Intelligent fault diagnosis and dynamic early warning system and method for SCADA (supervisory control and data acquisition) system

Abstract

The invention relates to an SCADA (supervisory control and data acquisition) system fault intelligent diagnosis and dynamic early warning system and method, in particular to the field of SCADA system fault intelligent diagnosis, and realizes accurate perception of equipment operation states through multi-source data deep fusion and intelligent feature extraction. An integrated diagnosis model is used for carrying out hierarchical accurate positioning on fault types and parts, so that the diagnosis confidence coefficient is remarkably improved; an early warning threshold is adaptively adjusted based on a dynamic threshold scheduling mechanism, and the problems of false alarm and missing alarm caused by working condition fluctuation are effectively overcome; and finally, through closed-loop disposal and model self-optimization, an intelligent closed loop for diagnosis and early warning disposal is formed, the system reliability is greatly improved, and the operation and maintenance pressure is reduced.

Description

Technical Field

[0001] This invention relates to the field of intelligent fault diagnosis technology for SCADA systems, and more specifically, to an intelligent fault diagnosis and dynamic early warning system and method for SCADA systems. Background Technology

[0002] In the field of industrial automation, Supervisory Control and Data Acquisition (SCADA) systems have become a core monitoring tool for large industrial facilities such as wind farms and substations. This system continuously collects data from equipment measurement points, including current, temperature, and vibration, through a sensor network deployed on the equipment side. It also collects operational data reflecting the equipment's load level, operating mode, and other conditions, as well as environmental data such as temperature, humidity, and wind speed, forming a multi-source heterogeneous data stream. This data is collected and transmitted to a central monitoring platform at millisecond intervals, providing a data foundation for equipment health status assessment and fault early warning. However, the complex industrial environment, the dynamic changes in equipment operating conditions, and the influence of factors such as sensor accuracy and transmission delay lead to inconsistent data quality, posing a significant challenge to subsequent fault diagnosis.

[0003] Currently, the fault diagnosis and early warning methods commonly used in SCADA systems have significant limitations. The core problem lies in the inability of statically set early warning thresholds to adapt to the dynamically changing operating conditions of equipment. Specifically, existing technologies typically set fixed thresholds based on the statistical characteristics of historical normal operating data (such as the mean plus or minus three standard deviations). However, real-time changes in equipment load levels, operating modes, and environmental parameters significantly affect the normal fluctuation range of measurement data. For example, the normal bearing temperature range of wind turbines under heavy load conditions is significantly higher than under light load conditions; using a fixed threshold would inevitably lead to false alarms or missed alarms. Although some improved methods introduce load factor adjustment mechanisms, these rely solely on simple linear proportional adjustments and fail to fully consider the transient process of operating condition switching, the coupled effects of environmental factors, and the gradual degradation of equipment performance, resulting in insufficient early warning accuracy. This deficiency is particularly prominent in scenarios such as wind farms where operating conditions fluctuate frequently, increasing the risk of misjudgment by maintenance personnel and potentially leading to serious equipment accidents due to missed alarms. Therefore, there is an urgent need for a dynamic early warning threshold technology that can deeply integrate multi-source information and adaptively adjust in real time to improve the accuracy and reliability of fault early warning under complex operating conditions. Summary of the Invention

[0004] This invention addresses the technical problems existing in the prior art by providing a SCADA system fault intelligent diagnosis and dynamic early warning system and method to solve the problems mentioned in the background art.

[0005] The technical solution of the present invention to solve the above-mentioned technical problems is as follows: a SCADA system fault intelligent diagnosis and dynamic early warning system, including a multi-source data fusion acquisition module, a feature extraction engine module, an integrated diagnostic model module, a dynamic early warning threshold scheduling module, and a closed-loop processing module; The multi-source data fusion acquisition module synchronously acquires equipment measurement point data, operating condition data, and environmental data at a sampling period of 50-100ms during SCADA system operation. Equipment measurement point data includes current, temperature, and vibration; operating condition data includes load level and operating mode; and environmental data includes temperature, humidity, and wind speed. The equipment measurement point data, operating condition data, and environmental data are stored in a standardized data mart in the form of "measurement point ID + timestamp" as a dual primary key. The feature extraction engine module, after acquiring data from the data mart, first uses the 3σ criterion to remove outliers and then uses linear interpolation to fill in missing data with a missing rate of no more than 5%. Then, it uses a sliding window method with a window size of 10 seconds to extract time-series features and load condition-related features from the preprocessed data. The time-series features include mean, variance, and peak factor. The load condition-related features are obtained by calculating the Pearson correlation coefficient between the load level and the key measurement point data. Finally, the extracted features are constructed into a 128-dimensional feature vector. The integrated diagnostic model module receives a 128-dimensional feature vector and first classifies the fault type into mechanical fault, electrical fault, or communication fault through the XGBoost model. Then, the classification result of the XGBoost model and the 10-second time-series feature sequence are input into the LSTM model to accurately locate the faulty component. Finally, the diagnostic result containing the fault ID, fault cause, and confidence level is output. When the confidence level is not lower than 90%, it is judged as a valid diagnosis. The dynamic early warning threshold scheduling module calculates the dynamic early warning threshold based on the diagnostic results, the baseline threshold calculated from historical normal operation data, and the load level coefficient determined by the real-time load level. The baseline threshold is the mean of historical normal operation data plus three times the standard deviation. The load level coefficient is divided into light load 0.2, medium load 0.5, and heavy load 0.8 according to the ratio of real-time load value to rated load value. The closed-loop handling module triggers tiered warnings—Level 1 emergency shutdown warning, Level 2 maintenance and repair warning, or Level 3 attention reminder—based on the type and severity of the diagnostic results. It also pushes the warning information to the monitoring terminal and records handling logs containing fault IDs, handling actions, and timestamps. The handling logs are used monthly as new training samples to update the parameters of the XGBoost and LSTM models.

