A substation digital operation and maintenance method and system based on big data

Abstract

The application discloses a kind of digital operation and maintenance method and system of transformer substation based on big data, belong to transformer substation digital operation and maintenance and power system fault diagnosis field, to solve the problem that multiple-source data is difficult to accurately align, repeat and associated confusion due to protocol, sampling frequency, clock bias and transmission delay difference, the application realizes the technical effect of multiple-source event reconstruction, alarm aggregation and fault root cause positioning by unified event modeling, disturbance anchor point driven time correction, heterogeneous time sequence event graph construction and graph attention aggregation and topological constraint causal path scoring.

Description

Technical Field

[0001] This invention relates to the field of digital operation and maintenance of substations and fault diagnosis of power systems, and particularly to a digital operation and maintenance method and system for substations based on big data. Background Technology

[0002] With the widespread integration of intelligent equipment, integrated online monitoring devices, fault recording devices, station control systems, and environmental sensors in substations, the types of operational data that operation and maintenance systems can acquire are constantly increasing. Existing digital operation and maintenance typically analyzes equipment status and fault processes through centralized data collection, rule-based alarms, and manual analysis. However, differences in communication protocols, sampling frequencies, time synchronization capabilities, and transmission links among different data sources result in inconsistent presentation times and alarm sequences for the same disturbance process across different systems.

[0003] When a fault or disturbance occurs, protection actions, circuit breaker changes, telemetry abrupt changes, waveform recording activation, online monitoring exceeding limits, and environmental state changes may occur consecutively within a short period. If correlation is based solely on the original timestamp or a single system alarm, problems such as misalignment of event sequence, failure to collapse duplicate alarms, mixing of derived alarms with main alarms, and miscorrelation of events across intervals can easily arise, making it difficult for maintenance personnel to quickly reconstruct the actual fault path from the flood of alarms.

[0004] Meanwhile, existing alarm aggregation methods are insufficient in jointly utilizing primary wiring topology, protected area coverage, switch status propagation direction, signal quality, and time uncertainty. When data exhibits clock skew or transmission delay fluctuations, fixed time windows or single rules struggle to balance misalignment risks with root cause location accuracy, impacting the reliability of fault impact range identification and evidence chain output.

[0005] Therefore, there is a need for a digital operation and maintenance method and system for substations that can address the shortcomings of existing technologies. Summary of the Invention

[0006] One objective of this invention is to propose a digital operation and maintenance method and system for substations based on big data. Addressing the problems in existing technologies where different multi-source data protocols and sampling frequencies, clock deviations, and transmission delays lead to difficulties in accurately aligning events and alarms on the timeline, further causing alarm duplication, confusion in correlations, and difficulties in locating the root cause of faults, this invention proposes a technical solution combining unified event modeling, joint time correction of disturbance anchor points, construction of heterogeneous time-series event graphs, graph attention aggregation, and topological constraint causal path scoring. This invention has the technical effects of improving the temporal consistency of multi-source events, restoring fault event chains, and assisting in the rapid location of suspected root cause devices.

[0007] This invention provides a digital operation and maintenance method for substations based on big data, comprising: S1, performing protocol parsing and unified modeling on multi-source operation data of the substation to generate a set of event objects, including equipment identifier, bay identifier, signal type, source protocol, original timestamp, and signal quality; S2, performing joint estimation of clock offset, drift rate, and transmission delay for each data source in the event object set based on disturbance anchor points to generate a time synchronization event set with correction timestamps and time confidence intervals; S3, constructing a heterogeneous time-series event graph based on primary wiring topology, protection zone range, equipment bay association, and communication subscription relationship, and determining event edge weights; S4, performing graph attention aggregation on the heterogeneous time-series event graph, and generating alarm association results by combining topological constraint causal path scoring; S5, performing alarm suppression, aggregation, and root cause sorting based on the alarm association results, and outputting fault event chains, main alarms, repeated alarms, derived alarms, suspected root cause equipment, fault impact range, and evidence chains.

[0008] Optionally, S1 includes:

[0009] Operational data are acquired from protection devices, station control systems, integrated online monitoring devices, fault recording devices, switch quantity acquisition devices, and environmental sensors, respectively.

[0010] According to the source protocol, remote signaling, telemetry, protection actions, waveform recording start, over-limit records, equipment status and environmental status are parsed, and the parsing results are mapped to a unified event field;

[0011] Complete the equipment identification, interval identification, and signal type based on the equipment ledger and interval ledger. Generate signal quality based on protocol verification results, sampling integrity, message order, and data out-of-bounds conditions to obtain the event object set.

[0012] Optionally, S2 includes:

[0013] The waveform recording start-up, protection action, circuit breaker displacement, telemetry sudden change, and online monitoring over-limit are identified as disturbance anchor points;

[0014] In the event object set, cross-source anchor point matching pairs are formed according to device identifier, interval identifier, signal type, and candidate time window;

[0015] Based on the original timestamp difference of the cross-source anchor matching pair, the data source sampling frequency and the message arrival time, the source-level time correction parameters of each data source are estimated. The source-level time correction parameters include clock offset, drift rate, average transmission delay and delay fluctuation.

[0016] The original timestamp of the event object is corrected using source-level time correction parameters, and a time confidence interval is generated based on anchor point matching residual, delay fluctuation, and signal quality to obtain a time-corrected event set.

[0017] Furthermore, the source-level time correction parameters are updated in the following way: the original timestamp differences of the same data source in multiple cross-source anchor matching pairs are grouped, and abnormal anchor matching pairs that exceed the residual threshold are removed;

[0018] The source clock offset is estimated based on the retained original timestamp difference, the drift rate is estimated based on the rate of change of timestamp difference during continuous disturbance, and the average transmission delay is estimated based on the difference between the message arrival time and the corrected timestamp.

