3D Visualization Modeling Method and System for Data Center Equipment Operation Status

Abstract

This invention discloses a 3D visualization modeling method and system for data center equipment operating status, relating to the field of big data processing technology. The method includes: classifying multi-source heterogeneous data based on metadata features to obtain static and dynamic equipment datasets; 3D reconstructing the static equipment dataset and merging it with the dynamic equipment dataset to construct a hierarchical association model; triggering a linkage response to generate joint audit instructions when the equipment operating status exceeds the security boundary; determining abnormal execution paths and abnormal tracking paths based on the hierarchical association model and joint audit instructions; deducing fault conditions by combining temporal change trends; and dynamically rendering and displaying the equipment status within the abnormality's influence range using a 3D visualization engine-driven hierarchical association model. This achieves deep fusion of multi-source heterogeneous data, 3D visualization of equipment operating status, and intelligent deduction of fault conditions, improving monitoring personnel's ability to perceive equipment anomalies and the efficiency of fault handling.

Description

Technical Field

[0001] This invention relates to the field of big data processing technology, specifically to a method and system for three-dimensional visualization modeling of the operating status of data center equipment. Background Technology

[0002] Currently, with the continuous expansion of the power grid and the increasing complexity of its structure, the amount of monitoring data from substation equipment is experiencing explosive growth. Most existing big data monitoring systems are based on traditional architectures. While they can access some monitoring data and perform real-time data analysis, they still have many shortcomings in terms of in-depth data mining and visualization. On the one hand, existing monitoring data displays are mostly in the form of two-dimensional charts or lists, making it difficult to intuitively and comprehensively present the spatial topology relationships and operational status of equipment, hindering monitoring personnel from quickly grasping the overall operational status of the equipment. On the other hand, existing monitoring systems often lack effective data fusion and correlation analysis mechanisms when processing multi-source heterogeneous data, making it difficult to achieve deep coupling between static equipment attributes and dynamic operational data, resulting in low accuracy in fault warning and anomaly location. Furthermore, when equipment malfunctions, existing systems typically only provide simple alarm pushes, lacking the ability to track anomaly propagation paths and deduce fault states, failing to provide auxiliary decision support for monitoring personnel, leading to low efficiency in fault handling and failing to meet the urgent needs of smart grids for intelligent, refined, and visualized equipment monitoring. Summary of the Invention

[0003] To address the problems of unintuitive monitoring data display, inaccurate anomaly location, and low fault handling efficiency in existing technologies, this application proposes a three-dimensional visualization modeling method and system for data center equipment operation status. This system enables deep fusion of multi-source heterogeneous data, three-dimensional visualization of equipment operation status, and intelligent deduction of fault conditions.

[0004] In a first aspect, one technical solution provided in this embodiment of the invention is: a three-dimensional visualization modeling method for the operating status of data center equipment, comprising the following steps: Based on metadata features, multi-source heterogeneous data are classified to obtain static equipment datasets and dynamic equipment datasets; A basic 3D model library is obtained by reconstructing the inherent attribute parameters in the static dataset of the equipment into a basic 3D model library, and the basic 3D model library is merged with the dynamic dataset of the equipment to construct a hierarchical association model. Configure a security boundary domain for the operating status parameters in the device dynamic dataset. When the real-time operating status of the device exceeds the security boundary domain, trigger a linkage response based on the preset event monitoring rules to generate a joint audit instruction. Based on the hierarchical association model and joint audit instructions, the abnormal execution path and abnormal tracking path are determined. The abnormal execution path and abnormal tracking path are input into the situation inference engine, and the fault situation is inferred by combining the time-series change trend of the device dynamic dataset. In response to the execution path, tracing path, and fault status, the hierarchical association model is driven by a 3D visualization engine to dynamically render and display the device status within the scope of the anomaly's impact.

[0005] The above solution achieves deep integration of static equipment attributes and dynamic operating data by constructing a hierarchical association model. It also uses a 3D visualization engine to dynamically render the equipment status within the scope of anomaly impact, intuitively displaying the anomaly propagation path and fault status, thereby improving the monitoring personnel's ability to perceive equipment anomalies and the efficiency of fault handling.

[0006] As a preferred embodiment, the steps for classifying multi-source heterogeneous data based on metadata features to obtain static and dynamic device datasets are as follows: Parse the interface protocols and data encapsulation formats of each data source, and extract metadata features including data source identifiers, field semantic descriptions, and update frequencies; Parameters whose update frequency is lower than a preset threshold and which describe the inherent attributes of the device are included in the device static dataset; the parameters of the inherent attributes of the device include device ledger information, geometric dimensions, material parameters and topological connection relationships; Parameters that are updated more frequently than a preset threshold and describe the operating status of the equipment are included in the equipment dynamic dataset; the parameters of the operating status of the equipment include real-time operating data, alarm signals, fault records and on-site operation status.

[0007] As a preferred embodiment, the steps of performing 3D reconstruction of the inherent attribute parameters in the static dataset of the device to obtain a basic 3D model library, and then fusing the basic 3D model library with the dynamic dataset of the device to construct a hierarchical association model are as follows: A lightweight 3D mesh model of each device is constructed based on the geometric dimensions and material parameters in the static dataset of the device, and a basic 3D model library is constructed using the unique identifier of the device as the index key. A static association layer is constructed by associating each lightweight 3D mesh model in the basic 3D model library with the ledger information and topological connection relationships in the equipment static dataset. Using the unique identifier of the same device as the mapping key, the real-time operating data, alarm signals and fault records in the device dynamic dataset are bound to the corresponding lightweight 3D mesh model to build a dynamic mapping layer; The static association layer and the dynamic mapping layer are integrated to obtain the corresponding hierarchical association model.

[0008] As a preferred embodiment, the steps for configuring a security boundary domain for the operating status parameters in the device's dynamic dataset, and triggering a linkage response to generate a joint audit instruction based on preset event monitoring rules when the device's real-time operating status exceeds the security boundary domain, are as follows: Safety boundary domains are set for various operating parameters in the device dynamic dataset. The safety boundary domains include the threshold range, rate of change limit, and correlation constraints between parameters for each operating state parameter. The system monitors the dynamic dataset of the equipment in real time, compares the current value of each operating status parameter with the corresponding safety boundary domain, and determines that the current operating status parameter is abnormal if the value of any operating status parameter exceeds the safety boundary domain. The system then calls the preset event monitoring rules to conduct a joint investigation of the operating status parameter and the associated abnormal data. Valid abnormal events confirmed after joint auditing are packaged into joint audit instructions according to a preset format. The joint audit instructions include at least the abnormal device identifier, the abnormality type code, the trigger timestamp, and the abnormality confidence level.

[0009] As a preferred embodiment, the event monitoring rules include anomaly type determination rules, invalid signal filtering rules, and signal priority rules; the step of invoking preset event monitoring rules to jointly audit the operating status parameters and associated anomaly data is as follows: Based on the aforementioned anomaly type determination rules, feature comparison is performed on the running status parameters that trigger the anomaly, and an anomaly category label is output. Based on the invalid signal filtering rules, and using the abnormal category labels as the filtering context, the operating status parameters and their associated alarm signals are subjected to pattern matching and screening, and the set of valid abnormal events and their corresponding category labels are output. Based on the signal priority rules, priority scores are determined according to the category labels, equipment levels, and estimated impact range of each event in the set of valid abnormal events. The sorted sequence of valid abnormal events is then output in descending order of scores as the joint audit result.

[0010] As a preferred embodiment, the steps for determining the abnormal execution path and the abnormal tracking path based on the hierarchical association model and the joint audit instructions are as follows: The joint inspection command is parsed to extract the abnormal device identifier, abnormal type code, and trigger timestamp as the starting point for tracing the abnormal source; Based on the static association layer in the hierarchical association model, with the abnormal device identifier as the root node, a device association topology graph is constructed according to the topological connection relationship between devices. The abnormal type code in the joint inspection instruction is matched with the device association topology map for pattern matching. Combined with the real-time operation data of each device in the dynamic mapping layer and the timing characteristics of alarm signals, the causal relationship of abnormal propagation is determined. Using the causal relationship as a positive constraint, a breadth-first traversal is performed along the positive connection direction of the device association topology to generate an abnormal execution path that includes the anomaly propagation timeline, the sequence of affected devices, and the propagation intensity. Using the causal relationship as a reverse constraint, a depth-first traversal is performed along the reverse connection direction of the device association topology to generate an anomaly tracing path that includes anomaly source location, triggering link, and root device identifier.

