Anti-malicious data inverter cluster distributed scada system and method

Abstract

The application relates to the technical field of inverter control, and particularly discloses an inverter cluster distributed SCADA system and method resisting bad data, which is applied to an alternating current power distribution network and comprises a plurality of inverter nodes interconnected through a point-to-point communication network. Each inverter node comprises a local acquisition unit for acquiring instantaneous electrical signals of an alternating current outlet of the inverter node and extracting fundamental phasors to generate a local real electrical state vector. The scheme enables a distributed consistency control unit to perform power sharing iteration based on screened and reconstructed reliable data, prevents bottom control instruction deviation caused by data abnormality, and maintains the power output stability and collaborative scheduling capability of the inverter cluster in a complex data interference environment.

Description

Technical Field

[0001] This invention relates to the field of inverter control technology, and in particular to a distributed SCADA system and method for inverter clusters that is resistant to bad data. Background Technology

[0002] In AC distribution networks, multiple inverters typically operate in parallel in a cluster, exchanging information between nodes via a distributed communication network. Each inverter node receives operating data such as voltage and power from neighboring nodes, combines this data with locally collected electrical status data, and runs a distributed consensus control algorithm to achieve power sharing and coordinated control within the cluster. Most existing distributed control systems rely directly on data transmitted through the communication network for control, and their underlying control logic is built upon the conventional assumption that the data exchanged between nodes is reliable.

[0003] In real-world operating scenarios, the communication network of the power distribution network operates in a complex industrial environment. Sensor hardware aging and drift, communication links experiencing errors due to environmental interference, or the system being injected with spurious data can all cause inverter nodes to receive abnormal electrical status data.

[0004] Because existing technologies lack a cross-validation mechanism for the physical validity of interactive data, this defective data will directly participate in the consistency iteration calculation, causing the power correction calculated by the system to deviate from the actual demand, thereby causing fluctuations in the inverter output power and affecting the overall operation of the distribution network. Summary of the Invention

[0005] This invention aims to at least partially solve one of the technical problems in related technologies. Therefore, the objective of this invention is to propose a distributed SCADA system and method for inverter clusters resistant to adverse data, in order to maintain the power output stability and collaborative scheduling capability of inverter clusters under complex data interference environments.

[0006] To achieve the above objectives, a first aspect of the present invention proposes a distributed SCADA system for inverter clusters resistant to adverse data, applied to an AC distribution network, comprising multiple inverter nodes interconnected via a point-to-point communication network, each inverter node comprising:

[0007] The local acquisition unit is used to acquire the instantaneous electrical signal of the AC output of this inverter node and extract the fundamental phasor to generate the local real electrical state vector.

[0008] The communication unit is used to receive the real-time network state vector of the adjacent inverter node and broadcast the local real electrical state vector.

[0009] The boundary observation and verification unit is used to construct a multi-dimensional physical boundary system based on the AC power flow equation and device physical constraints, perform cross-verification on the real-time network state vector to identify bad data, and reconstruct and generate a reliable state vector through a multi-node weighted fusion method.

[0010] A distributed consensus control unit is used to perform power equalization iteration based on the local real electrical state vector and the trusted state vectors of all adjacent inverter nodes to generate a power correction amount;

[0011] The droop control and drive unit is used to generate drive pulses based on the power correction amount to control the output power of this inverter node.

[0012] To achieve the above objectives, a second aspect of the present invention proposes a distributed SCADA control method for inverter clusters resistant to adverse data. For each inverter node, the method includes the following steps:

[0013] Step 1: Collect the instantaneous electrical signal at the AC output of this inverter node and extract the fundamental phasor to generate the local real electrical state vector;

[0014] Step 2: Receive the real-time network state vector of the adjacent inverter node and broadcast the local real electrical state vector to the point-to-point communication network;

[0015] Step 3: Construct a multi-dimensional physical boundary system based on the AC power flow equation and device physical constraints, perform cross-validation on the real-time network state vector to identify bad data, and reconstruct a reliable state vector through multi-node weighted fusion.

[0016] Step 4: Perform power equalization iterative calculation based on the local real electrical state vector and the reliable state vectors of all adjacent inverter nodes to generate power correction amount;

[0017] Step 5: Generate a drive pulse based on the power correction amount to control the output power of this inverter node.

[0018] To achieve the above objectives, a third aspect of the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory. When the computer program is executed by the processor, it implements the above-described inverter cluster distributed SCADA method for resisting malfunctioning data.

[0019] The technical solution of this invention sets up a boundary observation and verification unit in the inverter node, enabling the node to cross-verify the received data from adjacent nodes using AC power flow equations and device physical constraints before executing coordinated control. In actual distribution network grid connection operations, when the communication link transmits electrical data that does not conform to physical laws due to environmental interference or abnormal events, the system can identify this abnormal data and use a multi-node weighted fusion method to perform reconstruction calculations and obtain a reliable state vector.

[0020] This scheme enables the distributed consensus control unit to perform power distribution iterations based on filtered and reconstructed reliable data, preventing deviations in underlying control commands caused by data anomalies and maintaining the power output stability and collaborative scheduling capability of the inverter cluster in complex data interference environments. Attached Figure Description

[0021] Figure 1 This is a schematic diagram illustrating the implementation of the inverter cluster distributed SCADA system for resisting bad data provided by the present invention;

[0022] Figure 2 This invention provides a three-dimensional response surface plot of the feasible region of static amplitude and dynamic rate of change based on AC power flow constraints in a distributed SCADA system for inverter clusters that resists adverse data.

[0023] Figure 3 This is a multi-node health-weighted power equal distribution iterative convergence curve in the inverter cluster distributed SCADA system for resisting bad data provided by this invention;

[0024] Figure 4 This is a comparison diagram of the asynchronous data timing phase and amplitude compensation waveforms based on the physical inertia equation in the inverter cluster distributed SCADA system for resisting bad data provided by the present invention.

[0025] Figure 5 This invention provides the frequency domain amplitude-frequency response diagram of a high-order bandpass filter for physical watermark feature extraction in a distributed SCADA system for inverter clusters that resists bad data.

[0026] Figure 6 This invention provides a three-dimensional surface and thermal distribution map of the cross-correlation characteristics of the spatial response of multiple nodes in a distributed SCADA system for inverter clusters that resists adverse data.

[0027] Figure 7 This is a bitmap comparing the transient response of inverter cluster power output before and after bad data injection in the distributed SCADA system of inverter cluster with resistance to bad data provided by this invention.

[0028] Figure 8This is a flowchart illustrating the inverter cluster distributed SCADA control method for resisting adverse data provided by the present invention.

[0029] Figure 9 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0030] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0031] The following description, with reference to the accompanying drawings, describes an inverter cluster distributed SCADA system, control method, and electronic device that resists adverse data.

[0032] Example 1:

[0033] like Figure 1 As shown, this embodiment provides a distributed SCADA system for inverter clusters that is resistant to adverse data, applied to an AC distribution network. It includes multiple inverter nodes interconnected via a point-to-point communication network, and each inverter node comprises:

[0034] The local acquisition unit is used to acquire the instantaneous electrical signal of the AC output of the inverter node and extract the fundamental phasor to generate a local true electrical state vector. The communication unit is used to receive the real-time network state vector of the adjacent inverter nodes and broadcast the local true electrical state vector. The boundary observation and verification unit is used to construct a multi-dimensional physical boundary system based on the AC power flow equation and device physical constraints, perform cross-verification on the real-time network state vector to identify bad data, and reconstruct and generate a reliable state vector through multi-node weighted fusion. The distributed consistency control unit is used to perform power equalization iteration based on the local true electrical state vector and the reliable state vectors of all adjacent inverter nodes to generate a power correction amount. The droop control and drive unit is used to generate drive pulses according to the power correction amount to control the output power of the inverter node.

[0035] It should be noted that in the above overall system architecture, the AC distribution network refers to the power grid network structure with a voltage level of 10 kV and below, which is responsible for distributing electrical energy to various types of end users.

[0036] The inverter node refers to a power electronic device that has the ability to convert DC to AC power in a physical entity and has built-in microcontroller chips such as digital signal processors and field-programmable gate arrays.

[0037] The point-to-point communication network refers to an industrial communication topology that does not rely on a centralized central server, but rather allows each inverter node to directly exchange data. Typical physical media include fiber optic Ethernet buses, and it runs specific industrial control protocols.

[0038] The local real electrical state vector is a multi-dimensional data structure that contains core electrical parameters of the inverter node, such as voltage amplitude, voltage phase angle, active power, and reactive power, which are accurately measured within the current control cycle.

[0039] For example, the local acquisition unit mainly consists of a high-precision Hall voltage and current sensor, a low-pass anti-aliasing filter circuit, and a high-speed analog-to-digital converter chip at the hardware level.

[0040] The sensor converts the high-voltage signal from the AC distribution network side into a low-voltage analog signal at a fixed ratio. After the high-frequency switching noise is filtered out by the filter circuit, the signal is discretized by the analog-to-digital converter chip.

[0041] To extract the fundamental phasor, the local acquisition unit internally runs a synchronous rotating coordinate system transformation algorithm based on a phase-locked loop. This algorithm maps and projects the instantaneous sampled values ​​in a stationary three-phase AC coordinate system onto a two-phase orthogonal coordinate system that rotates synchronously with the grid's fundamental frequency. This converts the periodically alternating AC components into DC components, significantly improving the accuracy of subsequent controller extraction and tracking of the electrical state. The generated local true electrical state vector is stored in the controller's direct memory access register for use by other units.

[0042] Optionally, the communication unit employs a network interface controller chip that supports high real-time transmission. At the start of each fixed control cycle, the communication unit packages the local real electrical state vector generated in the previous cycle into a standard data frame and broadcasts it in the point-to-point communication network via the User Datagram Protocol (UDP).

[0043] At the same time, the communication unit enables the receive interrupt, captures the data frames broadcast by all adjacent inverter nodes in real time, unpacks them, and extracts the real-time network state vector that represents the operating status of the surrounding network.