[0006] In a preferred embodiment, the specific operation of synchronous acquisition and timestamp alignment in the multi-source data fusion acquisition module is as follows: When the system reaches the preset start point of the acquisition cycle, it controls the edge acquisition terminal to acquire device measurement point data, operating condition data and environmental data in parallel, and adds an original timestamp generated by the acquisition terminal to each acquired data point. Subsequently, time delay compensation is performed on the original timestamp. The time delay compensation is to superimpose a fixed transmission delay value determined in advance by the delay calibration of each communication path, thereby assigning a unified and accurate aligned timestamp to all data points.

[0007] In a preferred embodiment, after obtaining the accurate aligned timestamp, the following operations are also required: First, a confidence weight factor is calculated for each data point, with a value ranging from zero to one. The calculation process for the confidence weight factor is as follows: an exponential growth function with a base of the natural constant is used to process the data quality code determined by the hardware status of the acquisition device to obtain an initial weight value. Then, this initial weight value is multiplied by a linear decay term based on instantaneous gradient anomaly to obtain the final confidence weight factor. Instantaneous gradient anomaly is the ratio of the absolute difference between the physical parameter value corresponding to the current data point and the value of the previous time series point to the normal rate of change threshold preset by the system for the physical parameter. Secondly, using the measurement point identifier and the precise alignment timestamp as the association key, multiple data points pointing to the same physical entity within a small time tolerance window are fused. During fusion, a weighted average is calculated based on their respective credibility weight factors to generate a fused data record. Finally, the merged data records are stored in a standardized data mart.

[0008] In a preferred embodiment, the specific operation of outlier removal processing using the 3σ criterion in the feature extraction engine module is as follows: first, calculate the upper and lower quartiles and interquartile range of the data within the window; then, dynamically calculate the adaptive adjustment coefficient based on the kurtosis of the data distribution; then, use the adaptive adjustment coefficient and the interquartile range to determine the dynamic outlier judgment threshold; finally, remove data points that fall outside the dynamic outlier judgment threshold range. The process of supplementing missing data using linear interpolation includes: when the data missing rate does not exceed 5%, a weighted interpolation method based on the similarity of working conditions is used, and data from points before and after the location to be interpolated and data from similar working conditions in the same historical period are used as compensation sources for interpolation.

[0009] In a preferred embodiment, the process of extracting time-series features and operating condition-related features using the sliding window method further includes: A three-level window mechanism is adopted for multi-scale feature extraction, including a 10-second basic analysis window, a 30-second macro trend window, and a 2-second micro transient window; time-series features include improved fluctuation energy entropy, adaptive peak factor, and trend stability index; operating condition correlation features are obtained by calculating the dynamic condition mutual information and operating condition coupling coefficient between operating condition data and measuring point data; finally, features are selected from the initial features through the maximum correlation minimum redundancy feature selection algorithm, and the feature dimensions are constructed into 128 dimensions through feature interaction, nonlinear transformation, and time-series difference processing.

[0010] In a preferred embodiment, the specific operation of classifying fault types into mechanical faults, electrical faults, or communication faults using the XGBoost model in the integrated diagnostic model module is as follows: First, the feature importance of the input 128-dimensional feature vector is evaluated based on contribution weight. Then, a loss function with dynamic class weight adjustment is used for model training to solve the problem of imbalance in the number of fault category samples. The process of inputting the classification results of the XGBoost model and the ten-second time-series feature sequence into the LSTM model includes: encoding the fault type classification results into a three-dimensional vector, concatenating and fusing it with the time-series feature sequence, and then inputting it into the LSTM network after dimensionality reduction through the embedding layer.

[0011] In a preferred embodiment, the process of the LSTM model accurately locating faulty components in the integrated diagnostic model module is specifically as follows: A multi-head self-attention mechanism is introduced into the LSTM network to calculate the attention weights at different time steps, thereby achieving key focus at critical time points. Residual connections are added between the layers of the LSTM to avoid the gradient vanishing problem in deep network training. Finally, the location confidence is calibrated by the temperature scaling method, and the classification results and location results are fused based on evidence theory. When the confidence after fusion is not less than 90%, a valid diagnostic result is output, which includes the fault identifier, the fault cause, and the calibrated confidence.

[0012] In a preferred embodiment, the specific operation of the dynamic early warning threshold scheduling module is as follows: Based on historical normal operating data of the equipment, a fuzzy clustering algorithm is used to identify different operating modes and calculate the baseline threshold for each mode; real-time load data is collected, the load state transition probability is quantified through a hidden Markov model, and the nonlinear load influence coefficient is calculated; environmental factor compensation terms and equipment health status decay factors are fused, and a dynamic early warning threshold is synthesized through a multi-factor coupling formula; an adaptive Kalman filter is used to smooth the threshold and suppress transient abnormal fluctuations, and the final early warning threshold is output.

[0013] In a preferred embodiment, the specific operations of triggering tiered early warnings, recording handling logs, and updating model parameters in the closed-loop handling module are as follows: Based on the confidence level of the diagnostic results and the preset fault impact factors, a severity score is obtained through weighted calculation. Based on the comparison results of the severity score and fault impact factors with preset thresholds, the final warning level is determined through fuzzy reasoning. Log fields are encoded using an information entropy-based compression algorithm to form structured log entries containing fault identifiers, handling actions, timestamps, and entropy values. Training samples are extracted from the handling logs monthly, and the importance weights of the samples are adjusted using a time decay weighted sampling method. Regularized weighted incremental learning updates are then performed on the XGBoost model and the LSTM model, respectively.

