AI-powered intelligent analysis network fault prediction and diagnosis system for multi-source operation of substation grid-related services

Abstract

This invention specifically relates to an AI-powered intelligent analysis network fault prediction and diagnosis system for multi-source operation of substation grid-related services, encompassing the fields of power system automation and intelligent operation and maintenance technology. It includes: a grid-related service data source module; a network communication device module; a general database module; and an AI intelligent analysis processing module. This invention employs multi-dimensional dynamic feature analysis, targeting key parameters such as packet loss rate, latency, and traffic flow. It utilizes structured extraction logic to filter invalid data and focus on genuine anomalies. By combining machine learning loss functions to optimize u, k, and v parameters, it accurately captures collaborative anomaly patterns such as sudden packet loss, extreme latency, and rapid traffic changes, providing early warnings of potential faults. This effectively avoids malfunctions of protection devices or interruptions in dispatch commands caused by network anomalies, significantly enhancing the stability of power grid operation.

Description

Technical Field

[0001] This invention relates to the field of power system automation and intelligent operation and maintenance technology, and in particular to an AI-powered intelligent analysis network fault prediction and diagnosis system for multi-source operation of substation grid-related services. Background Technology

[0002] The stable operation of substation network-connected services (such as PMU, remote control, and new energy monitoring) depends on the reliability of network transmission, but existing technologies have significant limitations in network status assessment and fault early warning:

[0003] Network feature analysis is one-sided: Traditional systems assess network status solely based on single indicators such as absolute packet loss rate, average latency, and peak traffic, neglecting dynamic changes. For example, they fail to consider the magnitude of sudden changes in packet loss rate, the impact of extreme latency on real-time services, and the early warning value of sudden increases / decreases in traffic, leading to missed detections of "fluctuation-type anomalies."

[0004] The feature extraction is coarse and has poor anti-interference capabilities: it lacks fine-grained processing of packet loss, latency, and traffic data, and a large amount of invalid data (such as low packet loss rate when business is idle) interferes with the analysis; it does not quantify spatiotemporal features through labeling groups, time weighting, etc., making it difficult to distinguish between occasional anomalies and persistent risks;

[0005] Weak ability to integrate multi-dimensional features: Relying on manual experience or simple weighted assessment of network status, it is unable to convert features such as packet loss, latency, and traffic into quantitative indicators. When multiple indicators are abnormal at the same time, it is difficult to assess the overall risk and cannot distinguish the impact weight of different features on the business, resulting in insufficient targeting.

[0006] Rigid parameter settings and low prediction accuracy: Key parameters for feature extraction (such as packet loss analysis marker group number, delay ranking, etc.) rely on manual settings, which cannot adapt to business upgrades or changes in power grid operating conditions, resulting in feature extraction deviations, delayed early warnings and high false alarm rates, making it difficult to support the "unmanned" operation and maintenance needs of substations.

[0007] Therefore, an AI-powered intelligent analysis network fault prediction and diagnosis system is needed for multi-source operation of substation network-related services to address the aforementioned issues. Summary of the Invention

[0008] The purpose of this invention is to provide an AI-powered intelligent analysis network fault prediction and diagnosis system for multi-source operation of substation network services in order to solve the above-mentioned problems.

[0009] To achieve the above objectives, the present invention adopts the following technical solution:

[0010] The substation network-related business multi-source operation AI intelligent analysis network fault prediction and diagnosis system includes:

[0011] The data source module for network-related business is configured to comprehensively collect various types of business data and equipment status information closely related to power grid dispatch within the substation;

[0012] The network three-way device module is configured to be connected in series in the service transmission link, and it replicates data unidirectionally through mirror mode, without MAC or network address;

[0013] The general database module is configured to receive and store all data forwarded by the network three-way device, and record source address and destination address information to support AI analysis;

[0014] The AI-powered intelligent analysis module is configured to analyze device and link status from multiple dimensions based on database data, enabling fault diagnosis, location, and early warning.

[0015] Preferably, the network-related business data source module specifically includes:

[0016] Business data includes:

[0017] Remote control services are generated and transmitted by the main and backup remote control units in the secondary power equipment; their data covers the real-time operating parameters of primary power equipment, such as generators and transformers.

[0018] PMU services are transmitted by synchronous phasor measurement devices; focusing on dynamic stability monitoring data of the power system.

[0019] For new energy services, the transmission task is undertaken by integrated communication management terminal equipment; it is designed for new energy power generation scenarios; the data includes the output data of new energy equipment and the equipment operating status;

[0020] Information protection service: sent by the information protection substation server; records the operation information and setting status of the relay protection device;

[0021] The monitoring events are uploaded by the Type II network monitoring device and fall under the category of network layer status data.

[0022] Preferably, the network three-way device module specifically includes:

[0023] Equipped with two independent link ports, it can be directly connected to the secondary power equipment, PMU device and power dispatch data network switch through physical lines, and integrated into the original business transmission link in a series manner.

[0024] It is equipped with a forwarding port and uses mirroring mode to copy all service data passing through the link in real time. The device itself does not have a MAC address or network address, that is, it does not connect to any network protocol stack, and the forwarding port only supports data output.

[0025] Preferably, the general database module specifically includes:

[0026] It stores the complete content of business data and records the metadata of each data item; it processes heterogeneous data into a unified format before storing it.

