Power data anomaly detection method

Abstract

The invention provides a power data anomaly detection method, which relates to the field of power data detection, and comprises the following steps: if acquired voltage data passes physical constraint verification, judging that the acquired voltage data is caused by a protocol analysis error if the acquired voltage data does not pass the verification; and acquiring a baseline deviation range, if the acquired voltage data exceed the baseline deviation range, determining an abnormal phenomenon according to the acquired data, and determining an abnormal root cause in combination with a matching rule corresponding to the abnormal phenomenon, and if rule base matching fails, calculating a node abnormal probability by using a Bayesian network, and preferentially checking a high-probability node. The abnormal root causes are positioned through causal reasoning, manual participation is not needed, the method is suitable for edge end real-time detection, and the cost is lower.

Description

Technical Field

[0001] This invention relates to the field of power data detection, and in particular to a method for detecting power data anomalies. Background Technology

[0002] In the Modbus-RTU-TCP high-frequency data acquisition scenario of power digital display meters, the causes of abnormal data (such as voltage suddenly rising to tens of thousands of volts) are complex: it may be due to on-site physical faults (such as insulation breakdown), communication link interference (such as TCP packet loss causing data misalignment), protocol parsing errors (such as register address mismatch), or device initialization abnormalities (such as registers not being cleared after restart).

[0003] Existing technologies for detecting abnormal data employ fixed thresholds or statistical models (such as the 3σ principle). However, these methods either fail to distinguish between protocol layer errors and genuine anomalies—for example, a voltage jump of tens of thousands of volts caused by a Modbus register address misalignment might be misjudged as a physical fault; or they are unable to adapt to changes in operating conditions because power parameters (such as voltage) are significantly affected by factors such as load rate and equipment operating time; or they require the deployment of external temperature sensors or complex data training, resulting in high deployment costs, high computational complexity, weak generalization ability, and unsuitability for real-time detection at the edge. Furthermore, after anomalies occur, manual investigation is relied upon, lacking an automated reasoning mechanism to locate communication link, equipment hardware, or software configuration problems. Summary of the Invention

[0004] The main objective of this invention is to propose a method for detecting power data anomalies, which can identify protocol-level anomalies, locate the root cause of the anomalies through causal reasoning, require no human intervention, is suitable for real-time detection at the edge, and has a lower cost.

[0005] This invention is achieved through the following technical solution:

[0006] The method for detecting power data anomalies includes the following steps:

[0007] Step S1: Collect voltage and current data of the power equipment. Perform physical constraint verification on the collected voltage data based on the parameters of the power equipment. If the verification fails, the root cause of the abnormality is determined to be a protocol parsing error. Otherwise, proceed to step S2.

[0008] Step S2: Generate a dynamic baseline based on the historical operating data and real-time status of the power equipment. Obtain the baseline deviation range based on the dynamic baseline. If the collected voltage data exceeds the baseline deviation range, proceed to step S3 for anomaly handling; otherwise, determine that the data is normal.

[0009] Step S3: Construct a typical rule base that includes abnormal phenomena, matching rules for abnormal phenomena, and root cause localization. Determine the abnormal phenomena based on the collected data, determine the root cause of the abnormal phenomena by combining the matching rules corresponding to the abnormal phenomena, and proceed to step S5. If the rule base fails to match, proceed to step S4.

[0010] Step S4: Calculate the node anomaly probability using a Bayesian network, prioritize the investigation of high-probability nodes, and proceed to step S5. Here, nodes include communication links, device hardware, and software configurations.

[0011] Step S5: Output an exception report and issue an alarm.

[0012] Furthermore, in step S1, the voltage data is collected using a voltage transformer, and the current data is collected using a current transformer.

[0013] Furthermore, in step S1, the physical constraint includes a ratio constraint, which is represented as V. true =K v .V measured When V true If the value exceeds the set nominal range, it is determined to be a protocol parsing error. measured K represents the collected voltage data. v This indicates the voltage transformer ratio.

[0014] Furthermore, in step S2, the dynamic baseline is represented as V. baseline =μ hist +k×σ hist ×L weight ×T weight The baseline deviation range is denoted as [V]. baseline -,V baseline ], where V baseline −=μ hist −k×σ hist ×L weight ×T weight μ hist σ represents the average voltage value from historical operating data. hist The voltage standard deviation represents the historical operating data, k=3, L weight =0.5+0.5×L load L represents the load factor weighting of power equipment. load T represents the current load rate of electrical equipment. weight =1.2−0.01×T runtime T represents the power equipment operating time correction. runtime It indicates the continuous operating time of electrical equipment.