[0014] A method for intelligent fault diagnosis and dynamic early warning of SCADA system includes the following steps: S1. During SCADA system operation, equipment measurement point data, operating condition data and environmental data are collected synchronously with a sampling period of 50-100ms. Equipment measurement point data includes current, temperature and vibration, operating condition data includes load level and operating mode, and environmental data includes temperature, humidity and wind speed. The equipment measurement point data, operating condition data and environmental data are stored in a standardized data mart in the form of "measurement point ID + timestamp" as a dual primary key. S2. After obtaining data from the data mart, outlier removal is first performed using the 3σ criterion, and missing data with a missing rate of no more than 5% are supplemented using linear interpolation. Then, a sliding window method with a window size of 10 seconds is used to extract time-series features and load condition correlation features from the preprocessed data. The time-series features include mean, variance, and peak factor. The load condition correlation features are obtained by calculating the Pearson correlation coefficient between the load level and the key measurement point data. Finally, the extracted features are constructed into a 128-dimensional feature vector. S3. Receive a 128-dimensional feature vector and first classify the fault type into mechanical fault, electrical fault, or communication fault through the XGBoost model. Then, input the classification result of the XGBoost model and the 10-second time series feature sequence into the LSTM model to accurately locate the faulty component. Finally, output the diagnostic result containing the fault ID, fault cause, and confidence level. When the confidence level is not lower than 90%, it is judged as a valid diagnosis. S4. Based on the diagnostic results, calculate the dynamic early warning threshold using the baseline threshold calculated from historical normal operation data and the load level coefficient determined by the real-time load level. The baseline threshold is the mean of historical normal operation data plus three times the standard deviation. The load level coefficient is divided into light load (0.2), medium load (0.5), and heavy load (0.8) based on the ratio of the real-time load value to the rated load value. S5. Based on the type and severity of the diagnostic results, trigger a tiered warning system, such as a Level 1 emergency shutdown warning, a Level 2 maintenance and repair warning, or a Level 3 attention reminder, and push the warning information to the monitoring terminal. At the same time, record the handling log, which includes the fault ID, handling action, and timestamp. The handling log is used as a new training sample every month to update the parameters of the XGBoost model and LSTM model.

[0015] The beneficial effects of this invention are as follows: through deep fusion of multi-source data and intelligent feature extraction, accurate perception of equipment operating status is achieved; by using an integrated diagnostic model to hierarchically and accurately locate fault types and components, the diagnostic confidence is significantly improved; based on a dynamic threshold scheduling mechanism, the early warning threshold is adaptively adjusted to effectively overcome the false alarm and missed alarm problems caused by operating condition fluctuations; finally, through closed-loop processing and model self-optimization, an intelligent closed loop of diagnosis, early warning and processing is formed, which greatly improves system reliability and reduces operation and maintenance pressure. Attached Figure Description

[0016] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a block diagram of the system structure of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0019] In the description of this application, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0020] Example 1 This embodiment provides, for example Figure 2 The present invention relates to an intelligent fault diagnosis and dynamic early warning system for SCADA systems, comprising a multi-source data fusion acquisition module, a feature extraction engine module, an integrated diagnostic model module, a dynamic early warning threshold scheduling module, and a closed-loop processing module. The multi-source data fusion acquisition module synchronously acquires equipment measurement point data, operating condition data, and environmental data at a sampling period of 50-100ms during SCADA system operation. Equipment measurement point data includes current, temperature, and vibration; operating condition data includes load level and operating mode; and environmental data includes temperature, humidity, and wind speed. The equipment measurement point data, operating condition data, and environmental data are stored in a standardized data mart in the form of "measurement point ID + timestamp" as a dual primary key. The feature extraction engine module, after acquiring data from the data mart, first uses the 3σ criterion to remove outliers and then uses linear interpolation to fill in missing data with a missing rate of no more than 5%. Then, it uses a sliding window method with a window size of 10 seconds to extract time-series features and load condition-related features from the preprocessed data. The time-series features include mean, variance, and peak factor. The load condition-related features are obtained by calculating the Pearson correlation coefficient between the load level and the key measurement point data. Finally, the extracted features are constructed into a 128-dimensional feature vector. The integrated diagnostic model module receives a 128-dimensional feature vector and first classifies the fault type into mechanical fault, electrical fault, or communication fault through the XGBoost model. Then, the classification result of the XGBoost model and the 10-second time-series feature sequence are input into the LSTM model to accurately locate the faulty component. Finally, the diagnostic result containing the fault ID, fault cause, and confidence level is output. When the confidence level is not lower than 90%, it is judged as a valid diagnosis. The dynamic early warning threshold scheduling module calculates the dynamic early warning threshold based on the diagnostic results, the baseline threshold calculated from historical normal operation data, and the load level coefficient determined by the real-time load level. The baseline threshold is the mean of historical normal operation data plus three times the standard deviation. The load level coefficient is divided into light load 0.2, medium load 0.5, and heavy load 0.8 according to the ratio of real-time load value to rated load value. The closed-loop handling module triggers tiered warnings—Level 1 emergency shutdown warning, Level 2 maintenance and repair warning, or Level 3 attention reminder—based on the type and severity of the diagnostic results. It also pushes the warning information to the monitoring terminal and records handling logs containing fault IDs, handling actions, and timestamps. The handling logs are used monthly as new training samples to update the parameters of the XGBoost and LSTM models.

