Cross-region fault positioning method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network operation and maintenance, and discloses a cross-region fault positioning method and device, electronic equipment and a storage medium, which are applied to a production control region and a management information region of a new energy centralized control system, the production control region comprises at least two safety regions, and probe devices are deployed in each safety region and each management information region of the new energy centralized control system. The method comprises the following steps: acquiring state index information of a safety area and a management information area through a probe device; packaging the state index information into an intermediate data packet; transmitting the intermediate data packet to a management information area of a centralized control side through a data path of the new energy centralized control system, and storing the intermediate data packet to a time sequence database; and in response to the target fault occurring in the production control area, determining the position of the target fault according to the time sequence database and the topology modeling table. Through the technical scheme of the invention, the problem that the cross-regional fault is difficult to position accurately is solved, and the accuracy of cross-regional fault positioning is improved.

Description

Technical Field

[0001] This application relates to the field of network operation and maintenance technology, specifically to cross-regional fault location methods, devices, electronic equipment, and storage media. Background Technology

[0002] Under network isolation conditions, traditional network layer monitoring protocols fail because they cannot penetrate the isolation device, resulting in blind spots in cross-regional fault monitoring and making it difficult to accurately locate faults. Summary of the Invention

[0003] This application provides a method, apparatus, electronic device, and storage medium for locating cross-regional faults, in order to solve the problem that cross-regional fault monitoring has blind spots and makes it difficult to accurately locate faults in related technologies.

[0004] Firstly, this application provides a cross-regional fault location method applied to the production control area and management information area of ​​a new energy centralized control system. The production control area includes at least two security zones, and adjacent security zones are isolated by a network firewall. The management information area is connected to the production control area via a network gateway. The new energy centralized control system includes a centralized control side and a site side. The production control area on the centralized control side communicates with the production control area on the site side via encrypted communication, and the management information area on the centralized control side is connected to the management information area on the site side via a network. Probe devices are deployed in each security zone and management information area of ​​the new energy centralized control system. The probe devices are used to monitor the status indicators of the security zones and management information areas. The method includes:

[0005] The status indicator information of the security zone and the management information zone is obtained through a probe device; The status indicator information is encapsulated into an intermediate data packet, which supports the communication protocol of the new energy centralized control system. The intermediate data packets are transmitted to the management information area on the central control side through the data path of the new energy central control system and saved to the time series database. The intermediate data packets carry the timestamp of the acquired status indicator information. In response to a target fault occurring in the production control area, the location of the target fault is determined based on the time series database and the topology modeling table. The topology modeling table indicates the level of the monitoring object of the probe device in the safe zone.

[0006] In an optional implementation, before determining the location of the target fault based on the time-series database and topology modeling table in response to a target fault occurring in the production control area, the method further includes: The root node is the location of the probe device in the candidate safety zone. The objects that the probe device can directly monitor in the candidate safety zone are the first-level child nodes. The objects that the probe device can monitor in the first-level child nodes are the second-level child nodes. The probe device continuously monitors until the leaf node is determined. The candidate safety zone is either the production control zone on the centralized control side or the production control zone on the site side. The monitored objects include at least one of the following: equipment, service, link, and data channel. Construct a topology modeling table based on the root node, first-level child nodes, second-level child nodes, and leaf nodes.

[0007] In one optional implementation, the status indicator information is encapsulated into an intermediate data packet, including: Based on the mapping table between status indicators and the fields of the communication protocol of the new energy centralized control system, the data packet consisting of the fields of the communication protocol corresponding to the status indicator information is determined. The mapping table between status indicators and the fields of the communication protocol of the new energy centralized control system indicates that multiple status indicators correspond one-to-one with the fields of the communication protocol of multiple new energy centralized control systems. The heartbeat signal and data packets at the first frequency are used as intermediate data packets.

[0008] In one optional implementation, the intermediate data packet is transmitted to the management information area on the central control side via the data path of the new energy centralized control system, including: If the frequency of the heartbeat signal of the intermediate data packet is detected to be the first frequency, the intermediate data packet is transmitted to the management information area on the central control side through the data path; otherwise, the transmission of the intermediate data packet is suspended.

[0009] In an alternative implementation, the method further includes, prior to a target failure occurring in the production control area: Record the operating data of the probe device and abnormal information in the production control area.

[0010] In one alternative implementation, the location of the target fault is determined based on a time-series database and a topology modeling table, including: Using the first timestamp as the starting point, extract the target data sequence of the first duration from the time series database in chronological order. The first duration is the time length between the first timestamp and the timestamp of the target fault. Based on the target data sequence, node labels are added to the topology modeling table to obtain the target topology map; Nodes in abnormal states in the target topology graph are identified as suspected abnormal nodes; If the number of suspected abnormal nodes is 1, then the location of the suspected abnormal node is taken as the location of the target fault. If the number of suspected abnormal nodes is greater than or equal to 2, the fault level of each node in the suspected abnormal nodes is determined based on the distance between each node in the suspected abnormal nodes and the root node of the target topology graph. The location of the node corresponding to the highest fault level is taken as the location of the target fault. The distance is inversely proportional to the fault level.

[0011] In one alternative implementation, the method further includes: In the topology diagram of the new energy centralized control system, the location of the target fault is marked and displayed; Push the alarm information of the target fault to the alarm handler.

[0012] In one alternative implementation, the method further includes: The target fault is used as the sample data, and the location of the target fault is used as the sample label. Record sample data and sample labels as fault location data; Using fault location data, a fault location model is trained, which maps faults to the locations where they occur.

[0013] In one alternative implementation, after determining the location of the target fault, the method further includes: The health score of the new energy centralized control system is determined based on the fault level of suspected abnormal nodes.