[0027] The database adopts a distributed storage architecture, which has data redundancy and fault tolerance capabilities; even if a storage node fails, the system can quickly recover the data through the redundant nodes.

[0028] Preferably, the AI ​​intelligent analysis processing module specifically includes:

[0029] Key features are carefully extracted from massive amounts of data in the database, and a comprehensive and accurate analytical model is built.

[0030] Regarding equipment status characteristics, we closely monitor the CPU utilization and memory usage of secondary power equipment, while also monitoring process running status to determine if there are any abnormal processes, thereby comprehensively assessing the stability of equipment operation.

[0031] In terms of business parameter characteristics, the focus is on analyzing whether the current and voltage of primary power equipment are within the normal threshold range, and verifying whether the protection action logic in the insurance business is consistent with the preset rules.

[0032] In terms of network transmission characteristics, the network status is evaluated based on packet loss rate data, latency data, and traffic changes during data transmission.

[0033] Based on trend analysis of various characteristic data, early warnings are issued for potential faults.

[0034] Preferably, the process of assessing network status based on packet loss rate data, latency data, and traffic changes during data transmission includes:

[0035] The entire link data, including packet loss rate data, latency data, and traffic change data, is mirrored and copied using a network three-way communication device.

[0036] Packet loss rate data is extracted at preset time intervals, and a preset packet loss rate threshold is set. The packet loss rate of each time interval is subtracted from the packet loss rate threshold. If the resulting value is greater than 0, it is recorded as the packet loss difference. If the resulting value is less than 0, it is directly removed.

[0037] Sort each packet loss difference in descending order of its value, and extract the largest and smallest packet loss difference as a label group. Remove the label group from the packet loss difference data, and continue to extract the largest and smallest packet loss difference as a label group from the remaining packet loss differences to obtain the corresponding number of label groups. Sort the label groups in the order they were created, and extract the u-th label group from them.

[0038] The difference between the maximum and minimum packet loss difference in the u-th tag group is calculated, and the absolute value is multiplied by the time interval between the maximum and minimum packet loss difference to obtain the packet loss impact value.

[0039] Extract the source address and destination address of each data entry from the database, along with the corresponding source address sending time and destination address receiving time. Use the time between the receiving time and the sending time as the transmission time. Set an allowable fluctuation range for the transmission time. Record the transmission time that is outside the allowable fluctuation range as the transmission delay time. Extract the maximum transmission delay time ranked k from all the transmission delay times and record it as the transmission anomaly duration.

[0040] Preferably, the method further includes:

[0041] Traffic data from different time periods and paths in the database are extracted at preset time intervals, and the difference between traffic in adjacent time intervals is calculated. The absolute value is then taken to obtain the difference between adjacent traffic.

[0042] Each adjacent flow difference is compared with the threshold set by the Type II network monitoring device. Adjacent flow differences that are greater than the threshold set by the Type II network monitoring device are marked. The largest v adjacent flow differences are extracted from the marked adjacent flow differences. The difference between the largest v adjacent flow differences is calculated to obtain the flow anomaly value.

[0043] Preferably, the network fault assessment coefficients are obtained by substituting the packet loss impact value, transmission anomaly duration, traffic anomaly value, and their corresponding u, k, and v into the machine learning loss function. This is used to assess the network transmission status;

[0044] The function is:

[0045] ;

[0046] in:

[0047] Anomaly labels for historical data; It is the sigmoid function;

[0048] , , Feature calculations are driven by u, k, and v, respectively.

[0049] The impact of packet loss calculated for the u-th tag group;

[0050] To obtain the transmission anomaly duration ranked kth;

[0051] These are outlier values ​​in the flow rate calculated based on the largest flow rate difference in the previous v.

[0052] , , These are the feature weights;

[0053] For bias terms;

[0054] This represents the prediction error for a single data point.

[0055] To obtain the network fault assessment coefficient, we need to sum the prediction errors of all n historical data points. ;

[0056] After traversing all (u,k,v) combinations, compare the network fault assessment coefficients of each group. ,Will The smallest combination is used as the model trained to optimize subsequent network fault prediction.

[0057] Preferably, the result output and application module specifically includes:

[0058] The system displays the real-time status of all secondary power equipment in an intuitive and visual interface, categorized by type.

[0059] Once a failure occurs, a report containing detailed failure information is generated; the report includes the location of the failure, the scope of impact, and recommended actions.

[0060] Personnel will only be dispatched to handle the situation on-site when a clear fault indication is detected.

[0061] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0062] 1. This invention uses multi-dimensional dynamic feature analysis to target key parameters such as packet loss rate, latency, and traffic. It employs structured extraction logic to filter invalid data and focus on real anomalies. By combining machine learning loss functions to optimize u, k, and v parameters, it accurately captures collaborative anomaly patterns such as sudden packet loss, extreme latency, and sudden traffic changes, providing early warning of potential faults. This effectively avoids malfunctions of protection devices or interruptions of dispatch commands due to network anomalies, significantly enhancing the stability of power grid operation.