[0021] In this embodiment, it should be specifically noted that the synchronous acquisition operation in the multi-source data fusion acquisition module is as follows: First, the system reaches the preset start point of the data acquisition cycle. At the same time, the control edge acquisition terminal collects data from the measurement points of the equipment in parallel. Operating data and environmental data Each collected data point is appended with an original timestamp generated by the acquisition terminal, thus generating three sets of data points with original timestamps. The raw data stream:

[0022] After receiving the generated raw data stream, the raw timestamp is then... Time delay compensation is performed, which involves superimposing a fixed transmission delay value pre-determined by delay calibration of each communication path. (The specific values ​​are obtained by periodically pinging each communication path and calibrating the hardware latency.) This compensation operation follows the formula:

[0023] in, This is a precisely aligned timestamp after time delay compensation. This refers to the original timestamp recorded by the data acquisition terminal. This refers to the transmission path delay of data from the collection point to the processing point; its purpose is to assign a unified, millisecond-precise, aligned timestamp to all data points. and ensure The final error is no greater than 10 milliseconds, thus assigning a unified and precisely aligned timestamp to all data points. The output of this step is a data stream with strictly aligned timestamps: .

[0024] After obtaining the precise alignment timestamp, firstly, a confidence weight factor is calculated for each data point. The factor The value range of the confidence weight factor is from zero to one; The calculation process uses an exponential growth function with a base of the natural constant to handle the data quality code determined by the hardware status of the acquisition device. An initial weight value is obtained; then, this initial weight value is multiplied by a linear decay term based on the instantaneous gradient anomaly to obtain the final confidence weight factor, the expression of which is:

[0025] in, This is the data quality code, determined by the hardware status of the acquisition device (such as signal strength and ADC conversion accuracy). It can take discrete values ​​(e.g., 0 = invalid, 1 = excellent, 2 = good, 3 = fair). This parameter prioritizes the evaluation of hardware-level reliability. For instantaneous gradient anomaly, the ratio of the absolute difference between the current value and the previous time series value to the normal rate of change threshold is calculated. Used to capture physically impossible mutations. This is a preset threshold for the normal rate of change based on the characteristics of the equipment; This is an adjustable sensitivity parameter. Used to control the Sigmoid function in quality codes The sensitive region above, Tolerances for transient gradient anomalies can be set, for example, by setting... .

[0026] This formula, through the Sigmoid function and a linear decay term, fuses discrete quality codes and continuous gradient changes into a continuous reliability index, thus quantifying the reliability of each data point more precisely. Finally, it adds a calculated reliability weight factor to each data point. .

[0027] The instantaneous gradient anomaly It is the ratio of the absolute difference between the physical parameter value corresponding to the current data point and the value of the previous time series point to the normal rate of change threshold preset by the system for the physical parameter. Secondly, using measurement point markings and the precisely aligned timestamp As the association key, a small time tolerance window will be used. (in, For a tolerance value (e.g., 5 milliseconds), multiple data points pointing to the same physical entity (i.e., data from different sources but pointing to the same physical parameter, such as multiple sensors measuring the temperature of the same bearing) are fused, with each data point weighted according to its own reliability factor. Perform a weighted average calculation to generate a merged data record. The expression for the weighted average calculation is as follows:

[0028] in, This is the final value after fusing multi-source data. The number of data sources for this parameter at the same time; generate a fused data record containing the measurement points. Precisely aligned timestamps The fused data values ​​and a comprehensive quality label (e.g., the maximum value of the confidence weight factor among all data points involved in the fusion).

[0029] Finally, the fused data records are stored in a standardized data mart, specifically by using measurement points... Precisely aligned timestamps As a composite primary key, it is written to a time-series database (such as InfluxDB). The database table structure includes fields: data type and composite value. Comprehensive quality marking, operating condition label Environmental parameters This ultimately forms a standardized data mart, providing high-quality, spatiotemporally aligned input data for the feature extraction engine module. The feature extraction module will directly call upon data from this data mart. and Perform subsequent calculations.

[0030] In this embodiment, it should be specifically noted that in the feature extraction engine module, the module calls the data stream from the standardized data mart by measurement point. Each data point includes a numerical value, a quality marker, and a working condition label. Outlier removal is then performed using the 3σ criterion. The specific steps are as follows: First, calculate the upper and lower quartiles of the data within the window. and interquartile range Then, an adaptive adjustment coefficient is dynamically calculated based on the kurtosis of the data distribution. This adaptive adjustment coefficient and the interquartile range are then used to determine the dynamic anomaly detection threshold. Finally, data points falling outside the dynamic anomaly detection threshold range are removed. The expression for the dynamic anomaly detection threshold in the outlier removal process is:

[0031]

[0032] in, and These are the lower and upper thresholds for anomaly detection, used to define the range of normal data; These are the lower and upper quartiles of the data, representing the values ​​at the 25th and 75th percentiles of the dataset, respectively. The interquartile range is equal to the upper quartile minus the lower quartile, i.e. Used to measure the dispersion of data; adaptive adjustment coefficient. To dynamically adjust according to the data distribution pattern, the calculation formula is as follows:

[0033] in The kurtosis value of the data distribution falls within... , Points outside the range are considered outliers.

[0034] The process of supplementing missing data using linear interpolation includes: when the data missing rate does not exceed 5%, a weighted interpolation method based on the similarity of working conditions is used, and data from points before and after the location to be interpolated and data from similar working conditions in the same historical period are used as compensation sources for interpolation.

