Intelligent substation communication link fault accurate positioning method and system

Abstract

A kind of intelligent substation communication link fault accurate positioning method and system, comprising: obtaining configuration file and equipment state data, processing configuration file and equipment state data, generate standardized link feature vector and label data set;Construct hybrid deep learning model, the parameter configuration of hybrid deep learning model is optimized using optimization algorithm, obtain parameter optimized hybrid deep learning model;Using real fault sample is trained in combination with the virtual fault sample generated by generative adversarial network, and the timing prediction ability is optimized by echo state network, generate fault positioning model;Combined with link state data, through multistage confidence evaluation and topological correlation analysis, output fault link positioning result and confidence evaluation;Combined with configuration file carries out virtual-real corresponding verification, carries out parameter optimization to fault positioning model, outputs fault positioning system.The invention solves the problems of low fault positioning precision, slow response speed and inability to handle complex fault scenarios.

Description

Technical Field

[0001] This invention relates to the field of intelligent substations in power systems, and in particular to a method and system for accurately locating communication link faults in intelligent substations. Background Technology

[0002] Smart substations are an important component of smart grids. Their communication networks typically employ a complex "three-layer, two-network" topology (station control layer MMS network and process layer GOOSE / SV network), carrying a large amount of critical information exchange and transmission. With the widespread application of smart substations, the reliability of their communication links is crucial to the safe and stable operation of the entire power system.

[0003] Current intelligent substation communication systems typically employ Ethernet technology based on the IEC 61850 standard, including MMS communication at the station control layer and GOOSE / SV communication at the process layer. The station control layer primarily facilitates communication between the control center and the intelligent substation, while the process layer is responsible for real-time data exchange between various protection devices within the substation. These communications are built upon a complex physical topology, including multiple switches, IED devices, and their interconnecting links.

[0004] Existing communication link fault location technologies mainly rely on manual parsing of alarm information and analysis of communication device logs. This method typically requires maintenance personnel to make judgments based on experience, starting with alarms from individual devices, gradually checking for possible fault points, and then verifying them by combining SCD files and physical topology diagrams. This process is not only tedious and time-consuming, but also prone to misjudgment in complex network environments, especially when multiple links are abnormal at the same time, making it difficult to accurately locate the root cause of the fault.

[0005] Traditional fault location methods have the following technical drawbacks: First, they cannot effectively utilize multi-dimensional data features and rely solely on single alarm information for judgment; second, they lack systematic analysis of network topology, making it difficult to identify the correlation between faulty links; third, manual analysis is inefficient and difficult to achieve rapid response in large substation networks; and finally, they do not consider the fusion analysis of temporal characteristics and spatial topology, resulting in limited fault location accuracy. Summary of the Invention

[0006] The purpose of this invention is to provide a method and system for accurate fault location of communication links in intelligent substations, aiming to solve the technical problems of low fault location accuracy, slow response speed and inability to handle complex fault scenarios in the existing technology.

[0007] This invention utilizes a hybrid deep learning model that combines graph convolutional networks to capture spatial topological features with bidirectional long short-term memory networks to extract temporal features. It optimizes model parameters using a memory-enhanced fractional-order dung beetle optimization algorithm and expands fault samples using generative adversarial networks. This enables rapid and accurate location of communication link faults in smart substations. Furthermore, the reliability of the fault location results is ensured through a multi-level confidence assessment mechanism and virtual-real correspondence verification.

[0008] This invention discloses a method for accurate fault location in a communication link of a smart substation, comprising: acquiring configuration files containing SCD files and SPCD files, and equipment status data of the smart substation; parsing, cleaning, and standardizing the configuration files and equipment status data to generate standardized link feature vectors and labeled datasets; constructing a hybrid deep learning model based on the standardized link feature vectors and labeled datasets, fusing a topology feature extraction module of a graph convolutional network and a temporal feature extraction module of a bidirectional long short-term memory network; and optimizing the parameter configuration of the hybrid deep learning model using a memory-enhanced fractional-order dung beetle optimization algorithm to obtain a parameter-optimized hybrid deep learning model. The hybrid deep learning model, optimized by the aforementioned parameters, is trained using real fault samples combined with virtual fault samples generated by a generative adversarial network. The timing prediction capability is optimized through an echo state network to generate a trained fault location model. Based on this model and real-time collected link status data, multi-level confidence assessment and topology correlation analysis are used to output the fault link location result and confidence assessment. Based on the fault link location result and confidence assessment, and combined with the logical loop information in the configuration file, virtual-real correspondence verification is performed. An online learning mechanism is then used to optimize the parameters of the trained fault location model, resulting in a complete fault location system.

[0009] Further, the parsing, cleaning, and standardization of the configuration file and the device status data to generate standardized link feature vectors and labeled datasets includes: extracting intelligent substation logical loop information from the SCD file of the configuration file, including the IED device list, switch configuration, virtual terminal mapping, and GOOSE / SV publish-subscribe relationships, based on the configuration file and the real-time operating status and alarm information of the switches collected via the SNMP protocol; extracting the physical topology from the SPCD file of the configuration file, including fiber optic connections, port mappings, and device locations, to generate an initial multi-source heterogeneous dataset; and further... The initial multi-source heterogeneous dataset is time-synchronized, missing data is identified and processed, time-series data is completed using an interpolation algorithm based on long short-term memory networks, outliers are marked and filtered using the 3σ criterion, and a cleaned standard dataset is generated. Based on the cleaned standard dataset, the switch alarm information is converted into a binary feature vector, the switch traffic and CPU utilization time-series data of the real-time operating status of the switch are standardized to the [0,1] interval, the topology is converted into an adjacency matrix representation, a sender-receiver-APPID mapping table is constructed, and the standardized link feature vector and the marked dataset are generated.

[0010] Furthermore, the hybrid deep learning model that integrates a topology feature extraction module based on a graph convolutional network and a temporal feature extraction module based on a bidirectional long short-term memory network includes: designing a topology feature extraction module based on a graph convolutional network, representing the physical and logical topology of the substation as a graph structure, designing a two-layer graph convolutional network structure, the first layer capturing the features of directly connected nodes, and the second layer extending to second-order neighbors to achieve topology association capture, outputting a 64-dimensional topology feature vector; and designing a hybrid deep learning model based on a bidirectional long short-term memory network, based on the standardized link feature vector and the labeled dataset. The temporal feature extraction module of the memory network is configured with a three-layer bidirectional long short-term memory network structure, with 128 hidden units in each layer and an input window of 100 time steps. It processes the temporal changes of the real-time operating status and alarm information of the switch and outputs a 128-dimensional temporal feature vector. Based on the 64-dimensional topological feature vector and the 128-dimensional temporal feature vector, a feature fusion layer is designed. The 64-dimensional topological feature vector and the 128-dimensional temporal feature vector are concatenated and then compressed into a 64-dimensional hybrid feature vector through a fully connected layer. A Softmax multi-classifier is then constructed to achieve classification and identification of link fault types.

[0011] Furthermore, the optimization of the parameter configuration of the hybrid deep learning model using the memory-enhanced fractional-order dung beetle optimization algorithm includes: for the hybrid deep learning model, introducing fractional-order calculus theory to construct a memory mechanism for historical search information; and using fractional-order differential operators to ensure that the current parameter update process of the hybrid deep learning model simultaneously considers the current gradient and the historical search trajectory, with the parameter update formula being: ,in Describes the α-order differential operator. The current optimal solution is given by r, which is a random coefficient, and C(t) is a chaotic perturbation term, thus obtaining the parameter search strategy. Based on the parameter search strategy, the key parameters of the graph convolutional network, including the number of layers, the number of hidden units, and the learning rate, are optimized using the memory-enhanced fractional-order dung beetle optimization algorithm to avoid getting trapped in local optima, resulting in the optimized parameter configuration. According to the optimized parameter configuration, the 64-dimensional topological feature vector is output to effectively characterize the spatial correlation characteristics between devices, thus obtaining the parameter-optimized hybrid deep learning model.

[0012] Furthermore, the training using real fault samples combined with virtual fault samples generated by a generative adversarial network includes: establishing a fault type library based on collected historical fault data, including single-link disconnection, port jitter, broadcast storm, and configuration error; extracting traffic change features, alarm sequence patterns, and topology impact range for each fault type in the fault type library to form a fault feature template library; designing a generative adversarial network based on the fault feature template library; the generator learns to generate virtual samples that conform to various fault characteristics; the discriminator optimizes the realism of the generated samples; and a fractional-order logistic chaotic graph is applied to enhance sample diversity and avoid generation pattern collapse to generate virtual fault samples; based on the real fault samples and the virtual fault samples, a hybrid training strategy is adopted, first using the real fault samples for initial training, and then introducing the virtual fault samples for incremental learning; a chaotic perturbation mechanism is applied to avoid the model getting trapped in local optima; and an early stopping strategy is introduced to prevent overfitting.

[0013] Furthermore, the optimization of temporal prediction capability through the echo state network includes: constructing an echo state network based on the hybrid deep learning model optimized by the parameters, wherein the state update equation is as follows: Where s(t) is the reservoir state vector at time t, u(t) is the input vector at time t, W is the reservoir internal connection weight matrix, and Win is the input weight matrix. Let f be the leakage rate and f be the activation function, and then the state update strategy is obtained. The original time-series data is processed by the echo state network and long-term dynamic features are extracted. It works in conjunction with the bidirectional long short-term memory network to further refine the features and capture short-term dependencies, resulting in an optimized time-series feature representation. Based on the optimized time-series feature representation and the time-series prediction capability of the echo state network, the gradual fault features in the communication link are captured, and the 128-dimensional time-series feature vector is output, resulting in the trained fault location model.

[0014] Furthermore, the step of outputting fault link location results and confidence assessments through multi-level confidence evaluation and topology correlation analysis includes: based on the trained fault location model and real-time collected link status data, inputting the real-time features of the link status data into the trained fault location model, calculating the fault probability distribution of each link, and directly outputting the fault location result when the highest probability ≥ 0.85 to obtain a first-level confidence fault location result; based on the fault probability distribution, when 0.7 ≤ highest probability < 0.85, triggering secondary inference, calculating the link correlation matrix, analyzing the topological relationship between the Top-N probability links, and applying a Bayesian network model to comprehensively evaluate the joint fault probability of multiple links to obtain a corrected fault probability assessment; based on the first-level confidence fault location result or the corrected fault probability assessment, using multi-level confidence evaluation, outputting the fault link location result and corresponding confidence assessment to achieve accurate identification of complex fault scenarios.

[0015] Furthermore, the virtual-to-physical correspondence verification based on the logical loop information in the configuration file includes: based on the fault link location result and the configuration file, querying the logical loop information in the configuration file for the located physical link fault, checking whether the physical link matches the identified logical fault, and obtaining a virtual-to-physical matching analysis; based on the virtual-to-physical matching analysis, calculating the virtual-to-physical consistency score S = N using the matching result. match / N total , where N match N is the number of faults in the virtual-to-real matching. total The total number of faults is used to obtain a consistency assessment. Based on the consistency assessment, the reliability of the result is adjusted according to the virtual-real consistency score. When S≥0.8, it is marked as high reliability; when 0.5≤S<0.8, it is marked as medium reliability; and when S<0.5, it is marked as low reliability. The fault location result after reliability adjustment is obtained.

[0016] Furthermore, the online learning mechanism for parameter optimization of the trained fault location model includes: collecting manually confirmed new fault samples; using the new fault samples to perform small-batch updates on the trained fault location model with a learning rate of 0.0001, and outputting a parameter update strategy; based on the parameter update strategy and historical judgment accuracy, dynamically adjusting the confidence threshold through historical judgment accuracy; automatically adjusting feature weights by analyzing successful and failed fault location cases to enhance sensitivity to key features, thus obtaining an adaptive optimization mechanism; and based on the adaptive optimization mechanism, maintaining a dynamic fault mode knowledge base, adding newly identified fault modes to the fault mode knowledge base for future comparison and analysis, thereby achieving continuous optimization of the trained fault location model and obtaining the complete fault location system.

[0017] This invention also provides a precise fault location system for communication links in intelligent substations, comprising: a data acquisition and preprocessing module, used to acquire configuration files containing SCD files and SPCD files and equipment status data of the intelligent substation, and to parse, clean, and standardize the configuration files and equipment status data to generate standardized link feature vectors and labeled datasets; and a model construction and optimization module, used to construct a hybrid deep learning model based on the standardized link feature vectors and the labeled datasets, fusing a topology feature extraction module of a graph convolutional network and a temporal feature extraction module of a bidirectional long short-term memory network, and to optimize the parameter configuration of the hybrid deep learning model using a memory-enhanced fractional-order dung beetle optimization algorithm to obtain a parameter-optimized hybrid deep learning model. The model training module is used to train a hybrid deep learning model with optimized parameters, using real fault samples combined with virtual fault samples generated by a generative adversarial network, and to optimize the time-series prediction capability through an echo state network to generate a trained fault location model. The fault location module is used to output the fault link location result and confidence assessment based on the trained fault location model and real-time collected link status data, through multi-level confidence assessment and topology correlation analysis. The system optimization module is used to perform virtual-real correspondence verification based on the fault link location result and confidence assessment, combined with the logical loop information in the configuration file, and to optimize the parameters of the trained fault location model using an online learning mechanism to output a complete fault location system.

[0018] Compared with the prior art, the present invention has the following beneficial effects:

[0019] 1. This invention, by fusing graph convolutional networks and bidirectional long short-term memory networks, can simultaneously capture the topological spatial features and temporal variation features of substation communication networks, significantly improving fault location accuracy in complex environments;

[0020] 2. This invention employs a memory-enhanced fractional-order dung beetle optimization algorithm to optimize deep learning model parameters, effectively avoiding the problem of traditional optimization methods easily getting trapped in local optima, and improving model performance and convergence speed;

[0021] 3. This invention utilizes generative adversarial networks and fractional-order logical chaotic graph techniques to expand fault samples, solving the problem of scarce fault samples in real-world environments and enhancing the model's generalization ability;

[0022] 4. The multi-level confidence assessment mechanism and virtual-real correspondence verification method designed in this invention realize the reliability assessment of fault location results and reduce the false judgment rate;

[0023] 5. The online learning mechanism of this invention enables the system to continuously learn from operational experience, constantly optimize model parameters, and achieve continuous improvement in fault location capabilities. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A flowchart of a method for accurately locating communication link faults in intelligent substations provided in an embodiment of the present invention;

[0026] Figure 2 This is a structural diagram of the intelligent substation communication link fault accurate location system provided in an embodiment of the present invention. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] like Figure 1 As shown in the figure, this embodiment of the invention provides a method for accurate location of communication link faults in intelligent substations, the method comprising:

[0029] Step S1: Obtain the configuration file and equipment status data of the smart substation, which includes SCD and SPCD files. Parse, clean and standardize the configuration file and equipment status data to generate standardized link feature vectors and labeled datasets.

[0030] In this step, the core configuration files of the smart substation are first obtained through standard interfaces, including the SCD (Substation Configuration Description) file and SPCD (Substation Physical Connection Description) file specified in the IEC 61850 standard. The SCD file contains the logical connection relationships, communication configurations, and functional definitions between all IEDs (Intelligent Electronic Devices) within the smart substation, serving as a digital description of substation automation. The SPCD file, on the other hand, records in detail the physical connection relationships between devices, including physical layer information such as fiber optic cabling and port mapping. Simultaneously, real-time operational status data of the substation network devices is collected via SNMP (Simple Network Management Protocol), primarily including key indicators such as switch port traffic, CPU utilization, memory usage, and port status changes, as well as various alarm information. This smart substation adopts the IEC 61850 standard, digitizing information from primary and secondary equipment and transmitting it through a communication network. Compared to traditional substations, smart substations replace hard-wired connections with digital information exchange, achieving networked integration of various protection, monitoring, and measurement functions.

