Digital-twin-based virtual-real mapping management system for safe operation of integrated energy station

Abstract

The application discloses a comprehensive energy station safe operation virtual-real mapping management system based on digital twinning, which comprises a virtual-real mapping module, a safety attention heat map generation module, an attention-oriented counterfactual generation module, a safety redundancy boundary identification module, a cold-hot layered calculation scheduling module and a feedback and closed-loop control module. The virtual-real mapping module constructs a digital twin and collects real-time data; the attention heat map generation module divides grids and periodically calculates attention weights; the counterfactual generation module differentiates counterfactual scenarios according to the comparison results of attention weights and thresholds; the redundancy identification module counts the effective triggering times of safety redundancy elements in the counterfactual scenarios and outputs redundancy removal suggestions and simplification suggestions. Through attention-guided counterfactual deduction and feedback self-optimization, the application realizes dynamic allocation of computing power and intelligent identification of invalid redundancy, effectively improving the computing efficiency and decision accuracy of comprehensive energy station safe operation management.

Description

Technical Field

[0001] This invention belongs to the field of electrical digital data processing technology, and in particular relates to a virtual-real mapping management system for the safe operation of integrated energy stations based on digital twins. Background Technology

[0002] With the rapid development of multi-energy coupled systems, integrated energy stations (containing at least two energy forms such as electricity, heat, cooling, gas, and hydrogen) have become core energy supply facilities for industrial parks, data centers, and urban building complexes. These stations involve a wide variety of equipment and complex coupling relationships, and their safe operation and management heavily rely on digital twin technology to achieve real-time mapping between physical and virtual spaces. Currently, existing technical solutions mainly focus on high-fidelity modeling and real-time data synchronization of the digital twin. This involves deploying numerous sensors to collect operating parameters such as temperature, pressure, flow rate, voltage, and current, constructing a virtual mirror based on a mechanistic model or a data-driven model, and achieving a holographic reproduction of the physical station's operating status. At the safety analysis level, existing methods often employ fixed threshold alarms combined with manually compiled fault tree analysis manuals, with safety engineers periodically evaluating the effectiveness of redundant sensors, protection logic, and backup paths within the station. At the computing resource management level, all equipment areas typically use the same sampling frequency and model accuracy for unified mapping and simulation. Furthermore, some solutions introduce a periodic maintenance mechanism, performing offline calibration of the digital twin model parameters at fixed time intervals to mitigate the decline in mapping accuracy caused by equipment aging. The aforementioned technologies constitute the basic framework for the safe operation and management of current integrated energy stations.

[0003] However, the aforementioned existing technical solutions have the following shortcomings. First, the mapping and extrapolation strategy with equal precision and step size for all regions leads to a serious waste of computing resources. While low-risk areas consume a large amount of computing power, high-risk areas cannot obtain sufficient real-time protection due to the dispersion of computing power. Moreover, the computational workload of high-fidelity extrapolation is huge, making it difficult to achieve near real-time security analysis on edge devices. Second, security redundancy assessment relies entirely on manually compiled fault trees, which can only cover a limited number of pre-defined fault modes. It cannot dynamically identify invalid redundancy or overly secure designs, nor can it quantify the residual risk increment after removing redundancy. Low-frequency, high-consequence protection and completely invalid redundancy cannot be distinguished in the long term, leading to an imbalance between security and economy. Third, attention mechanisms and counterfactual extrapolation are still lacking in the field of integrated energy station security. There is a lack of mechanisms to adaptively adjust the analysis precision according to real-time operating conditions, and there is no closed-loop structure to feed the extrapolation results back to attention allocation to optimize the analysis focus of the next cycle. Fourth, computing resource scheduling lacks linkage with security attention levels. When a sudden change in the station's operating conditions causes a sharp increase in risk in a certain area, the existing system cannot quickly allocate more computing power to that area. Fifth, the twin model's parameter updates rely on offline manual operation, making it impossible to track the dynamic process of long-term equipment degradation. Furthermore, it lacks a rollback mechanism to ensure reliability after configuration changes, resulting in insufficient long-term system reliability and adaptability. These shortcomings, combined, constitute a technical bottleneck restricting the improvement of the safe operation and management level of integrated energy stations. Summary of the Invention

[0004] To overcome the aforementioned deficiencies in existing technologies, this invention provides a virtual-real mapping management system for the safe operation of integrated energy stations based on digital twins. This system addresses the problems in existing integrated energy station digital twin security management systems, such as wasted computing power due to equal-precision extrapolation, insufficient protection of high-risk areas, inability of static redundancy analysis to distinguish between effective protection and ineffective waste, lack of attention-driven adaptive closed-loop and resource linkage mechanisms, reliance on offline operations for model updates, and insufficient long-term system reliability and adaptability.