[0015] Furthermore, in step S3, the abnormal phenomena of the typical rule base are voltage surge with normal current, voltage fluctuation with high packet loss rate, and voltage jump with device just restarted. The corresponding matching rules are abnormal voltage with no current fluctuation, network delay greater than 100ms with TCP retransmission rate greater than 30%, and runtime less than 1h with Modbus register not initialized. The root causes are respectively located as Modbus register address misalignment, communication link congestion, and digital display table initialization not completed.

[0016] Furthermore, in step S4, the Bayesian network includes root cause nodes A, B, and C, intermediate nodes D, E, F, and G, and observation nodes H, I, and J. A represents communication link anomalies, B represents device hardware anomalies, C represents software configuration anomalies, D represents TCP retransmission rate greater than 25%, E represents network latency greater than 80ms, F represents power equipment operating time less than 30min, G represents normal current data, H represents voltage sudden rise or fall of more than 50% relative to historical baseline, I represents voltage drift greater than 10% and less than 50% for a duration greater than 5min, and J represents voltage-current phase difference greater than 5°. Each intermediate node and each observation node serves as evidence, and the conditional probabilities of all nodes are obtained through offline training using labeled historical real anomaly cases and expert rule injection.

[0017] Furthermore, in step S4, based on the collected data and device status, the authenticity of some or all intermediate nodes and / or some or all observation nodes is determined and used as input to the pre-trained Bayesian network to obtain the posterior probabilities P(A|evidence), P(B|evidence), and P(C|evidence) of each root cause node. If the posterior probability of a certain root cause node is above 0.8, it is identified as the root cause. If the highest posterior probability is between 0.5 and 0.8, the root causes are sorted according to their posterior probabilities. If the posterior probabilities of all three are below 0.5, they are judged as unknown anomalies.

[0018] Furthermore, in step S4, the Junction Tree algorithm is used to calculate the posterior probability of each root cause node by combining the conditional probability of the node.

[0019] Furthermore, the communication link anomalies include packet loss, TCP retransmission, and / or network delay; the device hardware anomalies include voltage transformer and / or current transformer anomalies, sensor drift, and / or insulation breakdown; and the software configuration anomalies include register address misalignment, turns ratio configuration error, data type error, and / or incomplete initialization. Among these, sensor drift includes zero-point drift, gain drift, and / or temperature drift of voltage and current sensors.

[0020] As can be seen from the above description of the present invention, compared with the prior art, the present invention has the following beneficial effects:

[0021] This invention first verifies the collected voltage data based on the physical constraints of the power equipment parameters. If the verification fails, the root cause of the anomaly is determined to be a protocol parsing error. Otherwise, a dynamic baseline is generated based on the historical operating data and real-time status of the power equipment. The baseline deviation range is obtained based on the dynamic baseline. If the collected voltage data exceeds the baseline deviation range, a typical rule base is constructed, including anomalies, matching rules for the anomalies, and root cause localization. The anomaly is determined based on the collected data, and the root cause is determined by combining the matching rules corresponding to the anomalies. An anomaly report is output and an alarm is triggered. If the rule base fails to match, a Bayesian network is used to calculate the node anomaly probability, prioritizing the investigation of high-probability nodes. This achieves accurate filtering of protocol layer anomalies. The dynamic baseline avoids misjudgments caused by fixed thresholds, and the Bayesian network is used to locate the root cause of anomalies, effectively reducing operation and maintenance costs. When generating the dynamic baseline, only the power equipment's own parameters and historical operating data are used, without the need to deploy additional temperature sensors or other external sensors, or perform complex data training, effectively reducing costs, computational complexity, and generalization ability. It is suitable for real-time detection at the edge and has interpretability. Attached Figure Description

[0022] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0023] Figure 1 This is a flowchart of the present invention.

[0024] Figure 2 This is a schematic diagram of dynamic baseline generation according to the present invention.

[0025] Figure 3 This is the matching logic of a typical rule base in this invention. Detailed Implementation

[0026] The present invention will be further described below through specific embodiments.