[0035] The process of extracting time-series features and operating condition correlation features using the sliding window method also includes: A three-level window mechanism is employed for multi-scale feature extraction, including a 10-second basic analysis window, a 30-second macro-trend window, and a 2-second micro-transient window. The time-series features include improved fluctuation energy entropy, adaptive peak factor, and trend stability index. The formula for calculating fluctuation energy entropy is as follows:

[0036] in, The energy entropy of fluctuations is used to quantify the complexity of data fluctuations. The number of subbands represents the total number of bands into which the data is decomposed. The energy percentage of the i-th sub-band is calculated using the following formula: ,in Let be the wavelet energy value of the i-th sub-band.

[0037] The operating condition correlation feature is obtained by calculating the dynamic condition mutual information and the operating condition coupling coefficient between the operating condition data and the measuring point data. The formula for calculating the operating condition coupling coefficient is as follows:

[0038] in, The operating condition coupling coefficient measures the strength of the correlation between load level and characteristic value. The covariance between load level and eigenvalue; The standard deviation of the load level and the characteristic value; This is a scaling parameter used to control the steepness of the logistic function; This is the real-time load level value. The baseline load level is typically 50% of the rated load. Finally, features are selected from the initial features using the maximum correlation minimum redundancy feature selection algorithm, and the feature dimensions are constructed into 128 dimensions through feature interaction, nonlinear transformation and time-series difference processing.

[0039] In this embodiment, it should be specifically explained that the specific operation of classifying fault types into mechanical faults, electrical faults, or communication faults using the XGBoost model in the integrated diagnostic model module is as follows: First, the feature importance of the input 128-dimensional feature vector is evaluated based on contribution weights, which is achieved through Shapley value calculation. The calculation formula is as follows:

[0040] in, This represents the Shapley value of the i-th feature, used to quantify the contribution of that feature to the model output; Represents the complete set of features; Represents a subset of features; Represents the model's prediction function; Indicates the size of subset S; This represents the total number of features; this formula ensures that important features receive higher weights, improving the model's sensitivity to key fault symptoms. Then, a loss function with dynamically adjusted class weights is used for model training, and its calculation expression is:

[0041] in, This represents the dynamic weighted cross-entropy loss value; This indicates the total number of fault categories, with a value of 3 (mechanical, electrical, communication). The weight of category c is represented by the formula: ; Indicates the total number of samples; This represents the number of samples in category c; This represents the actual label for category c; This represents the probability that the model predicts category c, in order to address the problem of imbalanced sample sizes for different fault categories. The process of inputting the classification results of the XGBoost model and the ten-second time-series feature sequence into the LSTM model includes: encoding the fault type classification results into a three-dimensional vector, concatenating and fusing it with the time-series feature sequence, and then inputting it into the LSTM network after dimensionality reduction through an embedding layer. The expression is as follows:

[0042] in, This represents the fused embedded feature vector; Indicates the activation function; Represents the weight matrix; Indicates the bias term; This indicates the coarse classification result; Represents a time-series characteristic sequence; This indicates a vector concatenation operation.

[0043] In the integrated diagnostic model module, the specific operation of the LSTM model for accurate location of faulty components is as follows: A multi-head self-attention mechanism is introduced into the LSTM network to calculate the attention weights at different time steps, thereby achieving focused attention at key time points. The calculation formula for the multi-head self-attention mechanism is as follows:

[0044] in, This represents the distribution of attention weights at time step t; Represents the query matrix; This indicates the hidden state of the previous time step; Represents the key matrix; Indicates the dimension of the key vector; The function is a normalized exponential function. Residual connections are added between the layers of the LSTM to avoid the gradient vanishing problem in deep network training. Multi-scale feature extraction of residual connections is achieved through the following formula:

[0045] in, This represents the hidden state of the l-th layer at time step t; This indicates the hidden state of the parent layer; Represents the computation function of an LSTM unit; This represents the weight matrix of the l-th layer; finally, the location confidence is calibrated using a temperature scaling method, which employs the following temperature scaling calibration method:

[0046] in, Indicates the probability after calibration; This represents the model's original output logits for category i; The temperature parameter is obtained by maximizing the log-likelihood of the validation set. This represents an exponential function; and based on evidence theory, the classification results and localization results are fused. The evidence theory fusion adopts Dempster's combination rule:

[0047] in, This represents the basic probability distribution after fusion; This represents the basic probability assignment for coarse classification; This represents the basic probability allocation for precise localization; This represents the Dempster combinatorial operator; a valid diagnostic result is output when the confidence level after fusion is not less than 90%. The final diagnostic result is determined by the following condition: when... If the diagnosis is deemed valid, the diagnosis result tuple is output. The diagnostic results include a fault identifier, the cause of the fault, and the calibrated confidence level.

