Digital-twin-based whole life cycle operation and maintenance management method and system for power transmission and distribution equipment

Abstract

The application provides a digital-twin-based whole-life-cycle operation and maintenance management method and system for power transformation and distribution equipment, relates to the technical field of power management, and comprises the following steps: extracting a target area operation closed-loop state from a digital-twin platform at the time of power grid failure through a field programmable gate array chip, and matching a termination qualification template set to output a termination qualification code; utilizing a state machine circuit to combine sensor data and compare and check conflicts in parallel, outputting a signal that the counterargument is established after confirming that there is no conflict; triggering a security element chip digital signature and fusing a physical fuse to place a termination flag bit; when a dispatch platform issues an inhibition instruction, an instruction decoder forcibly pulls down an authorization signal to block the control instruction at the hardware level; a double-account book management module triggers an account private key electric breakdown destruction and generates a revocation certificate, simultaneously performs termination settlement, and writes a closed account record hash value into a consortium chain consensus block.

Description

Technical Field

[0001] This invention relates to the field of power management technology, specifically to a method and system for the full lifecycle operation and maintenance management of power transmission and distribution equipment based on digital twins. Background Technology

[0002] With the advancement of digital transformation of the power system, intelligent operation and maintenance of infrastructure has become the key to ensuring energy security. In particular, in the context of building a new power grid, improving the life cycle operation efficiency and stability of assets has become an important trend in the industry. Through dynamic perception and collaborative control, it is possible to effectively optimize configuration and avoid the risk of large-scale failures.

[0003] Traditional network operation and maintenance mainly relies on a combination of centralized master server and inspection. The principle is to use upper-layer software to periodically obtain terminal data, perform status analysis and logical judgment at the centralized end, and then issue control commands through the management platform. For asset status changes and account settlement, manual entry and processing are usually performed in a centralized database.

[0004] The shortcomings of existing technologies are: limitations during critical transitions; due to excessive reliance on software for decision-making, they are susceptible to transmission delays and lack rigid underlying responses; at the same time, the depth of condition verification is insufficient, making it difficult to ensure that action decisions are highly consistent with the boundaries of the actual environment; daily management and back-end registration are disconnected from each other, making it impossible to achieve real-time recording and rigid evidence preservation of important turning points. Summary of the Invention

[0005] (a) Technical problems to be solved To address the shortcomings of existing technologies, this invention provides a digital twin-based method and system for the full lifecycle operation and maintenance management of power transmission and distribution equipment. This addresses the limitations mentioned in the background technology, such as: limitations during critical transitions; over-reliance on software for decision-making, resulting in susceptibility to transmission delays and a lack of rigid underlying responses; insufficient depth of condition verification, making it difficult to ensure that action decisions closely match the actual environmental boundaries; and the disconnect between daily management and backend registration, hindering the real-time recording and rigid evidence preservation of important transitional documents.

[0006] (II) Technical Solution To achieve the above objectives, the present invention is implemented through the following technical solution: a method and system for full life-cycle operation and maintenance management of power transmission and distribution equipment based on digital twins, comprising: S1, during normal operation, a field-programmable gate array (FPGA) chip continuously latches the network topology adjacency matrix, switchgear state vector, permanent fault point identification matrix, power point available remaining capacity vector, and load node power demand vector into an internal dual-port random access memory; upon detecting a power grid fault trigger signal, without generating a recovery path, performing islanding, or evaluating the recovery probability, but instead extracting the operational closed-loop state of the target area from the fault topology state in the digital twin platform; the operational closed-loop state includes at least the physical isolation state, control transfer state, authorization chain failure state, settlement closure state, and state bounce prohibition state; The closed-loop operation status is matched and verified with a preset termination qualification template set, which includes at least the closed-loop occupancy rules defined by circuit breakers, disconnect switches, grounding switches, cables, busbars, protection devices and communication optical fibers. When the closed-loop operation status continuously meets all termination qualification templates within the preset observation window, a termination qualification code is output; when any termination qualification template is not met, a qualification revocation code is output, and subsequent steps are stopped, returning to continuous monitoring. The termination qualification code is not related to the possibility of recovery; it is only used to indicate that the target area has entered a closed-loop occupancy state that can be sealed. S2, after obtaining the termination qualification code, the field-programmable gate array (FPGA) chip synchronously reads the real-time status data collected by the hard-wired sensors through the physical wiring path. The real-time status data includes at least the circuit breaker position status, disconnector switch position status, voltage transformer secondary voltage, insulation resistance to ground, phasor sum of incoming and outgoing branch currents, residual voltage to ground, DC auxiliary power supply output bus voltage, UHF partial discharge sensor signal, communication fiber optic signal status, cable connectivity, protection device setting group verification code, and grounding switch auxiliary contact status. The real-time status data is latched into the dual-port random access memory inside the FPGA chip. S3, the state machine circuit embedded in the field-programmable gate array chip reads the real-time status data from the dual-port random access memory and performs parallel comparison with the preset threshold constants embedded in the lookup table. It iterates through and determines the conflict types, including unbroken electrical connections, unresolved fault points, isolated nodes, incomplete discharge, signal link residues, protection setting residues, DC auxiliary power supply residues, unclosed grounding switches, and partial discharge residues. The state machine circuit obtains the updated operating closed-loop status from the digital twin platform and determines whether the operating closed-loop status is continuous and stable. If it is determined that there are no conflict residues and the operating closed-loop status remains continuous and stable, it outputs a counter-evidence signal. Otherwise, it does not output a counter-evidence signal and continues to perform the parallel comparison of the conflict types and the monitoring of the operating closed-loop status. S4, the field-programmable gate array (FPGA) chip triggers the security element chip to digitally sign the counter-evidence confirmation signal and the termination qualification code, generating an execution command; the counter-evidence confirmation signal, the termination qualification code, and the execution command are input into the AND gate path, triggering the physical fuse of the one-time programmable memory to blow and set the termination flag bit; before the physical fuse blows, the FPGA chip re-evaluates the current operating closed loop state according to the closed loop occupancy rules in the termination qualification template set based on the switch position and electrical quantity in the real-time status data, and compares the current operating closed loop state with the termination qualification code generated in step S1. The fuse blow is allowed only if they match and the termination qualification code is valid; otherwise, an inconsistency alarm is output, the fuse blow operation is stopped, and continuous monitoring is returned. Once the termination flag is entered, it only indicates that the closed-loop operation has been established and is not used to evaluate the possibility of recovery. S5, when the scheduling platform issues a control command, the command decoder queries the status of the termination flag bit through the management interface. When the status of the termination flag bit is true and the control command belongs to the prohibited command set, the command decoder forcibly pulls the authorization signal low, physically truncates the recovery reconnection, topology expansion and region merging control commands for the target area. S6, when the termination flag is true, the dual ledger management module triggers the destruction of the asymmetric private key of the running credit account in the electrically erasable programmable read-only memory and generates a ledger revocation certificate. At the same time, it triggers the business scheduling contract to terminate the settlement, transfer the book value of the assets to the historical archive, and writes the generated closing record hash value into the consortium chain consensus block for ledger anchoring. The termination settlement is based on the time when the termination flag is set to circuit breaker, and the hash value of the closure record only corresponds to the closed-loop occupancy status and does not correspond to the recovery probability judgment result.

