Automatic power generation control application safety anti-error method and system

Abstract

The invention discloses an automatic power generation control application safety anti-error method and system, and belongs to the field of power system active power automatic control. The method and the system aim at solving the problem that after automatic control of a new energy station and an energy storage access master station, a traditional automatic power generation control function is insufficient in anti-misoperation capability, and power grid operation abnormity is easily caused. A targeted anti-error strategy is designed from multiple dimensions such as control model abnormity anti-error, measurement data abnormity anti-error, control strategy abnormity anti-error, interface operation safety anti-error, main / standby switching safety anti-error, operation state safety anti-error and external system abnormity safety anti-error, so that the safety anti-error capability of the automatic power generation control function is effectively improved; and the power grid operation safety level is improved.

Description

Technical Field

[0001] The present invention belongs to the field of active power control of power systems, and particularly relates to a safety anti-error method and system applicable to automatic generation control applications. Background Art

[0002] With the continuous expansion of the power grid scale, large-scale centralized access of new energy, and the increasing complexity of the power grid structure, the safe operation of power grid regulation faces severe challenges. The Automatic Generation Control (AGC) system, as the core support system for power grid operation control and dispatching production management, its stability and reliability are crucial for the safe operation of power grid regulation. The AGC master station system involves many links, strong equipment correlation, and high real-time requirements. The reliability problem of any link will affect the safety and function use of the system. Once the AGC master station system fails, it will affect the normal development of power grid real-time monitoring services at least, and may endanger the safe and stable operation of the power grid at worst.

[0003] Enterprise standards such as the enterprise standard of the State Grid Corporation of China, "Q / GDW 680.43-2011 Smart Grid Dispatching Technical Support System 4-3 Grid Automatic Control", etc., have put forward relevant requirements for the technical functions and safety anti-error of the conventional AGC function, and have standardized the measurement anomaly handling and unit anti-error strategies of AGC. However, with the continuous construction of the new power system, in order to meet the regulation business requirements such as new energy consumption, power grid safety guarantee, and power market implementation, new resources such as new energy power stations and energy storage have been successively incorporated into the AGC control scope. New resources such as new energy power stations and energy storage have characteristics such as large control capacity, high action frequency, fast regulation rate, many control objects, and high modification frequency, resulting in the fact that the traditional anti-error methods and strategies applicable to conventional units can no longer meet the safety operation requirements of AGC under the new situation, leading to the prominent risk of abnormal AGC control and affecting the safe and stable operation of the power grid. It is urgent to optimize and improve the safety anti-error strategy of AGC and improve the safety operation level of AGC. Summary of the Invention

[0004] In order to improve the safety operation level of AGC under the new situation, the present invention proposes a safety anti-error method and system for automatic generation control applications, which can effectively improve the safety anti-error ability of AGC and enhance the safety level of power grid operation through multi-dimensional targeted anti-error strategies.

[0005] In order to achieve the above invention purpose, the present invention adopts the following technical solutions:

[0006] In the first aspect, a safety anti-error method for automatic generation control applications includes the following steps:

[0007] Perform model anti - error verification. After the automatic generation control (AGC) system is generated, for any modification of the control parameters or control models, first verify in the model verification library. If it is qualified, introduce it into the real - time operation library; if it is unqualified, give an alarm for model abnormality and do not introduce AGC real - time control.

[0008] Perform anti - error for abnormal measurement data. Configure multiple measurement points for the core control measurement data of automatic generation. Each measurement point is configured with multiple anti - error strategies. When one measurement point is invalid, automatically switch to the next available measurement point. If all measurement points of a measurement are invalid, then determine that the measurement is invalid, and according to different invalid measurement situations, make AGC or the unit enter a pause state.

[0009] Adopt a multi - dimensional anti - error mechanism to perform anti - error for abnormal control strategies. Based on the grid frequency obtained in real - time, the overall regulation deviation of the control instruction, the total change in new - energy power output, the deviation between the regulation direction of the control object and the target direction, and the prohibited regulation standard and safe regulation range conditions of the control object, determine whether to issue a control instruction or pause the control of the control object.

[0010] Perform anti - error for interface operations. Verify the operation permissions, modification of control parameters, and modification of control targets of users on the function interface, and reject operations that do not meet the conditions.

[0011] Adopt the method of master - standby coordination and master - standby machine consistency verification to perform anti - error for the safety of master - standby coordination and master - standby machine switching. Compare the calculation results of the master - standby machines and the master - standby coordinated main machines in real - time, judge the abnormal operation situation, and do not switch to an unavailable standby machine or standby coordination.

[0012] Perform anti - error for status safety according to the process running status and resource occupation. According to the exit situation of the core process, the consistency with the model library version, and the resource occupation of the core process, judge whether the function is abnormal and whether to exit the automatic generation control function.

[0013] Perform anti - error for external system abnormalities. When the host machine time jumps, or the message bus or service bus of the dispatching control system basic platform is abnormal, the automatic generation control function automatically exits the control.

[0014] Furthermore, the real - time operation library is used for saving the intermediate calculation results and displaying the control results during the AGC real - time control process; the model verification library is used for the temporary storage and validity verification of the AGC application function during the modification of interface parameters and control models; the initial values of the control model and the parameters are saved in the initial model library when the automatic generation control system is generated.