[0048] In this embodiment, it should be specifically explained that the specific operation of the dynamic early warning threshold in the dynamic early warning threshold scheduling module is as follows: Based on historical normal operation data of the equipment, a fuzzy clustering algorithm is used to identify different operating modes, the expression of which is:

[0049] in, This represents the value of the fuzzy clustering objective function, used to evaluate the clustering effect; Indicates the number of historical data samples; Indicates the number of running modal clusters; Representing data points Belongs to clustering Membership degree; This represents the fuzzy coefficient, used to control the degree of fuzziness in clustering; Indicates the first One historical data sample; Indicates the first Cluster centers; This represents the cluster compactness penalty coefficient; This represents the mean of all cluster centers. The baseline threshold for each modality is calculated using the following expression:

[0050] in, Indicates the first The baseline threshold for each operating mode; Representing modes The median of the data; This represents the sensitivity adjustment coefficient; Representing modes Interquartile range; Representing modes The number of samples. Real-time collection of current load data, quantifying load state transition probabilities using a Hidden Markov Model (HMM). The HMM is as follows:

[0051] in, Indicates at time Load is Every moment Load is The conditional probability; Indicates the standard deviation of load fluctuation; This represents the load autocorrelation coefficient. The nonlinear load influence coefficient is then calculated; the expression for calculating the nonlinear load influence coefficient is:

[0052] in, Indicates the load impact coefficient; This represents the load sensitivity parameter; Indicates the real-time load value; Indicates the rated load value; Indicates the optimal load factor; Indicates the gradient of load change; This represents a time interval. Integrating environmental factor compensation and equipment health status degradation factor, the expression for calculating the equipment health status degradation factor is:

[0053] in, Indicates the factor that diminishes health status; Indicates the cumulative running time; Indicates the design life; Indicates the attenuation coefficient; This represents the number of historical failures. The dynamic early warning threshold is synthesized using a multi-factor coupling formula, expressed as:

[0054] in, Indicates the dynamic early warning threshold; Indicates the load change rate sensitivity coefficient; This represents the instantaneous rate of change of the load. An adaptive Kalman filter is used to smooth the threshold; the expression is:

[0055] in, Indicates time The estimated smoothing threshold; Represents the state transition matrix; Represents the Kalman gain matrix; Represents the observation matrix; Indicates time The dynamic threshold is determined, and transient abnormal fluctuations are suppressed, outputting the final warning threshold.

[0056] In this embodiment, it should be specifically explained that the specific operations of triggering graded early warning, recording the handling log, and updating the model parameters in the closed-loop handling module are as follows: Based on the confidence level of the diagnostic results and the preset fault impact factors, a severity score is obtained through weighted calculation. The severity score calculation formula is as follows:

[0057] in, The severity score quantifies the urgency of the fault, while the confidence weighting coefficient represents the degree of confidence. The value range is 0.5-0.8. This represents the fusion confidence level in the diagnostic results, with a value range of [0,1]. This represents the weighting coefficient of the influence factor. This indicates the sensitivity adjustment parameter. This represents a preset fault impact factor, with different values ​​set according to the fault type. Based on the severity score and the comparison results of the fault impact factor with the preset threshold, the final warning level is determined through fuzzy reasoning. The warning level decision rule is as follows:

[0058] in, Indicates the warning level. This represents the severity threshold for a Level 1 warning, with a value ranging from 0.85 to 0.95. This indicates the severity threshold for a Level 2 warning, with a value ranging from 0.65 to 0.75. This represents the threshold value for the impact factor of the Level 1 early warning, ranging from 0.6 to 0.8. This represents the threshold for the impact factor of a Level 2 early warning, ranging from 0.4 to 0.6. An information entropy-based compression algorithm is used to encode the log fields, forming structured log entries containing fault identifiers, handling actions, timestamps, and entropy values. The formula for calculating log information entropy is:

[0059] in, This represents the log information entropy value, used to quantify the complexity of log information. Indicates the number of log fields. This represents the probability of the i-th field value occurring. Training samples are extracted from the disposal logs monthly, and the importance weights of the samples are adjusted using a time-decay weighted sampling method. Regularized weighted incremental learning updates are then performed on both the XGBoost and LSTM models, respectively.

[0060] Example 2 This embodiment provides, for example Figure 1 The present invention discloses a method for intelligent fault diagnosis and dynamic early warning of SCADA system, comprising the following steps: S1. During SCADA system operation, equipment measurement point data, operating condition data and environmental data are collected synchronously with a sampling period of 50-100ms. Equipment measurement point data includes current, temperature and vibration, operating condition data includes load level and operating mode, and environmental data includes temperature, humidity and wind speed. The equipment measurement point data, operating condition data and environmental data are stored in a standardized data mart in the form of "measurement point ID + timestamp" as a dual primary key. S2. After obtaining data from the data mart, outlier removal is first performed using the 3σ criterion, and missing data with a missing rate of no more than 5% are supplemented using linear interpolation. Then, a sliding window method with a window size of 10 seconds is used to extract time-series features and load condition correlation features from the preprocessed data. The time-series features include mean, variance, and peak factor. The load condition correlation features are obtained by calculating the Pearson correlation coefficient between the load level and the key measurement point data. Finally, the extracted features are constructed into a 128-dimensional feature vector. S3. Receive a 128-dimensional feature vector and first classify the fault type into mechanical fault, electrical fault, or communication fault through the XGBoost model. Then, input the classification result of the XGBoost model and the 10-second time series feature sequence into the LSTM model to accurately locate the faulty component. Finally, output the diagnostic result containing the fault ID, fault cause, and confidence level. When the confidence level is not lower than 90%, it is judged as a valid diagnosis. S4. Based on the diagnostic results, calculate the dynamic early warning threshold using the baseline threshold calculated from historical normal operation data and the load level coefficient determined by the real-time load level. The baseline threshold is the mean of historical normal operation data plus three times the standard deviation. The load level coefficient is divided into light load (0.2), medium load (0.5), and heavy load (0.8) based on the ratio of the real-time load value to the rated load value. S5. Based on the type and severity of the diagnostic results, trigger a tiered warning system, such as a Level 1 emergency shutdown warning, a Level 2 maintenance and repair warning, or a Level 3 attention reminder, and push the warning information to the monitoring terminal. At the same time, record the handling log, which includes the fault ID, handling action, and timestamp. The handling log is used as a new training sample every month to update the parameters of the XGBoost model and LSTM model.

