Energy storage abnormity early warning and risk grading system based on large language model

Abstract

The invention relates to the technical field of energy storage system abnormity early warning and risk grading, in particular to an energy storage abnormity early warning and risk grading system based on a large language model, which captures an abnormity early warning signal in real time through SCADA-> Kafka flow, extracts a data window, obtains a feature vector through feature quantification, inputs a GBDT model to obtain a risk score in combination with a Sigmoid function, and performs early warning and risk grading according to the risk score. According to the energy storage abnormity early warning and risk grading system based on the large language model, in 60-day operation of 15 stations, the grading accuracy rate is 93.4%, the three-level false alarm rate is 2.7%, the three-level risk is divided according to a threshold value and a hysteresis threshold value, hierarchical interpretation of technicians, operation and maintenance managers and clients is generated based on LLM, operation steps are retrieved and output through SOP, the threshold value and the model are collected, fed back and updated, and the energy storage abnormity early warning and risk grading system based on the large language model has the advantages that the grading accuracy rate is 93.4%, and the three-level false alarm rate is 2.7%. The technical staff score is 4.8 / 5, the customer satisfaction degree is 4.7 / 5, the average end-to-end time delay is 1.1 s, the risk quantification accuracy and the communication efficiency are improved, and stable operation of the energy storage system is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of energy storage system anomaly early warning and risk classification technology, specifically an energy storage anomaly early warning and risk classification system based on a large language model. Background Technology

[0002] Energy storage site BMS / EMS generates a large number of alarms every second, including voltage imbalance, temperature over-limit, PCS sync failure, etc. Large Language Model (LLM) can generate explanations according to the language style of different audiences. If LLM is combined with risk quantification model, an automatic link of "alarm → risk classification → role explanation" can be built, which provides a technical foundation for online monitoring and anomaly early warning of energy storage system, and helps to achieve more efficient handling and management of energy storage system anomalies.

[0003] Current platforms for energy storage site alarms can only display alarm codes and cannot provide "executable and understandable" layered text interpretations for different roles (such as technicians, operation and maintenance managers, and customers). This situation makes it easy for relevant personnel to misjudge alarm information, resulting in delays in abnormal handling. It is difficult to meet the actual needs of efficient and accurate handling of online monitoring and anomaly early warning of energy storage systems, which is not conducive to ensuring the stable operation of energy storage systems. Therefore, in view of the above situation, there is an urgent need to develop an energy storage anomaly early warning and risk classification system based on a large language model to overcome the shortcomings in current practical applications. Summary of the Invention

[0004] The purpose of this invention is to provide an energy storage anomaly early warning and risk classification system based on a large language model, so as to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A system for early warning and risk classification of energy storage anomalies based on a large language model includes:

[0007] The early warning capture module is used to capture abnormal early warning signals of energy storage sites in real time and extract raw data windows from the abnormal early warning signals;

[0008] The feature quantization module is used to preprocess the original data window and generate a structured feature vector based on the operating mechanism of the energy storage system.

[0009] The risk scoring module is used to input the feature vector into a preset risk assessment model and calculate the risk score.

[0010] The risk classification mapping module is used to map the risk score to the corresponding risk level based on a preset risk classification rule;

[0011] The LLM multi-role explanation module is used to generate differentiated anomaly explanation texts for different roles based on a large language model and combined with the SOP or knowledge base of the energy storage system.

[0012] The action suggestion generation module is used to output structured abnormal handling operation steps based on the abnormal warning signal, risk level and feature vector;

[0013] The push and closed-loop module is used to push the risk level, anomaly explanation text and anomaly handling operation steps to the corresponding roles, and collect user feedback to update the risk classification rules and risk assessment model.

[0014] As a further aspect of the present invention: the early warning capture module captures abnormal early warning signals generated by the BMS / EMS of the energy storage site through the collaboration of the SCADA system and the Kafka stream, partitions the topics of the Kafka stream according to the site × device type dimension, and encapsulates the abnormal early warning signals using a preset binary serialization format;

[0015] The encapsulated anomaly warning signal includes a site identifier, device identifier, data timestamp, data sampling window, data verification information, and clock synchronization tag.