[0007] Preferably, during normal operation, the field-programmable gate array (FPGA) chip continuously latches the network topology adjacency matrix, switch status vectors, permanent fault point identification matrix, power point available remaining capacity vectors, and load node power demand vectors. The latching action is triggered by a clock edge, synchronously writing each vector into the internal dual-port random access memory (DRAM) to ensure that the topology relationships, switch positions, fault identifiers, power supply margins, and load demands before a fault are all frozen data at the same moment. When a grid fault trigger signal arrives, the FPGA chip does not generate a recovery path, perform islanding, or evaluate recovery probability. Instead, it directly extracts the operational closed-loop state of the target area from the digital twin platform, starting from the fault topology state. The operational closed-loop state consists of physical isolation state, control transfer state, authorization chain failure state, settlement closure state, and state bounce prohibition state. Each state corresponds to a confirmation flag indicating that the storage and occupancy phase has begun. Subsequently, the chip compares the operational closed-loop state with a preset termination qualification template set. The matching process is performed one by one. The template set is jointly defined by circuit breakers, disconnectors, grounding switches, cables, busbars, protection devices, and communication optical fibers to define the closed-loop occupancy rules. During matching, the occupancy, isolation, connectivity, protection, and communication relationships of each device in the closed loop are checked item by item. Within the preset observation window, when the operating closed-loop status continuously meets all termination qualification templates, a termination qualification code is output, indicating that the target area has entered a sealable operating closed-loop occupancy state, and the termination qualification code does not point to the recovery possibility judgment. If any termination qualification template is not met, a qualification cancellation code is output, and subsequent steps are immediately stopped, returning to continuous monitoring. During continuous monitoring, the field-programmable gate array chip cyclically performs real-time status data reading, operating closed-loop status reading, parallel comparison of conflict types, and operating closed-loop status stability determination. If any step does not meet the termination conditions, the subsequent fuse setting process is not allowed to start. This ensures that no subsequent setting action is generated when the sealing conditions are not met, thus forming a complete closed loop from latching, retrieval, matching, confirmation to cancellation and rollback.

[0008] Preferably, after detecting a power grid fault trigger signal, the field-programmable gate array (FPGA) chip first reads the network topology adjacency matrix, switchgear state vector, permanent fault point identifier matrix, power source available remaining capacity vector, and load node power demand vector stored before the fault from the dual-port random access memory. Then, it calls the internal binary counter to generate a combination of switchgear states for all operable switchgear. In each clock cycle, the chip sends multiple sets of switchgear state combinations in parallel and performs three hardware parallel checks on each set of combinations simultaneously. The first check performs a logical AND operation between the path matrix corresponding to the checked combination and the permanent fault point prohibition matrix. If the result matrix is ​​non-zero, it directly determines that the path crosses the permanent fault point and discards the combination. The second check performs a hardware connectivity check on the topology adjacency matrix corresponding to the combination to confirm whether a complete electrical path from any power source to any load node is formed. The third check, when a complete electrical path is formed, accumulates all loads on the path. The node power requirement is compared in parallel with the available remaining capacity of the power supply points to determine whether the power limit constraint is met. When any switch state combination passes all three checks simultaneously, the hardware engine immediately outputs a signal indicating the existence of a feasible closed-loop occupied path, and incorporates this signal into the operating closed-loop state as the basis for generating the subsequent termination qualification code. After the hardware engine outputs the signal indicating the existence of a feasible closed-loop occupied path, the field-programmable gate array chip synchronously associates this signal with the current operating closed-loop state, and uses it as part of the termination qualification template matching verification result to participate in the subsequent termination qualification code determination. When all switch state combinations have been checked one by one and no combination has passed all three checks, the hardware engine outputs a qualification revocation code and stops subsequent steps, returning to continuous monitoring to ensure that each check result corresponds to a clear combination, a clear matrix, and a clear capacity comparison, forming a complete decision closed loop from fault input, combination enumeration, triple screening to qualification confirmation or revocation.

[0009] Preferably, after obtaining the termination qualification code, the field-programmable gate array (FPGA) chip synchronously reads the real-time status data collected by the hard-wired sensors through the physical wiring path. The reading action is triggered by a hardware sampling pulse, and each input is latched into a dual-port random access memory at the same sampling moment. The real-time status data includes the circuit breaker position status, disconnector switch position status, voltage transformer secondary voltage, insulation resistance to ground, phasor sum of currents in the incoming and outgoing branches, residual voltage to ground, DC auxiliary power supply output bus voltage, UHF partial discharge sensor signal, optical fiber signal status, cable connectivity, protection device setting group verification code, and grounding switch auxiliary contact status. The chip performs independent latching for each data channel, first converting the hard-wired input to a digital level, then writing it into the corresponding storage unit. After writing, the current value is immediately kept unchanged to avoid subsequent sampling fluctuations affecting the status. The determination process involves several parameters: circuit breaker position status and disconnector position status, voltage transformer secondary voltage, insulation resistance to ground, phasor sum of incoming and outgoing branch currents, and residual voltage to ground, all used to characterize electrical residuals; DC auxiliary power supply output bus voltage, used to characterize residual DC power supply; UHF partial discharge sensor signal, used to characterize residual discharge; optical fiber signal status and cable connectivity, used to characterize signal link integrity; protection device setting group verification code, used to characterize setting status; and grounding switch auxiliary contact status, used to characterize grounding switch position. After all data is latched, the chip sends the latched results to the subsequent status determination process, ensuring that each input has a corresponding source, storage location, and determination purpose, without retaining irrelevant branches or introducing additional judgment objects, thus forming a continuous closed loop from termination qualification confirmation to real-time status acquisition and then to data freezing and storage.

