A power system safe operation state fast evaluation method based on an ant colony-CNN coordination model
By constructing a reliable data flow model using an ant colony-CNN coordination model and optimizing lightweight CNN hyperparameters, the real-time assessment problem of complex safety monitoring in power systems is solved, achieving efficient safety status assessment and improved accuracy.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- ZHANGZHOU POWER SUPPLY COMPANY STATE GRID FUJIANELECTRIC POWER
- Filing Date
- 2026-02-28
- Publication Date
- 2026-06-16
Smart Images
Figure CN122222255A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of industrial control system safety technology, and in particular to a rapid assessment method for the safe operation status of power systems based on an ant colony-CNN coordination model. Background Technology
[0002] With the continuous expansion of my country's smart grid construction, modern digital communication technologies, advanced sensing and measurement technologies, and decision support systems are being applied and developed, providing assurance for the safe operation of the power system. Currently, the power system covers multiple stages, including power generation, transmission, substation, distribution, and consumption. Each stage involves a vast number of devices with complex and variable operating conditions. Traditional methods for power grid safety monitoring based on rules and statistics are no longer sufficient to meet the demands of complex and ever-changing real-world application scenarios. Therefore, there is an urgent need for a real-time safety assessment method capable of handling complex systems. Summary of the Invention
[0003] In view of this, the purpose of this invention is to provide a rapid assessment method for the safe operation status of power systems based on an ant colony-CNN coordination model. This method accelerates the efficiency of CNN models in assessing power grid safety status by using an ant colony algorithm, while simultaneously reducing the computational load of CNN and lowering its performance requirements for deployment hardware.
[0004] To achieve the above objectives, the present invention adopts the following technical solution: a rapid assessment method for the safe operation status of a power system based on an ant colony-CNN coordination model, comprising the following steps:
[0005] S101: Collects real-time data streams from the power monitoring network and performs deep protocol parsing on the data streams to extract operation instructions, function codes, and process data;
[0006] S102: Construct a trusted flow, conduct a principle analysis of the safe operation state of the power system, and associate the specific physical values that may be involved with the safe operation state. The physical values must have corresponding sensors that return power messages. The resulting set of multiple physical variables-safe state names is a "trusted data flow model".
[0007] Specifically, this "trusted data flow model" is not directly referenced from an existing external standard or document, but rather is an original concept and method proposed by this invention to solve the problem of power system security status assessment. Its core construction process is as follows:
[0008] (1) Business scenario analysis and physical mapping establishment: Analyze power grid control business (such as remote control, protection, etc.) and associate each business with specific equipment (primary / secondary equipment) and its key physical quantities (such as current, voltage, position status). Based on IEC61850 SCL documents, establish a strict and traceable mapping relationship from physical equipment to communication message fields to form a "digital twin" mapping table as the static knowledge basis of the model.
[0009] (2) Message structure parsing and field extraction: Deeply analyze protocol messages such as GOOSE, MMS, and IEC 104 to extract identification features, measurement features, status features, event features, quality features and timing features, and unify the time base to form structured data records with spatiotemporal context.
[0010] (3) Security status definition and label construction: Define security status categories at multiple levels, such as device level, system level and network security, and write a rule engine to automatically generate the "security status" label corresponding to each data record based on the structured data in the previous step, thereby forming the dataset required for supervised learning.
[0011] (4) Construction of Trusted Data Flow Model: This step formally constructs the "Trusted Data Flow Model", which is a composite model that combines white-box causal logic and gray-box statistical correlation.
[0012] 1. White-box component: Key security constraints (such as operation legality conditions) are modeled as state machines or sequential logic rules to form the core security verification layer.
[0013] 2. Gray box part: Defines a set of physical quantities that are statistically associated with complex states, which are provided as features to the subsequent CNN model for learning.
[0014] (5) Model verification and self-calibration: The model is verified by means of historical data, comparison with actual system actions and injection tests, and a case library and expert intervention mechanism are established to enable the model to dynamically adapt to changes in the power grid.
[0015] In summary, the "trusted data flow model" is a high-quality and interpretable data model constructed through the above steps, which is used to transform the raw messages of the power system into high-quality data with clear physical meaning and security status labels, providing an input basis for subsequent rapid security status assessment based on CNN.
[0016] S103: Determine the input window size and the number of output categories for the CNN, and preliminarily determine the inner layer structure;
[0017] S104: Determine the discrete values or ranges of hyperparameters by combining the theoretical range of hyperparameter values and the results of manual testing;
[0018] S105: Based on the preliminary validation results, the ant colony algorithm is used to optimize the hyperparameters. The inverse of the validation set error rate and the number of parameters is used as the pheromone, and the appropriate function is taken as the inverse of the weighted average sum of the validation set error rate, the number of parameters, and the inference time. The "training model" mentioned here and the data preprocessing steps (data cleaning, data transformation, sample equalization, and data augmentation) contained therein are a component of the "rapid assessment method for the safe operation status of power systems based on the ant colony-CNN coordination model" proposed in this invention.