[0005] To achieve the above objectives, the present invention provides the following technical solution: A digital twin-based integrated energy station safe operation virtual-real mapping management system includes coupling devices for at least two energy forms, the system comprising: The virtual-real mapping module constructs a digital twin and collects real-time operational data; The security attention heatmap generation module divides the space into grids and periodically calculates the attention weight of each grid. The attention-oriented counterfactual generation module divides regions based on a comparison of attention weights with preset high and low thresholds, and generates counterfactual scenarios in a differentiated manner. The safety redundancy boundary identification module counts the effective trigger counts of redundant elements in counterfactual scenarios and outputs removal and simplification suggestions. The hot and cold tiered computing scheduling module allocates computing resources based on attention weights and adjusts high thresholds when the load exceeds limits. The feedback and closed-loop control module updates the virtual pre-simulation influence, outputs the minimum safety redundancy configuration, and feeds the influence back to the attention heatmap module.

[0006] Preferably, the attention weight is obtained by weighted summation of the operating condition mutation rate, the sensitivity of historical accident precursors, and the virtual rehearsal influence of the previous cycle; the different attention regions are divided as follows: grid cells with attention weights higher than the high attention threshold are high attention regions, grid cells with attention weights higher than the low attention threshold but not higher than the high attention threshold are medium attention regions, and grid cells with attention weights not higher than the low attention threshold are low attention regions; the counterfactual generation module generates high-fidelity counterfactual scenarios, low-fidelity counterfactual scenarios, or no counterfactual scenarios for high, medium, and low attention regions, respectively, wherein low attention regions are forced to generate low-fidelity counterfactual scenarios when the operating condition mutation rate exceeds the sixth threshold.

[0007] Preferably, the output of the virtual-real mapping module is connected to the input of the security attention heatmap generation module, the output of the security attention heatmap generation module is connected to the input of the attention-oriented counterfactual generation module and the cold-hot stratified calculation scheduling module, the output of the attention-oriented counterfactual generation module is connected to the input of the security redundancy boundary identification module, the output of the security redundancy boundary identification module is connected to the input of the feedback and closed-loop control module, and the output of the feedback and closed-loop control module is connected to the feedback input of the security attention heatmap generation module, forming a closed-loop control loop.

[0008] Preferably, the virtual-real mapping module collects data at a first time scale of 100 milliseconds or less; the safety attention heatmap generation module periodically calculates attention weights at a second time scale of 5 to 30 minutes; the attention weight is equal to the sum of the first weight coefficient multiplied by the exponentially weighted moving average of the operating condition mutation rate, the second weight coefficient multiplied by the exponentially weighted moving average of the sensitivity of historical accident precursors, and the third weight coefficient multiplied by the exponentially weighted moving average of the influence of the virtual rehearsal in the previous period, wherein the sum of the first weight coefficient, the second weight coefficient, and the third weight coefficient is 1, the decay factor of the exponentially weighted moving average is 0.8 to 0.95, and the historical window length is 20 periods.

[0009] Preferably, the high-fidelity counterfactual scenario is generated as follows: for each grid cell in the high-attention region, at least three perturbation combinations are generated based on the historical fluctuation amplitude of the cell's key parameters. The perturbation combinations include applying a positive maximum amplitude perturbation, applying a negative maximum amplitude perturbation, and applying a half-amplitude perturbation in the same direction as the rate of change of the key parameters. A full-order nonlinear differential equation model is used to extrapolate forward for 30 to 120 seconds with the same time step as the virtual-real mapping module. The historical fluctuation amplitude is the historical fluctuation standard deviation of the cell's key parameters, the maximum amplitude is 1 times the fluctuation standard deviation, and the half amplitude is 0.5 times the fluctuation standard deviation. The key parameters include at least one of temperature, pressure, flow rate, voltage, current, and state of charge.

[0010] Preferably, the low-fidelity counterfactual scenario is generated as follows: for each grid cell in the attention region, based on the historical fluctuation amplitude of the cell's key parameters, positive maximum amplitude perturbation and negative maximum amplitude perturbation are applied, and a reduced-order model or surrogate model is used to extrapolate forward for 30 to 120 seconds with a time step of 5 to 10 times the virtual-real mapping step size.

