Method, apparatus and energy storage system for operating system state monitoring of an energy storage system

Abstract

The application provides a method and device for monitoring the operating system state of an energy storage system and the energy storage system, relates to the technical field of computer system monitoring, and comprises the following steps: acquiring multidimensional data, wherein the multidimensional data comprises operating data of an operating system and operating data of an energy storage device, and the operating data of the operating system comprises system resource data, process behavior data, log semantic data and network traffic data; determining the operating condition of the energy storage device according to the operating data of the energy storage device; associating the time sequence characteristics of the multidimensional data by using an attention mechanism; and performing fault diagnosis based on the operating condition of the energy storage device and the operating data of the operating system. The method provided by the application can help solve the problems of incomplete state monitoring of the operating system and difficult fault positioning.

Description

Technical Field

[0001] This application relates to the field of computer system monitoring technology, and in particular to an operating system status monitoring method, device and energy storage system for energy storage systems. Background Technology

[0002] Energy storage systems include battery packs, Power Conversion Systems (PCS), Battery Management Systems (BMS), Energy Management Systems (EMS), temperature control equipment, and fire protection equipment. The functionality of core energy storage devices (such as BMS, PCS, and EMS) relies on the management and control of the energy storage system's controller. This controller contains hardware such as a CPU (Central Processing Unit), memory, sensor interfaces, and communication modules. An operating system (such as Linux) is installed in the controller, responsible for the unified scheduling and management of these hardware resources, rationally allocating computing power and memory space, ensuring hardware collaboration, and avoiding resource conflicts. Therefore, the operating system can be used to manage and control energy storage devices, and monitoring the status of the energy storage system's operating system is crucial to ensuring the safe, efficient, and stable operation of the energy storage system.

[0003] However, the current status monitoring of energy storage system operating systems suffers from incomplete monitoring and difficulty in fault location. Summary of the Invention

[0004] This application provides a method, apparatus, and energy storage system for monitoring the status of an operating system, which helps to solve the problems of incomplete status monitoring and difficulty in fault location of the operating system.

[0005] In a first aspect, this application provides a method for monitoring the status of an operating system in an energy storage system, wherein the operating system is used to manage and control energy storage devices, and the method includes:

[0006] Acquire multi-dimensional data, including operating system runtime data and energy storage device runtime data. Operating system runtime data includes system resource data, process behavior data, log semantic data, and network traffic data.

[0007] Determine the operating status of energy storage devices based on their operational data.

[0008] Utilize attention mechanisms to correlate temporal features of multi-dimensional data;

[0009] Fault diagnosis is performed based on the operating conditions of the energy storage device and the operating data of the operating system.

[0010] In one possible implementation, the operating condition of the energy storage device includes charging, discharging, and standby, and the system resource data includes system CPU average load.

[0011] The fault diagnosis is performed based on the operating condition of the energy storage device and the operating data of the operating system, including:

[0012] When the operating condition of the energy storage device is charging or discharging, and the system CPU average load is greater than a first threshold value and lasts for a first time length, it is determined that the fault is CPU overload.

[0013] When the operating condition of the energy storage device is standby, and the system CPU average load is greater than a second threshold value and lasts for a second time length, it is determined that the fault is CPU overload.

[0014] The first threshold value is greater than the second threshold value, and the first time length is greater than the second time length.

[0015] In one possible implementation, the process behavior data includes CPU usage rate of the charging and discharging control process; and the method further includes:

[0016] When the operating condition of the energy storage device is charging or discharging, the monitoring threshold value of the CPU usage rate of the charging and discharging control process is increased.

[0017] In one possible implementation, the process behavior data includes CPU usage rate of the process, and the method further includes:

[0018] The fault diagnosis is performed according to the CPU usage rate of the process and the operating data of the energy storage device.

[0019] In one possible implementation, the CPU usage rate of the process includes CPU usage rate of the heat dissipation process, and the operating data of the energy storage device includes battery temperature.

[0020] The fault diagnosis is performed according to the CPU usage rate of the process and the operating data of the energy storage device, including:

[0021] When the temperature rising rate of the battery temperature is greater than a third threshold value, and the CPU usage rate of the heat dissipation process is less than a fourth threshold value, the log semantic data corresponding to the heat dissipation process is analyzed to determine the abnormal reason, and the abnormal reason includes heat dissipation execution device abnormality and process abnormality.

[0022] In one possible implementation, the CPU usage rate of the process includes CPU usage rate of the PCS control process, and the operating data of the energy storage device includes PCS power.

[0023] The fault diagnosis is performed according to the CPU usage rate of the process and the operating data of the energy storage device, including:

[0024] When the CPU usage rate of the PCS control process is greater than a fifth threshold value and the fluctuation of the PCS power is greater than a preset fluctuation range, the fault is determined to be CPU overload caused by abnormal PCS control process.

[0025] In one possible implementation, the CPU usage rate of the process includes the CPU usage rate of the log analysis process.

[0026] The fault diagnosis is performed according to the CPU usage rate of the process and the operation data of the energy storage device, including:

[0027] The working condition switching state is determined according to the operation data of the energy storage device.

[0028] When the CPU usage rate of the log analysis process is greater than a sixth threshold value and there is no working condition switching, the fault is determined to be CPU overload caused by redundant log processing logic.

[0029] In one possible implementation, the method further includes:

[0030] An abnormal process feature engineering model is constructed, and process behavior data is analyzed by process tree traversal combined with parent-child process call chain tracking to identify abnormal processes.

[0031] Regular matching and text vectorization techniques are used to analyze log semantic data.

[0032] Deep packet inspection technology is used to extract flow features based on network flow data, and abnormal connections are identified according to the flow features.

[0033] In one possible implementation, the method further includes:

[0034] A model-based fault diagnosis algorithm is used to perform fault fusion analysis on multi-dimensional data.

[0035] In one possible implementation, after the fault diagnosis, the method further includes:

[0036] A TOPSIS-based multi-attribute decision algorithm is used to sort fault priorities, and a report containing repair suggestions is generated by calling a historical repair scheme in an expert rule library.