[0019] S106: Data preprocessing is required before training the model, including data cleaning, data transformation, sample equalization, and data augmentation.
[0020] S107: Using a CNN model with specified hyperparameters, perform inference on the data on the validation set, calculate the inference time and error rate, and determine whether the accuracy of the system security status assessment meets the requirements. If yes, proceed to step S108; otherwise, return to step S105.
[0021] S108: When the model meets the requirements, extract the final CNN model to evaluate the safety status of the power system.
[0022] The specific model referred to in "extracting the final CNN model" in S108 is the specific CNN model instance that meets the performance requirements after optimization by steps S101-S107 of this invention.
[0023] Its specific meaning is as follows:
[0024] Model type: It is a lightweight CNN. The documentation in S103 clearly states that this project focuses on a lightweight CNN architecture to ensure low performance requirements on deployment devices.
[0025] Structural Basis: In section S103 of the "Detailed Implementation" section, a variant of MobileNetV3-Small is used as an example to illustrate the "minimum workable skeleton." Therefore, the structural basis of the final model references the design of such lightweight CNNs.
[0026] Key feature: The specific structural parameters of the model (such as kernel size, number of channels, etc.) are not fixed, but are defined by the optimal combination of hyperparameters searched by the ant colony algorithm (S105) within the defined discrete space (S104).
[0027] Final form: The "optimal CNN model file" saved in S108 contains the final structure, weights, hyperparameter vectors and performance metrics of the model.
[0028] In summary, the "model" in S108 specifically refers to the lightweight CNN model instance optimized by the ant colony algorithm, which is the final output of the method of this invention and used for rapid assessment of the safety status of power systems. In the claims and specification of this document, it represents the result of this optimization process, and not any externally predefined model.
[0029] In a preferred embodiment, the data stream in step S101 includes:
[0030] A large number of normal and abnormal power messages, containing various protocol communication data in the power monitoring network, are mainly captured using network packet capture tools.
[0031] The process parameters refer to the raw numerical fields carried in the power system monitoring protocol data frames, representing the measurement or status record of a certain physical quantity at a certain moment. They are information-level parameters.
[0032] In a preferred embodiment, the construction of the trusted data flow model in step S102 includes:
[0033] Based on power system principles (such as Kirchhoff's laws, stability margin, and protection logic), a causal relationship is established between a combination of physical values and a specific safety state. For example, "the current of a certain line suddenly increases to 3 times the rated value" + "the circuit breaker protection of this line shows that it has not tripped" = "line overcurrent fault (abnormal operation)".
[0034] The physical values mentioned include, but are not limited to, key parameters that directly reflect the operational health of the equipment, such as line voltage, current, frequency, power (active and reactive), harmonic content (waveform quality), equipment temperature, and oil / gas density (for equipment such as GIS). These physical values are measured by sensors deployed on specific equipment (such as circuit breakers, transformers, and busbars) and uploaded in real time via power messages. The messages not only contain sampled or measured values but must also include equipment identification information that uniquely identifies the source of the measurement point (such as logical device name, logical node name, and data object name conforming to the IEC 61850 standard) and regional / geographical information (such as substation number and bay number), thus forming a "traceable" data unit.
[0035] The system's safe operating status refers to a state in which the system is within a normal or acceptable risk range in both information security and operational security dimensions. It, along with abnormal system states, constitutes a complete description of the system's overall state.
[0036] The security status is specifically divided into:
[0037] 1) System information security: refers to the protection of the communication and commands of monitoring systems, protection and control systems, etc., from unauthorized access, tampering or denial-of-service attacks, and to their trustworthy, intact and usable state;
[0038] 2) System operation safety: refers to the state in which the physical equipment (power generation, transmission, and distribution) of the power network operates stably within the specified electrical and mechanical limits, meeting the requirements for power quality and continuous power supply.
[0039] The abnormal system state is the opposite of the safe state, including:
[0040] Ⅰ) Abnormal system information: This refers to network attacks or communication failures such as malicious software intrusion, illegal command injection, denial-of-service attacks, and data tampering that cause the system to be unreliable;
[0041] II) Abnormal system operation: refers to physical faults or deterioration of electrical performance caused by equipment aging, insulation damage, external damage, improper operation, etc.
[0042] The system fault categories are specific manifestations of abnormal system operation, such as: abnormal line shutdown (including short circuit, open circuit, protection malfunction / failure to operate), transformer fault (overheating, insulation fault, internal discharge), circuit breaker fault (failure to open, failure to close, mechanical jamming), power distribution imbalance (severe three-phase load imbalance, feeder overload), voltage imbalance (three-phase voltage asymmetry, voltage drop / rise), etc.
[0043] The power message serves as the carrier for realizing the aforementioned status information perception. A complete and reliable data message should include:
[0044] (1) Sampling / Measurement Field: Instantaneous value, effective value, or state value carrying physical values;
[0045] (2) Device Identity / Asset Field: Clearly defines the device object from which the data originates, thus binding the data to the physical device;
[0046] (3) Geographic location field: identifies the physical or logical location of the equipment (such as substation, bay);
[0047] (4) Quality and security fields: identify the validity of the data (e.g., whether it overflows or is locked), time synchronization tags (e.g., IEEE 1588 precise time stamp), and communication security tags (e.g., digital signature);
[0048] (5) Mainstream protocols: These include GOOSE for fast trip signals, MMS for client / server model access, and IEC 104 for telecontrol communication. Deep analysis of these protocols is required when constructing a trusted flow to extract all the key fields mentioned above.