[0063] 2. This invention improves the efficiency of equipment status monitoring by replacing the cumbersome process of manually logging into multiple devices and querying them through a panoramic visualization interface and automated analysis. When a fault occurs, a detailed report directly locates the fault point, the scope of impact, and handling suggestions, shortening the troubleshooting time. At the same time, the hierarchical operation and maintenance and remote monitoring functions based on health scores greatly reduce the need for manual inspections in severe weather, reducing on-site operation risks and labor costs. Attached Figure Description

[0064] Further details, features, and advantages of this application are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0065] Figure 1 This is a system structure diagram of the present invention. Detailed Implementation

[0066] Several embodiments of this application will now be described in more detail with reference to the accompanying drawings to enable those skilled in the art to implement this application. This application may be embodied in many different forms and for various purposes and should not be limited to the embodiments set forth herein. These embodiments are provided to make this application thorough and complete, and to fully convey the scope of this application to those skilled in the art. The embodiments described do not limit this application.

[0067] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. It will be further understood that terms such as those defined in commonly used dictionaries shall be interpreted as having a meaning consistent with their meaning in the relevant field and / or the context of this specification, and shall not be interpreted in an idealized or overly formal sense unless expressly defined herein.

[0068] Example 1

[0069] Its specific implementation method is combined with the appendix Figure 1 Please provide a detailed explanation.

[0070] Appendix Figure 1 The diagram below shows the structure of the AI-powered intelligent analysis network fault prediction and diagnosis system for multi-source operation of substation network services provided in this embodiment of the invention. It illustrates the connection relationship between the network service data source module and the result output and application modules, and marks the main functional interaction flow of each module.

[0071] In this embodiment, it includes:

[0072] The data source module for network-related business is configured to comprehensively collect various types of business data and equipment status information closely related to power grid dispatch within the substation;

[0073] Business data includes:

[0074] Remote control services are generated and transmitted by the main and backup remote control units in the secondary power equipment. The data covers the real-time operating parameters of key production equipment such as generators and transformers in the primary power equipment, including precise values ​​of current, voltage, and power, as well as basic production data such as whether the switch is open or closed. This data plays a core role in enabling the dispatch center to grasp the basic operating status of the station in real time and is the basis for monitoring the stable operation of the power grid.

[0075] The PMU (Power Management Unit) service, transmitted by the synchronous phasor measurement device, focuses on dynamic stability monitoring data of the power system. This includes data such as synchronous phasors, which accurately reflect the phase relationship between voltage and current at various nodes in the power system; frequency deviation, which directly reflects the stability of the grid frequency; and power angle, crucial for assessing the transient stability of the grid. Through this data, the dispatch center can monitor the dynamic changes of the grid in real time and promptly identify potential risks.

[0076] For new energy services, the transmission task is undertaken by integrated communication management terminal equipment. Targeting new energy power generation scenarios, such as wind power and photovoltaic power plants, the data includes the output data of new energy equipment, i.e., the actual power generation, which intuitively reflects the power generation efficiency; conversion efficiency, which reflects the ratio of solar energy and wind energy to electrical energy; and equipment operating status, such as the cleanliness of photovoltaic panels, the speed of wind turbines, and other special parameters. This data helps to gain a deeper understanding of the operating status of new energy power generation equipment and ensure the high efficiency and stability of new energy power generation.

[0077] Information protection service: This service is sent by the information protection substation server. It records in detail the operation information of the relay protection device, including the precise time of the protection action, the action type (e.g., overcurrent protection, differential protection), and the setting status, which is used to determine whether the protection parameter settings are within the normal range. This information provides the dispatch center with key evidence to verify the correctness of the protection device's operation during power grid faults, ensuring that power grid faults can be quickly and accurately isolated and protected, thus ensuring power grid safety.

[0078] The monitoring events are uploaded by the Type II network monitoring device and fall under the category of network layer status data. The specific content includes the physical plugging and unplugging status of the power secondary equipment interface, such as whether the interface is loose or disconnected, which directly affects the stability of data transmission; and whether the network traffic exceeds the preset threshold.

[0079] For example, if the traffic on a certain link exceeds 100Mbps within one minute, it indicates abnormal network load; and information such as link connectivity status is also displayed. This data is a key indicator for judging the status of device interfaces and basic network connections, helping maintenance personnel to promptly identify potential network faults.

[0080] The network three-way device module is configured to be connected in series in the service transmission link. It replicates data unidirectionally through mirror mode, without MAC or network address, ensuring security and easy deployment without affecting the original services.

[0081] Specifically, it includes:

[0082] Equipped with two independent link ports, it can be directly connected to secondary power equipment, PMU devices, and power dispatch data network switches via physical lines, respectively, integrating into the existing service transmission links in a serial manner. When the device experiences power failure, malfunction, or is not yet started, it will automatically switch to "pure adapter mode." In this mode, its function is completely consistent with that of a regular network cable adapter, ensuring that the original services, whether data uploads from the substation to the dispatch center or instructions issued by the dispatch center to the substation, will not be affected in any way. This effectively avoids interference with the normal operation of the power dispatch data network (which is strictly controlled by the dispatch center, and external devices and third-party programs are strictly prohibited from accessing it), ensuring the continuity and stability of services.