[0011] As a preferred embodiment, the step of inputting the abnormal execution path and the abnormal tracing path into the situation inference engine, and inferring the fault situation by combining the time-series change trend of the device dynamic dataset, is as follows: The sequence of affected devices in the abnormal execution path is spatiotemporally aligned with the root device identifier in the abnormal tracing path to construct an abnormal spatiotemporal map that includes device topology location, abnormal triggering sequence and propagation direction; Based on the device dynamic dataset, the historical operation data time series of each device node in the abnormal spatiotemporal map is extracted, and the trend feature of the historical operation data time series is extracted by the sliding window algorithm to obtain the state evolution curve and abnormal propagation rate of each device node. The abnormal spatiotemporal map and the state evolution curve are input into the situation inference engine. Based on the preset fault evolution model, the abnormal propagation process is simulated in multiple steps. The fault evolution model includes the equipment failure probability transition matrix, the abnormal propagation attenuation coefficient, and the chain reaction triggering conditions. Based on the multi-step simulation results, combined with the anomaly propagation rate and chain reaction triggering conditions, the predicted fault risk value of each device node within a preset time window is calculated, and a fault status report containing the fault development trend, impact range, and key nodes is generated.

[0012] As a preferred embodiment, the steps for calculating the predicted fault risk value of each device node within a preset time window based on the multi-step deduction results and in combination with the anomaly propagation rate and chain reaction triggering conditions are as follows: Based on the anomaly propagation time sequence in the multi-step simulation results, and combined with the anomaly propagation rate, the degree of anomaly accumulation of each device node within the preset time window is determined. The abnormality accumulation level is compared with the chain reaction triggering condition. If the abnormality accumulation level reaches or exceeds the chain reaction triggering condition, the chain failure triggering probability of the device node is determined to be a first preset value; otherwise, it is determined to be a second preset value. Based on the cascading failure trigger probability and combined with the historical failure statistics of each device node, a failure risk prediction value for each device node is generated.

[0013] As a preferred embodiment, the steps for dynamically rendering and displaying the device status within the anomaly's impact range using the hierarchical association model driven by the 3D visualization engine, in response to the execution path, tracing path, and fault status, are as follows: The set of target device nodes within the scope of the anomaly's impact is determined based on the execution path and the tracing path. Based on the fault status, the fault risk level of each device node in the target device node set is obtained; The target device node set is mapped to the three-dimensional coordinate space of the hierarchical association model to generate a three-dimensional layout of the device nodes; Based on the fault risk level, each device node in the 3D layout of the device nodes is configured with corresponding visualization attributes, including color coding, transparency and flashing frequency. The 3D visualization engine renders the 3D layout of the device nodes in real time according to the visualization attributes, generating a visual display interface.

[0014] Secondly, this invention also provides a three-dimensional visualization modeling system, applicable to the three-dimensional visualization modeling method for the operating status of data center equipment as described in any of the first aspects, comprising: Data classification module: Classifies multi-source heterogeneous data based on metadata features to obtain static and dynamic equipment datasets; Model building module: Performs 3D reconstruction of the inherent attribute parameters in the static dataset of the device to obtain a basic 3D model library, and merges the basic 3D model library with the dynamic dataset of the device to construct a hierarchical association model; Command triggering module: Configures a security boundary domain for the operating status parameters in the device dynamic dataset. When the real-time operating status of the device exceeds the security boundary domain, it triggers a linkage response based on preset event monitoring rules to generate a joint inspection command. Path generation module: Determines abnormal execution paths and abnormal tracking paths based on the hierarchical association model and joint audit instructions; Situation simulation module: Input the abnormal execution path and abnormal tracking path into the situation simulation engine, and deduce the fault situation by combining the time-series change trend of the device dynamic dataset; Visualization module: In response to the execution path, tracing path and fault status, the hierarchical association model is driven by a 3D visualization engine to dynamically render and display the device status within the scope of the anomaly.

[0015] Thirdly, the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor, when calling the computer program in the memory, implements the steps of the three-dimensional visualization modeling method for the operating status of data center equipment as described in any of the first aspects.

[0016] Fourthly, this invention also provides a storage medium storing computer-executable instructions, which, when loaded and executed by a processor, implement the steps of the three-dimensional visualization modeling method for the operating status of data center equipment as described in any of the first aspects.

[0017] This invention offers at least the following substantial benefits: By classifying multi-source heterogeneous data based on metadata features, it achieves effective separation and precise management of static and dynamic equipment data. Through the construction of a hierarchical association model, it deeply integrates the three-dimensional model of the equipment with real-time operational data, breaking the limitations of isolated and poorly correlated data display in traditional monitoring systems and providing monitoring personnel with an intuitive and comprehensive panoramic view of the equipment. By configuring security boundary domains and event monitoring rules, it can capture equipment anomalies in real time and automatically generate joint audit instructions, effectively filtering invalid alarms and improving the accuracy of anomaly identification and handling efficiency. By determining the anomaly execution path and tracing path, and combining it with a situational simulation engine for fault situation simulation, it achieves visualized tracking of fault propagation paths and prediction of future development trends, providing monitoring personnel with a scientific basis for decision-making and significantly improving the intelligence level and fault response capabilities of power grid equipment monitoring.

[0018] The above description of the invention is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0019] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings. The drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings.

[0020] Figure 1 This is a flowchart of the three-dimensional visualization modeling method for the operating status of data center equipment according to Embodiment 1 of the present invention.

[0021] Figure 2 This is a flowchart illustrating the construction process of the hierarchical association model in Embodiment 3 of the present invention.

[0022] Figure 3 This is a flowchart illustrating the generation of the abnormal execution path and the abnormal tracking path in Embodiment 5 of the present invention.

[0023] Figure 4 The diagram shown is a flowchart of the fault situation simulation in Embodiment 6 of the present invention.

[0024] Figure 5 The figure shown is a block diagram of a three-dimensional visualization modeling system according to Embodiment 8 of the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only one preferred embodiment of this invention and are only used to explain this invention. They do not limit the scope of protection of this invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0026] Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the operations (or steps) as sequential processes, many of the operations (or steps) can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but it may also have additional steps not included in the figures; the process may correspond to a method, function, procedure, subroutine, subroutine, etc.

[0027] Example 1: As Figure 1 As shown, this embodiment provides a 3D visualization modeling method for the operating status of data center equipment. This method aims to solve the problems of unintuitive monitoring data display, inaccurate anomaly location, and low fault handling efficiency in existing systems. It achieves deep fusion and 3D visualization of multi-source data by constructing a hierarchical association model. The method specifically includes steps S100-S600.

[0028] Step S100: Classify the multi-source heterogeneous data based on metadata features to obtain the device static dataset and the device dynamic dataset; Step S200: Perform three-dimensional reconstruction on the inherent attribute parameters in the static dataset of the device to obtain a basic three-dimensional model library, and merge the basic three-dimensional model library with the dynamic dataset of the device to construct a hierarchical association model; Step S300: Configure a security boundary domain for the operating status parameters in the device dynamic dataset. When the real-time operating status of the device exceeds the security boundary domain, trigger a linkage response to generate a joint audit instruction based on the preset event monitoring rules. Step S400: Determine the abnormal execution path and abnormal tracking path based on the hierarchical association model and joint audit instructions; Step S500: Input the abnormal execution path and abnormal tracking path into the situation inference engine, and infer the fault situation by combining the time-series change trend of the device dynamic dataset. In step S600, in response to the execution path, tracing path, and fault status, the hierarchical association model is driven by a 3D visualization engine to dynamically render and display the device status within the scope of the anomaly's influence.