[0049] In a preferred embodiment, the method for confirming the input window size and the number of output categories in step S103 is as follows:
[0050] Based on the trusted data flow model established in step S102, the one-dimensional data of the power system state (including physical values) corresponding to each type of security state is converted into a two-dimensional matrix, and the largest two-dimensional matrix size is taken as the input window size.
[0051] Based on the structure of the power system, analyze the number of system state types that it has, which are composed of various safe states or potential system faults, and take this type as the output classification number.
[0052] In a preferred embodiment, the inner structure specified in step S103 is as follows:
[0053] For a typical CNN, the inner structure requires specifying parameters such as kernel size, number of channels, dropout rate, and BN adjustment factor;
[0054] Lightweight CNNs require specifying the convolution decomposition size, depth separability expansion ratio, and block repetition count for their inner layer structure.
[0055] Both of the above structures can be used to construct the ant colony-CNN coordination model in this paper, but this project focuses on explaining the lightweight CNN structure to ensure that the CNN model has low requirements for the performance of the deployment device.
[0056] In a preferred embodiment, the hyperparameter range and manual testing determined in step S104 include:
[0057] The hyperparameters include: kernel size and decomposition size, number of channels, dropout rate and BN adjustment factor, depth separable expansion ratio and block repetition count;
[0058] The manual testing scheme is as follows: test the possible values of the hyperparameters of the CNN, and the accuracy of the CNN corresponding to each set of hyperparameters on the validation set should not be lower than the expected value;
[0059] In a preferred embodiment, step S105 calculates the pheromone and the sufficiency function:
[0060] First, calculate the number of parameters used in the CNN corresponding to the hyperparameter selection, the validation set error rate, and the inference time; then, select the three corresponding metrics from step S107.
[0061] The parameter quantity refers to the number of parameters of the CNN model, which is the total number of all learnable tensor elements, specifically including: convolution and weights, biases, batch normalization and fully connected weights and biases;
[0062] The inference time refers to the inference time of the CNN model on the validation set data. This is because the algorithm structure is divided into two layers: the outer layer is the ant colony algorithm and the inner layer is the CNN algorithm. The ant colony algorithm depends on the calculation results of the CNN inference. The search efficiency of the ant colony algorithm depends on the inference time. At the same time, the fast response capability of the CNN model is also an important indicator of this invention, so it has high requirements for inference time.
[0063] In a preferred embodiment, step S106 involves data cleaning, data transformation, sample equalization, and data augmentation of the power system operating status data, including:
[0064] Data cleaning: Remove duplicate packets, invalid packets, and noisy data to ensure the purity of the dataset;
[0065] Data transformation: Converting the format of data, such as unifying the format of timestamps and addresses in different protocols, and performing data normalization, such as mapping the range of physical quantities in power messages to standard intervals.
[0066] Sample equalization: making the number of normal and abnormal samples similar to prevent model imbalance;
[0067] Data augmentation: artificially expanding the sample without changing the labels;
[0068] In a preferred embodiment, the accuracy of the system safety operation status assessment required in step S107 includes:
[0069] The test set data includes normal samples, abnormal samples, and extended samples composed of power system state data. It is used to test the model once, and the corresponding results are only used to determine whether to stop the loop. Unlike the test process using validation set data, the results are used to guide the selection of hyperparameters and prevent overfitting.
[0070] In a preferred embodiment, the requirements that the final model needs to meet in step S108 specifically include:
[0071] The appropriate function value is already small enough, meaning that the model's hyperparameters, the number of model parameters, and the inference speed are all optimal;
[0072] The accuracy of the system's safe operation status assessment met expectations, ensuring the accuracy of the CNN safety assessment after the model went online.
[0073] Compared with the prior art, the present invention has the following beneficial effects: The present invention provides a detailed description of the establishment of the "trusted data flow model", and introduces a whitelist rule of "legitimate function code-operation instruction-equipment asset" for auxiliary judgment in the process of system security judgment and assessment. At the same time, it relies on the data collected by the Internet of Things for analysis, which greatly improves the accuracy of the security status assessment of the power monitoring system. Attached Figure Description
[0074] Figure 1 This is a flowchart of a preferred embodiment of the present invention for a rapid assessment method of the safe operation status of a power system based on an ant colony-CNN coordination model.
[0075] Figure 2 This is a structural block diagram of the ant colony-CNN coordination model according to a preferred embodiment of the present invention. Detailed Implementation
[0076] The present invention will be further described below with reference to the accompanying drawings and embodiments.
[0077] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.
[0078] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations according to this application; as used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise; furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.
