Power system data anomaly prediction method based on deep learning

Abstract

The invention discloses an electric power system data anomaly prediction method based on deep learning, and relates to the field of data anomaly prediction.The method comprises the steps that firstly, a graph convolutional network and LSTM are used for deeply mining time series data of an electric power system and spatial-temporal characteristics of a topological structure, and high-precision anomaly detection and positioning are achieved; and when an exception is detected, an exception attribution mechanism is introduced, and exception signal features (such as exception fragments and positioning information) at a mathematical level are converted into a structured query object at a semantic level. And then, a barrier between numerical data and the unstructured operation and maintenance knowledge base is broken through a vector retrieval technology, and related maintenance regulations and historical cases are accurately recalled. And finally, an executable recommended disposal scheme is automatically generated based on recall knowledge in combination with the generation capability of a large language model, so that an intelligent closed loop from anomaly perception and knowledge matching to decision assistance is constructed, and the accuracy and efficiency of power system fault handling are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data anomaly prediction, and more particularly, to a power system data anomaly prediction method based on deep learning. BACKGROUND

[0002] With the rapid development of new power systems and energy power digitization and intelligentization, the scale of power business systems is increasingly large, generating massive multi-source heterogeneous monitoring data, including real-time time series data, system topology structure, etc. These data contain key state information of system operation, which is crucial for ensuring the safe and stable operation of power systems. Using deep learning technology to mine these massive data can capture complex spatio-temporal features, thereby realizing the transition from passive operation and maintenance to active prediction. Through accurate anomaly prediction, early warnings can be issued before faults occur, giving valuable disposal time to operation and maintenance personnel, reducing the probability and impact of faults, which has important practical significance for improving the reliability and operation efficiency of power systems.

[0003] However, the existing deep learning-based power system anomaly prediction scheme still has significant limitations in practical application, mainly manifested as a serious disconnection between anomaly detection and disposal decision. Current deep learning models, such as long short-term memory network LSTM, graph neural network GNN, etc., mainly aim to minimize prediction error or classification error, focusing on learning time series patterns from numerical data to output alarm signals. Although these models perform well in identifying what has happened, they cannot directly relate to the domain knowledge of how to handle. In the operation field, there is a huge information gap between structured monitoring data and unstructured operation expert knowledge base (such as technical regulations, historical maintenance records, disposal plans). When the model issues an anomaly alarm, the operation personnel often only receive a numerical anomaly prompt and still need to manually review a large number of documents or rely on personal experience to match the solution. This manual operation mode is not only inefficient, but also prone to errors in emergency failures. The existing technology lacks a mechanism that can automatically convert anomaly feature signals at the mathematical level into query intent at the semantic level, and further associate and retrieve with the operation knowledge base, cannot realize the intelligent closed loop from anomaly discovery to disposal plan generation, and is difficult to meet the requirements of power grid for fault disposal speed and accuracy.

[0004] Therefore, an optimized deep learning-based power system data anomaly prediction method is needed to break down the barriers between monitoring data and operation knowledge and solve the problem of disconnection between anomaly detection and disposal in the existing technology. SUMMARY

[0005] In order to solve the problems existing in the current technology, according to an aspect of the present application, a deep learning-based power system data anomaly prediction method is provided, which comprises: obtain a time sequence data matrix and a topology graph; perform spatio-temporal feature extraction and abnormality preliminary judgment on the time sequence data matrix and the topology graph to obtain an abnormality flag, an abnormal signal segment, and preliminary positioning information; perform abnormality attribution and query intention generation on the abnormal signal segment and the preliminary positioning information to obtain a structured query object; perform vector knowledge search on the structured query object in a power operation and maintenance knowledge base to obtain Top-N relevant document segments; generate a recommended treatment scheme based on the Top-N relevant document segments and the structured query object.

[0006] Compared with the prior art, the power system data abnormality prediction method based on deep learning provided in the application solves the problem that in existing power system abnormality prediction technologies, numerical monitoring is disconnected from operation and maintenance knowledge, resulting in that abnormal alarms cannot be directly converted into effective treatment decisions. The scheme first uses a graph convolution network and an LSTM to deeply mine the spatio-temporal features of power system time sequence data and topology structures, realizes high-precision abnormality detection and positioning, and when an abnormality is detected, introduces an abnormality attribution mechanism to convert mathematical-level abnormal signal features (such as abnormal segments and positioning information) into semantic-level structured query objects. Subsequently, a vector retrieval technology is used to break down the barrier between numerical data and unstructured operation and maintenance knowledge bases, accurately recall relevant maintenance procedures and historical cases. Finally, a large language model is combined to generate an executable recommended treatment scheme based on the recalled knowledge, thereby constructing an intelligent closed loop from abnormality perception, knowledge matching to decision assistance, and significantly improving the accuracy and efficiency of power system fault response. BRIEF DESCRIPTION OF DRAWINGS

[0007] The above and other objects, features and advantages of the present application will become more apparent from the following detailed description of embodiments of the present application taken in conjunction with the accompanying drawings.

[0008] Figure 1 A flowchart of the power system data abnormality prediction method based on deep learning according to the embodiments of the present application.

[0009] Figure 2 A data flow flowchart of the power system data abnormality prediction method based on deep learning according to the embodiments of the present application.

[0010] Figure 3 A flowchart of step 2 in the power system data abnormality prediction method based on deep learning according to the embodiments of the present application.

[0011] Figure 4 A flowchart of step 5 in the power system data abnormality prediction method based on deep learning according to the embodiments of the present application. DETAILED DESCRIPTION

[0012] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes, and are not intended to limit the protection scope of the present disclosure.

[0013] Therefore, to solve the above technical problems, the present application provides a power system data anomaly prediction method based on deep learning. Figure 1 A flowchart of the power system data anomaly prediction method based on deep learning according to an embodiment of the present application. Figure 2 A data flowchart of the power system data anomaly prediction method based on deep learning according to an embodiment of the present application. As shown in Figure 1 and Figure 2 As shown in the power system data anomaly prediction method based on deep learning according to an embodiment of the present application, it includes: step 1, obtaining a time series data matrix and a topology graph; step 2, performing space-time feature extraction and anomaly preliminary judgment on the time series data matrix and the topology graph to obtain an anomaly flag, an anomaly signal segment and preliminary positioning information; step 3, performing anomaly attribution and query intention generation on the anomaly signal segment and the preliminary positioning information to obtain a structured query object; step 4, performing vector knowledge search on the structured query object in a power operation and maintenance knowledge base to obtain Top-N related document segments; and step 5, generating a recommended treatment scheme based on the Top-N related document segments and the structured query object.

[0014] In step 1, the time series data matrix and the topology graph are obtained. It should be understood that, under the background of the continuous deepening of the current energy power digital transformation, the operation mode of the power grid is becoming increasingly complex, the source, grid, load and storage interact frequently, and a large amount of multi-source heterogeneous monitoring data is generated. These data not only contain time-varying electrical measurement values, but also contain topology structures describing the physical connection relationship of the power grid, which together constitute a panoramic view reflecting the operation state of the power network. However, the original discrete data points and static atlas cannot be directly understood and processed by the deep learning model, and pure numerical monitoring often cannot capture the spatio-temporal evolution law hidden in the complex network structure. In order to utilize advanced graph neural networks and long short-term memory networks to deeply mine the state of the power grid, realize the leap from passive monitoring to active prediction, the present application first constructs a standard data basis that can uniformly represent the time series dynamics and spatial topology. Therefore, the implementation of this step aims to extract and construct a standardized time series data matrix and a topology graph from a large amount of original monitoring flow, to provide accurate and structured mathematical inputs for subsequent space-time feature extraction, anomaly attribution and knowledge base-based treatment scheme generation, which is a prerequisite and cornerstone for realizing the entire data anomaly prediction closed loop.