[0015] Furthermore, the core measurement data for automatic power generation control includes grid frequency, tie-line power, tie-line exchange plan, and active power of generating units; the anti-error strategies include abnormal measurement quality status, large measurement deviation abnormality, measurement data jump abnormality, and measurement non-change abnormality.

[0016] Furthermore, the multi-dimensional anti-error mechanism is specifically as follows: Based on the grid frequency obtained in real-time by automatic generation control, when the grid frequency is higher than the warning threshold for high frequency deviation, all commands to increase output are not issued; when the grid frequency is lower than the low frequency threshold, all commands to reduce output are not issued; when the automatic generation control function issues control commands, if the overall adjustment deviation of all commands exceeds the specified threshold, it is determined that the command issuance is abnormal and all commands are not issued; when the automatic generation control function calculates control commands, if the total addition of new energy power output jumps by more than the specified threshold, it is determined that the overall data measurement is abnormal and control commands are not issued; when the automatic generation control function issues control commands to a control object, if the adjustment direction of the control object is opposite to the control target direction by more than the specified threshold, it is determined that the adjustment of the control object is abnormal and the control of the control object is automatically suspended; when the automatic generation control function issues control commands to control objects such as conventional units and new energy power stations, the prohibited adjustment standard and safe adjustment range of the control object are considered, and control commands that affect the safe operation of the control object are not issued.

[0017] Furthermore, the specific steps for preventing errors in interface operations are as follows: When a user operates on the function interface, it is judged whether the user has the operation authority, and operations without operation authority are refused to be executed; when a user modifies control parameters on the function interface, model linkage verification is performed to judge whether the parameter modification affects other control parameters. If the model linkage verification fails, it is refused to be executed; when a user modifies the control target on the function interface, it is judged whether the control target is within a reasonable range. If it is not within the reasonable range, it is judged that the model modification is abnormal and refused to be executed.

[0018] Further, the specific method for the consistency check of the primary and standby regulators and the primary and standby machines is as follows: During the operation of the automatic generation control function, the calculation results of the function host and the standby machine are compared in real time. If the key calculation results of the standby machine are inconsistent with those of the host, it is determined that the automatic generation control function of the standby machine is operating abnormally; During the operation of the automatic generation control function, the calculation results of the function host of the primary regulation system and the function host of the standby regulation system are compared in real time. If the key calculation results of the automatic generation control function of the standby regulation host are inconsistent with those of the primary regulation host, it is determined that the automatic generation control function of the standby regulation is operating abnormally; When the primary and standby machines need to be switched during the daily operation and maintenance and abnormal conditions of the automatic generation control function, if the standby machine is determined to be unavailable, it cannot be switched to the host; When the primary and standby regulations need to be switched during the daily operation and maintenance and abnormal conditions of the automatic generation control function, if the standby regulation is determined to be unavailable, the automatic generation control function switch between the primary and standby regulations cannot be performed.

[0019] Further, the specific judgment conditions for the operation status safety error prevention are as follows: When the core process of the automatic generation control function frequently exits abnormally and the core process is inconsistent with the corresponding model library version, it is judged that the function is abnormal and the automatic generation control function exits automatically; When the core process of the automatic generation control function occupies the CPU exceeding the specified threshold, occupies the machine memory exceeding the specified threshold, and the number of file handles occupied exceeds the specified threshold, it is judged that the core process is operating abnormally and the automatic generation control function exits automatically.

[0020] Further, the specific triggering conditions for the external system abnormal safety error prevention are as follows: When the machine time of the host where the automatic generation control function is running jumps by more than the specified duration, it is judged that the machine running time is abnormal and the automatic generation control function exits the control automatically; When the message bus of the basic platform of the dispatching control system is abnormal, the automatic generation control function exits the control automatically; When the service bus of the basic platform of the dispatching control system is abnormal, the automatic generation control function exits the control automatically.

[0021] Further, the method is implemented based on a pre-established AGC control area, which is an area established in the power grid dispatching control center for closed-loop control of power grid units and facilities within a specified range in response to the frequency and tie-line control requirements of the new energy power grid.

[0022] In the second aspect, an automatic generation control application safety error prevention system includes:

[0023] A model error prevention verification module for performing model error prevention verification. After the automatic generation control (AGC) system is generated, for any modification of the control parameters or control models, it is first verified in the model verification library. If it is qualified, it is introduced into the real-time operation library; if it is unqualified, a model abnormal alarm is given and it is not introduced into the AGC real-time control.