[0037] In one possible implementation, after the fault diagnosis, the method further includes:

[0038] Different alarm levels and alarm modes are set for different fault types, and the alarm of low-level faults is delayed during a preset silent period.

[0039] In a second aspect, the application provides an operating system state monitoring device for an energy storage system, including:

[0040] The acquisition module is configured to acquire multi-dimensional data, the multi-dimensional data comprising operating data of an operating system and operating data of an energy storage device, the operating data of the operating system comprising system resource data, process behavior data, log semantic data and network traffic data;

[0041] The judgment module is configured to judge the operating condition of the energy storage device according to the operating data of the energy storage device.

[0042] The correlation module is configured to correlate the time sequence features of the multi-dimensional data by using an attention mechanism.

[0043] The fault diagnosis module is configured to perform fault diagnosis based on the operating condition of the energy storage device and the operating data of the operating system.

[0044] In a third aspect, the present application provides an energy storage system, comprising an operating system, which is state-monitored by the operating system state monitoring device for an energy storage system as shown in the second aspect.

[0045] The present application has the following beneficial effects:

[0046] The present application provides an operating system state monitoring method and device for an energy storage system and an energy storage system. By acquiring system resource data, process behavior data, log semantic data, network traffic data and operating data of an energy storage device, the operating state of an operating system and an energy storage system can be comprehensively and accurately mastered, which provides a rich data basis for accurate analysis of the operating system state and improves the comprehensiveness and accuracy of monitoring. According to the operating data of the energy storage device, the operating condition of the energy storage device is judged, the time sequence features of the multi-dimensional data are correlated by using an attention mechanism, and fault diagnosis is performed based on the operating condition of the energy storage device and the operating data of the operating system, which helps to realize correlation analysis of multi-dimensional data, introduces the energy storage condition, forms a three-dimensional monitoring perspective, quickly and accurately locates the fault root cause, improves the fault handling efficiency and solves the problem of difficult fault positioning. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 A flowchart of an operating system state monitoring method for an energy storage system provided by the present application embodiment is shown.

[0048] Figure 2 A structural diagram of an operating system state monitoring device for an energy storage system provided by the present application embodiment is shown. DETAILED DESCRIPTION

[0049] In the embodiments of this application, unless otherwise specified, the character " / " represents a relationship of one or the other of the associated objects before and after. For example, A / B can represent A or B. "And / or" describes the associated relationship of the associated objects, which means that there can be three relationships. For example, A and / or B can represent three cases: A exists alone, A and B exist together, and B exists alone.

[0050] It should be noted that the terms "first", "second", and the like used in the embodiments of the present application are only used for distinguishing purposes and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features, nor should they be understood as indicating or implying an order.

[0051] In the embodiments of the present application, "at least one" means one or more, and "multiple" means two or more. In addition, "at least one of the following" or the like means any combination of these items, which can include any combination of single item or multiple items. For example, at least one of A, B or C can represent A, B, C, A and B, A and C, B and C, or A, B and C. Each of A, B and C can be an element or a set containing one or more elements.

[0052] In the embodiments of the present application, "example", "in some embodiments", "in another embodiment" and the like are used to represent as an example, illustration or explanation. Any embodiment or design scheme described as "example" in the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the use of the word "example" is intended to present the concept in a specific manner.

[0053] In the embodiments of the present application, "of", "corresponding" and "corresponding" can be used interchangeably at times. It should be noted that when the distinction is not emphasized, the meaning to be expressed is consistent. In the embodiments of the present application, communication and transmission can be used interchangeably at times. It should be noted that when the distinction is not emphasized, the meaning to be expressed is consistent. For example, transmission can include sending and / or receiving, and can be a noun or a verb.

[0054] In the embodiments of the present application, equal to can be used with greater than, which is applicable to the technical solutions adopted when greater than is used. It can also be used with less than, which is applicable to the technical solutions adopted when less than is used. It should be noted that when equal to is used with greater than, it cannot be used with less than; when equal to is used with less than, it cannot be used with greater than.

[0055] Taking Linux system as an example, Linux system is widely used in technical fields such as servers, cloud computing, energy storage systems, etc. due to its open source and stability. Although some automatic monitoring tools of Linux system can collect part of the operating system indicators, they lack comprehensiveness and depth, and cannot comprehensively evaluate the overall running status of the operating system, and there is a problem of incomplete monitoring.

[0056] In addition, the Linux system has insufficient monitoring coverage for core energy storage devices, and fails to design a dedicated collection and analysis mechanism for key devices such as BMS and PCS, resulting in difficulty in including core indicators such as battery status and charging and discharging efficiency into the unified monitoring framework of the Linux system. The general threshold of the monitoring data of the Linux system cannot adapt to the fluctuation of the charging and discharging working conditions of the energy storage system, resulting in difficulty in fault location. In the face of complex system failures, it is difficult to quickly and accurately locate the root cause of the problem relying on existing monitoring means, resulting in long fault troubleshooting time, affecting the normal operation of the operating system, and further affecting the safe, efficient and stable operation of the energy storage system.

[0057] Based on the above problems, the embodiments of the present application provide an operating system state monitoring method, device and energy storage system for an energy storage system, which helps to solve the problems of incomplete state monitoring of the operating system and difficult fault location.

[0058] Figure 1 The flowchart of the operating system state monitoring method for the energy storage system provided by the embodiments of the present application specifically includes the following steps:

[0059] Step S11, acquiring multi-dimensional data, the multi-dimensional data including operating system running data and energy storage device running data.

[0060] The operating system running data includes system resource data, process behavior data, log semantic data and network traffic data; and the energy storage device running data includes battery voltage, charging and discharging current, battery temperature, SOC (State of Charge), charging and discharging power, etc.

[0061] The system resource data includes CPU usage, memory occupancy, disk I / O rate, network bandwidth occupancy, process or thread number, etc. Taking Linux system as an example, by reading the pseudo file system (proc) of the Linux system, for example, by reading the “proc / stat” file to acquire various time slice data of the CPU, and then calculating the CPU usage; by reading the “proc / meminfo” file to acquire the total amount, used amount and free amount of the memory, etc. In the system resource collection, the present application calculates the CPU memory, disk and network indicators in real time through a sliding window algorithm, which is more accurate than traditional fixed-time sampling and improves the real-time sampling.