[0015] In one exemplary operation, the specific procedure of step 1 is as follows: First, the monitoring range needs to be defined and the data acquisition channel is established. The monitoring range covers a specific power control area, such as a provincial power transmission network or a municipal power distribution network. The data sources mainly rely on the synchronized phasor measurement unit (PMU) in the wide area measurement system (WAMS) or the supervisory control and data acquisition (SCADA) system. PMU can provide phasor data with high-precision GPS timestamps at a high sampling frequency, such as 30 frames or 60 frames per second, which is suitable for capturing transient and dynamic anomalies; while SCADA system provides steady-state data at a level of seconds or minutes. In this embodiment, in order to achieve high-precision anomaly prediction, PMU data is preferred as the main source, supplemented by SCADA data. For the selected monitoring area, N key monitoring nodes are determined, which correspond to the busbars of substations, generator ports or key load points in the power grid. For each monitoring node, multiple types of electrical characteristic quantities need to be collected, including voltage amplitude, voltage phase angle, current amplitude, current phase angle, active power, reactive power, and frequency, etc. In the specific setting of this embodiment, the number of selected nodes is N, and the characteristic dimension collected by each node is F. Regarding the construction of the time series data matrix, the sliding window technique is applied to divide the continuous data stream into fixed-length sequence segments. Set a time window length T, which represents the number of time steps that the model backtracks historical data. According to the duration of typical transient disturbances or oscillation events in the power system and the minimum receptive field range required for deep learning models to capture effective time-dependent patterns, the statistical characteristics of historical fault samples and model convergence performance experiments need to be combined to optimize the setting, for example, T can be set to 30, which means that the model uses data from the past 30 sampling times to predict the future state. At the same time, set the sampling interval , for example, 20 milliseconds. At each current time t, extract the feature data of all N nodes from time t-T+1 to time t from the real-time database. This forms a three-dimensional data tensor, which is expressed as a two-dimensional matrix sequence or a specific dimension time series data matrix to adapt to the subsequent processing of graph neural networks. Specifically, the time series data matrix is denoted as , which has a mathematical form of a tensor with dimension , or in some simplified descriptions, for a single time t, it can be regarded as a The entire input is then a sequence of T such matrices. To facilitate the processing of the subsequent steps, the time series data matrix is defined as a collection of all F feature values of N nodes in T consecutive time steps in this embodiment. For example, the monitoring area is an IEEE-118 node system containing 118 nodes, i.e. N = 118, the voltage amplitude, voltage phase angle, active power and reactive power are selected as the key features, i.e. F = 4, and the time window is set to 30, i.e. T = 30, and the time series data matrix obtained is a 118x30x4 three-dimensional array in numerical value. This matrix completely records the dynamic change trajectory of the power grid in the past period of time, and contains the time series evolution pattern of the system.

[0016] Regarding the acquisition and construction of the topology graph, this is to endow the deep learning model with the ability to understand the spatial structure of the power grid. The physical connection relationship of the power system determines the propagation path of energy and faults, so this physical connection must be abstracted as a graph structure in graph theory . Among them, V represents the node set, corresponding to the N monitoring nodes described above; E represents the edge set, corresponding to the transmission lines or transformer branches connecting these nodes. The specific operation of acquiring the topology graph is to read the CIM (Common Information Model) file or topology description table from the energy management system (EMS) or network modeling database of the power grid. These files record the state (open or closed) of the switch in detail, because the running topology of the power grid will change with the action of the circuit breaker, so the acquisition of the topology graph is a dynamic updating process, which needs to ensure that the topology structure is consistent with the time stamp of the time series data matrix. In mathematical representation, the topology graph is mainly quantified by the adjacency matrix. Define the adjacency matrix as A, which is an N x N square matrix. The element in the matrix describes the connection relationship between node i and node j. In the most basic implementation, if there is a direct physical line between node i and node j and it is in the running state, = 1; otherwise, = 0. In addition, in order to enhance the model's ability to capture network characteristics, the adjacency matrix can also be weighted, i.e. The value of can be set according to the physical parameters of the line (such as the modulus of admittance value, the reciprocal of line length, or impedance information), so as to reflect the closeness of the electrical connection between nodes. In this step, the final output topology graph not only contains the visual graph structure, but also essentially outputs the N x N adjacency matrix A. For example, in the above example of the IEEE-118 node system, the adjacency matrix will be a 118 x 118 matrix, and the non-zero elements in it accurately map the power grid structure of the system. In order to ensure the quality and availability of the data, data alignment operations are also involved in the process of obtaining the time series data matrix and the topology graph. Due to the possibility of slight time delay in the transmission process of PMU data of different nodes, high-precision timestamps obtained by GPS time service are used for data alignment to ensure that the data in the same column of the matrix strictly corresponds to the same physical time. If the data of a node is missing at a certain time point, linear interpolation or previous value retention method is used to fill in the missing data to ensure the integrity of the matrix.

[0017] In step 2, the time and space features of the time series data matrix and the topology graph are extracted and the initial judgment of the anomaly is made to obtain the anomaly flag, the abnormal signal segment and the preliminary positioning information. Accordingly, in the field of power network operation monitoring, although the original electrical measurement data is large in scale, it is often mixed with random noise, environmental interference and dimensional differences between different devices, and the simple numerical sequence cannot directly reflect the complex physical connection characteristics of the power grid. The anomaly of the power system often does not occur in isolation, and voltage fluctuation or frequency deviation will propagate along the transmission line in the network topology, showing strong spatial correlation. At the same time, the evolution of the fault is a dynamic process, and the current state is deeply dependent on the operation trajectory at the historical time, showing significant time dependence. If only the threshold value at a single time or a single node is relied on, the time and space coupling rules hidden in the multi-dimensional data are easily ignored, resulting in missed or false reports. Therefore, the steps of time and space feature extraction and initial anomaly judgment are implemented to reconstruct the multi-dimensional features of the cleaned and standardized data through a deep learning model.

[0018] Figure 3 The flowchart of step 2 in the deep learning-based power system data anomaly prediction method according to the embodiments of the present application. In an exemplary operation, as shown in FIG. 2, the time and space features of the time series data matrix and the topology graph are extracted and the initial judgment of the anomaly is made to obtain the anomaly flag, the abnormal signal segment and the preliminary positioning information. Figure 3As shown, step 2, spatio-temporal feature extraction and abnormality preliminary judgment are performed on the time series data matrix and the topology graph to obtain abnormality signs, abnormal signal segments and preliminary positioning information, including: step 21, multi-source data fusion and standardization preprocessing are performed on the time series data matrix and the topology graph to obtain a standardized data matrix and an adjacency matrix; step 22, spatial feature extraction based on graph convolution is performed on the standardized data matrix and the adjacency matrix to obtain a spatial feature sequence; step 23, LSTM-based time series pattern evolution learning is performed on the spatial feature sequence to obtain a next time state prediction value; step 24, abnormality discrimination and abnormality positioning are performed based on the next time state prediction value and the next time real observation value to obtain abnormality signs, abnormal signal segments and preliminary positioning information.

[0019] The specific process of step 2 is as follows: first, step 21 is implemented. In the topology analysis link, first, the CIM model file or the branch parameter table of the power grid is read to construct an adjacency matrix A with a dimension of 118x118. For any element in the matrix , if there is a physical transmission line running between node i and node j, it is set to 1, otherwise it is set to 0. In order to correctly normalize in the subsequent graph convolution operation, the degree matrix D needs to be calculated at the same time. The degree matrix D is a diagonal matrix, and the element on the diagonal is equal to the sum of all elements of the i-th row of the adjacency matrix, that is, the total number of adjacent nodes connected to the node. Then, missing value processing is performed. Since there may be packet loss in PMU data transmission, the original time series data matrix is scanned in full. Once a non-numeric null value is detected, the program locks the data before and after the missing point, and uses linear interpolation algorithm to calculate the intermediate value for filling. For example, if the voltage of a node at time t is missing, the average of the voltages at times t-1 and t+1 is taken as the filling to ensure the integrity of the input tensor. Then, Z-Score standardization processing is performed, which is to eliminate the influence of different physical dimensions. The voltage amplitude is in the order of 110kV to 500kV, while the phase angle is in radians. The huge difference in order of magnitude makes it difficult for the deep learning model to converge. Therefore, for each feature dimension, the mean and standard deviation are calculated based on historical statistical data, and the transformation is performed on each element x in the matrix. After this operation, all feature values are mapped to the standard normal distribution interval with a mean of 0 and a variance of 1. The final output standardized data matrix is a 118x30x4 tensor with uniform numerical distribution, combined with the 118x118 adjacency matrix.