[0024] The measurement data anomaly prevention and error - proof module is used for preventing and error - proofing measurement data anomalies. Multiple measurement points are configured for the core control measurement data of automatic power generation. Each measurement point is configured with multiple anti - error strategies. When a measurement point is invalid, it automatically switches to the next available measurement point. If all measurement points of a measurement are invalid, it is determined that the measurement is invalid, and the AGC or the unit enters a suspension state according to different measurement invalid situations;

[0025] The control strategy anomaly prevention and error - proof module is used for preventing and error - proofing control strategy anomalies by adopting a multi - dimensional anti - error mechanism. Based on the grid frequency obtained in real - time, the overall regulation deviation of the control instruction, the total addition change of new energy power output, the deviation between the regulation direction and the target direction of the control object, and the prohibited regulation standard and safe regulation range conditions of the control object, it determines whether to issue a control instruction or suspend the control of the control object;

[0026] The interface operation prevention and error - proof module is used for preventing and error - proofing interface operations. It verifies the operation permissions, control parameter modifications, and control target modifications of users on the function interface, and rejects operations that do not meet the conditions;

[0027] The primary - standby switching prevention and error - proof module is used for ensuring the safety of primary - standby reconciliation and primary - standby machine switching by adopting the methods of primary - standby reconciliation and primary - standby machine consistency verification. It compares the calculation results of the primary and standby machines and the primary - standby regulating host in real - time, judges the abnormal operation situation, and does not perform switching for unavailable standby machines or standby regulators;

[0028] The operation status safety prevention and error - proof module is used for preventing and error - proofing status safety according to the process operation status and resource occupancy. According to the exit situation of the core process, the consistency with the model library version, and the resource occupancy of the core process, it judges whether the function is abnormal and whether to exit the automatic power generation control function;

[0029] The external system anomaly prevention and error - proof module is used for preventing and error - proofing external system anomalies. When the host machine time jumps, or the message bus or service bus of the dispatching control system basic platform is abnormal, the automatic power generation control function automatically exits the control.

[0030] Thirdly, a computer device includes: one or more processors; a memory; and one or more programs, where the one or more programs are stored in the memory and are configured to be executed by the one or more processors. When the program is executed by the processor, it implements the automatic power generation control application safety prevention and error - proof method as described in the first aspect of the present invention.

[0031] Fourthly, a computer - readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements the automatic power generation control application safety prevention and error - proof method as described in the first aspect of the present invention.

[0032] Compared with the prior art, the present invention has the following beneficial effects: (1) A comprehensive safety anti-error scheme for the AGC system design of the power grid dispatching control center is proposed, which takes into account various factors such as power grid frequency, tie-line control, and multiple types of power sources, as well as safety anti-error in different links. It has macroscopicity and systematicness, can achieve unified management and coordinated control of the entire AGC control area, and ensure the stable operation of the power grid. (2) A multi-dimensional anti-error system is constructed. From the perspective of power grid operation, based on frequency thresholds and multi-source measurement point configurations, the power grid frequency is stabilized, accurate measurement data is ensured, and a solid foundation is laid for control decisions; in terms of control instructions, a multi-dimensional verification mechanism prevents the issuance of abnormal instructions and takes into account equipment safety; in operation management, interface operation anti-error and primary / backup switchover verification avoid human errors and primary / backup switchover risks; at the operation and maintenance level, real-time monitoring of the operation status and an abnormal response mechanism for external systems help to promptly discover and solve problems, reduce operation and maintenance costs, and shorten the fault handling time, comprehensively ensuring the stable and efficient operation of the system. (3) Detailed regulations and specific operation methods are given for each link of safety anti-error, including not only anti-error rules but also specific measures to ensure the safe operation of the system from different aspects, such as model verification and abnormal measurement data processing. It has strong operability and improves the safety anti-error level of the AGC system itself by controlling the details inside the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 is a flowchart of the safety anti-error method for the automatic generation control application provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0034] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings.

[0035] The present invention aims to provide a security anti-misoperation scheme for automatic generation control applications in power grid dispatching and control. Generally speaking, the premise and foundation of the overall automatic generation control function is to establish an automatic generation control (AGC) control area. The AGC control area divides the power system into multiple relatively independent areas, and the power generation and load demand within each area need to be balanced. By establishing the AGC control area, the control scope and responsibilities of each area can be clarified, which is convenient for the effective management and control of the power system. For example, a large power system may be divided into several AGC control areas according to factors such as geographical location, grid structure, and load characteristics, and each control area is responsible for maintaining the power supply and demand balance within its own area. In response to the frequency and tie-line control requirements of a high-proportion new energy power grid, the present invention first establishes an AGC control area in the power grid dispatching control center (referred to as the dispatching center), which is mainly responsible for implementing closed-loop control of conventional thermal power units, centralized and distributed new energy power stations, and various types of energy storage within the scope of dispatching management. Then, a corresponding control anti-misoperation model is designed based on the AGC control area. That is, the proposed security anti-misoperation method for automatic generation control applications is carried out based on the AGC control area.

[0036] Referring to Figure 1 , an embodiment of the present invention provides a security anti-misoperation method for automatic generation control applications, including the following steps:

[0037] Step S1, perform anti-misoperation verification on the automatic generation control function model. This anti-misoperation strategy adopts a three-layer library redundant storage and security verification mechanism. The three-layer library includes:

[0038] An initial model library, which is used to save the control model and initial parameters when the system is generated;

[0039] A real-time operation library, which is used to save the intermediate calculation results and display the control results during the AGC real-time control process;

[0040] A model verification library, which is used for the temporary storage and validity verification of the automatic generation control application function when the interface parameters are modified and the control model is modified.

[0041] Based on the three-layer library redundancy mode of the automatic generation control function, after the system generation of the automatic generation control is completed, when the control parameters are manually modified on the interface or the AGC control model is modified using the model modification tool provided by the dispatching system platform, first perform model verification on the modified parameters and model based on the model verification library. The control parameters and models that pass the verification can be introduced into the real-time operation library, otherwise, a model exception alarm is given to ensure that incorrect models and parameters are not introduced into the AGC real-time control.