[0014] Secondly, this application provides a cross-regional fault location device applied to the production control area and management information area of ​​a new energy centralized control system. The production control area includes at least two security zones, and adjacent security zones are isolated by a network firewall. The management information area is connected to the production control area via a network gateway. The new energy centralized control system includes a centralized control side and a site side. The production control area on the centralized control side communicates with the production control area on the site side via encrypted communication, and the management information area on the centralized control side is connected to the management information area on the site side via a network. Probe devices are deployed in each security zone and management information area of ​​the new energy centralized control system. The probe devices are used to monitor the status indicators of the security zone and management information area. The cross-regional fault location device includes: The acquisition module is used to acquire status indicator information of the security zone and management information zone through the probe device; The encapsulation module is used to encapsulate status indicator information into intermediate data packets, which support the communication protocol of the new energy centralized control system. The transmission module is used to transmit intermediate data packets to the management information area on the central control side through the data path of the new energy central control system, and save them to the time series database. The intermediate data packets carry a timestamp of the acquired status indicator information. The positioning module is used to determine the location of the target fault in response to the occurrence of a target fault in the production control area, based on the time series database and the topology modeling table. The topology modeling table indicates the level of the monitoring object of the probe device in the safe zone.

[0015] Thirdly, this application provides an electronic device, including: a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to perform the cross-regional fault location method of the first aspect or any corresponding embodiment described above.

[0016] Fourthly, this application provides a computer-readable storage medium storing computer instructions for causing a computer to execute the cross-regional fault location method of the first aspect or any corresponding embodiment described above.

[0017] Fifthly, this application provides a computer program product, including computer instructions for causing a computer to execute the cross-regional fault location method described in the first aspect or any corresponding embodiment.

[0018] This application provides a cross-regional fault location method, which, compared with the prior art, achieves the following beneficial technical effects: This method is applied to the production control area and management information area of ​​a new energy centralized control system. The production control area includes at least two security zones, which are isolated from each other by a network firewall. The management information area is connected to the production control area via a network gateway. The new energy centralized control system includes a centralized control side and a site side. The production control area on the centralized control side communicates with the production control area on the site side via encrypted communication, and the management information area on the centralized control side is connected to the management information area on the site side via a network. Probe devices are deployed in each security zone and management information area of ​​the new energy centralized control system to monitor the status indicators of the security zone and management information area. The method includes: Status indicator information from the safety zone and management information zone is acquired through probe devices, providing comprehensive basic data support for fault location. This status indicator information is encapsulated into intermediate data packets that support the communication protocol of the new energy centralized control system. These packets are adapted for transmitting status indicator information from each zone to the management information zone, facilitating cross-zone monitoring data transmission. The intermediate data packets are transmitted to the management information zone on the centralized control side via the data path of the new energy centralized control system and saved to the time-series database. The intermediate data packets carry a timestamp indicating the acquisition of the status indicator information, enabling the reuse of existing data transmission channels and avoiding obstruction by network isolation strategies between the safety zones and management information zones, thus achieving cross-zone data transmission under network isolation. In response to a target fault occurring in the production control zone, the location of the target fault is determined based on the time-series database and the topology modeling table. The topology modeling table indicates the hierarchy of the monitoring objects of the probe devices in the safety zone. Through analysis of the fault data, precise fault location is obtained. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of a new energy centralized control system according to an embodiment of this application; Figure 2 This is a flowchart of a cross-regional fault location method according to an embodiment of this application; Figure 3 According to an embodiment of this application Figure 1 A schematic diagram of the probe device in the diagram; Figure 4 This is a flowchart of a probe device processing according to an embodiment of this application; Figure 5 This is a functional module structure diagram of a probe device according to an embodiment of this application; Figure 6 This is a flowchart of a fault location and display system according to an embodiment of this application; Figure 7 This is a structural block diagram of a cross-regional fault location device according to an embodiment of this application; Figure 8 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] It is understood that before using the technical solutions disclosed in the various embodiments of this application, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this application in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0023] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0024] In the energy sector, centralized control systems for new energy power plants are crucial for monitoring their operation. For instance, as the core of operation monitoring for new energy power plants, the stable operation of these systems is vital for ensuring plant safety and improving operational efficiency. This system involves key elements such as equipment, services, links, and channels, and is widely deployed across multiple security zones (Zones I, II, and III) on both the power plant and centralized control sides. To meet the security protection requirements of power monitoring systems, a security strategy of "vertical encryption and horizontal isolation" is adopted between zones. The production control zone and the management information zone must be physically isolated through forward isolation devices. This device typically only allows unidirectional transmission of TCP / IP data flow from the production control area to the management information area, and only allows the transmission of a very small amount of data (such as a single byte of specific data) in the reverse direction. This causes traditional network layer monitoring protocols (such as Simple Network Management Protocol (SNMP), Internet Control Message Protocol (ICMP), Transmission Control Protocol Ping (Tcpping)) to fail because they cannot penetrate the isolation device, resulting in a "blind spot" in cross-area fault monitoring.

[0025] The relevant technologies have the following prominent problems: 1. Delayed fault detection: Traditional methods cannot penetrate security isolation devices and cannot perceive the operating status of cross-regional devices, services, links, and channels in real time. Faults are often only discovered after business anomalies occur, lacking proactive early warning capabilities.

[0026] 2. Difficulty in fault location: When a fault occurs, it is difficult for maintenance personnel to quickly determine which security partition, which link, which service, or which data channel the fault point is located in. The location process relies on manual experience, which is time-consuming and inefficient.

[0027] 3. Slow operation and maintenance response: Due to inaccurate positioning and unintuitive information, fault handling relies on multi-party coordination and segmented troubleshooting, which prolongs the system recovery time and affects the stable operation of new energy power plants and power dispatch.