[0010] Preferably, after the field-programmable gate array (FPGA) chip reads the latched real-time status data from the dual-port random access memory, it immediately sends it to the internally embedded state machine circuit. The state machine circuit sends the read data to the unbroken electrical connection determination unit, the fault point determination unit, the isolated node determination unit, and the incomplete discharge determination unit in a parallel comparison manner. The unbroken electrical connection determination unit reads the secondary voltage of the voltage transformer on the cut-off port side in the target area. When the reading is greater than 2.0V, it directly outputs an unbroken electrical connection established signal, indicating that a residual voltage path is still retained at the cut-off end. The fault point determination unit reads the insulation resistance to ground of the bus or cable. When the reading is less than 1000kΩ, it directly outputs an fault point established signal, indicating that the insulation isolation is not complete. The isolated node determination unit checks the current entering and exiting the branch. The phasor sum modulus is calculated. When the modulus value is greater than 0.5A and lasts for more than 3 sampling cycles, an isolated node establishment signal is directly output, indicating that there is unbalanced current residue on the node side. The incomplete discharge determination unit reads the residual voltage to ground measured by the voltage divider. When the voltage is greater than 36V, an incomplete discharge establishment signal is directly output, indicating that the charge has not been completely released. The state machine circuit synchronously votes on the results of the four determination units. Any establishment signal will block the output of the counter-proof establishment signal. Only when all four determination units return the invalid result will the state machine circuit send the counter-proof establishment signal to the subsequent stage and write the current frame data into the dual-port random access memory as the comparison benchmark for the next round. This forms a closed loop of reading, determination, voting, release, and writeback, avoiding the simultaneous existence of four types of conflicts: residual voltage, insufficient insulation, isolated node, and incomplete discharge.

[0011] Preferably, after completing the four judgments of unbroken electrical connection, unresolved fault point, isolated node, and incomplete discharge, the state machine circuit continues to perform parallel comparisons on other conflict types. The optical signal status of the communication fiber is directly output by the optical receiving module, and the cable connectivity is directly given by the continuity detection circuit. When either of these conditions is met (either the optical signal loss is not triggered or the connectivity is true), the state machine circuit determines that there is a residual signal link. The criterion for determining the untriggered optical signal loss is that the optical receiving power is not less than -25dBm within five consecutive sampling periods, and the criterion for determining true connectivity is that the cable continuity resistance is not greater than 10Ω. The protection device setting group verification code is output by the setting reading unit. The state machine circuit compares the current verification code with the preset termination state verification code 0x5A3C bit by bit. When the two are inconsistent, it directly determines that there is a residual protection setting. The DC auxiliary power supply output bus voltage is provided by the DC sampling channel. When the voltage is greater than 48V, it determines that there is a residual DC auxiliary power supply. The status of the grounding switch auxiliary contact is provided by the auxiliary contact input circuit. When the auxiliary contact returns a disconnect signal, it determines that there is a residual DC auxiliary power supply. The grounding switch is not closed; the UHF partial discharge sensor signal is continuously acquired by the pulse detection unit. If the number of partial discharge pulses is greater than 8 or the pulse amplitude is greater than 1.2V within the continuous monitoring cycle, it is determined that there is residual partial discharge; the state machine circuit performs continuous sampling of the UHF partial discharge sensor signal and counts the number of partial discharge pulses and the amplitude of partial discharge pulses after each continuous monitoring cycle; the next continuous monitoring cycle begins immediately after the current continuous monitoring cycle ends, and there is no interruption between all continuous monitoring cycles; the state machine circuit writes the judgment results of the 5 types of conflict into the same synchronous register, and then summarizes all the judgment results. Only when all 5 types of conflict are not true and the closed-loop operation remains continuous and stable within the observation window, is the output of the counter-evidence signal allowed; when any type of conflict is true, the counter-evidence signal is directly blocked, and the current conflict result is returned to the previous stage for continued monitoring, thus forming a complete closed loop from link residue, setting residue, DC residue, grounding switch not closed, partial discharge residue to unified release.

[0012] Preferably, when both the counterfactual signal and the termination qualification code are valid, the field-programmable gate array (FPGA) chip sends a signature request to the secure element chip. The secure element chip performs a combination operation on the instruction number, timestamp, and termination qualification code number in the execution command, and then uses its internal private key to complete the digital signature, generating an execution command with a signature verification value. After completing the digital signature, the secure element chip returns the signature result to the FPGA chip for signature validity verification. If the signature validity verification passes, the FPGA chip allows subsequent gate path connection operations to be executed. If the signature validity verification fails, the FPGA chip outputs a signature anomaly alarm and returns a continuous monitoring function. Subsequently, the disproven signal, termination qualification code, and execution command are input to the three independent inputs of the AND gate. If any input is false, the AND gate remains closed. Only when all three inputs are true simultaneously, the AND gate outputs a conduction pulse, driving the fuse current source in the one-time programmable memory to discharge instantaneously, causing the physical fuse representing the termination flag to irreversibly blow and locking the corresponding stored state to true. After the fuse blows, the field-programmable gate array chip immediately writes the termination flag into the status register and simultaneously writes the corresponding topology, control transfer status, authorization chain failure status, and settlement closure status into the historical record area, forming a record of the termination flag and its corresponding status. The fixed correspondence of the closing record; before the circuit breaker is triggered, the field-programmable gate array (FPGA) chip reads the switch positions and electrical quantities in the current operating closed loop state again. The FPGA chip performs cyclic reading of the operating closed loop state according to a fixed sampling period; each sampling synchronously reads the physical isolation state, control transfer state, authorization chain failure state, settlement closing state, and state bounce prohibition state; when all consecutive sampling results are consistent, it is determined that the operating closed loop state is continuous and stable; when any state changes, the observation window timing restarts; the current state is re-checked according to the closed loop occupancy rules in the termination qualification template set, and the check result is compared bit by bit with the termination qualification code generated in step S1. The circuit breaker is only allowed to blow when both conditions are completely consistent and the termination qualification code is still valid. If an inconsistency occurs or the termination qualification code expires, the chip immediately outputs an inconsistency alarm, prohibits the fuse current from entering the fuse branch, and returns to continuous monitoring. This connects signature verification, three-way input determination, fuse blowing, termination flag writing, and pre-blowout verification into a single closed processing chain. After the field-programmable gate array (FPGA) chip is connected to the gate path, it performs a readback verification of the termination flag status in the one-time programmable memory. If the readback result is true, the physical fuse is determined to have blown completely; if the readback result is false, a fuse blowing failure alarm is output, and continuous monitoring is returned.