[0031] After acquiring the above data, the configuration file is parsed in a structured manner. Logical loop information of the smart substation is extracted from the XML-formatted SCD file, including the IED device list, switch configuration parameters, virtual terminal mapping relationships, and GOOSE / SV communication publish-subscribe relationships. The physical topology is extracted from the SPCD file to establish a complete network connection diagram. Then, the real-time acquired device status data is cleaned, including timestamp alignment, missing value handling, and outlier filtering, to ensure data quality. Finally, feature engineering techniques are used to convert the multi-source heterogeneous data into standardized feature vectors, including spatial topological features and temporal variation features, providing high-quality input for subsequent deep learning models.

[0032] Step S2: Based on the standardized link feature vectors and the labeled dataset, construct a hybrid deep learning model that integrates the topological feature extraction module of the graph convolutional network and the temporal feature extraction module of the bidirectional long short-term memory network. Optimize the parameter configuration of the hybrid deep learning model using the memory-enhanced fractional-order dung beetle optimization algorithm to obtain a parameter-optimized hybrid deep learning model.

[0033] This step designs an innovative hybrid deep learning architecture that fully considers the dual characteristics of smart substation communication networks: spatial topology and temporal dynamic changes. First, a topology feature extraction module is constructed using a Graph Convolutional Network (GCN). This module represents the physical and logical topology of the substation as a graph structure, capturing spatial relationships and neighborhood information between nodes through multi-layer graph convolution operations, effectively extracting network topology features. Second, a temporal feature extraction module based on a Bidirectional Long Short-Term Memory (Bi-LSTM) network is designed. This module can simultaneously consider past and future temporal information, making it suitable for capturing the temporal evolution patterns of communication states and changes before and after faults.

[0034] The outputs of the two feature extraction modules are integrated through a feature fusion layer to form a hybrid feature representation that combines spatial and temporal characteristics. To optimize model performance, a memory-enhanced fractional-order dung beetle optimization algorithm is introduced to fine-tune the model parameters. This algorithm, based on fractional calculus theory, incorporates the "memory" of historical search information, enabling the parameter update process to simultaneously consider the current gradient and historical search trajectories. This effectively avoids the problem of traditional optimization methods easily getting trapped in local optima, improving the model's convergence speed and performance ceiling.

[0035] Step S3: Combine the hybrid deep learning model with the optimized parameters, train it using real fault samples and virtual fault samples generated by generative adversarial networks, and optimize the temporal prediction capability through echo state network to generate the trained fault localization model.

[0036] In the actual operating environment of smart substations, real communication link fault samples are relatively scarce, posing a challenge to the effective training of deep learning models. To address this issue, this step first collects and analyzes historical fault data to establish a feature template library including typical faults such as single-link disconnection, port jitter, broadcast storms, and configuration errors. Then, a generative adversarial network (GAN) technique is innovatively introduced to expand the fault samples. A GAN consists of a generator and a discriminator. The generator learns to produce virtual samples that conform to various fault characteristics, while the discriminator is responsible for evaluating the realism of the generated samples. Through adversarial training, the two continuously improve the quality of the generated samples.

[0037] To enhance the diversity of GAN-generated samples, this invention employs fractional-order logistic chaotic graph technology to modulate the initial noise, avoiding the pattern collapse problem common in traditional GANs. This method generates a large number of high-quality virtual fault samples, significantly expanding the training dataset. Simultaneously, an Echo State Network (ESN) is introduced to optimize the model's temporal prediction capabilities. ESN possesses unique "echo state" characteristics, making it particularly suitable for capturing long-term dependencies in temporal data. Working in conjunction with Bi-LSTM, it further enhances the model's ability to identify gradual faults and complex temporal patterns. Finally, a hybrid training strategy is used to train the model, resulting in a high-performance fault localization model.

[0038] Step S4: Based on the trained fault location model and the real-time collected link status data, output the fault link location result and confidence assessment through multi-level confidence evaluation and topology correlation analysis.

[0039] This step enables the application of the trained deep learning model in a real-world environment. Real-time status data from substation communication equipment is continuously collected, and standardized feature vectors are generated using the same preprocessing procedures as in the training phase. These vectors are then input into the trained model to calculate the fault probability distribution of each link. To improve the accuracy and reliability of fault location, this invention designs a multi-level confidence assessment mechanism: when the highest fault probability reaches or exceeds 0.85, the link is directly output as the fault location result for rapid response; when the highest probability is between 0.7 and 0.85, a secondary inference process is triggered. By calculating the link correlation matrix, the topological relationships between high-probability links are analyzed, and a Bayesian network model is applied to comprehensively evaluate the joint fault probability of multiple links, resulting in a more accurate fault diagnosis.

[0040] This multi-level confidence assessment mechanism is particularly suitable for handling complex fault scenarios, such as cascading or multi-point faults. For example, when a core switch port fails, multiple downstream links may simultaneously report anomalies. Traditional methods struggle to pinpoint the root cause, while this mechanism, through topology correlation analysis, can accurately trace the initial fault location. Practical applications show that approximately 60% of faults can be accurately located using first-level inference, while more complex cases receive more precise results through second-level inference. The overall average response time is controlled within 3 seconds, meeting the rapid fault response requirements of smart substations.

[0041] Step S5: Based on the fault link location results and confidence assessment, and combined with the logical loop information in the configuration file, perform virtual-real correspondence verification, and use an online learning mechanism to optimize the parameters of the trained fault location model to output a complete fault location system.

[0042] To further improve the reliability of fault location, this step introduces a virtual-physical correspondence verification mechanism. Specifically, the located physical link fault is compared and verified with the logical loop information in the SCD file to check whether the physical link fault matches the identified logical fault. For example, when a physical link is determined to be faulty, it is checked whether the corresponding GOOSE / SV virtual loop in the SCD file also shows communication anomalies. By calculating the consistency score of the virtual-physical match, the reliability of the fault location results is graded and labeled, providing decision-making reference for operations and maintenance personnel.

[0043] Another innovation of this invention is the realization of the system's continuous learning capability. By collecting manually confirmed new fault samples, the model is trained online using a mini-batch update method with a low learning rate (0.0001) to prevent over-adaptation to new samples and the forgetting of previously learned knowledge. Furthermore, the confidence threshold is dynamically adjusted based on historical judgment accuracy, and feature weights are automatically adjusted by analyzing successful and failed fault location cases, enhancing sensitivity to key features. Simultaneously, a dynamically updated fault mode knowledge base is maintained, continuously accumulating new fault modes for future comparison and analysis.

[0044] Through this closed-loop self-learning mechanism, the system can continuously optimize its performance based on operational experience, adapting to network changes and emerging fault types. Actual operational tests show that the fault location accuracy has gradually increased from 88% at initial deployment to over 95%, fully demonstrating the technological advancement and practical value of this invention.

[0045] In step S1, the parsing, cleaning, and standardization of the configuration file and the device status data to generate standardized link feature vectors and labeled datasets includes:

[0046] Step S11: Based on the configuration file and the real-time operating status and alarm information of the switch collected via the SNMP protocol, extract the intelligent substation logical circuit information from the SCD file of the configuration file, including the IED device list, switch configuration, virtual terminal mapping and GOOSE / SV publish-subscribe relationship, and extract the physical topology from the SPCD file of the configuration file, including fiber optic connections, port mapping and device location, to generate an initial multi-source heterogeneous dataset.

[0047] In this step, a multi-channel data acquisition mechanism is first established. For the configuration file, a dedicated XML parsing engine was developed to perform deep parsing of the SCD file. The SCD file is an XML format file based on the IEC 61850 standard, containing the complete logical structure of the smart substation. The parsing engine extracts key information through XPath and DOM operations, including: an IED device list, recording the model, function, and configuration parameters of all intelligent electronic devices in the substation; switch configuration information, including VLAN partitioning, port parameter settings, and QoS policies; virtual terminal mapping relationships, recording the correspondence between logical signals and physical interfaces; and GOOSE / SV communication publish-subscribe relationships, describing which devices publish specific information and which devices subscribe to this information.

[0048] For SPCD files, extract the physical topology information, including: fiber optic connections, which record the physical link layout between devices; port mapping information, which details the purpose and connected objects of each physical port; and device location information, which records the physical installation location of each device in the substation. This information is crucial for understanding the network physical structure and the scope of fault impact.

[0049] Meanwhile, the system collects the operational status of network devices in real time via the SNMP protocol. SNMPv3 is used to ensure secure data transmission, polling key switch parameters every 5 seconds, including: port status (ifOperStatus), indicating whether the port is functioning correctly; traffic counters (ifInOctets, ifOutOctets), recording inbound and outbound traffic; CPU utilization and memory usage, reflecting the device's resource consumption; and port error counters, recording anomalies such as collisions and CRC errors. Additionally, the system receives alarm information proactively sent by devices, such as port status changes and device self-test anomalies, in parallel using both SNMP Trap and Syslog methods.

[0050] Through the above multi-source data collection, an initial heterogeneous dataset was generated, which includes the static configuration information and dynamic operating status of the substation communication network, laying the foundation for subsequent analysis.

[0051] Step S12: Synchronize the initial multi-source heterogeneous dataset in time, identify and process missing data, complete the time-series data using an interpolation algorithm based on a long short-term memory network, mark and filter outliers using the 3σ criterion, and generate a cleaned standard dataset.

[0052] A major challenge with multi-source heterogeneous datasets is data quality, including time discrepancies, missing data, and outliers. This step first addresses the time synchronization issue. Since clocks on different devices may deviate, a unified Network Time Protocol (NTP) server is used as a reference to calibrate the timestamps of all data, ensuring time sequence consistency. For historical data that cannot be directly calibrated, a linear interpolation method is used to map the timestamps to a unified time coordinate system.

[0053] Traditional methods for filling missing data often employ simple mean or linear interpolation, but these methods struggle to capture complex temporal patterns. This invention innovatively applies an interpolation algorithm based on Long Short-Term Memory (LSTM) networks to handle missing data. The algorithm first trains an LSTM model using complete historical data to learn the time-series characteristics of the data, and then uses the trained model to predict missing values. Specifically, the algorithm uses known data before and after the missing point as input sequences, and generates predicted values ​​that conform to historical patterns through the LSTM network to fill the missing points. This method is particularly suitable for processing network traffic and device status data with complex temporal dependencies, generating completion results that more accurately reflect actual changing trends.

[0054] For outlier detection, the 3σ criterion from statistics is employed. First, the mean (μ) and standard deviation (σ) of each time-series indicator are calculated. Then, data points deviating from the mean by more than three standard deviations (i.e., |x-μ|>3σ) are marked as potential outliers. These outliers are not simply deleted; instead, a comprehensive judgment is made based on equipment alarm information: if the outlier's time is close to the equipment alarm time, it is retained as a valid fault feature; if there is no corresponding alarm and the deviation is too large, it is judged as noise and filtered out. This outlier handling method, which incorporates business logic, effectively balances the need to retain valid fault features and filter irrelevant noise.

[0055] Through the aforementioned time synchronization, missing value handling, and outlier filtering, a standard dataset with significantly improved quality was generated, providing a reliable foundation for subsequent feature engineering and model training.

[0056] Step S13: Based on the cleaned standard dataset, the switch alarm information is converted into a binary feature vector, the switch traffic and CPU utilization time series data of the real-time operating status of the switch are standardized to the [0,1] interval, the topology is converted into an adjacency matrix representation, a sender-receiver-APPID mapping table is constructed, and the standardized link feature vector and the labeled dataset are generated.

[0057] This step involves feature engineering, transforming the cleaned multi-source data into standardized features that can be directly used by deep learning models. First, discrete device alarm information is processed. An alarm type dictionary is established, mapping each alarm to a unique identifier. Then, a binary feature vector is constructed: each position in the vector corresponds to an alarm type; if the alarm occurs at a certain time, the corresponding position is 1, otherwise it is 0. This representation method preserves the alarm type information while facilitating model processing.

[0058] For continuous time-series data, such as switch port traffic and CPU utilization, the min-max normalization method is used to map them to the [0,1] interval: The standardization process takes into account the differences in characteristics of different devices and ports, calculating the historical maximum and minimum traffic values ​​for each port separately, thus avoiding information loss that might result from simple global standardization. For metrics such as CPU utilization, a sliding window mechanism is introduced to dynamically update standardization parameters using data from the past 24 hours, adapting to long-term trends in device load.

[0059] For the network topology, it is converted into an adjacency matrix representation. Each row and column of the matrix corresponds to a network node (device or port), and the matrix element a ij Indicate whether there is a connection between node i and node j: if there is, then a ij =1, otherwise a ij =0. For a weighted graph representation, a ij It can be a weighted value such as link bandwidth or link quality. The adjacency matrix is ​​the standard input format for graph convolutional networks and can effectively express the topological relationships of the network.

[0060] In addition, a "sender-receiver-APPID" mapping table was constructed to record communication relationships. In the IEC 61850 standard, APPID (Application Identifier) ​​is used to identify different types of communication messages, such as GOOSE messages or SV sample values. The mapping table records which devices send messages with specific APPIDs and which devices receive these messages, thus establishing a complete communication dependency graph. This is crucial for identifying the scope of a fault's impact and its propagation path.

[0061] Ultimately, a standardized set of link feature vectors was generated, comprising two main categories: spatial features (topology, device type, port attributes, etc.) and temporal features (traffic changes, CPU utilization trends, alarm sequences, etc.). Simultaneously, based on historical fault records and expert annotations, a corresponding labeled dataset was constructed, recording the fault type and location for each sample. These high-quality feature vectors and labeled datasets provided a solid foundation for the subsequent training of deep learning models.

[0062] In step S2, the construction of the hybrid deep learning model that integrates the topological feature extraction module of the fused graph convolutional network and the temporal feature extraction module of the bidirectional long short-term memory network includes:

[0063] Step S21: Based on the standardized link feature vector and the labeled dataset, design a topology feature extraction module based on graph convolutional network, represent the physical and logical topology of the substation as a graph structure, design a two-layer graph convolutional network structure, the first layer captures the features of directly connected nodes, and the second layer extends to second-order neighbors to realize topology association capture and output a 64-dimensional topology feature vector.

[0064] The communication network of a smart substation exhibits typical graph structure characteristics, with devices and ports forming nodes and physical links forming edges. Traditional deep learning methods such as CNNs and RNNs struggle to directly process this non-Euclidean structure data. Graph Convolutional Networks (GCNs), however, are specifically designed for graph-structured data and can effectively learn the spatial relationships and topological features between nodes. In this step, the physical and logical topology of the substation are first represented as a heterogeneous graph structure G=(V,E,X), where V is the set of nodes, including IED devices, switches, and ports; E is the set of edges, representing physical link connections; and X is a node feature matrix, with each row corresponding to a node's attribute vector, containing information such as device type, importance level, and configuration parameters.

[0065] Based on this, a two-layer graph convolutional network structure was designed for feature extraction. The core idea of ​​graph convolution is to update the node representation through neighborhood aggregation operations, so that the features of each node not only contain its own information, but also incorporate the information of its neighboring nodes. The first layer graph convolution operation is expressed as follows: ,in It is an adjacency matrix with self-joins added (ensuring that the node's own information is also considered), and D is a degree matrix (diagonal elements D). ii (equal to the degree of node i), X is the initial node characteristic matrix, W (0) This is the learnable weight matrix for the first layer (dimension is the initial feature dimension × 32), and σ is the ReLU activation function. This layer captures the relationship between each node and its directly connected nodes, learning first-order neighborhood features.

[0066] The second layer of graph convolution further expands the receptive range to second-order neighbors, and the calculation formula is as follows: ,

[0067] Where H (1) It is the output feature of the first layer, W (1) It is the learnable weight matrix of the second layer (32×64 dimensions). In this way, the final representation of each node not only contains information about itself and its directly connected nodes, but also indirectly contains information about its second-order neighbors, which greatly enhances the model's ability to capture network topology relationships.

[0068] To enhance the model's ability to distinguish between different types of nodes, a node type embedding mechanism is introduced. Nodes are classified according to device type (such as switches, protection devices, monitoring and control devices, etc.), and a fixed-dimensional embedding vector is learned for each type of node. This vector is then concatenated with the node's original features to form an enhanced node representation. This approach enables the model to distinguish the specific roles and importance of different functional devices in the network.