[0028] Therefore, there is an urgent need for a systematic solution that can achieve cross-regional monitoring data transmission and accurate fault location in a strictly isolated network environment.

[0029] As one optional application scenario in the embodiments of this application, such as Figure 1 As shown, the new energy centralized control system includes a production control area and a management information area. The production control area includes four safety zones. The new energy centralized control system includes a centralized control side and a site side. The centralized control side is equipped with safety zone 1, safety zone 2, and management information zone (3). The site side is equipped with safety zone 1, safety zone 2, and management information zone (3).

[0030] The two security zones on the central control side are isolated from each other by a network firewall, as are the two security zones on the site side. The management information zone and the production control zone are connected via a network gateway. The production control zone on the central control side communicates with the production control zone on the site side via encrypted communication. The management information zone on the central control side is connected with the management information zone on the site side via a network. Probe devices are deployed in each security zone and management information zone of the new energy central control system to monitor the status indicators of the security zone and management information zone.

[0031] The production control area, within the new energy centralized control system, is responsible for real-time monitoring, control, and protection of power production operations. It is the core of the power system and has the highest security level. The management information area is responsible for non-real-time business such as power production management and office automation; it does not directly participate in control and has a lower security level than the production control area. The centralized control side refers to the centralized control center side, typically deployed in the power grid dispatch center, responsible for centralized monitoring and management of multiple power plants. The power plant side refers to the field side, such as power plants and substations, responsible for monitoring local power equipment and data acquisition. Security zones are logically defined areas based on the real-time nature and importance of business operations; the production control area is typically divided into Security Zone I, Security Zone II, etc. Probe devices are devices that collect status indicators from each security zone and management information zone.

[0032] According to an embodiment of this application, a cross-regional fault location method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0033] This embodiment provides a cross-regional fault location method, which can be used in the aforementioned new energy centralized control system. Figure 2 This is a flowchart of a cross-regional fault location method according to an embodiment of this application, such as... Figure 2 As shown, the process includes the following steps: Step S201: Obtain status indicator information of the security zone and management information zone through the probe device.

[0034] Specifically, status indicator information refers to data on devices, services, links, and data channels within the security zone and management information zone. Examples include device online status, CPU utilization, memory utilization, link traffic, and data channel availability.

[0035] The probe device collects status indicator information on devices, services, links, and data channels in the security zone and management information zone.

[0036] Step S202: Encapsulate the status indicator information into an intermediate data packet, which supports the communication protocol of the new energy centralized control system.

[0037] Specifically, intermediate data packets refer to the communication protocols supported by the new energy centralized control system. For example, IEC 104, the core communication protocol in the field of power automation developed by the International Electrotechnical Commission (IEC).

[0038] The status indicator information collected by the probe device is adapted to the communication protocol supported by the new energy centralized control system and encapsulated into an intermediate data packet.

[0039] Step S203: The intermediate data packet is transmitted to the management information area of ​​the central control side through the data path of the new energy central control system and saved to the time series database. The intermediate data packet carries a timestamp of the acquired status indicator information.

[0040] Specifically, a time-series database refers to a database that stores intermediate data packets arranged chronologically. After obtaining the intermediate data packets, the existing data pathway of the new energy centralized control system can be used to transmit the intermediate data packets to the management information area on the centralized control side and save them to the time-series database. The intermediate data packets carry a timestamp indicating the acquisition of status indicator information.

[0041] Step S204: In response to a target fault occurring in the production control area, the location of the target fault is determined based on the time series database and the topology modeling table, where the topology modeling table indicates the level of the monitoring object of the probe device in the safety area.

[0042] Specifically, the target fault refers to the fault whose location is to be located. The topology modeling table refers to the hierarchical structure of the objects monitored by the probe device within the safe zone.

[0043] When a target failure occurs in the production control area, the status of each node can be marked in the already constructed topology modeling table based on the status index information of the time series database. This allows for the analysis of nodes exhibiting abnormal states and the determination of the location where the target failure occurred.

[0044] The cross-regional fault location method provided in this embodiment acquires status indicator information from the safety zone and management information zone through a probe device, providing comprehensive basic data support for fault location. The status indicator information is encapsulated into intermediate data packets, which support the communication protocol of the new energy centralized control system. These intermediate data packets are adapted for transmitting status indicator information from each zone to the management information zone, facilitating cross-regional monitoring data transmission. The intermediate data packets are transmitted to the management information zone on the centralized control side through the data path of the new energy centralized control system and saved to the time-series database. The intermediate data packets carry a timestamp indicating the acquisition of the status indicator information, enabling the reuse of the original data transmission channel and avoiding obstruction by network isolation strategies between the safety zones and management information zones, thus achieving cross-regional data transmission under network isolation. In response to a target fault occurring in the production control zone, the location of the target fault is determined based on the time-series database and the topology modeling table. The topology modeling table indicates the hierarchy of the monitoring objects of the probe device in the safety zone. Through analysis of the fault data, accurate fault location is obtained.

[0045] In some optional implementations, the method further includes the following step before step S204: Step S204a: The location of the probe device in the candidate security zone is taken as the root node. The objects that the probe device can directly monitor in the candidate security zone are taken as first-level child nodes. The objects that can be monitored by the probe device in the first-level child nodes are taken as second-level child nodes. The probe device continuously monitors until the leaf node is determined. The candidate security zone is either the production control zone on the centralized control side or the production control zone on the site side. The monitored objects include at least one of the following: equipment, service, link, and data channel.

[0046] Specifically, a candidate safety zone refers to any one of the safety zones in the production control area on both the central control side and the site side. The monitored object is the object monitored by the probe device, including any one of the following: equipment, services, links, and data channels. A first-level child node is a child node extending from the root node. A second-level child node is a child node extending from the first-level child node. A leaf node is the node at the very end of the topology, which cannot extend to the next level of child nodes.