[0042] Suppose that after the staff manually modifies the control parameters on the interface, the system verifies the modified parameters according to the model verification library. For example, if the power adjustment parameters of a certain unit are modified, the model verification library will check whether the parameters are within a reasonable range and whether they match other relevant parameters according to the preset rules and algorithms. If the verification is qualified, the parameters will be introduced into the real-time operation library; if not, the system will give an alarm for model abnormality.

[0043] Step S2: Carry out error prevention for abnormal measurement data in automatic generation control, and adopt multi-data source measurement point configuration and safety verification error prevention strategies, including:

[0044] (21) Configure multiple (for example, 3) multi-source measurement points for the core measurement data of automatic generation control. The core measurement data of automatic generation control includes: grid frequency, tie-line power, tie-line exchange plan, and active power of the generator set;

[0045] (22) For any measurement point, configure error prevention strategies such as abnormal measurement quality bit, large measurement deviation abnormality, measurement data jump abnormality, and measurement non-change abnormality;

[0046] Abnormal measurement quality bit: The measurement quality bit is a flag bit used to represent the quality status of measurement data. By monitoring the measurement quality bit, if it shows abnormality, it indicates that there may be problems with the data quality. For example, the data may be invalid, unreliable, or incorrect data caused by equipment failures, communication problems, etc. For example, when the sensor fails, the corresponding measurement quality bit may be set to abnormal, prompting relevant personnel that the data at this measurement point is not trustworthy and needs to be checked and repaired.

[0047] Large measurement deviation abnormality: This strategy compares the current measurement value with the values of other relevant measurement points at this measurement point. If the deviation between these measurement values exceeds the set threshold, it is considered that there is a large measurement deviation abnormality. For example, under normal operation conditions, at a certain moment, the value of the main frequency measurement point is 50.033Hz, while the value of the standby measurement point is 49.975Hz. If the deviation of the frequency measurement point values at different locations does not conform to the actual situation of power grid operation, it may trigger a large measurement deviation abnormality, which may be due to measurement equipment failure or other reasons resulting in incorrect data.

[0048] Measurement data jump anomaly: Mainly focus on the changes in measurement data between adjacent moments. When the data shows discontinuous and sudden large changes, and the change amplitude exceeds the normal fluctuation range, it will trigger the measurement data jump anomaly. For example, if the measured value of the power grid frequency suddenly jumps from 50.00Hz to 49.5Hz in a short time and then immediately jumps back to 50.00Hz, this rapid jump that does not conform to physical laws is likely to be a problem with the measurement system, such as sensor interference or errors during data transmission, and it needs to be checked and processed in a timely manner.

[0049] Measurement non - change anomaly: It refers to the situation where measurement data remains unchanged for a period of time, while according to the actual operating conditions, this data should be dynamically changing. For example, during the operation of the power grid, the output of a generator will be adjusted according to the change in load. If the measured value of the output of a certain generator remains fixed for a long time while the load situation of the power grid has changed significantly, then it can be judged that there is a measurement non - change anomaly. This may be due to the measurement device getting stuck or a malfunction in the data acquisition system, resulting in the inability to obtain real - time data normally.

[0050] (23) When any one measurement of a certain measurement point is invalid, it automatically switches to the next available measurement point. When all measurement points of a measurement are invalid, it automatically determines that the measurement is invalid. If any one of the measurements of frequency, tie - line power, or tie - line plan is invalid, AGC automatically enters the pause state and does not issue control commands; when the measurement of the generator output is invalid, the generator unit (power station) automatically enters the pause mode.

[0051] Taking the frequency measurement as an example, 3 multi - source measurement points are configured. If one of the measurement points has an abnormal measurement quality bit due to equipment failure, the system will automatically switch to the next available measurement point to obtain frequency data. If all three measurement points are invalid for some reason, such as communication failure resulting in abnormal data transmission, the system will determine that the frequency measurement is invalid. At this time, AGC automatically enters the pause state and no longer issues control commands to prevent control operations based on incorrect frequency data.

[0052] Step S3, carry out anti - error prevention for the control strategy of automatic generation control, and adopt multi - dimensional anti - error mechanisms such as grid frequency, abnormal regulation and control limits of generator units (power stations), including:

[0053] (31) Based on the grid frequency obtained in real - time by automatic generation control, when the grid frequency is higher than the frequency - high warning threshold (for example, 50.05Hz), no commands to increase output will be issued; when the grid frequency is lower than the frequency - low threshold (for example, 49.95Hz), no commands to reduce output will be issued;

[0054] (32) When the automatic generation control function issues control instructions, if the overall adjustment deviation of all instructions exceeds the specified threshold (e.g., 1000 MW), it is judged that the instruction issuance is abnormal, and all instructions are not issued;

[0055] (33) When the automatic generation control function calculates control instructions, if the total addition of new energy power output jumps (i.e., the actual output change between the previous and the next two cycles) exceeds the specified threshold (e.g., 1000 MW), it is judged that the overall data measurement is abnormal, and no control instructions are issued;

[0056] (34) When the automatic generation control function issues control instructions to a control object, if the adjustment direction of the control object is reverse to the control target direction and exceeds a certain threshold (e.g., 10 MW), it is judged that the adjustment of the control object is abnormal, and the control of the control object is automatically suspended.