[0083] Equipped with a forwarding port, it uses a mirroring mode to replicate all business data passing through the link in real time and accurately, covering the above five types of network-related services and dispatch instructions. Its key security design is that the device itself does not have a MAC address or network address, that is, it does not connect to any network protocol stack, and the forwarding port only supports data output and cannot receive any external input. This security mechanism built at the physical level eliminates the possibility of external devices using the device to intrude into the power dispatch data network, comprehensively protects the security of internal data, and eliminates the potential risks of data leakage and network attacks.

[0084] During the deployment phase, no interface configuration changes or software debugging are required for the existing secondary power equipment. Installation is simply completed by disconnecting both ends of the existing link and connecting them to the two link ports of the new device. The entire process does not cause service interruption. This simple and convenient deployment method greatly reduces the difficulty of on-site construction, making it particularly suitable for complex scenarios in substations with numerous equipment brands and a mix of older equipment. In the later maintenance phase, if the device malfunctions, it can be directly replaced without complex reconfiguration, significantly reducing maintenance costs and improving maintenance efficiency.

[0085] The general database module is configured to receive and store all data forwarded by the network three-way device, record metadata such as source address and destination address, and is compatible with multiple types of data, providing support for AI analysis;

[0086] Specifically, it includes:

[0087] The system fully stores the specific details of business data, such as current (220.50kV) and voltage (10.20kV) accurate to two decimal places, and also records the metadata of each data entry in detail, including the source address, which clearly indicates which specific device the data originated from.

[0088] For example, "Telecontrol Unit Main and Backup Unit" and "PMU Unit" facilitate tracing the data source; the target address clearly indicates the destination of the data transmission, such as "Dispatch Center Area A Server," making it easy to understand the data flow; the transmission timestamp, accurate to the millisecond level, provides precise time information for data analysis; and the associated link information records the path identification of the data transmission, such as "First Plane Main Path" and "Second Plane Backup Path." This rich metadata provides indispensable key evidence for subsequent in-depth tracing of data sources and comprehensive analysis of transmission paths, helping to achieve full lifecycle management of data.

[0089] Given the diverse range of brands of secondary power equipment in substations, and the significant differences in output data formats and protocols between remote control devices (RTDs) and power control units (PMUs) produced by different manufacturers, with some devices using the international standard IEC 61850 protocol while others use proprietary protocols, the database pre-sets a comprehensive set of standardized conversion rules to unify the format of this heterogeneous data before storage. This effectively eliminates the obstacles caused by inconsistent data formats, enabling various types of data to be stored in an orderly manner within the same database, laying a solid foundation for subsequent centralized and efficient AI analysis.

[0090] The database adopts an advanced distributed storage architecture, which has strong data redundancy and fault tolerance capabilities; even if a storage node fails, the system can quickly recover the data through redundant nodes, ensuring that the data is not lost or tampered with.

[0091] For example, in a practical application at a substation in a certain region, a local network failure caused a brief loss of connection for some storage nodes. However, thanks to the distributed storage architecture, the system successfully restored all data within 5 minutes, ensuring the continuity and integrity of the data. This reliability provides a continuous and complete data source for subsequent AI analysis, ensuring the accuracy and reliability of the analysis results. For instance, it can accurately trace the CPU utilization curve of a device over 72 consecutive hours, providing strong support for equipment status assessment.

[0092] The AI ​​intelligent analysis processing module is configured to analyze the status of devices and links from multiple dimensions based on database data, so as to realize fault diagnosis, location and early warning.

[0093] Specifically, it includes:

[0094] Key features are carefully extracted from massive amounts of data in the database, and a comprehensive and accurate analytical model is built.

[0095] Regarding equipment status characteristics, we closely monitor the CPU utilization of secondary power equipment. For example, we monitor in real time whether the CPU utilization of the PMU device exceeds the preset threshold of 80%, as well as the memory usage. We check whether the memory usage of the main and backup remote control units shows a continuous upward trend. At the same time, we monitor the process running status to determine whether there are any abnormal processes, so as to comprehensively evaluate the stability of equipment operation.

[0096] In terms of business parameter characteristics, we focus on analyzing whether the current and voltage of primary power equipment are within the normal threshold range, such as whether the output current of photovoltaic inverters exceeds the rated value, and whether the protection action logic in the guarantee business is consistent with the preset rules, so as to ensure the safety and accuracy of business operation.

[0097] In terms of network transmission characteristics, the network status is evaluated based on packet loss rate data, latency data, and traffic changes during data transmission.

[0098] The process includes:

[0099] The entire link data, including packet loss rate data, latency data, and traffic change data, is mirrored and copied using a network three-way communication device.

[0100] Packet loss rate data is extracted at preset time intervals, and a preset packet loss rate threshold is set. The packet loss rate of each time interval is subtracted from the packet loss rate threshold. If the resulting value is greater than 0, it is recorded as the packet loss difference. If the resulting value is less than 0, it is directly removed.

[0101] In power systems, network packet loss is not always abnormal (e.g., the packet loss rate is naturally low during periods of low traffic). By using a packet loss rate threshold of <0 to exclude data, normal / meaningless packet loss data is directly filtered out, allowing subsequent calculations to focus only on periods where packet loss risk actually exists, avoiding interference from normal fluctuations in the analysis.

[0102] Sort each packet loss difference in descending order of its value, and extract the largest and smallest packet loss difference as a label group. Remove the label group from the packet loss difference data, and continue to extract the largest and smallest packet loss difference as a label group from the remaining packet loss differences to obtain the corresponding number of label groups. Sort the label groups in the order they were created, and extract the u-th label group from them.