[0047] In one possible implementation, the location of the probe device in the candidate safe zone is taken as the root node, the objects that the probe device can directly monitor in the candidate safe zone are taken as first-level child nodes, and the objects that can be monitored by the probe device after the first-level child nodes are taken as second-level child nodes. This process continues to probe the child nodes of the upper-level nodes until the objects monitored by the probe device are leaf nodes.

[0048] Step S204b: Construct a topology modeling table based on the root node, first-level child nodes, second-level child nodes, and leaf nodes.

[0049] Specifically, based on the root node, first-level child node, second-level child node, and leaf node obtained in each security zone according to the above steps, a topology modeling table is constructed according to the hierarchy.

[0050] It should be noted that the topology modeling table can consist of only a root node and first-level child nodes, or it can consist of a root node, first-level child nodes, second-level child nodes, or it can consist of multiple levels of child nodes (root node, first-level child nodes, second-level child nodes, third-level child nodes, etc.) and leaf nodes. This application does not impose a limit on the number of levels of child nodes.

[0051] In some optional implementations, step S202 above includes the following steps: Step S2021: Based on the mapping table between status indicators and the fields of the communication protocol of the new energy centralized control system, determine the data packet composed of the fields of the communication protocol corresponding to the status indicator information. The mapping table between status indicators and the fields of the communication protocol of the new energy centralized control system indicates that multiple status indicators correspond one-to-one with the fields of the communication protocol of multiple new energy centralized control systems. Specifically, the mapping table between status indicators and fields of the communication protocol of the new energy centralized control system refers to a data table or database that stores the fields that map status indicators to the communication protocol of the new energy centralized control system. Fields of the communication protocol of the new energy centralized control system include channel IP address, channel number, common body address, information body address, remote signaling point or telemetry point, and information object value, etc.

[0052] Based on the mapping table between status indicators and the fields of the communication protocol of the new energy centralized control system, the data packets consisting of the fields of the communication protocol corresponding to the status indicator information can be indexed.

[0053] Step S2022: Use the heartbeat signal and data packet of the first frequency as intermediate data packets.

[0054] Specifically, the heartbeat signal refers to the working status identifier reserved for the probe device in the data packet of the communication protocol of the new energy centralized control system. The first frequency is the transmission frequency of the heartbeat signal.

[0055] The heartbeat signal of the first frequency is integrated with the data packet into a data packet that matches the communication protocol of the new energy centralized control system as an intermediate data packet.

[0056] In some optional implementations, in conjunction with step S2022, step S203 includes: If the frequency of the heartbeat signal of the intermediate data packet is detected to be the first frequency, the intermediate data packet is transmitted to the management information area on the central control side through the data path; otherwise, the transmission of the intermediate data packet is suspended.

[0057] Specifically, if the frequency of the heartbeat signal of the intermediate data packet detected in the management information area is the first frequency, it means that the frequency of the received heartbeat signal is consistent with the frequency of the heartbeat signals of the intermediate data packets sent by each security area. In this case, the intermediate data packet is transmitted to the management information area on the central control side through the original data path of the new energy centralized control system. If the frequency of the heartbeat signal of the intermediate data packet detected in the management information area is not the first frequency, it means that the frequency of the heartbeat signal received in the management information area is inconsistent with the frequency of the heartbeat signals of the intermediate data packets sent by each security area. This indicates that there is an anomaly in the data transmission link of the intermediate data packet or in the intermediate data packet itself. In this case, the transmission of the intermediate data packet is suspended to avoid the accumulation of erroneous data.

[0058] In this embodiment, the working status of the probe device is known through the heartbeat signal. If the heartbeat signal is normal, the probe device is online and can send intermediate data packets normally. Otherwise, the probe device is offline and data transmission is suspended.

[0059] In some alternative implementations, step S204, prior to a target failure occurring in the production control area, further includes: Record the operating data of the probe device and abnormal information in the production control area.

[0060] Specifically, before reporting a fault, record the operating data of the probe device and any abnormal program execution in each safety zone of the production control area to facilitate problem diagnosis.

[0061] In some optional implementations, step S204 involves determining the location of the target fault based on the time-series database and the topology modeling table, including: Step S2041: Using the first timestamp as the starting time, extract the target data sequence of the first duration from the time series database in chronological order. The first duration is the time length between the first timestamp and the timestamp of the target fault.

[0062] Specifically, the target data sequence refers to the status indicator information extracted from the time series database from the time segment preceding the occurrence of the target fault to the moment the target fault occurs. The first timestamp refers to the start time of this time segment. The first duration refers to the duration from the first timestamp to the timestamp at which the target fault occurs.

[0063] Using the first timestamp as the starting moment, the target data sequence of the first duration is extracted from the time series database according to the chronological order.

[0064] Step S2042: Based on the target data sequence, label the nodes in the topology modeling table to obtain the target topology map.

[0065] Specifically, the target topology graph refers to the topology graph formed by the nodes generated in the topology modeling table based on the target data sequence and the connections between the nodes.

[0066] Based on the time-ordered state indicator data recorded in the target data sequence, nodes are labeled in the topology modeling table. Nodes that are working normally as reflected by the state indicator data are labeled as normal states, and nodes that show abnormal data as reflected by the state indicator data are labeled as abnormal states.

[0067] Step S2043: Identify nodes in abnormal states in the target topology graph as suspected abnormal nodes.

[0068] Specifically, suspected abnormal nodes refer to nodes that may be abnormal or faulty.

[0069] Nodes marked as abnormal in the target topology graph are considered as suspected abnormal nodes.

[0070] In one possible implementation, suspected abnormal nodes in the target topology graph can be identified by comparing the changes in nodes within the first time period.

[0071] Step S2044: If the number of suspected abnormal nodes is 1, then the location of the suspected abnormal node is taken as the location of the target fault.