[0019] The delay fluctuation is corrected based on the anchor point matching residual quantile and message delay quantile, and the corrected source-level time correction parameters are used to generate the correction timestamp and time confidence interval of subsequent event objects.

[0020] Optionally, S3 includes:

[0021] Use time synchronization events as nodes, and set node attributes according to device identifier, interval identifier, and signal type;

[0022] Calculate the electrical topology distance between time synchronization events based on the primary wiring topology, determine the protection zone coverage relationship and interval subordination relationship based on the protection zone range and equipment interval association, and determine the data source association relationship based on the communication subscription relationship;

[0023] The overlap of time intervals, electrical topology distance, protection zone coverage relationship, interval subordination relationship, propagation direction of switch state, waveform state consistency and signal quality are jointly mapped as event edge weights to form a heterogeneous time sequence event graph.

[0024] Furthermore, the event edge weights are determined as follows: the overlap of time intervals is determined based on the intersection-union ratio of the time confidence intervals of two time synchronization events;

[0025] The electrical topology distance is determined based on the number of adjacent electrical devices in a primary wiring topology.

[0026] The coverage relationship of the protected area is determined based on whether the protected area covers the equipment corresponding to the two time synchronization events.

[0027] The direction of switch state propagation is determined based on the sequential relationship between the state changes of circuit breakers, disconnectors, and busbars.

[0028] The consistency of waveform state is determined by the amplitude change direction of the abrupt change segment of the recorded waveform and the telemetry abrupt change segment, as well as the change direction of the switching quantity.

[0029] By mapping the time interval overlap, electrical topology distance, protected area coverage, switch state propagation direction, waveform state consistency, and signal quality input edge weights into a weighted input table, the event edge weights are obtained.

[0030] Optionally, S4 includes:

[0031] The node attributes, event edge weights, and time confidence intervals in the heterogeneous temporal event graph are input into the graph attention aggregation network to obtain the node association representation;

[0032] Candidate causal paths are selected based on the primary wiring topology, protection zone, circuit breaker opening / closing state change direction, and correction time sequence.

[0033] The topological constraint causal path score is obtained by weighting the node association representation, path edge weight product, temporal satisfaction, and protection action logic satisfaction in the candidate causal path.

[0034] The alarm association results are output based on the causal path scoring according to topological constraints.

[0035] Optionally, S5 includes:

[0036] The priority of the main alarm is determined based on the event edge weight, topological constraint causal path score, time confidence interval width, and device criticality in the alarm correlation results.

[0037] Collapse alarms that overlap with the main alarm within the time confidence interval and have the same device identifier, interval identifier, or protection zone range into duplicate alarms;

[0038] Alarms located downstream of the same candidate causal path and with edge weights higher than the derivation threshold are associated as derivation alarms.

[0039] Alarms with edge weights below the noise threshold and time confidence interval widths above the uncertainty threshold are suspended as low-confidence noise alarms.

[0040] Generate a root cause ranking and output the evidence chain based on the main alarm priority and topological constraint causal path score;

[0041] Furthermore, the primary alarm priority is corrected in the following way: an initial primary alarm priority is generated based on event edge weight, topological constraint causal path score, time confidence interval width, and device criticality;

[0042] When the width of the time confidence interval exceeds the wide interval threshold and the difference in topological constraint causal path scores between candidate primary alarms is less than the score difference threshold, the priority of candidate primary alarms whose time confidence interval width exceeds the uncertainty threshold is reduced while their evidence chain is preserved.

[0043] When the criticality of a device is higher than the critical device threshold and the protection zone coverage relationship and the propagation direction of the switch status are satisfied at the same time, the priority of the corresponding candidate primary alarm is increased.

[0044] The corrected primary alarm priority is used for duplicate alarm folding, derived alarm association, and root cause sorting.

[0045] On the other hand, the present invention also provides a digital operation and maintenance system for substations based on big data, comprising:

[0046] The data modeling module is used to perform protocol parsing and unified modeling of multi-source operation data of substations, generating a set of event objects; the time correction module is used to jointly estimate clock offset, drift rate and transmission delay based on disturbance anchor points, generating a set of time-corrected events with corrected timestamps and time confidence intervals; the event graph construction module is used to construct a heterogeneous time-series event graph and determine event edge weights based on primary wiring topology, protection zone range, equipment interval association and communication subscription relationship; the graph association analysis module is used to perform graph attention aggregation and topology constraint causal path scoring, generating alarm association results; the alarm handling output module is used to perform alarm suppression, aggregation and root cause sorting based on alarm association results, and output fault event chain, main alarm, repeated alarm, derived alarm, suspected root cause equipment, fault impact range and evidence chain.

[0047] The beneficial effects of this invention are:

[0048] 1. By parsing the operating data of protection devices, station control systems, integrated online monitoring, fault recording, switch quantities and environmental sensors into event objects containing equipment identifiers, interval identifiers, signal types, source protocols, original timestamps and signal quality, alarms and status changes from different sources have a unified basis for association, which helps to reduce duplicate identification and association omissions caused by inconsistent field definitions.

[0049] 2. By using waveform recording start-up, protection action, circuit breaker change, telemetry change and online monitoring over-limit as disturbance anchor points, and jointly estimating clock offset, drift rate, average transmission delay and delay fluctuation, and outputting correction timestamp and time confidence interval, the reliability of event time alignment can be improved in the presence of sampling differences and transmission delay fluctuations.