[0069] Finally, the graph convolutional network outputs a 64-dimensional feature vector for each node, representing the node's structural characteristics and neighborhood information within the overall network topology. Through average pooling or attention weighting of node-level features, the features of all nodes are aggregated into a single global graph feature vector, which serves as the final output of the topology feature extraction module. This 64-dimensional feature vector effectively encodes the spatial structural information of the substation communication network, providing an important topological perspective for subsequent fault localization.

[0070] For example, the two-layer graph convolutional network structure is the core of the topology feature extraction module, and its construction and training process demonstrates how the system understands the complex network topology of a substation. First, the substation communication network is represented as a graph structure, containing all device nodes (such as IED devices, switches, etc.), physical link connections, and initial node features. These initial features are quite rich, including attributes such as device type (encoded as one-hot vectors), importance level (1-5 points), number of ports, and operating status, typically with a dimension of around 20-30, comprehensively describing the basic characteristics of each network device. The first layer of the two-layer GCN uses 32 convolutional kernels, specifically responsible for capturing the feature relationships between directly connected nodes. The key function of this layer is to enable each node to aggregate information from its directly connected neighbors, recognizing first-order topology features such as star connection structures and key aggregation points. For example, when a switch connects to multiple terminal devices, the first-layer GCN can effectively capture this "one-to-many" star topology feature and identify potential key nodes. The second layer further uses 64 convolutional kernels, significantly expanding the perception range to second-order neighbors. This layer enables each node to perceive its "neighbor's neighbor," thus capturing more complex topologies such as ring connections and bridging paths. This is crucial for identifying complex fault propagation paths; for example, when a core switch failure causes multiple downstream devices to malfunction, the second-layer GCN can track such multi-level impact paths. During actual training, a series of carefully tuned hyperparameters were employed: batch size was set to 32 to balance training efficiency and memory consumption; the initial learning rate was 0.001, and the Adam optimizer was used for adaptive learning; the weight decay coefficient was set to 5e-4 to prevent overfitting; the dropout rate was 0.2 to enhance the model's generalization ability; and the maximum number of training epochs was set to 200, but an early stopping strategy was used to avoid overtraining. To further enhance training performance, feature normalization was used to scale all features to a uniform range, and graph data augmentation techniques such as random edge dropping and node feature perturbation were applied to enhance the model's robustness to topology changes. After training, global average pooling or attention weighting mechanisms were used to aggregate the 64-dimensional features of all nodes into a global graph representation, which served as the final output of the topology feature extraction module. This 64-dimensional vector efficiently encodes the spatial structure information of the substation communication network, providing a crucial topological perspective for subsequent fault location and enabling accurate identification of the fault location and its impact range.

[0071] Step S22: Based on the standardized link feature vector and the labeled dataset, design a time-series feature extraction module based on a bidirectional long short-term memory network, configure a three-layer bidirectional long short-term memory network structure with 128 hidden units in each layer, and an input window of 100 time steps, process the time-series changes of the real-time operating status of the switch and the alarm information of the switch, and output a 128-dimensional time-series feature vector.

[0072] Besides topology, communication link failures are often accompanied by temporal patterns of device status and alarm information. For example, abnormal traffic fluctuations and a gradual increase in packet loss rate may precede a link failure; when a failure occurs, multiple related devices may trigger different types of alarms in a specific time sequence. Capturing these temporal patterns is crucial for fault localization. This step designs a temporal feature extraction module based on a bidirectional long short-term memory network (Bi-LSTM) specifically to process these time-dimensional data features.

[0073] Long Short-Term Memory (LSTM) networks are a special type of recurrent neural network that effectively learns long-term dependencies in long sequences of data by introducing memory cells and three gating mechanisms (input gate, forget gate, and output gate), avoiding the vanishing gradient problem in traditional RNNs. Bidirectional LSTM further enhances this capability, containing two directional LSTM layers: one processing forward sequences from the past to the future, and the other processing reverse sequences from the future to the past. This bidirectional structure allows the model to utilize historical information and consider future trends when predicting the current state, making it particularly suitable for tasks requiring global temporal context, such as fault diagnosis. The construction and training of the LSTM network are core steps in temporal feature extraction and play a crucial role in fault diagnosis in smart substations. In practical applications, a three-layer stacked bidirectional LSTM network was constructed to process temporal data from a communication system. The input layer receives sequence data for 100 time steps, each containing more than 20 monitoring metrics such as port traffic, packet error rate, and CPU utilization. The first LSTM layer contains 128 hidden units to capture basic temporal patterns; the second layer also has 128 units but adds residual connections to mitigate gradient propagation; the third layer has 64 units to further refine key temporal features. Each LSTM layer is followed by a Dropout layer (with a ratio of 0.3) to effectively prevent overfitting. Network training employs sequence-to-sequence supervised learning, based on labeled fault sequence data. A series of carefully selected training hyperparameters were used: the sequence length was set to 100 time steps (equivalent to 10 minutes of monitoring data); the batch size was 16, balancing training speed and memory requirements; the Adam optimizer was used with an initial learning rate of 0.001, and cosine annealing was employed during training (decreasing by 50% every 50 epochs); gradient clipping was applied to prevent gradient explosion, with a threshold of 5.0; the maximum number of training epochs was 150, but an early stopping strategy was implemented (stopping if the validation set loss showed no improvement for 10 consecutive epochs). To enhance the model's robustness to noisy data, temporal data augmentation strategies were implemented, including time masking (randomly masking 5% of time steps), Gaussian noise injection (standard deviation of 0.01), and time warping (maximum warp range of ±2 time steps). These techniques significantly improved the model's generalization ability, enabling it to adapt to noise interference in various real-world environments. Finally, the bidirectional LSTM, through learning in both forward and backward directions, successfully captured the complete temporal dynamic features before and after the fault occurred, providing crucial temporal dimension information for accurate fault identification. Tests show that this structure improves fault identification accuracy by approximately 8.5% compared to unidirectional LSTM, particularly excelling in identifying gradual faults.

[0074] In terms of specific design, the time-series feature extraction module is configured with a three-layer stacked bidirectional LSTM network. The input layer receives a time-series feature sequence with a length of 100 time steps (corresponding to approximately 500 seconds of data, considering a sampling interval of 5 seconds), including traffic data of each port, CPU utilization, memory usage, link status changes, and alarm information. The feature dimension of each time step is dynamically determined based on the number of monitoring indicators and devices, typically ranging from several hundred to several thousand.

[0075] The first Bi-LSTM layer contains 128 hidden units (64 in each direction) and is responsible for initially extracting local temporal features. The second layer also contains 128 hidden units to further abstract temporal patterns. The third layer also contains 128 hidden units to generate the final high-level temporal representation. A Dropout regularization of 0.2 is applied after each LSTM layer to prevent overfitting. This three-layer stacked structure forms a hierarchical representation of temporal features, from simple patterns at lower levels to complex patterns at higher levels, comprehensively capturing the temporal dynamics of the data.

[0076] The calculation formulas for forward LSTM and backward LSTM are as follows:

[0077]

[0078] Where x t These are the input features at time t. t and t These are the hidden states of the forward and backward LSTMs at time t, respectively. Finally, the output feature at each time step is the concatenation of the two hidden states: h t = [ t , t To obtain a global representation of the entire sequence, an attention mechanism is used to weight and aggregate the outputs of all time steps, generating a 128-dimensional temporal feature vector. The attention weights are calculated based on the importance of the features at each time step, enabling the model to automatically focus on key moments in the sequence, such as alarm trigger points or traffic surges.

[0079] This meticulously designed temporal feature extraction module can effectively capture the temporal evolution patterns of equipment status and alarms, identify the sequence of feature changes before and after a fault occurs, and provide key time-dimensional information for fault location.

[0080] Step S23: Based on the 64-dimensional topological feature vector and the 128-dimensional temporal feature vector, a feature fusion layer is designed. The 64-dimensional topological feature vector and the 128-dimensional temporal feature vector are concatenated and then compressed into a 64-dimensional hybrid feature vector through a fully connected layer. A Softmax multi-classifier is then constructed to achieve classification and identification of link fault types.

[0081] The topology feature extraction module and the temporal feature extraction module capture the characteristics of the communication network from the spatial and temporal dimensions, respectively. However, to achieve accurate fault location, it is necessary to organically integrate these two types of features. This step designs a feature fusion layer to integrate the two heterogeneous features into a unified representation, providing a comprehensive information foundation for the final fault classification.

[0082] Feature fusion employs a two-stage strategy. The first stage is simple concatenation, which directly concatenates the 64-dimensional topological feature vector output by GCN with the 128-dimensional temporal feature vector output by Bi-LSTM to form a 192-dimensional joint feature vector. This direct concatenation preserves all the original information of both types of features, but it has a high dimensionality and may contain redundant information.

[0083] The second stage involves feature compression and interaction, further processing the concatenated features through a two-layer fully connected network. The first fully connected layer maps the 192-dimensional features to a 128-dimensional intermediate representation, calculated as: Z1 = ReLU(W1·[H]). 2 , h t ] + b1), where [H 2 , h t The ] indicates concatenated features, W1 is a 128×192 weight matrix, b1 is the bias term, and ReLU is the activation function. The second fully connected layer further compresses the features to 64 dimensions, and the calculation formula is: Z = ReLU(W2·Z1+ b2), where W2 is a 64×128 weight matrix and b2 is the bias term.

[0084] This two-layer mapping not only reduces feature dimensionality, but more importantly, it enables deep interaction and information fusion between topological and temporal features through learnable weight matrices W1 and W2. The training process of the fully connected layer automatically learns the optimal combination of the two types of features, highlighting key information, suppressing redundant content, and generating a more compact and information-rich hybrid feature representation.

[0085] Based on feature fusion, a softmax-based multi-classifier was constructed as the final decision layer. The classifier receives a 64-dimensional mixed feature vector as input and maps it to an N-dimensional output through a fully connected layer, where N equals the number of all possible link fault types within the substation (typically 30-50 in experimental environments). The softmax function transforms the output into a probability distribution: p i = exp(z i ) / Σ j exp(z j ), where z i p is the raw score of the i-th class. i It is the normalized failure probability.

[0086] Ultimately, the link with the highest output probability is selected as the fault location result, while a complete probability distribution is provided as a confidence level reference. This classification method based on fused features fully utilizes information from both spatial topology and temporal variations, significantly improving the accuracy and reliability of fault location.

[0087] In step S2, optimizing the parameter configuration of the hybrid deep learning model using the memory-enhanced fractional-order dung beetle optimization algorithm includes:

[0088] Step S24: For the hybrid deep learning model, fractional calculus theory is introduced to construct a memory mechanism for historical search information. The current parameter update process of the hybrid deep learning model is made to simultaneously consider the current gradient and the historical search trajectory through fractional differential operators. The parameter update formula is as follows: ,in Let X*(t) represent the α-order differential operator, r be the current optimal solution, and C(t) be the random coefficients. Then, we obtain the parameter search strategy.

[0089] The performance of deep learning models largely depends on the optimization of their parameter configuration. Traditional parameter optimization methods, such as gradient descent or the Adam optimizer, are prone to getting trapped in local optima, especially when dealing with complex hybrid model structures. To address this issue, this paper innovatively introduces a parameter optimization method based on fractional calculus theory—the memory-enhanced fractional dung beetle optimization algorithm.

[0090] Fractional calculus is a generalization of classical calculus, allowing the orders of derivatives and integrals to be any real number, not just integers. Unlike integer derivatives, which only consider the variation of a function in its local neighborhood, fractional derivatives calculate the function's value over its entire domain, exhibiting a "long-range memory" property. This property makes fractional derivatives particularly suitable for optimizing functions with complex search spaces and multiple local optima.

[0091] Inspired by the food-finding and transporting behavior of dung beetles in nature, the memory-enhanced fractional-order dung beetle optimization algorithm of this invention incorporates fractional calculus theory to design a parameter search strategy with historical memory capabilities. The core of this algorithm is to use fractional differential operators to update the current parameters while simultaneously considering the current gradient and historical search trajectories, thus avoiding getting trapped in local optima.

[0092] The memory-enhanced fractional-order dung beetle optimization algorithm is an innovative bio-inspired parameter optimization method that integrates dung beetle foraging behavior with fractional-order calculus theory, providing an efficient solution to complex nonlinear problems. Technically, the algorithm comprises three key operations: rolling the ball, pushing the ball, and random foraging. Rolling the ball corresponds to local search, where the algorithm makes minor adjustments based on gradient information surrounding the current solution; pushing the ball enables global exploration, with individual dung beetles learning from each other and moving towards the group's optimal solution; random foraging randomly perturbs the current solution with a fixed probability, escaping local traps. The balance of these three operations is dynamically adjusted by adaptive weight coefficients, initially favoring global exploration and later emphasizing refined local search. The memory enhancement mechanism is the algorithm's greatest innovation, implemented using fractional-order calculus theory. When α is close to 0, historical information is almost disregarded; when α is close to 1, the system highly relies on historical search trajectories. In each iteration, the algorithm dynamically adjusts the α value based on optimization progress, intelligently utilizing historical experience. In addition, the algorithm maintains an elite solution pool, recording the historical best solution and its surrounding high-quality solutions, providing a reference direction when the search stalls. The parameter update formula is: , where X(t) is the parameter vector at time t, X(t+1) is the updated parameter vector, and X*(t) is the currently known optimal solution. α represents the α-order differential operator (typically ranging from 0.5 to 0.9). When α = 1, it degenerates into the traditional first derivative. When 0 < α < 1, it possesses historical memory properties, and parameter updates consider historical information from the entire optimization process. r is a random coefficient between 0 and 0.1, controlling the intensity of random perturbations. C(t) is the chaotic perturbation term, generated using a Logistic mapping.

[0093] C(t+1) = 4·C(t)·(1-C(t)), this chaotic perturbation increases the algorithm's exploration ability and helps it escape local optima.

[0094] Among these, the parameter update strategy based on fractional derivatives has significant advantages: First, it retains the "memory" of the search history, avoiding repeated searches of already explored regions; second, the fractional derivative characteristic allows the algorithm to adaptively reduce the step size when approaching the optimal solution, improving convergence accuracy; finally, chaotic perturbations enhance the algorithm's global search capability, reducing the risk of getting trapped in local optima. Experiments show that this algorithm can find better parameter configurations than traditional optimizers such as gradient descent and Adam, significantly improving model performance.

[0095] Step S25: Based on the parameter search strategy, optimize the key parameters of the graph convolutional network, including the number of layers, the number of hidden units, and the learning rate, using the memory-enhanced fractional-order dung beetle optimization algorithm to avoid getting trapped in local optima and obtain the optimized parameter configuration.

[0096] This step applies the memory-enhanced fractional-order dung beetle optimization algorithm to the hyperparameter optimization of a hybrid deep learning model, focusing on key parameters of the graph convolutional network. Compared to traditional grid search or random search methods, this algorithm can more efficiently explore the high-dimensional parameter space and find better parameter combinations.

[0097] First, determine the set of key parameters that need optimization. For graph convolutional networks, this mainly includes: the number of GCN layers (range 1-5 layers), the number of hidden units per layer (range 16-256, increasing in powers of 2), the activation function type (ReLU, LeakyReLU, ELU, etc.), and the initial learning rate (range 1e). -5 to 1e -2 (logarithmic scale), weight decay coefficient (range 1e) -6 to 1e -3 The parameters include the dropout rate (range 0-0.5). These parameters have a significant impact on the expressive power and generalization performance of GCNs.

[0098] The parameter optimization process employs a hierarchical search strategy. First, the parameters are divided into several relatively independent groups, such as network structure parameters (number of layers, number of hidden units), regularization parameters (Dropout rate, weight decay coefficient), and optimizer parameters (learning rate, momentum coefficient). Then, each group of parameters is optimized separately, and finally, the optimal combination is fine-tuned. This hierarchical strategy significantly reduces the dimensionality of the search space and improves optimization efficiency.