[0062] Process behavior data includes process creation or termination time, process ID, parent process ID, occupied CPU or memory resources, opened files, called system functions, thread state, etc. The detailed information of each process in the system is obtained by using the ps command or the process-related file under the proc file system, including process ID, process name, process state (running, sleeping, stopping, etc.), process CPU occupancy, memory occupancy, etc. For example, the detailed information of all processes in the current system can be obtained by executing the “ps -aux” command, and the required process state data can be obtained by analyzing the command output result.

[0063] Log semantic data includes system startup or shutdown log, service start-stop record, error code and description, user login or operation record, program abnormal crash information, etc.

[0064] Network traffic data includes source IP (Internet Protocol) or destination IP, port number, protocol type (TCP (Transmission Control Protocol) / UDP (User Datagram Protocol) / ICMP (Internet Control Message Protocol)), packet size, transmission rate, connection state (connected or closed), etc.

[0065] The collection of the operation data of the energy storage device is based on a pre-collection module based on an operating system (such as Linux), and through an industrial communication protocol such as Modbus RTU, the standardized collection of the core parameters of the battery (such as SOC, SOH, and single-cell voltage) and the PCS operation data (such as active power) is realized, so as to ensure that the key state information of the energy storage device is efficiently accessed to the monitoring system of the operating system.

[0066] In the present application, by obtaining system resource data, process behavior data, log semantic data, network traffic data and operation data of the energy storage device, the running state of the operating system and the energy storage system can be comprehensively and accurately mastered, which provides a rich data basis for accurately analyzing the operating system state and improves the comprehensiveness and accuracy of monitoring.

[0067] Step S12, judging the operation condition of the energy storage device according to the operation data of the energy storage device.

[0068] Specifically, the operation condition of the energy storage device is judged according to the PCS active power, battery voltage and SOC, and the operation condition of the energy storage device includes charging, discharging and standby.

[0069] For example, the judgment of the charging working condition can be: when the PCS active power < 0 (the power grid charges the energy storage system), and the battery voltage continues to slowly rise, the SOC gradually increases;

[0070] The judgment of the discharging working condition can be: when the PCS active power > 0 (the energy storage system discharges to the power grid), and the battery voltage continues to slowly decrease, the SOC gradually decreases;

[0071] The judgment of the standby working condition can be: when the PCS active power is close to 0, the battery voltage is basically stable (or the battery voltage fluctuation is within the allowable range), and the SOC does not change.

[0072] In other embodiments, the working condition can also be judged according to the charging and discharging state signal of the energy storage system. For example, the energy storage control system outputs the "charging enable" signal, which indicates the charging working condition; the energy storage control system outputs the "discharging enable" signal, which indicates the discharging working condition; and there is no charging and discharging enable signal, which indicates the standby working condition.

[0073] In step S13, the time sequence characteristics of the multi-dimensional data are associated by using the attention mechanism.

[0074] Specifically, the system resource data, process behavior data, log semantic data and network traffic data, and the operation data of the energy storage device are regarded as different "modalities". The time sequence characteristics of each "modality" are associated by using the attention weight. Compared with the traditional time sequence alignment which is only based on the timestamp synchronization, the attention mechanism further captures the semantic association between the data (such as the logical relationship between the CPU soaring and the specific process creation), and assists the operation and maintenance personnel to understand the fault root cause (such as the disk anomaly is mainly caused by the backup process, rather than the hardware problem).

[0075] Optionally, the attention weight can also be dynamically adjusted according to the current state (such as increasing the feature weight of the network traffic data during the network attack), so as to reduce the probability of fault misjudgment or omission.

[0076] In step S14, the fault diagnosis is performed based on the operation working condition of the energy storage device and the operation data of the operating system.

[0077] In the present application, by performing the correlation analysis on the multi-dimensional data, for example, using the attention mechanism to capture the semantic association between the multi-dimensional data, and then introducing the energy storage working condition, a three-dimensional monitoring perspective is formed, which can quickly and accurately locate the fault root cause, improve the fault handling efficiency, and solve the problem of difficult fault positioning.

[0078] In some optional embodiments, the operating conditions of the energy storage device include charging, discharging, and standby, and the system resource data includes system CPU average load; the fault diagnosis based on the operating conditions of the energy storage device and the operating data of the operating system includes: when the operating condition of the energy storage device is charging or discharging, and the system CPU average load is greater than a first threshold value and lasts for a first duration, it is determined that the fault is CPU overload; when the operating condition of the energy storage device is standby, and the system CPU average load is greater than a second threshold value and lasts for a second duration, it is determined that the fault is CPU overload; the first threshold value is greater than the second threshold value, and the first duration is greater than the second duration.

[0079] For example, when the operating condition of the energy storage device is charging or discharging, and the system CPU average load is greater than >85% and lasts for 5 minutes, it is determined that the fault is CPU overload; when the operating condition of the energy storage device is standby, and the system CPU average load is greater than 60% and lasts for 2 minutes, it is determined that the fault is CPU overload.

[0080] When the energy storage device is in charging or discharging, the processes are active and the tasks are intensive, and when the energy storage device is in standby, most of the processes are in an idle state. Therefore, the allowed threshold value of the system CPU average load when charging or discharging (i.e., the first threshold value) is greater than the allowed threshold value of the system CPU average load when in standby (i.e., the second threshold value), and if a low threshold value is used when charging or discharging, it will cause frequent misjudgment and cause unnecessary shutdown or alarm, and if a high threshold value is used when in standby, it will miss early abnormalities and cause the fault to expand. And the duration of exceeding the first threshold value when charging or discharging (i.e., the first duration) is greater than the duration of exceeding the second threshold value when in standby (i.e., the second duration), which avoids misjudgment due to transient peaks when charging or discharging.

