispatching system based on the node fault analysis results and the preset alarm priority.

2. The fault alarm method of the electric power dispatching system according to claim 1, characterized in that: The node time series data set is specifically: Collect node operation data from various nodes in the power dispatching system; The node operation data is sequentially cleaned, normalized, denoised, processed for outliers, and reduced in dimension to obtain the node operation data after dimension reduction; The time information is extracted from the node operation data after dimension reduction, and the time series structure of the node operation data after dimension reduction is converted according to the time information to obtain a node time series data set.

3. The fault alarm method of the electric power dispatching system according to claim 1, characterized in that: The first anomaly detection result is obtained by performing anomaly detection on the node time series data set through the 3sigma algorithm based on the adjustable sliding window, specifically: Calculate the mean and standard deviation of the node time series data set; Determine a first threshold range according to the principle of the 3sigma algorithm, the mean and the standard deviation; The node time series data set is analyzed according to the first threshold range and the first sliding window of the 3sigma algorithm to obtain a first anomaly detection result.

4. The fault alarm method of the electric power dispatching system according to claim 3, characterized in that: The step of analyzing the node time series data set according to the first threshold range and the first sliding window of the 3sigma algorithm to obtain a first anomaly detection result further includes: Adjusting the size of the first sliding window according to the data change speed of the node time series data set; Updating the first threshold range according to the size of the first sliding window; When the data in the first sliding window exceeds the first threshold range, it is marked as abnormal data; A first abnormality detection result is obtained according to the abnormal data.

5. The fault alarm method of the electric power dispatching system according to claim 1, characterized in that: The second anomaly detection result is obtained by performing anomaly detection on the node time series data set through the SR algorithm based on the adjustable sliding window, specifically: Adjusting the size of the second sliding window of the SR algorithm according to the data change speed of the node time series data set; The node time series data set is analyzed according to the second sliding window and a preset second threshold range to obtain a second anomaly detection result.

6. The fault alarm method of the electric power dispatching system according to claim 1, characterized in that: The first abnormality detection result and the second abnormality detection result are superimposed and determined to obtain a node fault analysis result, specifically: The first anomaly detection result and the second anomaly detection result are superimposed by a preset superposition algorithm to obtain a superposition result of each node; Determining whether the superposition result is normal according to a preset judgment standard; When the first abnormality detection result and the second abnormality detection result in the superposition result are both normal, the node corresponding to the superposition result is in a normal state; When only one of the first abnormal detection result and the second abnormal detection result in the superposition result is abnormal, the node corresponding to the superposition result is in a first-level abnormal state; When the first abnormality detection result and the second abnormality detection result in the superposition result are both abnormal, the node corresponding to the superposition result is in a secondary abnormal state; According to the status information of all nodes, the node fault analysis results are obtained.

7. The fault alarm method of the electric power dispatching system according to claim 6, characterized in that: The method of judging whether the superposition result is normal according to the preset judgment standard is as follows: Determining a first judgment criterion according to the fault type detected by the 3sigma algorithm; Determining a second judgment criterion according to the fault type detected by the SR algorithm; Determining a first abnormality detection result in the superposition result according to a first judgment criterion; The second abnormality detection result in the superposition result is judged according to a second judgment standard.

8. The fault alarm method of the electric power dispatching system according to claim 1, characterized in that: The generating of the alarm information of the power dispatching system according to the node fault analysis result and the preset alarm priority is specifically: Generate alarm information for nodes in abnormal state based on the node fault analysis results. Determining the abnormality level of the node in the abnormal state according to the alarm priority; The alarm information is sorted according to the abnormality level, and the alarm information is processed in sequence according to the sorting result.

9. The fault alarm method of the electric power dispatching system according to any one of claims 1 to 8, characterized in that: Also includes: Input the alarm information into a preset fault relationship analysis model, and locate the root cause of the fault through the relationship between nodes; The fault is repaired according to the root cause of the fault, and a corresponding repair report is generated.

10. A fault alarm system for a power dispatching system, characterized in that: include: A first abnormality detection result generating module, a second abnormality detection result generating module, a fault analysis module and an alarm information generating module; The first anomaly detection result generating module is used to perform anomaly detection on the node time series data set by using a 3sigma algorithm based on an adjustable sliding window to obtain a first anomaly detection result; The second anomaly detection result generating module is used to perform anomaly detection on the node time series data set by using an SR algorithm based on an adjustable sliding window to obtain a second anomaly detection result; The fault analysis module is used to perform superposition determination on the first abnormality detection result and the second abnormality detection result to obtain a node fault analysis result; The alarm information generation module is used to generate alarm information of the power dispatching system according to the node fault analysis result and the preset alarm priority.

Images