[0020] Step 22 is then implemented. The topology dependency of the power system in space is captured by using a graph convolution network (GCN). Traditional convolutional neural networks deal with regular grid data (such as images), while the power grid is a graph structure in non-Euclidean space. In this embodiment, the state of the power grid at each time step t is regarded as a signal matrix defined on a graph , which has a dimension of 118 x 4. In order to enable each node to retain its own features while aggregating neighbor information, first, the adjacency matrix A is renormalized, that is, a unit matrix I is added to A to obtain an adjacency matrix with a self-loop , and the corresponding degree matrix is calculated accordingly. The operation process of graph convolution is based on the first-order approximation of spectral graph theory, and its core propagation formula is . In the formula, , the input feature matrix of the lth layer is , that is, the standardized data matrix of the current time step t; is a normalized Laplacian matrix, which ensures the stability of the numerical value in the feature aggregation process through mathematical transformation, preventing the explosion of the eigenvalue caused by the excessively large node degree; is the trainable weight matrix of the current layer, and its dimension determines the spatial transformation of the feature mapping, for example, mapping the original 4-dimensional feature to a 64-dimensional hidden layer space; is a nonlinear activation function, and the ReLU function is selected to increase the nonlinear expression ability of the model. In the specific operation of this embodiment, a neural network architecture including two layers of GCN is constructed. For each time step t (from 1 to 30) within the time window T = 30, the model independently inputs the feature matrix of the moment into the GCN network. The first layer of GCN maps the input of 118 x 4 to an intermediate feature of 118 x 32, and the second layer of GCN further maps it to a high-dimensional spatial feature vector of 118 x 64 . This is no longer a simple electrical quantity value, but a comprehensive topological feature vector that integrates the node itself and the state information of its first-order and second-order neighborhood nodes. By traversing the entire time window, the outputs of 30 moments are stacked in time sequence to finally form a spatial feature sequence with a dimension of 118 x 30 x 64 . This sequence not only retains the time sequence of the original data, but also deeply embeds the spatial structure information of the power grid at each time slice. The weight matrix and the bias term are parameters learned automatically by the back propagation algorithm during the model training phase by minimizing the prediction error loss function.

[0021] Then, step 23 is implemented to capture the dynamic law of the power system operating state evolving over time, especially to deal with the long-distance time dependence problem. The spatial feature sequence is sent as input into a long short-term memory network (LSTM). The LSTM is a special recurrent neural network whose core architecture contains an input gate, a forget gate, an output gate, and a cell state, and can effectively solve the gradient vanishing problem in long sequence training. The specific processing process is as follows: the LSTM network reads the elements in the spatial feature sequence one by one in time step order. If the current time step t is processed, the input is , with a dimension of 118x64. First, the forget gate decides which information in the cell state at the previous time step should be discarded. It reads the hidden state at the previous time step and the current input , and outputs a value vector between 0 and 1 through a sigmoid activation function , with the calculation formula being In the power scenario, this is equivalent to the model automatically determining which historical fluctuations (such as a random disturbance a long time ago) have no effect on the future state and should be forgotten. Second, the input gate decides which new information should be updated to the cell state. It is composed of two parts: the sigmoid layer determines the weight of the update value , and the tanh layer generates a new candidate value vector . Then, the cell state is updated , with the formula being This step realizes the fusion of long and short-term memory, retaining key historical trends (such as a sustained rise in load). Finally, the output gate determines the final hidden state based on the current cell state and input, which is the deep encoding of the spatio-temporal state at the current time step by the model. In this embodiment, the hidden layer dimension of the LSTM is set to 64. After 30 time step iterations, the hidden state at the last time step is taken. This vector condenses the spatio-temporal evolution law of the power grid in the past 30 sampling periods. To obtain specific prediction values, the is input into a fully connected layer. The fully connected layer maps the 64-dimensional hidden state back to the original feature dimension (i.e., 4 dimensions) through linear transformation , thereby obtaining a prediction value matrix for all 118 nodes at the next time step (T+1). This prediction matrix contains the predicted voltage amplitude, phase angle, active and reactive power of each node, which represents the state that the power grid should have under normal operation mode based on historical laws. The prediction value is directly passed to the subsequent steps for comparison with the actual observed value collected at T+1, and then the anomaly score is calculated and the anomaly flag is generated. The gating unit weight and fully connected layer weights , bias and Also in the offline training phase, the weights are optimized to minimize the mean square error (MSE) through learning from a large number of historical samples.

[0022] Finally, step 24 is implemented, in an example operation, step 24, based on the next time state prediction value and the next time real observation value, to perform anomaly discrimination and anomaly positioning to obtain an anomaly flag, an anomaly signal segment, and preliminary positioning information, including: step 241, calculating an anomaly score between the next time state prediction value and the next time real observation value; step 242, determining an adaptive threshold based on historical error sliding window data; step 243, generating the anomaly flag based on a comparison between the anomaly score and the adaptive threshold. In an example operation, step 24, based on the next time state prediction value and the next time real observation value, to perform anomaly discrimination and anomaly positioning to obtain an anomaly flag, an anomaly signal segment, and preliminary positioning information, further includes: step 244, in response to the anomaly flag being true, intercepting the original data containing the previous T time steps of the time when the anomaly is triggered as the anomaly evidence segment; step 245, calculating the contribution degree of each monitoring node in the prediction error vector to the anomaly score, and determining the preliminary positioning information based on the ordering of the contribution degree.

[0023] Step 241: In order to quantify the severity of the prediction deviation, but not simply calculate the Euclidean distance, because there is often correlation between different characteristic variables (such as voltage amplitude and active power) of the power system, and the fluctuation amplitudes (variances) of different variables are also different. In order to eliminate the interference of correlation between variables and the influence of standardization scale, this embodiment adopts Mahalanobis distance as the measurement standard of anomaly score. Specifically, first, obtain the prediction value matrix for all N nodes at time T+1 output by step 23 At the same time, obtain the actual real observation value matrix at time T+1 from the data acquisition system (such as PMU) . Taking the IEEE-118 node system as an example, the dimensions of the two matrices are both 118x4, that is, 118 nodes and 4 characteristics for each node. First, calculate the prediction error vector , which is the difference between the real value and the prediction value, that is . In order to facilitate matrix operation, the difference value matrix is flattened into a one-dimensional column vector with a dimension of 472x1, that is, 118x4. Next, use the pre-constructed historical error distribution model to calculate the anomaly score. The model relies on two key parameters: the mean vector of the historical error vector and the covariance matrix of the historical error data These two parameters are obtained during the model training or validation phase by collecting a large number of prediction error samples under normal operating conditions. For example, the prediction error data of the model under normal operating conditions over the past week can be collected and its mean calculated. (Ideally, a vector close to zero) and the covariance matrix (Describes the degree of correlation between errors between different nodes and different features). In an exemplary operation, step 241, calculating the anomaly score between the predicted state value and the actual observation value at the next time step, includes: step 241-1, calculating the prediction error vector between the predicted state value and the actual observation value at the next time step; step 241-2, determining the anomaly score based on the prediction error vector using the following formula: in, For the prediction error vector, This is the mean vector of the historical error vector. The covariance matrix of the historical error data. For outlier scores. In this formula, This indicates the deviation of the current error from the historical average level; It is the inverse of the covariance matrix, and its role is extremely crucial. It is equivalent to decorrelation and standardization of the error vector. The weight of features with large variance will be reduced, while the weight of features with small variance will be increased, and the covariance between variables is taken into account. This represents the matrix transpose operation. The final calculated... This is a scalar value, namely the anomaly score. For example, in a certain actual calculation, the calculated anomaly score is 5.8. This value intuitively reflects the statistical distance between the current prediction error and the center of the normal error distribution. The larger the value, the further the current operating state deviates from the normal pattern, and the higher the probability of anomalies.

[0024] Step 242: The operating state of the power system is time-varying, and its noise level and fluctuation characteristics change with factors such as load level and generator dispatch. A fixed threshold is difficult to balance sensitivity and false alarm rate simultaneously; therefore, this embodiment adopts a dynamic threshold setting method based on a sliding window. The specific operation is as follows: Maintain a threshold of length... A sliding window for historical abnormal scores, such as setting =1000, storing the set of anomaly scores calculated over the past 1000 time steps. This window updates continuously over time; each new outlier score slides into the window, and the oldest score is removed. The percentile method is used to determine the current dynamic threshold. Set a confidence level, such as 99% or 99.9%. The system will sort the 1000 historical outlier scores within the sliding window from smallest to largest and select the 990th value (corresponding to the 99th percentile) as the current threshold. For example, if the historical outlier scores within the current sliding window are mainly distributed between 1.2 and 4.5, and after sorting, the 99th percentile value is 4.2, then the adaptive threshold will be... =4.2. If, in the next period, the overall prediction error of the model slightly increases due to increased fluctuations in grid load, the score distribution within the historical window shifts to the right, and the 99th percentile may become 5.0. In this case, the threshold will automatically rise to 5.0, thereby avoiding false alarms caused by fluctuations in normal operating conditions. This mechanism ensures that the threshold always closely follows the current operating environment, achieving adaptive adjustment.