[0057] (35) When the automatic generation control function issues control instructions to control objects such as conventional units and new energy power stations, it is necessary to consider the prohibited adjustment standard and the safe adjustment range of the control object, and no control instructions that affect the safe operation of the control object are issued.

[0058] As an example, when the grid frequency is higher than the high-frequency warning threshold, such as when the grid frequency reaches 50.5 Hz (assuming the high-frequency warning threshold is 50.3 Hz), in order to prevent the system frequency from rising further, all instructions to increase output are not issued. When issuing control instructions to a certain conventional unit, if considering the current operating state of the unit, its safe adjustment range is 30% - 80% of the rated power, then the system will not issue control instructions that make the unit output exceed this range to ensure the safe operation of the unit.

[0059] Step S4, perform anti-misoperation for the interface operation of the automatic generation control function, including:

[0060] (41) When the user operates on the function interface, it is necessary to first judge whether the user has the operation authority, and the operation without operation authority is refused to be executed;

[0061] (42) When the user sets control parameters on the function interface, model linkage verification is required to judge whether the parameter modification affects other control parameters. If the model linkage verification fails, it is refused to be executed;

[0062] (43) When the user modifies the control target on the function interface, it is necessary to judge whether the control target is within a reasonable range. If it is not within the reasonable range, it is judged that the model modification is abnormal, and it is refused to be executed.

[0063] For example, if an ordinary operation and maintenance personnel attempts to modify some control parameters on the function interface that can only be operated by senior administrators, the system will first determine that the user does not have the operation authority and reject the execution of the operation. When the user modifies a certain control parameter, such as modifying the active power setting value of the unit, the system will perform model linkage verification to check whether the parameter modification will affect other relevant control parameters, such as reactive power, voltage, etc. If it is found that the modification will cause abnormalities in other parameters, the operation will be rejected.

[0064] Step S5, carry out the safety anti-misoperation of the main and standby regulation and the main and standby machine switching of the automatic generation control function, and adopt the method of consistency verification of the main and standby regulation and the main and standby machines to ensure the safety anti-misoperation during the automatic switching of the main and standby regulation and the main and standby machines.

[0065] In the power dispatching system, in order to effectively respond to possible abnormal conditions in the dispatching system and ensure the normal monitoring and control of the power grid by the dispatching agency, the power dispatching agency adopts the "1:1" configuration principle to build two complete and independent dispatching systems: the main dispatching system and the standby dispatching system. The main dispatching system, as the core system for daily operation, undertakes key tasks such as real-time monitoring of the power grid operation status and execution of various dispatching control instructions; the standby dispatching system is in a hot standby state and is ready to seamlessly take over the work of the main dispatching system at any time when the main dispatching system fails or is abnormal, ensuring the continuity and stability of the power dispatching business.

[0066] Within a single dispatching system, the automatic generation control (AGC) function is based on the redundant design concept and is deployed on two servers, which are respectively defined as the main machine and the standby machine. The main machine and the standby machine run exactly the same AGC function program and synchronize data in real time to ensure the consistency of their states. During normal operation, the main machine undertakes the main operation and control tasks of the AGC function, and the standby machine is in a state of real-time monitoring and hot standby. Once the main machine experiences abnormal situations such as hardware failures, software errors, communication interruptions, etc., the system will immediately trigger the automatic switching mechanism, quickly promote the standby machine to the main machine, and continue to execute the AGC function to maintain the stable operation and power balance of the power system. This combination of the main and standby dispatching systems and the main and standby machine configurations greatly improves the reliability, stability, and fault tolerance of the power dispatching system and the AGC function.

[0067] Specifically, the method of consistency verification of the main and standby regulation and the main and standby machines of the present invention includes:

[0068] (51) During the operation of the automatic generation control function, the calculation results of the function main machine and the standby machine are compared in real time. If the key calculation results of the standby machine (such as grid frequency, area control deviation of the grid, etc.) are inconsistent with the calculation results of the main machine, it is determined that the operation of the automatic generation control function of the standby machine is abnormal;

[0069] (52) During the operation of the automatic generation control function, the calculation results of the function host of the main dispatching system and the function host of the standby dispatching system are compared in real time. If the key calculation results of the automatic generation control function of the standby host (such as grid frequency, area control deviation of the power grid, etc.) are inconsistent with the calculation results of the main host, it is determined that the operation of the automatic generation control function of the standby is abnormal.

[0070] (53) When the automatic generation control function needs to switch the main and standby machines during daily operation and maintenance and in case of anomalies, if the standby machine is judged to be unavailable, the standby machine cannot be switched to the main machine;

[0071] (54) When the automatic generation control function needs to switch the main and standby dispatchers during daily operation and maintenance and in case of anomalies, if the standby dispatcher is judged to be unavailable, the switching of the automatic generation control function between the main and standby dispatchers cannot be carried out.

[0072] As an example, during the operation of the automatic generation control function, the calculation results of the function host and the standby machine are compared in real time, such as comparing the key calculation results of the power grid load prediction value, unit regulation amount, etc. If the power grid load prediction value calculated by the standby machine differs too much from the main machine, exceeding the allowable error range, it is determined that the operation of the automatic generation control function of the standby machine is abnormal. At this time, even if the main and standby machines need to be switched, since the standby machine is judged to be unavailable, it will not be switched to the main machine.