[0050] 3. By using time interval overlap, electrical topology distance, protection coverage relationship, interval subordination relationship, switch state propagation direction, waveform state consistency and signal quality together as event edge weights, and combining graph attention aggregation and topology constraint causal path scoring to select the main alarm, fold repeated alarms, associate derived alarms and suspend low confidence noise alarms, the risk of false aggregation and false location can be reduced, and the interpretability of fault event chain, impact range and evidence chain output can be improved. Attached Figure Description

[0051] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0052] Figure 1A flowchart illustrating a digital operation and maintenance method for substations based on big data;

[0053] Figure 2 This is a flowchart of graph attention aggregation and topological constraint causal path scoring in step S4 of the present invention. Detailed Implementation

[0054] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0055] refer to Figure 1 A digital operation and maintenance method for substations based on big data includes: S1. Performing protocol parsing and unified modeling on multi-source operation data of the substation to generate a set of event objects, including equipment identifier, bay identifier, signal type, source protocol, original timestamp, and signal quality; S2. Performing joint estimation of clock offset, drift rate, and transmission delay for each data source in the event object set based on disturbance anchor points to generate a time synchronization event set with correction timestamps and time confidence intervals; S3. Constructing a heterogeneous time-series event graph from the time synchronization event set according to the primary wiring topology, protection zone range, equipment bay association, and communication subscription relationship, and determining the event edge weights; S4. Performing graph attention aggregation on the heterogeneous time-series event graph, and generating alarm association results by combining topological constraint causal path scoring; S5. Performing alarm suppression, aggregation, and root cause sorting based on the alarm association results, and outputting fault event chains, main alarms, repeated alarms, derived alarms, suspected root cause equipment, fault impact range, and evidence chains.

[0056] In this specific embodiment, S1 includes:

[0057] According to the data source side protocol, the multi-source operation data of the substation is accessed, parsed, and uniformly modeled to generate a set of event objects;

[0058] The operation and maintenance server is connected to the protection device, station control system, integrated online monitoring device, fault recording device, switch quantity acquisition device and environmental sensor through the acquisition bus. The protection device and station control system use IEC61850 message to send data, the integrated online monitoring device and environmental sensor use ModbusTCP message to send data, the fault recording device uses COMTRADE file to send data, and the switch quantity acquisition device uses remote signaling change message to send data.

[0059] The acquisition bus records the arrival timestamp of each raw message entering the system and writes it into the buffer queue. The arrival timestamp is counted in milliseconds starting from 00:00:00 UTC on 1970-01-01.

[0060] The protocol parser reads the original message from the buffer queue and completes message verification, field decoding and point table mapping according to the source protocol. Among them, the IEC61850 message extracts the change status quantity, analog value and quality bit of the dataset member and parses the time stamp carried in the message as the original timestamp. The ModbusTCP message extracts the status quantity or measurement value corresponding to the register address and writes it to the buffer as the original timestamp. The COMTRADE parses the trigger flag and generates the original timestamp of the waveform recording start event with the trigger timestamp. The remote signaling change message extracts the input change timestamp as the original timestamp.

[0061] The unified event field consists of device identifier, interval identifier, signal type, source protocol, original timestamp, and signal quality. The device identifier is a unique code in the device ledger, which is a structured table at the device level containing device identifier, device name, associated interval identifier, device type, and communication point number. The interval identifier is a unique code in the interval ledger, which is a structured table at the primary interval level containing interval identifier, interval name, associated voltage level, and a list of primary equipment. The signal type is selected from remote signaling, telemetry, protection action, waveform recording start, over-limit record, device status, and environmental status. The source protocol is selected from IEC61850, ModbusTCP, COMTRADE, and remote signaling change message. The original timestamp is recorded as follows. And the meaning of the time stamp on the data source side remains unchanged;

[0062] The point mapping is implemented using a measurement point mapping table. The measurement point mapping table uniquely locates the measurement point with the source protocol and point number key-value pair and provides the corresponding device identifier, interval identifier, signal type, engineering quantity conversion parameters and legal range. The engineering quantity conversion parameters include the proportional coefficient and the offset, which are used to convert the parsed raw values ​​into engineering values. The legal range includes the lower limit and the upper limit, which are used for out-of-bounds judgment.

[0063] When the parsing result is missing a device identifier or interval identifier, the parser fills in the device identifier and interval identifier with the measurement point mapping table. When the same source protocol point number corresponds to multiple device identifiers, the parser performs a unique matching between the communication point number set in the device ledger and the current message link identifier and outputs a unique device identifier.

[0064] Signal quality is used in the range of The quantized value is denoted as It is generated jointly by the protocol verification result, sampling integrity, message order, and data out-of-bounds status. The index corresponding to the protocol verification result is... The value is 1 if both the CRC check and the message structure check pass, and 0 otherwise. The index corresponding to the sampling integrity is... Furthermore, within a 1-second sliding window with the data source as the granularity, the number of expected message entries is calculated according to the sampling period configuration table, and the ratio of the actual number of successfully parsed messages to the expected number of messages is used as the cutoff point. The identifier corresponding to the message sequence is Furthermore, when the message contains a sequence number, it is truncated to the complementary amount of the percentage of inversions of the sequence number within the window. And when the message does not contain a sequence number, it is set to 0.5; the flag corresponding to data out of bounds is set to... Furthermore, the value is set to 1 if the engineering value falls within the valid range of the measurement point mapping table, and 0 otherwise.

[0065] Signal quality is determined by the formula:

[0066] ;

[0067] in Indicates the protocol verification weight and takes Represents the sampling completeness weight and takes Indicates message order weight and takes This indicates that the data is out of bounds and the weight is set to 0.20. Indicates the protocol verification metrics. Indicator of sampling completeness Indicates message sequence index, Indicator that indicates data is out of bounds Indicates signal quality;

[0068] Event objects are written to the event object collection in the form of structured records, and each record contains device identifier, interval identifier, signal type, source protocol, and original timestamp. and signal quality It also carries the parsed state variables or engineering values ​​as event payloads for subsequent time correction and alarm association processing.