[0103] The danger of packet loss in power grids lies not only in the high packet loss rate, but also in the sudden changes in the packet loss rate (such as a sudden jump from 0.2% to 1%, which may trigger misjudgments by protection devices). By using a marker group composed of the maximum packet loss difference (sudden increase) and the minimum packet loss difference (sudden decrease), the "abnormal fluctuation range" of the packet loss rate can be accurately captured, rather than just the absolute value.

[0104] The difference between the maximum and minimum packet loss difference in the u-th tag group is calculated, and the absolute value is multiplied by the time interval between the maximum and minimum packet loss difference to obtain the packet loss impact value.

[0105] u is the sequence number of the tag group arranged in the order of establishment, corresponding to the time series characteristics of the power business (e.g., u=1 is the earliest packet loss fluctuation group, which may be related to the start of the morning peak load; u=2 is the second earliest group, which may be related to sudden power changes in renewable energy plants). Engineers can trace the time context of packet loss anomalies by using the value of u, and locate the root cause by combining it with the power grid operating conditions (e.g., maintenance, large-scale renewable energy generation).

[0106] Traditional packet loss analysis focuses on the absolute value of packet loss rate, while the packet loss impact value output by this process integrates composite features such as anomaly magnitude, duration, and occurrence sequence. It can be directly used as input for machine learning models (such as fault prediction neural networks) to solve the problem that "pure numerical packet loss rate cannot reflect complex impacts".

[0107] The power industry has extremely high requirements for the interpretability of AI decision-making (it involves power grid safety and requires tracing the basis for anomaly judgment). The calculation process of packet loss impact value has a clear physical meaning for each step (threshold filtering, fluctuation extraction, time weighting). When the model issues an alert based on this feature, engineers can trace back to which tag group (u) and which time period's packet loss fluctuation caused the anomaly, which meets the security requirements of auditability and traceability.

[0108] This packet loss impact calculation process is neither a simple packet loss rate statistic nor a purely black-box AI feature, but rather a structured feature extraction solution tailored to the needs of the power industry (filtering normal fluctuations, focusing on continuous impacts, and emphasizing interpretability). By focusing on abnormal intervals, capturing fluctuation trends, and correlating time series, it provides accurate, interpretable, and business-adaptable core features for network status assessment and fault prediction and early warning of substation grid-related businesses, enabling subsequent AI analysis to truly be implemented in power scenarios and serve grid security.

[0109] Extract the source address and destination address of each data entry from the database, along with the corresponding source address sending time and destination address receiving time. Use the time between the receiving time and the sending time as the transmission time. Set an allowable fluctuation range for the transmission time. Record the transmission time that is outside the allowable fluctuation range as the transmission delay time. Extract the maximum transmission delay time ranked k from all the transmission delay times and record it as the transmission anomaly duration.

[0110] The latency of substation network-connected services (such as PMU and protection device communication) is not absolutely constant and will dynamically change with the type of service, power grid conditions, and network load (for example, during power grid faults, the latency of PMU services may temporarily increase due to a surge in data volume). By presetting the allowable fluctuation range, reasonable latency fluctuations during normal service operation are filtered out, focusing only on abnormal latency exceeding the service's tolerance.

[0111] In power systems, a single extremely long latency is more harmful than multiple slightly longer latency events (e.g., excessively long AGC command delays can lead to grid frequency instability). By extracting the maximum transmission delay time ranked k, the most severe latency anomalies in business operations can be accurately captured, and high-risk scenarios can be prioritized for assessment.

[0112] Substation networks employ a layered architecture (bay layer, station control layer, and dispatch layer). The source and destination addresses of data correspond to specific physical devices / links (e.g., from bay layer protection devices to station control layer switches). When the duration of a transmission anomaly is extracted, the specific link where the anomaly occurred can be traced back, assisting engineers in quickly locating the fault point.

[0113] Power outages are often accompanied by a series of abnormal timing sequences involving multiple devices (e.g., in the event of a line fault, the protection device activates first, but the PMU data synchronization is delayed). The transmission-reception timestamps of the transmission delay can be correlated with the timing of power grid events (e.g., fault recording start time, protection action time), aiding in the analysis of whether network anomalies are the cause or consequence of the fault.

[0114] Traffic data from different time periods and paths in the database are extracted at preset time intervals, and the difference between traffic in adjacent time intervals is calculated. The absolute value is then taken to obtain the difference between adjacent traffic.

[0115] Each adjacent flow difference is compared with the threshold set by the Type II network monitoring device. Adjacent flow differences that are greater than the threshold set by the Type II network monitoring device are marked. The largest v adjacent flow differences are extracted from the marked adjacent flow differences. The difference between the largest v adjacent flow differences is calculated to obtain the flow anomaly value.

[0116] By calculating the traffic difference between adjacent time intervals (taking the absolute value), we can directly focus on the dynamic change of traffic (rather than static values), and can keenly capture possible sudden traffic surges / drops in the network (such as attack traffic, precursors to link congestion, etc.). Compared with simply monitoring the absolute value of traffic, it can better reflect potential anomalies.