[0044] Specifically, in this embodiment of the system, the boundary observation and verification unit includes:

[0045] The boundary calculation submodule is used to obtain the line impedance parameters between adjacent inverter nodes, combine the AC power flow equation to invert and calculate the static amplitude feasible range of each component of the real-time network state vector, and calculate the single-cycle rate of change limit of each component of the real-time network state vector based on the device physical constraints.

[0046] The two-level physical cross-verification submodule is used to sequentially perform static amplitude verification based on the feasible range of the static amplitude and dynamic rate of change verification based on the single-cycle rate of change limit.

[0047] Run the baseline verification submodule to perform a second statistical baseline fine-check on the data verified by the two-level physical cross-verification submodule in order to identify suspicious hidden abnormal data;

[0048] The multi-node joint reconstruction submodule is used to generate the trusted state vector by fusing the inversion results of multiple adjacent trusted nodes for all the verified abnormal data.

[0049] It is important to note that the boundary observation and verification unit is the core of this system for resisting interference from adverse data, and it operates at the highest priority of the microcontroller's hardware interrupts. During system initialization and operation, the boundary calculation submodule continuously maintains a mapping table recording the spatial topology of the distribution network and line impedance parameters.

[0050] By calling the physical parameters in the mapping table, the boundary calculation submodule no longer passively trusts the data received by the communication unit, but actively performs physical inversion and range definition for the data of adjacent inverter nodes based on the most fundamental energy conservation and Kirchhoff's laws (i.e., AC power flow equations) of the power system.

[0051] The static amplitude feasible range defines the theoretically achievable maximum and minimum value boundaries of a certain electrical state variable under the current grid topology and load conditions. The single-cycle rate of change limit defines the maximum change amplitude that a certain electrical state variable can undergo between two adjacent control cycles, limited by the charging and discharging speed of the inverter's own hardware capacitors and inductors, as well as the limitations imposed by the electromagnetic propagation laws of the lines.

[0052] For example, when calculating the feasible range of the static amplitude, the boundary calculation submodule incorporates the following power grid physical constraints: line thermal stability constraint that the square root of the sum of the squares of the active and reactive power transmitted by the line is not greater than the line's rated apparent power; voltage deviation constraint that the node voltage deviation does not exceed the preset allowable voltage range; and power angle stability constraint that the absolute value of the phase angle difference between adjacent inverter nodes is not greater than a preset safety angle. When calculating the single-cycle rate of change limit, the limit indicators used include: the single-cycle rate of change limit of active and reactive power determined by the maximum ramp rate of the inverter's rated power; the single-cycle rate of change limit of voltage amplitude determined by the inverter's voltage regulation rate and the line's electromagnetic transient characteristics; and the single-cycle rate of change limit of phase angle determined by the maximum allowable instantaneous frequency deviation of the distribution network system.

[0053] Specifically, when calculating the aforementioned feasible range of static amplitude, it is necessary to use the active power inversion calculation formula for AC distribution networks to perform physical state deduction. The active power inversion calculation formula used is as follows:

[0054] ;

[0055] in: This represents the active power flowing from this inverter node to adjacent inverter nodes. This represents the voltage amplitude at this inverter node; The voltage amplitude of the adjacent inverter node; This is the admittance value of the line between this inverter node and the adjacent inverter node; This is the voltage phase angle of this inverter node; The voltage phase angle between adjacent inverter nodes; This is the admittance phase angle of the line between this inverter node and the adjacent inverter node.

[0056] In practical industrial applications, the above formula serves to establish a strong physical coupling relationship between the electrical parameters of the nodes. This inverter node can obtain its own accurate voltage amplitude and phase angle in real time, and the admittance amplitude and admittance phase angle of the line are known.

[0057] When the system receives the real-time network state vector from a neighboring inverter node, it can substitute the parameters into the formula described above. If the calculated active power flowing from the current inverter node to the neighboring inverter node violates the aforementioned line thermal stability constraints (i.e., the calculated apparent power causes the line to overheat), or if the voltage amplitude of the neighboring inverter node violates the voltage deviation constraints after substitution, it can be proven from a purely physical perspective that the data reported by the neighboring inverter node through the communication network is false and violates objective physical reality. This provides the system with a low-level physical defense barrier that does not rely on any network layer security protocols.

[0058] like Figure 2 The figure shows the three-dimensional response surface of the physical boundary feasible region based on AC power flow constraints. The horizontal axis corresponds to the node voltage amplitude in per unit, the vertical axis corresponds to the voltage phase angle difference in degrees, and the vertical axis corresponds to the inverted active power in kilowatts.

[0059] The colored gradient surface presented in the figure reflects the spatial distribution of active power calculated by the system based on the electrical data between inverter nodes. Different colors on the surface represent the high and low fluctuations of the power value from negative to positive.

[0060] To achieve a multi-dimensional physical boundary system verification mechanism, multiple sets of semi-transparent boundary constraint planes are introduced in the figure. The red vertical semi-transparent plane defines the voltage deviation boundary in the horizontal coordinate axis range of 0.93 to 1.07, the green vertical semi-transparent plane defines the power angle stability boundary in the vertical coordinate axis range of -30 degrees to +30 degrees, and the purplish-red horizontal semi-transparent plane defines the line thermal stability extreme value boundary in the vertical coordinate axis range of ±600 kilowatts.

[0061] When the electrical status data reported by adjacent inverter nodes falls within the central allowable space defined by the three colored semi-transparent planes mentioned above, the system determines that the data conforms to the physical laws of the distribution network; if the combined coordinate data points exceed the limits formed by the semi-transparent planes, the system identifies it as bad data and triggers a joint reconfiguration procedure.

[0062] In addition, irregular fine undulations and sawtooth-shaped burrs can be observed on the surface morphology of the colored gradient surface. This objectively reflects the high-frequency hardware noise of the sensor and the quantization discrete error of the underlying analog-to-digital converter during sampling in the actual R&D and industrial application environment. This indicates that the current physical boundary judgment mechanism still has poor data tolerance margin under extremely high frequency transient disturbances. This leaves room for technical upgrades for the subsequent system to further introduce adaptive dynamic smoothing filtering algorithms and optimize boundary judgment sensitivity.

[0063] Optionally, the two-level physical cross-validation submodule and the running baseline validation submodule jointly execute a three-level progressive validation algorithm:

[0064] The first level is the static amplitude verification, which compares each data component of the real-time network state vector with the feasible range of the static amplitude one by one. If a component exceeds the limit, the corresponding real-time network state vector is directly determined to be strong bad data.

[0065] The second level is the dynamic change rate verification. The actual change of each data component in a single period is calculated based on the reliable state vector generated in the previous control cycle. If the actual change in a single period exceeds the corresponding single-period change rate limit, it is determined to be dynamic bad data.

[0066] The third level is the operation baseline verification, which constructs a sliding statistical baseline based on a preset number of historical control cycle trusted state vectors, calculates the relative deviation of the data that passed the first two levels of verification, and if the relative deviation exceeds a set threshold, it is determined to be the suspicious hidden abnormal data.

[0067] It is important to note that the three-level progressive verification algorithm enables data review from macro to micro and from static to dynamic perspectives.

[0068] The first-level static amplitude verification mainly filters out severe numerical distortions caused by sensor disconnection or communication data packet loss, which are considered highly undesirable data.

[0069] The second level of dynamic rate of change verification targets data jumps caused by sensor temperature drift, or step-like abnormal data injected by attackers attempting to instantly change the system state.

[0070] Level 3 operational baseline verification is key to combating advanced persistent threats.

[0071] When abnormal data changes its value slowly and in very small increments to circumvent the first two levels of checks, physical extreme value verification fails. In this case, the system uses the relative deviation calculation formula for identification. The relative deviation calculation formula is as follows:

[0072] ;

[0073] in: The relative deviation of the state data of adjacent inverter nodes; The state data component of the current control cycle of the adjacent inverter node; The mean of the state data for the sliding statistical baseline; The standard deviation of the state data is the moving statistical baseline.

[0074] In practical applications, the system allocates a fixed-length circular queue in memory to cache historical safety status data of adjacent inverter nodes, thereby calculating the mean and standard deviation of the status data. If the deviation of the status data component in the current control cycle from the mean exceeds several times the standard deviation of the historical status data, i.e., the relative deviation exceeds a set threshold, it indicates that the data exhibits abnormal fluctuation characteristics that violate its historical statistical distribution pattern. This mechanism effectively captures suspicious and hidden abnormal data lurking within physical boundaries.

[0075] Specifically, the multi-node joint reconfiguration submodule uses a weighted least squares fusion method to calculate the reliable state vector. The specific reconfiguration execution steps are as follows: taking the inverter node as the center, obtain the inversion estimates of the abnormal node state variables independently calculated by all adjacent reliable nodes based on the AC power flow equation; calculate the joint reconfiguration weight coefficient corresponding to each adjacent reliable node, the joint reconfiguration weight coefficient is calculated as the product of the system comprehensive health degree of the adjacent reliable node and the identification confidence degree of the corresponding line parameter; use the joint reconfiguration weight coefficient to perform a weighted summation operation on the inversion estimates of all adjacent reliable nodes to generate the reliable state vector, the reliable state vector includes the finally reconfigured reliable voltage amplitude, reliable voltage phase angle, reliable active power and reliable reactive power.

[0076] For example, to ensure the accuracy and robustness of multi-node joint reconstruction, the system uses a joint reconstruction weight coefficient calculation formula to dynamically allocate trust levels. The calculation formula is as follows:

[0077] ;

[0078] in: This refers to the joint reconfiguration weight coefficients assigned to adjacent trusted nodes by this inverter node; The overall health of the system for adjacent trusted nodes; To identify the confidence level of the corresponding line parameters between this inverter node and its adjacent trusted nodes.