[0079] refer to Figure 1-2 This invention provides a rapid assessment method for the safe operation status of a power system based on an ant colony-CNN coordination model. Its core lies in constructing a reliable flow model, training a CNN model of power messages, building an ant colony-CNN coordination model, and optimizing the hyperparameters of the CNN model to achieve rapid assessment of the safe operation status of the power system. The following detailed explanation uses a specific power system safe operation status monitoring scenario as an example. The method specifically includes the following steps:
[0080] Step S101: Data Acquisition
[0081] This method uses the WIRESHARK network packet capture tool to collect power messages, and uses filters to obtain JSON structured data. This data is then parsed to extract all process parameters and process operations. At the same time, the relevant naming information and regional information carried by each power message are recorded for the next step of building a trusted data stream model.
[0082] Step S102: Trusted Data Flow Modeling
[0083] 1) Business scenario analysis and physical mapping establishment
[0084] Objective: To clarify the types of power grid control services and establish a mathematical mapping between the physical world and message fields.
[0085] Operation: Organize typical power grid control operations, including but not limited to: remote control (closing / opening), remote adjustment (setpoint modification), protection (fault isolation), automatic control (AVC, AGC), and synchronous phasor measurement; associate each operation scenario with the primary equipment (circuit breakers, transformers, lines, etc.) and secondary equipment (protection devices, measurement and control units, merging units, etc.), forming an equipment catalog with unique asset codes. Identify all key physical quantities involved in the operation, control, and protection of each piece of equipment (e.g., the "opening / closing position" of circuit breakers, the "winding temperature" of transformers, and the "A-phase current RMS value" of lines).
[0086] Based on the IEC 61850 SCL (System Configuration Language) document or actual engineering configuration, establish a strict mapping relationship: [Substation] - [Bay] - [Equipment (Asset Code)] - [Logical Node] - [Data Object] → [Specific Address / Index / Reference in Communication Message]; ensuring that each data point in this mapping relationship corresponds to a real, calibrable sensor or actuator. This mapping table serves as the static foundation of the "digital twin" and is stored in the model knowledge base. Any subsequent data must be traceable to this table to be considered "trustworthy".
[0087] 2) Message structure parsing and field extraction
[0088] Objective: To extract, clean, align, and structure data from raw messages to form feature sequences that can be used for analysis.
[0089] Operation: Configure corresponding parsers for protocols such as GOOSE (High-Speed Events), MMS (Comprehensive Data Service), and IEC 104 (Telecommunications Control System), parsing not only numerical values but also semantics (e.g., stNum and sqNum in GOOSE are used to determine message sequence continuity):
[0090] (1) Identification features: Equipment ID, asset code, data object reference, used for data traceability.
[0091] (2) Measurement characteristics: instantaneous or effective values of analog quantities such as current, voltage, and power (process parameters).
[0092] (3) Status characteristics: switch position, pressure plate status, device health status (binary or enumerated status).
[0093] (4) Event characteristics: protection start / action signal, alarm signal, operation record (process operation).
[0094] (5) Quality characteristics: data validity, whether it has been replaced, time stamp synchronization status, communication interruption flag.
[0095] (6) Timing characteristics: message arrival time, sampling time stamp, event occurrence time stamp.
[0096] Using precise timestamps in the messages (such as IEEE 1588), data from different devices are unified to the same time base. For data without precise timestamps, interpolation or state preservation methods are used for alignment. Based on the power grid wiring diagram and equipment mapping relationships, multiple data points (such as current at both ends of the line, voltage of related buses) at the same electrical node or the same protection zone are associated into feature groups. Centered on an event (such as an operation command) or a fixed time window, all associated features are extracted to form a structured data record with temporal and spatial context.
[0097] 3) Security Status Definition and Tag Construction
[0098] Objective: To assign a "safety status" label to each piece of data, establishing a foundation for supervised learning.
[0099] Operation: Define system security status categories: (1) Equipment / component level status: normal, alarm (e.g., overload), fault (e.g., short circuit), maintenance; (2) Local system level status: normal operation, risk warning (e.g., voltage exceeding limit), abnormal operation (e.g., power flow reversal, power distribution imbalance), fault state; (3) Information network security status: normal communication, communication interruption, abnormal message (e.g., malformation, overclocking), suspected malicious instructions (e.g., operation from unauthorized sources).
[0100] Develop a tag generation rule engine. The engine takes structured data records generated in Phase 2 as input and outputs security status tags.
[0101] Example of a rule:
[0102] IF Line differential protection action signal = TRUE AND corresponding circuit breaker trip signal = TRUE AND fault recording data confirmation THEN tag = "Line fault (correct action)".
[0103] If a remote tripping command is received AND the command source is not in the preset whitelist AND there is currently no protection activation signal THEN tag="abnormal command (suspected attack)".
[0104] If the three-phase voltage amplitude imbalance exceeds the set threshold and persists for more than time T, then the tag is “voltage imbalance anomaly”.
[0105] This process generates a high-quality supervised learning dataset, where the features are fused multidimensional data and the labels are the security states determined by rules.
[0106] 4) Construction of a Trusted Data Flow Model
[0107] Objective: To construct a composite reliable model that combines deterministic causal logic with statistical correlation.