[0069] In this specific embodiment, S2 includes:

[0070] The system takes a set of event objects as input and builds a source-level time correction model for each data source to output the corrected timestamp and time confidence interval.

[0071] The system first extracts perturbation anchor events from the event object set and assigns them anchor categories. Perturbation anchor events are determined by the following rules:

[0072] When the signal type is waveform recording start, it is directly marked as waveform recording start anchor point; when the signal type is protection action, it is directly marked as protection action anchor point; when the signal type is remote signaling, the equipment type in the equipment ledger is circuit breaker, and the event load indicates that the open / close position has reversed, it is marked as circuit breaker change anchor point; when the signal type is telemetry, the range is calculated according to the lower and upper limits of the range given in the measurement point mapping table. And order Equal to the upper limit of the measurement range minus the lower limit of the measurement range, if the absolute value of the difference between the engineering values ​​of two adjacent telemetry events at the same measurement point is greater than or equal to... Then mark the next telemetry event as a telemetry mutation anchor point, and when the signal type is an out-of-limit record, mark it directly as an online monitoring out-of-limit anchor point;

[0073] The system sets the data source corresponding to the protection device as the reference data source and uses its disturbance anchor event as the reference anchor sequence. For each non-reference data source... Based on device identifier, interval identifier, and anchor point category, refer to the anchor point sequence and data source. Establish cross-source anchor matching pairs between anchor sequence sequences, and select candidate time windows. And using the original timestamp of the reference anchor point The search is performed around the central point. If multiple anchor events that meet the criteria exist within the window, the anchor event with the smallest absolute difference from the original timestamp of the reference anchor is selected. If the absolute differences are the same, the signal quality is selected. Larger anchor point events;

[0074] For each data source For all cross-source anchor point matching pairs, the system constructs a source-level time correction parameter set and executes the update process. The update process will include the same data source. The original timestamp differences of the anchor points are grouped according to the perturbation process. The rule for dividing the perturbation process is that if the original timestamp interval before correction of two adjacent reference anchor points is not greater than 3s, they are classified into the same perturbation process. If the condition is not met, a new perturbation process is started. For the differences within each group, the median is calculated first, and abnormal anchor point matching pairs with residuals exceeding the residual threshold are removed. The residual threshold is 80ms, and the residual is defined as the absolute value of the difference between the anchor point difference and the median difference within the group.

[0075] After anomaly removal, the system uses the median of the retained anchor point differences as the source clock offset. The drift rate is calculated by the rate of change of the difference between the first and last retained anchor points in each disturbance process, and the median of the rates of change for all disturbance processes is taken as the source-level drift rate. The denominator of the rate of change is taken from the data source. The difference in the original timestamps corresponding to the first and last anchor points is used to reflect the linear drift of the data source clock over time.

[0076] The system uses the message arrival timestamps recorded by the acquisition bus. Estimate transmission parameters and reserve each anchor point in the application and The arrival residual is defined as the message arrival timestamp minus the estimated occurrence timestamp before correction. The median of the arrival residuals from all retained anchor points is taken as the average transmission delay. The lag fluctuation is calculated as half the difference between the 0.95 quantile and the 0.05 quantile of the reaching residual. ;

[0077] In obtaining Then, the system accesses the data source. For each event object, a time synchronization event is generated according to the linear correction model, and a time confidence interval is output. The correction model and confidence interval are calculated as follows:

[0078] ,

[0079] ,

[0080] ;

[0081] in Indicates the correction timestamp. Represents the original timestamp of the event object. Indicates data source clock offset, Indicates data source The drift rate, Indicates data source The first entry in the current parameter update window retains the original timestamp of the anchor point and is used as the baseline for alignment of the drift item. Indicates data source Average transmission delay, Indicates the time confidence interval. Indicates the half-width of the time confidence interval. This represents the 0.95 quantile of the anchor point matching residual, and the residual is defined as the residual of the same cross-source anchor point matching pair in the application. The absolute value of the difference between the corrected timestamps. Indicates the amount of delayed fluctuation. Denotes the uncertainty coefficient and takes This indicates the quality of the signal output from step 1;

[0082] The system will include device identifier, interval identifier, signal type, source protocol, and calibration timestamp. Time confidence interval With signal quality The records are written to the time synchronization event set and updated according to the above update process after every 30 new cross-source anchor point matching pairs are accumulated. For use in the continuous time synchronization processing of subsequent event objects.

[0083] In this specific embodiment, S3 includes:

[0084] Construct a heterogeneous time-series event graph and determine the event edge weights using a set of time synchronization events as input;

[0085] The system defines each time synchronization event as an event node and writes node attributes to the event node. The node attributes include device identifier, interval identifier, signal type, source protocol, calibration timestamp, time confidence interval, and signal quality.

[0086] The system generates an electrical topology graph based on the primary wiring topology and calculates the electrical topology distance accordingly. The primary wiring topology is an undirected graph with primary equipment in the equipment ledger as vertices and electrical connection relationships as edges. The electrical topology distance is defined as the number of shortest path edges between the devices corresponding to two event nodes on the undirected graph, and the electrical topology distance is 0 when the two nodes correspond to the same device.

[0087] The system determines the coverage relationship of protected areas based on the protected area scope. The protected area scope is given by the protected area configuration table and records the protected area identifier and the set of device identifiers covered by it at the protected area level. If the same protected area covers the corresponding devices of two event nodes at the same time, it is determined that the two event nodes satisfy the protected area coverage relationship and are recorded as covered; otherwise, they are recorded as not covered.

[0088] The system determines the interval subordination relationship based on the device interval association. The interval subordination relationship is given by the interval ledger. If the interval identifiers of two event nodes are the same, it is determined that the interval subordination relationship is satisfied; otherwise, it is determined that the relationship is not satisfied.