[0025] Step 243: This is a binarization decision process. The anomaly score calculated in step 241 at the current time step is used... The adaptive threshold determined in step 242 at the current time Perform a numerical comparison. The judgment logic is very straightforward: if... If so, it is determined that an abnormal event has occurred at the current moment, and an abnormality flag is set. Set to True. This means that the current prediction error has significantly exceeded the normal fluctuation range that can be tolerated based on historical statistical patterns, and is very likely caused by abnormal events such as short-circuit faults, equipment tripping, or drastic load switching. Conversely, if... If the system is in normal operating condition or only has acceptable noise interference, an anomaly flag will be set. Set to False. Continuing with the example above, the currently calculated anomaly score is 5.8, while the adaptive threshold determined based on the historical window is 4.2. Since 5.8 > 4.2, the system will output... =True.

[0026] Step 244: This is a conditionally triggered operation. In step 243, the system has already output an anomaly flag by comparing the anomaly score with an adaptive threshold. The logic of this step is activated only when the flag is set to True. At this point, the system does not simply record an alarm time point, but needs to acquire complete contextual data so that subsequent modules can analyze the evolution of the anomaly. Specifically, the system maintains a real-time data buffer consistent with the time-series data matrix construction logic described in step 1. This buffer always retains the latest monitoring data stream. Once an anomaly is triggered, the system immediately locks the current time t and backtracks to extract a data segment from time t-T+1 to time t. Here, T is consistent with the time window length set during model training; for example, in the IEEE-118 node system scenario of this embodiment, T is set to 30. The extracted content includes the original values ​​of all four feature dimensions (F=4, i.e., voltage amplitude, voltage phase angle, active power, and reactive power) of all 118 monitoring nodes (N=118) within the past 30 sampling periods. This generates an anomaly evidence segment. Essentially, it's a three-dimensional tensor with dimensions of 118×30×4. To ensure data integrity, this fragment not only contains the data at the instant that caused the anomaly score to exceed the limit (time t), but also fully preserves the evolution trajectory before the anomaly occurred (the previous 29 times). For example, if it's a voltage sag event, The process of voltage gradually or suddenly dropping from its normal amplitude will be fully recorded.

[0027] Step 245: The anomaly score calculated in step 241 This is a scalar value representing the overall degree to which the current state of the entire power system deviates from the normal pattern. However, maintenance personnel need to know which specific node(s) caused this deviation. Therefore, this step uses the Mahalanobis distance calculation formula for inverse decomposition to quantify the contribution of each node. The specific processing procedure is as follows: First, obtain the prediction error vector calculated in step 241. In the IEEE-118 node system, this vector contains 118 × 4 = 472 elements, representing the prediction bias of all features across all nodes. Simultaneously, the inverse of the covariance matrix of the historical error data is obtained. To calculate the node-level contribution, we mainly examine the quadratic form of the prediction error vector inside the square root of the Mahalanobis distance formula. We define the contribution vector. Its calculation is based on the formula term. The diagonal elements or weighted modulo of each component. In a preferred simplified implementation, the comprehensive error contribution of each node i is directly calculated. For the i-th node (i from 1 to 118), it contains 4 feature components. The prediction error of all feature components of this node is calculated after weighting by the covariance matrix. For example, for node 45, the error components of its corresponding voltage, phase angle, and power are extracted, and their contribution to the total anomaly score is calculated by combining the corresponding rows and columns in the covariance matrix. If a short-circuit fault occurs at node 45 in this anomaly, its voltage amplitude will drop sharply, causing a significant deviation between the voltage value predicted by the prediction model (based on normal historical patterns) and the actual observed value. This results in a very large component of the prediction error vector corresponding to node 45. Weighted calculations (considering the correlation between nodes; if fluctuations in node 45 also cause fluctuations in neighboring node 46, the covariance matrix will handle this redundancy, highlighting the main source) will result in a significantly higher calculated contribution from node 45 compared to other normally operating nodes. After calculating the contributions of all 118 nodes, the system sorts these 118 values ​​in descending order. A location cutoff value K is set. This K value is a preset empirical parameter determined based on the total scale of power system monitoring nodes and the average spillover range of typical fault events in the topology network. The aim is to ensure coverage of the main fault source while filtering out secondary affected nodes; for example, the top 5 nodes are selected (K=5). The system selects the top K node IDs and their corresponding contribution values ​​to form preliminary location information. For example, the output might be [(Node_45,0.85),(Node_46,0.10),(Node_12,0.03),...]. This indicates that node 45 is the primary cause of this anomaly, contributing the vast majority of its value, while node 46 may be a neighboring node affected by it.

[0028] In particular, in practical applications of power system anomaly detection, the aforementioned method of generating thresholds based on a single sliding window suffers from significant operational condition blindness. Power system operation modes are complex and variable. For example, the industrial peak load conditions during weekdays differ from the stable off-peak load conditions at night, or the highly volatile conditions during periods of high renewable energy generation. The inherent background noise levels and prediction error distributions of their normal operation data differ significantly. If these error data from different operating conditions are indiscriminately mixed within a single sliding window for statistical processing, it can lead to threshold passivation or oversensitivity: when the window contains a large amount of highly volatile data, the calculated high threshold can cause missed detections of minor faults under stable operating conditions; conversely, if the dominant data in the window is stable operating conditions, an excessively low threshold can trigger numerous false alarms during operating condition transitions or normal fluctuations. Therefore, the implementation of an adaptive threshold generation step based on dynamic weighting of multiple operating conditions aims to establish a nonlinear correlation between prediction error and the macroscopic operating conditions of the power system. By decomposing the calculation of a single threshold into real-time operating condition identification, dedicated benchmark calculation and dynamic weighted refinement that integrates volatility, a dual adaptive judgment boundary that can both perceive macroscopic patterns and adapt to microscopic instantaneous fluctuations is constructed, thereby significantly improving the robustness and accuracy of anomaly detection in complex power grid environments.

[0029] Based on this, in a preferred exemplary operation, step 242, determining an adaptive threshold based on historical error sliding window data, includes: Obtain the external context vector. This step is the perception front end of the entire dynamic mechanism. To enable the algorithm to understand the current macroscopic state of the power grid, a feature vector that comprehensively represents the system's operating environment needs to be constructed. Specifically, the system will collect macroscopic operating indicators in real time, excluding electrical micro-quantities such as voltage and current, including but not limited to the current total system load level, the proportion of new energy (wind and solar) output, the time of day (e.g., whether it is morning or evening peak), the average grid frequency deviation, and the transmission power of key sections. After normalizing these indicators, they are concatenated to form a high-dimensional external context vector. For example, at a certain time t, the constructed It could be a 5-dimensional vector [0.85 (high load), 0.10 (low PV), 0.9 (evening peak), 0.01 (frequency stable), 0.7 (heavy load on cross-section)]. This vector It directly reflects the current physical operating context of the system.

[0030] Real-time power system operating condition identification is performed on the external context vector to obtain the operating condition ID and confidence level. This step aims to utilize a statistical learning model to... The system analyzes the data to determine the most likely operating condition. It predefines k typical operating conditions, which are automatically defined offline based on the statistical distribution patterns of key characteristic indicators such as load level and the proportion of renewable energy output. These conditions are derived through cluster analysis of massive historical operating data (e.g., using the K-Means algorithm). (e.g., k=5, including stable low-load periods, heavy peak loads, high fluctuations in renewable energy output, and post-fault recovery). A Gaussian Mixture Model (GMM) or a similar probabilistic clustering model is trained using historical data. In practice, the current context vector is first calculated. In the k-th predefined working condition The conditional probability density under the given conditions. For example, the data distribution for each working condition follows a mean of... The covariance matrix is Gaussian distribution, using the formula: Calculate The distance or matching degree with each work condition center is calculated. Then, Bayes' theorem is used to calculate the posterior probability to determine the current work condition and its confidence level. in, Represents the external context vector, which contains features characterizing the current macroscopic state of the system; Refers to the k-th predefined power system operating condition; Under given working conditions Under the condition of observing the context vector The probability density; Represents a mean of The covariance matrix is Gaussian distribution; Operating conditions The prior probabilities or mixture weights are determined based on the frequency ratio of each working condition in the historical long-term operation data statistics, or are obtained automatically through the expectation-maximization (EM) algorithm as model parameters when training the Gaussian mixture model (GMM); It represents the confidence level of the current working condition identification result; `K` represents the currently identified operating condition ID; `K` is the predefined total number of operating conditions. The denominator of the formula is a normalized sum of all operating condition possibilities. The system selects the operating condition with the highest probability as the current operating condition ID. For example, it can be identified as a peak heavy load mode; at the same time, the maximum probability value is used as the confidence level of the operating condition for this identification. (Range 0 to 1). If A value close to 1 indicates that the current operating condition is very typical; if A lower value (e.g., 0.4) indicates that the current system may be in a transitional zone between several operating conditions, and the characteristics are not obvious.