[0081] It can be understood that the sizes of the first threshold value, the second threshold value, the first duration, and the second duration can be designed according to actual scenes or requirements, as long as the conditions that the first threshold value is greater than the second threshold value and the first duration is greater than the second duration are met.

[0082] The present application is aimed at the energy storage system under different operating conditions, and the rule of determining "CPU overload" through the threshold value and duration of CPU average load, which dynamically adjusts the fault judgment standard combined with the working state of the energy storage device (charging, discharging, standby), is more suitable for the load characteristics of the actual scene, and avoids misjudgment or omission.

[0083] In some optional embodiments, the process behavior data includes the CPU usage rate of the charging and discharging control process, and the method provided by the present application further includes: when the operating condition of the energy storage device is charging or discharging, the monitoring threshold value of the CPU usage rate of the charging and discharging control process is increased.

[0084] The CPU usage rate of the charge-discharge control process refers to the CPU resources consumed by the charge-discharge control process, and reflects the occupation of the CPU by the charge-discharge control process. When the energy storage device is charging or discharging, the CPU occupation will increase for a short period of time in order to adjust the charge-discharge current, and therefore, the monitoring threshold of the CPU usage rate of the charge-discharge control process during charging or discharging needs to be increased. For example, under normal circumstances, the monitoring threshold of the CPU usage rate is 30%, and during charging or discharging, the monitoring threshold of the CPU usage rate is increased to 35%.

[0085] The application can prevent false triggering of the alarm of "process overload" during charging or discharging by dynamically adjusting the CPU usage rate of the process according to the energy storage working condition.

[0086] In some optional embodiments, the process behavior data includes the CPU usage rate of the process, and the method provided by the application further includes: performing fault diagnosis according to the CPU usage rate of the process and the running data of the energy storage device.

[0087] The application associates and analyzes the running data of the operating system and the running data of the energy storage device, and specifically, performs fault diagnosis according to the CPU usage rate of the process and the running data of the energy storage device, which helps to improve the fault diagnosis accuracy.

[0088] In some optional embodiments, the CPU usage rate of the process includes the CPU usage rate of the heat dissipation process, and the running data of the energy storage device includes the battery temperature; the fault diagnosis according to the CPU usage rate of the process and the running data of the energy storage device includes: when the temperature rise rate of the battery temperature is greater than a third threshold value and the CPU usage rate of the heat dissipation process is less than a fourth threshold value, analyzing the log semantic data corresponding to the heat dissipation process to determine the abnormal reason, and the abnormal reason includes heat dissipation execution device abnormality and process abnormality.

[0089] For example, if the battery temperature rises by more than 10℃ in 10 minutes (i.e., the temperature rise rate of the battery is greater than 1℃ / min), and the CPU usage rate of the heat dissipation process is less than 5%, it is determined that an abnormality has occurred, and further, the log semantic data corresponding to the heat dissipation process needs to be analyzed to determine whether the heat dissipation execution device (such as a fan) is abnormal or the process is abnormal (such as a program abnormality). It can be understood that the sizes of the third threshold value and the fourth threshold value can be designed according to actual scenes or requirements. Specifically, the log semantic data corresponding to the heat dissipation process can be analyzed to check whether the heat dissipation process is alive, or whether there is a record of process crash, or whether the communication between the heat dissipation process and the underlying hardware (such as a fan controller) is normal, etc. If the program is normal, the operation of the heat dissipation execution mechanism is checked, such as whether the fan sound is normal, or whether the liquid cooling pipeline is normally circulated, etc.

[0090] The application analyzes the battery temperature and the CPU usage rate of the heat dissipation process, and combines the analysis of the log semantic data, which is helpful to quickly and accurately locate the fault source and solve the problem of difficult fault location.

[0091] In some optional embodiments, the CPU usage rate of the process includes the CPU usage rate of the PCS control process, and the operation data of the energy storage device includes the PCS power; and the fault diagnosis according to the CPU usage rate of the process and the operation data of the energy storage device includes: when the CPU usage rate of the PCS control process is greater than a fifth threshold value, and the fluctuation of the PCS power is greater than a preset fluctuation range, it is determined that the fault is CPU overload caused by abnormality of the PCS control process.

[0092] For example, when the CPU usage rate of the PCS control process is greater than 40% (the normal range is < 25%), and the fluctuation of the PCS power is greater than ± 10%, it is determined that the fault is CPU overload caused by abnormality of the PCS control process.

[0093] The PCS control process is responsible for real-time data exchange and control instruction issuing with the PCS device. In normal cases, the PCS power changes smoothly, and the CPU usage rate of the PCS control process is also stable within the normal range (< 25%). When the PCS control process is abnormal (such as program error, memory leakage), the issued power instruction is chaotic, the PCS power abnormally fluctuates, and at the same time, the CPU usage rate of the PCS control process rises to process abnormal data, and the CPU usage rate is greater than the fifth threshold value, wherein the fifth threshold value (40%) is greater than the normal monitoring threshold value (25%) of the process.

[0094] The application analyzes the PCS power and the CPU usage rate of the PCS control process. If the CPU usage rate of the PCS control process is greater than the normal monitoring threshold value, and the fluctuation of the PCS power is greater than the preset fluctuation range, it indicates that the fault is CPU overload caused by abnormality of the PCS control process. The fault is locked in a specific process and the interaction with the PCS, which provides troubleshooting direction for the operation and maintenance personnel, helps to more quickly and accurately locate the fault, improves the fault handling efficiency, and ensures the safe operation of the energy storage system.

[0095] In some optional embodiments, the CPU usage rate of the process includes the CPU usage rate of the log analysis process; and the fault diagnosis according to the CPU usage rate of the process and the operation data of the energy storage device includes: judging the working condition switching state according to the operation data of the energy storage device; and when the CPU usage rate of the log analysis process is greater than a sixth threshold value, and there is no working condition switching, it is determined that the fault is CPU overload caused by log processing logic redundancy.