[0011] Preferably, the necessity score is the number of times the safety redundancy element is effectively triggered in all counterfactual scenarios divided by the total number of scenarios; the safety redundancy element includes redundant sensors, protection logic, and backup paths; the effective triggering is defined as: in a counterfactual scenario, the safety redundancy element activates after the accident indicator exceeds a preset alarm threshold, and the peak value of the accident indicator after activation decreases by more than 10% within 5 to 30 seconds relative to the peak value immediately before activation; the accident indicator includes at least one of pressure over-limit time, temperature over-limit range, gas concentration over-limit duration, and current overload time; the third threshold is 0.05.

[0012] Preferably, the residual risk increment is calculated as follows: for a safety redundancy element marked as a candidate redundancy, the redundancy element is removed from the original counterfactual scenario and re-analyzed. The severity of the accident after removal in each scenario is subtracted from the severity of the accident before removal, multiplied by the probability of occurrence of the scenario, the above products of all scenarios are added together, and then divided by the sum of the probabilities of all scenarios; the fourth threshold is 0.01; the severity of the accident is expressed as the economic loss value in units of 10,000 yuan or the normalized accident index time integral, and the dimension of the residual risk increment is the same as that of the accident severity.

[0013] Preferably, in the hot and cold tiered computing scheduling module, the hot layer is used to execute high-precision computing tasks, the warm layer is used to execute medium-precision computing tasks, and the cold layer is used to execute low-precision computing tasks. The high-precision computing tasks include real-time mapping of full-order models in high-attention regions and high-fidelity counterfactual generation; the medium-precision computing tasks include low-fidelity counterfactual generation in medium-attention regions; and the low-precision computing tasks include static mapping or linear interpolation in low-attention regions. The preset capacity threshold is 85% of the edge server capacity. When the number of times the limit is exceeded reaches 3 times in 3 consecutive second time scale periods, a capacity expansion prompt is issued, which is a warning message about insufficient edge server resources.

[0014] Preferably, the feedback and closed-loop control module is further configured to: automatically execute the suggestion if two adjacent second timescale cycles output the same removal recommendation for the same redundant element and the absolute value of the residual risk increment change is less than 5%; if the counterfactual inference of the next cycle after execution shows that a new accident path has appeared, causing the residual risk increment to exceed the fourth threshold, then issue a rollback recommendation and restore the redundant element to its original configuration; the virtual-real mapping module also includes a model self-calibration unit, configured to trigger an online update of the digital twin model parameters when the number of removal recommendations output by the safety redundancy boundary identification module for three consecutive second timescale cycles is zero and the number of simplified design recommendations is zero; the third, fourth, and sixth thresholds are manually adjusted by the operator through a human-machine interface; the system also includes a visualization module, configured to display the attention weight of each grid cell on a two-dimensional or three-dimensional map, and display the minimum safety redundancy configuration scheme and residual risk report output in the current cycle.

[0015] The technical effects and advantages of the digital twin-based integrated energy station safe operation virtual-real mapping management system of this invention are as follows: 1. This invention's attention-oriented counterfactual generation module divides grid cells into high, medium, and low attention regions based on a comparison of attention weights and thresholds. It generates high-fidelity, low-fidelity, or no counterfactual scenarios for different regions, with low-attention regions only forcibly generating low-fidelity scenarios when the operational condition mutation rate exceeds a sixth threshold. This differentiated generation strategy avoids the computational waste caused by equal-precision simulations across all regions in traditional solutions. While ensuring the accuracy of security analysis in high-risk areas, it significantly reduces the computational requirements for counterfactual simulations, making near-real-time security analysis possible in edge computing environments. Simultaneously, the attention weights are obtained by weighted summation of the operational condition mutation rate, historical accident precursor sensitivity, and the influence of the previous virtual simulation cycle. This triple-factor fusion mechanism ensures the accuracy and dynamic adaptability of the attention heatmap.

[0016] In this invention, the necessity score in the safety redundancy boundary identification module is calculated by dividing the number of times a safety redundancy element is effectively triggered in all counterfactual scenarios by the total number of scenarios. This indicator objectively reflects the actual frequency of action of redundant elements in real accident conditions. The module further calculates the residual risk increment through comparative deduction. For candidate redundancies with a necessity score below the third threshold, it quantifies the risk increase after removal. If the residual risk increment is below the fourth threshold, a removal recommendation is output. This mechanism, for the first time, elevates the value measurement of safety redundancy from static empirical judgment to dynamic data-driven decision-making, achieving accurate differentiation between low-frequency, high-consequence protection and completely ineffective redundancy. It effectively eliminates the safety hazards of over-designing by "retaining all redundancy" or "blindly simplifying" in traditional manual fault tree analysis.