[0079] In actual power distribution network operations, when data from a node is determined to be abnormal, it cannot be simply discarded, otherwise it will lead to a break in the control topology. This embodiment uses a weighted least squares fusion method to mobilize other trusted neighboring nodes that are in normal operating condition around the abnormal node. Each trusted neighboring node uses its own accurate measurements to infer the values ​​that the abnormal node should have had through physical equations.

[0080] To prevent estimation errors caused by aging equipment or inaccurate impedance measurements of connecting lines at certain nodes, the system uses the aforementioned formula to calculate weights. If a neighboring trusted node has a high overall system health and high confidence in line parameter identification, then this inverter node will be assigned a larger joint reconstruction weight coefficient for its estimation results when reconstructing data. This spatial cross-validation and weighted fusion ensures that even if individual nodes experience severe data tampering, the system can still utilize the redundant physical information of surrounding healthy nodes to reconstruct a trusted state vector that closely approximates the actual situation.

[0081] Optionally, when the distributed consensus control unit performs the power distribution iteration, it adopts a health-weighted average consensus algorithm to assign dynamic iteration weights to each adjacent inverter node. The dynamic iteration weight value assigned to an adjacent inverter node is positively correlated with the current overall system health of that adjacent inverter node. The power output target of the inverter node is adjusted based on the weighted network topology calculation containing the dynamic iteration weights.

[0082] It is important to note that the ultimate goal of the distributed consensus control unit is to achieve autonomous coordination of the entire inverter cluster without a central scheduling host. Its core control law operates based on a health-weighted power-equal distribution iterative formula, as follows:

[0083] ;

[0084] in: Update the target power output value for this inverter node; This represents the current actual output active power of this inverter node; This represents the global convergence gain coefficient of the consensus algorithm. The dynamic iterative weight value assigned to a certain adjacent inverter node; This is a reliable active power reference value for a certain adjacent inverter node.

[0085] In real-world grid-connected power generation scenarios, each inverter node needs to fairly share the active power output task based on the total load demand of the entire grid. Using the formula described above, this inverter node continuously compares its current actual output active power with the reliable active power reference values ​​of its neighboring inverter nodes.

[0086] If the inverter itself bears less power, the correction term calculated by the formula will be positive, and the system will increase the power output target update value in the next cycle; otherwise, it will decrease. More importantly, due to the introduction of dynamic iterative weight values, the system assigns smaller weights to adjacent inverter nodes with lower health and potential failure risks, reducing their traction on the state updates of this inverter node. This prevents data offsets from faulty nodes from polluting the control convergence of the entire cluster, ensuring the elasticity and stability of the distributed control architecture.

[0087] like Figure 3 The figure shows the convergence curve of the weighted power distribution iteration for the health of multiple nodes. The horizontal axis corresponds to the number of iterations in units of times, and the vertical axis corresponds to the output active power in units of kilowatts.

[0088] The diagram contains five solid broken lines of different colors, representing the power output evolution trajectory of the five inverter nodes during the distributed control process.

[0089] In the early stages of iteration, the output active power of each inverter node differed significantly, exhibiting a large-amplitude waveform divergence. As the system operated using the health-weighted average consensus algorithm, the four curves in blue, green, cyan, and magenta in the figure represent four healthy inverter nodes. They exchanged and reconstructed reliable data to iterate on power sharing, and their waveforms rapidly approached the target value of 50 kilowatts. This verified the system's ability to maintain stable inverter cluster power output and coordinate scheduling under complex data interference environments.

[0090] The red curve in the figure represents an abnormal node with bad data or hardware degradation. Because the system calculates the overall health of this node based on multiple operating characteristics including the severity of equipment failure, and adjusts the dynamic iterative weight value assigned to the adjacent inverter node according to the positive correlation mapping relationship, the red curve shows significant lag in the convergence process and eventually has a steady-state deviation of about 5 kilowatts from the average target value. This mechanism reduces the traction of abnormal nodes on the status updates of other healthy nodes and prevents the data offset of faulty nodes from polluting the control convergence of the entire cluster.

[0091] Furthermore, the persistent micro-oscillations in the curves during the later stages of convergence and the residual steady-state errors at abnormal nodes indicate that, given the random delays in the underlying communication of real power distribution networks and the measurement noise in sensors, the current distributed consensus control algorithm still has room for technological upgrades in terms of further smoothing high-frequency ripples and compressing the steady-state tolerance band under extreme asynchronous conditions by introducing advanced damping filtering mechanisms.

[0092] Specifically, each inverter node also includes a source tracing and hierarchical handling module running in the background asynchronous thread of the controller. The execution cycle of the source tracing and hierarchical handling module is longer than the real-time control cycle of the inverter node and does not occupy real-time control computing power. The source tracing and hierarchical handling module has a built-in decision tree source tracing and classification sub-module, which is used to extract the multi-dimensional operational characteristics of the bad data identified by the boundary observation and verification unit, and classify the causes of bad data into three types of abnormal events: sensor drift failure, communication error anomaly, and false data injection attack.

[0093] For example, the source tracing and graded handling module further includes a graded handling execution submodule, which is used to output differentiated control instructions based on the causes of bad data identified by the decision tree source tracing and classification submodule: if the cause is the sensor drift fault, then trigger the local sensor automatic calibration program and lower the overall system health of the corresponding inverter node; if the cause is the communication error anomaly, then trigger the inter-node data retransmission mechanism and the underlying communication link quality detection program; if the cause is the false data injection attack, then physically isolate the attacked corresponding communication port in real time and broadcast the abnormal node marking information to other inverter nodes in the entire cluster to cut off the propagation chain.

[0094] It should also be noted that the above functional modules are deployed in the background asynchronous low-priority thread of the embedded real-time operating system (RTOS).

[0095] The core grid-connection control and physical verification of the inverter are located in a high-priority interrupt in the foreground, with a cycle typically on the order of hundreds of microseconds, to ensure the safety of electrical control. However, source tracing analysis involves extensive historical data mining, feature engineering extraction, and the execution of decision tree classification algorithms, which is time-consuming.

[0096] Through an asynchronous thread architecture that separates the front-end and back-end, the source tracing and hierarchical handling module can calmly perform offline analysis on the waveform jump patterns, cyclic redundancy check error rates, and time series characteristics of abnormal data within an execution cycle of hundreds of milliseconds or even seconds. Once the decision tree source tracing and classification submodule identifies the root cause of the fault, the hierarchical handling execution submodule will take corresponding targeted measures, achieving a leap from passive defense to proactive diagnosis and self-healing.

[0097] Optionally, each inverter node further includes a node health assessment and fault-tolerant scheduling module running in a background asynchronous thread. The node health assessment and fault-tolerant scheduling module adopts a two-layer weighting model, using multi-dimensional operating characteristics including the severity of equipment failure, maintenance records, output power fluctuation rate, and frequency of bad data occurrence to calculate the overall system health of the inverter node. When the overall system health is lower than a first health threshold, the weight of the inverter node in the cluster control is reduced. When the overall system health is lower than a second health threshold, a pre-set alternative node within the power unit group is scheduled to smoothly take over the entire power share of the inverter node, and complementary nodes in the same group cooperate to provide reactive power compensation, so as to realize a soft exit mechanism for the faulty node. The first health threshold is greater than the second health threshold.

[0098] Specifically, in order to quantitatively describe the operating status of inverter nodes, the system constructs a two-layer weighted health calculation formula, which is as follows:

[0099] ;

[0100] in: The overall system health of the inverter node; The basic weighting coefficient for hardware status indicators; Quantify the severity of equipment failure and the operational characteristics of maintenance records; The basic weighting coefficients for software performance indicators; This provides a quantitative assessment of the operational characteristics, including output power fluctuation and the frequency of adverse data occurrence.

[0101] In actual industrial field maintenance and management, the health of inverters is not only affected by the data quality at the communication software level, but also by hardware physical attributes such as the aging of insulated gate bipolar transistors (IGBTs) and the degradation of capacitor lifespan. This two-layer weighted model linearly combines the quantitative evaluation values ​​of operating characteristics at the hardware level with the quantitative evaluation values ​​of operating characteristics at the software level according to specific basic weight coefficients.

[0102] When the calculated overall health of the system falls below the first health threshold, it indicates that the node is in a sub-healthy state. The system will reduce its weight at the control level to prevent its unstable state from expanding.

[0103] When the overall system health deteriorates further and falls below the second health threshold, it means that the hardware faces an extremely high risk of shutdown and collapse at any time. At this point, the system activates a soft exit mechanism, assigning a nearby alternative node with spare capacity to take over the load power it was undertaking via network commands. This fault-tolerant scheduling based on comprehensive health assessment avoids secondary power grid accidents such as voltage drops and harmonic surges caused by sudden hard disconnection of nodes.

[0104] For example, the distributed SCADA system also includes a cluster edge operation and maintenance node that communicates with all inverter nodes. The cluster edge operation and maintenance node has a digital twin power flow mapping module deployed separately inside. The digital twin power flow mapping module includes a line parameter dynamic identification submodule, which is used to dynamically identify the line impedance parameters between nodes online based on the real electrical state vectors reported by each inverter node during a safe and reliable period when the network communication data does not trigger the physical boundary system boundary judgment. The submodule calculates the parameter identification confidence level of the line impedance parameters synchronously and sends it to the corresponding inverter node in real time as the basis for weight calculation of the multi-node weighted fusion method.

[0105] It is important to note that line impedance parameters are not constant ideal values. In actual AC distribution networks, the impedance characteristics of overhead lines or underground cables will drift significantly due to factors such as ambient temperature and line loss caused by operating current. If the factory-fixed line impedance parameters are always used in the boundary calculation submodule, it will lead to deviations in the calculation of the feasible range of static amplitude, resulting in false alarms or missed alarms.

[0106] To this end, this embodiment deploys a digital twin power flow mapping module in the cluster edge operation and maintenance nodes, which have more abundant computing resources. When it is determined that the entire network is in a secure and reliable period with good communication quality and no attacks, this submodule uses a recursive least squares algorithm to inversely estimate the latest line impedance parameters based on the real time series data of voltage and current reported by the nodes.