[0031] Based on the working condition ID, a working condition-specific benchmark threshold is calculated for each working condition-specific historical error set in the historical error sliding window data to obtain the basic threshold and the global threshold. This step is to establish a hierarchical reference standard. Unlike traditional methods that only maintain a single mixed historical error window, this mechanism already stores historical prediction error data by working condition category during the offline stage, forming K working condition-specific historical error sets. First, based on the operating condition ID identified in the previous step... From the corresponding exclusive set Extract data and calculate the baseline threshold using the percentile method. : , This represents the base threshold calculated for the current operating conditions; It is a set of historical error data belonging to operating condition p; It is used to calculate datasets The A function of percentiles. For example, if the current condition is confirmed to be a peak heavy load, the system only searches for the 99th percentile in the historical error data for that condition, such as a result of 5.0. This value accurately reflects the noise level that the system should have under that specific condition. Simultaneously, to prevent the system from becoming blind to incorrect condition identification or encountering unknown new conditions, a fallback global threshold is calculated. : , This is a global threshold calculated from all historical errors without distinguishing between operating conditions. It is a general threshold calculated using the union of all historical error data, such as a result of 3.5. It represents the average tolerance of the entire system.

[0032] Based on the operating condition confidence level, the basic threshold and the global threshold are refined using a confidence-based threshold weighting method to obtain the adaptive threshold. This step is the core of the entire mechanism's decision-making, transforming the aforementioned static standard into a real-time adaptive boundary through a dynamic weighting formula. First, the recent fluctuation factor, reflecting the immediate instability at the system's microscopic timescale, is calculated. : , It is the sequence of true observations over the most recent w time steps; and and These are functions for calculating the standard deviation and the mean, respectively. This formula calculates the mean of the standard deviations of the actual observed values ​​Y over the most recent w time steps, such as w=10, across each feature dimension. If the system is currently undergoing a normal rapid load ramp-up, It will increase. Finally, the final adaptive threshold is calculated using the following fusion formula. : in, It is the refined final adaptive threshold. It is a volatility factor that reflects the recent micro-level uncertainty of the system; It is the sensitivity adjustment coefficient of the instantaneous fluctuation compensation term; It is a hyperbolic tangent function used to impose nonlinear constraints on the influence of volatility factors. The formula contains two key adjustment terms: a confidence-weighted smoothing term. When the operating condition is very clear ( When the threshold is determined, it is primarily composed of precise, proprietary thresholds. Decision; when in a transitional period with ambiguous operating conditions ( When the threshold is relatively small, it will automatically and smoothly shift towards a more conservative global threshold. This effectively avoids drastic threshold jumps caused by sudden changes in operating conditions. Instantaneous fluctuation compensation term. This is the sensitivity adjustment coefficient (e.g., set to 0.5), which is determined during the offline phase by performing a grid search on a validation set containing various transient disturbances (such as normal switching operations and load switching) to maximize the system's immunity to transient noise while maintaining sensitivity to real faults (i.e., maximizing the F1-score). When a local high-frequency oscillation is detected ( When the threshold is increased, this item will moderately raise the final threshold, giving the system more tolerance and preventing transient fluctuations caused by normal operations (such as switching on / off switches) from being falsely reported as abnormal. For example, in a certain calculation, the base threshold... =5.0, global threshold =3.5, operating condition confidence level =0.8, the volatility factor results in a compensation term of 1.1. Therefore, the final threshold... This value reflects both its relevance to the current peak operating conditions and its dynamic compensation for instantaneous fluctuations.

[0033] Generated based on this preferred embodiment The subsequent steps 243-245, anomaly identification and attribution, have a significant advantage in greatly reducing the false alarm rate caused by operating condition switching or normal transient fluctuations, ensuring that only genuine physical faults will trigger anomaly flags. and subsequent evidence interception, thereby capturing abnormal evidence fragments. With greater purity and representativeness, it provides high-quality input for accurate fault location and knowledge base retrieval, significantly improving the credibility and operational efficiency of the entire prediction system.

[0034] In step 3, anomaly attribution and query intent generation are performed on the abnormal signal fragments and preliminary location information to obtain structured query objects. It is understandable that while the preceding steps can accurately capture numerical anomalies in the data and pinpoint the spatiotemporal coordinates of the anomalies through mathematical models, these outputs are essentially still low-level mathematical signals and discrete device codes. However, the maintenance procedures, historical cases, and contingency plans in the power operation and maintenance knowledge base exist in unstructured natural language text form. There is a significant semantic gap between a voltage amplitude drop of 0.5 pu at the mathematical level and a bus short-circuit fault at the semantic level. If simple keyword matching is performed based solely on numerical alarms or device IDs, the difference in description methods can easily lead to inaccurate search results or omission of key information, failing to effectively activate the value of the operation and maintenance knowledge base. Therefore, this application aims to build a bridge connecting the numerical world and the semantic world by performing anomaly attribution and query intent generation on abnormal signal fragments and preliminary location information. Through a deep learning model, abstract waveform features and location information are translated into structured query objects containing fault phenomenon descriptions, urgency assessments, and core search terms, thereby accurately expressing the current handling needs and providing index instructions with rich semantic information for the subsequent efficient retrieval of highly relevant handling solutions from a massive knowledge base.

[0035] In an exemplary operation, the specific process of step 3 is as follows: First, a deep feature extraction stage is performed. The goal of this stage is to identify physically meaningful morphological features from the original time-series waveform. Although LSTM captures the temporal evolution pattern in step 2, it focuses on calculating the prediction error, while this stage needs to identify the shape of the waveform, such as whether it is an instantaneous spike pulse, a continuous oscillation, or a step drop. These shapes directly correspond to different physical fault types. Therefore, this embodiment uses a pre-trained lightweight convolutional neural network model, with MobileNetV3 as the feature extractor. MobileNetV3 is designed to achieve efficient inference on mobile or edge devices, making it very suitable for power fault scenarios with extremely high response speed requirements. In specific implementation, firstly, based on the preliminary location information... From abnormal evidence fragments The node with the highest contribution is extracted, such as the time-series data subset corresponding to Node_45. This subset is a 30×4 matrix, i.e., 30 time steps and 4 features. To adapt to the input of CNN, it is expanded into a single-channel image form or a sequence-preserving input. The core architecture of MobileNetV3 is based on an inverse residual structure and a linear bottleneck. When processing abnormal waveform data of the input, the data first passes through a 1×1 expanded convolutional layer, which expands the number of low-dimensional input feature channels (e.g., 4 channels) to a high-dimensional space (e.g., 24 channels) so that the model can decouple the nonlinear relationship of features in the high-dimensional space. Subsequently, the data enters a depthwise separable convolutional layer. Unlike standard convolution, depthwise separable convolution performs convolution operation on each input channel separately, which greatly reduces the number of parameters and computation. For example, for the voltage amplitude channel, the convolutional kernel will specifically learn its slope and amplitude; for the frequency channel, the convolutional kernel will learn its periodicity of oscillation. The SE attention mechanism is also embedded in the MobileNetV3 module. The SE module compresses the spatial dimension of the feature map through global average pooling to obtain channel-level global statistics, and then generates weight coefficients for each channel through two fully connected layers. This means the model can automatically learn which features are more important for determining the fault type. For example, in short-circuit faults, a large voltage drop is a key feature, and the SE module automatically assigns higher weights to the voltage channel while suppressing noise interference from the reactive power channel. After stacking multiple layers of inverted residual blocks, the original 30×4 waveform matrix is ​​abstracted into a one-dimensional waveform feature vector. Its dimensions are set to 128 or 256. This vector no longer contains specific time step values, but instead highly condenses the morphological semantics of the fault waveform, such as high-frequency oscillations or deep sags. The weight parameters of this MobileNetV3 model are obtained through supervised training in the offline phase using the IEEE standard power quality disturbance dataset (which includes labels for voltage sags, swells, interruptions, harmonics, etc.).