[0013] Preferably, after the scheduling platform issues a control command, the command decoder first reads the termination flag status through the management interface, then performs hardware decoding on the command code of the control command, and compares the decoding result with a preset prohibited command set item by item. The prohibited command set consists of three types of command codes: recovery reconnection command, topology expansion command, and region merging command. When any code matches the input command, the control command is determined to belong to the prohibited command set. When the termination flag status is true and the control command belongs to the prohibited command set, the command decoder reads the normally closed physical signal representing the termination flag from the one-time programmable memory, performs a hardware AND operation between the inverted value of the normally closed physical signal and the decoding enable signal of the control command. If the inverted value is false, the decoding enable signal is forcibly pulled low, the gate input of the subsequent execution stage loses its level permission, and the control command cannot proceed. The instruction is then processed by the subsequent execution pipeline. When the termination flag is false, the instruction decoder maintains the original value of the authorization signal and does not apply truncation to instruction codes outside the prohibited instruction set. When the termination flag is true and the input instruction does not belong to the prohibited instruction set, the instruction decoder only completes normal decoding and does not trigger the authorization signal to go low. In this way, the termination flag and the prohibited instruction set together constitute the hardware-level truncation condition. The management interface completes the status reading, the decoder completes the code recognition, the normally closed physical signal completes the enable blocking, and the subsequent execution pipeline completes the disable isolation. The three are connected in sequence to form a closed processing chain from instruction reception, status query, code screening to physical cutoff. If any condition is not met, the truncation branch will not be entered, thus ensuring that the three types of control instructions—recovery reconnection, topology expansion, and region merging—are directly blocked after the termination flag is true.

[0014] Preferably, when the termination flag is true, the dual ledger management module first sends a credit account cancellation instruction to the security element chip. This cancellation instruction includes three fields: the running credit account identifier, the asset number, and the termination flag number. Upon receiving the cancellation instruction, the security element chip immediately initiates the asymmetric private key hardware destruction procedure. It first locates the electrically erasable programmable read-only memory (EEPROM) physical segment storing the asymmetric private key, and then applies a breakdown voltage pulse higher than the rated potential difference to the physical segment via an internal charge pump. The pulse duration and amplitude are executed according to preset destruction parameters. The breakdown action directly destroys the floating gate oxide layer, causing an irreversible change in the threshold state of the original storage unit, thereby degrading the asymmetric private key information into noise and rendering it unreadable. After the private key destruction is complete, the security element chip calls the internal unused... The damaged root key is digitally signed with the hash value of the original public key corresponding to the destroyed private key, the asset cancellation timestamp, and the termination flag number to generate a ledger revocation certificate. After the ledger revocation certificate is generated, it is broadcast by the security element chip to all edge ledger nodes in the network. Upon receiving the certificate, the edge ledger nodes mark the corresponding running credit account as revoked and prohibit subsequent credit transfer requests from entering the settlement path. The entire process sequentially goes through six steps: cancellation instruction triggering, physical segment location, breakdown voltage pulse application, private key invalidation, revocation certificate signing, and network-wide broadcasting. Each step uses the output of the previous step as the input of the next step, without retaining irrelevant branches or introducing judgment conditions unrelated to the termination flag, thus connecting account cancellation, private key destruction, certificate generation, and account disabling into a continuous closed process.

[0015] Preferably, after receiving the ledger revocation certificate, the dual ledger management module first retrieves the account index corresponding to the running credit account in the local credit ledger, then modifies the account status field from valid to revoked, and synchronously updates the account access control table to prevent subsequent credit transfer requests from passing identity verification. Subsequently, the dual ledger management module extracts the commercial scheduling contract associated with the running credit account and reads the timestamp corresponding to the time the termination flag is set. Using this timestamp as the termination settlement basis, it freezes the cumulative operating data of the equipment, calculates the final value of equipment damage up to the time of the circuit breaker, and then converts the final value of equipment damage into closing account record data. After the closing account record data is generated, the dual ledger management module writes the closing account record data into the financial ledger and simultaneously transfers the corresponding asset book value to the historical archive. The historical archive stores content including the area code, After the transfer of four fields—asset number, termination settlement time, and final value of equipment damage—the original operating account will no longer participate in subsequent commercial scheduling contract settlements. Subsequently, the security element chip digitally signs the closed-loop record data containing the region number and final settlement value, and generates a closed-loop record hash value based on the signature result. The dual ledger management module writes the closed-loop record hash value into the consortium blockchain consensus block. After the consortium blockchain consensus block completes the write confirmation, the ledger anchoring state is permanently fixed. The closed-loop record hash value only corresponds to the operating closed-loop occupancy state and does not correspond to the recovery probability judgment result. The entire process is executed sequentially in the order of account revocation, contract extraction, settlement benchmark determination, final value of equipment damage calculation, closed-loop record generation, financial ledger writing, asset transfer, digital signature, hash writing, and consortium blockchain anchoring. All results of the preceding steps are used as inputs for the following steps, thus forming a complete closed-loop chain.