[0117] After comparing with the threshold set by the Type II network monitoring device, only the traffic difference exceeding the threshold is marked, which can filter out small fluctuations within the normal range (such as slight traffic changes in daily business), reduce invalid data interference, and allow subsequent analysis to focus more on significant anomalies that may really affect network stability.

[0118] Extracting the largest v adjacent flow differences and calculating their differences to obtain flow anomalies has two advantages:

[0119] Selecting the maximum number of v ensures that attention is paid to the most severe outliers (the higher the degree of anomaly, the greater the potential impact on the network).

[0120] By calculating the difference between multiple maximum values, scattered outliers are transformed into a single quantitative indicator, which not only preserves the overall strength information of the anomaly, but also facilitates subsequent comprehensive evaluation by combining it with indicators such as packet loss and latency (e.g., by substituting it into a machine learning model).

[0121] Substituting the packet loss impact, transmission anomaly duration, traffic anomaly value, and their corresponding u, k, and v into the machine learning loss function yields the network fault assessment coefficients. This is used to assess the network transmission status;

[0122] The correlation between network status (packet loss, latency, traffic) and anomalies in substation-related services is strongly non-linear (e.g., high packet loss rate combined with low traffic may indicate link failure, while high packet loss rate combined with high traffic may indicate service bursts; these correspond to different anomaly risks). Traditional linear evaluation methods (such as simple weighting) struggle to capture this correlation. However, by using a sigmoid-activated mean squared error loss function, the model can learn complex non-linear patterns from historical data, more accurately distinguishing between normal fluctuations and genuine anomalies.

[0123] The function is: ;

[0124] in:

[0125] For anomaly labels in historical data, historical network operation data (including packet loss, latency, traffic, etc.) is extracted from a general database and manually / automatically labeled as "whether an anomaly has occurred" (1=abnormal, 0=normal) as the true answer for model learning;

[0126] It is the sigmoid function;

[0127] Compress the "linear calculation result" to the 0-1 range and output the anomaly probability (e.g., a calculation result of 0.8 means there is an 80% probability of it being judged as an anomaly).

[0128] , , Feature calculations are driven by u, k, and v, respectively.

[0129] The impact of packet loss calculated for the u-th tag group;

[0130] To obtain the transmission anomaly duration ranked kth;

[0131] These are outlier values ​​in the flow rate calculated based on the largest flow rate difference in the previous v.

[0132] The three are the input features of the model. u, k, and v are hyperparameters that directly determine the calculation logic of the features (for example, u=2 and u=3 will extract packet loss data from different labeled groups and change the input features).

[0133] , , These are the feature weights; and the parameters automatically learned during model training, representing... , , The strength of the impact on the probability of anomalies;

[0134] This is a bias term; similar to a correction constant, it allows the model to adapt more flexibly to the data (for example, when all features are 0, the bias term determines the base anomaly probability).

[0135] This represents the prediction error for a single data point; the larger the error, the worse the model's prediction for that data point.

[0136] To obtain the network fault assessment coefficient, we need to sum the prediction errors of all n historical data points. ;

[0137] After traversing all (u,k,v) combinations, compare the network fault assessment coefficients of each group. ,Will The smallest combination, when used as a model for training, has the smallest prediction error on historical data and is theoretically more accurate in predicting future network anomalies, thus optimizing the prediction and diagnosis of subsequent network faults.

[0138] The substation network status changes dynamically with business upgrades (such as adding new renewable energy plants or upgrading protection devices) and power grid operating conditions (such as peak and valley loads and large-scale renewable energy generation). The loss function can automatically adapt to these changes and maintain the accuracy of the evaluation coefficients by continuously iteratively training with new data (updating weights w1, w2, w3 and bias term b).

[0139] If the values ​​of u (packet loss marker group number), k (transmission anomaly duration ranking), and v (number of traffic differences) rely on human experience, it is easy to lead to feature extraction bias due to limitations in scenario cognition (e.g., maintenance personnel may overestimate the impact of packet loss in the morning and underestimate traffic fluctuations during the power ramp-up period of new energy sources). By optimizing the loss function through traversal, the combination of u, k, and v that "best reflects business risks" can be automatically found from historical anomaly cases, making feature extraction more consistent with actual fault patterns.

[0140] u, k, and v are not black-box parameters, but rather correspond to specific physical scenarios (u is associated with the time series of packet loss fluctuations, k is associated with the severity of latency anomalies, and v is associated with the range of flow fluctuations). With the optimized combination of u, k, and v using the loss function, engineers can trace back to the corresponding packet loss periods, latency peaks, and flow difference ranges. Combined with power grid operation logs (such as maintenance plans and renewable energy output curves), they can pinpoint the root causes of anomalies, avoiding the pitfalls of AI predictions that cannot be explained in power scenarios.

[0141] The weights w1, w2, and w3 in the loss function are automatically tilted towards features that contribute more to anomalies during training (e.g., PMU services are sensitive to latency, so w2 (weight of transmission anomaly duration) will be higher; telemetry services are sensitive to packet loss, so w1 (weight of packet loss impact value) will be higher). This dynamic weighting allows network fault assessment coefficients to prioritize anomalies in critical services, avoiding minor fluctuations in non-core services (such as backend monitoring) from interfering with early warnings.