[0036] The next step is the intent generation stage. This stage aims to generate the aforementioned waveform feature vectors. Compared with preliminary location information The data is fused to generate a semantic representation with retrieval intent. This embodiment uses a lightweight Transformer encoder model, similar to the DistilBERT architecture, as a small model for intent generation. The core of the Transformer architecture lies in its self-attention mechanism, which can capture long-distance dependencies between different elements in the input sequence, making it very suitable for handling multimodal data fusion tasks. The specific processing is as follows: First, the preliminary localization information is embedded. For The device ID, such as Node_45, is used to look up a pre-built device topology embedding table and convert it into a fixed-dimensional location feature vector. This embedding table was generated based on the power grid topology using graph embedding algorithms such as Node2Vec before model training. This not only represents the node ID but also implies the node's structural location within the power grid, such as its location in a key substation or as an end load. Then, the waveform feature vector... With positional feature vector The features are concatenated to form a fused feature vector. .Will The input is fed into a Transformer encoder. The encoder contains multiple stacked layers of self-attention and feedforward neural networks. In the self-attention layers, the input vector is mapped to a query matrix Q, a key matrix K, and a value matrix V. Using the formula... The attention score is calculated. The physical meaning of this process is that the model dynamically adjusts its focus after combining waveform morphology and location information. For example, when the input waveform features show a voltage sag and the location features show a line end, the self-attention mechanism will activate internal neuron patterns associated with line end faults; while if it is also a voltage sag but the location is at the generator outlet, the model will activate patterns associated with generator demagnetization or internal faults. After multiple layers of processing and layer normalization by the Transformer, the model outputs a high-dimensional intent context vector. .

[0037] Finally, the structured output stage is performed. This step involves processing the hidden layer's intent context vector. The mapping is done to specific text descriptions and structured fields to generate the final structured query object. The output layer of the intent generation model contains several parallel fully connected classification heads or generation heads. The first branch is used to generate the phenomenon. This branch will... The model maps to a predefined fault phenomenon category space and outputs the description with the highest probability. For example, based on the voltage drop waveform of Node_45, the model determines and outputs "sudden voltage sag," i.e., a sudden voltage sag. The second branch handles location information. Although the input already contains location information, the output here needs to be converted into standard named entities in a knowledge base. The IDs in the model are mapped to asset names in the knowledge base. For example, Node_45 is transformed into West_Substation_Bus_45, which is bus 45 of the West Substation. Combined with contribution ranking, the model outputs a list-style location description. The third branch assesses the urgency level. This branch is essentially a regression or multi-classification task, outputting High, Medium, or Low based on the severity of the waveform (e.g., voltage drop exceeding 50%) and the importance of the location (e.g., a hub node). For example, if Node_45 is a critical transmission channel node and the voltage drop is severe, the model will output High. The fourth branch generates keywords_generated. This is a sequence generation or multi-label classification task where the model predicts the core words most likely to appear in relevant disposal documents based on context vectors. For example, for the above scenario, the model generates ["voltage dip", "short circuit protection", "check breaker status"], i.e., voltage dip, short circuit protection, and checking breaker status.

[0038] Finally, the outputs of the four branches are assembled into a standard JSON object. For the Node_45 anomaly scenario in the IEEE-118 node system in this embodiment, the generated structured query object is as follows: {"phenomenon":"three-phase voltage sag","location":["Node_45(West_Substation)","Line_45_46"],"urgency": "critical","keywords_generated":["transmission line fault","relay operation","reclosing failure"]}. This JSON object clearly defines what happened (three-phase voltage sag), where it is (Node 45), how urgent it is (emergency), and what keywords are used for the search (transmission line fault, relay operation). This object will be passed as the sole input parameter to the subsequent vector knowledge search module, ensuring that the retrieval process is no longer a blind numerical match, but a precise search based on a deep understanding of the physical semantics of the fault. It is worth noting that the weight parameters in the intention generation model (including the attention weights of the Transformer and the weights of the fully connected layers of each branch) were also determined in the offline stage by constructing a dataset consisting of historical waveform-fault report pairs and using the cross-entropy loss function for end-to-end supervised training.

[0039] In step 4, the structured query object is subjected to vector knowledge search in the power operation and maintenance knowledge base to obtain Top-N relevant document fragments. It is understandable that in the traditional power operation and maintenance system, unstructured expert experience, technical procedures, and massive historical maintenance records often lie dormant in document servers, forming isolated information silos. When an anomaly occurs, although the preceding steps have generated structured query objects containing fault characteristics, if these objects cannot be efficiently converted into accurate retrieval from the knowledge base, operation and maintenance personnel still face the dilemma of having data but no solutions, or are forced to perform inefficient manual browsing of a large number of documents. Single keyword searches often fail to match high-value cases that are semantically related but use different terms, while simple semantic searches may overlook the precise matching of key characters such as specific equipment models. To break down this data and knowledge barrier and achieve an intelligent leap from knowing that a problem has occurred to knowing how to solve it, this application introduces an advanced retrieval mechanism that can balance the breadth of semantic understanding with the accuracy of keyword matching.

[0040] In an exemplary operation, step 4 follows this process: First, query vectorization is performed. The purpose of this step is to transform the structured query object into a vector form that the computer can perform mathematical operations on. First, the contents of the `phenomenon` and `keywords_generated` fields are extracted and concatenated into a natural language query text. For example: three-phase voltage sag transmission line fault relay operation, i.e., three-phase voltage sag, transmission line fault, relay operation. (This refers to...) Two types of vectors are generated in parallel. The first is dense vector generation. A pre-trained sentence vector model is used; in this embodiment, the BGE-large-zh (BAAI GeneralEmbedding) model is selected. This model is based on the BERT architecture and has been fine-tuned using large-scale Chinese corpora and retrieval tasks, enabling it to map variable-length text sequences to a fixed-dimensional semantic space. Model input... After processing by the self-attention mechanism of a multi-layer Transformer encoder, the output is a high-dimensional (e.g., 1024-dimensional) floating-point vector. This vector deeply captures the semantic meaning of the query text. Even if documents in the knowledge base use different terms such as voltage sag or short circuit, as long as the meanings are similar, their distances in the vector space will be very close. The second method is sparse vector generation, which uses the BM25 algorithm. BM25 is a probabilistic retrieval algorithm that considers both the term frequency (TF) of the query term in the document and the inverse document frequency (IDF) across the entire corpus. BM25 is also a bag-of-words model-based retrieval algorithm that ranks a set of documents based on the frequency of the query term appearing in each text segment, regardless of their proximity within the text segments. It is a family of scoring functions with slightly different components and parameters. Given an alert question Q, containing the term... ,… The BM25 score of a text segment D is: in yes The frequency of occurrence in text fragment D It is the length of text segment D. This represents the average length of the set of text segments. b are hyperparameters. IDF It is each word The inverse document frequency. In this formula, It is each word The inverse document frequency is calculated as follows: Where N represents the total number of text fragments in the set. Indicates inclusion The number of documents. Furthermore, to more concisely represent the content of text fragments, a keyword index can be generated for each text fragment D using a large model. After word segmentation, a high-dimensional sparse vector is generated. The non-zero elements correspond to the weights of the query terms. This vector is ideal for capturing precise matches of proper nouns such as relays and circuit breakers.

[0041] Next, a hybrid search is performed. The search target is a pre-built power operation and maintenance knowledge base. This knowledge base is built offline and aggregates the power grid company's technical standards, maintenance SOPs (Standard Operating Procedures), historical fault handling reports, and expert experience database. During the construction phase, these unstructured documents were segmented into short document fragments, and corresponding dense vector indexes and sparse inverted indexes were generated using the BGE-large-zh model and BM25 algorithm, respectively. These were stored in a vector database that supports hybrid search, such as a hybrid search engine that combines the efficient vector indexing capabilities of FAISS with the inverted indexing capabilities of Elasticsearch.

[0042] During retrieval, the query vector and Simultaneously, the data is sent to the search engine. The engine performs two search actions in parallel: calculating using FAISS. Recall the most semantically relevant candidate set by using the cosine similarity or inner product of the document vectors in the library. Simultaneously, utilize Elasticsearch based on Perform an inverted index search to retrieve the candidate set with the highest keyword matching degree. The first K results from each of these two sets (e.g., K=50) are taken and merged to remove duplicates, forming a preliminary candidate document set.