[0061] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0062] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0063] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0064] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0065] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0066] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0067] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A SCADA system fault intelligent diagnosis and dynamic early warning system, characterized in that, It includes a multi-source data fusion acquisition module, a feature extraction engine module, an integrated diagnostic model module, a dynamic early warning threshold scheduling module, and a closed-loop processing module; The multi-source data fusion acquisition module synchronously acquires equipment measurement point data, operating condition data, and environmental data at a sampling period of 50-100ms during SCADA system operation. Equipment measurement point data includes current, temperature, and vibration; operating condition data includes load level and operating mode; and environmental data includes temperature, humidity, and wind speed. The equipment measurement point data, operating condition data, and environmental data are stored in a standardized data mart in the form of "measurement point ID + timestamp" as a dual primary key. The feature extraction engine module, after acquiring data from the data mart, first uses the 3σ criterion to remove outliers and then uses linear interpolation to fill in missing data with a missing rate of no more than 5%. Then, it uses a sliding window method with a window size of 10 seconds to extract time-series features and load condition-related features from the preprocessed data. The time-series features include mean, variance, and peak factor. The load condition-related features are obtained by calculating the Pearson correlation coefficient between the load level and the key measurement point data. Finally, the extracted features are constructed into a 128-dimensional feature vector. The integrated diagnostic model module receives a 128-dimensional feature vector and first classifies the fault type into mechanical fault, electrical fault, or communication fault through the XGBoost model. Then, the classification result of the XGBoost model and the 10-second time-series feature sequence are input into the LSTM model to accurately locate the faulty component. Finally, the diagnostic result containing the fault ID, fault cause, and confidence level is output. When the confidence level is not lower than 90%, it is judged as a valid diagnosis. The dynamic early warning threshold scheduling module calculates the dynamic early warning threshold based on the diagnostic results, the baseline threshold calculated from historical normal operation data, and the load level coefficient determined by the real-time load level. The baseline threshold is the mean of historical normal operation data plus three times the standard deviation. The load level coefficient is divided into light load 0.2, medium load 0.5, and heavy load 0.8 according to the ratio of real-time load value to rated load value. The closed-loop handling module triggers tiered warnings—Level 1 emergency shutdown warning, Level 2 maintenance and repair warning, or Level 3 attention reminder—based on the type and severity of the diagnostic results. It also pushes the warning information to the monitoring terminal and records handling logs containing fault IDs, handling actions, and timestamps. The handling logs are used monthly as new training samples to update the parameters of the XGBoost and LSTM models.

2. The SCADA system fault intelligent diagnosis and dynamic early warning system according to claim 1, characterized in that: In the multi-source data fusion acquisition module, the specific operations for synchronous acquisition and timestamp alignment are as follows: When the system reaches the preset start point of the acquisition cycle, it controls the edge acquisition terminal to acquire device measurement point data, operating condition data and environmental data in parallel, and adds an original timestamp generated by the acquisition terminal to each acquired data point; Subsequently, time delay compensation is performed on the original timestamp. Time delay compensation is achieved by superimposing a fixed transmission delay value determined in advance through the delay calibration of each communication path, thereby assigning a unified and precise aligned timestamp to all data points.

3. The SCADA system fault intelligent diagnosis and dynamic early warning system according to claim 2, characterized in that: After obtaining the precisely aligned timestamps, the following steps are also required: First, a confidence weight factor is calculated for each data point, with a value ranging from zero to one. The calculation process for the confidence weight factor is as follows: an exponential growth function with a base of the natural constant is used to process the data quality code determined by the hardware status of the acquisition device to obtain an initial weight value. Then, this initial weight value is multiplied by a linear decay term based on instantaneous gradient anomaly to obtain the final confidence weight factor. Instantaneous gradient anomaly is the ratio of the absolute difference between the physical parameter value corresponding to the current data point and the value of the previous time series point to the normal rate of change threshold preset by the system for the physical parameter. Secondly, using the measurement point identifier and the precise alignment timestamp as the association key, multiple data points pointing to the same physical entity within a small time tolerance window are fused. During fusion, a weighted average is calculated based on their respective credibility weight factors to generate a fused data record. Finally, the merged data records are stored in a standardized data mart.

4. The SCADA system fault intelligent diagnosis and dynamic early warning system according to claim 3, characterized in that: In the feature extraction engine module, the specific operation of outlier removal using the 3σ criterion is as follows: First, calculate the upper and lower quartiles and interquartile range of the data within the window. Then, dynamically calculate the adaptive adjustment coefficient based on the kurtosis of the data distribution. Next, use the adaptive adjustment coefficient and the interquartile range to determine the dynamic outlier judgment threshold. Finally, remove data points that fall outside the dynamic outlier judgment threshold range. The process of supplementing missing data using linear interpolation includes: when the data missing rate does not exceed 5%, a weighted interpolation method based on the similarity of working conditions is used, and data from points before and after the location to be interpolated and data from similar working conditions in the same historical period are used as compensation sources for interpolation.

5. The SCADA system fault intelligent diagnosis and dynamic early warning system according to claim 4, characterized in that: The process of extracting time-series features and operating condition correlation features using the sliding window method also includes: A three-level window mechanism is adopted for multi-scale feature extraction, including a 10-second basic analysis window, a 30-second macro trend window, and a 2-second micro transient window; time-series features include improved fluctuation energy entropy, adaptive peak factor, and trend stability index; operating condition correlation features are obtained by calculating the dynamic condition mutual information and operating condition coupling coefficient between operating condition data and measuring point data; finally, features are selected from the initial features through the maximum correlation minimum redundancy feature selection algorithm, and the feature dimensions are constructed into 128 dimensions through feature interaction, nonlinear transformation, and time-series difference processing.