[0016] As a further aspect of the present invention: the preprocessing of the feature quantization module includes data cleaning, data alignment, and data normalization;

[0017] The structured feature vector contains multi-dimensional features, which are selected from at least three of the following: statistical features, trend features, event count features, spectral features, and log alarm features.

[0018] The feature quantization module also introduces prior confidence weights to weight each feature in the feature vector. The prior confidence weights are determined based on the mutual information between the feature and the risk outcome, the correlation between the feature and the SOP item, and the physical rationality of the feature.

[0019] As a further aspect of the present invention: the risk scoring module adopts Gradient Boosting Tree (GBDT) as the risk assessment model. The GBDT model adopts an additive structure and is optimized by a log loss function with sample weights to handle the class imbalance problem.

[0020] The risk scoring module also maps the output of the GBDT model to a risk score in the [0,1] interval using the Sigmoid function, and performs calibration processing on the risk score. The calibration processing is selected from equivalent calibration or Platt calibration.

[0021] As a further aspect of the present invention: the risk classification rules of the classification mapping module include at least two risk classification thresholds, and the risk level is determined by comparing the risk score with the classification thresholds;

[0022] The hierarchical mapping module also introduces a hysteresis threshold, which is determined based on the noise standard deviation of the risk score and the allowable risk level switching frequency, in order to suppress frequent risk level switching caused by small fluctuations in the risk score.

[0023] As a further aspect of the present invention: the LLM multi-role explanation module adopts a lightweight deployment of an instruction-based large language model, obtains evidence sets from SOPs or knowledge bases through retrieval augmented generation (RAG) technology, and generates explanation text based on preset role style vectors;

[0024] The character style vector includes at least three of the following: terminology density, conciseness, emotional temperature, directivity, and numerical density.

[0025] The LLM multi-role interpretation module also sets up factual consistency, style consistency, and action consistency guardrails to ensure that the interpretation text is based on the evidence set, conforms to the target role's style, and that the operation steps can be traced back to a specific version of the SOP.

[0026] As a further aspect of the present invention: the action suggestion generation module constructs a search query statement based on the alarm code, risk level and feature vector, and performs retrieval and rearrangement in the SOP graph database, wherein the rearrangement is based on the degree of correlation with the alarm code, risk level and feature vector as the priority basis;

[0027] The structured exception handling steps include operation sequence number, action content, and operation identifier and version information associated with the SOP.

[0028] As a further aspect of the present invention: the push and closed-loop module pushes through at least two channels among WebSocket, RESTAPI and SMS, and each push channel is configured with an authentication mechanism and a traffic control strategy;

[0029] The user feedback includes evaluation information on risk level, explanatory text, and operation steps. The push and closed-loop module adjusts the risk classification threshold and the parameters of the risk assessment model based on the user feedback.

[0030] As a further aspect of the present invention, it also includes a deployment adaptation module, which configures the number of edge gateways, the number of brokers in the Kafka cluster, the time-series database type, and the data storage strategy according to the scale of the energy storage site.

[0031] The data storage strategy includes data retention duration and hot / cold tiered storage configuration. The hot / cold tiered storage configuration stores high-frequency real-time data in a time-series database and archived data in object storage.

[0032] Compared with the prior art, the beneficial effects of the present invention are:

[0033] 1. The method and examples were combined to clearly demonstrate the feasibility of the entire process from data capture to closed-loop feedback. During 60 days of operation at 15 sites, a total of 420 alarms were processed, which fully verified the actual operability of the system.

[0034] 2. The combination of multidimensional features and probability grading improves the accuracy and interpretability of risk quantification. The results show that the grading accuracy reaches 93.4%, which is 12.2 percentage points higher than the threshold-only method. The false alarm rate of the third level is 2.7%, which is significantly better than the traditional 6.5%, effectively improving the reliability of risk judgment.

[0035] 3. LLM multi-role explanation enhances communication effectiveness, covering three audiences: technical, management, and customer. It can generate differentiated explanatory texts that meet the needs of different roles. The average operability score for technicians reached 4.8 / 5, and the customer satisfaction score reached 4.7 / 5, which improved the efficiency of different roles in understanding and processing alarm information.