[0096] Specifically, the working condition switching state is determined according to the changes of the PCS active power and the battery current. For example, when the energy storage device is discharging, the PCS active power is greater than 0, and when the energy storage device is charging, the PCS active power is less than 0. When the PCS active power and the battery current increase negatively from zero, it is determined that the working condition switching process is switched from standby to charging, or when the PCS active power and the battery current increase positively from zero, it is determined that the working condition switching process is switched from standby to discharging.

[0097] When the energy storage system has no working condition switching, the energy storage system is in a relatively stable operating state, the data amount processed by the log analysis process is relatively uniform, and the CPU usage rate of the log analysis process is within the normal monitoring range. When the energy storage system has working condition switching, a large amount of state change logs, control instruction logs and sensor data logs are generated. At this time, the data amount processed by the log analysis process increases, and the CPU usage rate of the log analysis process rises. Therefore, if the CPU usage rate of the log analysis process is greater than a sixth threshold value when there is no working condition switching, and the sixth threshold value is greater than the normal monitoring threshold value of the process, the high load caused by working condition switching can be excluded, and it is determined that the fault is CPU overload caused by log processing logic redundancy, for example, the log analysis algorithm may be inefficient, or the system may be in an infinite loop or repeatedly processing the same batch of log data.

[0098] For example, when the CPU usage rate of the log analysis process is greater than 30% (the normal range is less than 10%) and there is no working condition switching, it is determined that the fault is CPU overload caused by log processing logic redundancy.

[0099] The application associates the working condition switching state with the CPU usage rate of the log analysis process. When the CPU usage rate of the log analysis process is greater than the normal monitoring threshold value and there is no working condition switching, it is determined that the fault is CPU overload caused by log processing logic redundancy, so that the fault location is more accurate, and the response speed and accuracy of operation and maintenance are improved.

[0100] In some optional embodiments, the method provided by the application further comprises: constructing an abnormal process feature engineering model, analyzing process behavior data by process tree traversal combined with parent-child process call chain tracking to identify abnormal processes; using regular matching and text vectorization technology to analyze log semantic data; using deep packet detection technology to extract flow features based on network flow data, and identifying abnormal connections according to the flow features.

[0101] Specifically, the process behavior data obtained is characterized by process tree traversal combined with parent-child process call chain tracking. The extracted features include dynamic features, static features, and timing features. The dynamic features include process ID, parent process ID, startup path, permission level, etc. The static features include the change rate of CPU or memory occupancy, the number of file handles, the number of network connections, etc. The timing features include the resource occupancy curve in the process life cycle, such as the continuous growth trend of memory leakage. The feature space of normal processes is constructed by the PCA (principal components analysis) algorithm and the isolation forest algorithm. Processes deviating from the space are determined as abnormal processes, thereby constructing an abnormal process feature engineering model. The extracted features are input into the pre-constructed abnormal process feature engineering model to identify hidden abnormal processes (such as zombie processes).

[0102] The kernel log and application log data are parsed using regular matching and NLP (Natural Language Processing) text vectorization technology to convert unstructured logs into analyzable semantic features, solving the defects of traditional log monitoring such as "only keyword matching, lack of semantic understanding".

[0103] The DPI (Deep Packet Inspection) technology is used to extract flow features from the obtained network traffic data. The flow features include five-tuple features, traffic statistics features, and application layer features. The five-tuple features include source IP, source port, destination IP, destination port, and protocol. The traffic statistics features include byte count, packet count, flow duration, and packet interval time entropy. The application layer features include HTTP User-Agent, URL (Uniform Resource Locator) path, and DNS (Domain Name System) query domain name. The extracted flow features are analyzed to identify abnormal connections at the network level, such as DDoS (Distributed Denial of Service) pre-flow anomalies, improving the system monitoring dimension.

[0104] The present application locks the problem process through abnormal process feature engineering, analyzes the log semantics combined with regular matching and text vectorization technology, and supplements the network dimension evidence with deep packet detection technology, realizing the full-link fault location of "resource anomaly -> process anomaly -> log evidence -> network correlation", shortening the fault location time.

[0105] In some optional embodiments, the method provided in the application further comprises: using a model-based fault diagnosis algorithm to perform fault fusion analysis on the multi-dimensional data.

[0106] Specifically, a model-based diagnosis (MBD) fault diagnosis model is constructed based on a physical model, an operation mechanism model (such as a BMS battery charging and discharging model and a PCS power conversion model) of the energy storage system, multi-dimensional data (such as battery temperature, PCS power and system CPU load) is input into the model, a model prediction value is output, and the multi-dimensional data is compared and analyzed with the model prediction value to determine the fault type and locate the fault source.

[0107] The application uses a model-based fault diagnosis (MBD) algorithm combined with multi-dimensional data fusion analysis, which can improve the diagnosis accuracy, enhance the adaptability to complex scenarios, and help accurately locate the fault root cause.

[0108] In some optional embodiments, after fault diagnosis, the method provided in the application further comprises: using a TOPSIS-based multi-attribute decision algorithm to sort the fault priority, and calling a historical repair scheme in an expert rule library to generate a report containing repair suggestions.

[0109] When handling the faults of the energy storage device, the problem of “threatening the safety of the device or personnel” is solved first, then the problem of “affecting the operation of the energy storage business” is handled, and finally the problem of “whether the repair is complex” is considered. Therefore, the fault attributes are set to include safety impact, business continuity and repair difficulty, the fault attribute weights are safety impact > business continuity > repair difficulty, the TOPSIS (Technique for Order Preference by Similarity to Ideal Solution) multi-attribute decision algorithm calculates the fault priority according to the fault attribute weights, sorts the fault priority, and then calls a historical repair scheme in an expert rule library to generate a report containing repair suggestions (for example, “insufficient disk space” is prioritized over “CPU slight overload”).

[0110] For example,

[0111] Fault 1: battery cell voltage imbalance; high safety impact, high business continuity impact and medium repair difficulty; may cause thermal runaway and inability to charge and discharge; repair suggestion: need to disassemble the cabinet for inspection.

[0112] Fault 2: PCS power output abnormality; no safety impact, high business continuity impact (affecting charging and discharging) and easy repair difficulty; repair suggestion: restart the PCS.