[0027] like Figure 1 As shown, the power data anomaly detection method includes the following steps:

[0028] Step S1: Collect voltage and current data of the power equipment. Perform physical constraint verification on the collected voltage data based on the parameters of the power equipment. If the verification fails, the root cause of the abnormality is determined to be a protocol parsing error. Otherwise, proceed to step S2.

[0029] The voltage data is collected using a voltage transformer, and the current data is collected using a current transformer. Physical constraints include turns ratio constraints, which are expressed as V... true =K v .V measured When Vtrue If the voltage exceeds the set nominal range (e.g., 0-400V), it is determined to be a protocol parsing error (e.g., an incorrect register address causing the voltage data to be amplified 10 times). measured K represents the collected voltage data. v This indicates the voltage transformer ratio.

[0030] Step S2: Generate a dynamic baseline based on the historical operating data and real-time status of the power equipment. Obtain the baseline deviation range based on the dynamic baseline. If the collected voltage data exceeds the baseline deviation range, proceed to step S3 for anomaly handling; otherwise, determine that the data is normal.

[0031] The dynamic baseline generation process is as follows Figure 2 As shown, the dynamic baseline is represented by V. baseline =μ hist +k×σ hist ×L weight ×T weight The baseline deviation range is represented as [V] baseline -,V baseline ], where V baseline −=μ hist −k×σ hist ×L weight ×T weight μ hist σ represents the average voltage value from historical operating data. hist The voltage standard deviation represents the historical operating data, k=3 (3σ principle), L weight =0.5+0.5×L load L represents the load factor weighting of power equipment. load =P actual / P rated P represents the current load factor of electrical equipment. actual P represents the current active power. rated T represents the rated power of the equipment. weight =1.2−0.01×T runtime T represents the power equipment operating time correction. runtime This indicates the continuous operating time of electrical equipment. Historical operating data refers to power supply data for the same period within the previous 30 days. The higher the load rate, the greater the allowable fluctuation. The longer the continuous operating time of the equipment, the stricter the threshold (to avoid long-term drift).

[0032] Step S3: Construct a typical rule base that includes abnormal phenomena, matching rules for abnormal phenomena, and root cause localization. Determine the abnormal phenomena based on the collected data, determine the root cause of the abnormal phenomena by combining the matching rules corresponding to the abnormal phenomena, and proceed to step S5. If the rule base fails to match, proceed to step S4.

[0033] As shown in Table 1, typical rule base anomalies include voltage spikes with normal current, voltage fluctuations with high packet loss rate, and voltage jumps with the device recently restarted. The corresponding matching rules are: abnormal voltage with no current fluctuation, network latency greater than 100ms with TCP retransmission rate greater than 30%, and runtime less than 1 hour with uninitialized Modbus registers. The root causes are respectively: Modbus register address misalignment, communication link congestion, and incomplete digital display table initialization. The matching logic of the typical rule base set in this embodiment is as follows: Figure 3 As shown.

[0034] Table 1

[0035]

[0036] Step S4: Calculate the node anomaly probability using a Bayesian network, prioritize the investigation of high-probability nodes, and proceed to step S5. Here, nodes include communication links, device hardware, and software configurations.

[0037] A Bayesian network consists of root cause nodes A, B, and C; intermediate nodes D, E, F, and G; and observation nodes H, I, and J. A represents a communication link anomaly; B represents a device hardware anomaly; C represents a software configuration anomaly; D represents a TCP retransmission rate greater than 25%; E represents a network latency greater than 80ms; F represents power equipment operating time less than 30 minutes; G represents normal current data; H represents a voltage spike or drop of more than 50% relative to the historical baseline; I represents a voltage drift greater than 10% but less than 50% for a duration greater than 5 minutes; and J represents a voltage-current phase difference greater than 5°. The Bayesian network structure is: A→D, E; B→H, I, J; C→H, F, G.

[0038] Each intermediate node and each observation node serves as evidence. The conditional probabilities of all nodes are obtained through offline training using labeled historical real-world anomaly cases and expert rule injection, and are then fixed in tabular form on edge devices. Minor updates can be made via OTA if needed; this process is existing technology. Communication link anomalies include packet loss, TCP retransmission, and / or network latency. Equipment hardware anomalies include voltage transformer and / or current transformer anomalies, sensor drift, and / or insulation breakdown. Software configuration anomalies include register address misalignment, turns ratio configuration errors, data type errors, and / or incomplete initialization. The voltage and current phase difference is expressed as Δθ = |θ|. v −θ i |, θ v For voltage phase, θ i This represents the current phase.