[0099] For each set of parameters, an iterative search is performed using the memory-enhanced fractional-order dung beetle optimization algorithm. A parameter population is initialized, with each individual representing a possible parameter configuration. In each iteration, the performance of each parameter set on the validation set is evaluated (using accuracy or F1 score as the evaluation metric), and the global optimum X* is updated. Then, the next generation of parameter configurations is calculated according to the previously defined update formula.

[0100] To balance exploration and exploitation, the algorithm introduces an adaptive fractional order mechanism: in the early stages of the search, α takes a small value (e.g., 0.5) to enhance global exploration capabilities; as iterations progress, α gradually increases (up to a maximum of 0.9) to strengthen local fine-grained search. Simultaneously, the chaotic perturbation term C(t) gradually decreases in the later stages of the search, further enhancing convergence.

[0101] To handle the mixed optimization problem involving discrete parameters (such as the number of layers) and continuous parameters (such as the learning rate), a hybrid encoding strategy is adopted: discrete parameters are rounded to ensure they always take integer values; continuous parameters are directly updated using the update formula. This method guarantees the algorithm's efficient search in the mixed parameter space.

[0102] After approximately 100 iterations (each iteration evaluating 20 sets of parameter configurations), the algorithm finally determined the optimal parameter configuration for the GCN: a 2-layer GCN structure with 64 hidden units in the first layer and 128 hidden units in the second layer, using the LeakyReLU activation function (negative slope 0.1), an initial learning rate of 0.001, and a weight decay coefficient of 5e. -4 The dropout rate is 0.2%. This set of parameters achieved a fault location accuracy of 93.2% on the validation set, an improvement of 7.8 percentage points compared to the initial default configuration.

[0103] Step S26: Based on the optimized parameter configuration, output the 64-dimensional topological feature vector to effectively characterize the spatial correlation characteristics between devices, and obtain the parameter-optimized hybrid deep learning model.

[0104] After determining the optimal parameter configuration, this step reconstructs and trains the hybrid deep learning model, particularly the graph convolutional network (GCN) part, to generate high-quality topological feature representations. Based on the optimized parameter configuration, a two-layer GCN structure is constructed, with 64 and 128 hidden units per layer, respectively. The LeakyReLU activation function is used, and a Dropout rate of 0.2 is applied for regularization.

[0105] The model is trained using standardized link feature vectors and a labeled dataset. Training employs mini-batch gradient descent with a batch size of 32, using the Adam optimizer with an initial learning rate of 0.001. The learning rate is halved every 20 epochs if the validation loss does not improve. To prevent overfitting, in addition to Dropout, an early stopping strategy is introduced: training stops when the validation set loss does not improve for 10 consecutive epochs. The training process typically converges within 100 epochs.

[0106] The optimized GCN can more effectively capture key information in the network topology. Specifically, through the first layer of graph convolution, each node aggregates information from directly connected nodes to form a representation of its first-order neighborhood; through the second layer of graph convolution, it further extends to second-order neighbors, enabling each node to perceive a wider range of network environments. This hierarchical feature extraction process allows the model to recognize various complex topological patterns, such as star connections, ring connections, or cascaded structures.

[0107] To further enhance the expressive power of topological features, an edge feature enhancement mechanism is introduced. In addition to considering the attributes of the nodes themselves, link characteristics (such as bandwidth, protocol type, and link importance) are also incorporated as edge attributes into the graph convolution process. This edge-feature-enhanced graph convolution operation is expressed as follows:

[0108]

[0109] Where e ij It is the feature vector of edge (i,j). In this way, the model can distinguish between connections of different types and importance.

[0110] After training, the optimized GCN outputs a 128-dimensional feature vector for each node. To generate a unified topological representation, the features of all nodes are weighted by attention to obtain a global graph feature vector. Specifically, the attention score for each node is calculated: , where q and These are learnable parameters; then a weighted average is calculated based on the attention score: This yields 128-dimensional graph-level features. Finally, a fully connected layer compresses the dimension to 64, resulting in the final topological feature vector.

[0111] This 64-dimensional topological feature vector efficiently encodes the spatial structure information of the substation communication network, including the connections between devices, the characteristics of important nodes, and potential vulnerabilities. Feature visualization analysis shows that this vector can clearly distinguish different types of network topologies and fault modes in the feature space, laying a solid foundation for subsequent fusion with time-series features.

[0112] In step S3, the training process using real fault samples combined with virtual fault samples generated by a generative adversarial network includes:

[0113] Step S31: Based on the collected historical fault data, establish a fault type library including single link disconnection, port jitter, broadcast storm and configuration error. Extract traffic change characteristics, alarm sequence patterns and topology impact range for each fault type in the fault type library to form a fault feature template library.

[0114] In real-world smart substation operations, communication link failures are relatively rare, and the types and locations of these failures are diverse, resulting in a severe shortage of real-world fault samples available for training. To address this issue, this step first involves collecting and analyzing historical fault data to establish a comprehensive fault type library and feature template library, laying the foundation for subsequent virtual sample generation.

[0115] Operational data from multiple smart substations over the past three years was collected, including maintenance records, fault reports, and historical monitoring data. After processing and analysis, four main categories of typical communication link faults were identified: single-link disconnection, port jitter, broadcast storms, and configuration errors. Each category is further subdivided into several subtypes; for example, single-link disconnection can be categorized into physical fiber optic cable disconnection, port hardware failure, and STP protocol blocking; broadcast storms can be categorized into MAC address table overflow, loop formation, and malicious attacks. This resulted in a classification system of 28 specific fault types.

[0116] For each fault type, feature patterns in three dimensions are extracted:

[0117] 1. Traffic Change Characteristics: Record the trend of traffic changes before and after a fault occurs. For example, broadcast storm faults are usually characterized by an exponential increase in traffic; link disconnection is characterized by a sudden drop in traffic to zero; port jitter is characterized by periodic fluctuations in traffic. Mathematical modeling is performed on the traffic changes for each type of fault to extract key parameters such as rise rate, fluctuation frequency, and duration.

[0118] 2. Alarm Sequence Patterns: This section analyzes the alarm sequences triggered during a fault and their temporal relationships. Each fault typically corresponds to a specific combination of alarms and a specific timing pattern. For example, a link disconnection usually triggers a "link status change" alarm first, followed by a "communication interruption" alarm, and may finally trigger a "protection function degradation" alarm; while a broadcast storm first triggers a "port traffic anomaly" alarm, followed by alarms such as "high CPU utilization" and "abnormal broadcast packet ratio." Sequence pattern mining algorithms are used to extract these alarm sequence features from historical data and record the typical time intervals between alarms.

[0119] 3. Topology Impact Scope: Analyze the impact scope and propagation path of the fault on the network topology. Faults at different locations will affect devices and services of varying ranges. For example, a core switch port failure may affect multiple downstream IED devices; while communication failures in edge IED devices typically only affect local functions. By analyzing the network topology and communication dependencies, a fault impact scope model is established, and typical propagation patterns for each type of fault are recorded.

[0120] Through comprehensive analysis of these three-dimensional features, detailed feature templates were established for each fault type. These templates include not only qualitative descriptions but also quantitative parameters, such as mathematical model parameters of flow rate changes, temporal distribution characteristics of alarm sequences, and topological relationships affecting equipment. These parameters are encoded into a structured template library for use in the subsequent sample generation process.

[0121] In addition, each type of fault was classified into severity levels (minor, moderate, severe), and the corresponding response time requirements and processing priorities were recorded. This information is crucial for subsequently building a priority-aware fault localization model, enabling priority to be given to fault types that have a greater impact on operational safety.

[0122] Step S32: Based on the fault feature template library, design a generative adversarial network. The generator learns to generate virtual samples that conform to various fault features. The discriminator optimizes the authenticity of the generated samples. A fractional-order logical chaotic graph is applied to enhance the diversity of samples and avoid the collapse of the generation pattern, thereby generating virtual fault samples.

[0123] Based on the established fault feature template library, this step designs a Generative Adversarial Network (GAN) to generate high-quality virtual fault samples. The GAN consists of two adversarial neural networks: a generator responsible for creating virtual samples, and a discriminator responsible for distinguishing between real and virtual samples. Through adversarial training of the two networks, the generator gradually learns to produce high-quality samples that can "deceive" the discriminator.

[0124] This invention designs a Conditional Generative Adversarial Network (GAN) that enables the generation process to produce samples with corresponding features based on a specified fault type. The generator G receives two inputs: a random noise vector z and a fault type condition vector c. The condition vector c is a one-hot encoding representing one of 28 specific fault types. The generator's goal is to learn a mapping G(z,c) that transforms the random noise into samples that conform to the features of a specific fault type.

[0125] The generator employs a deep fully connected network structure with four hidden layers, each containing 512, 256, 512, and 1024 neurons respectively. It uses the LeakyReLU activation function and batch normalization. The conditional vector *c* is processed through an embedding layer and then concatenated with the output of each layer to ensure that the conditional information is fully utilized throughout the generation process. The final layer uses the Tanh activation function to output a normalized feature vector with dimensions consistent with the real sample (including traffic features, alarm sequences, and topological impact information).

[0126] The discriminator D is also a deep neural network that takes a sample x and a condition c as input and outputs a scalar value representing the authenticity of the sample. The discriminator contains three hidden layers, each with 512, 256, and 128 neurons respectively, using the LeakyReLU activation function and Dropout regularization (ratio 0.3). Similarly, the condition vector c is concatenated with the sample x after embedding, influencing the entire discrimination process. The final layer uses the Sigmoid activation function, outputting a value between 0 and 1, representing the probability that the sample is a true sample.

[0127] The training objective of GANs is to solve the following minimax games:

[0128] E x E represents the expectation of the real sample. z This represents the expectation of random noise. To stabilize the training process, the Wasserstein GAN with Gradient Penalty (WGAN-GP) technique was adopted, and the loss function was modified as follows:

[0129] ,in λ represents the random interpolation point between the real sample and the generated sample, and λ is the gradient penalty coefficient (set to 10). The generator's loss function simplifies to: L G = -E z [D(G(z,c),c)].

[0130] Traditional GANs often face the problem of mode collapse, meaning the generator can only produce a limited number of sample types. To enhance sample diversity, this invention innovatively introduces fractional-order logistic chaotic graph technology to modulate initial noise. A core characteristic of chaos is its high sensitivity to initial conditions; even small changes in input can lead to significant differences in output. The iterative formula for the fractional-order logistic chaotic graph is: , where a is the control parameter (set to 1.95), β is the fractional exponent (set to 0.7), and sgn is the sign function. This chaotic mapping has complex dynamic characteristics, producing sequences with more uniform distribution and long-range correlation.

[0131] In practice, an initial noise vector with a uniform or Gaussian distribution is first generated. Then, each dimension is iteratively processed using a fractional-order logistic chaotic graph to generate a new noise vector with chaotic characteristics, which is then input into the generator. This process ensures that even with similar initial noise distributions, the final generated samples exhibit rich diversity.

[0132] Using the aforementioned techniques, a large number of high-quality virtual fault samples were successfully generated. To evaluate sample quality, a triple verification mechanism was designed: first, experts evaluated the rationality of the generated samples; second, statistical verification confirmed the consistency of the distribution between the generated samples and real samples; finally, 10% of the real samples were used as a test set to verify the generalization performance of the model trained based on the generated samples in real-world scenarios. Evaluation results show that the generated virtual samples not only exhibit high consistency with real samples in statistical characteristics but also effectively improve the model's performance in real-world fault scenarios.

[0133] Step S33: Based on the real fault samples and the virtual fault samples, a hybrid training strategy is adopted. First, the real fault samples are used for initial training, and then the virtual fault samples are introduced for incremental learning. A chaotic perturbation mechanism is applied to avoid the model getting trapped in local optima, and an early stopping strategy is introduced to prevent overfitting.

[0134] Having both real and virtual fault samples, the key issue is how to effectively utilize these two types of data to train the model. This step designs an innovative hybrid training strategy that maximizes the use of limited real samples while fully leveraging the value of a large number of virtual samples, thus avoiding model overfitting or getting trapped in local optima.

[0135] The hybrid training strategy consists of two main phases: an initial training phase and an incremental learning phase. In the initial training phase, the hybrid deep learning model is trained using only real fault samples. The goal of this phase is to allow the model to first grasp the basic characteristics and patterns of real faults, establishing a foundation for accurate fault identification. The initial training employs a small learning rate (0.001) and appropriate regularization strength (L2 regularization coefficient 0.0005) to prevent the model from overfitting to the limited number of real samples.

[0136] To fully utilize the limited real samples, K-fold cross-validation is employed in the initial training phase. Specifically, the real samples are randomly divided into 5 parts, with 4 parts used as the training set and 1 part as the validation set in each iteration. This process is repeated 5 times, and finally, the outputs of the 5 models are integrated using model ensemble techniques (such as soft voting). This approach not only maximizes the use of the limited real samples but also reduces the variance of individual models through model ensemble, thereby improving the overall generalization performance.

[0137] After initial training, the incremental learning phase begins, gradually introducing virtual fault samples. Incremental learning employs a progressive strategy: first, virtual samples most similar to real samples are introduced, then the scope is gradually expanded to include more diverse virtual samples. A sample similarity evaluation mechanism is designed, calculating the similarity between virtual and real samples based on feature space distance (such as Euclidean distance or cosine similarity), sorting them from high to low similarity, and introducing them into the training process in batches.

[0138] During incremental learning, the weights of real and virtual samples are dynamically adjusted. Initially, real samples have a much higher weight than virtual samples; as training progresses, the weight of virtual samples gradually increases, but the priority of real samples is always maintained. This dynamic weighting mechanism ensures that the model always prioritizes learning the features of real samples, while gradually acquiring more diverse knowledge from virtual samples.

[0139] To prevent the model from getting stuck in local optima during incremental learning, a chaotic perturbation mechanism is applied. During training, small chaotic perturbations are periodically added to the model parameters (e.g., every 10 epochs): W new = W + η·C(t), where W is the current parameter, C(t) is the chaotic sequence generated by the Logistic mapping, and η is the perturbation strength coefficient (initial value 0.01, gradually decreasing as training progresses). This controlled perturbation helps the model escape local optima, explore a wider parameter space, and find the global optimum.

[0140] To prevent overfitting, an early stopping strategy is introduced. Specifically, after each training epoch, the model's performance on the validation set is evaluated. If the validation set performance does not improve for 10 consecutive epochs, training is stopped, and the model parameters that yielded the best validation performance are reverted to. The validation set consists of 20% real samples, ensuring that the early stopping decision is based on real fault characteristics rather than virtual sample characteristics.

[0141] Furthermore, the concept of Curriculum Learning was adopted, arranging the training samples according to their difficulty. First, the model was trained to identify fault types with obvious and easily distinguishable features (such as single-link disconnection). Then, more complex fault types with greater difficulty in differentiation (such as intermittent port jitter or complex configuration errors) were gradually introduced. This training sequence from easy to difficult made the model learning process smoother and more efficient.

[0142] This carefully designed hybrid training strategy successfully integrates the accuracy of real samples with the diversity of virtual samples, training a fault location model that combines high accuracy and strong generalization ability. Evaluations on the test set show that the hybrid training strategy improves fault location accuracy by 7.2% and 3.5% compared to methods using only real samples or directly mixing the two types of samples.

[0143] In step S3, optimizing the timing prediction capability through the echo state network includes:

[0144] Step S34: Based on the optimized hybrid deep learning model with the aforementioned parameters, construct the echo state network, whose state update equation is: Where s(t) is the reservoir state vector at time t, u(t) is the input vector at time t, and W is the reservoir internal connection weight matrix. in It is the input weight matrix. Here, f is the leakage rate, f is the activation function, and we obtain the state update strategy.