[0108] operate:
[0109] (1) Construct a causal chain model for the white-box part:
[0110] First, the key safety constraints are formally described. For example, the legality of a "circuit breaker closing" operation depends on its preceding conditions (e.g., the corresponding grounding switch is in the "open" position, and the synchronization verification conditions are met) and subsequent expectations (e.g., the current should rise steadily after closing, rather than a sudden increase in short-circuit current). Second, these strong causal relationships are modeled as state machines or timing logic rules, forming the core safety verification layer of the model. Any behavior that violates this layer of causal logic can be directly identified as a high-risk anomaly.
[0111] (2) Construct an association feature model for the gray box part:
[0112] For complex states that cannot be described by simple rules (such as "early insulation degradation of transformers"), a set of statistically correlated physical quantities is defined (such as: gas content in oil, winding temperature, load current, vibration spectrum). This correlation is provided as a feature set for subsequent machine learning models such as CNNs to learn from, and the model will explore the complex nonlinear mapping between these features and the safe state.
[0113] 5) Model validation and self-calibration mechanism activated.
[0114] Objective: To verify the accuracy of the model and its ability to adapt to changes in the power grid.
[0115] Operation: Using historical fault waveform data with clear event records and SCADA event logs, verify the accuracy, recall, and timeliness of the model's state judgment; in the security agent or mirror system, compare the model evaluation results with the stability control system actions and the results confirmed by the manual dispatcher, and calculate the false alarm and false negative rates; inject various known abnormal data patterns and attack scripts to test the robustness of the model.
[0116] When persistent false alarms or missed alarms occur, or when there are significant changes in the power grid structure or equipment parameters, the self-correction process is initiated, as described below:
[0117] (1) Case capture: Automatically save misjudged cases and their context data into the "cases to be analyzed library".
[0118] (2) Expert intervention: Domain experts analyze the case to determine whether the problem is due to missing / incorrect rules, insufficient features, or model limitations.
[0119] (3) Knowledge update: If it is a rule problem, add, delete or modify the rules in the causal chain model; if it is a feature or model problem, add new cases to the training dataset.
[0120] Finally, the model needs to be retrained periodically to achieve the dynamic evolution of the reliable data stream.
[0121] Step S103: Initial selection of CNN structure
[0122] Based on the feasible flow model, data samples are partitioned and labeled to obtain a two-dimensional matrix of power system operating states that can be used for CNN model training. The following suggestions are made for determining the input size and output category:
[0123] Input size: Reshape the one-dimensional vector corresponding to each state into a two-dimensional matrix, and take the maximum width and height (H, W); if the vector length is a prime number, pad it with zeros to the nearest multiple of 8 and then take the square root to ensure divisibility.
[0124] Output categories: safe operating status + number of abnormal subclasses (it is recommended to have a maximum of 8 classes, otherwise the sample imbalance will make training difficult).
[0125] First, choose a CNN model structure with a "minimum working skeleton":
[0126] Using a variant of MobileNetV3-Small, we have the following set of "median values":
[0127] (1) Stage0: Conv3×3 (stride=2, 16 channels);
[0128] (2) Stage 1~3: 3 depth separable bottlenecks, channels 16→48→96, each stage is repeated once;
[0129] (3) Stage 4: Conv1×1 (dimension reduced to 128) → GAP → FC(K);
[0130] (4) Activation: ReLU6; dropout=0.15; BN momentum=0.1;
[0131] Then, the hyperparameters that need to be adjusted are: kernel size and decomposition size, number of channels, dropout rate and BN adjustment factor, depthwise separable expansion ratio and block repetition count;
[0132] Finally, the minimal CNN model is validated based on the set hyperparameters.
[0133] Step S104: Determine the range of hyperparameter values
[0134] The discrete value ranges for the five hyperparameters identified earlier are determined as follows:
[0135]
[0136] Steps S105, S106, and S107: Optimize the hyperparameters of the CNN model using the ant colony algorithm.
[0137] Reference Figure 2 The specific implementation process of the ant colony-CNN coordination model consisting of steps S105, S106, and S107 is explained. In step S201, the heuristic factors α (pheromone importance) and β (heuristic information importance) are adjusted so that α dynamically decreases while β dynamically increases, ensuring the convergence speed in the early stage of the algorithm and the global optimization ability in the later stage. Specifically, it is expressed as: α=(G / (c1*g+1) ) - g / G + 1, β = ( c2*g / (G+1) ) - G / (g+C2) + 1, where g and G are the current iteration number and the total iteration number, respectively, and c1 and c2 are adjustable constant parameters. The heuristic factors are also adjusted based on historical performance, and their values are:
[0138]
[0139] in The historical fitness variance of hyperparameter i in dimension j is defined by δ, which is a constant to avoid division by zero. Additionally, the number of ants m and nodes n need to be initialized; in this project, m=5, and n can be adjusted according to the actual optimization speed.