[0036] 4. SOP retrieval ensures that explanation and action are linked to form a closed loop. The system can construct queries based on (Code, L, f), perform mixed retrieval and rearrangement in the SOP diagram database, and output structured operation steps, ensuring the standardization and executability of the handling suggestions.

[0037] 5. Feedback learning ensures the long-term adaptability and dynamic optimization capability of the system. The system can collect user feedback r∈[−1,1] and update the threshold and model based on the feedback. At the same time, the average end-to-end latency is 1.1s, which meets the real-time requirements. It can continuously adapt to the operation needs of the energy storage system and respond efficiently to abnormal warnings. Attached Figure Description

[0038] Figure 1 This is a system architecture diagram of an energy storage anomaly early warning and risk classification system based on a large language model in an embodiment of the present invention. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

[0041] Please see Figure 1 This invention provides an energy storage anomaly early warning and risk classification system based on large language model (LLM). Combining online monitoring of energy storage systems, anomaly early warning presentation, and large language model (LLM) technology, it achieves end-to-end processing from anomaly signal capture to closed-loop optimization through multi-module collaboration. Specifically, it includes the following:

[0042] I. Early Warning Capture Layer: Real-time acquisition of abnormal early warning signals and raw data;

[0043] The system captures abnormal early warning signals generated by the BMS / EMS of the energy storage site in real time through SCADA→Kafka stream. It sets topics using hierarchical naming rules (format stg.{env}.{site}.{bus}, where env∈{dev,test,prod}, site is the site code such as CN-NT-ESS001, and bus is the bus type such as telemetry, event, log). It divides the system into partitions according to the dimension of "site × device type" and uses {site}:{device_id} as the write key to ensure the timing consistency of the same device.

[0044] The outer layer of the message uses Protobuf (or Avro) binary serialization, with optional gzip / zstd compression, and is encapsulated into a TelemetryBatch structure containing site_id, device_id, device_type, t0_unix_ms, span_ms, samples, tags, schema_ver, and sig (HMAC-SHA256 checksum). The edge gateway synchronizes time via NTP / PTP, sets the quality bit and appends a clock offset tag when |Δt|>100ms, and enables acks=all and idempotent producers to ensure transmission reliability.

[0045] Simultaneously, structured fields (Code, ...) are extracted from the captured signal. ),in The system uses a 30-second raw data window; for example, at t=12:05:30, if the energy storage site generates alarm code 0x57E2, the system extracts the voltage, current, and temperature curves from the most recent 30 seconds as... .

[0046] It enables real-time and reliable capture of abnormal early warning signals and extraction of raw data windows. Through standardized topic partitioning, message encapsulation and security verification, it avoids data loss or tampering, providing complete and accurate basic data for subsequent feature quantification. At the same time, it is adaptable to different environments (development, testing, production) and equipment types, improving the versatility and stability of signal capture.

[0047] II. Feature Quantization Layer: Transforms raw data into structured feature vectors;

[0048] For the original data window After cleaning, alignment, and normalization, a multi-dimensional feature vector is designed based on the operating mechanism of the energy storage system. The features include statistics (statistics such as mean, standard deviation, extreme values, etc.). ), trend (linear slope, AR(1) coefficient, EWMA increment), event count (number of points exceeding threshold, duration of exceeding limit, number of peaks), spectrum (spec: FFT bandwidth energy, main frequency, harmonic energy ratio), log / alarm (log: number of times a specific alarm code's nearest neighbor appears, time arrival characteristics);

[0049] Combining mechanism and procedure to define prior credibility :

[0050]

[0051] Where MI stands for mutual information, Rel for correlation with standard operating procedure (SOP) items, and Phys for physical plausibility score; features are scaled before training. ( Injecting domain priors, the system then trains the data and uses gain and SHAP values ​​to determine the importance of data-driven features. , and make priors Post-hoc consistency checks are performed; if significant conflicts are found, the process proceeds to feature auditing.

[0052] Feature calculation is performed according to the formula:

[0053] (τ∈ );

[0054] For example, in the alarm code 0x57E2... In the middle, the calculation yields:

[0055] ΔV=0.22V, ΔT=78℃−60℃=18℃, =180A.