[0145] While bidirectional LSTM networks in hybrid deep learning models can effectively capture short-term dependencies in time-series data, their performance has room for improvement in handling gradual failures with long-term memory characteristics (such as communication quality degradation caused by slow equipment performance decline) or complex periodic anomaly patterns. To enhance the model's time-series prediction capabilities, this step introduces an Echo State Network (ESN) as a supplement.

[0146] Echo-state networks (ESNs) are a special type of recurrent neural network. Their core characteristic is a large "reservoir" of random connections, and they train only the output weights, without adjusting the internal connection weights. This design gives ESNs the advantages of high training efficiency and strong memory capacity, making them particularly suitable for processing time-series data with long-term dependencies.

[0147] The constructed ESN consists of three main parts: an input layer, a reservoir, and an output layer. The input layer receives a temporal feature vector u(t) and connects it to the reservoir via an input weight matrix W_in. The reservoir comprises a large number of randomly connected neurons, forming a complex dynamic. The output layer reads state information from the reservoir and outputs it via trainable output weights W_in. out Generate prediction results.

[0148] The core of ESN is the state update mechanism of the reserve pool, and its state update equation is:

[0149] ,in:

[0150] - s(t) is the reservoir state vector at time t, with the dimension being the number of reservoir neurons (set to 500 in this implementation);

[0151] - u(t) is the input vector at time t, and its dimension is equal to the temporal feature dimension;

[0152] - W is the internal connection weight matrix of the reservoir (500×500), initialized as a random sparse matrix with a sparsity of about 5% and a spectral radius of 0.8 (less than 1 to ensure stability);

[0153] - W in It is the input weight matrix, connecting the input layer and the reserve pool, initialized as a random matrix with a range of [-0.5, 0.5];

[0154] - This is the leakage rate, which controls the speed of status updates; it is set to 0.3.

[0155] - f is the activation function, usually the tanh function is chosen.

[0156] The most important features of ESN are W and W in After initialization, it remains fixed and does not participate in the training process. This "reservoir computing" paradigm greatly simplifies the training complexity and avoids the gradient vanishing / exploding problem in traditional RNN training.

[0157] In practice, the construction and training of ESN involves the following steps:

[0158] 1. Initialization of the reservoir: Generate a random sparse matrix W, and adjust its spectral radius (the absolute value of the largest eigenvalue) to 0.8 to ensure that it has the "echo state" property—the influence of the input signal will "echo" for a medium to long time, but will eventually decay and disappear, thus avoiding a chaotic state.

[0159] 2. State Collection: Input the training data into the ESN, iteratively calculate the reservoir state through the state update equation, and collect the state vector s(t) for all time steps. Typically, the states of the first 100 time steps are discarded, and collection resumes only after the state has stabilized; this process is called "washout".

[0160] 3. Output weight training: After collecting enough state vectors, train the output weights W using simple linear regression (such as ridge regression). out This makes the output y(t) = W out • s(t) should be as close as possible to the target value. The regularization parameter for ridge regression is set to 1e-6 to balance fitting accuracy and generalization ability.

[0161] 4. Predictive Application: After training, the same state update equation and fixed W and W' are used. in Process new data, using the trained W out Generate the predicted output.

[0162] This design enables ESN to efficiently capture long-term dependencies in time-series data, making it particularly suitable for identifying gradual failures and complex periodic anomaly patterns. Experiments show that for certain types of communication failures (such as slow performance degradation due to equipment aging), ESN's detection capability is 2-3 times faster than traditional LSTM, significantly enhancing its early warning capabilities.

[0163] Step S35: The original time-series data is processed by the echo state network and long-term dynamic features are extracted. The network works in conjunction with the bidirectional long short-term memory network to further refine the features and capture short-term dependencies, thereby obtaining an optimized time-series feature representation.

[0164] EchoState Networks (ESNs) and Bidirectional Long Short-Term Memory (Bi-LSTM) networks each have their own strengths: ESN excels at capturing long-term dynamic features and complex periodic patterns, while Bi-LSTM is better at handling short-term dependencies and local contextual information. This step designs a collaborative working mechanism between these two networks to fully leverage their respective advantages and extract more comprehensive and accurate temporal features.

[0165] The collaborative working mechanism is based on a "hierarchical feature extraction" strategy and comprises three main stages: ESN preprocessing, Bi-LSTM refinement, and feature fusion. First, the ESN processes the raw time-series data, capturing long-term dynamic features and global patterns. Specifically, raw time-series data such as collected switch traffic and CPU utilization are input into the trained ESN to generate a reserve pool state sequence s(t). These state vectors encode the long-term dependencies and global dynamic characteristics of the data, effectively identifying slowly evolving anomalous patterns.

[0166] Building upon the ESN processing, a Bi-LSTM network is used to further refine features and capture finer-grained temporal patterns. The Bi-LSTM receives two types of input: the state vector s(t) generated by the ESN and the original temporal features. This dual-channel input design allows the Bi-LSTM to simultaneously focus on long-term dynamic features and short-term local changes. To ensure a balance between these two types of information, an attention mechanism is introduced to dynamically adjust the weights of attention given to the ESN state and the original features.

[0167] The formula for calculating attention mechanism is: α t = softmax(v T ·tanh(W s ·s(t) + W f ·f(t) + b), where s(t) is the ESN state vector, f(t) is the original feature vector, and W s W f v and b are learnable parameters. Attention score α t Used to calculate the weighted input: x t = α t [0]·s(t) + α t [1]·f(t), then x t The input is fed into a Bi-LSTM network for processing.

[0168] The Bi-LSTM network is configured with a three-layer structure, with 128 hidden units in each layer, processing sequential data for 100 time steps (approximately 500 seconds). The forward LSTM captures the information flow from the past to the present, while the backward LSTM captures the information flow from the future to the present. The hidden states of both are concatenated to form a complete bidirectional representation. This structure allows the model to fully utilize the contextual information of the time-series data, making it particularly suitable for identifying anomalous patterns highly correlated with the surrounding environment, such as link congestion caused by communication storms.

[0169] Finally, feature fusion is performed, integrating the features extracted by Bi-LSTM with the features directly output by ESN. The fusion method employs a nonlinear transformation: h fused = tanh(W f ·[h BiLSTM , h ESN ] + b f ), where [h BiLSTM , h ESN ] represents the concatenation of two types of features, W f and b f These are learnable parameters. This non-linear fusion is more effective than simple concatenation, and can capture the complex interactions between two types of features.

[0170] The aforementioned hierarchical feature extraction strategy generates an optimized temporal feature representation with a dimension of 128, encompassing multi-scale temporal information ranging from long-term dynamics to short-term localities. Experimental results demonstrate that this mechanism of ESN and Bi-LSTM working in tandem achieves better performance than using either network alone, particularly when handling complex hybrid faults (such as hardware faults superimposed with configuration errors), resulting in a 5.7 percentage point improvement in accuracy.

[0171] Step S36: Based on the optimized temporal feature representation and the temporal prediction capability of the echo state network, the gradual fault features in the communication link are captured, and the 128-dimensional temporal feature vector is output to obtain the trained fault location model.

[0172] After obtaining the optimized temporal feature representation, this step further utilizes the temporal prediction capability of the echo state network, especially enhancing the detection capability of gradual faults, and finally integrates all components to form a complete fault location model.

[0173] Gradual faults are a special and difficult-to-detect type of fault in smart substation communications. They are characterized by the slow accumulation of fault symptoms without obvious abrupt changes. Typical examples include gradual signal quality degradation due to fiber optic connector oxidation, a continuous decrease in packet processing capability caused by switch hardware aging, and slow equipment performance degradation due to power fluctuations. These faults do not immediately trigger alarms, but their long-term persistence affects stability and may even lead to protection failure at critical moments.

[0174] The capture of gradual fault characteristics utilizes the predictive modeling capabilities of ESN to construct a timing anomaly detection module, enabling early detection of gradual faults. Based on the "prediction-comparison" principle: ESN predicts the expected timing pattern under normal operating conditions, and then compares the actual observations with the predicted values; significant deviations indicate potential anomalies. A "continuous deviation accumulation" mechanism is introduced to monitor the cumulative deviation within a continuous time window, identifying fault trends early. Specifically, for each monitored metric (such as port traffic, packet error rate, CPU utilization, etc.), a dedicated ESN is trained for multi-step prediction. The ESN's output layer is configured to predict the metric values ​​for the next N time steps (typically N=10, corresponding to 50 seconds).

[0175] The predictive model is trained using only normal operating data to learn the normal dynamic behavior of the system. After training, the prediction error sequence is calculated during the runtime phase: ,in These are actual observed values. These are model predictions. Then, a dynamic thresholding algorithm is applied to detect anomalies. , where σ(t) is the time-varying variance estimate and β is the smoothing factor (set to 0.95). When e(t) > 3·sqrt(σ(t)), it is marked as a potential outlier.

[0176] To improve detection reliability, a "continuous deviation accumulation" mechanism is introduced. This not only focuses on single-point anomalies but also monitors the cumulative deviation over a continuous time window: E(t) = Σ i =t-w+1 t e(i), where w is the window length (usually set to 20, corresponding to 100 seconds). When the cumulative deviation E(t) exceeds the threshold and shows an increasing trend, it is identified as an early sign of a gradual failure.

[0177] This ESN-based predictive modeling method can detect gradual anomalies that are difficult to detect using traditional methods. Actual testing shows that for fiber optic signal quality degradation faults, this method can issue an early warning on average 2-3 hours before a complete link outage, far earlier than traditional alarms based on fixed thresholds.

[0178] To effectively integrate gradual fault features with other features, a feature enhancement layer was designed. This layer receives the prediction error features and cumulative bias features of the ESN, as well as the previously generated temporal feature representation, and generates the final 128-dimensional temporal feature vector through nonlinear transformation: h final = tanh(W e ·[h fused , e feat E feat ] + b e ), where [h fused , e feat E feat ] represents the concatenation of three types of features, W e and b e These are learnable parameters.

[0179] Ultimately, the following components were integrated to form a complete fault location model:

[0180] 1. A topological feature extraction module based on GCN outputs a 64-dimensional topological feature vector;

[0181] 2. A time-series feature extraction module based on the collaborative operation of ESN and Bi-LSTM outputs a 128-dimensional time-series feature vector;

[0182] 3. Feature fusion layer, which integrates topological features and temporal features into a 64-dimensional hybrid feature vector;

[0183] 4. Classification layer, which outputs the probability distribution of fault type and location based on the mixed feature vector.

[0184] The complete inference process of the model is as follows: First, device status data and topology information are collected in real time; then, the data is standardized and features are extracted through the preprocessing module; next, the topology feature extraction module and the temporal feature extraction module work in parallel to generate their respective feature vectors; finally, the feature fusion layer and the classification layer process these features and output the final fault location result and confidence assessment.

[0185] This hierarchical feature extraction and fusion architecture enables precise location of various communication link faults, including sudden faults, gradual faults, and complex mixed faults. In practical applications, the model can complete fault location within an average of 2.8 seconds, with an accuracy rate of 95.6%, greatly improving the reliability and maintenance efficiency of smart substation communication.

[0186] In step S4, the step of outputting the fault link location result and confidence assessment through multi-level confidence evaluation and topology correlation analysis includes:

[0187] Step S41: Based on the trained fault location model and the real-time collected link status data, input the real-time features of the link status data into the trained fault location model, calculate the fault probability distribution of each link, and when the highest probability is ≥0.85, directly output the fault location result to obtain the first-level confidence fault location result.

[0188] Following preliminary model training and optimization, a robust fault location model has been established. In the actual operation phase, this step is responsible for applying this model to real-time link status data to achieve rapid and accurate fault location. First, the communication network status of the smart substation is continuously monitored through multiple data acquisition channels. These channels include: switch performance metrics collected via SNMP protocol (every 5 seconds), such as port traffic, CPU utilization, buffer usage, and error packet count; real-time alarm information received by the network management system, including events such as switch status changes, link jitter, and communication interruptions; and GOOSE / SV communication status data collected via the IEC61850 protocol, such as GOOSE packet loss rate and time synchronization deviation.

[0189] The collected raw data undergoes a standardized preprocessing procedure, consistent with the processing methods used in the training phase, to ensure the consistency of feature distribution. Preprocessing includes data cleaning (removing noise and outliers), time synchronization, feature scaling (normalizing to the [0,1] interval), and feature extraction. Specifically for time-series data, a sliding window (typically 100 time steps, approximately 500 seconds) is maintained to capture sufficient temporal context information. For topology information, the topology graph data is updated periodically (every 5 minutes or when network configuration changes) to ensure the model has the latest network structure information.

[0190] The preprocessed feature vectors are input into the trained fault localization model. The core computational process of the model includes: first, the topology feature extraction module processes network structure information to generate a 64-dimensional topology feature vector; simultaneously, the temporal feature extraction module processes temporal data to generate a 128-dimensional temporal feature vector; then, the feature fusion layer integrates the two types of features into a 64-dimensional hybrid feature vector; finally, the classification layer calculates the probability distribution of various fault types based on the hybrid feature vector. The entire inference process is typically completed within 200 milliseconds, meeting real-time response requirements.

[0191] The model outputs a probability distribution vector, where each element corresponds to the probability of a specific location and type of fault. For example, in a substation network with 8 switches and 45 IED devices, there are dozens of possible fault points. The model assigns a probability value to each possible fault point. First, it checks the highest probability value: when the highest probability reaches or exceeds 0.85, it indicates that the model has extremely high confidence in fault location. In this case, the result is directly adopted, and the corresponding fault link location information is output, including the fault location (device identifier and port number), fault type (such as link disconnection, port jitter, etc.), and fault severity.

[0192] This high-confidence scenario typically occurs in fault situations with clear characteristics and patterns, such as a physical disconnection of a single link, communication interruptions caused by equipment hardware failure or configuration errors, etc. Actual operational data shows that approximately 60% of fault cases fall into this high-confidence category, providing accurate location results within an average of 1.5 seconds after the fault occurs, enabling rapid response.

[0193] It also records the characteristic patterns of these high-confidence cases for subsequent model optimization and knowledge accumulation. For each successfully located high-confidence fault, its key feature markers (such as specific alarm sequences, traffic change patterns, or topology impact range) are extracted and stored in the knowledge base, continuously enriching the fault pattern library and providing richer reference information for future fault identification.

[0194] Step S42: Based on the fault probability distribution, when 0.7 ≤ highest probability < 0.85, trigger secondary inference, calculate the link correlation matrix, analyze the topological relationship between the Top-N probability links, apply the Bayesian network model to comprehensively evaluate the joint fault probability of multiple links, and obtain the corrected fault probability assessment.

[0195] When the highest fault probability output by the model is between 0.7 and 0.85, it indicates a certain degree of uncertainty in fault location. This situation typically occurs in complex fault scenarios, such as multi-point faults, cascading faults, or gradual faults with indistinct characteristics. Simply selecting the result with the highest probability may lead to misjudgment. Therefore, this step designs a secondary inference mechanism to improve the location accuracy by deeply analyzing the network topology and the joint fault probability of multiple links.

[0196] Secondary inference first extracts the Top-N candidate faulty links (usually N=5) from the probability distribution. These links have a relatively high probability of failure, but the probability value alone is insufficient to determine the true source of the failure. Next, a link correlation matrix is ​​calculated to quantify the dependencies between candidate links. The correlation calculation is based on three dimensions: topological connectivity, communication dependencies, and historical failure association patterns.

[0197] Topology reflects the connection distances and hierarchical relationships between links in the physical network structure. The topological distance between any two links is calculated using the shortest path algorithm, and their correlation is evaluated based on topological hierarchy (e.g., whether they belong to the same switch, whether they are in the same subnet, etc.). Links that are directly connected or located on the same device have high topological correlation.

[0198] Communication dependencies are analyzed based on business logic. By parsing the GOOSE / SV publish-subscribe relationships in the SCD file, it identifies which links carry interdependent communication traffic. For example, if traffic on link A is a necessary input for communication on link B, then the two have a high communication dependency. A communication dependency graph algorithm is used to analyze the dependency chains of the entire network and construct a complete dependency matrix.