[0073] Step S6, carry out safety anti-error for the operation environment of the automatic generation control function, and conduct safety anti-error from two aspects of the process running status and resource occupancy, including:

[0074] (61) When the core process of the automatic generation control function frequently exits abnormally and the core process is inconsistent with the corresponding model library version, it is judged that the function is abnormal, and the automatic generation control function exits automatically.

[0075] (62) When the core process of the automatic generation control function occupies the CPU exceeding a certain threshold, occupies the machine memory exceeding a certain threshold, and the number of file handles occupied exceeds a certain threshold, it is judged that the core process runs abnormally, and the automatic generation control function exits automatically.

[0076] As an example, if the core process of the automatic generation control function frequently exits abnormally, such as automatically closing multiple times in a short period of time, the system will judge that the function is abnormal and automatically exit the automatic generation control function to prevent the unstable process from further affecting the system. When the core process occupies the CPU up to 20% (assuming the threshold is 10%), occupies the machine memory up to 40% (assuming the threshold is 30%), or the number of file handles occupied reaches 1200 (assuming the threshold is 1000), the system will judge that the core process runs abnormally and automatically exit the automatic generation control function to avoid system crashes caused by excessive resource occupancy.

[0077] Step S7, perform external system abnormal safety anti-misoperation for the automatic generation control function. An anti-misoperation mechanism that automatically exits the control function is adopted for external abnormalities that affect function data reading, message interaction, and control instruction issuance, including:

[0078] (71) When the machine time of the host where the automatic generation control function runs jumps by more than a certain threshold, it is determined that the machine operation is abnormal, and the automatic generation control function automatically exits the control;

[0079] (72) When the message bus of the basic platform of the dispatching control system is abnormal, the automatic generation control function automatically exits the control;

[0080] (73) When the service bus of the basic platform of the dispatching control system is abnormal, the automatic generation control function automatically exits the control.

[0081] As an example, if the machine time of the host where the automatic generation control function runs jumps, such as suddenly jumping forward or backward by 5 minutes (assuming the threshold is 3 minutes), the system will determine that the machine running time is abnormal, and the automatic generation control function will automatically exit the control, because time anomalies may cause timestamp errors in data, affecting data accuracy and consistency. When the message bus of the basic platform of the dispatching control system fails and cannot transmit messages normally, the automatic generation control function automatically exits the control to avoid incorrect or undeliverable control instructions due to poor message interaction.

[0082] The present invention provides a safety anti-misoperation method applicable to automatic generation control applications, covering multiple aspects such as models, measurement data, control strategies, and interface operations, forming a relatively comprehensive and systematic safety anti-misoperation system. There are specific anti-misoperation strategies and measures for each link, with strong operability; it does not rely on cutting-edge technologies such as complex artificial intelligence algorithms and is easier to implement and promote in existing systems.

[0083] Based on the same technical concept as the method embodiment, another embodiment of the present invention provides a safety anti-misoperation system for automatic generation control applications, including:

[0084] A model anti-misoperation verification module for performing model anti-misoperation verification. After the automatic generation control AGC system is generated, for modifications to control parameters or control models, first verify in the model verification library. If qualified, introduce it into the real-time operation library; if unqualified, give a model anomaly alarm and do not introduce AGC real-time control;

[0085] The measurement data anomaly prevention and error - proof module is used to prevent and correct measurement data anomalies. Multiple measurement points are configured for the core control measurement data of automatic generation. For each measurement point, multiple error - proof strategies are configured. When one measurement point is invalid, it automatically switches to the next available measurement point. If all measurement points of a measurement are invalid, it is determined that the measurement is invalid, and the AGC or the unit is put into a pause state according to different invalid measurement situations;

[0086] The control strategy anomaly prevention and error - proof module is used to prevent and correct control strategy anomalies by adopting a multi - dimensional error - proof mechanism. Based on the grid frequency obtained in real - time, the overall adjustment deviation of the control command, the total addition change of new - energy power output, the deviation between the adjustment direction and the target direction of the control object, and the prohibited adjustment standard and safe adjustment range conditions of the control object, it judges whether to issue a control command or pause the control of the control object;

[0087] The interface operation error - proof module is used to prevent and correct interface operations. It verifies the operation permissions, control parameter modifications, and control target modifications of users on the function interface, and rejects operations that do not meet the conditions;

[0088] The primary - standby switching error - proof module is used to prevent and correct the safety of primary - standby reconciliation and primary - standby machine switching by adopting the methods of primary - standby reconciliation and primary - standby machine consistency verification. It compares the calculation results of the primary - standby machines and the primary - standby regulating main machines in real - time, judges the abnormal operation situation, and does not perform switching for unavailable standby machines or standby regulators;

[0089] The operation status safety error - proof module is used to prevent and correct status safety according to the process operation status and resource occupancy. According to the exit situation of the core process, the consistency with the model library version, and the resource occupancy of the core process, it judges whether the function is abnormal and whether to exit the automatic generation control function;

[0090] The external system anomaly prevention and error - proof module is used to prevent and correct external system anomalies. When the host machine time jumps, or the message bus or service bus of the dispatching control system basic platform is abnormal, the automatic generation control function automatically exits the control.