[0142] By optimizing the combination of u, k, and v, the model can make the evaluation coefficients change in advance before the actual anomaly occurs, based on the abnormal precursor features in historical data (such as the packet loss marker group with u=2 often appearing 30 minutes before the link failure), thus achieving a closed loop of fault warning, proactive intervention, and avoidance of outages.

[0143] Regarding path and link characteristics, we conduct in-depth analysis of the primary and backup paths, namely the switching frequency of the first and second planes, such as whether the number of switching times exceeds 3 times per hour, and the continuity of data during switching, to determine whether data interruption occurs during the switching process. At the same time, we monitor the interaction status of each device in the link, such as the switch, to ensure the smooth and reliable transmission path.

[0144] Based on trend analysis of various characteristic data, early warnings are issued for potential faults. For example, traffic data reported by the Type II network monitoring device 5 shows that the traffic has been approaching the threshold for five consecutive minutes with a growth rate of 2% per minute. Using a professional prediction model, it can accurately predict that the traffic on this link will exceed the threshold in 10 minutes. The system will promptly issue early warnings to maintenance personnel, informing them to check the link interface in advance so that appropriate measures can be taken to eliminate potential faults in their infancy. This achieves a shift from the traditional passive repair mode to a proactive prevention mode, effectively improving the reliability and stability of power grid operation.

[0145] The output and application module is configured to transform AI analysis results into equipment status views and fault report information to support operation and maintenance and help substations become unmanned or less staffed.

[0146] Specifically, it includes:

[0147] The real-time status of all secondary power equipment is displayed in a categorized manner using an intuitive and visual interface, such as dashboards and charts.

[0148] For example, the system clearly displays "Telecontrol device main / standby: CPU utilization 35% (normal), memory usage 40% (normal)," allowing maintenance personnel to understand the equipment's operating status at a glance. For "PMU device: CPU utilization 85% (warning), it is recommended to check process load," the system not only clearly indicates the abnormal device status but also provides targeted suggestions. Furthermore, the display of "FR device (integrated communication management terminal): interface status normal, network traffic 60Mbps (normal threshold ≤100Mbps)" provides maintenance personnel with a clear overview of the device's network connectivity and traffic. This panoramic view completely replaces the cumbersome process of logging into multiple devices individually to check their status in existing technologies, greatly improving maintenance efficiency.

[0149] In the event of a failure, this module quickly generates a report containing detailed fault information. The report covers the fault location, clearly indicating which device is causing the problem; for example, "Cause of failure: Abnormal encryption algorithm, causing PMU service decryption failure"; the scope of impact, clearly explaining which services are affected by the fault, such as "Scope of impact: The dispatch center cannot receive PMU dynamic stability data"; and recommended measures, providing maintenance personnel with professional solutions, such as "Recommended measures: Restart the encryption device and verify the algorithm parameters". This detailed report helps maintenance personnel quickly locate the root cause of the problem, greatly shortening the fault investigation time, reducing the hours required for traditional fault investigation to minutes, and significantly improving fault handling efficiency.

[0150] For example, an assessment result of "One-plane path health score of 92 (excellent), key equipment operating stably" indicates that the path is operating well; while an evaluation of "Two-plane path health score of 68 (requires attention), real-time switch latency fluctuations are large" suggests that maintenance personnel have potential risks in this path and need to pay close attention. This quantitative link health assessment provides a clear and objective basis for maintenance priority decisions, enabling the rational allocation of maintenance resources.

[0151] Leveraging these powerful functions, this module significantly reduces the need for manual inspections. Especially during severe weather conditions such as sandstorms in the "Three Norths" region (Northeast China, Northwest China, and Northwest China) and typhoons along the southeast coast, maintenance personnel can remotely and comprehensively monitor equipment and link status through the system. The system only dispatches personnel for on-site handling when a clear fault indication is detected. For example, during a typhoon, a substation successfully identified and resolved potential problems with some equipment through remote monitoring using this system, avoiding the safety risks associated with manual inspections and reducing labor costs. This approach directly supports the realization of the substation's "unmanned and minimally staffed" goals, effectively improving the safety of power grid dispatching, preventing the escalation of accidents due to delayed fault location, and providing strong support for the efficient and reliable operation of the smart grid.

[0152] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0153] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