[0029] Through the coordinated operation of steps S100 to S600, this embodiment achieves a closed-loop process from data access, model building, anomaly detection, path tracking, situational analysis to visualization. Specifically, step S100 uses a metadata feature-driven data classification mechanism to decouple multi-source heterogeneous data into two dimensions: static attributes and dynamic states, providing a clear data foundation for subsequent processing. Step S200, based on this, constructs a hierarchical association model that integrates static geometry and dynamic states, breaking the limitations of data isolation in traditional monitoring systems and achieving deep integration of physical entities and digital models. Step S300, through a multi-layered filtering mechanism of security boundary domains and event monitoring rules, achieves a shift from passive alarm reception to proactive anomaly analysis, effectively shielding noise interference from massive signals. Step S400 utilizes topological association and causal analysis techniques to generate abnormal execution paths and tracing paths, enabling monitoring personnel not only to locate fault points but also to predict the scope of fault impact and trace the root cause. Step S500 introduces a situational prediction engine, predicting future fault development trends based on historical data and temporal characteristics, achieving a leap from post-event handling to pre-event prevention. Step S600 uses a 3D visualization engine to transform abstract analysis results into intuitive visual signals, enabling monitoring personnel to quickly perceive complex fault situations. The above steps are interconnected and progressive, jointly constructing a three-dimensional visualization modeling method with data fusion, intelligent analysis, and intuitive display capabilities, which significantly improves the monitoring efficiency and decision-making accuracy of data center or substation equipment operation status.

[0030] Example 2: This example, based on Example 1, provides a detailed explanation of the specific criteria for data classification and the construction process of the hierarchical association model. Specifically, multi-source heterogeneous data is classified based on metadata features to obtain static and dynamic equipment datasets, as shown in steps S101-S103.

[0031] Step S101: Parse the interface protocol and data encapsulation format of each data source, and extract metadata features including data source identifier, field semantic description and update frequency.

[0032] Specifically, monitoring systems in data centers or substations typically connect to multiple heterogeneous data sources, such as control cloud systems, EMS systems, and online monitoring devices. These data sources may have different interface protocols; some use WebService interfaces, while others use the IEC61850 communication protocol. Their data encapsulation formats also vary, such as JSON, XML, or binary streams. This step first parses these heterogeneous interfaces to extract metadata features that describe the data attributes. Data source identifiers distinguish whether the data comes from the dispatching end or the substation end; field semantic descriptions explain the specific meaning of the data, such as "Ua" representing phase A voltage; and update frequency records the time interval for data refresh, such as milliseconds, seconds, or days. By extracting these metadata features, the system can automatically identify the business attributes and temporal characteristics of the data, providing a basis for subsequent classification processing.

[0033] Step S102: Parameters with an update frequency lower than a preset threshold and that describe inherent device attributes are included in the device static dataset.

[0034] Step S103: Parameters with an update frequency higher than a preset threshold and that describe the device's operating status are included in the device dynamic dataset.

[0035] Specifically, this embodiment classifies data based on two dimensions: update frequency and attribute type. A preset threshold can be set according to actual business needs, for example, 24 hours. Parameters with an update frequency below this threshold that describe inherent equipment attributes, such as equipment ledger information (asset number, commissioning date, manufacturer), geometric dimensions (length, width, height), material parameters, and topological connections, are classified into the equipment static dataset. This type of data typically changes little after the equipment is commissioned, exhibiting high stability. Conversely, parameters with an update frequency above this threshold that describe the equipment's operating status, such as real-time operating data (current, voltage, power), alarm signals, fault records, and on-site operating status, are classified into the equipment dynamic dataset. This type of data changes continuously over time, reflecting the real-time health status of the equipment. It should be understood that the above classification criteria are not unique; in other embodiments, the importance of the data or the storage medium can also be used for auxiliary classification. This classification strategy achieves decoupled management of massive monitoring data, reducing the complexity of data storage and processing.

[0036] Example 3: This example, based on Example 2, provides a detailed explanation of the construction process of the hierarchical association model. Specifically, as follows... Figure 2 As shown in the figure, the basic three-dimensional model library is obtained by three-dimensional reconstruction of the inherent attribute parameters in the static dataset of the device, and the hierarchical association model is constructed by merging the basic three-dimensional model library with the dynamic dataset of the device as shown in steps S201~S204.

[0037] Step S201: Construct a lightweight 3D mesh model for each device based on the geometric dimensions and material parameters in the device static dataset, and build a basic 3D model library using the device's unique identifier as the index key.

[0038] Specifically, after obtaining the static dataset of the devices, this step utilizes computer graphics technology for 3D reconstruction. The system reads the geometric dimensions and material parameters recorded in the static dataset of the devices, and generates 3D mesh models for each device using parametric modeling methods or matching mapping from a preset model library. To meet the performance requirements of real-time rendering in large-scale scenes, this embodiment particularly emphasizes the construction of "lightweight" models. Lightweight processing may include reducing the number of mesh faces, simplifying texture details, or using LOD (Level of Detail) technology to minimize the data volume of the model while ensuring visual realism. Each generated 3D mesh model is bound to a unique device identifier as an index key, thus forming a basic 3D model library. This model library serves as a static foundation for visualization, providing a spatial carrier for subsequent data mapping.

[0039] Step S202: Associate each lightweight 3D mesh model in the basic 3D model library with the ledger information and topological connection relationships in the equipment static dataset to construct a static association layer.

[0040] Specifically, the static association layer is the first layer of the hierarchical association model, primarily responsible for carrying the static attributes and spatial relationships of the equipment. The system uses the unique identifier of each device as a link to bind the 3D mesh model with ledger information (such as rated voltage and rated capacity) and topological connections (such as the upstream busbar and downstream switches connected to the device). By constructing the static association layer, the 3D model is no longer merely a geometric shell, but an entity node with business semantics. For example, clicking on the transformer 3D model allows you to query its asset number and connection relationships. This association method provides a topological foundation for subsequent anomaly path tracing.

[0041] Step S203: Using the unique identifier of the same device as the mapping key, bind the real-time operating data, alarm signals and fault records in the device dynamic dataset to the corresponding lightweight 3D mesh model to build a dynamic mapping layer.

[0042] Specifically, the dynamic mapping layer is the second layer of the hierarchical association model, primarily responsible for carrying the dynamic operating status of the equipment. The system acquires the data stream from the dynamic data set of the equipment in real time through a data subscription or polling mechanism, and maps this dynamic data to the corresponding 3D mesh model based on the unique identifier of the equipment. For example, real-time oil temperature data of the transformer is mapped to the oil temperature attribute field of the transformer model, and the opening and closing status of the circuit breaker is mapped to the action status field of the circuit breaker model. This mapping is real-time and dynamic; as the data stream changes, the state attributes of the 3D model are updated accordingly. By constructing the dynamic mapping layer, state synchronization between physical equipment and the digital model is achieved, providing data support for subsequent real-time monitoring and anomaly rendering.

[0043] Step S204: Integrate the static association layer and the dynamic mapping layer to obtain the corresponding hierarchical association model.

[0044] Specifically, by logically integrating the static association layer and the dynamic mapping layer constructed above, a complete hierarchical association model is obtained. This model includes both the static geometric and topological information of the equipment and incorporates the dynamic operating status of the equipment, achieving deep fusion of multi-source data. The construction of the hierarchical association model breaks down the barrier between static ledgers and dynamic operating data in traditional monitoring systems, allowing monitoring personnel to intuitively view comprehensive information about the equipment in a three-dimensional scene, significantly improving the readability of monitoring data and the efficiency of association analysis.

[0045] Example 4: Based on Example 1, this example configures a security boundary domain for the operating status parameters in the device's dynamic dataset. When the device's real-time operating status exceeds this security boundary domain, a linkage response is triggered according to preset event monitoring rules to generate a joint audit instruction. The specific process is described in detail below. In actual monitoring scenarios, a single threshold judgment is often insufficient to handle complex operating conditions, easily leading to false alarms or missed alarms. Therefore, this example significantly improves the accuracy of anomaly identification by constructing a multi-dimensional security boundary domain and a three-layer filtering event monitoring rule. Specific steps are as described in steps S301-S303.

[0046] Step S301: Set safety boundary domains for various operating parameters in the device dynamic dataset. The safety boundary domains include the threshold range, rate of change limit, and correlation constraints between parameters for each operating state parameter.