[0107] This dynamic parameter identification not only enables the virtual digital twin model to evolve in a highly synchronized manner with the physical power grid, but also gives the physical boundary verification system of the underlying inverter nodes environmental adaptability, continuously ensuring high sensitivity and high accuracy in identifying bad data.

[0108] In summary, unlike existing distributed SCADA systems that rely solely on network communication protocol security and lack underlying physical mechanism verification of received data, this embodiment introduces a multi-dimensional physical boundary system composed of static amplitude and dynamic rate of change within the control loop. In practical applications, this solution strongly couples the pure data flow with the physical power flow of the AC distribution network and the hardware constraints of the devices. When the system faces natural fault data caused by sensor aging and drift, or malicious fake data injection attacks exploiting network vulnerabilities, this technical solution can intercept forged data that does not conform to the laws of electrical engineering in real time and accurately, and utilize the redundant information of multiple spatial nodes for weighted least squares joint reconstruction.

[0109] Ultimately, by combining a distributed consensus algorithm with a health-based fault-tolerant scheduling mechanism, the inverter cluster can maintain high-precision power sharing in a harsh data pollution environment, thereby improving the safe operation boundary and overall survivability of the distribution network and producing positive and outstanding engineering application results.

[0110] Example 2:

[0111] This embodiment provides a distributed SCADA system for inverter clusters that is resistant to bad data. Based on the architecture constructed in the previous embodiment, the system is further extended to address the non-ideal communication network environment that is common in actual industrial sites.

[0112] In this embodiment, an asynchronous data timing alignment compensation module is deployed in series between the communication unit and the boundary observation and verification unit. The asynchronous data timing alignment compensation module is used to parse the transmission timestamp of the received real-time network state vector, compare the transmission timestamp with the reception timestamp of the local control cycle, and calculate the real-time communication delay span.

[0113] When the real-time communication delay span is greater than zero and less than the preset communication delay tolerance limit, the asynchronous data timing alignment compensation module extracts the historical state vector time series of the corresponding adjacent inverter node in the local cache, and combines it with the current local real electrical state vector of the inverter node.

[0114] The asynchronous data timing alignment compensation module performs forward state deduction based on the pre-fixed inverter droop control response inertial equation, performs timing phase and electrical amplitude compensation estimation on the delayed real-time network state vector, and generates a time window aligned state vector corresponding to the current control cycle.

[0115] The boundary observation and verification unit replaces the original received real-time network state vector with the time window aligned state vector and inputs it into the multi-dimensional physical boundary system to perform the cross-verification.

[0116] It is important to note that in the above technical solution, the serial deployment refers to placing the asynchronous data timing alignment compensation module as a necessary node in the data link on the data flow bus inside the microcontroller, between the output of the data link layer of the underlying communication protocol stack and the input of the upper-layer control algorithm. Any external node data received by the communication unit must first undergo timing review and compensation processing by this module before entering the physical boundary observation unit.

[0117] This serial architecture fundamentally isolates the timing pollution caused by physical delays at the communication layer to the upper-layer control strategy. The transmission timestamp refers to the absolute time stamp assigned to the data frame by the local high-precision hardware timer of the adjacent inverter node at the instant it generates and packages the real-time network state vector. The reception timestamp refers to the absolute time stamp recorded by the hardware timer of the local inverter node at the instant its communication unit successfully captures and verifies the integrity of the data frame. To ensure the accuracy of the timestamps, all inverter nodes in the cluster run a high-precision time synchronization protocol to maintain microsecond-level synchronization of the global clock.

[0118] For example, after obtaining the two timestamps mentioned above, the asynchronous data timing alignment compensation module performs a subtraction operation to calculate the real-time communication delay span. The real-time communication delay span characterizes the absolute physical time consumed by the data frame in the transmission of physical communication media such as optical fiber, twisted pair, or wireless space, and in the queuing and forwarding at the switch node.

[0119] In actual power distribution network scenarios, data frames are prone to nondeterministic delays due to high-frequency electromagnetic interference generated by the frequent switching on and off of high-power power electronic devices, or sudden data congestion in the network. The communication delay tolerance limit refers to a time threshold parameter set by the system based on the current transient stability margin of the power grid.

[0120] When the real-time communication delay span is equal to zero or within the system clock error range, it indicates that the data arrives synchronously and no compensation is required; when the span exceeds the communication delay tolerance limit, it means that the data has lost its engineering value in representing the current state of adjacent nodes, and the system will directly discard the frame of data to prevent outdated data from interfering with the control closed loop.

[0121] Optionally, when the real-time communication delay span is within a range greater than zero and less than a preset communication delay tolerance limit, the system activates the core compensation mechanism. The asynchronous data timing alignment compensation module extracts the historical state vector time series of the corresponding adjacent inverter nodes from the local cache. The historical state vector time series refers to a fixed-depth circular buffer in the random access memory of the local controller, which stores verified and continuous safety status data of the adjacent inverter nodes over several past control cycles in strict chronological order.

[0122] It is important to emphasize that a time series representing the state evolution process is used here, rather than a traditional decay curve or other nonlinear fitting model. This is to accurately and losslessly reconstruct the electrical state trajectory of the adjacent node before the communication delay occurs. By performing first- or second-order difference operations on this time series, the system can accurately extract the changing trend and rate of change of the electrical state of the adjacent node.

[0123] Specifically, the asynchronous data timing alignment compensation module then combines the extracted change trend with the current local real electrical state vector of the inverter node, and performs forward state deduction based on the pre-fixed inverter droop control response inertial equation. The inverter droop control response inertial equation describes that when the inverter is subjected to external power fluctuation disturbances, its internal voltage amplitude and voltage phase angle do not change instantaneously, but exhibit a hysteretic and gradual physical characteristic similar to the rotor inertia of a traditional synchronous generator.

[0124] The system utilizes this clear physical hysteresis characteristic to "fast forward" the real-time network state vector, which was originally stuck in the past due to communication delays, along its inevitable physical evolution trajectory in the virtual time dimension.

[0125] It is important to note that when performing the compensation estimation for the timing phase and electrical amplitude, since the nodes in the power grid are interconnected, changes in the state of a local node will have a feedback effect on adjacent nodes through physical lines. Therefore, it is necessary to incorporate the actual local measurement data into the derivation model. For the compensation estimation of the timing phase, the first compensation formula executed by the asynchronous data timing alignment compensation module is as follows:

[0126] ;

[0127] in: The internal reference potential phase angle, which is mapped to the inverter's internal control algorithm layer, in the time window aligned state vector generated after timing alignment compensation. The original virtual phase angle contained in the received delayed real-time network state vector, used for control inference; The real-time communication delay span; The reference rated angular frequency for AC distribution network systems; The active power frequency droop coefficient is preset for the adjacent inverter node; The original active power contained in the received, delayed real-time network state vector; This represents the rated active power of the adjacent inverter node.

[0128] In the practical application of the above formula, since the droop control makes the inverter's output frequency adjust linearly with the change of output active power, the formula calculates the difference between the received original active power and the rated active power, and multiplies it by the active power frequency droop coefficient to obtain the actual operating angular frequency of the adjacent node at the moment of data transmission.

[0129] Subsequently, the deviation between the actual angular frequency and the system's reference rated angular frequency is calculated and multiplied by the communication delay span, thereby accurately deriving the cumulative phase drift caused by frequency offset in adjacent nodes during that communication delay period. Finally, this drift is superimposed on the original phase angle, completing the phase angle compensation and alignment.

[0130] For example, for compensation estimation of electrical amplitude, the asynchronous data timing alignment compensation module must introduce a more stringent current differential state to address the physical characteristics of voltage coupling between nodes. To ensure the absolute uniqueness and specificity of the definitions of each electrical characteristic parameter, the second compensation formula executed by the system during this compensation estimation is as follows:

[0131] ;

[0132] in: The voltage magnitude in the time-window aligned state vector generated after timing alignment compensation; The original voltage amplitude contained in the received, delayed real-time network state vector; The real-time communication delay span; This refers to the voltage cross-coupling compensation gain coefficient embedded within the microcontroller. The current transmitted by neighboring nodes in real time is included in the delayed real-time network state vector and is measured by neighboring nodes. This is the actual output current of the local node, which is synchronously and accurately collected by the local node during the current control cycle.

[0133] In actual industrial operations, voltage amplitude changes depend not only on the reactive power droop characteristics of the nodes themselves, but also on the profound influence of current interactions between nodes. The above formula, by clearly distinguishing between real-time current and actual current, effectively avoids variable confusion in state deduction.

[0134] Here, the real-time current represents the current state of adjacent nodes at the time of data frame transmission, while the actual output current represents the true physical output of the local node at the current moment. The formula uses the current difference between the two during the communication delay, multiplied by the voltage cross-coupling compensation gain coefficient and the delay span, to calculate the compensation amount for the voltage transient drop or rise caused by the physical network impedance. By superimposing this compensation amount onto the original voltage amplitude, the voltage amplitude state that the adjacent nodes should have at the current moment is successfully restored.

[0135] like Figure 4 The figure shows a comparison of asynchronous data timing phase and amplitude compensation waveforms based on the physical inertia equation. The horizontal axis corresponds to the time unit in seconds, and the vertical axis corresponds to the voltage amplitude unit in volts.

[0136] The figure contains three waveform curves of different colors and line types. The black dashed line represents the ideal voltage waveform without delay, with a peak value of around 311 volts, representing the reference state when nodes maintain ideal synchronization.

[0137] The red solid line represents the original delayed received waveform. Due to high-frequency electromagnetic interference caused by frequent switching on and off of high-power electronic devices, or sudden data congestion in the network, data frames are prone to nondeterministic delays. This red solid line waveform shows a significant rightward shift and lag compared to the reference waveform, with its peak value attenuating to around 290 volts. If the original data with communication delays is used directly, the system will generate an extremely large and severely distorted pseudo-rate of change and trigger a physical boundary exceedance alarm.