[0016] Preferably, during the continuous monitoring phase, the field-programmable gate array (FPGA) chip cyclically reads the closed-loop state of the digital twin platform at a fixed sampling period, and simultaneously reads the circuit breaker position status, disconnector position status, optical fiber signal status, and grounding switch auxiliary contact status from the dual-port random access memory. After each sampling, the state machine circuit immediately compares the results of the previous and subsequent samplings item by item. When the physical isolation status, control transfer status, authorization chain failure status, settlement closure status, and state bounce prohibition status are all consistent, the state machine circuit writes the current sampling result into the stable state register. When any state changes, the state machine circuit immediately clears the stable state register and restarts the observation window timing. The observation window length is fixed at 60 seconds. When all sampling results are consistent within 60 seconds, the closed-loop state is determined to be continuously stable. Only after continuous stability is established does the state machine circuit allow subsequent counter-evidence signals to enter the signature process. If a circuit breaker position change occurs within the observation window... If any of the four state changes occur—change of disconnector position, recovery of optical fiber signal, or disconnection of grounding switch auxiliary contact—the state machine circuit immediately cancels the continuous stable state and returns to continuous monitoring. During continuous monitoring, the termination qualification code remains frozen, and the generation of a new termination qualification code is not allowed, nor is the process of recovery path calculation, islanding, or recovery probability evaluation permitted. The field-programmable gate array chip only performs four processing steps around the closed-loop occupancy state: state confirmation, stability verification, conflict resolution, and termination flag setting. This connects the closed-loop state acquisition, continuous stability determination, stable state maintenance, and abnormal state cancellation into a complete closed processing chain, preventing the operating state from entering the subsequent circuit breaker setting stage when it is unstable. After receiving the hash value of the closing record, the consortium blockchain consensus block executes block write confirmation. When the block write confirmation is completed, the dual ledger management module determines that the ledger anchoring is complete. When the block write confirmation is not completed, the dual ledger management module keeps the closing record hash value in a pending write state.

[0017] (III) Beneficial Effects This invention provides a method and system for the full lifecycle operation and maintenance management of power transmission and distribution equipment based on digital twins. It has the following beneficial effects: 1. This invention uses a field-programmable gate array (FPGA) chip to perform multi-channel hardware parallel comparison of the closed-loop state and conflict type. When the conditions are met, it uses the digital signature of the security element and the gate path to trigger the physical fuse of the one-time programmable memory to cause irreversible melting, thereby permanently locking the termination flag bit at the hardware level. This mechanism can use the instruction decoder to forcibly pull down the authorization signal when a prohibited instruction is detected, thereby achieving direct hardware-level blocking of the reconnection control instruction for the target area. This effectively avoids erroneous recovery control caused by software vulnerabilities or human error, and greatly improves the reliability of equipment operation and maintenance management.

[0018] 2. After the termination flag is physically set, this invention applies a high-voltage pulse to the electrically erasable programmable read-only memory through the charge pump of the security element chip, destroying the hardware of the asymmetric private key of the running credit account and degrading it into noise, while simultaneously generating a ledger revocation certificate; at the same time, it combines the commercial scheduling contract to terminate the settlement based on the circuit breaker time, and writes the signature hash value containing the region number and the final settlement value into the consortium blockchain consensus block to complete the ledger anchoring, realizing the permanent reconstruction of the asset ledger, and effectively ensuring the immutability and traceability of retired asset data flow. Attached Figure Description

[0019] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings, wherein: Figure 1 This is the overall flowchart of the operation and maintenance management method and system for the entire life cycle of power transmission and distribution equipment based on digital twins as described in this invention. Detailed Implementation

[0020] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example 1: This invention provides a method and system for full lifecycle operation and maintenance management of power transmission and distribution equipment based on digital twins. The method includes, within a target area of ​​a power transmission and distribution equipment, a field-programmable gate array (FPGA) chip, during normal operation, continuously latches the network topology adjacency matrix, switchgear state vectors, permanent fault point identification matrix, available remaining capacity vectors of power supply points, and load node power demand vectors. The latched results are then written to an internal dual-port random access memory (DRAM) to ensure that the topology relationships, switch position relationships, fault identification relationships, power supply margin relationships, and load demand relationships are fixed before the arrival of a power grid fault trigger signal. At the same time, when a power grid fault trigger signal appears, the field-programmable gate array chip does not enter the recovery path calculation, does not perform islanding, and does not evaluate the recovery probability. Instead, it directly extracts the operating closed-loop state of the target area from the fault topology state. The operating closed-loop state consists of physical isolation state, control transfer state, authorization chain failure state, settlement closure state, and state bounce prohibition state. The operating closed-loop state is matched and verified with the termination qualification template set. The termination qualification template set is jointly defined by circuit breakers, disconnect switches, grounding switches, cables, busbars, protection devices, and communication optical fibers to define the closed-loop occupancy rules.

[0022] During the matching verification process, the field-programmable gate array (FPGA) chip calls its internal binary counter to enumerate all possible switching state combinations of operable switches. For each combination, it performs a logical AND operation on the path matrix and the permanent fault point prohibition matrix. If the result matrix is ​​non-zero, the combination is discarded. If the result matrix is ​​zero, a topology connectivity determination is performed to confirm whether a complete electrical path from any power source to any load node is formed. If a complete electrical path is formed, the power demand of all load nodes on the path is summed and compared in parallel with the available remaining capacity of the power source on the path. Only combinations that pass all three tests are marked as having a feasible closed-loop occupancy path signal. If all combinations fail, a qualification revocation code is output and the system returns to continuous monitoring. When the closed-loop operation continuously meets all termination qualification templates within a preset observation window, the FPGA chip outputs a termination qualification code and synchronously writes the termination qualification code and the feasible closed-loop occupancy path signal into a dual-port random access memory.