[0199] Historical fault association patterns are calculated based on statistical analysis of historical data, determining the co-occurrence frequency and conditional probability of different link faults. For example, if historical data shows that whenever link X fails, link Y has an 80% probability of also failing, then the two have a high historical fault correlation. Frequent pattern mining and association rule learning algorithms are used to extract these association patterns from the historical fault database.

[0200] Combining the information from the above three dimensions, a complete link correlation matrix R is constructed, where the elements R... ij This represents the combined correlation score between link i and link j (normalized to the [0,1] interval). The correlation matrix is ​​an important input for subsequent Bayesian network construction.

[0201] Based on the link correlation matrix and the initial probabilities of candidate failed links, a dynamic Bayesian network model is constructed to comprehensively evaluate the joint failure probability of multiple links. A Bayesian network is a probabilistic graphical model capable of expressing conditional dependencies between variables, making it particularly suitable for analyzing complex causal relationships. In this application, each candidate failed link corresponds to a node in the network, and the edges between nodes represent their dependencies, with the edge weights determined based on the correlation matrix.

[0202] The construction of the Bayesian network employs an improved version of the K2 algorithm. First, the initial ordering of nodes is determined based on topological relationships (typically from core switches to edge devices). Then, the network structure is iteratively optimized to maximize the likelihood probability of the structure with respect to the observed data. Network parameters (conditional probability tables) are initialized based on historical data and expert knowledge and optimized using the Expectation-Maximization (EM) algorithm.

[0203] Once constructed, observed anomalies (such as alarm messages and abnormal traffic) are input into the Bayesian network as evidence for probabilistic inference, calculating the posterior probability of each candidate faulty link given the evidence. The inference process employs the Junction Tree Algorithm, which can efficiently handle probabilistic networks with complex dependencies.

[0204] A key advantage of Bayesian inference is its ability to distinguish between primary and secondary faults. For example, when a core switch port failure causes multiple downstream devices to report communication outages, a Bayesian network can infer, based on causal relationships, that the core switch port is the most likely root cause of the failure, rather than the numerous terminal devices reporting anomalies. This "root cause analysis" capability is particularly important when dealing with cascading faults.

[0205] After Bayesian network inference, the resulting fault probability assessment is more focused on the root cause of the fault, reducing the false probability of secondary faults. In practical applications, this secondary inference mechanism can effectively handle about 30% of complex fault scenarios, improving the localization accuracy from the initial 75% to over 90%, significantly reducing false positives and false negatives.

[0206] Step S43: Based on the first-level confidence fault location result or the corrected fault probability assessment, a multi-level confidence assessment is adopted to output the fault link location result and the corresponding confidence assessment, so as to achieve accurate identification of complex fault scenarios.

[0207] After obtaining the first-level confidence fault location result or the corrected fault probability assessment, these results need to be further processed to form the final fault location output, and a reliable confidence assessment is provided for each result. This step designs a multi-level confidence assessment mechanism, combining multiple evidence sources and verification methods to ensure the reliability and interpretability of the fault location results.

[0208] The multi-level confidence assessment mechanism is based on the principle of "evidence fusion," comprehensively considering the support of evidence from multiple dimensions to assign a comprehensive confidence score to each fault location result. The main evidence dimensions include: model confidence, historical similarity, topology consistency, alarm verification, and expert rule matching.

[0209] Model confidence is derived directly from the probability values ​​output by the deep learning model or the corrected probabilities after Bayesian network inference. For high-confidence faults (initial probability ≥ 0.85), the model confidence score directly uses the original probability values; for results after secondary inference, the model confidence score uses the corrected posterior probability, which is usually more focused on the true fault points.

[0210] Historical similarity assessment provides additional evidence by comparing the similarity between current fault characteristics and historically confirmed faults. A historical fault case library is maintained, with each case containing a complete feature description and validated fault diagnosis results. When a new fault occurs, its similarity to historical cases is calculated using a weighted cosine similarity formula: , where f new and f hist These are the feature vectors of the new fault and the historical fault, respectively, w i These are feature weights. Historical similarity scores are determined by combining the similarity value of the most similar case and the reliability rating of that case.

[0211] Topology consistency assessment verifies whether fault location results are consistent with the network topology. Based on network topology analysis, it determines the scope of the fault's impact and verifies whether observed anomalies are topologically consistent with the located fault point. For example, if the fault location indicates a fault on a switch port, it checks whether all downstream devices connected to that port are reporting communication problems, while devices in other areas are functioning normally. Topology consistency scoring is calculated based on the coverage and exclusivity of affected devices. , where N match The number of affected devices, N, is in line with expectations. affected N is the total number of devices actually affected. unexpected The number of abnormal devices that did not meet expectations, N total It represents the total number of devices in the network.

[0212] Alarm verification verifies whether alarm information supports fault location results by analyzing its timing patterns and content. Based on alarm sequence analysis technology, it checks whether the alarm propagation order conforms to a pattern of outward diffusion from the fault point; simultaneously, it analyzes whether the alarm content is consistent with the located fault type. For example, for a link interruption fault, it is expected that physical layer alarms (such as "link disconnected") will appear first, followed by communication layer alarms (such as "communication interrupted"), and finally application layer alarms (such as "protection function degraded"). Alarm verification scoring is based on a comprehensive calculation of the completeness of the alarm sequence, the reasonableness of the timing, and the consistency of the content.

[0213] Expert rule matching is a rule base built upon domain knowledge, used to verify whether fault location results conform to known fault modes and diagnostic experience. The rule base contains various fault characteristics and judgment criteria summarized by power experts, represented using production rules (if-then form). Fault characteristics are input into the rule engine, which checks whether they match any known rules and provides an expert rule matching score based on the degree of matching. This dimension is particularly suitable for handling typical faults with obvious characteristic patterns.

[0214] The overall confidence score is calculated by combining the scores from the five dimensions using a weighted average method: C = Σi w i ·score i / Σ i w i Among them, score i It is a rating across various dimensions, w i These are the corresponding weights. The weight settings are based on historical validation data and optimized using machine learning methods (such as logistic regression or decision trees) to maximize the correlation between the overall score and the accuracy of actual fault diagnosis.

[0215] Based on the comprehensive confidence score, the fault location results are divided into three confidence levels: high confidence (C≥0.85), medium confidence (0.7≤C<0.85), and low confidence (C<0.7). For high confidence results, fault handling suggestions are directly generated, and some repair measures (such as port reset, communication rerouting, etc.) can be automatically executed according to pre-configured policies. For medium confidence results, a fault report is generated, but it is recommended that operations and maintenance personnel conduct further confirmation. For low confidence results, they are marked as "fault to be confirmed," providing multiple possible fault hypotheses, requiring manual intervention and analysis by operations and maintenance personnel.

[0216] The final fault link location output contains a wealth of information: faulty device identifier, port number, and location; fault type and severity; fault occurrence time and duration; support and overall confidence scores for each evidence dimension; recommended handling measures and priorities; and relevant historical case references. This multi-dimensional, multi-level fault location output not only provides accurate fault location but also includes ample evidence support and reliability assessment, greatly improving the maintenance efficiency and reliability of smart substation communications.

[0217] In practical applications, this multi-level confidence assessment mechanism enables accurate identification and handling of various complex fault scenarios, including single-point faults, simultaneous multi-point faults, cascading faults, and intermittent faults. Performance evaluation shows that, in complex fault scenarios, the multi-level confidence assessment method improves accuracy by 12.5 percentage points compared to methods relying solely on a single model output, significantly reducing the risk of misjudgment and misoperation.

[0218] In step S5, the virtual-to-real correspondence verification is performed by combining the logical loop information in the configuration file, including:

[0219] Step S51: Based on the fault link location result and the configuration file, for the located physical link fault, query the logical loop information in the configuration file, check whether the physical link matches the identified logical fault, and obtain virtual-physical matching analysis.

[0220] Intelligent substation communication exhibits a distinct "two-layer virtual-physical structure": the physical layer includes equipment hardware, network interfaces, and physical links; the logical layer includes virtual terminals, logical loops, and communication services. A physical link failure typically affects multiple logical loops carried on it, and similarly, an anomaly in a logical loop may originate from a problem in the physical link it depends on. This step designs a virtual-physical correspondence verification mechanism to further improve the reliability of fault location by cross-verifying the fault behavior of both the physical and logical layers.

[0221] First, based on the fault link location results, the possible faulty physical links are clearly identified, including the faulty device identifier (such as switch name, IED device ID, etc.), port number (such as Ethernet port 1, fiber optic interface 2, etc. on the switch), and link type (such as Ethernet, serial port, fiber optic, etc.). The fault's characteristics are also recorded, such as link interruption, link jitter, one-way communication, and data errors.

[0222] Next, the logical loop information in the SCD configuration file is queried to establish the mapping relationship between physical links and logical loops. The SCD file of a smart substation is based on the IEC 61850 standard and uses XML format to describe the functions and communication configurations of all equipment within the substation. Logical loop information is extracted by parsing several key parts of the SCD file:

[0223] 1. Extract the device's communication parameters from the partial data, including IP address, subnet mask, gateway, and communication service type (such as MMS, GOOSE, SMV, etc.).

[0224] 2. Extract the functional configuration of the intelligent electronic device from the partial data, including logical node definitions, dataset organization, and virtual terminal mapping.

[0225] 3. Extract data type and attribute definitions from the parts to understand the semantics and structure of the communication data.

[0226] 4. Extract the functional structure of the substation from the partial data to understand the functional relationships between the equipment.

[0227] 5. Pay special attention to the (GOOSE service) and (sample value service) sections, which define key real-time communication configurations, including parameters such as publisher, subscriber, APPID, and MAC address.

[0228] By analyzing this information, a detailed bidirectional mapping table of "physical link-logical loop" was constructed, recording which logical loops each physical link carries and which physical links each logical loop depends on. For example, the physical link from switch port SW1-P3 to IED1-ETH1 may carry multiple GOOSE publish / subscribe relationships and MMS communication services.

[0229] This mapping table allows for the prediction of the set of logical loops that should be affected based on the located physical link failure. For example, if a fault is determined to be in switch port SW1-P3, the mapping table is queried to identify all logical loops that depend on that port, such as GOOSE1, GOOSE2, and MMS5. Then, the actual operating status of these logical loops is checked, typically through the following methods:

[0230] 1. Analyze GOOSE / SV communication quality counters, such as packet loss rate, delay statistics, and state change frequency.

[0231] 2. Check the communication status of the MMS service, including connection status, response time, and error count.

[0232] 3. Query the event logs of the relevant devices to identify abnormal records related to communication.

[0233] 4. Analyze the status report of the protection function to check whether the function has been degraded due to communication problems.

[0234] A virtual-physical matching analysis is performed by comparing the set of expected affected logic loops with the actual observed abnormal logic loops. Ideally, the two sets should highly overlap: the expected affected loops do indeed exhibit abnormalities, while the expected unaffected loops remain normal. This high degree of matching indicates that the physical link fault location results are consistent with the phenomena observed at the logic layer, enhancing the reliability of fault location.

[0235] However, actual situations may present some discrepancies, mainly in two ways: first, logic loops expected to be affected but actually operating normally may indicate the existence of redundant paths or backup communication mechanisms; second, logic loops expected to be unaffected but actually malfunctioning may suggest multiple points of failure or inaccurate fault localization. These discrepancies will be recorded in detail to provide a basis for subsequent confidence assessments and further analysis.

[0236] Virtual-to-real-world matching analysis not only verifies the accuracy of fault location but also provides a comprehensive assessment of the fault's impact, helping operations and maintenance personnel understand the fault's business impact and urgency. For example, if a fault affects communication loops with critical protection functions, it will be given higher processing priority; if it only affects non-critical monitoring loops, it may be scheduled for processing at an appropriate time.

[0237] Step S52: Based on the virtual-real matching analysis, calculate the virtual-real consistency score S = N using the matching results. match / N total , where N match N is the number of faults in the virtual-to-real matching. total This represents the total number of failures, leading to a consistent assessment.

[0238] Physical-virtual matching analysis provides a correspondence between physical link failures and logical loop anomalies, but a quantitative indicator is needed to measure the degree of this matching in order to make a reliable confidence assessment. This step designs a method for calculating the physical-virtual consistency score, transforming the qualitative matching analysis into a comparable numerical score.

[0239] The basic formula for calculating the consistency score between virtual and real data is: S = N match / N total , where N match N is the number of faults in the virtual-to-physical matching (i.e., the number of physical link fault predictions that match the actual anomalies in the logical loops). total This is the total number of faults (i.e., the total number of all related logic loops). This simple ratio reflects the consistency between the fault location results and the actual observed behavior, with scores ranging from 0 to 1, where the closer to 1, the higher the consistency.

[0240] In practice, a more refined calculation method was used, taking into account the weights and importance of different types of mismatches. The complete calculation formula is as follows:

[0241] S = (w1·N match + w2·N partial ) / (N total + w3·N unexpected )

[0242] in:

[0243] N match It is the number of perfectly matched loops, that is, the number of logic loops that were expected to be affected and actually were abnormal.

[0244] N partial This refers to the number of partially matched loops, such as loops that are expected to be affected but only show a performance degradation rather than a complete interruption.

[0245] N total This is the total number of all circuits expected to be affected;

[0246] N unexpected It is the number of circuits that are unexpectedly abnormal, that is, the number of circuits that are not expected to be affected but actually become abnormal;

[0247] w1, w2, and w3 are weighting coefficients. Typically, w1 = 1.0 (the highest weight is given to perfect matches), w2 = 0.5 (partial matches are given appropriate weight), and w3 = 2.0 (unexpected anomalies are penalized more severely).

[0248] The weighting settings reflect the evaluation strategy for different matching scenarios: a perfect match is the ideal situation and receives full marks; a partial match indicates that the fault location is basically correct but may underestimate the severity, and receives partial marks; while unexpected anomalies may indicate unidentified fault points or incorrect fault location, and therefore incur a larger penalty. The weight values ​​can be adjusted based on actual operating experience and expert knowledge to optimize evaluation accuracy.

[0249] In addition to basic quantitative statistics, the importance weights of logical loops are also considered. In smart substations, the functional importance of different logical loops varies greatly: protection-related communications (such as circuit breaker trip commands) are the most critical, followed by monitoring-related communications (such as equipment status monitoring), while management-related communications (such as parameter settings) are relatively less important. During the SCD file analysis phase, each logical loop is assigned an importance level (usually 3-5 levels), and different weights are applied to loops of different importance when calculating the consistency score, ensuring that the evaluation results more accurately reflect actual business operations.

[0250] Furthermore, the time dimension of matching is also considered. Ideally, physical link failures and logical loop anomalies should be closely related in time: after a physical failure occurs, logical loops that depend on that link will become abnormal within a short period of time (usually milliseconds to seconds). The time series of physical failures and logical anomalies are analyzed, the time correlation coefficient is calculated, and it is used as an adjustment factor for the consistency score.

[0251] Finally, based on the above calculations, a comprehensive virtual-to-real consistency score S is obtained. This score fully reflects the degree of consistency between the fault location results and the actual behavior. A high consistency score (close to 1) indicates that the fault location results can well explain the observed phenomena, enhancing the credibility of the results; while a low consistency score (close to 0) indicates a significant mismatch, requiring further analysis or reassessment of the fault situation.

[0252] Consistency assessment is not only used to determine the confidence level of current faults, but is also recorded in the fault case database, serving as an important data source for performance evaluation and continuous improvement. By analyzing the consistency score distribution of a large number of fault cases, it is possible to identify one's own strengths and weaknesses, and to optimize algorithms and parameters in a targeted manner, thereby improving the overall fault location capability.

[0253] Step S53: Based on the consistency assessment, adjust the reliability of the result according to the virtual-real consistency score. When S≥0.8, it is marked as high reliability; when 0.5≤S<0.8, it is marked as medium reliability; and when S<0.5, it is marked as low reliability, thus obtaining the fault location result after reliability adjustment.