[0138] The blue solid line represents the voltage waveform after compensation and alignment. The system extracts the historical state vector time series of the corresponding adjacent inverter nodes from the local cache and combines it with the current local real electrical state vector of the current inverter node to perform forward state deduction based on the pre-fixed inverter droop control response inertia equation. The system calculates the compensation amount for the voltage transient drop or rise caused by the physical network impedance, adds this compensation amount to the original voltage amplitude, and restores the voltage amplitude state that the adjacent node should have at the current moment.

[0139] Furthermore, observing the blue compensated curve reveals a visible difference in the overall curvature of its waveform compared to the ideal black dashed line. The blue solid line exhibits slight distortion and concave deformation in the peak and trough regions, and shows some dynamic convergence tracking deviation at the beginning of the time axis. This objectively reflects that the inverter's droop physical inertia equation mainly performs linear extrapolation based on the fundamental state, and cannot accurately reconstruct the nonlinear low-frequency harmonics and transient waveform distortions that objectively exist in the power grid.

[0140] The difference in waveform curvature and the tracking lag indicate that the current compensation algorithm has inherent engineering limitations when dealing with the reconstruction of complex full-band nonlinear signals. This proves that the deduction mechanism still has room for further optimization and upgrading in terms of fitting multi-order nonlinear dynamic models and adaptive filtering of extreme high-frequency transient noise.

[0141] Optionally, after completing the phase angle and amplitude derivation described above, the asynchronous data timing alignment compensation module reassembles and packages the calculation results to generate a time window alignment state vector corresponding to the current control cycle. Subsequently, the boundary observation and verification unit replaces the original received real-time network state vector with this time window alignment state vector.

[0142] The significance of this alternative operation lies in the fact that, in Implementation Example 1, the system relies on the single-cycle rate of change limit to perform dynamic physical boundary verification. If raw data with communication delays is used directly, the system calculates the difference between this stale data and the local data from the previous cycle, and divides it by an extremely short single control cycle time, resulting in an extremely large and severely distorted "pseudo-rate of change." This pseudo-rate of change immediately triggers a physical boundary exceedance alarm, causing the system to misjudge normal data lagging due to network latency as dynamically problematic data, and thus incorrectly remove healthy neighboring nodes from the control network.

[0143] By pre-compensating the data to the current time window, the rate of change exhibited by the replaced data when entering the multi-dimensional physical boundary system reflects the reasonable changes under the real physical evolution trajectory, thereby ensuring the robustness and correctness of the cross-validation logic in an asynchronous environment.

[0144] Specifically, in practical applications, renewable energy grid-connected power generation systems are often deployed in remote areas with harsh environments. When severe convective weather causes strong electromagnetic interference to space wireless communication links, or when multiple inverters simultaneously perform high-load switching, causing millisecond-level congestion in local area network switches, random jitter and data delays are inevitable in the network. If the system lacks an alignment mechanism for asynchronous timing, the state synchronization between multiple nodes will break down within the micro-control cycle. This can lead to the distributed consensus iterative algorithm failing to converge, resulting in continuous low-frequency power oscillations; or, in severe cases, a large number of normal nodes being mistakenly removed by the verification system, triggering a large-scale system-level disconnection accident, seriously endangering the safe operation of the distribution network.

[0145] It is also worth noting that by introducing the historical state vector time series as the basic boundary condition for deduction, the system does not require expensive real-time modifications to the communication hardware, such as laying dedicated deterministic Ethernet fiber optic networks. Instead, it can construct a near-ideal synchronized state-aware view in conventional and flawed industrial communication networks simply through software-level time series extraction and physical model reconstruction. This time window translation technique based on controlling physical inertia reintegrates discrete, time-disordered network slice data into a continuous stream of entity states with physical causal relationships.

[0146] In terms of existing technologies, most traditional distributed SCADA systems are built on the assumption of high reliability and zero latency in the communication network. Existing algorithms for combating malicious data typically focus on mathematical Kalman filtering or neural network prediction. These algorithms often confuse data mutations caused by communication delays with real malicious data injection attacks, lacking a deep understanding of the underlying physical timestamp semantics. Consequently, the system has extremely low fault tolerance when faced with communication quality degradation.

[0147] The technical solution described in this embodiment, which includes an asynchronous data timing alignment compensation module, obtains the precise delay span by serially parsing the sending and receiving timestamps, and combines the local historical state vector time series with the inverter droop physical inertia equation to complete forward state compensation before the data enters the boundary verification center.

[0148] This overall solution effectively eliminates timing spurious features caused by non-ideal communication networks without adding any additional hardware sensors. This not only enables the multi-dimensional physical cross-verification system in Example 1 to be free from misjudgment interference in complex asynchronous communication environments, but also significantly improves the self-healing capability, collaborative stability, and engineering feasibility of the inverter cluster distributed control system under extreme conditions, achieving remarkable technological progress.

[0149] Example 3:

[0150] This embodiment provides a distributed SCADA system for inverter clusters that resists malicious data. Based on the aforementioned embodiment, this system further introduces an active detection and defense architecture based on power electronic physical entities to solve the problem of cluster collaborative deception at the pure software level.

[0151] In this embodiment, an active physical watermark detection and defense module is connected across layers between the boundary observation and verification unit and the droop control and drive unit in the system to resist multi-node collaborative deceptive data forgery attacks.

[0152] The active physical watermark detection and defense module includes a disturbance feature generation submodule and a spatial response correlation verification submodule. The disturbance feature generation submodule is used to generate a pseudo-random power disturbance sequence within a preset amplitude range and superimpose the pseudo-random power disturbance sequence onto the input command of the droop control and drive unit so that the inverter node outputs an electromagnetic response signal carrying the pseudo-random power disturbance sequence to the AC distribution network.

[0153] The spatial response correlation verification submodule is used to continuously perform signal separation and extraction on the real-time network state vectors of all adjacent inverter nodes received by the communication unit, and obtain the watermark response feature column inside the data returned by each adjacent inverter node; the spatial response correlation verification submodule further performs cross-correlation feature comparison operation between the locally generated pseudo-random power disturbance sequence and the extracted watermark response feature column one by one, and calculates the spatial response cross-correlation coefficient corresponding to each adjacent inverter node.

[0154] When the spatial response cross-correlation coefficient of any adjacent inverter node is lower than the set collaborative deception judgment threshold, the active physical watermark detection and defense module determines that the corresponding adjacent inverter node is in a collaborative deception state, and instructs the boundary observation and verification unit to block the data link of the abnormal node and clear the reconstruction weight of the abnormal node when executing the multi-node weighted fusion method.

[0155] It should be noted that in the system hierarchy architecture of the above technical solution, the cross-level serial setting means that the active physical watermark detection and defense module is not only located in the middle position between the upper physical boundary verification and the lower underlying driving instructions in the software algorithm scheduling queue, but also directly crosses the traditional communication application layer in the hardware data flow direction, and directly intervenes in the pulse width modulation (PWM) register writing channel of the inverter microprocessor.

[0156] The aforementioned multi-node collaborative deceptive data forgery attack refers to an attack in which, when an industrial SCADA system is subjected to advanced network intrusion, the attacker simultaneously gains control of multiple adjacent inverter nodes and uses algorithms to generate a set of false electrical status data that mathematically perfectly satisfies the AC power flow equations and mutually corroborates each other.

[0157] Because these data are highly self-consistent in numerical logic, traditional mathematical boundary checks based on static amplitude and dynamic rate of change can mistakenly identify them as real power grid operating conditions, leading to malicious takeover of control of the inverter cluster. The active detection architecture provided in this embodiment aims to overcome this limitation of defense based purely on the network digital space.

[0158] For example, the disturbance feature generation submodule runs within a separate timer interrupt service routine inside the microcontroller. This module contains a linear feedback shift register based on a polynomial generator, used to generate a digital pseudo-random code stream with high autocorrelation and low cross-correlation.

[0159] The preset amplitude range refers to the small range within which the voltage or current fluctuation amplitude corresponding to the digital pseudo-random code stream, when converted into a power reference signal, is strictly limited to a range that does not trigger the inverter's hardware overcurrent protection and does not violate national standards for grid-connected power quality (such as voltage flicker extreme value requirements). In actual engineering settings, this amplitude is usually limited to between five-thousandths and one-hundredth of the inverter's rated output power. The pseudo-random power disturbance sequence is the digital command stream with this limited amplitude and a unique local node code identifier.

[0160] Optionally, after acquiring the pseudo-random power disturbance sequence, the disturbance feature generation submodule injects it into the control closed-loop input of the droop control and drive unit in the form of superimposed feedforward.

[0161] Specifically, after the driving unit calculates the basic modulation waveform reference based on the system's active and reactive power droop equations, the tiny voltage waveform represented by the pseudo-random power disturbance sequence is added to the reference.

[0162] Subsequently, using a space vector pulse width modulation algorithm, the digital commands are converted into the turn-on and turn-off timing of high-power insulated-gate bipolar transistors (IGBTs). This process enables the inverter node to output an electromagnetic response signal carrying the pseudo-random power disturbance sequence to the AC distribution network. This electromagnetic response signal is no longer a digital bit residing in the communication network cable, but a real voltage and current waveform with specific frequency and envelope characteristics existing on the AC bus. This physical electromagnetic wave propagates instantaneously along the distribution network cables to all adjacent inverter nodes, exciting weak physical electrical responses in their local acquisition circuits.

[0163] Specifically, in order to verify whether the adjacent nodes have truly perceived the aforementioned physical signals, rather than simply falsifying mathematical calculations, the system has activated the spatial response correlation verification submodule.

[0164] The first task performed by this submodule is to continuously perform signal separation and extraction on the real-time network state vectors of all adjacent inverter nodes received by the communication unit.

[0165] In actual power grid operation, the 50 Hz or 60 Hz power frequency fundamental wave component of the main power grid accounts for the vast majority of the signal energy, while the electromagnetic response signal energy carrying physical watermarks is extremely weak and is mixed in with switching harmonics and line thermal noise.