[0023] Subsequently, the chip synchronously reads the real-time status data collected by the hard-wired sensors through the physical wiring path. This real-time status data includes the circuit breaker position status, disconnector switch position status, voltage transformer secondary voltage, insulation resistance to ground, phasor sum of incoming and outgoing branch currents, residual voltage to ground, DC auxiliary power supply output bus voltage, UHF partial discharge sensor signal, communication fiber optic signal status, cable connectivity, protection device setting group verification code, and grounding switch auxiliary contact status. All data is then latched into a dual-port random access memory. The state machine circuit then reads the real-time status data from the memory and performs parallel comparisons according to preset threshold constants for nine conflict types: undisconnected electrical connection, fault point not cleared, isolated node, incomplete discharge, signal link residue, protection setting residue, DC auxiliary power supply residue, grounding switch not closed, and partial discharge residue. A voltage transformer secondary voltage greater than 2V is considered an undisconnected electrical connection, and an insulation resistance to ground less than 1000kΩ is considered an incomplete discharge. To eliminate fault points, isolated nodes are identified if the phasor and magnitude of the current in the incoming and outgoing branches are greater than 0.5A and persist for more than 3 sampling cycles; incomplete discharge is identified if the residual voltage to ground is greater than 36V; residual signal link is identified if the optical fiber receiving power is not less than -25dBm for 5 consecutive sampling cycles or the cable continuity resistance is not greater than 10Ω; residual protection settings are identified if the protection device setting group check code is inconsistent with the preset termination state check code 0x5A3C; residual DC auxiliary power supply is identified if the DC auxiliary power supply output bus voltage is greater than 48V; grounding switch auxiliary contact returns an open signal to identify if the grounding switch is not closed; residual partial discharge is identified if the UHF partial discharge sensor signal has more than 8 partial discharge pulses or a pulse amplitude greater than 1.2V within a continuous monitoring period; when all conflict types are not valid and the closed-loop operation remains continuously stable within the observation window, the state machine circuit outputs a counter-proof signal and writes the current frame data back to the dual-port random access memory as the comparison benchmark for the next round.

[0024] Subsequently, the security element chip digitally signs the counter-proof signal, the termination qualification code, and the execution command. The execution command includes the instruction number, timestamp, and termination qualification code number. After completing the signing, the security element chip returns the signature result to the field-programmable gate array (FPGA) chip for signature validity verification. If the verification passes, the three inputs enter the AND gate path, and the conduction pulse drives the fuse current source in the one-time programmable memory, causing the physical fuse corresponding to the termination flag bit to irreversibly blow. After the blowing, the FPGA chip reads back to confirm that the termination flag bit status is true. Before the blowing, the FPGA chip rechecks the current closed-loop status based on the real-time status data and compares the verification result with the termination qualification code bit by bit. The blowing is only allowed when the two are completely consistent and the termination qualification code is still valid. If there is a status inconsistency or the termination qualification code is invalid, a status inconsistency alarm is output and continuous monitoring is returned.

[0025] When the termination flag is true, the dispatching platform issues control commands. The command decoder first queries the termination flag status through the management interface, and then compares the control command code with the prohibited command set. The prohibited command set includes three types of codes: recovery reconnection command, topology expansion command, and area merging command. When the termination flag is true and the input command belongs to the prohibited command set, the decoder reads the normally closed physical signal and performs a hardware AND operation with the inverse value and the decoding enable signal to forcibly pull down the authorization signal, directly blocking the recovery reconnection, topology expansion, and area merging control commands.

[0026] Finally, when the termination flag is true, the dual ledger management module triggers the self-destruction of the asymmetric private key of the running credit account. First, it sends a credit account cancellation command to the security element chip, and then the charge pump applies a breakdown voltage pulse higher than the rated potential difference to the physical segment of the electrically erasable programmable read-only memory that stores the asymmetric private key, destroying the floating gate oxide layer and degrading the private key into noise. Subsequently, the undamaged root key digitally signs the original public key hash value, asset cancellation timestamp, and termination flag number to generate a ledger revocation certificate, which is then broadcast to all edge ledger nodes across the network. After receiving the ledger revocation certificate, the dual ledger management module marks the running credit account as revoked in its local credit ledger, extracts the commercial scheduling contract, and uses the termination flag circuit breaker setting time as the settlement benchmark to calculate the final value of equipment damage, generate closed-end record data, write it into the financial ledger, and transfer the asset book value to the historical archive. Then, the closed-end record data containing the region number and settlement final value is digitally signed and a hash value is generated, which is then written into the consortium blockchain consensus block to complete the ledger anchoring. This completes the entire implementation process from fault triggering, closed-loop identification, status verification, termination setting, instruction blocking to ledger sealing.