[0039] Based on the collected data and device status, the authenticity of some or all intermediate nodes and / or some or all observation nodes is determined and used as input to a pre-trained Bayesian network. The Bayesian network uses the JunctionTree algorithm, combined with the conditional probability of the nodes, to calculate the posterior probability of each root cause node, so as to obtain the posterior probabilities P(A|evidence), P(B|evidence), and P(C|evidence) of each root cause node. If the posterior probability of a certain root cause node is above 0.8, it is located as that root cause. If the highest posterior probability is between 0.5 and 0.8, the root causes are sorted according to the posterior probability from highest to lowest. If the posterior probabilities of all three are below 0.5, they are judged as unknown anomalies.

[0040] In this embodiment, in a certain abnormal situation: the voltage suddenly surged from 228V to 16880V, the current remained completely normal (fluctuating only 0.8%), the equipment ran for 156 hours without high packet loss, then the evidence is represented as: H=true, G=true, F=false, D=false, calculated using the posterior probability ∝ prior probability × likelihood of each symptom:

[0041] P(Evidence|A) = P(H=True|A) × P(G=True|A) × P(F=False|A) × P(D=False|A) = 0.25 × 0.30 × (1 - 0.05) × (1 - 0.90) = 0.25 × 0.30 × 0.95 × 0.10 = 0.007125;

[0042] P(Evidence|B) = 0.40 × 0.20 × (1 - 0.10) × (1 - 0.05) = 0.40 × 0.20 × 0.90 × 0.95 = 0.0684;

[0043] P(Evidence|C) = 0.98 × 0.99 × 0.99 × (1 - 0.30) × (1 - 0.03) = 0.98 × 0.99 × 0.70 × 0.97 ≈ 0.659;

[0044] Calculate the unnormalized posterior probabilities of A, B, and C respectively:

[0045] A: 0.15×0.007125≈0.001069;

[0046] B: 0.10 × 0.0684 ≈ 0.00684;

[0047] C: 0.75 × 0.659 ≈ 0.49425;

[0048] The total is approximately 0.50216.

[0049] Then P(A|evidence) = 0.001069 / 0.50216 ≈ 0.0021 (0.21%).

[0050] P(B|evidence) = 0.00684 / 0.50216 ≈ 0.0136 (1.36%).

[0051] P(C|evidence) = 0.49425 / 0.50216 ≈ 0.984 (98.4%).

[0052] The problem was determined to be a software configuration error. On-site inspection confirmed that the register address was offset by two bytes. After repair, the system returned to normal.

[0053] Step S5: Output an anomaly report and trigger an alarm. The anomaly report includes a timestamp, anomaly type, and root cause location. Write the anomaly report to the time series database and trigger an alarm.

[0054] In this invention, the terms "first," "second," and "third," etc., are used only to distinguish similar objects and are not necessarily used to describe a specific order or sequence, nor should they be construed as indicating or implying relative importance. The use of terms such as "upper," "lower," "left," "right," "front," and "rear" to indicate orientation or positional relationships is based on the orientation or positional relationships shown in the accompanying drawings and is only for the convenience of describing the invention, not to indicate or imply that the device referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, it should not be construed as a limitation on the scope of protection of this invention. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0055] Furthermore, in the description of this application, unless otherwise stated, "multiple" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0056] The above are merely specific embodiments of the present invention, but the design concept of the present invention is not limited thereto. Any non-substantial modifications made to the present invention using this concept shall be considered as infringing upon the protection scope of the present invention.

Claims

1. A method for detecting anomalies in power data, characterized in that: Includes the following steps: Step S1: Collect voltage and current data of the power equipment. Perform physical constraint verification on the collected voltage data based on the parameters of the power equipment. If the verification fails, the root cause of the abnormality is determined to be a protocol parsing error. Otherwise, proceed to step S2. Step S2: Generate a dynamic baseline based on the historical operating data and real-time status of the power equipment. Obtain the baseline deviation range based on the dynamic baseline. If the collected voltage data exceeds the baseline deviation range, proceed to step S3 for anomaly handling; otherwise, determine that the data is normal. Step S3: Construct a typical rule base that includes abnormal phenomena, matching rules for abnormal phenomena, and root cause localization. Determine the abnormal phenomena based on the collected data, determine the root cause of the abnormal phenomena by combining the matching rules corresponding to the abnormal phenomena, and proceed to step S5. If the rule base fails to match, proceed to step S4. Step S4: Calculate the node anomaly probability using a Bayesian network, prioritize the investigation of high-probability nodes, and proceed to step S5. Here, nodes include communication links, device hardware, and software configurations. Step S5: Output an exception report and issue an alarm.