[0017] This invention employs a hot-cold tiered computing scheduling module that dynamically divides computing resources into three precision levels: hot, warm, and cold. Based on attention weight distribution, real-time mapping of full-order models and high-fidelity counterfactual generation for high-attention regions are allocated to the hot layer; low-fidelity counterfactual generation for medium-attention regions is allocated to the warm layer; and static mapping or linear interpolation for low-attention regions is allocated to the cold layer. This mechanism introduces the hot-cold tiered approach from computer architecture into digital twin resource management, ensuring that high-attention regions receive the highest precision computing guarantee while preventing low-attention regions from consuming excessive computing power. A load adaptive unit automatically adjusts the first threshold to reduce the range of high-attention regions when the total computing load exceeds a preset capacity threshold, and a capacity expansion warning mechanism issues a resource shortage warning when limits are continuously exceeded. This dual-protection mechanism ensures stable system operation under different operating conditions.

[0018] In this invention, the feedback and closed-loop control module calculates the virtual pre-simulation influence of each grid cell based on the current counterfactual scenario and updates it to the historical sliding window for attention weight calculation in the next cycle. This mechanism enables high-influence nodes discovered in counterfactual simulation to increase their attention weight in the next cycle, guiding the system to simulate that area more precisely in the next round. This forms a self-reinforcing cycle of "risk discovery in simulation → attention focusing on risk areas → more precise simulation in the next round," allowing the system's security analysis capabilities to continuously optimize itself during operation.

[0019] In this invention, the feedback and closed-loop control module automatically executes only when the same removal suggestion is output for the same redundancy in two adjacent cycles and the residual risk change is less than 5%. After execution, if the next cycle's simulation shows a new accident path causing the residual risk to exceed the fourth threshold, a rollback suggestion is immediately issued and the configuration is restored. This mechanism, through the dual protection of "pre-execution verification + post-execution monitoring," effectively prevents erroneous operations caused by single simulation deviations. Simultaneously, the model self-calibration unit in the virtual-real mapping module triggers online updates of model parameters when there are no output suggestions for three consecutive cycles. This enables the digital twin to track the long-term degradation trend of the physical device, maintain the long-term accuracy of the virtual-real mapping, and ensure the effectiveness of the system's safety analysis throughout its entire lifecycle. Attached Figure Description

[0020] Figure 1 This is a system block diagram of the integrated energy station safety operation virtual-real mapping management system based on digital twin proposed in this invention. Detailed Implementation

[0021] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0022] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include," "contain," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "includes..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0023] refer to Figure 1This invention provides a virtual-real mapping management system for the safe operation of integrated energy stations based on digital twins, including a virtual-real mapping module, a safety attention heatmap generation module, an attention-oriented counterfactual generation module, a safety redundancy boundary identification module, a cold and hot layered calculation and scheduling module, and a feedback and closed-loop control module. The system constructs a digital twin through a virtual-real mapping module and collects real-time operational data from the physical station. The security attention heatmap generation module divides the integrated energy station into multiple spatial grid units and periodically calculates the attention weight of each grid unit. The attention-oriented counterfactual generation module divides the grid units into different attention regions based on the comparison results of attention weight and threshold, and generates high-fidelity, low-fidelity, or no counterfactual scenarios for different regions. The security redundancy boundary identification module counts the number of times security redundancy elements are effectively triggered in all counterfactual scenarios and calculates the necessity score to mark candidate redundancies. At the same time, it calculates the residual risk increment to output removal suggestions and counts the percentage of times protection logic or backup paths are not effectively triggered to output simplification suggestions. The hot and cold layered computing scheduling module dynamically divides computing resources into different precision levels and allocates processing tasks to each region according to the attention weight distribution, and monitors the total computing load to adjust the threshold and reduce the range of high attention regions when the limit is exceeded. The feedback and closed-loop control module calculates the virtual pre-simulation impact based on the current round of counterfactual scenarios, updates it to the historical sliding window, outputs the minimum security redundancy configuration scheme, and issues change instructions according to the preset execution mode. The system guides counterfactual deduction through attention heatmaps, and the results of counterfactual deductions are fed back to the attention heatmaps to form a self-optimizing closed loop. Based on the deduction results, it quantitatively identifies invalid redundancy and low-frequency, high-consequence protection. Combined with cold and hot hierarchical scheduling, it achieves accuracy assurance for high-risk areas under limited computing power, effectively solving the technical problems of wasted computing power, inaccurate static analysis of redundancy, and lack of adaptive closed loop in the safe operation and management of integrated energy stations.