[0056] By designing multi-dimensional features to cover key characteristics of anomalies in energy storage systems, and through cleaning, normalization, and standardized formula calculations, unstructured raw data is transformed into structured feature vectors that can be directly used for risk analysis. This eliminates data noise interference, ensures the effectiveness and standardization of features, and provides accurate input for subsequent risk quantification.

[0057] III. Risk Scorer: Based on the GBDT model, risk quantification and scoring are achieved;

[0058] The feature vector f is input into the Gradient Boosting Tree (GBDT) model, which employs an additive structure:

[0059]

[0060] For regression trees with a maximum depth ≤ d, For the learning rate, use log loss with sample weights:

[0061]

[0062] No. Minimize the forward stepwise method of the wheel Using negative gradient residuals to grow Leaf values ​​are determined using a one-dimensional linear search within the leaf. ;

[0063] To handle class imbalance, we define:

[0064]

[0065] Let N be the total number of samples. / Number of positive / negative class samples;

[0066] Simultaneously, constraints are imposed on features with clear monotonic mechanisms: for features such as temperature rise rate and ΔV imbalance, monotonic constraints are applied during tree splitting (ensuring that the risk probability p(x) does not decrease with the value of this type of feature); the model output needs to be calibrated, with one of two calibration methods to choose from:

[0067] 1. IsoCal equivalent calibration (binning by risk score, correcting the score for each bin using the actual tag frequency);

[0068] 2. Platt calibration (fitting parameters a and b using logistic regression and mapping the model output to the calibrated score). a and b are determined by fitting the cross-validation set.

[0069] The training data comes from a fixed-length sliding time window of SCADA / EMS / BMS streams. For each original alarm / heartbeat timeline, it is sliced ​​with a window length W and a step size S and aggregated with the logs to obtain samples.

[0070]

[0071] in, For the number of stations, For the number of days, To estimate the retention ratio after quality control, as follows: =20、 =90, S=30s, When = 0.6, N ≈ 3.1 × 10 8 The tag y comes from expert review results or post-hoc event silver label.

[0072] During the training and validation phases, cross-site grouped cross-validation (Group K-Fold by site) is employed to avoid data leakage. The learning rate ν, number of trees M, maximum depth d, and subsampling rate r are determined through grid search or Bayesian optimization. sub The optimal value is determined by the model evaluation, which uses AUC, F1 score, and graded accuracy as the main indicators, and cost-sensitive indicators weighted by alarm consequences (such as giving higher weight to missed high-risk events than to false low-risk events) as secondary optimization objectives.

[0073] Model output Then, through the Sigmoid function:

[0074]

[0075] Obtain a risk score; for example, model prediction. When =1.35, then:

[0076] .

[0077] By utilizing the additive structure and class imbalance handling of the GBDT model, the model's ability to fit the risks of energy storage systems is improved. Combined with large-scale labeled training data, the model's generalization ability is ensured. The model output is then mapped to a risk score in the [0,1] interval using the Sigmoid function, achieving accurate risk quantification and providing a scientific and comparable numerical basis for risk classification. This method improves the accuracy of risk assessment compared to traditional threshold methods.

[0078] IV. Graded Mapper: Risk classification based on threshold and hysteresis mechanism;

[0079] Set risk classification thresholds Define risk level L:

[0080]

[0081] When ρ > 0.8, L = 3 (high risk); when 0.5 < ρ ≤ 0.8, L = 2 (medium risk); when ρ ≤ 0.5, L = 1 (low risk). To suppress rating fluctuations caused by scoring noise, a hysteresis threshold is introduced. )=(0.82,0.78), center threshold Through cost-sensitive optimization:

[0082]

[0083] Sure, This indicates the cost of underreporting. Indicates the cost of false alarms;

[0084] Considering the standard deviation of scoring noise And the allowed number of erroneous handovers per unit time Define the maximum out-of-bounds probability:

[0085] ;

[0086] in, Sampling frequency, This is the correlation correction coefficient. Then the hysteresis bandwidth... It should meet the following requirements:

[0087]

[0088] in, It is the inverse function of the standard normal distribution.

[0089] Based on this, the hysteresis threshold pair is obtained:

[0090]

[0091] For example, when ρ = 0.794, since 0.5 < ρ ≤ 0.8 and does not exceed [the threshold value], [the condition is met]. =0.82, L=2 (medium risk), avoid jitter as high risk.