[0047] Specifically, the safety boundary domain is no longer limited to traditional single threshold comparisons, but rather constructs a three-dimensional protection space. Threshold ranges define the upper and lower limits of normal parameter fluctuations; for example, the normal range for the top oil temperature of a certain type of transformer is set to 30℃ to 85℃. The rate of change limit focuses on the drastic nature of parameter changes, used to capture sudden anomalies. For example, setting the oil temperature rate of change limit to 5℃ / minute means that even if the current oil temperature does not exceed the upper limit, if the temperature rise is too rapid, the system will still determine it as an anomaly. More importantly, this embodiment introduces correlation constraints between parameters. This is because, in actual operation, the changes of some parameters are interconnected. For example, when the transformer's load current increases, the winding temperature and oil temperature usually rise accordingly. If only temperature exceedances are monitored while ignoring the current status, it may lead to a misjudgment of equipment overheating. Therefore, correlation constraints set logical relationships between parameters, such as "when the load current is greater than 80% of the rated current, the upper limit of oil temperature is allowed to be dynamically corrected according to the load factor." Through this multi-dimensional boundary setting, the system can more accurately identify abnormal states that deviate from the normal operating trajectory, effectively reducing the false alarm rate caused by changes in operating conditions.

[0048] Step S302: Monitor the dynamic dataset of the device in real time, compare the current value of each operating status parameter with the corresponding safety boundary domain. If the value of any operating status parameter exceeds the safety boundary domain, the current operating status parameter is determined to be abnormal, and the preset event monitoring rules are invoked to conduct a joint investigation of the operating status parameter and the associated abnormal data.

[0049] When a parameter is detected to be out of bounds, the system does not immediately trigger an alarm, but instead initiates a joint audit mechanism. The core of this mechanism lies in pre-defined event monitoring rules, which include anomaly type determination rules, invalid signal filtering rules, and signal priority rules. These three layers of filtering logic ensure the authenticity and importance of abnormal events. Specific audit steps are shown in steps S3011-S3013.

[0050] Step S3011: Based on the anomaly type determination rule, perform feature comparison on the running status parameters that trigger the anomaly and output an anomaly category label.

[0051] Specifically, the system has pre-set feature libraries for various anomaly types, such as out-of-limit, abrupt, and frequent anomalies. When an abnormal signal is detected, the system extracts the signal's waveform characteristics, duration, and other attributes and compares them with the feature libraries. For example, for a circuit breaker's "control circuit disconnection" signal, the system analyzes its level characteristics and duration and marks it as a "state missing" anomaly. This label not only clarifies the nature of the anomaly but also provides contextual basis for subsequent filtering and handling.

[0052] Step S3012: Based on the invalid signal filtering rules, and using the abnormal category label as the filtering context, perform pattern matching and screening on the operating status parameters and their associated alarm signals, and output a set of valid abnormal events and their corresponding category labels.

[0053] This is a crucial step in improving identification accuracy. In real-world scenarios, sensor jitter, communication interference, or equipment maintenance operations often generate a large number of false or invalid signals. Invalid signal filtering rules eliminate these signals through pattern matching. For example, a "jitter signal" caused by poor sensor contact is characterized by frequent signal flips within a very short time. After the system identifies this pattern, it combines it with the anomaly category label generated in the previous step to determine that the signal does not possess persistent fault characteristics, thus filtering it out and not outputting it as a valid abnormal event. Similarly, when the system detects that a device is in a "maintenance tagged" state, the alarm signals generated by that device are automatically masked to avoid interfering with normal monitoring. Through this filtering layer, the system can eliminate a large amount of noisy data, ensuring that only genuine and valid abnormal events enter the subsequent processes.

[0054] Step S3013: Based on the signal priority rules, determine the priority score according to the category label, equipment level and estimated impact range of each event in the set of valid abnormal events, and output the sorted sequence of valid abnormal events as the joint audit result in descending order of the score.

[0055] Specifically, even after filtering, multiple abnormal events may still exist, requiring the system to prioritize their handling. A signal priority rule constructs a multi-dimensional scoring model. Equipment level is a significant weight; for example, the anomaly score for a main transformer in a core substation is higher than that for a regular line switch. The estimated impact range is calculated based on topological connections, with anomalies potentially causing large-scale power outages receiving higher scores. Combining anomaly category tags (e.g., protection actions take priority over general alarms), the system calculates the priority score for each event and sorts them according to their scores. This ranking result serves as the output of the joint audit, ensuring that monitoring personnel can prioritize and handle the highest-risk and most impactful abnormal events, thus optimizing the allocation of monitoring resources.

[0056] Specifically, the signal priority rule constructs a multi-dimensional scoring model that uses a weighted summation method to calculate the priority score. The specific calculation formula is as follows: Priority Score P sco=w1×D+w2×R+w3×C; where D is the equipment level score, R is the estimated impact range score, C is the anomaly category score, and w1, w2, and w3 are the corresponding weighting coefficients. The weighting coefficients can be set according to actual monitoring needs. For example, setting w1=0.4, w2=0.3, and w3=0.3 indicates that the equipment level has a higher weight in the score. The equipment level score D is assigned according to the importance of the equipment in the power grid. For example, the main transformer of a core substation is assigned 10 points, the main transformer of an important substation is assigned 7 points, and ordinary line switches are assigned 4 points. The estimated impact range score R is calculated based on the topology connections. The system traverses the downstream topology network of the abnormal device, counts the number of potentially affected devices or the total load, and performs normalization processing. For example, a score of 10 is assigned when the number of affected devices exceeds 10 or the total load exceeds 100MW; a score of 7 is assigned when the number of affected devices is between 5 and 10 or the total load is between 50MW and 100MW; and a score of 4 is assigned when the number of affected devices is less than 5 or the total load is less than 50MW. The anomaly category score C is assigned based on the urgency of the anomaly type. For example, a protection action anomaly is assigned 10 points, a severe alarm anomaly is assigned 7 points, and a general alarm anomaly is assigned 4 points. The system calculates the priority score P for each anomaly event according to the above formula. sco The scores are then sorted in descending order. This sorting result serves as the output of the joint audit, ensuring that monitoring personnel can prioritize and address the highest-risk and most impactful anomalies, thus optimizing the allocation of monitoring resources.

[0057] Step S303: The valid abnormal events confirmed after joint audit are packaged into a joint audit instruction according to a preset format. The joint audit instruction includes at least the abnormal device identifier, the abnormal type code, the trigger timestamp, and the abnormal confidence level.

[0058] Specifically, the joint inspection results are ultimately encapsulated into standardized joint inspection instructions. These instructions serve as the trigger for subsequent path generation and situational analysis. Abnormal device identifiers are used to locate target nodes in the hierarchical association model; abnormality type codes are used to match corresponding contingency plans or simulation models; trigger timestamps record the precise time of the abnormality's occurrence for time-series analysis; and the abnormality confidence level reflects the probability that the abnormality is a genuine fault after joint inspection, a value that integrates factors such as signal strength and filtering rule matching. This standardized encapsulation enables efficient flow of abnormal information between different modules.

[0059] Example 5: This embodiment, based on Embodiment 1, provides a detailed explanation of the specific methods for determining abnormal execution paths and abnormal tracing paths based on the hierarchical association model and joint audit instructions. After generating the joint audit instructions, the system needs to clarify the direction and root cause of the abnormality in order to perform accurate fault isolation and handling. For example... Figure 3 As shown, the specific steps are as shown in steps S401 to S405.

[0060] Step S401: Parse the joint inspection instruction and extract the abnormal device identifier, abnormal type code and trigger timestamp as the starting point for abnormal source tracing.

[0061] Specifically, the joint inspection command serves as the input source for subsequent path analysis. The system first parses the command to obtain the abnormal device identifier, such as "Transformer T-001," which determines the starting node of the path traversal. The abnormality type code, such as "over-temperature alarm," is used to match the corresponding propagation rule base. The trigger timestamp is used to lock a snapshot of the device's state at the time the abnormality occurred, ensuring that subsequent analysis is based on the actual operating conditions at the time of the fault. These three elements together constitute the triplet of the abnormality tracing starting point, providing clear spatiotemporal coordinates for subsequent topology traversal.