[0166] Therefore, relying solely on time-domain observation is insufficient for effective identification. The signal separation and extraction process requires the digital signal processing unit within the microcontroller to execute a high-order bandpass filtering algorithm to obtain the watermark response feature sequence within the data transmitted back from each adjacent inverter node.

[0167] To accurately extract this weak feature, the spatial response correlation verification submodule employs a finite impulse response digital filtering calculation model, and its first feature extraction formula is as follows:

[0168] ;

[0169] in: The watermark response feature columns obtained after filtering are at discrete time points. The value; Let be the order of the finite impulse response digital filter; For bandpass filters at tap index The filter coefficients at the location; For the corresponding state components of the received real-time network state vector at discrete time points The value.

[0170] In practical applications, the above formula serves to construct a digital frequency domain channel with extremely narrow passband characteristics. (Filter order) The selection of the bandpass filter depends on the computing power of the microcontroller and the required frequency resolution; in industrial practice, it is typically set to between 128th and 256th order. It is generated by the system during the initialization phase by performing a discrete inverse Fourier transform based on the center frequency band of the pseudo-random power perturbation sequence.

[0171] When the received real-time network state vector After the convolution operation of this long sequence, the massive power frequency fundamental wave and high-frequency switching noise are filtered out by the extremely high stopband attenuation of the filter, retaining only the signal components in the lower frequency band that match the pseudo-random disturbance, thus extracting a pure watermark response feature sequence. Implementing this formula is the only way to convert weak signals from the physical layer into eigenvectors from the control layer.

[0172] like Figure 5 The figure shows the frequency domain amplitude-frequency response of a high-order bandpass filter with finite impulse response for physical watermark feature extraction. The horizontal axis corresponds to the frequency in Hertz, and the vertical axis corresponds to the amplitude gain in Decibels.

[0173] The blue solid line in the figure represents the amplitude-frequency response curve of a high-order bandpass filter, reflecting the separation and extraction characteristics of the received signal by the digital signal processing unit in the frequency domain. From the overall shape of the curve, it can be seen that in the specific frequency band range of 150 Hz to 250 Hz, the curve bulges upwards, forming a passband with a gain approaching zero dB. This ensures that pseudo-random power disturbance sequence signal components matching this frequency band can pass smoothly. At the 50 Hz power frequency fundamental frequency and in the high-frequency region above 300 Hz, the curve exhibits a downward attenuating stopband characteristic. This effectively filters out the large amount of power frequency fundamental and high-frequency switching noise, thereby extracting a pure watermark response feature sequence.

[0174] Furthermore, observing the local details of the blue solid line reveals that the transition band edge between the passband and stopband exhibits a slight but not steep slope. Moreover, the attenuation in the stopband region, after decreasing to approximately -50 to -55 dB, exhibits a noise floor bottleneck with random spikes, preventing further penetration into deeper suppression. This limited attenuation depth and the smooth transition band indicate that, constrained by the controller's hardware word length truncation error, the current filtering algorithm still exhibits some clutter leakage when strong, specific subharmonic interference with frequencies close to the passband exists in the AC distribution network. This suggests that the feature extraction mechanism still has room for technological upgrades in dynamically adaptively isolating strong noise interference in extremely narrow bands by introducing cascaded notch filtering algorithms.

[0175] It is also important to note that after obtaining the watermark response feature columns of each node, their authenticity needs to be quantitatively evaluated. The spatial response correlation verification submodule further performs cross-correlation feature comparison operations on the locally generated pseudo-random power perturbation sequence and the extracted watermark response feature columns one by one.

[0176] Cross-correlation is a statistical method widely used in the field of signal processing. Its core advantage lies in its ability to quantify the waveform similarity of two different signal sequences during the time-axis sliding process, and it is insensitive to the absolute amplitude attenuation and fixed phase delay of the signal during transmission.

[0177] In a power distribution network, when physical electromagnetic waves propagate from a local node to an adjacent node, they will inevitably experience voltage drops and phase shifts caused by line impedance. Therefore, it is impossible to make a simple numerical equivalent judgment. It is necessary to rely on cross-correlation algorithms to evaluate their trend consistency.

[0178] For example, in order to calculate the spatial response cross-correlation coefficients corresponding to each adjacent inverter node, the spatial response correlation verification submodule calls the internal digital signal processor parallel arithmetic unit to run the second cross-correlation evaluation formula as follows:

[0179] ;

[0180] in: To calculate the cross-correlation coefficient of the spatial response corresponding to adjacent inverter nodes; The length of the sliding time window calculated for cross-correlation evaluation; Discrete points within a time window for locally generated pseudo-random power perturbation sequences The value; The arithmetic mean of the locally generated pseudo-random power perturbation sequence over the length of the sliding time window; The extracted watermark response features are discrete points within the time window. The value; The arithmetic mean of the extracted watermark response features over the length of the sliding time window is given.

[0181] Based on actual on-site debugging and application, the engineering function of the above formula is to provide a standardized safety scoring system that is not affected by the impedance difference of the space frame structure.

[0182] The formula calculates the cross-correlation coefficient of the spatial response by summing the products of two sequences minus their respective arithmetic means and dividing by the product of their standard deviations. Strictly normalized to the range of -1 to +1.

[0183] If the data reported by neighboring nodes through the communication network is measured in the real physical power grid, due to the objective existence of electromagnetic coupling, the watermark response extracted from the data will inevitably show a strong positive correlation with the locally occurring disturbance sequence. At this time, the calculated spatial response cross-correlation coefficient will significantly approach positive one.

[0184] Conversely, if the neighboring node is taken over by a hacker, the real-time network state vector it reports is fabricated data created by the backend server through solving the AC power flow equations. Since the hacker cannot predict the pseudo-random sequence generated by the local node using physical noise, the generated data does not actually contain the corresponding weak physical watermark features. In this case, because the two sets of sequences are statistically independent, the calculated cross-correlation coefficient of the spatial response will approach zero.

[0185] like Figure 6 The figure shows the three-dimensional surface and thermal distribution of the cross-correlation feature comparison of the spatial response of multiple nodes. The first horizontal axis corresponds to the sliding time offset in milliseconds, the second horizontal axis corresponds to the spatial node number in numbers, and the vertical axis corresponds to the cross-correlation coefficient of the spatial response in per unit value.

[0186] The three-dimensional thermal surface rendered in multiple colors in the figure reflects the quantization results of the system performing signal separation and extraction and calculating waveform similarity for data transmitted back from different adjacent nodes.

[0187] For inverter nodes numbered 1 to 3, since their reported data is measured in the actual physical power grid, the objectively existing electromagnetic coupling causes the calculated spatial response cross-correlation coefficient to bulge upwards on the surface, forming a warm-toned red peak region when the sliding time offset approaches zero. These red peaks reach a maximum of around 0.85, significantly higher than the system's preset cooperative deception threshold of 0.3 to 0.5, proving that their data contains weak physical watermark characteristics.

[0188] For nodes numbered four and five, the surface appears as a flat region with randomly undulating, cool-toned blue noise, with the cross-correlation coefficient consistently hovering below 0.15 and no obvious similarity peaks. This indicates that the real-time network state vector of this node is statistically independent of the locally occurring perturbation sequence, confirming that it is in a state of collaborative data fabrication relying on a backend server. The system will block the data link of this abnormal node and reset its reconstruction weights to zero.

[0189] Furthermore, observing the area surrounding the red peak of the actual node reveals that the main peak not only failed to reach the theoretically highest positive value, but also exhibits continuous wavy sidelobe protrusions and irregular blue background noise fluctuations on both sides. This waveform phenomenon objectively exposes the degradation and distortion of the orthogonal characteristics of the pseudo-random disturbance sequence under a finite sliding time window, and the complex stray capacitance of the distribution network causes phase shift divergence. This indicates that the current spatial response correlation verification submodule still has room for improvement in terms of anti-aliasing during sequence decoding under strong background noise and feature sharpening in extremely short time windows, through the introduction of advanced feature isolation and noise reduction mechanisms.

[0190] Optionally, when the cross-correlation coefficient of the spatial response corresponding to any adjacent inverter node is lower than a set cooperative deception judgment threshold, the system triggers the highest level of security defense mechanism. The cooperative deception judgment threshold is an engineering experience value set based on the system's security requirements, typically in the range of 0.3 to 0.5. When the cross-correlation coefficient falls below this threshold, the system no longer considers the deviation to be caused by conventional measurement errors or channel noise, but directly determines that the corresponding adjacent inverter node is in a cooperative deception state by the active physical watermark detection and defense module. A cooperative deception state means that the node has lost the objective authenticity of its physical measurements, and any data it emits is considered a malicious attack payload targeting the consistency convergence of the entire inverter cluster.

[0191] Specifically, after determining the outcome, the defense module will take hard intervention measures:

[0192] On one hand, the boundary observation and verification unit is instructed to block the data link of the abnormal node when executing the multi-node weighted fusion method. At the underlying communication driver layer, the microcontroller will directly shut down the data frames receiving the Media Access Control (MAC) address of the specific node, thus physically isolating it in the software logical topology.

[0193] On the other hand, in order to maintain the collaborative control of the remaining healthy nodes, the module resets the reconstruction weight corresponding to the abnormal node to zero.

[0194] In mathematical graph theory and multi-agent consensus control systems, setting the weight of a node's communication adjacency matrix to zero is equivalent to removing that node from the control network's topology. By clearing the weights, even if spurious data sent by abnormal nodes mathematically conforms to the boundaries of static amplitude and dynamic rate of change, it will directly lose its eligibility to participate in multi-node weighted least squares fusion calculations. This prevents it from exerting any influence or misleading effect on the power distribution iteration of local inverter nodes, thus effectively ensuring the normal operation of unaffected nodes.