[0092] By setting reasonable risk thresholds, a clear division of risk levels can be achieved. Combined with a hysteresis mechanism, frequent level switching caused by minor fluctuations in scores can be effectively suppressed, reducing misclassification. At the same time, the center threshold is determined based on cost-sensitive optimization to balance the costs of underreporting and false reporting, thereby improving the stability and practicality of risk classification and providing a clear basis for subsequent differentiated interpretation and handling.

[0093] V. LLM Multi-role Interpreter: Generates differentiated hierarchical interpreted text;

[0094] It adopts a lightweight deployment of 7B to 13B level instruction model (Instruction), reduces memory usage through 4-bit / NF4 quantization, performs domain instruction fine-tuning through LoRA / QLoRA, and generates explanations by combining RAG retrieval SOP / knowledge base;

[0095] First, construct a retrieval query based on code / symptom to obtain the evidence set. The prompts cite each item by number. The answer must include citation tags to support auditing. The output is validated using JSON Schema; failure to validate triggers a self-correcting loop.

[0096]

[0097] Simultaneously, a triple safety and consistency guardrail is installed:

[0098] 1. Factual consistency: Only evidence sets are allowed to be cited. If the evidence is insufficient, the uncertain_points field should be output in the JSON to list the missing information.

[0099] 2. Style Consistency: After generation, the actual style vector s is evaluated using a style discriminator. If... The preset threshold ε (ε ranges from 0.1 to 0.2, and can be adjusted according to the role's requirements) is... For the target style vector, (For style discriminator evaluation), the sampling temperature is reduced (T=0.2~0.4) and the sentence length / term upper limit is tightened before regenerating;

[0100] 3. Action Consistency: The operation steps in the steps field are all selected from the SOP standard operation library. When outputting, the operation ID (such as ACT-001) and SOP version number (such as V3.1) must be included to ensure traceability.

[0101] The fine-tuning data comes from historical alerts, expert interpretation supervision pairs, SOP slice rewriting content, and manually constructed adversarial instructions. The instructions adopt a three-part structure of system / user / assistant (system has fixed security and style constraints, user injects code, risk_level, features, evidence, role, and assistant outputs JSON).

[0102] Character style is quantified based on style vectors: s=[τ,η,ξ, ,χ,κ];

[0103] Where τ is terminology density, η is conciseness, ξ is emotional temperature, and ϕ is... χ represents politeness, κ represents imperativeness, and κ represents numerical density.

[0104] Generate differentiated text for the Technician version (high terminology density, short sentences, imperative steps, each sentence ≤20 characters, ≥3 executable steps), the Operations Manager version (indicator-oriented, cost-risk description, including KPI fields), and the Customer version (low terminology, reassuring, avoiding professional abbreviations);

[0105] LLM optimization strategies include:

[0106] 1. Optimization of the prompt layer: Segmented instructions are adopted (separation of role constraints and evidence citation), providing Few-shot positive and negative examples (positive examples are explanatory text that meets the style requirements, and negative examples are fabricated content or text that deviates from the style). The sampling parameters are set to temperature T∈[0.2,0.7] (T=0.2~0.4 for technician version, T=0.5~0.7 for customer version), p-core sampling p∈[0.8,0.95], and n-best candidates (n=3~5) are generated and then re-ranked according to "structural integrity + style distance + evidence coverage".

[0107] 2. Preference Alignment: Collect pairwise preference feedback from users on (prompt, output), and use DPO (Direct Preference Optimization) or SFT (Supervised Fine-Tuning) to iteratively optimize the model, mapping user satisfaction scores to rewards r∈[-1,1]. The scoring formula is used during rearrangement.

[0108]

[0109] Where λ1 to λ4 are weights, and λ1+λ2+λ3+λ4=1, with the default values ​​being λ1=0.3, λ2=0.3, λ3=0.2, and λ4=0.2.

[0110] For example, when Code=0x57E2 and L=2, the technician version reads "The bus voltage fluctuation is too large, which may be caused by the aging of the PCS capacitor. Recommendations: 1) Switch to bypass; 2) Measure ESR; 3) Remeasure ΔV after 30 minutes." The administrator version reads "A medium-risk event has been detected. If not handled, it may cause power fluctuations and increase maintenance costs. It needs to be rechecked within half an hour." The customer version reads "The system has detected an equipment abnormality. Technicians will check it within half an hour. Please rest assured."