2. The power data anomaly detection method according to claim 1, characterized in that: In step S1, voltage data is collected using a voltage transformer, and current data is collected using a current transformer.

3. The power data anomaly detection method according to claim 2, characterized in that: In step S1, the physical constraints include the ratio constraint, which is represented as V. true =K v .V measured When V true If the value exceeds the set nominal range, it is determined to be a protocol parsing error. measured K represents the collected voltage data. v This indicates the voltage transformer ratio.

4. The power data anomaly detection method according to claim 1, 2, or 3, characterized in that: In step S2, the dynamic baseline is represented as V. baseline =μ hist +k×σ hist ×L weight ×T weight The baseline deviation range is denoted as [V]. baseline -,V baseline ], where V baseline −=μ hist −k×σ hist ×L weight ×T weight μ hist σ represents the average voltage value from historical operating data. hist The voltage standard deviation represents the historical operating data, k=3, L weight =0.5+0.5×L load L represents the load factor weighting of power equipment. load T represents the current load rate of electrical equipment. weight =1.2−0.01×T runtime T represents the power equipment operating time correction. runtime It indicates the continuous operating time of electrical equipment.

5. The power data anomaly detection method according to claim 1, 2, or 3, characterized in that: In step S3, the abnormal phenomena of the typical rule base are voltage surge with normal current, voltage fluctuation with high packet loss rate, and voltage jump with device just restarted. The corresponding matching rules are abnormal voltage with no current fluctuation, network delay greater than 100ms with TCP retransmission rate greater than 30%, and runtime less than 1h with Modbus register not initialized. The root causes are respectively located as Modbus register address misalignment, communication link congestion, and digital display table initialization not completed.

6. The power data anomaly detection method according to claim 1, 2, or 3, characterized in that: In step S4, the Bayesian network includes root cause nodes A, B, and C, intermediate nodes D, E, F, and G, and observation nodes H, I, and J. A represents communication link anomalies, B represents device hardware anomalies, C represents software configuration anomalies, D represents TCP retransmission rate greater than 25%, E represents network latency greater than 80ms, F represents power equipment operating time less than 30min, G represents normal current data, H represents voltage sudden rise or fall of more than 50% relative to historical baseline, I represents voltage drift greater than 10% and less than 50% for a duration greater than 5min, and J represents voltage and current phase difference greater than 5°. Each intermediate node and each observation node serves as evidence, and the conditional probabilities of all nodes are obtained through offline training using labeled historical real anomaly cases and expert rule injection.

7. The power data anomaly detection method according to claim 6, characterized in that: In step S4, based on the collected data and device status, the authenticity of some or all intermediate nodes and / or some or all observation nodes is determined and used as input to the pre-trained Bayesian network to obtain the posterior probabilities P(A|evidence), P(B|evidence), and P(C|evidence) of each root cause node. If the posterior probability of a certain root cause node is above 0.8, it is identified as the root cause. If the highest posterior probability is between 0.5 and 0.8, the root causes are sorted according to their posterior probabilities. If the posterior probabilities of all three are below 0.5, they are judged as unknown anomalies.

8. The power data anomaly detection method according to claim 6, characterized in that: In step S4, the Junction Tree algorithm is used to calculate the posterior probability of each root cause node by combining the conditional probability of the nodes.

9. The power data anomaly detection method according to claim 6, characterized in that: The communication link anomalies include packet loss, TCP retransmission and / or network delay; the device hardware anomalies include voltage transformer and / or current transformer anomalies, sensor drift and / or insulation breakdown; the software configuration anomalies include register address misalignment, turns ratio configuration error, data type error and / or incomplete initialization; and the sensor drift includes zero-point drift, gain drift and / or temperature drift of voltage sensors and current sensors.

Images