[0027] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for the full lifecycle operation and maintenance management of power transmission and distribution equipment based on digital twins, characterized in that, include: S1, during normal operation, the field-programmable gate array (FPGA) chip continuously latches the network topology adjacency matrix, switchgear state vector, permanent fault point identification matrix, power point available remaining capacity vector, and load node power demand vector into its internal dual-port random access memory. After detecting a power grid fault trigger signal, it does not generate a recovery path, perform islanding, or evaluate the recovery probability. Instead, it starts from the fault topology state and extracts the operational closed-loop state of the target area in the digital twin platform. The operational closed-loop state includes at least the physical isolation state, control transfer state, authorization chain failure state, settlement closure state, and state bounce prohibition state. The closed-loop operation status is matched and verified with a preset termination qualification template set, which includes at least the closed-loop occupancy rules defined by circuit breakers, disconnect switches, grounding switches, cables, busbars, protection devices and communication optical fibers. When the closed-loop operation status continuously meets all termination qualification templates within the preset observation window, a termination qualification code is output; when any termination qualification template is not met, a qualification revocation code is output, and subsequent steps are stopped, returning to continuous monitoring; wherein, the termination qualification code is unrelated to the possibility of recovery, and is only used to indicate that the target area has entered a sealable closed-loop operation occupancy state; S2, after obtaining the termination qualification code, the field-programmable gate array (FPGA) chip synchronously reads the real-time status data collected by the hard-wired sensors through the physical wiring path. The real-time status data includes at least the circuit breaker position status, disconnector switch position status, voltage transformer secondary voltage, insulation resistance to ground, phasor sum of incoming and outgoing branch currents, residual voltage to ground, DC auxiliary power supply output bus voltage, UHF partial discharge sensor signal, communication fiber optic signal status, cable connectivity, protection device setting group verification code, and grounding switch auxiliary contact status. The real-time status data is latched into the dual-port random access memory inside the FPGA chip. S3, the state machine circuit embedded in the field-programmable gate array chip reads the real-time status data from the dual-port random access memory and performs parallel comparison with the preset threshold constants embedded in the lookup table. It iterates through and determines the conflict types, including unbroken electrical connections, unresolved fault points, isolated nodes, incomplete discharge, signal link residues, protection setting residues, DC auxiliary power supply residues, unclosed grounding switches, and partial discharge residues. The state machine circuit obtains the updated operating closed-loop status from the digital twin platform and determines whether the operating closed-loop status is continuous and stable. If it is determined that there are no conflict residues and the operating closed-loop status remains continuous and stable, it outputs a counter-evidence signal. Otherwise, it does not output a counter-evidence signal and continues to perform the parallel comparison of the conflict types and the monitoring of the operating closed-loop status. S4, the field-programmable gate array (FPGA) chip triggers the security element chip to digitally sign the counter-evidence confirmation signal and the termination qualification code, generating an execution command; the counter-evidence confirmation signal, the termination qualification code, and the execution command are input into the AND gate path, triggering the physical fuse of the one-time programmable memory to blow and set the termination flag bit; before the physical fuse blows, the FPGA chip re-evaluates the current operating closed loop state according to the closed loop occupancy rules in the termination qualification template set based on the switch position and electrical quantity in the real-time status data, and compares the current operating closed loop state with the termination qualification code generated in step S1. The fuse blow is allowed only if they match and the termination qualification code is valid; otherwise, an inconsistency alarm is output, the fuse blow operation is stopped, and continuous monitoring is returned. Once the termination flag is entered, it only indicates that the closed-loop operation has been established and is not used to evaluate the possibility of recovery. S5, when the scheduling platform issues a control command, the command decoder queries the status of the termination flag bit through the management interface. When the status of the termination flag bit is true and the control command belongs to the prohibited command set, the command decoder forcibly pulls the authorization signal low, physically truncates the recovery reconnection, topology expansion and region merging control commands for the target area. S6, when the termination flag is true, the dual ledger management module triggers the destruction of the asymmetric private key of the running credit account in the electrically erasable programmable read-only memory and generates a ledger revocation certificate. At the same time, it triggers the business scheduling contract to terminate the settlement, transfer the book value of the assets to the historical archive, and writes the generated closing record hash value into the consortium chain consensus block for ledger anchoring. The termination settlement is based on the time when the termination flag is set to circuit breaker, and the hash value of the closure record only corresponds to the closed-loop occupancy status and does not correspond to the recovery probability judgment result.

2. The method for full life-cycle operation and maintenance management of power transmission and distribution equipment based on digital twins as described in claim 1, characterized in that: The matching verification of the termination eligibility template set mentioned in step S1 includes the following steps: S11: After detecting the power grid fault trigger signal, the field-programmable gate array chip reads the network topology adjacency matrix, switching equipment state vector, permanent fault point identification matrix, power point available remaining capacity vector and load node power demand vector stored before the fault from the dual-port random access memory. S12: The binary counter inside the field-programmable gate array chip generates all possible switching state combinations for operable switching devices. Multiple sets of switching state combinations are processed in parallel each clock cycle, and three hardware parallel checks are performed on each set of switching state combinations within the same clock cycle: First check: Perform a logical AND operation between the path matrix corresponding to the checked switch state combination and the preset permanent fault point prohibition matrix. If the result matrix is ​​non-zero, it is determined that the path of this switch state combination passes through a permanent fault point, and this switch state combination is directly discarded. Second test: Perform hardware connectivity determination on the topological adjacency matrix corresponding to the tested switch state combination to check whether a complete electrical path is formed from any power source point to any load node. Third test: If a complete electrical path is formed, the power demand of all load nodes on the path is accumulated and compared with the available remaining capacity of the power supply point of the path in parallel to determine whether the power limit constraint is met. S13: If any combination of switch states passes the first, second and third checks simultaneously, the hardware engine inside the field programmable gate array chip immediately outputs a "feasible closed-loop occupied path exists" signal and uses this signal as part of the running closed-loop state. S14: If all switch state combinations have been checked one by one and no combination passes all three checks, then the termination qualification template is determined to be unsatisfactory, the hardware engine outputs the qualification revocation code, and stops executing subsequent steps.

3. The method for full life-cycle operation and maintenance management of power transmission and distribution equipment based on digital twins according to claim 1, characterized in that: In step S3, the state machine circuit performs the parallel comparison of the collision type, including the following steps: S31: The state machine circuit reads the voltage of the secondary side of the voltage transformer on the port side that has been cut off in the target area from the dual-port random access memory. When the voltage is greater than the preset secondary side residual voltage threshold, it determines that there is an undisconnected electrical connection. S32: The state machine circuit reads the insulation resistance to ground of the bus or cable, and determines that there is an unresolved fault point when the resistance is lower than the preset insulation resistance safety threshold. S33: The state machine circuit calculates the sum of the current phasors of the incoming and outgoing branches. When its magnitude is greater than the preset isolated node current determination threshold and continues to exceed the preset period threshold, it determines that the isolated node exists. S34: The state machine circuit reads the residual voltage to ground measured by the voltage divider, and determines that there is incomplete discharge when the voltage is greater than the preset safe voltage threshold. The state machine circuit performs synchronous voting on the above determination results, and outputs the counter-evidence signal only when all conflict types are not met.

4. The method for full life-cycle operation and maintenance management of power transmission and distribution equipment based on digital twins according to claim 3, characterized in that: In step S3, the state machine circuit performs parallel comparisons of other collision types, including the following steps: S35: The field-programmable gate array chip monitors the communication optical fiber and the cable, and determines that there is a residual signal link when no optical signal loss or connectivity is true. S36: The field-programmable gate array chip reads the check code of the protection device effective setting group, and determines that there is a residual protection setting when it does not match the preset termination state check code. S37: The state machine circuit determines that there is residual DC auxiliary power supply when the output bus voltage of the DC auxiliary power supply is greater than the preset DC safety voltage threshold, and determines that the grounding switch is not closed when the auxiliary contact of the grounding switch returns a disconnect signal. S38: The state machine circuit analyzes the UHF partial discharge sensor signal and determines that the partial discharge residue exists when the number or amplitude of partial discharge pulses is greater than the preset partial discharge threshold during the continuous monitoring period. The result of the conflict type determination is used as a prerequisite for forming the counter-evidence signal. The counter-evidence signal is allowed to be output only when all conflict types are not met and the closed-loop operation remains continuous and stable.