[0154] It should be noted that, in this document, the use of relational terms such as "first" and "second" is merely for distinguishing one entity or operation from another, and does not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0155] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0156] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0157] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0158] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0159] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0160] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0161] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A substation network service multi-source operation AI analysis network fault prediction and diagnosis system, characterized in that, Comprise: The network-related business data source module is configured to comprehensively collect various types of business data and device state information closely related to power grid dispatching in the substation; The network three-way device module is configured to be connected in series in the business transmission link, to copy data in mirror mode in one direction, and to have no MAC and network address; The general database module is configured to receive and store full-amount data forwarded by the network three-way device, record source address and target address information, and provide support for AI analysis; The AI analysis processing module is configured to analyze device and link status from multiple dimensions based on database data, to realize fault diagnosis, positioning, and early warning; The AI analysis processing module further includes evaluating network status based on packet loss rate data, delay data, and traffic change in the data transmission process in terms of network transmission characteristics, the process comprising: Mirroring and copying full-link data through the network three-way device, including packet loss rate data, delay data, and traffic change data; Extracting packet loss rate data at preset time intervals, and presetting a packet loss rate data threshold, subtracting the packet loss rate threshold from the packet loss rate of each time interval, if the obtained value is greater than 0, it is recorded as a packet loss difference value, if the obtained value is less than 0, it is directly excluded; Arranging each packet loss difference value in descending order according to the numerical value, and extracting the maximum packet loss difference value and the minimum packet loss difference value as a marker group, and then extracting the maximum packet loss difference value and the minimum packet loss difference value from the remaining packet loss difference values as a marker group after excluding the marker group from the packet loss difference value data, obtaining a corresponding number of marker groups, arranging the marker groups in the order of establishment, and extracting the u-th marker group therefrom; And taking the absolute value of the difference between the maximum packet loss difference value and the minimum packet loss difference value in the u-th marker group, and multiplying it by the time interval between the maximum packet loss difference value and the minimum packet loss difference value, to obtain a packet loss impact value; Extracting the source address and target address of each data from the database, as well as the corresponding source address sending time and target address receiving time, taking the time between the receiving time and the sending time as the transmission time, presetting the allowable fluctuation range of the transmission time, and recording the transmission time that is not within the allowable fluctuation range of the transmission time as the transmission delay time; and extracting the maximum transmission delay time ranked k from all transmission delay times, recorded as the transmission abnormal duration; Extracting the traffic data of each time period and in different paths in the database at preset time intervals, and performing difference calculation on the adjacent traffic, taking the absolute value to obtain the adjacent traffic difference; Comparing each adjacent traffic difference obtained with the threshold set by the type II network monitoring device, marking the adjacent traffic difference greater than the threshold set by the type II network monitoring device, and extracting the maximum v adjacent traffic difference from the marked adjacent traffic difference, and performing difference calculation on the maximum v adjacent traffic difference to obtain a traffic anomaly value; The packet loss influence value, the transmission abnormal duration, the traffic abnormal value, and u, k, and v corresponding thereto are substituted into a machine learning loss function to obtain a network fault evaluation coefficient , and the network transmission state is evaluated based on the network fault evaluation coefficient. The function is: ； Wherein: anomaly label for historical data; sigmoid function; , , u, k, v-driven feature computation, respectively; a packet loss impact value calculated for the u-th marker group; is the transmission anomaly duration ranked k; is the flow anomaly value based on the previous v large flow difference calculation; , , are feature weights, respectively; is a bias term; is the prediction error for a single piece of data; To add all the historical data, the prediction error of n, get the network failure evaluation coefficient ; After traversing all (u, k, v) combinations, compare the network failure evaluation coefficients of each group , the smallest combination is used as the trained model to optimize the subsequent network failure prediction.

2. The substation grid service multi-source operation AI analysis network fault prediction diagnosis system according to claim 1, characterized in that, The network-related business data source module specifically comprises: The business data comprises: Telecontrol business data generated and transmitted by the telecontrol device master and backup in the power secondary equipment; the data covers the operation information of the power primary equipment, including real-time operation parameters of the generator and the transformer; PMU service data, responsible for sending by the synchronous phasor measurement device; focus on dynamic stability monitoring data of power system; New energy service data, responsible for transmission by the integrated communication management terminal device; for new energy power generation scene; data contains output data of new energy equipment and equipment operating status; Relay service data: sent by the relay sub-station server; records the action information of the relay protection device and the setting state; Monitoring events are responsible for uploading by type II network monitoring devices, which belong to network layer state data category.

3. The substation grid service multi-source operation AI analysis network fault prediction diagnosis system of claim 1, wherein, Network three-way device module, specifically including: Equipped with two independent link ports, connected directly with power secondary equipment, PMU device and power dispatching data network switch through physical lines, in series with the original service transmission link; Set forwarding port, real-time copy all service data through link in mirror mode, the device itself does not have MAC address and network address, that is, not to access any network protocol stack, and the forwarding port only supports data input.

4. The substation grid service multi-source operation AI analysis network fault prediction diagnosis system of claim 1, wherein, General database module, specifically including: Complete storage of specific content of service data, also records the meta information of each data; after uniform format processing of heterogeneous data, store again; Database adopts distributed storage architecture, with data redundancy and fault tolerance capability; even if a storage node fails, the system can quickly recover data through redundant nodes.

5. The substation grid service multi-source operation AI analysis network fault prediction diagnosis system of claim 1, wherein, AI analysis processing module, also including: Carefully extract key features from massive database data, and build comprehensive and accurate analysis model; In terms of device state characteristics, closely monitor CPU utilization and memory occupancy of power secondary equipment, and monitor process running state to determine whether there is abnormal process, so as to evaluate the stability of device running comprehensively; In the dimension of business parameter characteristics, focus on analyzing whether the current and voltage of power primary equipment are within the normal threshold range, and checking whether the protection action logic in relay service is consistent with the preset rules; Based on the trend analysis of various characteristic data, give early warning to potential faults.

6. The substation grid service multi-source operation AI analysis network fault prediction diagnosis system according to claim 1, wherein, Result output and application module, specifically including: Display the real-time state of all power secondary equipment in a visual and intuitive interface; Once a fault occurs, generate a report containing detailed fault information; the report content covers fault point, impact range and suggested measures; Only when the explicit fault prompt is detected, arrange personnel to handle the scene.

Images