[0072] Specifically, if there is only one suspected abnormal node, then the location of the suspected abnormal node will be taken as the location of the target fault.

[0073] Step S2045: If the number of suspected abnormal nodes is greater than or equal to 2, then the fault level of each node in the suspected abnormal nodes is determined according to the distance between each node in the suspected abnormal nodes and the root node of the target topology graph. The location of the node corresponding to the highest fault level is taken as the location of the target fault. The distance is inversely proportional to the fault level.

[0074] Specifically, if the number of suspected anomalous nodes is greater than or equal to 2, it indicates the existence of multiple anomalous nodes. Then, the distance between each suspected anomalous node and the root node is calculated; the closer the distance, the higher the fault level. The location corresponding to the highest fault level is taken as the location of the target fault.

[0075] This implementation method locates the target fault in the target topology map determined by the status index information, and quickly obtains the accurate fault location.

[0076] In some alternative implementations, the method further includes: Step a1: In the topology diagram of the new energy centralized control system, mark and display the location of the target fault.

[0077] Step a2: Push the alarm information of the target fault to the alarm handler.

[0078] Specifically, alarm information refers to information indicating the discovery or urgent handling of a target fault. The alarm handler refers to the personnel responsible for operating and maintaining the new energy centralized control system.

[0079] In the topology diagram of the new energy centralized control system, the location of the target fault is marked and displayed. This improves the efficiency of fault analysis and provides a more intuitive understanding of the target fault location. Simultaneously, alarm information for the target fault is pushed to the alarm handler to quickly notify them to address the fault promptly, thereby improving the efficiency of fault handling.

[0080] In some alternative implementations, the method further includes: Step b1: Use the target fault as sample data and the location of the target fault as the sample label; Step b2: Record the sample data and sample labels as fault location data; Step b3: Use the fault location data to train the fault location model. The fault location model is used to map the fault to the location where the fault occurred.

[0081] Specifically, fault location data refers to a dataset used for fault location, which is a combination of sample data consisting of fault codes of the target fault and sample labels consisting of location data of the target fault. A fault location model refers to an algorithm that maps the location of a fault based on fault information, such as a deep neural network algorithm.

[0082] In the ongoing work of the fault location method in this application, the obtained target fault is used as sample data, the location corresponding to the target fault is used as sample label, and the sample data and sample label are recorded as samples. A large number of samples are collected to form fault location data. Using the fault location data, a fault location model is trained, and then the location of the fault can be directly predicted based on fault information (such as fault codes).

[0083] In some optional implementations, after determining the location of the target fault in S204, the method further includes: determining the health score of the new energy centralized control system based on the fault level of the suspected abnormal node.

[0084] Specifically, the health score refers to a quantitative assessment value for evaluating the operational health status of a new energy centralized control system.

[0085] After determining the location of the target fault, a health score is calculated for the new energy centralized control system based on the fault level of suspected abnormal nodes. This shifts the operation and maintenance model of the new energy centralized control system from reactive handling to proactive prevention.

[0086] Figure 3 According to an embodiment of this application Figure 1 A schematic diagram of the probe device in the image. Figure 3 As shown, the probe device includes an initialization module, a status monitoring module, a data encapsulation module, a configuration management module, a heartbeat module, and a logging module. Each module is described below: 1. Initialize the module and runtime environment. Obtain the monitoring object status indicator configuration information, monitoring method configuration information, and data acquisition service configuration information from the configuration file. The main fields of the monitoring object status indicator configuration information are shown in Table 1. Table 1. Configuration Information of Status Indicators for Monitored Objects

[0087] The main fields of the monitoring method configuration information are shown in Table 2. Table 2 Monitoring Method Configuration Table

[0088] Explain the main meanings of the values ​​in the "Monitoring Object" field of this table: The equipment mainly includes: vertical encryption, routers, switches, servers, data acquisition devices, etc. The links mainly include: dedicated power lines, dedicated lines from operators, and local area network links; The services mainly include: business systems, application services, databases, middleware, etc. The channels mainly include: data transmission channels between the data acquisition device and the power generation equipment and system of the monitored electric field.

[0089] 2. Status monitoring module: This module monitors the status indicators of the objects as needed and periodically obtains status indicator data according to the configured "monitoring method".

[0090] 3. Data Encapsulation Module: This is the core module, responsible for converting the status index data of multi-source monitoring objects into IEC104 protocol information objects. The conversion mapping relationship is shown in Table 3, and the data is encapsulated into a unified IEC protocol data packet.

[0091] Table 3 Mapping Relationship between Monitoring Indicators and IEC104 Information Objects

[0092] 4. Configuration Management Module: This module mainly performs add, delete, modify, and query operations on the configuration information of the status indicators of the monitored objects and the configuration information of the data acquisition service.

[0093] 5. Heartbeat module: This module mainly reports the operation of the probe device to the centralized control management information area fault location and display system.

[0094] 6. Log module: This module mainly records the key states of the probe device during startup and operation, as well as information on handling abnormalities, so as to troubleshoot problems with the probe device after they occur.