[0111] By employing lightweight LLM deployment and domain-specific fine-tuning, the system balances the real-time nature (latency ≤ 1.2s) and accuracy of generated explanations. Combined with RAG retrieval, it ensures that explanations are based on SOPs / knowledge bases, avoiding fabricated content. Layered text is generated in a quantified manner according to role style, providing "executable and understandable" explanations for technicians, operations managers, and customers. This addresses the information asymmetry problem caused by existing platforms only displaying alarm codes, reducing misjudgments and delayed handling. The average operability score for technicians reached 4.8 / 5, and customer satisfaction reached 4.7 / 5.

[0112] VI. Action suggestion generator: Outputs standardized, structured operation steps;

[0113] Construct a query statement based on (Code,L,f), perform mixed retrieval and rearrangement in the SOP graph database, prioritize matching SOP entries with high correlation to alarm codes, risk levels and feature vectors during retrieval, and output structured steps containing operation sequence numbers and action content after rearrangement.

[0114] For example, for Code=0x57E2 and L=2, after the system retrieves the relevant SOP, it outputs in a sorted manner: "Step 1: Switch bypass; Step 2: Measure the ESR of the filter capacitor; Step 3: Remeasure ΔV after 30 minutes".

[0115] It achieves seamless integration of explanatory text and action suggestions, ensures the standardization and authority of operational steps through SOP diagram database retrieval, and facilitates quick understanding and execution by relevant personnel through structured output, avoiding operational errors caused by unclear handling steps, forming a complete "risk identification-explanation-handling" chain, and improving the efficiency of anomaly handling.

[0116] VII. Push and Closed-Loop Layer: Push results in real time and dynamically optimize the system;

[0117] Push graded results, explanatory text, and action suggestions via multiple channels including WebSocket, REST API, and SMS:

[0118] WebSocket uses the address wss: / / api.example.com / ws / notify, with the subprotocol ess.notif.v1, carrying JWT authentication. The client sends a PING every 30 seconds to maintain the connection. It supports resuming interrupted downloads with last_event_id. The Query parameter can be either site_id (multiple values ​​separated by commas, such as site_id=CN-NT-ESS001,CN-SH-ESS002) or role (values ​​tech / mgr / cust, corresponding to technician / manager / customer roles).

[0119] The REST API uses POST / v1 / events / push, includes X-Client-Id, X-Timestamp, and X-Signature authentication, supports idempotent key deduplication, and is rate-limited to R per tenant. max =1000RPS, burst traffic is buffered through a token bucket (capacity 10k);

[0120] SMS templates such as "

{brand}

[0121] After the push notification, user feedback is collected (r∈[-1,1]) according to the formula:

[0122]

[0123] Update the threshold and model; for example, if a technician reports r=-1 (considering it a high-risk indicator), When =0.8, then:

[0124] =0.8−0.01×(-1)×(0.794−0.8)=0.80006;

[0125] The threshold has been slightly raised, making it more likely that similar situations will be classified as high-risk in the future.

[0126] Multi-channel push notifications cater to the receiving habits of different roles (technicians, operations managers, and customers), ensuring real-time delivery of results. Based on user feedback thresholds and model update mechanisms, the system achieves dynamic optimization, improves its adaptability to different scenarios, and ensures the long-term accuracy of risk assessment and classification. The average end-to-end latency is 1.1 seconds, meeting real-time requirements.

[0127] 8. Deployment solutions for different site sizes: adaptable to 10MW and 100MW site requirements;

[0128] For 10MW sites: Configure 1-2 edge gateways (active / backup, local buffer 48h), adopt Modbus-TCP / IEC104 acquisition protocol, 1GbE network, Kafka as a 1-3 Broker micro cluster (replication factor 1-2), lightweight rule engine to process streaming data, single-machine / master-backup time-series database (such as Timescale DB), optional local NAS storage, Docker+systemd orchestration, gateway N+1 high availability, retain 30-90 days of online data.