6. The SCADA system fault intelligent diagnosis and dynamic early warning system according to claim 5, characterized in that: In the integrated diagnostic model module, the specific operation of classifying fault types into mechanical faults, electrical faults, or communication faults using the XGBoost model is as follows: First, the feature importance of the input 128-dimensional feature vector is evaluated based on contribution weight. Then, a loss function with dynamic class weight adjustment is used for model training to solve the problem of imbalance in the number of fault category samples. The process of inputting the classification results of the XGBoost model and the ten-second time-series feature sequence into the LSTM model includes: encoding the fault type classification results into a three-dimensional vector, concatenating and fusing it with the time-series feature sequence, and then inputting it into the LSTM network after dimensionality reduction through the embedding layer.

7. The SCADA system fault intelligent diagnosis and dynamic early warning system according to claim 6, characterized in that: In the integrated diagnostic model module, the specific operation of the LSTM model for accurate location of faulty components is as follows: A multi-head self-attention mechanism is introduced into the LSTM network to calculate the attention weights at different time steps, thereby achieving key focus at critical time points. Residual connections are added between the layers of the LSTM to avoid the gradient vanishing problem in deep network training. Finally, the location confidence is calibrated by the temperature scaling method, and the classification results and location results are fused based on evidence theory. When the confidence after fusion is not less than 90%, a valid diagnostic result is output, which includes the fault identifier, the fault cause, and the calibrated confidence.

8. The SCADA system fault intelligent diagnosis and dynamic early warning system according to claim 7, characterized in that: In the dynamic early warning threshold scheduling module, the specific operation of the dynamic early warning threshold is as follows: Based on the historical normal operation data of the equipment, a fuzzy clustering algorithm is used to identify different operating modes and calculate the baseline threshold for each mode; the current load data is collected in real time, the load state transition probability is quantified through a hidden Markov model, and the nonlinear load influence coefficient is calculated. By integrating environmental factor compensation items and equipment health status degradation factors, a dynamic early warning threshold is synthesized through a multi-factor coupling formula. An adaptive Kalman filter is used to smooth the threshold and suppress transient abnormal fluctuations, and the final warning threshold is output.

9. The SCADA system fault intelligent diagnosis and dynamic early warning system according to claim 8, characterized in that: In the closed-loop handling module, the specific operations for triggering tiered early warnings, recording handling logs, and updating model parameters are as follows: Based on the confidence level of the diagnostic results and the preset fault impact factors, a severity score is obtained through weighted calculation. Based on the comparison results of the severity score and fault impact factors with preset thresholds, the final warning level is determined through fuzzy reasoning. Log fields are encoded using an information entropy-based compression algorithm to form structured log entries containing fault identifiers, handling actions, timestamps, and entropy values. Training samples are extracted from the handling logs monthly, and the importance weights of the samples are adjusted using a time decay weighted sampling method. Regularized weighted incremental learning updates are then performed on the XGBoost model and the LSTM model, respectively.

10. A method for intelligent fault diagnosis and dynamic early warning of SCADA system, characterized in that, The intelligent diagnosis and dynamic early warning method employs the SCADA system fault intelligent diagnosis and dynamic early warning system as described in any one of claims 1-9, and includes the following steps: S1. During SCADA system operation, equipment measurement point data, operating condition data and environmental data are collected synchronously with a sampling period of 50-100ms. Equipment measurement point data includes current, temperature and vibration, operating condition data includes load level and operating mode, and environmental data includes temperature, humidity and wind speed. The equipment measurement point data, operating condition data and environmental data are stored in a standardized data mart in the form of "measurement point ID + timestamp" as a dual primary key. S2. After obtaining data from the data mart, outlier removal is first performed using the 3σ criterion, and missing data with a missing rate of no more than 5% are supplemented using linear interpolation. Then, a sliding window method with a window size of 10 seconds is used to extract time-series features and load condition correlation features from the preprocessed data. The time-series features include mean, variance, and peak factor. The load condition correlation features are obtained by calculating the Pearson correlation coefficient between the load level and the key measurement point data. Finally, the extracted features are constructed into a 128-dimensional feature vector. S3. Receive a 128-dimensional feature vector and first classify the fault type into mechanical fault, electrical fault, or communication fault through the XGBoost model. Then, input the classification result of the XGBoost model and the 10-second time series feature sequence into the LSTM model to accurately locate the faulty component. Finally, output the diagnostic result containing the fault ID, fault cause, and confidence level. When the confidence level is not lower than 90%, it is judged as a valid diagnosis. S4. Based on the diagnostic results, calculate the dynamic early warning threshold using the baseline threshold calculated from historical normal operation data and the load level coefficient determined by the real-time load level. The baseline threshold is the mean of historical normal operation data plus three times the standard deviation. The load level coefficient is divided into light load (0.2), medium load (0.5), and heavy load (0.8) based on the ratio of the real-time load value to the rated load value. S5. Based on the type and severity of the diagnostic results, trigger a tiered warning system, such as a Level 1 emergency shutdown warning, a Level 2 maintenance and repair warning, or a Level 3 attention reminder, and push the warning information to the monitoring terminal. At the same time, record the handling log, which includes the fault ID, handling action, and timestamp. The handling log is used as a new training sample every month to update the parameters of the XGBoost model and LSTM model.

Images