[0095] Figure 4 This is a flowchart of a probe device processing according to an embodiment of this application. Figure 4As shown, after the probe device starts, the initialization module prepares the operating environment, reading the status indicator configuration information of the monitored object from the configuration file. This configuration information mainly includes: indicator code, monitored object code, monitored object IP address, service port, SNMP OID, Public, and monitoring interval. The configuration information varies depending on the monitored indicator code, and the required configuration information for each monitored indicator code is shown in Table 1. The module also reads the data acquisition service configuration information from the configuration file, which mainly includes: the data acquisition device IP address and service port. Based on the monitored object status indicator configuration information, the status monitoring module periodically acquires indicator status data according to the monitoring interval. The monitoring method for each indicator is configured and executed according to the "Monitoring Method" field in Table 2. After obtaining the status data, it is converted or transformed according to the format requirements of the "Data Type" field in Table 2. The data encapsulation module encapsulates the acquired monitoring object status data into IEC104 protocol data packets according to the IEC104 protocol format requirements. Based on the numerical type of the monitoring object status index data (e.g., boolean type, IEC104 data packet type identifier is set to remote signaling; int type, it is set to telemetry), the module sets the IEC104 data packet common address to the monitoring object code and the IEC104 data packet information body address to the monitoring index code, using the monitoring object code + monitoring index code to identify its global uniqueness. According to the data acquisition service configuration information, the data encapsulation module sends the encapsulated IEC104 protocol data packets to the data acquisition device, which then aggregates the data through the centralized control system's data acquisition path to the centralized control side management information area and saves it to the time-series database. The heartbeat module sends a heartbeat signal to the fault location and display system every 30 seconds, indicating that the probe device is operating normally; otherwise, it indicates offline operation. The heartbeat signal is encapsulated in an IEC104 data packet. The fields of this IEC104 data packet are set as follows: type identifier is remote signaling, common address is the probe device code, and information body address is 9999. The heartbeat data packet is sent in the same way as the data acquisition path of the centralized control system, which aggregates to the management information area on the centralized control side. The log module is responsible for recording the probe device's startup, operation status, and abnormal program execution conditions to facilitate problem diagnosis.

[0096] Figure 5 This is a functional module structure diagram of a probe device according to an embodiment of this application. Figure 5 As shown, the fault location and display system mainly consists of an initialization module, a fault location module, a topology modeling module, a configuration display module, an alarm notification module, and a system configuration module. The details of each module are as follows: 1. Initialization Module: Initializes the runtime environment and loads configuration information (monitoring objects, monitoring indicators, topology modeling, alarm receivers, etc.) from the relational database. The configuration information and data structure of the monitoring objects are shown in Table 4.

[0097] Table 4 Monitoring Objects

[0098] The configuration information and data structure of the status indicators of the monitored objects are shown in Table 5.

[0099] Table 5 Status Indicators of Monitored Objects

[0100] The topology modeling configuration information and data structure are shown in Table 6.

[0101] Table 6 Topology Modeling Table for Monitored Objects

[0102] 2. Fault Location Module: This module implements a fault merging and location algorithm based on topology hierarchy and is the core module of the system. The key points of the algorithm are as follows: It reads the latest monitoring object indicator status data from the time series database and combines it with topology modeling information to accurately locate the fault and generate fault alarm information, such as whether the online status of the device, service, or channel is abnormal. The smaller the level number, the higher the priority. That is, when an object at level 1 is abnormal, it is taken as the primary suspected object during fault location, rather than objects at higher levels below it.

[0103] 3. Topology Modeling Module: In each security zone on the central control side and the site side, the probe device is used as the root node (level 0). The objects monitored in the security zone are hierarchically sorted out. Objects that can be directly monitored (without other monitored objects in the access link) are level 1, objects that need to be monitored through a monitored object are level 2, and so on until the hierarchical relationship of all monitored objects in the security zone is sorted out and a topology modeling table is formed. The table structure is shown in Table 6.

[0104] 4. Configuration Display Platform: Based on the deployment of the centralized control system on the central control side and the site side, a configuration diagram is constructed using configuration tools. The graphical elements of the configuration diagram are associated with the indicators (measuring points) of the monitoring objects, realizing the dynamic and intuitive association of real-time monitoring data and fault location results, and providing panoramic visualization.

[0105] 5. Alarm Notification Module: Receives alarm information generated by the fault location module and pushes it to the alarm recipient.

[0106] 6. System Configuration Module: This module is mainly used to manage and maintain the monitored objects, their indicators, topology modeling, and topology diagrams, as well as to set alarm thresholds and alarm recipients.

[0107] Figure 6 This is a flowchart illustrating a fault location and display system according to an embodiment of this application. Figure 6 As shown, the detailed steps of the fault location and display system are as follows: Step S1: Initialize the runtime environment and load configuration information (monitoring objects, monitoring object status indicators, topology modeling, alarm receivers, etc.) from the relational database.

[0108] Step S2: The topology modeling module constructs the hierarchical relationship of the monitoring objects in each safety zone based on the information in the topology modeling table (the table structure is shown in Table 3), so as to provide a basis for subsequent fault location.

[0109] Step S3: Obtain the latest monitoring object indicator status data from the time series database, perform fault analysis and diagnosis based on indicator code and threshold configuration information. If the indicator code is 1002 (CPU utilization), 1003 (memory utilization), 1004 (storage utilization), or 2002 (link traffic), perform threshold judgment. If the threshold is exceeded, issue a fault alarm.

[0110] Step S4: If the indicator code is 1001 (online or offline), 2001 (UP / DOWN), 3001 (online or offline), or 4001 (available or unavailable), then based on the topology modeling information of the monitored object to which the indicator belongs, only the monitoring object indicator with the smallest hierarchical number on the abnormal link is alarmed, and fault alarm merging and fault precise location are performed.

[0111] Step S5: Push the alarm information results from steps S3 and S4 to the configuration display module. This module changes the color of the corresponding monitored object to clearly show the object and location of the fault.

[0112] Step S6: Push the alarm information from steps S3 and S4 to the alarm recipient so that the problem can be handled as soon as possible.