[0140] In step S202, ant paths are selected based on the constructed hyperparameter discrete space. Each ant selects the next value sequentially according to the probability of pheromone concentration and heuristic information. The probability of the k-th ant moving from node i to node j is:
[0141]
[0142] in Let be the pheromone concentration on the paths of nodes i and j at time t; J is the reciprocal of the distance between nodes i and j at time t; k Let k be the set of nodes that the k-th ant has not yet visited; Let be the pheromone concentration on the paths of nodes i and s at time t; Let be the derivative of the distance between nodes i and s at time t;
[0143] In step S203, the fitness function is the reciprocal of the weighted average sum of the validation set error rate, the number of parameters, and the inference time. Step S106 needs to be implemented to construct a CNN based on the hyperparameters in the current ant colony algorithm iteration, and train it using the CNN structure selected in step S103 and the training set samples (already labeled). After training, the validation set samples are used for testing to generate the fitness function value corresponding to the hyperparameters, that is, the fitness function value of one iteration of the ant colony algorithm.
[0144] In step S204, the trained CNN model is used to test the test set samples to obtain the accuracy of the CNN in assessing the safe operation status of the power system, so as to implement step S207.
[0145] In step S205, the information evaporation coefficient is adjusted to ensure that the ant colony algorithm optimization process is a positive feedback, gradual process, and is set to ρ(i) = exp(-i 2 / 2σ 2 ), σ=i max / ε, where i is the current iteration number, i max ε is the maximum number of iterations, and ε(1) is the pheromone decay coefficient.
[0146] In step S206, the pheromone is updated. This should address the situation of being trapped in a local optimum. First, the pheromone reward on the locally optimal path is reduced, and the worst-performing path is eliminated. Simultaneously, pheromone is accumulated on other paths. The specific process is as follows:
[0147] (1) Global pheromone update: After each iteration, the pheromone of all paths is updated as follows.
[0148]
[0149] in:
[0150] It represents the pheromone concentration on the path (i,j) before the current iteration;
[0151]
[0152]
[0153]
[0154] (2) Pheromones increment calculation (only for paths visited): For the k-th ant, if its path contains the edge (i,j), then ;otherwise: Among them, F kQ is the fitness value of the hyperparameter combination corresponding to the k-th ant (i.e., the fitness function value calculated in step S203); Q is a positive constant (e.g., Q = 1.0) used to adjust the pheromone intensity scale.
[0155] (3) Enhanced Elite Strategy: In addition to ordinary ants, the globally optimal ant (historically best solution) releases pheromones again: Among them, F best It is the maximum fitness value that has appeared in all iterations so far, and the operation is performed on edge (i,j) on the globally optimal path.
[0156] (4) Local Optimum Path Penalty Mechanism: To avoid the algorithm getting trapped in local optima, a penalty mechanism is introduced. If a path (i,j) has not been selected by any ant in the last N generations (e.g., N=5), or its average fitness is consistently lower than 10% of the global average fitness, then a penalty is applied.
[0157]
[0158] Penalty_rate is the penalty rate, which is set to 0.2 (i.e., a 20% reduction).
[0159] (5) Worst Path Elimination Mechanism: Record the fitness of all ants in each generation, find the worst-performing ant (lowest fitness): set the pheromone level of all paths (i,j) traversed by this ant to the minimum allowed value (e.g., ...). Its code form is
[0160] for each (i,j) in worst_ant_path:
[0161] tau_new[i][j] = max(tau_new[i][j], tau_min)
[0162] It is recommended to set tau_min= 0.01 and tau_max= 5.0.
[0163] (6) Pheromone boundary mechanism: After the update, all Cutting:
[0164]
[0165] In step S207, the reasoning result obtained in S204 is judged. If the requirements are met, the iterative solution of the ant colony algorithm is directly terminated; otherwise, the process returns to step S201.
[0166] Step S108: Extract the CNN model for power system safe operation status assessment
[0167] Save the following four types of data:
[0168] (1) Optimal CNN model file (including weights, structure, hyperparameter vectors, fitness, and performance metrics):
[0169] The finalized CNN model is serialized and stored in both TorchScript and ONNX formats.
[0170] TorchScript is a model intermediate representation format provided by PyTorch, which supports efficient inference in C++ or embedded devices without Python environment, and is suitable for deployment on local edge computing nodes in substations; ONNX (OpenNeural Network Exchange) is an open cross-framework model exchange standard, compatible with mainstream inference engines such as TensorFlow, TensorRT, and OpenVINO, which facilitates high-performance inference on different hardware platforms (such as NVIDIA GPU, Huawei Ascend, and Intel CPU).
[0171] The file also embeds the model structure, the weights obtained from training, the corresponding optimal hyperparameter vectors (such as learning rate, number of convolutional layers, number of filters, etc.), the fitness value (i.e., the inverse of the weighted comprehensive index of validation set error rate, number of parameters and inference time), and performance indicators such as accuracy and F1 score on the test set.