5. The method for full life-cycle operation and maintenance management of power transmission and distribution equipment based on digital twins according to claim 4, characterized in that: In step S4, setting the termination flag includes the following steps: S41: Input the counter-evidence confirmation signal, the termination qualification code, and the execution command of the security element chip digital signature into the three independent channels of the AND gate path respectively; S42: When the three independent channels output true level simultaneously, the AND gate conducts a pulse hardware current source and applies a preset current pulse to the one-time programmable memory, causing the physical fuse representing the termination flag bit to blow irreversibly and permanently locking its corresponding storage state value to true. S43: After the termination flag is successfully physically set, based on the topology corresponding to the closed-loop operation state, the equipment asset ledger for the entire life cycle is permanently reconstructed, and the original operation configuration is cleared.

6. The method for full life-cycle operation and maintenance management of power transmission and distribution equipment based on digital twins according to claim 5, characterized in that: In step S5, the physical cutoff control command includes the following steps: S51: The field-programmable gate array chip parses the received control instructions at the hardware level and compares and determines whether the instruction code of the control instructions belongs to a preset prohibited instruction set; S52: If it is determined that the instruction code belongs to the prohibited instruction set, the instruction decoder reads the normally closed physical signal representing the termination flag bit in the one-time programmable memory, and performs a hardware AND operation between its inverted value and the decoding enable signal of the control instruction. S53: When the termination flag is locked to true by the fuse, its reverse normally closed physical signal turns to a false level, forcibly pulling the authorized signal output by the decoder low, so that the control instruction cannot enter the subsequent instruction execution pipeline due to the lack of hardware path level enable, thereby realizing direct hardware-level blocking of the control instruction.

7. The method for full life-cycle operation and maintenance management of power transmission and distribution equipment based on digital twins according to claim 6, characterized in that: Step S6 includes the following steps: S61: After the dual ledger management module detects that the termination flag is true, it sends a credit account cancellation instruction to the security element chip and starts the private key hardware destruction program of the critical asset operation credit account. S62: The charge pump inside the security element chip applies a breakdown voltage pulse higher than the rated potential difference to the physical segment of the electrically erasable programmable read-only memory storing the asymmetric private key, destroying the floating gate oxide layer and making its physical state irreversibly changed, permanently degrading the stored asymmetric private key information into noise. S63: The security element chip uses its internal undamaged root key to digitally sign the original public key hash value corresponding to the destroyed private key, the asset cancellation timestamp, and the termination flag number, generate the ledger revocation certificate, and broadcast it to all edge ledger nodes in the network to complete the account disabling.

8. The method for full life-cycle operation and maintenance management of power transmission and distribution equipment based on digital twins according to claim 7, characterized in that: Step S6 also includes the following steps: S64: After receiving the ledger revocation certificate, the dual ledger management module marks the corresponding running credit account as revoked in the local credit ledger, permanently blocking subsequent credit transfer requests for the running credit account; S65: The dual ledger management module extracts the commercial scheduling contract associated with the operating credit account, uses the time when the termination flag is set as the settlement benchmark, calculates the final value of the equipment damage accumulated at the time, completes the settlement and converts it into closed account record data. S66: Write the closing record data into the financial ledger, and transfer the corresponding asset book value to the historical archive for classification and removal. Use the security element chip to digitally sign the closing record data containing the area number and settlement final value and generate a hash value, and write it into the consortium blockchain consensus block to complete the ledger anchoring.

9. The system for the full life-cycle operation and maintenance management method of power transmission and distribution equipment based on digital twins as described in claim 1, characterized in that: Operational closed-loop status assessment module: used to continuously latch power grid topology and load data during normal operation; after detecting a power grid fault trigger signal, starting from the fault topology status, extracting the operational closed-loop status of the target area in the digital twin platform, and matching and verifying the operational closed-loop status with a preset set of termination qualification templates; when all termination qualification templates are continuously satisfied within a preset observation window, a termination qualification code is output; otherwise, a qualification revocation code is output and continuous monitoring is returned. Real-time status data acquisition and latching module: connected to the operation closed-loop status evaluation module, used to synchronously read the real-time status data collected by the hard-wired sensor through the physical wiring path after obtaining the termination qualification code, and latch the real-time status data into the dual-port random access memory inside the field programmable gate array chip; Hardware state machine conflict parallel analysis module: connected to the real-time state data acquisition and latching module and the digital twin platform, used to read real-time state data from the dual-port random access memory through the solidified state machine circuit, and perform parallel comparison with the preset threshold constant solidified in the lookup table to traverse and determine the conflict type; at the same time, it obtains the updated running closed-loop state from the digital twin platform, and outputs a counter-proof signal when it is determined that there are no conflict residues and the running closed-loop state remains continuous and stable. Security feature verification and fuse setting module: connected to the operation closed-loop state evaluation module and the hardware state machine conflict parallel analysis module respectively, used to trigger the security element chip to digitally sign the counter-proof signal and the termination qualification code to generate an execution command; Before triggering the physical fuse to blow, the system re-evaluates and performs a consistency comparison based on the real-time status data. When the comparison is consistent and the termination qualification code is valid, the counter-proof signal, the termination qualification code, and the execution command are input into the AND gate path to trigger the physical fuse of the one-time programmable memory to set the termination flag bit. Scheduling control physical truncation and dual-ledger consensus module: connected to the security feature verification and fuse setting module, comprising: Instruction decoder: When the termination flag is true and the control instruction issued by the scheduling platform belongs to the prohibited instruction set, the authorization signal is forcibly pulled low to physically truncate the control instructions for the target area, such as recovery reconnection, topology expansion and area merging. Dual ledger management module: When the termination flag is true, it triggers the destruction of the asymmetric private key of the running credit account in the electrically erasable programmable read-only memory and generates a ledger revocation certificate. At the same time, it triggers the business scheduling contract to terminate the settlement based on the time when the termination flag is set, transfers the book value of the assets to the historical archive, and writes the generated closing record hash value into the consortium blockchain consensus block for ledger anchoring.

Images