[0113] Fault 3: Monitoring system log storage is full; no security impact, no business continuity impact, and easy repair difficulty; the repair suggestion is to export old logs to clear memory.

[0114] In handling the fault, fault 1 is handled first, fault 2 is handled second, and fault 3 is handled last.

[0115] The application uses the multi-attribute decision algorithm of TOPSIS, eliminates the subjective bias of artificial priority setting through multi-attribute quantitative calculation, and integrates the expert rule base through artificial cooperation to provide research and judgment experience for complex faults, and can call historical repair schemes to reduce the technical threshold.

[0116] The application also sets different levels of thresholds corresponding to fault levels, for example, battery temperature 35℃ is "mild", 45℃ is "moderate", and 55℃ is "severe", and the threshold classification is used to accurately judge the severity of the fault.

[0117] In some optional embodiments, after fault diagnosis, the method provided by the application further includes: setting different alarm levels and alarm modes for different fault types, and delaying the alarm of low-level faults during the preset silent period.

[0118] Optionally, different alarm levels and alarm modes can be set for different fault types according to the severity of the fault. For example, the set alarm levels include first-level fault, second-level fault and third-level fault, wherein the severity of the first-level fault is the highest, the severity of the third-level fault is the lowest, the alarm mode of the first-level fault can be triple alarm of short message, email and telephone, the alarm mode of the second-level fault can be double alarm of short message and email, and the alarm mode of the third-level fault can be short message alarm.

[0119] Optionally, different alarm levels and alarm modes can also be set according to the business impact. For example, the set alarm levels include core business fault and non-core business fault, the alarm mode of the core business fault is double alarm of short message and email, and the alarm mode of the non-core business fault is short message alarm.

[0120] Among them, the core business is the key function of the energy storage device, such as peak-valley arbitrage (charging at low price valley and discharging at peak), emergency power supply (powering the load when power is off), and power grid frequency regulation (responding to power demand); the non-core business is the auxiliary function that does not affect the key function, such as historical data report generation, device operation log backup, and non-key parameter (such as storage cabinet environment humidity) monitoring.

[0121] Optionally, different alarm levels and alarm modes can also be set according to the severity of the fault in combination with the safety impact and business impact. For example, set the threat to equipment or personnel safety (such as battery over-temperature), interrupt core business (such as PCS stall) as "high severity" fault; only affect non-core business (such as log storage full), no safety or business risk (such as CPU of a non-critical process is slightly high for a short period of time) as "low severity" fault. The alarm mode of "high severity" fault can be SMS and email dual alarm, and the alarm mode of "low severity" fault is SMS alarm.

[0122] The present application sets different alarm levels and alarm modes for different fault types, which can inform the management personnel of serious faults, improve fault response efficiency, reduce losses, and also reduce the interference of minor faults.

[0123] At the same time, by setting a silent period, for example, from 12 o'clock at night to 7 o'clock in the morning, when a low-level fault (such as a non-core business fault) occurs, the fault alarm is delayed until after 7 o'clock in the morning, avoiding disturbing at night.

[0124] In some optional embodiments, the method provided by the present application further comprises: grouping diagnosis according to different devices and different data types of the devices, for example, diagnosing PCS and BMS separately, and subdividing by data type (such as "power channel" and "voltage channel" of PCS, "temperature channel" and "SOC channel" of BMS), each channel is independently monitored to avoid cross interference of faults.

[0125] Optionally, in addition to the correlation analysis of multi-dimensional data, the present application can also perform real-time analysis and trend analysis on multi-dimensional data.

[0126] Specifically, real-time analysis can be real-time calculation and analysis of indicators such as CPU usage, memory usage, battery temperature, to determine whether the operating data of the operating system and the operating data of the energy storage system are within the normal operating range. For example, when the CPU usage rate exceeds the set threshold (such as 80%) for a continuous period of time, the system will mark it as an abnormal condition and further analyze the reason for the high CPU usage, such as whether there is a process that occupies a large amount of CPU resources for a long time.

[0127] Trend analysis can be the use of historical data to analyze the usage trend of system resources, charging and discharging power, etc. For example, by plotting the curve of CPU usage, memory usage, etc. with time, the future usage of system resources can be predicted. Or by analyzing the CPU usage rate data of different time periods every day in the past week, the CPU usage rate trend of the same time period in the future can be predicted, so as to make resource allocation and optimization in advance.

[0128] The application fuses real-time analysis, trend analysis and correlation analysis, can quickly find current abnormalities through real-time analysis, predict the future by using historical data through trend analysis, facilitate early planning of resources, can mine the connection between different data through correlation analysis, quickly locate the root cause of complex faults, improve fault handling efficiency, and solve the problem of difficult fault location.

[0129] Optionally, the monitoring threshold is automatically optimized by a sliding window dynamic threshold algorithm, for example, the CPU alarm threshold is dynamically adjusted according to the business peak value, for example, the operating system performs log saving at 12 o'clock, at this time, the CPU alarm threshold is increased, and the false alarm rate is reduced.

[0130] Optionally, when performing periodic task scheduling, the periodic task scheduling includes performing a deep health check at dawn every day, checking whether data collection is interrupted, whether the charge and discharge capacity reaches the expectation, and automatically retriggering the diagnosis process when a new abnormality is detected, forming a complete closed loop of "monitoring-diagnosis-repair-optimization", and guaranteeing long-term stable operation of the system.

[0131] Optionally, the monitoring results are directly presented in the form of visual charts, graphs and reports, reducing the difficulty of administrators to understand the data, at the same time, detailed reports in various formats (such as PDF, Excel) can be generated as needed, facilitating archiving and further analysis, and solving the problem of non-intuitive data presentation and inconvenient analysis.