[0172] (2) Ant colony knowledge base: Stores the final state knowledge of the ant colony optimization process, including: Final state pheromone matrix: Records the "historical experience intensity" on each hyperparameter combination path, reflecting which configurations have been verified as effective multiple times; Final iteration values of α, β, and ρ: Represent the importance of pheromone, the importance of heuristic information, and the information evaporation coefficient, respectively, used to analyze the convergence characteristics of the algorithm; Top 10 best paths in history: The top 10 hyperparameter combinations in terms of fitness.
[0173] This knowledge base supports a warm start mechanism—when the power grid topology expands (e.g., by adding a bus or line) or the operating data distribution shifts (e.g., by a significant increase in the penetration rate of new energy sources), this knowledge base can be directly loaded as the initial state for a new optimization task, avoiding a re-search from a random starting point, greatly shortening the parameter tuning cycle, and improving the system's adaptive capability.
[0174] (3) Sample partitioning index table:
[0175] Save the unique identifiers (IDs) of samples in the training, validation, and test sets, along with their corresponding ground truth labels, to form a traceable partition index table. For example:
[0176] TS_20250101_001 → Training Set → Security
[0177] TS_20250101_002 → Test Set → Instability
[0178] This table does not contain raw data, but only records sample attribution and semantic labels, meeting the power industry's audit and record-keeping requirements for the model development process. If a misjudgment occurs during actual model operation, this index can be used to quickly trace back the source of training and testing data, verifying the fairness and reproducibility of model evaluation, and complying with relevant compliance standards such as the "Regulations on Security Protection of Power Monitoring Systems".
[0179] (4) Trusted data stream version number:
[0180] A data semantic version number (e.g., v1, v2, v3…) is maintained to identify the mapping relationship between physical quantities and communication message fields in the current power system. For example, in IEC 61850 or 104 protocols, specific byte positions correspond to physical quantities such as voltage, current, or frequency. When this mapping relationship is updated due to field equipment upgrades, communication protocol changes, or monitoring point adjustments, the version number is automatically incremented. The system will detect this change and automatically trigger a new round of CNN hyperparameter optimization and model retraining to prevent the old model from making incorrect judgments due to input misalignment under the new data semantics. This mechanism is a core component of Model Lifecycle Management (MLOps), ensuring the long-term reliable operation of AI models in dynamic industrial environments.
[0181] The above four types of data together constitute the Model Delivery Package, which not only supports the current deployment, but also provides a complete technical foundation for future model iteration, fault tracing, compliance review and cross-scenario migration.
Claims
1. A rapid assessment method for the safe operation status of a power system based on an ant colony-CNN coordination model, characterized in that, Includes the following steps: S101: Collects real-time data streams from the power monitoring network and performs deep protocol parsing on the real-time data streams to extract operation instructions, function codes, and process data; S102: Construct a trusted flow, conduct a principle analysis of the safe operation state of the power system, and associate the specific physical values that may be involved with the safe operation state. The physical values must exist in the corresponding sensors and return power messages. The resulting set of multiple physical variables - safe state names is the trusted data flow model. S103: Determine the input window size and the number of output categories for the CNN, as well as the internal structure of the CNN; S104: Determine the discrete values or ranges of hyperparameters by combining the theoretical range of hyperparameter values and the results of manual testing; S105: Based on the preliminary verification results, the ant colony algorithm was used to optimize the hyperparameters. The inverse of the verification set error rate and the number of parameters was used as the pheromone, and the adequacy function was taken as the inverse of the weighted average sum of the verification set error rate, the number of parameters, and the inference time. S106: Data preprocessing is required before training the model, including data cleaning, data transformation, sample equalization, and data augmentation. S107: Using a CNN model with specified hyperparameters, perform inference on the data on the validation set, calculate the inference time and error rate, and determine whether the accuracy of the system security status assessment meets the requirements. If yes, proceed to step S108; otherwise, return to step S105. S108: When the model meets the requirements, extract the final CNN model to evaluate the safety status of the power system.
2. The method for rapid assessment of the safe operation status of a power system based on an ant colony-CNN coordination model according to claim 1, characterized in that, The data stream in step S101 includes: A large number of normal and abnormal power messages, containing various protocol communication data in the power monitoring network, are captured using network packet capture tools; the process data refers to the raw numerical fields carried in the power system monitoring protocol data frames, representing the measurement or status record of a certain physical quantity at a certain moment; it is itself an information layer.