[0089] The system determines the data source association relationship based on the communication subscription relationship. The communication subscription relationship is given by the station control system subscription configuration table and recorded with the publisher dataset identifier and the subscriber device identifier as keys. When building the edge, the system only includes event node pairs that meet the same interval subordinate relationship, the protected area coverage relationship, or the communication subscription relationship into the candidate set to control cross-interval erroneous association.

[0090] The system calculates the time interval overlap for each pair of candidate event nodes and uses it to characterize the alignment of the two events on the time axis. Let the first... The time confidence interval for each event node is: , No. The time confidence interval for each event node is: The overlap of time intervals is denoted as And according to Calculation, where Indicates the degree of overlap between time intervals. Indicates the first The time confidence interval of each event node Indicates the first The time confidence interval of each event node This represents the intersection interval of two time confidence intervals. This represents the union of two time confidence intervals. Indicates the interval length in milliseconds;

[0091] The system determines the propagation direction of the switch state to constrain the timing direction of the event edge. The propagation direction of the switch state is based on the interval direction table in the primary wiring topology. The interval direction table gives a fixed electrical direction of "bus side → line side" for each interval and sets the connection direction of two nodes in the same interval to point from the bus side device event to the line side device event. When the device corresponding to the event node is a circuit breaker or disconnector and the signal type is remote signaling and indicates that the open / close position has flipped, the system takes the event node as the propagation source node and sends a directed edge only to the candidate nodes in the line side direction. The system requires that the correction timestamp of the propagation source node is not later than the correction timestamp of the pointed-to node.

[0092] The system determines waveform state consistency to enhance semantic consistency constraints between waveform recording, measurement, and switching quantities. The waveform state consistency is calculated when there is a signal type of waveform recording start or telemetry change in the event node. The system extracts the fundamental amplitude of one cycle before and after the trigger of the waveform data and determines whether the amplitude change direction is rising or falling. For the telemetry change event, the system takes the engineering values ​​of two sampling points before and after the change and determines whether the change direction is rising or falling. If the two change directions are the same, the waveform state consistency is determined to be valid; otherwise, the determination is not valid. At the same time, when the candidate node includes circuit breaker displacement and the circuit breaker changes from closed to open, the telemetry change with the same interval and the change direction is falling is determined to be consistent, while the telemetry change with the change direction is rising is determined to be inconsistent.

[0093] The system maps time interval overlap, electrical topology distance, protected area coverage, interval subordination, switch state propagation direction, waveform state consistency, and signal quality together as event edge weights to generate a heterogeneous time-series event graph. The edge types of this graph include time overlap edges, topological adjacency edges, and protected area constraint edges, and the edge strength is uniformly represented by event edge weights. The range of event edge weight values ​​is... The edge weight mapping table is determined by a discrete, graded key-value structure, which divides the overlap of time intervals into four grades. , The electrical topology distance is divided into four levels, namely At least 3, the protection zone coverage relationship is divided into coverage and non-coverage, the interval subordination relationship is divided into satisfaction and non-satisfaction, the propagation direction of the switch state is divided into consistency and inconsistency, the waveform state consistency is divided into establishment and non-establishment, and the signal quality is divided into three levels based on the smaller value of the signal quality of the two nodes, namely at least 0.8, 0.5 to 0.8, and below 0.5;

[0094] The system categorizes each candidate edge according to the above criteria to form a categorization key and retrieves the event edge weight from the edge weight mapping table. The query rule for the event edge weight mapping table is fixed: the total score is obtained by accumulating the sub-scores corresponding to the categorization key, and the total score is then mapped to the edge weight. The total score is an integer from 0 to 12, and the edge weights are mapped as follows: The system directly discards candidate edges with edge weights less than 0.24 to suppress weak correlation noise and writes the retained directed edges into the heterogeneous temporal event graph for subsequent graph attention aggregation and causal path scoring.

[0095] In this specific embodiment, S4 includes:

[0096] Perform graph attention aggregation on heterogeneous temporal event graphs and combine it with topological constraint causal path scoring to generate alarm correlation results;

[0097] The system takes time synchronization event nodes as the processing objects and constructs an input feature vector for each node. The input feature vector consists of a 7-dimensional one-hot encoding of the signal type, a 4-dimensional one-hot encoding of the source protocol, and signal quality. The normalized time difference between the correction timestamp and the current analysis window start point, and the normalized value of the time confidence interval width are concatenated in a fixed order. The analysis window length is 10s and slides once every 1s. The normalized time difference is divided by 10s as the denominator, and the time confidence interval width is truncated by 200ms as the upper limit and then divided by 200ms to complete the normalization.

[0098] The system inputs the above-mentioned node input features, event edge weights, and time confidence intervals into a graph attention aggregation network to obtain a node association representation. The graph attention aggregation network is a two-layer graph attention network with fixed parameters. The first layer contains 4 attention heads, each of which outputs a 16-dimensional intermediate representation, which is then concatenated between the heads to obtain a 64-dimensional representation. The second layer contains 4 attention heads, each of which outputs an 8-dimensional intermediate representation, which is then concatenated between the heads to obtain a 32-dimensional node association representation. The activation function is ReLU, and the dropout rate is 0.10. In the attention weight calculation, the event edge weight is used as the edge strength coefficient and multiplied by the aggregation weight of the neighbor message. Edges with a time confidence interval intersection-union ratio (IUU) lower than 0.10 are set to zero during aggregation to suppress the propagation of noise with low temporal consistency.

[0099] The parameters of the graph attention aggregation network are determined through offline training and fixed during online operation. The offline training data consists of a set of event chains labeled with historical faults and disturbances, and each sample contains a heterogeneous temporal event graph and its set of real causal edges. The training objective is to predict whether each edge belongs to a real causal edge and to use the cross-entropy loss function. The optimizer is Adam with a learning rate of 0.001, the batch size is 16, and the number of training rounds is 50.