[0132] Based on the same idea, the embodiment of the application also provides an operating system state monitoring device for a energy storage system, such as Figure 2 A structural schematic diagram of an operating system state monitoring device for a energy storage system provided by the embodiment of the application, the operating system state monitoring device 20 for a energy storage system mainly includes:

[0133] The acquisition module 21 is configured to acquire multi-dimensional data, the multi-dimensional data including operating system running data and energy storage equipment running data, the operating system running data including system resource data, process behavior data, log semantic data and network traffic data;

[0134] The judgment module 22 is configured to judge the running condition of the energy storage equipment according to the energy storage equipment running data;

[0135] The correlation module 23 is configured to correlate the time sequence characteristics of the multi-dimensional data by using an attention mechanism;

[0136] The fault diagnosis module 24 is configured to perform fault diagnosis based on the running condition of the energy storage equipment and the operating system running data.

[0137] In one possible implementation, the operating condition of the energy storage device includes charging, discharging, and standby, and the system resource data includes system CPU average load; the fault diagnosis module 24 can be further configured to:

[0138] When the operating condition of the energy storage device is charging or discharging, the system CPU average load is greater than a first threshold value and lasts for a first time length, it is determined that the fault is CPU overload;

[0139] When the operating condition of the energy storage device is standby, the system CPU average load is greater than a second threshold value and lasts for a second time length, it is determined that the fault is CPU overload;

[0140] The first threshold value is greater than the second threshold value, and the first time length is greater than the second time length.

[0141] In one possible implementation, the process behavior data includes CPU usage of the charging and discharging control process; the fault diagnosis module 24 can be further configured to:

[0142] When the operating condition of the energy storage device is charging or discharging, the monitoring threshold value of the CPU usage of the charging and discharging control process is increased.

[0143] In one possible implementation, the process behavior data includes CPU usage of the process, and the fault diagnosis module 24 can be further configured to:

[0144] The fault diagnosis is performed according to the CPU usage of the process and the operating data of the energy storage device.

[0145] In one possible implementation, the CPU usage of the process includes CPU usage of the heat dissipation process, and the operating data of the energy storage device includes battery temperature; the fault diagnosis module 24 can be further configured to:

[0146] When the temperature rising rate of the battery temperature is greater than a third threshold value, and the CPU usage of the heat dissipation process is less than a fourth threshold value, the log semantic data corresponding to the heat dissipation process is analyzed to determine an abnormal reason, and the abnormal reason includes heat dissipation execution device abnormality and process abnormality.

[0147] In one possible implementation, the CPU usage of the process includes CPU usage of the PCS control process, and the operating data of the energy storage device includes PCS power; the fault diagnosis module 24 can be further configured to:

[0148] The fault diagnosis is performed according to the CPU usage of the process and the operating data of the energy storage device, including:

[0149] When the CPU usage of the PCS control process is greater than a fifth threshold value, and the fluctuation of the PCS power is greater than a preset fluctuation range, it is determined that the fault is CPU overload caused by PCS control process abnormality.

[0150] In one possible implementation, the CPU usage of the process includes the CPU usage of the log analysis process; the fault diagnosis module 24 can be further configured to:

[0151] determine the working condition switching state according to the operation data of the energy storage device;

[0152] when the CPU usage of the log analysis process is greater than the sixth threshold value and there is no working condition switching, determining that the fault is CPU overload caused by log processing logic redundancy.

[0153] In one possible implementation, the operating system state monitoring device 20 for the energy storage system further includes an analysis module, which is configured to:

[0154] constructing an abnormal process feature engineering model, analyzing process behavior data through process tree traversal combined with parent-child process call chain tracking to identify abnormal processes;

[0155] adopting regular matching and text vectorization technology to analyze log semantic data;

[0156] adopting deep packet inspection technology to extract flow features based on network flow data, and identifying abnormal connections according to the flow features.

[0157] In one possible implementation, the analysis module is further configured to:

[0158] performing fault fusion analysis on multi-dimensional data using a model-based fault diagnosis algorithm.

[0159] In one possible implementation, the operating system state monitoring device 20 for the energy storage system further includes a fault repair module, which is configured to:

[0160] performing fault priority sorting based on a TOPSIS multi-attribute decision algorithm, and calling a historical repair scheme in an expert rule library to generate a report containing repair suggestions.

[0161] In one possible implementation, the operating system state monitoring device 20 for the energy storage system further includes an alarm module, which is configured to:

[0162] setting different alarm levels and alarm modes for different fault types, and delaying the alarm of low-level faults during a preset silent period.

[0163] Figure 2 The operating system state monitoring device 20 for the energy storage system provided in the embodiments can be used to execute the technical solutions of the method embodiments of the present application, and the implementation principles and technical effects can be further referred to the related descriptions in the method embodiments.

[0164] It should be understood that the above Figure 2The division of the illustrated modules of the operating system state monitoring device 20 for the energy storage system is only a logical functional division. In actual implementation, all or part of the modules can be integrated into one physical entity, or can be physically separated. Moreover, the modules can all be implemented in the form of software invoked by a processing element; can all be implemented in the form of hardware; or some modules can be implemented in the form of software invoked by a processing element, and some modules can be implemented in the form of hardware. For example, the acquisition module can be a separately established processing element, or can be implemented in a certain chip of an electronic device. The implementation of other modules is similar. Moreover, all or part of the modules can be integrated together, or can be independently implemented. In the implementation process, each step of the above method or each of the above modules can be completed by an integrated logic circuit of hardware in a processor element or an instruction in the form of software.

[0165] For example, the above modules can be one or more integrated circuits configured to implement the above method, such as one or more application specific integrated circuits (ASICs), or one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs), etc. For another example, the modules can be integrated together to implement a system-on-a-chip (SOC).

[0166] In the above embodiments, the processor can include a CPU, a DSP, a microcontroller, or a digital signal processor, and can further include a GPU, an embedded neural network processing unit (NPU), and an image signal processor (ISP). The processor can further include necessary hardware accelerators or logic processing hardware circuits, such as an ASIC, or one or more integrated circuits for controlling the execution of programs of the technical solutions of the present application. In addition, the processor can have the function of operating one or more software programs, and the software programs can be stored in a storage medium.

[0167] Those skilled in the art can clearly understand that the units and algorithm steps described in the embodiments disclosed herein can be realized by electronic hardware, computer software and a combination of the two. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solutions. Those skilled in the art can use different methods to realize the described functions for each specific application, but the implementation should not be considered beyond the scope of the present application.