[0113] This embodiment also provides a cross-regional fault location device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0114] This embodiment provides a cross-regional fault location device applied to the production control area and management information area of ​​a new energy centralized control system. The production control area includes at least two security zones, and adjacent security zones are isolated by a network firewall. The management information area is connected to the production control area via a network gateway. The new energy centralized control system includes a centralized control side and a site side. The production control area on the centralized control side communicates with the production control area on the site side via encrypted communication. The management information area on the centralized control side is connected to the management information area on the site side via a network. Probe devices are deployed in each security zone and management information area of ​​the new energy centralized control system. The probe devices are used to monitor the status indicators of the security zone and management information area, such as... Figure 7 As shown, the cross-regional fault location device includes: The acquisition module 701 is used to acquire status indicator information of the security area and the management information area through the probe device; Encapsulation module 702 is used to encapsulate status indicator information into intermediate data packets, which support the communication protocol of the new energy centralized control system. The transmission module 703 is used to transmit intermediate data packets to the management information area of ​​the central control side through the data path of the new energy central control system, and save them to the time series database. The intermediate data packets carry a timestamp of the acquired status indicator information. The positioning module 704 is used to determine the location of the target fault in response to the occurrence of a target fault in the production control area, based on the time series database and the topology modeling table, which indicates the hierarchy of the monitoring objects of the probe device in the safety area.

[0115] In some alternative implementations, before determining the location of the target fault based on a time-series database and a topology modeling table in response to a target fault occurring in the production control area, the positioning module 704 further includes: The node determination unit is used to take the location of the probe device in the candidate safety zone as the root node, the objects that the probe device can directly monitor in the candidate safety zone as first-level child nodes, and the objects that the probe device can monitor in the first-level child nodes as second-level child nodes. The probe device continuously monitors until the leaf node is determined. The candidate safety zone is either the production control zone on the centralized control side or the production control zone on the site side. The monitored objects include at least one of the following: equipment, service, link, and data channel. The topology modeling table construction unit is used to construct a topology modeling table based on the root node, first-level child nodes, second-level child nodes, and leaf nodes.

[0116] In some alternative implementations, the encapsulation module 702 includes: The mapping unit is used to determine the data packet consisting of the fields of the communication protocol corresponding to the status indicator information based on the mapping table between the status indicators and the fields of the communication protocol of the new energy centralized control system. The mapping table between the status indicators and the fields of the communication protocol of the new energy centralized control system indicates that multiple status indicators correspond one-to-one with the fields of the communication protocol of multiple new energy centralized control systems. The intermediate data packet determination unit is used to determine the heartbeat signal and data packets at the first frequency as intermediate data packets.

[0117] In some alternative implementations, the transmission module 703 includes: The transmission unit is used to transmit the intermediate data packet to the management information area on the central control side through the data path if the frequency of the heartbeat signal detected in the intermediate data packet is the first frequency; otherwise, it suspends the transmission of the intermediate data packet.

[0118] In some alternative implementations, the positioning module 704 further includes, prior to a target fault occurring in the production control area: The information recording unit is used to record the operating data of the probe device and abnormal information in the production control area.

[0119] In some alternative implementations, the positioning module 704 includes: The data extraction unit is used to extract a target data sequence of a first duration from the time series database in chronological order, starting from the first timestamp. The first duration is the time length between the first timestamp and the timestamp of the target fault. The target topology map determination unit is used to label nodes in the topology modeling table based on the target data sequence to obtain the target topology map; The suspected abnormal node determination unit is used to identify nodes in an abnormal state in the target topology graph as suspected abnormal nodes. The first positioning unit is used to take the location of the suspected abnormal node as the location of the target fault if the number of suspected abnormal nodes is 1. The second positioning unit is used to determine the fault level of each node in the suspected abnormal nodes based on the distance between each node in the suspected abnormal nodes and the root node of the target topology if the number of suspected abnormal nodes is greater than or equal to 2, and take the position of the node corresponding to the highest fault level as the position of the target fault, wherein the distance is inversely proportional to the fault level.

[0120] In some alternative embodiments, the apparatus further includes: The display module is used to mark and display the location of the target fault in the topology diagram of the new energy centralized control system; The push module is used to push alarm information of the target fault to the alarm handler.

[0121] In some alternative embodiments, the apparatus further includes: The sample creation unit is used to take the target fault as sample data and the location of the target fault as the sample label. The fault location data determination unit is used to record sample data and sample labels as fault location data. The fault location model training unit is used to train a fault location model using fault location data. The fault location model is used to map faults to the locations where the faults occur.

[0122] In some alternative implementations, after the positioning module 704, the following is also included: The health scoring module is used to determine the health score of the new energy centralized control system based on the fault level of suspected abnormal nodes.

[0123] The cross-regional fault location device provided in this application can execute the cross-regional fault location method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects for executing the method. Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0124] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0125] The following is a detailed reference. Figure 8 The diagram illustrates a structural schematic suitable for implementing the electronic device described in the embodiments of this application. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 801, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 802 or a program loaded from memory 808 into random access memory (RAM) 803. The RAM 803 also stores various programs and data required for the operation of the electronic device. The processor 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0126] Typically, the following devices can be connected to I / O interface 805: input devices 806 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 807 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 808 including, for example, magnetic tapes, hard disks, etc.; and communication devices 809. Communication device 809 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 8 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0127] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 809, or installed from a memory 808, or installed from a ROM 802. When the computer program is executed by the processor 801, it performs the functions defined in the cross-regional fault location method of embodiments of this application.

[0128] Figure 8The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0129] This application also provides a computer-readable storage medium. The methods described in this application can be implemented in hardware or firmware, or implemented as recordable on a storage medium, or implemented as computer code downloaded over a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the cross-regional fault location method shown in the above embodiments is implemented.

[0130] A portion of this application can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to this application through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0131] Although embodiments of this application have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of this application, and all such modifications and variations fall within the scope defined by the appended claims.