[0062] Step S402: Based on the static association layer in the hierarchical association model, and with the abnormal device identifier as the root node, construct a device association topology graph according to the topological connection relationship between devices.

[0063] Specifically, the static association layer in the hierarchical association model stores the equipment ledger information and topological connection relationships. The system uses the abnormal equipment identifier as the root node, retrieves its connected upstream equipment (such as incoming switches and busbars) and downstream equipment (such as outgoing switches and loads), and recursively retrieves the connection relationships of associated equipment, thereby constructing a local equipment association topology graph. This topology graph is a directed graph, where nodes represent equipment and edges represent electrical connections or control relationships. It should be understood that the traversal depth of the topology graph construction process can be set as needed, for example, only searching third-level associated equipment to balance computational efficiency and coverage.

[0064] Step S403: Perform pattern matching between the anomaly type code in the joint inspection instruction and the device association topology map, and combine the real-time operation data of each device in the dynamic mapping layer and the timing characteristics of alarm signals to determine the causal relationship of anomaly propagation.

[0065] Specifically, a simple topological connection is not equivalent to an anomaly propagation path. The system needs to further analyze the causal relationships of anomaly propagation. This process is achieved through pattern matching: the system encodes the anomaly type and inputs it into a preset fault evolution model, which defines the propagation rules of different types of anomalies. For example, for an "overtemperature alarm," the model defines it as possibly caused by a "cooling system failure" or "overload operation," and may further lead to "insulation breakdown." By combining the real-time operating data of each device in the dynamic mapping layer (such as load rate and oil temperature curves) and the timing characteristics of alarm signals (such as the cooler fault signal appearing before the overtemperature alarm), the system can determine how the anomaly flows in the topology graph, thereby determining the causal relationships. This step eliminates topological connections but paths without actual causal relationships, improving the accuracy of path analysis.

[0066] Understandably, the form of a fault evolution model can be... Where R represents the fault propagation rule base, H represents the total number of rules. Let h be the propagation rule. Each rule is defined as follows: Exception type h → {set of possible causes, set of possible consequences}, for example Over-temperature alarm → {cooling system failure, overload operation} → {insulation breakdown}. P is the fault probability transition matrix, specifically in the form of... N represents the total number of fault types. When N=5, the fault types include over-temperature abnormality, insulation breakdown, short circuit fault, protection action, and normal operation. Configure the propagation parameter vector, specifically in the form of: , This is the attenuation coefficient for abnormal propagation. This is the triggering condition (critical threshold) for a chain reaction. High-risk probability value (e.g., a value of 0.9). This is a low-risk probability value (e.g., a value of 0.1).

[0067] Step S404: Using the causal relationship as a positive constraint, perform a breadth-first traversal along the positive connection direction of the device association topology graph to generate an abnormal execution path that includes the anomaly propagation timeline, the sequence of affected devices, and the propagation intensity.

[0068] Specifically, positive constraints refer to the direction of energy flow or control logic transmission. For example, the direction from the transformer body to the downstream outgoing switch. The system uses a breadth-first search algorithm, starting from the anomaly tracing origin and searching layer by layer for affected downstream devices. The advantage of breadth-first search is that it can prioritize finding the devices closest to the fault point and most directly affected, making it suitable for quickly assessing the scope of the fault's impact. During the traversal, the system records the time sequence and degree of impact (i.e., propagation intensity) of each layer of devices, ultimately generating an anomaly execution path that includes the anomaly propagation time sequence, the sequence of affected devices, and the propagation intensity. This path answers the question "Which devices will be affected by the anomaly?", providing a basis for monitoring personnel to formulate power outage isolation plans.

[0069] Step S405: Using the causal relationship as a reverse constraint, perform a depth-first traversal along the reverse connection direction of the device association topology to generate an anomaly tracing path that includes the anomaly source location, triggering link, and root device identifier.

[0070] Specifically, reverse constraints refer to the direction opposite to the energy flow or control logic transmission, i.e., the direction pointing towards the power supply side or the upper-level control terminal. The system employs a depth-first search algorithm, starting from the anomaly tracing origin and delving deeper along the reverse connections until the root cause device of the anomaly is found. The advantage of depth-first search is its ability to quickly penetrate to the lower levels, making it suitable for finding single fault sources. During the traversal, the system records the triggering links at each level of investigation, ultimately generating an anomaly tracing path that includes the anomaly source location, triggering links, and root cause device identification. This path answers the question "Which device caused the anomaly?", helping maintenance personnel quickly locate the root cause of the fault and avoiding blind troubleshooting. Through the parallel generation of the above two paths, the system achieves comprehensive and three-dimensional analysis of anomaly events.

[0071] Example 6: This example, based on Example 4, details the process of inputting the abnormal execution path and abnormal tracing path into the situation inference engine, and inferring the fault situation by combining the time-series change trends of the device dynamic dataset. After determining the anomaly propagation path and tracing path, the system needs to further predict the future development trend and risk level of the fault so that monitoring personnel can take intervention measures in advance. Figure 4 As shown, the specific steps are as shown in S501~S504.

[0072] Step S501: Spatiotemporally align the sequence of affected devices in the abnormal execution path with the root device identifier in the abnormal tracing path to construct an abnormal spatiotemporal map containing device topology location, abnormal triggering sequence and propagation direction.

[0073] Specifically, the anomaly execution path and the anomaly tracing path describe the propagation trajectory of the anomaly from the forward and reverse directions, respectively, but these two paths are intertwined in time and space. This step uses spatiotemporal alignment technology to map the device nodes in the two paths into a unified four-dimensional coordinate system (three-dimensional spatial coordinates + time axis). In this anomaly spatiotemporal map, each node represents the state of a device at a certain moment, and the lines between nodes not only represent topological connections but also indicate the direction and time difference of anomaly propagation. For example, the map can clearly show the spatiotemporal evolution process of "transformer T-001 experiencing an over-temperature anomaly at 10:00:05, which propagated to the downstream circuit breaker CB-002 at 10:00:10". By constructing the anomaly spatiotemporal map, the system integrates discrete anomaly events into a continuous dynamic evolution scenario, providing a structured data foundation for subsequent trend analysis.

[0074] Step S502: Based on the device dynamic dataset, extract the historical operating data time series of each device node in the abnormal spatiotemporal map, and use the sliding window algorithm to extract trend features from the historical operating data time series to obtain the state evolution curve and abnormal propagation rate of each device node.

[0075] Specifically, the system retrieves historical operational data of each device node over a past period from the anomaly spatiotemporal map of the device dynamic dataset, forming a time series. These series are then processed using a sliding window algorithm. The sliding window algorithm sets a fixed-size time window (e.g., 10 minutes) and slides it along the time axis, calculating the statistical characteristics (e.g., mean, variance, and slope) of the data within the window. The window size is not fixed and can be dynamically adjusted according to the anomaly type; for example, a smaller window is used for abrupt faults to improve sensitivity, while a larger window is used for gradual faults to smooth out noise. Through this algorithm, the system can extract the state evolution curves of each device node, visually displaying the trend of parameter changes over time. Simultaneously, by comparing the time difference and spatial distance between anomaly triggers of adjacent nodes, the anomaly propagation rate is calculated. This rate is a key indicator for assessing the speed of fault propagation and directly determines the time window available for monitoring personnel to respond.

[0076] Step S503: Input the abnormal spatiotemporal map and the state evolution curve into the situation inference engine, and perform multi-step inference on the abnormal propagation process according to the preset fault evolution model. The fault evolution model includes the equipment fault probability transition matrix, the abnormal propagation attenuation coefficient and the chain reaction triggering condition.

[0077] Specifically, the equipment failure probability transition matrix defines the probability of different failure types transforming into other failure types under different operating conditions, such as the probability of "overtemperature anomaly" transforming into "insulation breakdown". The anomaly propagation attenuation coefficient reflects the loss of anomaly energy during propagation; for example, the greater the electrical distance, the weaker the impact of the anomaly. The chain reaction triggering condition defines the critical threshold for triggering large-scale power outages or equipment cluster failures. The engine uses the anomaly spatiotemporal map as the initial state and combines it with the trend parameters provided by the state evolution curve to perform multi-step extrapolation. Each extrapolation simulates the equipment nodes that the anomaly may propagate to in the next moment and the secondary failures that may be triggered. Through this model-driven extrapolation, the system can generate multiple possible failure evolution paths, covering various scenarios from the most likely occurrence to the most severe consequences.