[0168] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0169] In several embodiments provided in the present application, any function realized in the form of a software function unit and sold or used as an independent product can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0170] The embodiments of the present application also provide an energy storage system, comprising: an operating system, which is state-monitored by the operating system state monitoring device for the energy storage system shown in the above embodiments.

[0171] The above is only a specific implementation of the present application, and any skilled person in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. The protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for monitoring the status of an operating system in an energy storage system, wherein the operating system is used to manage and control energy storage devices, characterized in that, The method includes: Acquire multi-dimensional data, including operating system runtime data and energy storage device runtime data. The operating system runtime data includes system resource data, process behavior data, log semantic data, and network traffic data. The operating condition of the energy storage device is determined based on its operating data. The attention mechanism is used to correlate the temporal features of the multi-dimensional data; Fault diagnosis is performed based on the operating conditions of the energy storage device and the operating data of the operating system. The operating conditions of the energy storage device include charging, discharging and standby, and the system resource data includes the average CPU load of the system. The fault diagnosis based on the operating conditions of the energy storage device and the operating data of the operating system includes: When the energy storage device is operating in charging or discharging mode, and the average CPU load of the system is greater than a first threshold and lasts for a first duration, the fault is determined to be CPU overload. When the energy storage device is in standby mode, and the average CPU load of the system is greater than the second threshold and lasts for a second duration, the fault is determined to be CPU overload. The first threshold is greater than the second threshold, and the first duration is greater than the second duration; The process behavior data includes the CPU utilization rate of the charge / discharge control process; the method further includes: When the energy storage device is operating in the charging or discharging state, increase the monitoring threshold of CPU utilization in the charging and discharging control process.

2. The method for monitoring the operating system status of an energy storage system according to claim 1, characterized in that, The process behavior data includes the process's CPU utilization, and the method further includes: Fault diagnosis is performed based on the CPU utilization of the process and the operating data of the energy storage device.

3. The method for monitoring the operating system status of an energy storage system according to claim 2, characterized in that, The CPU utilization of the process includes the CPU utilization of the heat dissipation process, and the operating data of the energy storage device includes the battery temperature. The fault diagnosis based on the CPU utilization of the process and the operating data of the energy storage device includes: When the rate of temperature rise of the battery exceeds the third threshold and the CPU utilization of the heat dissipation process is less than the fourth threshold, the log semantic data corresponding to the heat dissipation process is analyzed to determine the cause of the anomaly. The cause of the anomaly includes abnormal heat dissipation execution device and abnormal process.

4. The method for monitoring the operating system status of an energy storage system according to claim 2, characterized in that, The CPU utilization of the process includes the CPU utilization of the PCS control process, and the operating data of the energy storage device includes the PCS power. The fault diagnosis based on the CPU utilization of the process and the operating data of the energy storage device includes: When the CPU utilization of the PCS control process exceeds the fifth threshold and the fluctuation of the PCS power exceeds the preset fluctuation range, the fault is determined to be CPU overload caused by an abnormality in the PCS control process.

5. The method for monitoring the operating system status of an energy storage system according to claim 2, characterized in that, The CPU utilization of the process includes the CPU utilization of the log analysis process; The fault diagnosis based on the CPU utilization of the process and the operating data of the energy storage device includes: The operating condition switching status is determined based on the operating data of the energy storage device; When the CPU utilization of the log analysis process exceeds the sixth threshold and there is no change in operating conditions, the fault is determined to be CPU overload caused by redundancy in log processing logic.

6. The method for monitoring the operating system status of an energy storage system according to claim 1, characterized in that, The method further includes: An abnormal process feature engineering model is constructed, and the process behavior data is analyzed by combining process tree traversal with parent-child process call chain tracing to identify abnormal processes; The log semantic data is parsed using regular expression matching and text vectorization techniques; Deep packet inspection technology is used to extract flow features from the network traffic data, and abnormal connections are identified based on these flow features.

7. The method for monitoring the operating system status of an energy storage system according to claim 1, characterized in that, The method further includes: A model-based fault diagnosis algorithm is used to perform fault fusion analysis on the multi-dimensional data.

8. The method for monitoring the operating system status of an energy storage system according to claim 1, characterized in that, After fault diagnosis, the method further includes: The TOPSIS-based multi-attribute decision algorithm prioritizes faults and generates a report containing repair recommendations by calling historical repair schemes from the expert rule base.

9. The method for monitoring the operating system status of an energy storage system according to claim 1, characterized in that, After fault diagnosis, the method further includes: Different alarm levels and alarm methods are set for different fault types, and alarms for low-level faults are delayed during preset silent periods.

10. An operating system status monitoring device for an energy storage system, characterized in that, include: The acquisition module is used to acquire multi-dimensional data, which includes operating system running data and energy storage device running data. The operating system running data includes system resource data, process behavior data, log semantic data, and network traffic data. The judgment module is used to judge the operating condition of the energy storage device based on the operating data of the energy storage device; The association module is used to associate the temporal features of the multi-dimensional data using an attention mechanism; The fault diagnosis module is used to perform fault diagnosis based on the operating conditions of the energy storage device and the operating data of the operating system. The operating conditions of the energy storage device include charging, discharging, and standby; the system resource data includes the average CPU load of the system; the process behavior data includes the CPU utilization of the charging and discharging control process; the fault diagnosis module can also be used for: When the energy storage device is operating in charging or discharging mode, and the average CPU load of the system is greater than a first threshold and lasts for a first duration, the fault is determined to be CPU overload. When the energy storage device is in standby mode, and the average CPU load of the system is greater than the second threshold and lasts for a second duration, the fault is determined to be CPU overload. The first threshold is greater than the second threshold, and the first duration is greater than the second duration; When the energy storage device is operating in the charging or discharging mode, increase the monitoring threshold of CPU utilization in the charging and discharging control process.

11. An energy storage system, characterized in that, include: An operating system, wherein the operating system is state-monitored by the operating system state monitoring device for an energy storage system as described in claim 10.

Images