Claims

1. A method for locating cross-regional faults, characterized in that, An application is made to the production control area and management information area of ​​a new energy centralized control system. The production control area includes at least two security zones, which are isolated from adjacent security zones by a network firewall. The management information area is connected to the production control area via a network gateway. The new energy centralized control system includes a centralized control side and a site side. The production control area on the centralized control side communicates with the production control area on the site side via encrypted communication. The management information area on the centralized control side is connected to the management information area on the site side via a network. Probe devices are deployed in each security zone and management information area of ​​the new energy centralized control system to monitor the status indicators of the security zone and the management information area. The method includes: The probe device is used to acquire status indicator information of the security zone and the management information zone; The status indicator information is encapsulated into an intermediate data packet, and the intermediate data packet supports the communication protocol of the new energy centralized control system. The intermediate data packet is transmitted to the management information area of ​​the central control side through the data path of the new energy central control system and saved to the time series database. The intermediate data packet carries a timestamp of the acquisition of the status indicator information. In response to a target fault occurring in the production control area, the location of the target fault is determined based on the time-series database and the topology modeling table, wherein the topology modeling table indicates the level of the monitoring object of the probe device in the safety zone.

2. The method according to claim 1, characterized in that, Before determining the location of the target fault based on the time-series database and topology modeling table in response to a target fault occurring in the production control area, the method further includes: The root node is the location of the probe device in the candidate safety zone. The objects that the probe device can directly monitor in the candidate safety zone are the first-level child nodes. The objects that the probe device can monitor in the first-level child nodes are the second-level child nodes. The probe device continuously monitors until a leaf node is determined. The candidate safety zone is either the production control zone on the centralized control side or the production control zone on the site side. The monitored objects include at least one of equipment, service, link, and data channel. The topology modeling table is constructed based on the root node, the first-level child nodes, the second-level child nodes, and the leaf nodes.

3. The method according to claim 1, characterized in that, The step of encapsulating the status indicator information into an intermediate data packet includes: Based on the mapping table between status indicators and fields of the communication protocol of the new energy centralized control system, the data packet consisting of the fields of the communication protocol corresponding to the status indicator information is determined. The mapping table between the status indicators and fields of the communication protocol of the new energy centralized control system indicates that multiple status indicators correspond one-to-one with fields of multiple communication protocols of the new energy centralized control system. The heartbeat signal at the first frequency and the data packet are used as the intermediate data packet.

4. The method according to claim 3, characterized in that, The step of transmitting the intermediate data packet to the management information area on the central control side through the data path of the new energy central control system includes: If the frequency of the heartbeat signal of the intermediate data packet is detected to be the first frequency, the intermediate data packet is transmitted to the management information area of ​​the central control side through the data path; otherwise, the transmission of the intermediate data packet is suspended.

5. The method according to claim 1, characterized in that, Prior to the occurrence of a target fault in the production control area, the method further includes: Record the operating data of the probe device and the abnormal information of the production control area.

6. The method according to claim 1, characterized in that, Determining the location of the target fault based on the time-series database and topology modeling table includes: Using the first timestamp as the starting time, a target data sequence of a first duration is extracted from the time series database in chronological order. The first duration is the time length between the first timestamp and the timestamp of the target fault. Based on the target data sequence, node labels are performed in the topology modeling table to obtain the target topology graph; Nodes in the target topology graph that are in an abnormal state are identified as suspected abnormal nodes; If the number of suspected abnormal nodes is 1, then the location of the suspected abnormal node is taken as the location of the target fault. If the number of suspected abnormal nodes is greater than or equal to 2, the fault level of each node in the suspected abnormal nodes is determined according to the distance between each node in the suspected abnormal nodes and the root node of the target topology graph. The location of the node corresponding to the highest fault level is taken as the location of the target fault, wherein the length of the distance is inversely proportional to the fault level.

7. The method according to claim 1, characterized in that, The method further includes: The location of the target fault is marked and displayed in the topology diagram of the new energy centralized control system; The alarm information of the target fault is pushed to the alarm handler.

8. The method according to claim 1, characterized in that, The method further includes: Using the target fault as sample data, and the location of the target fault as sample label; Record the sample data and the sample tags as fault location data; Using the fault location data, a fault location model is trained, which maps faults to the locations where they occur.

9. The method according to claim 6, characterized in that, After determining the location of the target fault, the method further includes: The health score of the new energy centralized control system is determined based on the fault level of the suspected abnormal nodes.

10. A cross-regional fault location device, characterized in that, An application is made to the production control area and management information area of ​​a new energy centralized control system. The production control area includes at least two security zones, which are isolated from adjacent security zones by a network firewall. The management information area is connected to the production control area via a network gateway. The new energy centralized control system includes a centralized control side and a site side. The production control area on the centralized control side communicates with the production control area on the site side via encrypted communication. The management information area on the centralized control side is connected to the management information area on the site side via a network. Probe devices are deployed in each security zone and management information area of ​​the new energy centralized control system to monitor the status indicators of the security zone and the management information area. The cross-zone fault location device includes: The acquisition module is used to acquire status indicator information of the security zone and the management information zone through the probe device; Encapsulation module is used to encapsulate the status indicator information into an intermediate data packet, the intermediate data packet supporting the communication protocol of the new energy centralized control system; The transmission module is used to transmit the intermediate data packet to the management information area of ​​the central control side through the data path of the new energy central control system, and save it to the time series database. The intermediate data packet carries a timestamp of the acquisition of the status indicator information. The positioning module is used to determine the location of the target fault in response to the occurrence of a target fault in the production control area, based on the time series database and the topology modeling table, wherein the topology modeling table indicates the level of the monitoring object of the probe device in the safety area.

11. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the cross-regional fault location method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the cross-regional fault location method according to any one of claims 1 to 9.

13. A computer program product, characterized in that, It includes computer instructions for causing a computer to perform the cross-regional fault location method according to any one of claims 1 to 9.

Images