[0091] It should be understood that the automatic generation control application safety error - proof system in the embodiments of the present invention can implement all the technical solutions in the above - mentioned method embodiments. The functions of its respective functional modules can be specifically implemented according to the methods in the above - mentioned method embodiments. The specific implementation process can refer to the relevant descriptions in the above - mentioned embodiments and will not be elaborated here.

[0092] The present invention also provides a computer device, including: one or more processors; a memory; and one or more programs, where the one or more programs are stored in the memory and are configured to be executed by the one or more processors. When the program is executed by the processor, it implements the automatic generation control application safety error - proof method as described above.

[0093] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the automatic power generation control application safety anti-error method as described above is implemented.

[0094] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a device (system), a computer device, or a computer program product. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memories, CD-ROMs, optical memories, etc.) containing computer-usable program codes.

[0095] The present invention is described with reference to the flowcharts of the methods according to the embodiments of the present invention. It should be understood that each flow in the flowchart and the combination of the flows in the flowchart can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for implementing the functions specified in one Figure 1 or more of the flows.

[0096] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device, and the instruction device implements the functions specified in one Figure 1 or more of the flows.

[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process. Therefore, the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one Figure 1 or more of the flows.

Claims

1. An automatic generation control application safety anti-misoperation method, characterized in that, The steps include the following: Perform model anti - error verification. After the automatic generation control (AGC) system is generated, for any modification of the control parameters or control model, first verify it in the model verification library. If it is qualified, introduce it into the real - time operation library; if not, give an alarm for model abnormality and do not introduce AGC real - time control. Prevent measurement data errors. Configure multiple measurement points for the core measurement data of automatic generation control. Each measurement point is configured with multiple anti - error strategies. When one measurement point is invalid, automatically switch to the next available measurement point. If all measurement points of a measurement are invalid, then determine that the measurement is invalid, and according to different invalid measurement situations, make the AGC or the unit enter a pause state. Adopt a multi - dimensional anti - error mechanism to prevent control strategy errors. Based on the grid frequency obtained in real - time, the overall regulation deviation of the control instruction, the total addition change of new - energy power output, the deviation between the regulation direction of the control object and the target direction, and the prohibited regulation standard and safe regulation range conditions of the control object, determine whether to issue a control instruction or pause the control of the control object. Prevent interface operation errors. Verify the operation permissions, modification of control parameters, and modification of control objectives of the user on the function interface, and reject operations that do not meet the conditions. Adopt the method of master - slave coordination and master - slave machine consistency verification to prevent safety errors in master - slave coordination and master - slave machine switching. Compare the calculation results of the master - slave machines and the master - slave coordination host in real - time, judge the abnormal operation situation, and do not switch to an unavailable standby machine or standby coordination. Prevent status safety errors according to the process running status and resource occupation. According to the exit situation of the core process, the consistency with the model library version, and the resource occupation of the core process, judge whether the function is abnormal and whether to exit the automatic generation control function. Prevent external system safety errors. When the host machine time jumps, or the message bus or service bus of the dispatching control system basic platform is abnormal, the automatic generation control function automatically exits the control.

2. The automatic generation control application safety anti-misoperation method according to claim 1, characterized in that The real - time operation library is used for saving the intermediate calculation results and displaying the control results during the AGC real - time control process; the model verification library is used for the temporary storage and validity verification of the AGC application function during the modification of interface parameters and control models; the initial values of the control model and the parameters are saved in the initial model library when the automatic generation control system is generated.

3. The automatic generation control application safety anti-misoperation method according to claim 1, characterized in that The core measurement data of automatic generation control includes grid frequency, tie - line power, tie - line exchange plan, and active power of the generating unit; the anti - error strategies include abnormal measurement quality bit, large measurement deviation, measurement data jump, and measurement non - change.

4. The automatic generation control application safety anti-misoperation method according to claim 1, characterized in that The specific multi-dimensional anti-error mechanism is as follows: Based on the grid frequency obtained in real time by automatic generation control, when the grid frequency is higher than the warning threshold for high frequency deviation, all commands to increase output are not issued; when the grid frequency is lower than the low frequency threshold, all commands to reduce output are not issued; when the automatic generation control function issues control commands, if the overall adjustment deviation of all commands exceeds the specified threshold, it is judged that the command issuance is abnormal, and all commands are not issued; when the automatic generation control function calculates control commands, if the total addition of new energy power output jumps by more than the specified threshold, it is judged that the overall data measurement is abnormal, and control commands are not issued; when the automatic generation control function issues control commands to the control object, if the adjustment direction of the control object is opposite to the control target direction by more than the specified threshold, it is judged that the adjustment of the control object is abnormal, and the control of the control object is automatically suspended; when the automatic generation control function issues control commands to the control objects such as conventional units and new energy power stations, considering the prohibited adjustment standard and safe adjustment range of the control object, control commands that affect the safe operation of the control object are not issued.