[0195] In summary, traditional defenses for industrial communication security, combined with existing technologies, typically rely on public key infrastructure (PKI) systems or asymmetric encryption algorithms to digitally sign and authenticate data packets. These mechanisms can only verify that the data was indeed sent by the node and that it has not been tampered with during network transmission; they cannot prove that the data sent by the node reflects the true physical state of the power grid. When the node's firmware is compromised, the encryption mechanism completely fails, and malicious programs can legitimately issue highly destructive false physical state data.

[0196] The active physical watermark detection and defense module and related technical solutions disclosed in this embodiment extend the information security verification mechanism from the software code logic level to the objective electromagnetic physical laws.

[0197] By covertly superimposing a pseudo-random power perturbation sequence into the local physical output and using signal separation and spatial cross-correlation algorithms to perform comparison verification in the network backhaul data of adjacent nodes, the system constructs a closed-loop verification logic consisting of a network communication layer and a physical entity layer. This mechanism does not rely on any complex key management or high-computing-power encryption / decryption hardware; it only utilizes the inverter's original low-level modulation unit and signal processing computing power to achieve highly sensitive identification and instant weight stripping of collaborative deceptive data forgery attacks.

[0198] The overall solution effectively fills the defense gap of the inverter cluster distributed control system in dealing with cross-domain attacks in the physical and cyberspace, making the SCADA system highly robust against malicious data and of great engineering application value, and significantly improving the survivability of the distributed AC distribution network in extreme adversarial environments.

[0199] Example 4:

[0200] In real-world operating scenarios, AC distribution networks are typically situated in industrial environments characterized by strong electromagnetic interference and complex operating conditions. Existing distributed control methods heavily rely on the authenticity of data exchanged between nodes. When faced with sensor hardware aging and drift, communication links experiencing errors due to environmental interference, or the injection of external spurious data, inverter nodes often receive distorted and abnormal electrical status data. Because conventional methods lack a low-level cross-validation mechanism for the physical validity of the exchanged data, this flawed data directly participates in the distributed consensus iterative calculation of the cluster, leading to incorrect power correction values ​​output by the system. This, in turn, can cause inverter output power fluctuations, cluster instability, and even grid disconnection.

[0201] In order to overcome the significant defects existing in the above-mentioned background technology, such as Figure 8 As shown, this embodiment discloses a distributed SCADA control method for inverter clusters resistant to adverse data, implemented based on the distributed SCADA system for inverter clusters resistant to adverse data described in the above embodiment. For each inverter node, the method includes the following steps:

[0202] Step 1: Collect the instantaneous electrical signal of the AC output of this inverter node and extract the fundamental phasor to generate the local real electrical state vector.

[0203] In a real-world industrial hardware environment, this step relies on high-precision voltage transformers (PTs) and current transformers (CTs) deployed at the inverter's AC grid-connected port. These physical sensors monitor analog electrical signals on the grid-connected bus in real time. The analog signals then enter the inverter's internal signal conditioning circuitry for step-down and low-pass filtering, before being converted into discrete digital signals by a high-speed analog-to-digital converter (ADC) at a sampling frequency of at least 10 kHz. Upon receiving the instantaneous electrical signals, the digital signal processor (DSP) decouples the periodically alternating AC signals by running a digital phase-locked loop (PLL) and a synchronous rotating coordinate system (dq coordinate system) transformation algorithm, accurately extracting the fundamental phasors (including voltage amplitude, current amplitude, and their corresponding phase angles) unaffected by high-frequency harmonics.

[0204] The fundamental phasor, together with the locally calculated active and reactive power, is packaged and encapsulated into a local real electrical state vector and stored in the microcontroller's internal cache as an absolutely reliable physical reference for all subsequent control algorithms.

[0205] Step 2: Receive the real-time network state vector of the adjacent inverter node and broadcast the local real electrical state vector to the point-to-point communication network.

[0206] In terms of the actual operation of the communication equipment, this step is achieved through industrial-grade Ethernet communication modules or fiber optic transceivers configured on the inverter nodes. In the distributed control topology, there is no central scheduling master station between nodes; instead, a peer-to-peer (P2P) data exchange network is formed. Within each microsecond-level control cycle, the communication module multicasts the local real electrical state vector generated in step one to the network bus according to industrial control protocols (such as GOOSE or specific UDP messages).

[0207] Simultaneously, the communication module is in a listening state, receiving data packets from other adjacent inverter nodes in the electrical topology and parsing them into real-time network state vectors. During this stage, the system assumes the received data is in an untrusted state because it has been removed from the direct control of the local hardware and has undergone physical transmission through a complex electromagnetic environment.

[0208] Step 3: Construct a multi-dimensional physical boundary system based on the AC power flow equation and device physical constraints, perform cross-validation on the real-time network state vector to identify bad data, and reconstruct a reliable state vector through multi-node weighted fusion.

[0209] This step is the core defense mechanism for achieving anti-interference and fault tolerance in this control method. Within the controller's computing center, AC power flow equations reflecting the energy conservation and impedance characteristics of the AC distribution network, as well as device physical constraint models reflecting the charging and discharging limits of the inverter's power electronic hardware, are pre-fixed.

[0210] When the system uses AC power flow equations to verify the power flow between nodes, it strictly separates data attributes from different physical domains to ensure the rigor of the physical logic and the uniqueness of the calculation parameters. For example, when comparing the consistency between the output state declared by adjacent nodes and the locally observed state, the controller rigorously substitutes the real-time current transmitted by adjacent nodes parsed from network packets with the actual output current of local nodes currently collected by local high-precision sensors as independent variables, avoiding the failure of the verification equations due to variable confusion.

[0211] If, after substitution and calculation, it is found that the voltage amplitude or power data reported by adjacent nodes causes the calculated line current differential to exceed the physical safety boundary, or the single-cycle change rate of the data exceeds the physical limit that the inverter's energy storage capacitor can support, the system will determine the real-time network state vector as bad data and isolate it within the current control cycle.

[0212] Subsequently, the system initiates a multi-node weighted fusion mechanism, calling upon real measurement data from other undisturbed healthy nodes surrounding the abnormal node. Using a weighted least squares algorithm, it performs spatial topology inversion to reconstruct a set of alternative values ​​that conform to objective physical laws, thus generating a reliable state vector. This step enables the system to maintain the accuracy of local state perception even in the face of data contamination.

[0213] Step 4: Perform power equalization iterative calculation based on the local real electrical state vector and the reliable state vectors of all adjacent inverter nodes to generate power correction amount.

[0214] At this stage, the inverter controller enters the execution phase of the distributed consensus algorithm. Unlike traditional methods that directly use raw communication data, this step only uses the security data after physical review and reconstruction in step three. The controller algebraically subtracts the active and reactive power values ​​in the local real electrical state vector from the corresponding target values ​​in the trusted state vectors of neighboring nodes, multiplies this subtraction by a specific convergence gain coefficient, and executes state iteration under the graph theory network architecture.

[0215] Through this evenly distributed iterative calculation, each inverter node can autonomously determine whether its current load share is too high or too low, thereby generating a power correction amount with directionality and magnitude. Since the data involved in the calculation all have solid physical reliability, this prevents the risk of the entire cluster control diverging due to abnormal data from individual nodes from the source.

[0216] Step 5: Generate a drive pulse based on the power correction amount to control the output power of this inverter node.

[0217] As the final execution stage of the control closed loop, the calculated power correction is passed to the inverter's underlying drive algorithm unit (such as the droop control and voltage / current dual-loop regulator). The regulator updates the voltage reference command based on the correction and then inputs it to the space vector pulse width modulation (SVPWM) generator. The SVPWM generator adjusts the duty cycle according to the command and outputs a high-frequency six-channel drive pulse signal with a specific timing.

[0218] These drive pulses, after passing through an optocoupler-isolated amplifier circuit, directly act on the gates of high-power insulated-gate bipolar transistors (IGBTs) or silicon carbide (SiC) power devices in the main power conversion topology, controlling their high-frequency turn-on and turn-off. Ultimately, by adjusting the voltage amplitude and phase of the inverter bridge output, the physical power scale injected into the AC distribution network at this inverter node is precisely changed.

[0219] In summary, the method disclosed in this embodiment achieves a deep logical closed-loop binding between the digital information flow of the communication network layer and the physical laws of the electrical entities at the bottom layer of the distribution network. During the actual operation of distribution network equipment, when the communication link transmits electrical data that does not conform to physical laws due to environmental interference or equipment failure, this method can identify the malfunctioning data within a millisecond-level control cycle and obtain a reliable state vector through multi-node spatial reconstruction.

[0220] This scheme enables the distributed consensus control algorithm to always perform power distribution iterations based on the security data filtered by physical verification, preventing disordered deviations in the underlying control commands and effectively maintaining the power output stability and collaborative scheduling capability of the inverter cluster in a complex data pollution environment, achieving significant engineering application value and beneficial effects.

[0221] like Figure 7 The graph shows a comparison of the transient response of the inverter cluster power output before and after the injection of bad data. The horizontal axis corresponds to the time unit in seconds, and the vertical axis corresponds to the output active power unit in kilowatts.

[0222] The diagram is divided into two waveform regions: the upper red waveform curve represents the traditional distributed control response curve without using this solution, and the lower blue waveform curve represents the control response curve of this patented solution using this solution.

[0223] Before 0.5 seconds, the inverter cluster was in a normal steady-state operation, with both curves remaining stable around the rated power of 200 kW. At 0.5 seconds, the system encountered a false data injection attack. The upper red curve, due to malicious data directly participating in the cluster's distributed consistency iteration calculation, caused the system to output an incorrect power correction value. The power then oscillated violently, with its value fluctuating significantly between 50 kW and 300 kW, demonstrating the instability trend of traditional architectures under abnormal interference.