[0078] Understandably, for the k-th step of the deduction, the current state is first determined based on the topological connectivity of the anomaly spatiotemporal graph. Candidate propagation node set: ,in, For the set of edges in the anomalous spatiotemporal graph, For the device nodes in the current state, First, identify candidate target nodes for propagation; then, calculate the target nodes for each candidate node. Probability of being propagated by anomalies ,in, For nodes The probability of triggering a chain of failures, For the node To the node The propagation attenuation coefficient, From the type of fault Transfer to fault type The probability of propagation; and thus setting a propagation threshold. ,like If the anomaly is propagated to the node, then it is determined that the anomaly has been propagated to the node. : For the nodes that are determined to have been propagated Update its status: ,in, For the timestamp of the k-th step of the deduction, For the new New node fault types; finally, repeat the single-step deduction process until the preset deduction step K is reached or no new nodes are propagated to. , For situational projection function, This represents the set of system states after the k-th simulation step, where K is the preset number of simulation steps. After K simulation steps, the situation simulation engine outputs the multi-step simulation results. , of which each Includes the set of affected devices The complete propagation path of the anomaly from its source to each node, and the fault types of each device node. and the timestamps of the exceptions triggered by each node. .

[0079] Step S504: Based on the multi-step simulation results, combined with the abnormal propagation rate and the chain reaction triggering conditions, calculate the predicted fault risk value of each device node within a preset time window, and generate a fault status report that includes the fault development trend, the scope of impact, and key nodes.

[0080] The calculation logic for the fault risk prediction value is particularly critical, specifically including steps S5041~S5043.

[0081] Step S5041: Based on the anomaly propagation time sequence in the multi-step deduction results, and in combination with the anomaly propagation rate, determine the degree of anomaly accumulation of each device node within the preset time window.

[0082] Specifically, the anomaly accumulation level is a quantitative indicator used to measure the intensity of anomaly impacts on equipment within a preset time window (e.g., the next 30 minutes). Based on simulation results, the system calculates the number of anomaly events the equipment may experience within the window, their duration, and the deviation of anomaly parameters, and then performs a weighted summation based on the anomaly propagation rate. For example, if the simulation shows that a device will be subjected to high-amplitude anomaly energy impacts for an extended period, its anomaly accumulation level will be high. This indicator reflects the immediate pressure faced by the equipment.

[0083] Understandably, the formula for calculating the degree of abnormal accumulation is as follows: , The degree of abnormality accumulation of the device within a preset time window t. Let be the probability that the device is abnormally propagated in the k-th step of the deduction. This represents the normalized value of the abnormal parameter deviation of the device in the k-th simulation (the degree of deviation relative to the normal value). Let k be the time step of the derivation. The propagation attenuation coefficient, , This is the attenuation coefficient (set according to the characteristics of the electrical system). Let be the electrical distance of the k-th abnormal event.

[0084] Step S5042: Compare the degree of abnormal accumulation with the chain reaction triggering condition. If the degree of abnormal accumulation reaches or exceeds the chain reaction triggering condition, determine that the chain failure triggering probability of the device node is a first preset value; otherwise, determine it to be a second preset value.

[0085] Specifically, the cascading failure trigger condition is the critical point for determining whether a fault should escalate. The system compares the calculated cumulative anomaly level with this condition. If the condition is met or exceeded, it means that the device is highly likely to fail and trigger a cascading failure. In this case, the system determines the cascading failure trigger probability to a first preset value (e.g., 0.9, representing high risk); if it is not met, it is determined to be a second preset value (e.g., 0.1, representing low risk). It should be understood that the specific values ​​of the first and second preset values ​​can be set according to the safety level requirements of the power grid, and this embodiment does not impose any restrictions on this. Through this binary determination logic, the system can quickly screen out high-risk nodes, avoiding decision delays caused by complex probability calculations.

[0086] Step S5043: Based on the cascading failure trigger probability and combined with the historical failure statistics of each device node, generate the failure risk prediction value of each device node.

[0087] Specifically, to further improve prediction accuracy, the system also incorporates historical fault statistics as a correction factor. This data records the frequency and repair difficulty of similar faults occurring in the equipment's past operation. The system integrates the cascading fault trigger probability with historical fault weights to generate a comprehensive fault risk prediction value. This value not only reflects the current abnormal situation but also considers the inherent reliability of the equipment. The final fault situation report will include a fault development trend graph, the geographical distribution of affected equipment, and a list of key nodes requiring focused monitoring, providing monitoring personnel with comprehensive decision support.

[0088] It is understandable that the formula for calculating the predicted value of failure risk is... ,in, This is the predicted value for failure risk. This represents the probability of a cascading failure being triggered. The historical fault statistical weight is calculated using the following formula: , The historical failure frequency weighting coefficient, To fix the difficulty weighting coefficient, ; The normalized value of historical failure frequency is determined by the ratio of the number of historical failures to the maximum number of historical failures. The normalized value for repair difficulty is determined based on the ratio of average repair time to maximum repair time.

[0089] Example 7: Based on Example 1, this example details the process of dynamically rendering and displaying the device status within the anomaly's impact range using a 3D visualization engine driven by the hierarchical association model in response to the execution path, tracing path, and fault status. After obtaining the fault status report through the status simulation engine, the system needs to transform these abstract data analysis results into intuitive visual signals so that monitoring personnel can quickly perceive them. This is specifically illustrated in steps S601-S605.

[0090] Step S601: Determine the set of target device nodes within the scope of the anomaly's influence based on the execution path and the tracing path.

[0091] Specifically, the execution path indicates the sequence of downstream devices to which the anomaly may propagate, while the tracing path indicates the sequence of upstream devices from which the anomaly may originate. The system performs a union operation on all device nodes along these two paths and, combined with the predicted impact range from the fault status report, identifies a set of target device nodes requiring focused monitoring. It should be understood that this set includes not only devices currently experiencing anomalies but also potentially affected devices that are on the anomaly propagation path but have not yet failed but are at high risk. For example, if a transformer fails, its downstream busbars and multiple outgoing switches will be included in the target device node set, even if these switches currently appear to be in normal status. This path-based set determination method ensures the comprehensiveness and forward-looking nature of the visualization.

[0092] Step S602: Based on the fault status, obtain the fault risk level of each device node in the target device node set.

[0093] Specifically, in Example 5, the system has calculated the predicted fault risk value for each device node, which is typically a continuous probability value or score. To facilitate visualization and mapping, this step discretizes the continuous risk prediction value into several fault risk levels. For example, the system can set the risk levels into four levels: Level 1 (low risk, predicted value 0-0.3), Level 2 (medium risk, predicted value 0.3-0.6), Level 3 (high risk, predicted value 0.6-0.85), and Level 4 (extremely high risk, predicted value 0.85-1.0). This hierarchical processing reduces the complexity of rendering calculations and aligns with the monitoring personnel's understanding of risk levels. For different types of equipment, the grading threshold can be dynamically adjusted according to their importance; for example, the grading threshold for the core transformer can be set lower to increase its sensitivity.

[0094] Step S603: Map the target device node set to the three-dimensional coordinate space of the hierarchical association model to generate a three-dimensional layout of the device nodes.

[0095] Specifically, the hierarchical association model stores the 3D geometric models of each device and their spatial location information. Based on the unique identifier of each device, the system maps each node in the target device node set to its corresponding position in the 3D scene. During the mapping process, the system can adjust the viewpoint and layout as needed. For example, it can magnify the device model in the core area of ​​the anomaly and appropriately compress the spacing between devices in the surrounding non-core areas to clearly display the details of the anomaly area within the limited screen space. The generated 3D layout of the device nodes includes not only the spatial coordinates of the devices but also the topological connection lines between the devices; these connection lines will serve as the basis for subsequent rendering of the anomaly propagation path.

[0096] Step S604: Based on the fault risk level, configure corresponding visualization attributes for each device node in the three-dimensional layout of the device nodes. The visualization attributes include color coding, transparency, and flashing frequency.