3. The method for rapid assessment of the safe operation status of a power system based on an ant colony-CNN coordination model according to claim 1, characterized in that, The construction of the trusted data flow model in step S102 includes: Based on the principles of power systems, a causal relationship is established between a combination of physical values and a specific security state; The physical values mentioned include line voltage, current, frequency, active power, reactive power, harmonic content, equipment temperature, and oil level / gas density, which are key parameters that directly reflect the health of equipment operation. The power message contains sampled or measured values, as well as equipment identification information and regional / geographical information that uniquely identify the source of the measurement point, thus forming a "traceable" data unit. The system's safe operating status refers to the state in which the system is within a normal or acceptable risk range in both information security and operational security dimensions; it, together with the system's abnormal state, constitutes a complete description of the system's state. The security status is specifically divided into: 1) System information security: refers to the protection of the communication and commands of the monitoring system and protection and control system from unauthorized access, tampering or denial-of-service attacks, and to their trustworthy, intact and available state; 2) System operation safety: refers to the state in which the physical equipment of the power network operates stably within the specified electrical and mechanical limits, meeting the requirements for power quality and continuous power supply; The abnormal system state is the opposite of the safe state, including: Ⅰ) Abnormal system information: This refers to situations where the system has been subjected to malicious software intrusion, illegal command injection, denial-of-service attacks, data tampering network attacks, or communication failures, resulting in unreliable information; II) Abnormal system operation: refers to physical failures or deterioration of electrical performance caused by equipment aging, insulation damage, external damage, or improper operation; The power message is the carrier for realizing the above-mentioned status information perception; a complete trusted data message includes: Sampling / Measurement Fields: Instantaneous values, effective values, or status values that carry physical values; Device Identity / Asset Field: Clearly identifies the device object from which the data originates, enabling the binding of data to physical devices; Geographic location field: Identifies the physical or logical location of the device; Quality and security fields: identify data validity, time synchronization tags, and communication security tags; Mainstream protocols include GOOSE for fast trip signals, MMS for client / server model access, and IEC 104 for telecontrol communication. When building a trusted flow, these protocols need to be deeply analyzed to extract all the key fields mentioned above.
4. The method for rapid assessment of the safe operation status of a power system based on an ant colony-CNN coordination model according to claim 1, characterized in that, The method for confirming the input window size and the number of output categories in step S103 is as follows: Based on the trusted data flow model established in step S102, the one-dimensional data of the power system state corresponding to each type of security state is converted into a two-dimensional matrix, and the largest two-dimensional matrix size is taken as the input window size. Based on the structure of the power system, analyze the number of system state types that it has, which are composed of various safe states or potential system faults, and take this type as the output classification number.
5. The method for rapid assessment of the safe operation status of a power system based on an ant colony-CNN coordination model according to claim 1, characterized in that, The inner structure specification in step S103 is as follows: For a typical CNN, the inner structure requires specifying parameters such as kernel size, number of channels, dropout rate, and BN adjustment factor; Lightweight CNNs require specifying the convolution decomposition size, depth separable expansion ratio, and block repetition count for their inner layer structure.
6. A method for rapid assessment of the safe operation status of a power system based on an ant colony-CNN coordination model according to claim 1 or 3, characterized in that, The hyperparameter range and manual testing determined in step S104 include: The hyperparameters include: kernel size and decomposition size, number of channels, dropout rate and BN adjustment factor, depth separable expansion ratio and block repetition count; The manual testing scheme is as follows: test the possible values of the hyperparameters of the CNN, and the accuracy of the CNN corresponding to each set of hyperparameters on the validation set should not be lower than the expected value.
7. The method for rapid assessment of the safe operation status of a power system based on an ant colony-CNN coordination model according to claim 1, characterized in that, Step S105 involves calculating the pheromone and the sufficiency function: First, calculate the number of parameters used in the CNN corresponding to the hyperparameter selection, the validation set error rate, and the inference time; then, select the three corresponding metrics from step S107. The parameter quantity refers to the number of parameters of the CNN model, which is the total number of all learnable tensor elements, specifically including: convolution and weights, biases, batch normalization and fully connected weights and biases; The inference time refers to the inference time of the CNN model on the validation set data. This is because the algorithm structure is divided into two layers: the outer layer is the ant colony algorithm and the inner layer is the CNN algorithm. The ant colony algorithm relies on the calculation results of the CNN inference, and the search efficiency of the ant colony algorithm depends on the inference time.
8. The method for rapid assessment of the safe operation status of a power system based on an ant colony-CNN coordination model according to claim 1, characterized in that, Step S106 involves data cleaning, data transformation, sample equalization, and data augmentation of the power system operating status data, including: Data cleaning: Remove duplicate packets, invalid packets, and noisy data to ensure the purity of the dataset; Data transformation: Converting the format of data, such as unifying the format of timestamps and addresses in different protocols, and performing data normalization, such as mapping the range of physical quantities in power messages to standard intervals. Sample equalization: making the number of normal and abnormal samples similar to prevent model imbalance; Data augmentation: artificially expanding the sample without changing the labels.
9. The method for rapid assessment of the safe operation status of a power system based on an ant colony-CNN coordination model according to claim 1, characterized in that, The accuracy rate of the system safety operation status assessment required in step S107 includes: The test set data includes normal samples, abnormal samples, and extended samples composed of power system state data. It is used to test the model once, and the corresponding results are only used to determine whether to stop the loop. Unlike the test process using validation set data, the results are used to guide the selection of hyperparameters and prevent overfitting.
10. The method for rapid assessment of the safe operation status of a power system based on an ant colony-CNN coordination model according to claim 1, characterized in that, The specific requirements that the final model needs to meet in step S108 include: The appropriate function value is already small enough, meaning that the model's hyperparameters, the number of model parameters, and the inference speed are all optimal; The accuracy of the system's safe operation status assessment met expectations, ensuring the accuracy of the CNN safety assessment after the model went online.