[0129] Inbound traffic formula by site:

[0130]

[0131] in, For the number of connected devices, Number of data collection points per device For sampling frequency, For the number of bytes per record, Compression factor and storage usage formula:

[0132]

[0133] in, To retain days, For replication factor, 10MW site =120、 =80、 =1Hz =12B、 When =2.0, ≈56.3KB / s.

[0134] For 100MW sites: Configure 3-4 edge gateways (regional deployment, local buffer 7d), adopt IEC61850MMS+SV acquisition protocol, 10 Gigabit aggregation network, Kafka 5+ Broker cluster (replication factor 3, cross-rack), Flink / KStreams cluster to process streaming data, distributed time series database (TSDB, ≥6 shards, cold and hot tiering), standard S3 compatible object storage, K8s+HPA / VPA orchestration, gateway N+2 high availability, retain 180-365 days of online data + cold archiving.

[0135] Key design trade-offs and recommendations:

[0136] 1. Key-based ordering and cross-partition parallel processing: Using {site}:{device_id} as the Kafka write key ensures data time-series consistency on a single device, while expanding total throughput by partitioning by "site × device type";

[0137] 2. Domain dictionary versioning: The schema_ver field in the message body is associated with the data dictionary version, and multiple version parsers are retained in the backend to support smooth migration of the data dictionary;

[0138] 3. Idempotency and Retry: All push-related interfaces (REST / SMS) introduce idempotent keys, and the retry mechanism adopts an exponential backoff strategy (retry interval of 2). n Seconds, n=0,1,2,...,5, i.e. 1s, 2s, 4s...32s).

[0139] 4. Hot and cold storage: 100MW-level sites use TSDB hot storage (retaining 7-30 days of high-frequency data) + object storage cold storage (retaining more than 180 days of archived data) to reduce storage costs;

[0140] 5. Observe availability indicators: For the three channels WS / REST / SMS, respectively, the delivery rate (target ≥99.9%), first packet latency (target WS≤200ms, REST≤500ms, SMS≤3s) and failure retry rate (target ≤0.1%) are calculated and included in the operation and maintenance SLO (Service Level Objective).

[0141] 100MW site =800、 =120、 =2Hz, with other parameters the same as above ≈0.55MB / s, estimated with a 5×peak margin considering event peak and redundancy. ≈2.8MB / s, number of Kafka partitions:

[0142]

[0143] Where B is the number of Brokers, For single-partition target throughput, P=8~12 is recommended.

[0144] By adapting differentiated deployment solutions to the hardware resources, data volume, and business needs of energy storage sites of different sizes, the 10MW site solution balances cost and practicality, while the 100MW site solution ensures high throughput, high availability, and massive data storage capabilities, avoiding the problems of "overpowered" or "underpowered" systems and improving the applicability and reliability of the system in different scenarios.

[0145] In summary, over 60 days of operation across 15 sites, the system processed a total of 420 alarms. Results showed a classification accuracy rate of 93.4% (a 12.2 percentage point improvement over the threshold-only method), a Level 3 false alarm rate of 2.7% (significantly better than the traditional 6.5%), an average technician operability score of 4.8 / 5, a customer satisfaction score of 4.7 / 5, and an average end-to-end latency of 1.1 seconds. These results fully validate the system's superiority in risk quantification accuracy, multi-role communication effectiveness, anomaly handling efficiency, and real-time performance, effectively ensuring the stable operation of the energy storage system.

[0146] It should be noted that, in this invention, although the specification describes the embodiments, not every embodiment contains only one independent technical solution. This way of describing the specification is only for clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A system for early warning and risk classification of energy storage anomalies based on a large language model, characterized in that, include: The early warning capture module is used to capture abnormal early warning signals of energy storage sites in real time and extract raw data windows from the abnormal early warning signals; The feature quantization module is used to preprocess the original data window and generate a structured feature vector based on the operating mechanism of the energy storage system. The risk scoring module is used to input the feature vector into a preset risk assessment model and calculate the risk score. The risk classification mapping module is used to map the risk score to the corresponding risk level based on a preset risk classification rule; The LLM multi-role explanation module is used to generate differentiated anomaly explanation texts for different roles based on a large language model and combined with the SOP or knowledge base of the energy storage system. The action suggestion generation module is used to output structured abnormal handling operation steps based on the abnormal warning signal, risk level and feature vector; The push and closed-loop module is used to push the risk level, anomaly explanation text and anomaly handling operation steps to the corresponding roles, and collect user feedback to update the risk classification rules and risk assessment model.