[0097] Specifically, this is the core step in achieving data-to-visual mapping. The system pre-defines mapping rules between fault risk levels and visualization attributes. For color coding, warm colors are typically used to represent high risk, and cool colors to represent low risk. For example, level four risk corresponds to red, level three to orange, level two to yellow, and level one to green. For transparency, devices with higher risk levels have lower model transparency (i.e., less transparent) to stand out; devices with lower risk levels can have their model transparency appropriately increased to create a "blurred" background effect, avoiding interference with the monitoring personnel's focus. For flicker frequency, the system can configure high-frequency flickering effects for high-risk devices, such as flickering twice per second, to generate a strong visual warning; for medium- and low-risk devices, low-frequency flickering or static display can be configured. It should be understood that the above mapping rules are only examples. In other embodiments, other visual coding methods can also be used, such as changing the thickness of the model outline or adding dynamic halo effects, as long as different risk levels can be intuitively distinguished. Through this multi-dimensional visualization attribute configuration, monitoring personnel do not need to consult specific values; they can quickly identify the core fault area and potential risk area based solely on visual intuition.

[0098] Step S605: Using the 3D visualization engine, the 3D layout of the device nodes is rendered in real time according to the visualization attributes to generate a visualization display interface.

[0099] Specifically, the 3D visualization engine is the software component driving the entire rendering process. It can be developed based on graphics libraries such as WebGL, OpenGL, or Unity3D. The engine reads the visualization attribute parameters configured in step S604, calls upon graphics processing unit (GPU) resources, and performs real-time rendering of the 3D scene. The rendering process includes geometric transformations, lighting calculations, texture mapping, and rasterization. The engine continuously updates the image according to a set refresh rate (e.g., 30 frames per second), thus achieving dynamic rendering effects. For example, when the fault risk level of a device rises from level two to level three, the engine will change its color from yellow to orange in real time and initiate a flashing animation. The generated visualization display interface can be presented to monitoring personnel through large screens, workstation monitors, or mobile terminals. Furthermore, the engine supports interactive operations, allowing monitoring personnel to view detailed fault status reports or historical operating curves for specific devices through clicking, selecting, and other operations. Driven by the 3D visualization engine, real-time mapping from abstract data to intuitive scenes is achieved, significantly improving the efficiency of monitoring personnel's perception of complex fault situations and the accuracy of their decisions.

[0100] Example 8: One technical solution provided in this embodiment of the invention is a three-dimensional visualization modeling system, applicable to the methods described in any of the above embodiments, such as... Figure 5 As shown, it includes: Data classification module 101: Classifies multi-source heterogeneous data based on metadata features to obtain static and dynamic data sets of equipment; Model building module 102: performs three-dimensional reconstruction of the inherent attribute parameters in the static dataset of the equipment to obtain a basic three-dimensional model library, and merges the basic three-dimensional model library with the dynamic dataset of the equipment to construct a hierarchical association model; Command triggering module 103: Configures a security boundary domain for the operating status parameters in the device dynamic dataset. When the real-time operating status of the device exceeds the security boundary domain, it triggers a linkage response based on preset event monitoring rules to generate a joint inspection command. Path generation module 104: Determines abnormal execution paths and abnormal tracking paths based on the hierarchical association model and joint audit instructions; Situation simulation module 105: Input the abnormal execution path and abnormal tracking path into the situation simulation engine, and deduce the fault situation by combining the time-series change trend of the equipment dynamic dataset. Visualization module 106: In response to the execution path, tracing path and fault status, the hierarchical association model is driven by the 3D visualization engine to dynamically render and display the device status within the scope of the anomaly.

[0101] Specifically, the data classification module decouples multi-source heterogeneous data into two dimensions—static attributes and dynamic states—through a metadata feature-driven data classification mechanism, providing a clear data foundation for subsequent processing. The model building module, based on this, constructs a hierarchical association model that integrates static geometry and dynamic states, breaking the limitations of data isolation in traditional monitoring systems and achieving deep integration of physical equipment entities and digital models. The command triggering module, through a multi-layered filtering mechanism of security boundary domains and event monitoring rules, achieves a shift from passive alarm reception to proactive anomaly analysis, effectively shielding noise interference from massive signals. The path generation module utilizes topological association and causal analysis techniques to generate abnormal execution paths and tracing paths, enabling monitoring personnel not only to locate fault points but also to predict the scope of fault impact and trace the root cause. The situational simulation module introduces a situational simulation engine, predicting future fault development trends based on historical data and temporal characteristics, achieving a leap from post-event handling to pre-event prevention. The visualization module, through a 3D visualization engine, transforms abstract analysis results into intuitive visual signals, enabling monitoring personnel to quickly perceive complex fault situations. The modules mentioned above are interconnected and the data flows smoothly, together constructing a three-dimensional visualization modeling system with data fusion, intelligent analysis and intuitive display capabilities, which significantly improves the monitoring efficiency and decision-making accuracy of the operating status of data center or substation equipment.

[0102] Example 9: One technical solution provided in this embodiment of the invention is: an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor, when calling the computer program in the memory, implements the steps of the three-dimensional visualization modeling method for the operating status of data center equipment as described in the above embodiments.

[0103] Example 10: One technical solution provided in this embodiment of the invention is: a storage medium storing computer-executable instructions, wherein when the computer-executable instructions are loaded and executed by a processor, the steps of the three-dimensional visualization modeling method for the operating status of data center equipment as described in the above embodiment are implemented.

[0104] Through the above description of the embodiments, those skilled in the art will understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the specific device can be divided into different functional modules to complete all or part of the functions described above.

[0105] In the embodiments provided in this application, it should be understood that the disclosed structures and methods can be implemented in other ways. For example, the structural embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another structure, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between structures or units, and may be electrical, mechanical, or other forms.

[0106] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0107] Furthermore, in the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0108] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0109] The specific embodiments described above are preferred embodiments of the three-dimensional visualization modeling method and system for the operating status of data center equipment of the present invention, and are not intended to limit the specific scope of the present invention. The scope of the present invention includes but is not limited to the specific embodiments described above. All equivalent changes made in accordance with the shape and structure of the present invention are within the protection scope of the present invention.

Claims

1. A three-dimensional visualization modeling method for the operating status of data center equipment, characterized in that, Includes the following steps: Based on metadata features, multi-source heterogeneous data are classified to obtain static equipment datasets and dynamic equipment datasets; A basic 3D model library is obtained by reconstructing the inherent attribute parameters in the static dataset of the equipment into a basic 3D model library, and the basic 3D model library is merged with the dynamic dataset of the equipment to construct a hierarchical association model. Configure a security boundary domain for the operating status parameters in the device dynamic dataset. When the real-time operating status of the device exceeds the security boundary domain, trigger a linkage response based on the preset event monitoring rules to generate a joint audit instruction. Based on the hierarchical association model and joint audit instructions, the abnormal execution path and abnormal tracking path are determined. The abnormal execution path and abnormal tracking path are input into the situation inference engine, and the fault situation is inferred by combining the time-series change trend of the device dynamic dataset. In response to the execution path, tracing path, and fault status, the hierarchical association model is driven by a 3D visualization engine to dynamically render and display the device status within the scope of the anomaly's impact.

2. The three-dimensional visualization modeling method for the operating status of data center equipment according to claim 1, characterized in that: The steps for classifying multi-source heterogeneous data based on metadata features to obtain static and dynamic device datasets are as follows: Parse the interface protocols and data encapsulation formats of each data source, and extract metadata features including data source identifiers, field semantic descriptions, and update frequencies; Parameters whose update frequency is lower than a preset threshold and which describe the inherent attributes of the device are included in the device static dataset; the parameters of the inherent attributes of the device include device ledger information, geometric dimensions, material parameters and topological connection relationships; Parameters that are updated more frequently than a preset threshold and describe the operating status of the equipment are included in the equipment dynamic dataset; the parameters of the operating status of the equipment include real-time operating data, alarm signals, fault records and on-site operation status.