[0100] After obtaining the node association representation of each node, the system filters candidate causal paths on the heterogeneous timing event graph. The starting point of the candidate causal path is limited to the node whose signal type is protection action or circuit breaker change, and the path extends along the directed edge given by S3. The extension constraints simultaneously satisfy the primary wiring topology direction constraint, protection zone range constraint, circuit breaker opening and closing state change direction constraint, and correction time sequence constraint. Among them, the primary wiring topology direction constraint requires that the edge direction be consistent with the bay direction table. The protection zone range constraint requires that the protection zone coverage relationship of any protection action node in the path can cover the corresponding equipment of all circuit breaker change nodes in the path. The circuit breaker opening and closing state change direction constraint requires that the change node of the circuit breaker from closing to opening can only point to its line side node. The correction time sequence constraint requires that the time confidence interval of two adjacent nodes in the path satisfy that the upper bound of the confidence interval of the previous node is no later than the lower bound of the confidence interval of the next node plus 50ms. If this condition is not met, the extension in that direction is stopped.

[0101] The system calculates a topological constraint causal path score for each candidate causal path and uses this score as the ranking criterion for alarm association. The topological constraint causal path score is calculated using the following formula:

[0102] ;

[0103] in Indicate candidate causal paths The topological constraint causal path score and the range of values ​​are This represents a candidate causal path consisting of several time synchronization event nodes and their adjacent directed edges. The association represents the consistency weight and takes... The consistency score represents the association representation of adjacent nodes within a path, and is obtained by calculating the cosine similarity of the 32-dimensional node association representations of adjacent nodes within the path and taking the average. Represents the contribution weight of the edge weight and takes This indicates the slave node determined by S3. Pointing to node The right to the side of the event, This represents the product of the event edge weights of all directed edges within the path. Indicates the time sequence and satisfies the degree weight and takes The score represents the satisfaction of time sequence, calculated based on the percentage of adjacent node pairs within the path that satisfy the corrected time sequence constraint. The weights represent the satisfaction of the protection action logic and are taken as follows: The score represents the satisfaction of the protection action logic. It is 1 when the protection action type in the path is consistent with the coverage relationship of its protection zone and the propagation direction of the circuit breaker's open / closed state, and 0 when there is inconsistency.

[0104] The system will score Candidate causal paths with a score of 0.65 or higher are sorted from highest to lowest, and the top 20 are selected as the set of valid causal paths. Using this set as the framework, the system merges all nodes within a path into the same alarm association group and combines multiple valid causal paths sharing a node into a single fault event chain. Simultaneously, for each alarm association group, the system outputs the set of nodes within the group, the set of edges within the group, and the score for each valid causal path. The event edge weight of each edge in the path is used as the alarm association result.

[0105] In this specific embodiment, S5 includes:

[0106] The alarm association results are used as input, and for each alarm association group, the main alarm is determined, duplicate alarms are folded, derived alarms are associated, low-confidence noise alarms are suspended, and root cause sorting and evidence chain output are performed.

[0107] The system uses each time synchronization event node within the alarm association group as a candidate alarm and inherits its device identifier, interval identifier, signal type, correction timestamp, and time confidence interval. With signal quality Simultaneously, the path scoring information of the node is extracted from the effective causal path set, and the event edge weight information connected to the node is extracted from the heterogeneous temporal event graph.

[0108] The system calculates an initial primary alarm priority for each candidate alarm and uses it for subsequent correction and sorting. The initial primary alarm priority is calculated using the formula:

[0109] ;

[0110] in Indicates the first The initial primary alarm priority of each candidate alarm and its value range is: , Represents the contribution coefficient of the edge weights and takes Indicates the first The node edge weight characteristic of each candidate alarm is defined as the edge weight of all incoming events within the alarm association group. The maximum value and take it when there are no incoming edges. Represents the path score contribution coefficient and takes Indicates the first The maximum topological constraint causal path score of the valid causal paths involving candidate alarms is used, and when the alarm is not in any valid causal path, the score is taken. Denotes the time uncertainty penalty coefficient and takes Indicates the first The time confidence interval width of each candidate alarm is defined as follows: And in milliseconds, This represents the normalized upper limit of the time confidence interval width and takes... This indicates that the ratio within the parentheses is minimized by 1 to achieve truncation normalization. Indicates the contribution coefficient of equipment criticality and takes Indicates the first The device criticality of each candidate alarm corresponds to a value within a range of [value range missing]. The values ​​are determined by the equipment type and voltage level fields in the equipment ledger according to a fixed table, with the following values: main transformer 1.00, busbar 0.90, line interval circuit breaker 0.85, other primary equipment 0.70, secondary devices 0.60, and integrated online monitoring and environmental sensors 0. Indicates from node Pointing to node The event edge weights and their range of values ​​are ;

[0111] The system performs primary alarm priority correction within each alarm association group based on the initial primary alarm priority to meet the aforementioned uncertainty and critical equipment constraints. The correction process divides the alarm association groups according to... The top 3 candidate alarms from highest to lowest are selected as the candidate master alarm set, and their maximum and minimum values ​​are calculated. The difference, the wide interval threshold is set to And the uncertainty threshold is set to And the score difference threshold is set to ;

[0112] When there are candidate primary alarm sets And within the candidate primary alarm set The difference is less than At that time, the system will satisfy one of them. The priority of the candidate primary alarm is reduced by 0.15 and its evidence chain is retained in the output to avoid false primary alarms caused by time uncertainty;

[0113] When there are candidate primary alarm sets When a candidate primary alarm simultaneously satisfies both the protected area coverage relationship and the propagation direction of the switch status, the system increases its primary alarm priority by 0.10, with the threshold for critical equipment set to... The protection zone coverage relationship is based on the protection zone coverage determination of S3 and requires that the device corresponding to the candidate main alarm is covered by the protection zone of the protection action node of the effective causal path where it is located. The switch state propagation direction is based on the directed edge direction of S3 and requires that the candidate main alarm is located upstream of the effective causal path and can reach at least one circuit breaker displacement node along the directed edge.