[0254] The virtual-to-real consistency score provides a measure of the reliability of fault location results. This step adjusts the previous confidence assessment based on this score to form the final confidence rating, providing clear decision-making reference for operations and maintenance personnel. Virtual-to-real correspondence verification is an important supplement and correction to the previous confidence assessment based on model output, especially capable of discovering complex dependencies and special cases that the model may have missed.

[0255] Based on the consistency score S between virtual and real data, the fault location results are divided into three confidence levels:

[0256] High confidence level: S≥0.8 indicates that the fault location results are highly consistent with the actual behavior and can be highly trusted;

[0257] Medium confidence level: 0.5≤S<0.8, indicating that the fault location is basically correct but may be partially inaccurate or incomplete, requiring careful handling;

[0258] Low confidence level: S<0.5 indicates that there is a significant difference between the fault location results and the actual observations, requiring re-evaluation or manual analysis.

[0259] The criteria for these three levels are determined based on statistical analysis of a large number of historical failure cases and verified by expert knowledge to ensure that the classification boundaries have practical business significance. The thresholds of 0.8 and 0.5 are not fixed and will be continuously optimized based on long-term operational experience and feedback to make the classification more accurate.

[0260] After obtaining the virtual-real consistency rating, it is integrated with the confidence rating based on the model output from previous steps to generate the final confidence adjustment result. The integration follows the "lower of two" principle, meaning the final confidence level is the lower of the two assessments. For example, if the model assessment is high confidence, but the virtual-real consistency assessment is medium confidence, the final confidence level is determined to be medium. This conservative strategy ensures that overconfidence is avoided and reduces the risk of misjudgment.

[0261] For fault location results that are ultimately determined to be highly reliable, a detailed fault report and handling suggestions will be generated. Corresponding repair operations can be executed according to pre-configured automated policies, such as port reset, communication rerouting, or enabling alternative paths. These types of faults can typically be automatically handled within 1-2 minutes of occurrence, significantly shortening fault recovery time.

[0262] For results with medium confidence levels, a fault report and possible handling suggestions are generated, but actual actions are only taken after confirmation by operations and maintenance personnel. The report details the specific reasons for the confidence level degradation, such as which logic loops experienced unexpected anomalies or which expected anomalies were not observed, helping operations and maintenance personnel quickly understand the situation and make judgments. Typically, operations and maintenance personnel can complete analysis and handling decisions within 3-5 minutes of receiving the report, significantly faster than traditional manual analysis methods.

[0263] For results with low confidence, they will be marked as "requiring further analysis," generating multiple possible failure hypotheses and listing supporting and opposing evidence for each hypothesis. These situations typically involve complex multi-point failures or the emergence of new, unknown failure modes, requiring intervention from professional operations and maintenance personnel. The system provides rich diagnostic information and interactive analysis tools to support in-depth troubleshooting by operations and maintenance personnel. While not fully automated, the structured information and analytical support provided can significantly accelerate the manual analysis process, reducing the analysis time required by traditional methods from hours to 10-15 minutes.

[0264] The final, confidence-adjusted fault location results contain the following key information:

[0265] 1. Fault location and type: including device identifier, port number, link type, and fault manifestation (e.g., disconnection, jitter, etc.);

[0266] 2. Credibility rating: High, Medium, or Low, along with the basis and specific calculation indicators for the rating;

[0267] 3. Scope of impact: A list of affected logic loops, sorted by importance, including a functional impact assessment;

[0268] 4. Handling Recommendations: For the identified fault type, provide handling solutions and steps, including automatic execution options for high-confidence faults;

[0269] 5. Supplementary Analysis: For results with medium to low confidence, a detailed analysis of the mismatch and possible alternative explanations are provided.

[0270] This meticulous confidence level adjustment and tiered processing not only provides accurate fault location but also adds reliable confidence level assessments and processing recommendations to each result, greatly improving the maintainability and operational reliability of smart substation communication.

[0271] In step S5, the parameter optimization of the trained fault location model using an online learning mechanism includes:

[0272] Step S54: Collect new fault samples confirmed by manual verification, and use the new fault samples to perform a small batch update on the trained fault localization model. The learning rate is set to 0.0001, and the parameter update strategy is output.

[0273] High-quality deep learning models require continuous updates to adapt to system changes and emerging failure modes. This step designs an online learning mechanism that uses newly collected failure samples during operation to incrementally update the trained model, continuously improving its performance while maintaining model stability. This continuous learning capability is a key guarantee for the long-term effective operation of the system.

[0274] First, a new structured fault sample collection mechanism was established. After the fault location system outputs results, operations and maintenance personnel will confirm and provide feedback on the results. This feedback information is extremely valuable for model improvement. The system is designed with multiple sample collection channels:

[0275] 1. Direct Feedback: Maintenance personnel can directly confirm, correct, or supplement the fault location results output by the system through the interface, such as marking "accurate", "partially accurate" or "inaccurate", and can provide the correct fault location and type.

[0276] 2. Fault Handling Records: The system automatically captures the fault handling operations actually performed by maintenance personnel (such as restarting which device, replacing which fiber optic cable, etc.), compares them with the handling measures suggested by the system, and indirectly assesses the accuracy of fault location.

[0277] 3. Problem Work Order Information: Integrate with the enterprise work order system to extract detailed fault descriptions, cause analyses, and solutions from formal fault work orders, serving as high-quality labeled samples.

[0278] 4. Expert review: For complex or typical failure cases, an expert team will conduct a detailed review and annotation to ensure sample quality.

[0279] 5. System self-verification: After the fault is resolved, the system will monitor the communication recovery status. If it is consistent with expectations (such as the relevant communication returning to normal after replacing a certain fiber), it will be automatically marked as a valid sample.

[0280] These channels enable the collection of various types of new fault samples. Each sample contains complete feature data (such as device status, alarm information, topology, etc.) and verified fault labels (location, type, and severity). To ensure data quality, each sample is validated, checking feature completeness, label consistency, and temporal correlation. Only high-quality samples that pass validation will enter the learning process.

[0281] After collecting a sufficient number of new samples (usually accumulating 10-20 or once a week, depending on the failure frequency), the system initiates a mini-batch update process. Mini-batch updates employ an incremental learning strategy, fine-tuning only the existing model parameters rather than retraining. Key settings include:

[0282] 1. The learning rate is set to 0.0001, which is much lower than the initial training learning rate (usually 0.001). This extremely low learning rate ensures that the model parameters are only slightly adjusted, preventing over-adaptation to new samples and "forgetting" previously learned knowledge. This phenomenon is called "catastrophic forgetting" in machine learning.

[0283] 2. The number of training iterations is limited, typically set to 50-100 epochs, to avoid overfitting new samples. The system also monitors the performance on the validation set, and stops training immediately if a performance decline is observed.

[0284] 3. Use Elastic Weight Consolidation (EWC) to prevent key parameters from deviating excessively. EWC is a method specifically designed to address catastrophic forgetting; it assigns importance weights to each parameter of the model, with changes to important parameters (parameters that have a significant impact on performance on older tasks) being more severely penalized. In the specific implementation, the loss function is modified as follows: L new It is the standard loss of the new sample. This is the current parameter. These are the original parameters, F i λ represents the importance of the parameter, and λ is the balance coefficient (usually set to 1000).

[0285] 4. Employ a mixed training set strategy, mixing new samples with some retained historical samples (especially representative difficult examples) to ensure the model does not completely "forget" old knowledge. The mixing ratio is usually 1:5 for new samples to historical samples, maintaining an appropriate balance between new and old knowledge.

[0286] During mini-batch updates, model performance is closely monitored, especially on the validation set. The validation set consists of three parts: a set of historical difficult examples (to verify whether the model retains its ability to solve known complex problems), a subset of new samples (to verify whether the model effectively learns new knowledge), and a comprehensive test set (to evaluate overall balance). Only when the performance on all validation subsets reaches or exceeds the original level will the updated model be accepted and deployed to the production environment.

[0287] This carefully designed small-batch update strategy allows for a smooth adaptation to emerging failure modes and network changes while maintaining accurate identification of known failure types. Actual operational data shows that after six months of online learning, the overall fault location accuracy steadily improved from an initial 88% to over 95%, and the ability to identify new faults was significantly enhanced, reducing the initial detection time of 3-5 occurrences for new fault types to accurate identification on the first or second occurrence.

[0288] Step S55: Based on the parameter update strategy and historical judgment accuracy, the confidence threshold is dynamically adjusted through the historical judgment accuracy. By analyzing successful and failed fault location cases, the feature weights are automatically adjusted to enhance the sensitivity to key features, thus obtaining an adaptive optimization mechanism.

[0289] In addition to updating model parameters, it is also necessary to adjust decision thresholds and feature weights to adapt to changes in the operating environment and the continuously improving model capabilities. This step designs an adaptive optimization mechanism that enables the system to automatically adjust key configuration parameters based on historical performance data, achieving continuous performance optimization.

[0290] First, dynamic adjustment of the confidence threshold was implemented. The confidence threshold is a key parameter for judging the reliability of fault location results, such as 0.85 in step S41, 0.7 in step S42, and 0.8 and 0.5 in step S53. The setting of these thresholds directly affects the system's judgment strategy: thresholds that are too high will lead to an overly conservative system, requiring manual verification of many results; thresholds that are too low may introduce incorrect judgments and increase the risk of misoperation. The optimal threshold should be dynamically adjusted as the model's performance improves, fully utilizing the model's capabilities.

[0291] A threshold adaptive algorithm was designed based on historical accuracy data. First, historical accuracy statistics for each confidence interval were collected, such as the actual accuracy of fault location results within intervals like [0.95, 1.0], [0.9, 0.95], and [0.85, 0.9]. Then, based on the target reliability requirements (e.g., high-confidence results require an accuracy ≥ 95%), the corresponding confidence threshold was determined in reverse. The specific algorithm is as follows:

[0292] 1. For each possible threshold value T (decreasing from 1.0 to 0.5 in steps of 0.05), calculate the actual accuracy A(T) of all predictions with confidence ≥ T in the historical data.

[0293] 2. Find the minimum threshold that satisfies the accuracy target: T* = min{T | A(T) ≥ A} target}, where A target It is the target accuracy rate (e.g., 95% for a high-confidence target).

[0294] 3. To avoid frequent fluctuations in the threshold, a smoothing mechanism is introduced: Where β is the smoothing coefficient (usually 0.7), T old T is the currently used threshold. new This is the updated threshold.

[0295] 4. Set an upper limit for threshold changes (e.g., each adjustment should not exceed ±0.05) to prevent threshold mutations caused by special samples.

[0296] This threshold adjustment process is performed periodically (usually once a month or after accumulating 50 new fault samples) to ensure that the decision threshold always matches the current model performance. As model performance improves, the threshold is usually gradually reduced, allowing more faults to be judged with high confidence and reducing the need for manual intervention.

[0297] In addition to confidence thresholds, feature weights are automatically adjusted to enhance sensitivity to key features. By analyzing successful and failed fault location cases, it is possible to identify which features are most critical for accurately diagnosing specific types of faults and adjust their weights accordingly. Feature weight adjustment involves two levels:

[0298] 1. Internal Feature Weights: By analyzing the gradient contributions of successful and failed cases, the feature dimensions that have the greatest impact on the judgment result are identified. Specifically, the average gradient contribution G+ to correctly classified samples and the average gradient contribution G- to misclassified samples for each feature are calculated, with the feature importance score being S = G+ - G-. A higher score indicates that the feature is more helpful for correct classification. Then, during mini-batch updates, lower regularization coefficients are applied to the relevant parameters of important features, allowing them to adjust more freely, while higher regularization constraints are imposed on unimportant features to reduce their volatility.

[0299] 2. Feature weights in preprocessing and postprocessing stages: The system analyzes the impact of different preprocessing parameters (such as time window length, sampling frequency, feature extraction method, etc.) on the final result and automatically adjusts these parameters to optimize overall performance. Similarly, in the postprocessing stage, such as the multi-level confidence assessment in step S43, the system adjusts the weights of each evidence dimension based on historical data, enhancing the influence of more reliable evidence and reducing the weight of unstable evidence.

[0300] A key characteristic of adaptive optimization mechanisms is differentiated processing. Instead of simply applying global adjustments, they perform differentiated optimization based on fault type, equipment type, and scenario characteristics. For example:

[0301] 1. Differentiated fault types: For different types of faults (such as physical disconnection, configuration error, performance degradation, etc.), the system maintains independent feature importance scores and optimization strategies, because the judgment of different faults may depend on completely different feature sets.

[0302] 2. Equipment type differentiation: The fault characteristics and judgment criteria of different equipment (such as core switches, edge IED devices, protection devices, etc.) are also significantly different. The system will establish a special optimized configuration for each type of key equipment.

[0303] 3. Scenario adaptability: The system will identify different operating scenarios (such as normal load, peak load, maintenance status, etc.) and evaluate the model performance in each scenario, and optimize the judgment strategy for each scenario accordingly.

[0304] Through this multi-dimensional and differentiated adaptive optimization mechanism, the judgment strategy can be continuously refined, improving the ability to identify various types of faults. Actual operation data shows that after enabling adaptive optimization, the system's accuracy in complex fault scenarios increased by 7.3 percentage points, the speed of adapting to new faults accelerated by about 40%, and the proportion of high-confidence judgments increased from the initial 45% to 68%, significantly reducing the need for manual intervention.

[0305] Step S56: Based on the adaptive optimization mechanism, maintain a dynamic fault mode knowledge base, add newly identified fault modes to the fault mode knowledge base for future comparison and analysis, realize the continuous optimization of the trained fault location model, and obtain the complete fault location system.

[0306] The final step in continuous optimization is establishing and maintaining a dynamic fault mode knowledge base. This knowledge base not only serves as a carrier of the system's "memory," storing historical fault information, but also actively learns new fault modes, continuously expanding the system's identification capabilities. This step designed the architecture and update mechanism of the knowledge base, enabling continuous optimization of the model and ultimately forming a complete fault location system.

[0307] The fault mode knowledge base adopts a multi-level structure design, comprising four main components:

[0308] 1. Basic Fault Type Library: Records the standard definitions and key characteristics of all known fault types, including physical layer faults (such as link disconnection, signal quality degradation, etc.), protocol layer faults (such as packet loss, timeout, protocol errors, etc.), and application layer faults (such as service interruption, function degradation, etc.). Each fault type has a detailed description, typical characteristic patterns, and standardized severity rating.

[0309] 2. Fault Case Library: This library stores complete records of historical fault cases, including original characteristic data, system judgment results, manual confirmation results, and handling measures. Each case is marked with detailed metadata, such as fault type, occurrence time, duration, and scope of impact, facilitating subsequent retrieval and analysis. The case library is organized chronologically and features an automatic archiving mechanism to maintain a reasonable storage size.

[0310] 3. Feature Pattern Library: Standardized feature patterns extracted from historical cases describe typical manifestations of various faults. Each feature pattern includes time-series features (such as traffic change curves, alarm sequence patterns, etc.) and topological features (such as impact range, propagation path, etc.), as well as the variation range and importance weight of these features. Feature patterns support fuzzy matching, enabling the identification of similar but not identical fault manifestations.

[0311] 4. Diagnostic Rule Base: Diagnostic rules based on expert experience and data analysis are represented using production rules (if-then structure) and decision trees. The rule base contains two types of rules: deterministic rules (explicit judgment criteria defined by domain experts) and probabilistic rules (statistical association patterns learned from data). These rules complement deep learning models and are particularly suitable for handling typical faults with well-defined characteristics.

[0312] The core value of a knowledge base lies in its dynamic updating capability, which implements multiple knowledge acquisition and updating mechanisms:

[0313] 1. Incremental Learning: When operations and maintenance personnel confirm a new fault case, it is automatically added to the case library, triggering the incremental learning process. If the new case belongs to a known fault type but exhibits a new variation pattern, the system will update the feature pattern description of that type, expanding its variation range; if the new case represents a completely new fault type, the system will create new type definitions and feature patterns, expanding the basic fault type library.