3. The three-dimensional visualization modeling method for the operating status of data center equipment according to claim 2, characterized in that: The steps for performing 3D reconstruction of the inherent attribute parameters in the static dataset of the device to obtain a basic 3D model library, and then fusing the basic 3D model library with the dynamic dataset of the device to construct a hierarchical association model are as follows: A lightweight 3D mesh model of each device is constructed based on the geometric dimensions and material parameters in the static dataset of the device, and a basic 3D model library is constructed using the unique identifier of the device as the index key. A static association layer is constructed by associating each lightweight 3D mesh model in the basic 3D model library with the ledger information and topological connection relationships in the equipment static dataset. Using the unique identifier of the same device as the mapping key, the real-time operating data, alarm signals and fault records in the device dynamic dataset are bound to the corresponding lightweight 3D mesh model to build a dynamic mapping layer; The static association layer and the dynamic mapping layer are integrated to obtain the corresponding hierarchical association model.

4. The three-dimensional visualization modeling method for the operating status of data center equipment according to claim 1, characterized in that: The steps for configuring a security boundary domain for the operating status parameters in the device's dynamic dataset, and triggering a linkage response to generate a joint audit instruction based on preset event monitoring rules when the device's real-time operating status exceeds the security boundary domain, are as follows: Safety boundary domains are set for various operating parameters in the device dynamic dataset. The safety boundary domains include the threshold range, rate of change limit, and correlation constraints between parameters for each operating state parameter. The system monitors the dynamic dataset of the equipment in real time, compares the current value of each operating status parameter with the corresponding safety boundary domain, and determines that the current operating status parameter is abnormal if the value of any operating status parameter exceeds the safety boundary domain. The system then calls the preset event monitoring rules to conduct a joint investigation of the operating status parameter and the associated abnormal data. Valid abnormal events confirmed after joint auditing are packaged into joint audit instructions according to a preset format. The joint audit instructions include at least the abnormal device identifier, the abnormality type code, the trigger timestamp, and the abnormality confidence level.

5. The three-dimensional visualization modeling method for the operating status of data center equipment according to claim 4, characterized in that: The event monitoring rules include anomaly type determination rules, invalid signal filtering rules, and signal priority rules; the steps of calling the preset event monitoring rules to jointly audit the operating status parameters and related anomaly data are as follows: Based on the aforementioned anomaly type determination rules, feature comparison is performed on the running status parameters that trigger the anomaly, and an anomaly category label is output. Based on the invalid signal filtering rules, and using the abnormal category labels as the filtering context, the operating status parameters and their associated alarm signals are subjected to pattern matching and screening, and the set of valid abnormal events and their corresponding category labels are output. Based on the signal priority rules, priority scores are determined according to the category labels, equipment levels, and estimated impact range of each event in the set of valid abnormal events. The sorted sequence of valid abnormal events is then output in descending order of scores as the joint audit result.

6. The three-dimensional visualization modeling method for the operating status of data center equipment according to claim 1 or 4, characterized in that: The steps for determining the abnormal execution path and the abnormal tracking path based on the hierarchical association model and the joint audit instructions are as follows: The joint inspection command is parsed to extract the abnormal device identifier, abnormal type code, and trigger timestamp as the starting point for tracing the abnormal source; Based on the static association layer in the hierarchical association model, with the abnormal device identifier as the root node, a device association topology graph is constructed according to the topological connection relationship between devices. The abnormal type code in the joint inspection instruction is matched with the device association topology map for pattern matching. Combined with the real-time operation data of each device in the dynamic mapping layer and the timing characteristics of alarm signals, the causal relationship of abnormal propagation is determined. Using the causal relationship as a positive constraint, a breadth-first traversal is performed along the positive connection direction of the device association topology to generate an abnormal execution path that includes the anomaly propagation timeline, the sequence of affected devices, and the propagation intensity. Using the causal relationship as a reverse constraint, a depth-first traversal is performed along the reverse connection direction of the device association topology to generate an anomaly tracing path that includes anomaly source location, triggering link, and root device identifier.

7. The three-dimensional visualization modeling method for the operating status of data center equipment according to claim 6, characterized in that: The steps for inputting the abnormal execution path and abnormal tracing path into the situation inference engine, and combining them with the time-series change trend of the device dynamic dataset to infer the fault situation are as follows: The sequence of affected devices in the abnormal execution path is spatiotemporally aligned with the root device identifier in the abnormal tracing path to construct an abnormal spatiotemporal map that includes device topology location, abnormal triggering sequence and propagation direction; Based on the device dynamic dataset, the historical operation data time series of each device node in the abnormal spatiotemporal map is extracted, and the trend feature of the historical operation data time series is extracted by the sliding window algorithm to obtain the state evolution curve and abnormal propagation rate of each device node. The abnormal spatiotemporal map and the state evolution curve are input into the situation inference engine. Based on the preset fault evolution model, the abnormal propagation process is simulated in multiple steps. The fault evolution model includes the equipment failure probability transition matrix, the abnormal propagation attenuation coefficient, and the chain reaction triggering conditions. Based on the results of multi-step simulation, combined with the abnormal propagation rate and the chain reaction triggering conditions, the predicted fault risk value of each device node within a preset time window is calculated, and a fault status report containing the fault development trend, the scope of impact, and key nodes is generated.

8. The three-dimensional visualization modeling method for the operating status of data center equipment according to claim 7, characterized in that: The steps for calculating the predicted fault risk value of each device node within a preset time window based on the multi-step simulation results and in combination with the anomaly propagation rate and the chain reaction triggering conditions are as follows: Based on the anomaly propagation time sequence in the multi-step simulation results, and combined with the anomaly propagation rate, the degree of anomaly accumulation of each device node within the preset time window is determined. The abnormality accumulation level is compared with the chain reaction triggering condition. If the abnormality accumulation level reaches or exceeds the chain reaction triggering condition, the chain failure triggering probability of the device node is determined to be a first preset value; otherwise, it is determined to be a second preset value. Based on the cascading failure trigger probability and combined with the historical failure statistics of each device node, a failure risk prediction value for each device node is generated.

9. The three-dimensional visualization modeling method for the operating status of data center equipment according to claim 1, characterized in that: The steps for dynamically rendering and displaying the device status within the anomaly's impact range using the 3D visualization engine, in response to the execution path, tracing path, and fault status, are as follows: The set of target device nodes within the scope of the anomaly's impact is determined based on the execution path and the tracing path. Based on the fault status, the fault risk level of each device node in the target device node set is obtained; The target device node set is mapped to the three-dimensional coordinate space of the hierarchical association model to generate a three-dimensional layout of the device nodes; Based on the fault risk level, each device node in the 3D layout of the device nodes is configured with corresponding visualization attributes, including color coding, transparency and flashing frequency. The 3D visualization engine renders the 3D layout of the device nodes in real time according to the visualization attributes, generating a visual display interface.

10. A three-dimensional visualization modeling system, applicable to the three-dimensional visualization modeling method for the operating status of data center equipment as described in any one of claims 1 to 9, characterized in that, include: Data classification module: Classifies multi-source heterogeneous data based on metadata features to obtain static and dynamic equipment datasets; Model building module: Performs 3D reconstruction of the inherent attribute parameters in the static dataset of the device to obtain a basic 3D model library, and merges the basic 3D model library with the dynamic dataset of the device to construct a hierarchical association model; Command triggering module: Configures a security boundary domain for the operating status parameters in the device dynamic dataset. When the real-time operating status of the device exceeds the security boundary domain, it triggers a linkage response based on preset event monitoring rules to generate a joint inspection command. Path generation module: Determines abnormal execution paths and abnormal tracking paths based on the hierarchical association model and joint audit instructions; Situation simulation module: Input the abnormal execution path and abnormal tracking path into the situation simulation engine, and deduce the fault situation by combining the time-series change trend of the device dynamic dataset; Visualization module: In response to the execution path, tracing path and fault status, the hierarchical association model is driven by a 3D visualization engine to dynamically render and display the device status within the scope of the anomaly.

11. An electronic device, characterized in that: The system includes a memory and a processor. The memory stores a computer program, and when the processor calls the computer program in the memory, it implements the steps of the three-dimensional visualization modeling method for the operating status of data center equipment as described in any one of claims 1 to 9.

12. A storage medium, characterized in that: The storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the steps of the three-dimensional visualization modeling method for the operating status of data center equipment as described in any one of claims 1 to 9.

Images