5. The automatic generation control application safety anti-misoperation method according to claim 1, characterized in that, The specific steps of the interface operation anti-error are as follows: When the user operates on the function interface, it is judged whether the user has the operation authority, and operations without operation authority are refused to be executed; when the user modifies the control parameters on the function interface, model linkage verification is carried out to judge whether the parameter modification affects other control parameters. If the model linkage verification fails, it is refused to be executed; when the user modifies the control target on the function interface, it is judged whether the control target is within a reasonable range. If it is not within the reasonable range, it is judged that the model modification is abnormal and refused to be executed.

6. The automatic generation control application safety anti-misoperation method according to claim 1, wherein, The specific method of the main and standby dispatching and the consistency verification of the main and standby machines is as follows: During the operation of the automatic generation control function, the calculation results of the function main machine and the standby machine are compared in real time. If the key calculation results of the standby machine are inconsistent with the calculation results of the main machine, it is judged that the operation of the automatic generation control function of the standby machine is abnormal; during the operation of the automatic generation control function, the calculation results of the function main machine of the main dispatching system and the function main machine of the standby dispatching system are compared in real time. If the key calculation results of the automatic generation control function of the standby dispatching main machine are inconsistent with the calculation results of the main dispatching main machine, it is judged that the operation of the automatic generation control function of the standby dispatching is abnormal; when the main and standby machines need to be switched during the daily operation and maintenance and anomalies of the automatic generation control function, if the standby machine is judged to be unavailable, the standby machine cannot be switched to the main machine; when the main and standby dispatching need to be switched during the daily operation and maintenance and anomalies of the automatic generation control function, if the standby dispatching is judged to be unavailable, the switching of the automatic generation control function of the main and standby dispatching cannot be carried out.

7. The automatic generation control application safety anti-misoperation method according to claim 1, wherein The specific judgment conditions for the operation status safety anti-error are as follows: When the core process of the automatic generation control function frequently exits abnormally and the core process is inconsistent with the corresponding model library version, it is judged that the function is abnormal, and the automatic generation control function is automatically exited; when the core process of the automatic generation control function occupies the CPU exceeding the specified threshold, occupies the machine memory exceeding the specified threshold, and the number of file handles occupied exceeds the specified threshold, it is judged that the core process runs abnormally, and the automatic generation control function is automatically exited.

8. The automatic generation control application safety anti-error method according to claim 1, wherein The specific triggering conditions for external system exception safety error prevention are as follows: When the machine time of the host where the automatic generation control function runs jumps by more than the specified duration, it is determined that the machine running time is abnormal, and the automatic generation control function automatically exits control; when the message bus of the basic platform of the dispatching control system is abnormal, the automatic generation control function automatically exits control; when the service bus of the basic platform of the dispatching control system is abnormal, the automatic generation control function automatically exits control.

9. The automatic generation control application safety anti-misoperation method according to any one of claims 1-8, characterized in that, The method is implemented based on a pre-established AGC control area, which is an area established in the power grid dispatching control center for closed-loop control of power grid units and facilities within a specified range in response to the frequency and tie-line control requirements of the new energy power grid.

10. An automatic generation control application security anti-misoperation system, characterized in that, It includes: A model error prevention and verification module for performing model error prevention and verification. After the automatic generation control (AGC) system is generated, for any modification of the control parameters or control model, it is first verified in the model verification library. If it is qualified, it is introduced into the real-time operation library; if it is unqualified, a model exception alarm is given and it is not introduced into the AGC real-time control. A measurement data exception error prevention module for performing measurement data exception error prevention. Multiple measurement points are configured for the core control measurement data of automatic generation. Each measurement point is configured with multiple error prevention strategies. When one measurement point is invalid, it automatically switches to the next available measurement point. If all measurement points of a measurement are invalid, it is determined that the measurement is invalid, and the AGC or the unit enters a suspended state according to different measurement invalid situations. A control strategy exception error prevention module for performing control strategy exception error prevention using a multi-dimensional error prevention mechanism. Based on the grid frequency, the overall adjustment deviation of the control instruction, the total addition change of the new energy power output, the deviation between the adjustment direction of the control object and the target direction, and the prohibited adjustment standard and safe adjustment range conditions of the control object obtained in real time, it is determined whether to issue a control instruction or suspend the control of the control object. An interface operation error prevention module for performing interface operation error prevention. It verifies the operation permissions, modification of control parameters, and modification of control targets of the user on the function interface, and rejects operations that do not meet the conditions. A primary and standby switching error prevention module for performing primary and standby reconciliation and safety error prevention for primary and standby machine switching by means of primary and standby reconciliation and primary and standby machine consistency verification. It compares the calculation results of the primary and standby machines and the primary and standby dispatching hosts in real time, determines the abnormal operation situation, and does not perform switching for unavailable standby machines or standby dispatchers. An operation status safety error prevention module for performing status safety error prevention based on the process operation status and resource occupancy. According to the exit situation of the core process, the consistency with the model library version, and the resource occupancy of the core process, it determines whether the function is abnormal and whether to exit the automatic generation control function. An external system exception error prevention module for performing external system exception safety error prevention. When the host machine time jumps, or the message bus or service bus of the basic platform of the dispatching control system is abnormal, the automatic generation control function automatically exits control.

11. A computer device, characterized in that, It includes: One or more processors; A memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and when the programs are executed by the processors, implement the automatic generation control application security anti-error method according to any one of claims 1-9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the automatic generation control application security anti-error method according to any one of claims 1-9.

Images