[0114] The system will use the primary alarm priority adjusted as described above as the final primary alarm priority. And select within each alarm association group The largest candidate alarm is designated as the primary alarm, and its corresponding device is identified as the suspected root cause device.

[0115] The system then folds the duplicate alarms and attaches the folding result to the main alarm name. The folding rule is to traverse the non-main alarm nodes within the same alarm association group and fold alarms that simultaneously meet the conditions of overlapping time confidence intervals and the same device identifier or the same interval identifier or are within the same protection zone as duplicate alarms. The overlapping time confidence intervals are defined as the time confidence intervals of two alarms having a non-empty intersection and the protection zone range being determined by mapping the protection zone coverage relationship of S3 to the protection zone identifier set.

[0116] The system associates derived alarms and distinguishes between master and slave relationships. The rule for determining derived alarms is to mark alarms located downstream of the same valid causal path in the set of valid causal paths to which the master alarm belongs as derived alarms, and require that the weight of each event edge on the path segment from the master alarm to the downstream alarm is not less than the derivation threshold. And this path segment will be included as part of the derived chain of evidence;

[0117] The system suspends low-confidence noise alarms to avoid contaminating the fault event chain. The suspension rule is to calculate the likelihood of failure for alarm nodes that have not yet been collapsed into duplicate alarms and have not been associated with derived alarms. and ,when and It is then marked as a low-confidence noise alarm and removed from the fault event chain display but retained in the original alarm list, where the noise threshold is set to ;

[0118] After classifying primary alarms, repeating alarms, derived alarms, and low-confidence noise alarms, the system generates a root cause ranking and outputs a chain of evidence. The root cause ranking is performed on all candidate alarms within the alarm association group at the device level. Perform a secondary sort and take the device corresponding to the first alarm in the sort as the suspected root cause device. Take the union of the set of devices covered by the same protection zone in the primary wiring topology and the set of downstream devices that are reachable along the direction of switch state propagation and whose event edge weight is not less than 0.56 as the fault impact range.

[0119] The evidence chain is output in a structured manner and includes at least the device identifier, interval identifier, signal type, correction timestamp, and time confidence interval of the main alarm; the set of valid causal paths used for main alarm determination and the topological constraint causal path score and path edge weight sequence for each valid causal path; the list of repeated alarm folds and the folding basis field; the derived alarms and their corresponding upstream main alarms and path segment edge weight sequences; the list of suspended low-confidence noise alarms and trigger threshold records; and outputs the fault event chain, main alarm, repeated alarms, derived alarms, suspected root cause devices, fault impact range, and evidence chain.

[0120] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

[0121] This invention establishes a complete technical chain by unifying the processing relationships between event objects, time-synchronized event sets, heterogeneous timing event graphs, and alarm association results. This chain integrates multi-source operational data from protocol parsing, time correction, graph structure association to root cause sorting, enabling multiple types of events triggered by the same disturbance or fault to be comprehensively analyzed under the corrected time axis and electrical topology constraints. This achieves technical effects that address the confusion in multi-source alarm alignment and the difficulty in locating the root cause of faults.

[0122] This invention further employs a clock bias joint estimation mechanism driven by disturbance anchor points, a topology-protected area dual-constraint edge weight mechanism, and an uncertainty-aware aggregation mechanism, so that the time correction result includes not only the correction timestamp but also the time confidence interval, and the alarm aggregation process simultaneously considers edge weights, time uncertainty, and equipment criticality, thus making it more suitable for complex data sources and complex fault propagation scenarios in substations.

Claims

1. A digital operation and maintenance method for substations based on big data, characterized in that, include: S1. Perform protocol parsing and unified modeling on multi-source operation data of the substation to generate a set of event objects. The event objects include equipment identifier, bay identifier, signal type, source protocol, original timestamp, and signal quality. S2. Based on disturbance anchor points, jointly estimate the clock offset, drift rate, and transmission delay of each data source in the event object set to generate a time synchronization event set with corrected timestamps and time confidence intervals. S3. Based on the primary wiring topology, protection zone range, equipment bay association, and communication subscription relationship, construct the time synchronization event set into a heterogeneous time-series event graph and determine the event edge weights. S4. Perform graph attention aggregation on the heterogeneous time-series event graph, and generate alarm association results by combining topological constraint causal path scoring; S5. Perform alarm suppression, aggregation and root cause sorting based on alarm association results, and output fault event chain, main alarm, repeated alarm, derived alarm, suspected root cause device, fault impact range and evidence chain.

2. The digital operation and maintenance method for substations based on big data according to claim 1, characterized in that, S1 includes: Operational data are acquired from protection devices, station control systems, integrated online monitoring devices, fault recording devices, switch quantity acquisition devices, and environmental sensors, respectively. The remote signaling, telemetry, protection actions, waveform recording initiation, over-limit records, equipment status, and environmental status are analyzed according to the source protocol, and the analysis results are mapped to a unified event field. The equipment identifier, interval identifier, and signal type are completed according to the equipment ledger and interval ledger. The signal quality is generated according to the protocol verification results, sampling integrity, message order, and data over-limit situation, and the event object set is obtained.