[0043] Then, score fusion and rearrangement are performed. For each document fragment in the initial candidate set... Calculate the dense vector similarity score for each. correlation score with sparse vectors Among them, dense vector similarity score The calculation uses cosine similarity, that is, by calculating the query vector. With document vectors Dividing the dot product by the product of the magnitudes of the two vectors quantifies the cosine of the angle between them in the semantic space; the closer the value is to 1, the more semantically similar they are. Meanwhile, the sparse vector relevance score... The calculation is based on the core formula of the BM25 algorithm, which accumulates the weight of each term in the query text within the document. Specifically, it considers the inverse document frequency (IDF) and the term frequency (TF) of the term within the document, and introduces a document length normalization factor to eliminate bias from long documents. A higher score indicates a higher degree of keyword matching. To prevent the numerical range of one score class from dominating the ranking, the two sets of scores are first normalized to a minimum. Then, a weighted fusion formula is used to calculate the mixed score: In this formula, This is a weighting factor between 0 and 1, determined through experiments on a validation set containing labeled query-document pairs. The weighting factor value is adjusted to optimize the evaluation metrics of the search results (such as NDCG or Recall), balancing the importance of semantic matching and keyword matching. In this embodiment, considering that power fault handling requires both understanding the macroscopic fault phenomenon (semantics) and accurately corresponding to specific equipment types (keywords), after validation set optimization, the following setting is used: =0.6. This means the system slightly emphasizes semantic understanding, but still reserves 40% weight for exact matching. For example, a document about an emergency plan for a substation transmission line fault has a high semantic match with the query and scores highly; while an operation manual containing keywords related to relay actions scores highly in sparsity. By using a mixed score calculation, documents that both match the fault semantics and contain key equipment information can be filtered out. Perform a preliminary sorting of the documents from highest to lowest, and retain the first M results, such as M=20.

[0044] Finally, a confidence-based re-ranking process is performed. The initial ranking only considered the relevance of the text content, without taking into account the authority and applicability of the documents themselves. Therefore, document confidence is introduced. A second ranking process is performed. Confidence scores are obtained based on metadata from the knowledge base. Base weights are pre-assigned to documents from different sources: Standard Operating Procedures (SOPs) and technical specifications are considered high-authority documents, with a base weight of 1.0; verified historical success cases are considered medium-authority, with a base weight of 0.8; and unverified forum posts or drafts are assigned a base weight of 0.5. Furthermore, for historical cases, the weight is dynamically adjusted based on their success rate. In the specific calculation, the final score... For example, a post from a technical forum might have a high mixed score (the content is a very good match), but its final score will be discounted because the source confidence level is only 0.5; while a document from a general power grid regulation, even with a slightly lower mixed score, might have a higher final ranking because of its 1.0 confidence level. This mechanism ensures that the solutions recommended to operations and maintenance personnel are reliable and compliant in the first place.

[0045] After confidence level rearrangement, the top N document segments with the highest final scores are selected (Top-N, e.g., N=3). In this example, the final Top-3 recalled documents are: 1. Document A, source: SOP: "XXX", detailing the fault inspection, isolation, and repair steps. 2. Document B, source: Historical Cases: "XXX", recording the actual handling process and successful experience under similar waveform characteristics. 3. Document C, source: Equipment Manual: "XXX", explaining the principle of relay operation mentioned in the keywords.

[0046] In step 5, a recommended handling plan is generated based on the Top-N relevant document fragments and structured query objects. That is, in the preceding processing flow, the process from collecting raw data to mathematically identifying anomaly features has been completed, and further, cross-modal retrieval technology has been used to recall several fragmented relevant documents from a massive operation and maintenance knowledge base. However, these retrieved Top-N document fragments (such as technical specifications, historical cases, and equipment manuals) exist in unstructured natural language, and the content is scattered, lengthy, and even contains redundant information or information that needs to be tailored to specific operating conditions. In the high-voltage environment of an emergency power system failure, dispatchers or operation and maintenance personnel often face enormous psychological pressure, making it difficult to quickly read and synthesize multiple documents in a short period of time to extract precise handling steps for the current specific fault point (such as a voltage dip at a specific node). Directly presenting the search results to the user solves the problem of having verifiable information, but fails to solve the last-mile problem of how to implement the decision. Therefore, this application ultimately aims to generate a recommended handling scheme based on Top-N related document fragments and structured query objects. This scheme aims to introduce the generative reasoning and logical synthesis capabilities of large language models, deeply integrate and reorganize discrete knowledge fragments with the current abnormal situation, thereby significantly reducing the risk of human decision-making errors and greatly improving the response speed and accuracy of fault handling.

[0047] Figure 4 This is a flowchart of step 5 in the deep learning-based power system data anomaly prediction method according to an embodiment of this application. In one exemplary operation, such as Figure 4 As shown, step 5, based on Top-N related document fragments and structured query objects, generates recommended treatment plans, including: step 51, constructing treatment plan generation prompts based on Top-N related document fragments and structured query objects; step 52, inputting the treatment plan generation prompts into a large language model to obtain a draft treatment plan; step 53, optimizing and structuring the draft treatment plan to obtain a recommended treatment plan.

[0048] In the above exemplary operation, the specific process of step 5 is as follows: First, implement step 51. This step is a key preparatory stage for realizing Large Language Model (LLM) contextual learning. The construction process is not a simple string concatenation, but requires filling a carefully designed Prompt template, which consists of five parts: role definition, task instructions, context input, knowledge reference, and output constraints. In specific implementation, firstly, the structured query object is parsed to extract key field values. Taking the anomaly occurring at Node_45 of the IEEE-118 node system as an example, the extracted phenomenon is a three-phase voltage sag, the location is the No. 45 bus (Node_45) of the West Substation and its associated lines, and the urgency is critical. At the same time, the content of the Top-N document fragments is read. This information is dynamically filled into the preset prompt word template. The final Prompt string constructed is as follows (for logical illustration only): [Role Setting] You must play the role of a power system dispatch and control expert with 20 years of experience, possessing extremely high safety awareness and professional judgment. [Current Scenario] The system detected a three-phase voltage dip anomaly on busbar 45 (Node_45) of the West Substation, and the system has determined the urgency level to be critical. [Reference Knowledge] Please strictly adhere to the following document snippets for decision-making; do not fabricate facts: Snippet 1: ... (Text content of Document A, such as prioritizing the isolation of the fault point after confirming the fault type)... Snippet 2: ... (Text content of Document B, such as historically, faults at Node_45 are often caused by lightning strikes, requiring inspection of surge arresters)... Snippet 3: ... (Text content of Document C)... [Task Requirements] Based on the above information, generate a fault handling plan for this node. The plan must include: 1. Fault analysis; 2. Detailed operating steps (accurate to the equipment name); 3. Risk warnings. [Output Format] Please output in Markdown format, with clear steps and rigorous logic.

[0049] Next, step 52 is implemented. This step is the core of logical reasoning using deep neural networks. The large language model used is a decoder model based on the Transformer architecture, with a parameter scale between 7 billion (7B) and 70 billion (70B), and has been fine-tuned according to instructions from the power industry. The specific architecture of this model consists of dozens of stacked Transformer decoder blocks. Each layer contains two main sub-layers: a multi-head self-attention mechanism and a feedforward neural network, and the layers are coupled through residual connections and layer normalization. In the model, the weight matrices, such as the query matrix, key matrix, value matrix, and the weights and biases of the feedforward layers, were determined during the offline training phase through pre-training on a general corpus of trillions of words and supervised fine-tuning (SFT) on a specialized dataset containing millions of power industry texts, such as power grid regulations and emergency response plans. This fine-tuning enables the model to understand the precise meaning of technical terms such as bus, reclosing, and load shedding, as well as the physical logic behind them. In the processing, the Prompt string constructed in step 51 is first segmented into a token sequence by a token segmenter and mapped to dense vector embeddings. These vectors then enter the model for layer-by-layer feature extraction and transformation. The self-attention mechanism dynamically calculates attention weights based on the correlation between words in the input sequence, such as the strong correlation between voltage sags and short circuits, capturing long-distance contextual dependencies. Finally, the model output layer calculates the probability distribution of the next token on the vocabulary. In this embodiment, to ensure the stability and rigor of the handling plan, the sampling temperature parameter needs to be set to a low value during the inference stage, such as 0.1 or 0.2. Lower temperatures make the probability distribution sharper, prompting the model to tend to select the words with the highest probabilities, thereby suppressing randomness and creativity, and preventing the model from generating illusions or fabricating non-existent operational steps. The model generates tokens one by one through autoregression until it encounters an end marker, ultimately combining them into a complete text, i.e., a draft of the handling plan. For example, the draft generated by the model might contain the following: Based on the monitored three-phase voltage sag on busbar 45 of the West Substation, combined with documents A and B, it is determined that there may be a line short circuit fault. The following actions are recommended: 1. Immediately check the protection action signal of line 45 in the West Substation; 2. If a permanent fault is confirmed, disconnect circuit breaker 451; 3. Notify the inspection team to check the surge arresters on the towers of line 45... While this draft is logically coherent, it is still unstructured natural language text, and the equipment numbers mentioned, such as circuit breaker 451, are generated based on probability in the model and require further verification.