2. The energy storage anomaly early warning and risk classification system based on a large language model according to claim 1, characterized in that, The early warning capture module captures abnormal early warning signals generated by the BMS / EMS of the energy storage site through the collaboration of the SCADA system and Kafka stream. It partitions the Kafka stream topics according to the site × device type dimension and encapsulates the abnormal early warning signals using a preset binary serialization format. The encapsulated anomaly warning signal includes a site identifier, device identifier, data timestamp, data sampling window, data verification information, and clock synchronization tag.

3. The energy storage anomaly early warning and risk classification system based on a large language model according to claim 1, characterized in that, The preprocessing of the feature quantization module includes data cleaning, data alignment, and data normalization; The structured feature vector contains multi-dimensional features, which are selected from at least three of the following: statistical features, trend features, event count features, spectral features, and log alarm features. The feature quantization module also introduces prior confidence weights to weight each feature in the feature vector. The prior confidence weights are determined based on the mutual information between the feature and the risk outcome, the correlation between the feature and the SOP item, and the physical rationality of the feature.

4. The energy storage anomaly early warning and risk classification system based on a large language model according to claim 1, characterized in that, The risk scoring module uses Gradient Boosting Tree (GBDT) as the risk assessment model. The GBDT model adopts an additive structure and is optimized by a log loss function with sample weights to handle the class imbalance problem. The risk scoring module also maps the output of the GBDT model to a risk score in the [0,1] interval using the Sigmoid function, and performs calibration processing on the risk score. The calibration processing is selected from equivalent calibration or Platt calibration.

5. The energy storage anomaly early warning and risk classification system based on a large language model according to claim 1, characterized in that, The risk classification rules of the classification mapping module include at least two risk classification thresholds, and the risk level is determined by comparing the risk score with the classification thresholds. The hierarchical mapping module also introduces a hysteresis threshold, which is determined based on the noise standard deviation of the risk score and the allowable risk level switching frequency, in order to suppress frequent risk level switching caused by small fluctuations in the risk score.

6. The energy storage anomaly early warning and risk classification system based on a large language model according to claim 1, characterized in that, The LLM multi-role explanation module adopts a lightweight deployment of an instruction-based large language model. It obtains evidence sets from SOPs or knowledge bases through retrieval augmented generation (RAG) technology and generates explanation text based on preset role style vectors. The character style vector includes at least three of the following: terminology density, conciseness, emotional temperature, directivity, and numerical density. The LLM multi-role interpretation module also sets up factual consistency, style consistency, and action consistency guardrails to ensure that the interpretation text is based on the evidence set, conforms to the target role's style, and that the operation steps can be traced back to a specific version of the SOP.

7. The energy storage anomaly early warning and risk classification system based on a large language model according to claim 1, characterized in that, The action suggestion generation module constructs a search query statement based on the alarm code, risk level and feature vector, and performs retrieval and rearrangement in the SOP diagram database. The rearrangement is based on the degree of correlation with the alarm code, risk level and feature vector as the priority. The structured exception handling steps include operation sequence number, action content, and operation identifier and version information associated with the SOP.

8. The energy storage anomaly early warning and risk classification system based on a large language model according to claim 1, characterized in that, The push and closed-loop module pushes through at least two channels among WebSocket, RESTAPI and SMS, and each push channel is configured with an authentication mechanism and a traffic control strategy; The user feedback includes evaluation information on risk level, explanatory text, and operation steps. The push and closed-loop module adjusts the risk classification threshold and the parameters of the risk assessment model based on the user feedback.

9. The energy storage anomaly early warning and risk classification system based on a large language model according to claim 1, characterized in that, It also includes a deployment adaptation module, which configures the number of edge gateways, the number of brokers in the Kafka cluster, the time-series database type, and the data storage strategy according to the scale of the energy storage site; The data storage strategy includes data retention duration and hot / cold tiered storage configuration. The hot / cold tiered storage configuration stores high-frequency real-time data in a time-series database and archived data in object storage.

Images