3. The substation digital operation and maintenance method based on big data according to claim 1, characterized in that, S2 include: The following events are identified as disturbance anchor points: waveform recording initiation, protection action, circuit breaker displacement, telemetry abrupt change, and online monitoring exceeding limits. Cross-source anchor point matching pairs are formed in the event object set according to device identifier, interval identifier, signal type, and candidate time window. Based on the original timestamp difference of the cross-source anchor point matching pairs, the data source sampling frequency, and the message arrival time, the source-level time correction parameters of each data source are estimated. These source-level time correction parameters include clock offset, drift rate, average transmission delay, and delay fluctuation. The original timestamps of the event objects are corrected using the source-level time correction parameters, and time confidence intervals are generated based on the anchor point matching residual, delay fluctuation, and signal quality to obtain the time-calibrated event set.

4. The substation digital operation and maintenance method based on big data according to claim 1, characterized in that, S3 includes: using time synchronization events as nodes, setting node attributes according to device identifiers, interval identifiers, and signal types; calculating the electrical topology distance between time synchronization events based on the primary wiring topology; determining the protection zone coverage relationship and interval subordination relationship based on the protection zone range and device interval association; determining the data source association relationship based on the communication subscription relationship; and mapping the time interval overlap, electrical topology distance, protection zone coverage relationship, interval subordination relationship, switch state propagation direction, waveform state consistency, and signal quality together as event edge weights to form a heterogeneous timing event graph.

5. The digital operation and maintenance method for substations based on big data according to claim 1, characterized in that, S4 includes: inputting node attributes, event edge weights, and time confidence intervals from the heterogeneous time-series event graph into a graph attention aggregation network to obtain node association representations; filtering candidate causal paths based on the primary wiring topology direction, protection zone range, circuit breaker opening / closing state change direction, and correction time sequence; performing weighted calculations on the node association representations, path edge weight products, time sequence satisfaction, and protection action logic satisfaction in the candidate causal paths to obtain a topology-constrained causal path score; and outputting alarm association results according to the topology-constrained causal path score.

6. The substation digital operation and maintenance method based on big data according to claim 1, characterized in that, S5 This includes: determining the priority of the primary alarm based on the event edge weight, topological constraint causal path score, time confidence interval width, and device criticality in the alarm association results; folding alarms that overlap with the primary alarm within the time confidence interval and have the same device identifier, interval identifier, or protected area as duplicate alarms; associating alarms located downstream of the same candidate causal path and with edge weights higher than the derivation threshold as derived alarms; suspending alarms with edge weights lower than the noise threshold and time confidence interval widths higher than the uncertainty threshold as low-confidence noise alarms; and generating root cause ranking and outputting evidence chains according to the primary alarm priority and topological constraint causal path score.

7. The digital operation and maintenance method for substations based on big data according to claim 3, characterized in that, The source-level time correction parameters are updated in the following way: the original timestamp differences of the same data source in multiple cross-source anchor point matching pairs are grouped, and abnormal anchor point matching pairs that exceed the residual threshold are removed; The source clock offset is estimated based on the retained original timestamp difference, the drift rate is estimated based on the rate of change of timestamp difference during continuous disturbance, and the average transmission delay is estimated based on the difference between the message arrival time and the corrected timestamp. The delay fluctuation is corrected based on the anchor point matching residual quantile and the message delay quantile, and the corrected source time correction parameters are used to generate the corrected timestamp and time confidence interval of subsequent event objects.

8. The substation digital operation and maintenance method based on big data according to claim 4, characterized in that, The event edge weights are determined as follows: the overlap of time intervals is determined based on the intersection-exchange ratio of the time confidence intervals of two time synchronization events; the electrical topology distance is determined based on the number of adjacent electrical devices in a primary wiring topology; the protection zone coverage relationship is determined based on whether the protection zone covers the devices corresponding to the two time synchronization events; the propagation direction of switch states is determined based on the sequential relationship of the state changes of circuit breakers, disconnectors, and busbars; the consistency of waveform states is determined based on the amplitude change direction of the waveform abrupt change segment and the telemetry abrupt change segment, as well as the change direction of the switch quantity; and the event edge weights are obtained by inputting the overlap of time intervals, electrical topology distance, protection zone coverage relationship, propagation direction of switch states, waveform state consistency, and signal quality into an edge weight mapping table.

9. The digital operation and maintenance method for substations based on big data according to claim 6, characterized in that, The primary alarm priority is corrected in the following ways: an initial primary alarm priority is generated based on event edge weight, topological constraint causal path score, time confidence interval width, and device criticality; when the time confidence interval width exceeds the wide interval threshold and the difference in topological constraint causal path scores between candidate primary alarms is less than the score difference threshold, the priority of candidate primary alarms whose time confidence interval width exceeds the uncertainty threshold is reduced while their evidence chain is preserved; when the device criticality is higher than the critical device threshold and the protection zone coverage relationship and the propagation direction of the switch status are simultaneously satisfied, the priority of the corresponding candidate primary alarm is increased; the corrected primary alarm priority is used for duplicate alarm folding, derived alarm association, and root cause sorting.

10. A big data-based digital operation and maintenance system for substations, used to execute the big data-based digital operation and maintenance method for substations as described in any one of claims 1 to 9, characterized in that, include: The data modeling module is used to perform protocol parsing and unified modeling of multi-source operation data of substations, and generate a set of event objects; The time correction module is used to jointly estimate clock offset, drift rate and transmission delay based on the disturbance anchor point, and generate a set of time-corrected events with corrected timestamps and time confidence intervals; The event graph construction module is used to construct a heterogeneous time-series event graph and determine event edge weights based on the primary wiring topology, protected area range, equipment interval association, and communication subscription relationship; the graph association analysis module is used to perform graph attention aggregation and topological constraint causal path scoring to generate alarm association results; the alarm handling output module is used to perform alarm suppression, aggregation, and root cause sorting based on the alarm association results, and output the fault event chain, main alarm, repeated alarm, derived alarm, suspected root cause device, fault impact range, and evidence chain.

Images