[0314] 2. Pattern Mining: Regularly (e.g., monthly) perform data mining on the case library to find new feature patterns and regularities. Mining algorithms include clustering analysis (discovering natural groupings of cases), association rule learning (discovering association patterns between features), and sequence pattern mining (discovering regularities in time-series data). Newly discovered patterns are added to the feature pattern library after validation, enriching the system's recognition foundation.

[0315] 3. Knowledge Transformation: It can transform the implicit knowledge learned by deep learning models into explicit rules. Through techniques such as decision tree approximation, LIME (Local Interpretable Model-agnostic Explanations), and SHAP (SHapley Additive exPlanations) value analysis, it extracts the key basis for model decisions, forms interpretable rules, and adds them to the diagnostic rule base. This explicit knowledge not only enhances the interpretability of the system but also maintains consistency in key judgment capabilities before and after model updates.

[0316] 4. External Knowledge Integration: Provides an interface to import external knowledge sources, such as fault characteristic descriptions provided by equipment manufacturers, industry standard updates, and experience summaries from other substations. This external knowledge is standardized and integrated into the knowledge base, enabling the system to pre-identify fault types that have not yet appeared locally.

[0317] The collaborative working mechanism between the knowledge base and the deep learning model is crucial for continuous system optimization. They form a complementary closed loop: the model acquires prior knowledge and training samples from the knowledge base to improve its judgment capabilities; the model's results, after verification, are fed back into the knowledge base, enriching its content; and the updated knowledge base provides a better foundation for the next round of model optimization. Specific collaborative mechanisms include:

[0318] 1. Hybrid Reasoning in Fault Localization: During fault localization, deep learning-based reasoning and knowledge base-based rule matching are simultaneously initiated, and the final judgment is derived by combining the results of both. For situations where the model is uncertain, knowledge base rules can provide supplementary judgments; for new situations that cannot be covered by the rules, the model's generalization ability can fill the gaps.

[0319] 2. Knowledge-guided model training: During model updates, feature importance information from the knowledge base guides training. This can be achieved by assigning higher attention weights to key features or designing specific loss functions for particular sample types. This knowledge-guided approach enables the model to learn key patterns more quickly, improving training efficiency.

[0320] 3. Multi-source verification of results: Multi-source verification is performed on each fault location result, comparing not only the consistency between model predictions and human confirmation, but also evaluating the similarity of the results with similar cases in the knowledge base, as well as the degree of conformity with diagnostic rules. This comprehensive verification ensures the high reliability of the system output.

[0321] 4. Dynamic Benchmark for Performance Evaluation: The knowledge base maintains difficulty ratings and expected accuracy rates for various fault identification types, providing a dynamic reference benchmark for system performance. Performance is evaluated separately for fault types of varying difficulty, ensuring comprehensive improvement rather than just enhancements on simple cases.

[0322] Through the aforementioned mechanism, continuous optimization of the deep learning model is achieved, forming a complete and adaptive fault location system. This system can not only accurately identify known types of faults but also continuously learn new fault modes, adapting to changes in the network environment and technological evolution. In actual deployment, the system demonstrates excellent long-term stability and self-improvement capabilities: after 12 months of use, the fault location accuracy increased from the initial 88% to 97%, the average response time decreased from 3.5 seconds to 1.8 seconds, and the proportion of high-confidence judgments increased from 45% to 78%, greatly improving the reliability and maintainability of the intelligent substation communication system.

[0323] The complete fault location system integrates all the innovative technologies and methods of this invention, including hybrid deep learning models, memory-enhanced optimization algorithms, generative adversarial networks (GANs) to augment samples, multi-level confidence assessment, virtual-real correspondence verification, and online learning mechanisms. The system adopts a modular architecture design, with each functional component connected through standard interfaces, ensuring overall collaborative operation while supporting individual upgrades and replacements. The system provides multiple deployment options, running on edge computing devices, station control layer servers, or cloud platforms, adapting to smart substation environments of varying sizes and complexities.

[0324] The method and system provided by this invention have comprehensively solved the problem of accurately locating communication link faults in smart substations, significantly improving the safe and stable operation of the power system and providing important technical support for the reliable operation of smart grids.

[0325] like Figure 2 As shown in the figure, this embodiment of the invention also provides a precise fault location system for communication links in intelligent substations, comprising:

[0326] The data acquisition and preprocessing module 601 is used to acquire configuration files and equipment status data of the smart substation, including SCD files and SPCD files, and to parse, clean and standardize the configuration files and equipment status data to generate standardized link feature vectors and labeled datasets.

[0327] The model building and optimization module 602 is used to build a hybrid deep learning model based on the standardized link feature vectors and the labeled dataset, which integrates the topological feature extraction module of the graph convolutional network and the temporal feature extraction module of the bidirectional long short-term memory network. The parameter configuration of the hybrid deep learning model is optimized by the memory-enhanced fractional-order dung beetle optimization algorithm to obtain the parameter-optimized hybrid deep learning model.

[0328] The model training module 603 is used to train the hybrid deep learning model with the parameters optimized by combining real fault samples with virtual fault samples generated by the generative adversarial network, and to optimize the temporal prediction capability through the echo state network to generate the trained fault localization model.

[0329] The fault location module 604 is used to output the fault link location result and confidence assessment based on the trained fault location model and real-time collected link status data, through multi-level confidence assessment and topology correlation analysis.

[0330] The system optimization module 605 is used to perform virtual-real correspondence verification based on the fault link location results and confidence assessment, combined with the logical loop information in the configuration file, and to optimize the parameters of the trained fault location model using an online learning mechanism, so as to output a complete fault location system.

[0331] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for accurately locating communication link faults in intelligent substations, characterized in that, include: The system acquires configuration files containing SCD and SPCD files and equipment status data from intelligent substations. It then parses, cleans, and standardizes the configuration files and equipment status data to generate standardized link feature vectors and labeled datasets. Based on the standardized link feature vectors and the labeled dataset, a hybrid deep learning model is constructed that integrates the topological feature extraction module of the graph convolutional network and the temporal feature extraction module of the bidirectional long short-term memory network. The parameter configuration of the hybrid deep learning model is optimized by the memory-enhanced fractional dung beetle optimization algorithm to obtain the parameter-optimized hybrid deep learning model. The hybrid deep learning model with optimized parameters is trained using real fault samples combined with virtual fault samples generated by a generative adversarial network, and the temporal prediction capability is optimized through an echo state network to generate a trained fault localization model. Based on the trained fault location model and combined with real-time collected link status data, the fault link location result and confidence assessment are output through multi-level confidence evaluation and topology correlation analysis. Based on the fault link location results and confidence assessment, and combined with the logical loop information in the configuration file, virtual-real correspondence verification is performed. An online learning mechanism is used to optimize the parameters of the trained fault location model, and a complete fault location system is output. The step of parsing, cleaning, and standardizing the configuration file and the device status data to generate standardized link feature vectors and labeled datasets includes: Based on the configuration file and the real-time operating status and alarm information of the switch collected via SNMP protocol, the intelligent substation logical circuit information, including the IED device list, switch configuration, virtual terminal mapping and GOOSE / SV publish-subscribe relationship, is extracted from the SCD file of the configuration file. The physical topology, including fiber optic connections, port mapping and device location, is extracted from the SPCD file of the configuration file to generate an initial multi-source heterogeneous dataset. The initial multi-source heterogeneous dataset is time-synchronized, missing data is identified and processed, time-series data is completed using an interpolation algorithm based on a long short-term memory network, outliers are marked and filtered using the 3σ criterion, and a cleaned standard dataset is generated. Based on the cleaned standard dataset, the switch alarm information is converted into a binary feature vector, the switch traffic and CPU utilization time-series data of the real-time operating status of the switch are standardized to the [0,1] interval, the topology is converted into an adjacency matrix representation, a sender-receiver-APPID mapping table is constructed, and the standardized link feature vector and the labeled dataset are generated.

2. The method according to claim 1, characterized in that, The hybrid deep learning model that constructs a topological feature extraction module of a fused graph convolutional network and a temporal feature extraction module of a bidirectional long short-term memory network includes: Based on the standardized link feature vector and the labeled dataset, a topology feature extraction module is designed based on a graph convolutional network. The physical and logical topology of the substation is represented as a graph structure. A two-layer graph convolutional network structure is designed. The first layer captures the features of directly connected nodes, and the second layer extends to second-order neighbors to realize topology association capture and output a 64-dimensional topology feature vector. Based on the standardized link feature vector and the labeled dataset, a time-series feature extraction module based on a bidirectional long short-term memory network is designed. A three-layer bidirectional long short-term memory network structure is configured, with 128 hidden units in each layer and an input window of 100 time steps. The module processes the time-series changes of the real-time operating status of the switch and the alarm information of the switch, and outputs a 128-dimensional time-series feature vector. Based on the 64-dimensional topological feature vector and the 128-dimensional temporal feature vector, a feature fusion layer is designed. The 64-dimensional topological feature vector and the 128-dimensional temporal feature vector are concatenated and then compressed into a 64-dimensional hybrid feature vector through a fully connected layer. A Softmax multi-classifier is then constructed to achieve the classification and identification of link fault types.

3. The method according to claim 2, characterized in that, The optimization of the parameter configuration of the hybrid deep learning model using the memory-enhanced fractional-order dung beetle optimization algorithm includes: For the aforementioned hybrid deep learning model, fractional calculus theory is introduced to construct a memory mechanism for historical search information. Through fractional differential operators, the current parameter update process of the hybrid deep learning model simultaneously considers the current gradient and the historical search trajectory. The parameter update formula is as follows: Where X(t) is the parameter vector at time t, and X(t+1) is the updated parameter vector. Let X*(t) represent the α-order differential operator, where X*(t) is the current optimal solution, r is the random coefficient, and C(t) is the chaotic perturbation term, thus obtaining the parameter search strategy. Based on the parameter search strategy, the key parameters of the graph convolutional network, including the number of layers, the number of hidden units, and the learning rate, are optimized using the memory-enhanced fractional-order dung beetle optimization algorithm to avoid getting trapped in local optima and obtain the optimized parameter configuration. Based on the optimized parameter configuration, the 64-dimensional topological feature vector is output, which effectively represents the spatial correlation characteristics between devices, and the optimized hybrid deep learning model is obtained.

4. The method according to claim 1, characterized in that, The training process using real fault samples combined with virtual fault samples generated by a generative adversarial network includes: Based on the collected historical fault data, a fault type library is established, including single link disconnection, port jitter, broadcast storm and configuration error. For each fault type in the fault type library, traffic change characteristics, alarm sequence patterns and topology impact range are extracted to form a fault feature template library. Based on the fault feature template library, a generative adversarial network is designed. The generator learns to generate virtual samples that conform to various fault features, the discriminator optimizes the authenticity of the generated samples, and a fractional-order logical chaotic graph is applied to enhance the diversity of samples, avoid the collapse of the generation pattern, and generate virtual fault samples. Based on the real fault samples and the virtual fault samples, a hybrid training strategy is adopted. First, the real fault samples are used for initial training, and then the virtual fault samples are introduced for incremental learning. A chaotic perturbation mechanism is applied to avoid the model getting trapped in local optima, and an early stopping strategy is introduced to prevent overfitting.

5. The method according to claim 1, characterized in that, The optimization of time series prediction capabilities through echo state networks includes: Based on the optimized hybrid deep learning model with the aforementioned parameters, an echo state network is constructed, and its state update equation is: Where s(t) is the reservoir state vector at time t, u(t) is the input vector at time t, and W is the reservoir internal connection weight matrix. in It is the input weight matrix. Here, f is the leakage rate, f is the activation function, and we obtain the state update strategy. The echo state network is used to process the raw time series data and extract long-term dynamic features. It works in conjunction with the bidirectional long short-term memory network to further refine the features and capture short-term dependencies, resulting in an optimized time series feature representation. Based on the optimized temporal feature representation and the temporal prediction capability of the echo state network, the gradual fault features in the communication link are captured, and a 128-dimensional temporal feature vector is output to obtain the trained fault location model.

6. The method according to claim 1, characterized in that, The process involves multi-level confidence assessment and topology correlation analysis to output fault link location results and confidence assessments, including: Based on the trained fault location model and the real-time collected link status data, the real-time features of the link status data are input into the trained fault location model to calculate the fault probability distribution of each link. When the highest probability is ≥0.85, the fault location result is directly output to obtain the first-level confidence fault location result. For the aforementioned failure probability distribution, when 0.7 ≤ highest probability < 0.85, secondary inference is triggered to calculate the link correlation matrix, analyze the topological relationship between the Top-N probability links, and apply a Bayesian network model to comprehensively evaluate the joint failure probability of multiple links, thereby obtaining a corrected failure probability assessment. Based on the first-level confidence fault location result or the corrected fault probability assessment, a multi-level confidence assessment is adopted to output the fault link location result and the corresponding confidence assessment, thereby achieving accurate identification of complex fault scenarios.

7. The method according to claim 1, characterized in that, The virtual-to-real correspondence verification, which combines the logical loop information in the configuration file, includes: Based on the fault link location results and the configuration file, for the located physical link fault, query the logical loop information in the configuration file, check whether the physical link matches the identified logical fault, and obtain virtual-physical matching analysis. Based on the aforementioned virtual-real matching analysis, the virtual-real consistency score S = N is calculated using the matching results. match / N total , where N match N is the number of faults in the virtual-to-real matching. total This is the total number of failures, which yields a consistent assessment; Based on the consistency assessment, the reliability of the results is adjusted according to the virtual-real consistency score. When S≥0.8, it is marked as high reliability; when 0.5≤S<0.8, it is marked as medium reliability; and when S<0.5, it is marked as low reliability, thus obtaining the fault location result after reliability adjustment.

8. The method according to claim 1, characterized in that, The step of optimizing the parameters of the trained fault location model using an online learning mechanism includes: Collect newly confirmed fault samples by manual verification, and use the new fault samples to perform mini-batch updates on the trained fault localization model. The learning rate is set to 0.0001, and the output parameter update strategy is implemented. Based on the parameter update strategy and historical judgment accuracy, the confidence threshold is dynamically adjusted through the historical judgment accuracy. By analyzing successful and failed fault location cases, the feature weights are automatically adjusted to enhance the sensitivity to key features, thus obtaining an adaptive optimization mechanism. Based on the aforementioned adaptive optimization mechanism, a dynamic fault mode knowledge base is maintained, and newly identified fault modes are added to the fault mode knowledge base for future comparison and analysis, thereby achieving continuous optimization of the trained fault location model and obtaining the complete fault location system.

9. A precise fault location system for communication links in intelligent substations, characterized in that, The method for accurately locating communication link faults in intelligent substations according to any one of claims 1-8 includes: The data acquisition and preprocessing module is used to acquire configuration files and equipment status data of smart substations, including SCD files and SPCD files, and to parse, clean and standardize the configuration files and equipment status data to generate standardized link feature vectors and labeled datasets. The model building and optimization module is used to build a hybrid deep learning model based on the standardized link feature vectors and the labeled dataset, which integrates the topological feature extraction module of the graph convolutional network and the temporal feature extraction module of the bidirectional long short-term memory network. The module uses the memory-enhanced fractional-order dung beetle optimization algorithm to optimize the parameter configuration of the hybrid deep learning model, thereby obtaining a parameter-optimized hybrid deep learning model. The model training module is used to train a hybrid deep learning model that combines the optimized parameters with real fault samples and virtual fault samples generated by a generative adversarial network, and to optimize the temporal prediction capability through an echo state network to generate a trained fault localization model. The fault location module is used to output the fault link location result and confidence assessment based on the trained fault location model and the real-time collected link status data, through multi-level confidence assessment and topology correlation analysis. The system optimization module is used to perform virtual-real correspondence verification based on the fault link location results and confidence assessment, combined with the logical loop information in the configuration file, and to optimize the parameters of the trained fault location model using an online learning mechanism, so as to output a complete fault location system.

Images