[0050] Finally, step 53 is implemented. This step acts as a firewall and shaper to ensure the safe and usable nature of AI-generated content. Since large language models are essentially probabilistic prediction models, they cannot guarantee 100% authenticity of the generated content. Therefore, a post-processing mechanism based on rules and knowledge graphs must be introduced. First, structured parsing is performed. The system uses regular expressions or lightweight text extraction algorithms to break down the draft text output from step 52 according to predefined fields. Content suggesting the following operations is extracted as an operation step list; "Judging that it may be..." is extracted as fault analysis; and content related to safety is extracted as risk warnings. Next, critical factual verification is performed. This is the bottom line for ensuring the safe operation of the power system. The system extracts all key entities appearing in the draft, especially equipment names and numbers, such as busbar 45 and circuit breaker 451. Then, it is compared and verified using the topology diagram or CIM model database built in steps 1 and 2. Query: Does a circuit breaker with ID '451' exist in the CIM model of the West Substation? Is this circuit breaker connected to busbar 45? If the verification passes, the step is retained; if the verification fails, for example, if the model incorrectly generates circuit breaker number 459 when the station does not actually have this number, it is corrected to the closest correct number, such as circuit breaker number 452, using a fuzzy matching algorithm, or a label is directly added next to the step stating "[Warning: Equipment number needs manual verification]", and the overall confidence of the solution is reduced. In addition, source tracing is performed. Each generated key step is back-matched with Top-N document fragments. For example, if the solution suggests checking the surge arrester, it will detect that the suggestion originates from document B, and a hyperlink or reference mark (Reference: Document B - Lightning Trip Handling Report) will be added after the step. This allows maintenance personnel to click and view the original basis at any time, increasing the interpretability of the solution. Finally, the optimized and verified information is assembled into a standardized recommended handling solution object. For the above scenario, the final recommended handling solution may be as follows: Title: Suggestions for Handling Voltage Sag on Busbar 45 of West Substation; Fault Analysis: A three-phase voltage sag of 0.6 pu was detected. Based on historical data, it is suspected that a lightning strike or short circuit fault occurred on transmission line 45. Operation Steps: 1. Check Signals: Retrieve the SCADA screen of West Substation to confirm whether the distance protection and zero-sequence protection of line 45 have been activated. (Confidence: High, equipment has been verified to exist). 2. Isolate Fault: If reclosing fails, confirm that circuit breakers 451 and 452 are in the open position to isolate the faulty line. (Reference: SOP Document A). 3. Equipment Inspection: Focus on checking the status of surge arresters and insulators in the section of towers #15-#20 of line 45. (Reference: Historical Case Document B) Risk Warning: Cutting off the line may cause the voltage of downstream Node_50 to be low. It is recommended to adjust the reactive power compensation device in advance.Finally, the originally vague language model output was transformed into precise, reliable, and evidence-based engineering-level handling instructions, realizing the transformation from data anomaly prediction to decision support execution.

[0051] In summary, the deep learning-based power system data anomaly prediction method based on the embodiments of this application is elucidated. Addressing the problem in existing power system anomaly prediction technologies where numerical monitoring and operation and maintenance knowledge are disconnected, preventing anomaly alarms from being directly translated into effective handling decisions, this scheme first utilizes graph convolutional networks and LSTM to deeply mine the spatiotemporal features of power system time-series data and topology, achieving high-precision anomaly detection and location. Upon anomaly detection, an anomaly attribution mechanism is introduced, transforming mathematically-level anomaly signal features (such as anomaly fragments and location information) into semantically-level structured query objects. Subsequently, vector retrieval technology breaks down the barriers between numerical data and unstructured operation and maintenance knowledge bases, accurately recalling relevant maintenance procedures and historical cases. Finally, combining the generation capabilities of large language models, executable recommended handling solutions are automatically generated based on the recalled knowledge, thus constructing an intelligent closed loop from anomaly perception and knowledge matching to decision support, significantly improving the accuracy and efficiency of power system fault response.

Claims

1. A deep learning-based method for predicting power system data anomalies, characterized in that, include: Obtain the time-series data matrix and topology diagram; Spatiotemporal feature extraction and preliminary anomaly detection are performed on the time-series data matrix and topology map to obtain anomaly markers, anomaly signal fragments, and preliminary location information; Anomaly attribution and query intent generation are performed on abnormal signal fragments and preliminary location information to obtain structured query objects; The structured query object is used to perform vector knowledge search in the power operation and maintenance knowledge base to obtain Top-N related document fragments; Based on Top-N related document fragments and structured query objects, a recommended treatment plan is generated.

2. The deep learning-based power system data anomaly prediction method according to claim 1, characterized in that, Spatiotemporal feature extraction and preliminary anomaly detection are performed on the time-series data matrix and topology map to obtain anomaly markers, anomaly signal fragments, and preliminary location information, including: Multi-source data fusion and standardization preprocessing are performed on the time-series data matrix and topology graph to obtain a standardized data matrix and adjacency matrix; Spatial feature sequences are obtained by performing graph convolution-based spatial feature extraction on the standardized data matrix and adjacency matrix; The spatial feature sequence is subjected to LSTM-based temporal pattern evolution learning to obtain the state prediction value at the next time step; Anomaly detection and location are performed based on the predicted state value and the actual observation value at the next time step to obtain anomaly markers, anomaly signal segments, and preliminary location information.

3. The deep learning-based power system data anomaly prediction method according to claim 2, characterized in that, Anomaly detection and localization are performed based on the predicted state value and the actual observation value at the next time step to obtain anomaly markers, anomaly signal segments, and preliminary localization information, including: Calculate the anomaly score between the predicted state value at the next time step and the actual observed state value at the next time step; Determine an adaptive threshold based on historical error sliding window data; The anomaly flag is generated based on a comparison between the anomaly score and an adaptive threshold.

4. The deep learning-based power system data anomaly prediction method according to claim 3, characterized in that, Calculate the anomaly score between the predicted state value at the next time step and the actual observed state value at the next time step, including: Calculate the prediction error vector between the predicted state value at the next time step and the actual observed state value at the next time step; Based on the prediction error vector, the anomaly score is determined using the following formula: in, For the prediction error vector, This is the mean vector of the historical error vector. The covariance matrix of the historical error data. These are abnormal scores.

5. The deep learning-based power system data anomaly prediction method according to claim 3, characterized in that, Based on historical error sliding window data, an adaptive threshold is determined, including: Obtain the external context vector; Real-time power system operating condition identification is performed on external context vectors to obtain operating condition ID and confidence level; Based on the working condition ID, the working condition-specific benchmark threshold is calculated for the set of historical errors for each working condition in the historical error sliding window data to obtain the basic threshold and the global threshold. Based on the operating condition confidence level, the basic threshold and the global threshold are subjected to confidence-based threshold weighting and refinement to obtain the adaptive threshold.

6. The deep learning-based power system data anomaly prediction method according to claim 3, characterized in that, Anomaly detection and localization are performed based on the predicted state value and the actual observation value at the next time step to obtain anomaly markers, anomaly signal segments, and preliminary localization information. This also includes: In response to the anomaly flag being true, extract the raw data from the T time steps preceding the time when the anomaly was triggered as an anomaly evidence fragment; The contribution of each monitoring node in the prediction error vector to the anomaly score is calculated, and the preliminary location information is determined based on the ranking of the contributions.

7. The deep learning-based power system data anomaly prediction method according to claim 1, characterized in that, Based on Top-N relevant document fragments and structured query objects, a recommended treatment plan is generated, including: Based on Top-N related document fragments and structured query objects, a treatment plan is constructed and prompt words are generated; The prompt words for the treatment plan are generated and input into a large language model to obtain a draft of the treatment plan. The draft disposal plan was optimized and structured to obtain the recommended disposal plan.

Images