[0224] When the blue curve at the bottom encountered the same attack, the system, based on AC power flow equations and device physical constraints, constructed a multi-dimensional physical boundary system. This system performed cross-validation on the received data to identify malfunctioning data and reconstructed a reliable state vector through multi-node weighted fusion. As a result, its output active power only experienced a brief drop of approximately 15 kW, subsequently converging rapidly and recovering to around 198 kW within a very short time, maintaining stable operation. This demonstrates that the scheme can prevent deviations in low-level control commands caused by data anomalies, maintaining the power output stability and collaborative scheduling capability of the inverter cluster under complex data interference environments.

[0225] Meanwhile, observing the lower blue curve in the recovered steady-state range reveals that there is still a steady-state deviation of about two kilowatts and a continuous weak high-frequency noise on the waveform. This phenomenon objectively reflects the slight time delay caused by the controller's weighted fusion reconstruction calculation process and the inherent filtering bandwidth limitation of the sensing hardware. This indicates that the patented method still has room for further optimization and upgrading in terms of transient error-free tracking and broadband noise suppression when facing extreme data pollution.

[0226] Example 5:

[0227] Corresponding to the above embodiments, the present invention also proposes an electronic device.

[0228] like Figure 9 The diagram shows a structural schematic of an electronic device according to the present invention. The electronic device 100 includes a processor 101 and a memory 103. The processor 101 and the memory 103 are connected, for example, via a bus 102. Optionally, the electronic device 100 may further include a transceiver 104. It should be noted that in practical applications, the transceiver 104 is not limited to one unit, and the structure of this electronic device 100 does not constitute a limitation on the embodiments of the present invention.

[0229] Processor 101 may be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA, or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It may implement or execute the various exemplary logic blocks, modules, and circuits described in connection with this disclosure. Processor 101 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0230] Bus 102 may include a pathway for transmitting information between the aforementioned components. Bus 102 may be a PCI bus or an EISA bus, etc. Bus 102 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0231] The memory 103 stores a computer program corresponding to the inverter cluster distributed SCADA control method for resisting adverse data according to the above embodiments of the present invention. This computer program is executed by the processor 101. The processor 101 executes the computer program stored in the memory 103 to implement the content shown in the aforementioned method embodiments.

[0232] Among them, electronic devices 100 include, but are not limited to: mobile terminals such as laptops and PADs (tablet computers) and fixed terminals such as desktop computers. Figure 9The electronic device 100 shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.

[0233] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A distributed SCADA system for inverter clusters resistant to adverse data, applied to an AC distribution network, comprising multiple inverter nodes interconnected via a point-to-point communication network, characterized in that, Each of the inverter nodes includes: The local acquisition unit is used to acquire the instantaneous electrical signal of the AC output of this inverter node and extract the fundamental phasor to generate the local real electrical state vector. The communication unit is used to receive the real-time network state vector of the adjacent inverter node and broadcast the local real electrical state vector. The boundary observation and verification unit is used to construct a multi-dimensional physical boundary system based on the AC power flow equation and device physical constraints, perform cross-verification on the real-time network state vector to identify bad data, and reconstruct and generate a reliable state vector through a multi-node weighted fusion method. A distributed consensus control unit is used to perform power equalization iteration based on the local real electrical state vector and the trusted state vectors of all adjacent inverter nodes to generate a power correction amount; The droop control and drive unit is used to generate drive pulses according to the power correction amount and control the output power of this inverter node. The boundary observation and verification unit includes: The boundary calculation submodule is used to obtain the line impedance parameters between adjacent inverter nodes, combine the AC power flow equation to invert and calculate the static amplitude feasible range of each component of the real-time network state vector, and calculate the single-cycle rate of change limit of each component of the real-time network state vector based on the device physical constraints. The two-level physical cross-verification submodule is used to sequentially perform static amplitude verification based on the feasible range of the static amplitude and dynamic rate of change verification based on the single-cycle rate of change limit; Run the baseline verification submodule to perform a second statistical baseline fine-check on the data verified by the two-level physical cross-verification submodule in order to identify suspicious hidden abnormal data; The multi-node joint reconstruction submodule is used to generate the trusted state vector by fusing the inversion results of multiple adjacent trusted nodes for all the verified abnormal data. When calculating the feasible range of static amplitude, the boundary calculation submodule incorporates the following power grid physical constraints: Line thermal stability constraint: the square root of the sum of the squares of active power and reactive power transmitted by the line is not greater than the line's rated apparent power; voltage deviation constraint: the node voltage deviation does not exceed the preset allowable voltage range; and power angle stability constraint: the absolute value of the phase angle difference between adjacent inverter nodes is not greater than the preset safety angle. When calculating the single-cycle rate of change limit, the limit indicators used include: the single-cycle rate of change limit of active power and reactive power determined by the maximum ramp rate of the inverter's rated power; the single-cycle rate of change limit of voltage amplitude determined by the inverter's voltage regulation rate and the electromagnetic transient characteristics of the line; and the single-cycle rate of change limit of phase angle determined by the maximum allowable instantaneous frequency deviation of the distribution network system.

2. The system according to claim 1, characterized in that, The two-level physical cross-validation submodule and the running baseline validation submodule jointly execute a three-level progressive validation algorithm: The first level is the static amplitude verification, which compares each data component of the real-time network state vector with the feasible range of the static amplitude one by one. If a component exceeds the limit, the corresponding real-time network state vector is directly determined to be strong bad data. The second level is the dynamic change rate verification. The actual change of each data component in a single period is calculated based on the reliable state vector generated in the previous control cycle. If the actual change in a single period exceeds the corresponding single-period change rate limit, it is determined to be dynamic bad data. The third level is the operation baseline verification, which constructs a sliding statistical baseline based on a preset number of historical control cycle trusted state vectors, calculates the relative deviation of the data that passed the first two levels of verification, and if the relative deviation exceeds a set threshold, it is determined to be the suspicious hidden abnormal data.

3. The system according to claim 1, characterized in that, The multi-node joint reconstruction submodule calculates the trusted state vector using a weighted least squares fusion method. The specific reconstruction execution steps are as follows: Centered on this inverter node, obtain the inversion estimates of the state variables of the abnormal node independently calculated by all adjacent trusted nodes based on the AC power flow equation; Calculate the joint reconstruction weight coefficient corresponding to each adjacent trusted node. The joint reconstruction weight coefficient is calculated as the product of the overall system health of the adjacent trusted node and the identification confidence of the corresponding line parameter. The inversion estimates of all adjacent trusted nodes are weighted and summed using the joint reconstruction weight coefficients to generate the trusted state vector, which includes the finally reconstructed trusted voltage amplitude, trusted voltage phase angle, trusted active power, and trusted reactive power.

4. The system according to claim 1, characterized in that, When executing the power sharing iteration, the distributed consensus control unit uses a health-weighted average consensus algorithm to assign dynamic iteration weights to each adjacent inverter node. Specifically: The dynamic iterative weight value assigned to an adjacent inverter node is positively correlated with the current overall system health of that adjacent inverter node, and the power output target of the inverter node is adjusted based on the weighted network topology calculation containing the dynamic iterative weight.

5. The system according to claim 1, characterized in that, Each inverter node also includes a tracing and hierarchical processing module running in an asynchronous thread in the background of the controller. The execution cycle of the tracing and hierarchical processing module is longer than the real-time control cycle of the inverter node and does not occupy real-time control computing power. The source tracing and hierarchical handling module has a built-in decision tree source tracing classification submodule, which is used to extract the multi-dimensional operational characteristics of the bad data identified by the boundary observation and verification unit, and classify the causes of bad data into three types of abnormal events: sensor drift failure, communication error anomaly, and false data injection attack.

6. The system according to claim 5, characterized in that, The source tracing and hierarchical handling module also includes a hierarchical handling execution submodule, which is used to output differentiated control instructions based on the causes of adverse data identified by the decision tree source tracing and classification submodule. If the cause is the sensor drift fault, the local sensor automatic calibration program is triggered and the overall system health of the corresponding inverter node is lowered. If the cause is the aforementioned communication error anomaly, then the inter-node data retransmission mechanism and the underlying communication link quality detection program are triggered. If the attack is caused by the aforementioned fake data injection attack, the corresponding communication port of the attacked device will be physically isolated in real time, and the marking information of the attacked corresponding inverter node will be broadcast to other inverter nodes in the entire network to cut off the propagation chain.

7. The system according to claim 1, characterized in that, Each inverter node also includes a node health assessment and fault-tolerant scheduling module running in a background asynchronous thread; The node health assessment and fault-tolerant scheduling module adopts a two-layer weighting model, which uses multi-dimensional operating characteristics including the severity of equipment failure, maintenance records, output power fluctuation rate and frequency of bad data occurrence to calculate the overall system health of the inverter node. When the overall health of the system is lower than the first health threshold, the weight of the inverter node in the cluster control is reduced. When the overall health of the system is lower than the second health threshold, the pre-set alternative nodes in the power unit group are scheduled to smoothly take over the full power share of the inverter node, and the complementary nodes in the same group cooperate to provide reactive power compensation, so as to realize the soft exit mechanism of the faulty node; wherein, the first health threshold is greater than the second health threshold.

8. A distributed SCADA control method for inverter clusters resistant to adverse data, applied to an AC distribution network, wherein the AC distribution network includes multiple inverter nodes interconnected via a point-to-point communication network, characterized in that... The method is executed based on the inverter cluster distributed SCADA system for resisting adverse data as described in any one of claims 1-7, and for each inverter node, the method includes the following steps: Step 1: Collect the instantaneous electrical signal at the AC output of this inverter node and extract the fundamental phasor to generate the local real electrical state vector; Step 2: Receive the real-time network state vector of the adjacent inverter node and broadcast the local real electrical state vector to the point-to-point communication network; Step 3: Construct a multi-dimensional physical boundary system based on the AC power flow equation and device physical constraints, perform cross-validation on the real-time network state vector to identify bad data, and reconstruct a reliable state vector through multi-node weighted fusion. Step 4: Perform power equalization iterative calculation based on the local real electrical state vector and the reliable state vectors of all adjacent inverter nodes to generate power correction amount; Step 5: Generate a drive pulse based on the power correction amount to control the output power of this inverter node.

Images