[0024] Example 1 Purpose of implementation: The purpose of this embodiment is to provide a specific implementation of the virtual-real mapping module and the security attention heatmap generation module, so as to achieve accurate mapping of the physical system of the integrated energy station to the digital space, and dynamically calculate the security attention level of each area based on the operating conditions, historical priors and feedback information, so as to provide a basis for subsequent differentiated counterfactual inference.

[0025] Implementation System: The system used in this embodiment includes a virtual-real mapping module and a safety attention heatmap generation module. The virtual-real mapping module is used to construct a digital twin of the integrated energy station and collect real-time operating data of the physical station at a first time scale. The safety attention heatmap generation module is used to divide the integrated energy station into multiple spatial grid cells and periodically calculate the attention weight of each grid cell at a second time scale. The attention weight is obtained by weighted summation of the operating condition mutation rate, the sensitivity of historical accident precursors, and the influence of the virtual rehearsal in the previous period.

[0026] The integrated energy station described in this embodiment is a park-level integrated energy station comprising a gas turbine generator set, a lithium bromide absorption heat pump, an electric chiller unit, and an energy storage battery. Key equipment within the station includes one 10MW gas turbine, two 2000kW lithium bromide heat pumps, three 1500kW electric chillers, and one 5MWh energy storage battery system.

[0027] Implementation steps: Step 1: Digital Twin Construction. The virtual-physical mapping module synchronously collects real-time operational data from the physical station via Industrial Ethernet and Modbus / TCP protocol, using 100 milliseconds as the first time scale. The collected data includes: gas turbine exhaust temperature (range 0 to 800 degrees Celsius, accuracy ±0.5 degrees Celsius); natural gas intake pressure (range 0 to 4 MPa, accuracy ±0.1% of full scale); lithium bromide heat pump chiller inlet and outlet temperature difference (range 0 to 100 degrees Celsius, accuracy ±0.2 degrees Celsius); electric chiller compressor current (range 0 to 2000 amperes, accuracy ±0.5%); energy storage battery state of charge (accuracy ±1%); valve opening degree (accuracy ±0.5%); and various switch statuses.

[0028] The virtual-real mapping module constructs a digital twin based on the above data. The gas turbine adopts a zero-dimensional nonlinear differential equation model based on thermodynamic principles, and its dynamic response equation is: the derivative of exhaust temperature with respect to time multiplied by the exhaust temperature time constant equals the combustion efficiency multiplied by the fuel mass flow rate multiplied by the lower heating value of natural gas minus the specific heat capacity of air at constant pressure multiplied by the air mass flow rate multiplied by the difference between exhaust temperature and ambient temperature. The lithium bromide heat pump adopts a reduced-order model based on an absorption cycle, and the electric chiller adopts a surrogate model based on the coefficient of performance curve. The parameters of each model were obtained through field test calibration before the system was put into operation.

[0029] Step Two: Spatial Grid Division. The safety attention heatmap generation module divides the integrated energy station into multiple spatial grid units according to equipment boundaries. In this embodiment, there are 15 spatial grid units, specifically divided as follows: the gas turbine area is Unit 1, the waste heat boiler area is Unit 2, the two lithium bromide heat pump areas are Units 3 and 4, the three electric chiller areas are Units 5, 6, and 7, the energy storage battery area is Unit 8, the natural gas pressure regulating and metering area is Unit 9, the cooling water circulation area is Unit 10, the chilled water circulation area is Unit 11, the power grid connection area is Unit 12, the station control system area is Unit 13, and the gas pipeline section is Units 14 and 15, divided equally according to the pipeline length.

[0030] Step 3: Attention Weight Calculation. The safety attention heatmap generation module periodically calculates the attention weight of each grid cell using a 30-minute timescale as the second time scale. Within the current period, for any grid cell, the attention weight is equal to the sum of 0.4 multiplied by the exponentially weighted moving average of the operational condition mutation rate, 0.3 multiplied by the exponentially weighted moving average of the sensitivity to historical accident precursors, and 0.3 multiplied by the exponentially weighted moving average of the influence of the virtual rehearsal in the previous period. The decay factor of the exponentially weighted moving average is set to 0.9, and the historical window length is 20 periods.

[0031] The operating condition abrupt change rate is calculated as follows: For any key variable within a grid cell, the total variation over the most recent 10 sampling steps is divided by the maximum total variation among all grid cells for normalization. For example, at a certain operating moment, if the gas turbine exhaust temperature rises from 510 degrees Celsius to 518 degrees Celsius in the most recent second, with a total variation of 8 degrees Celsius, and the maximum total variation among all cells is 12 degrees Celsius, then the operating condition abrupt change rate for this gas turbine cell is 8 divided by 12, which equals 0.667.

[0032] The sensitivity of historical accident precursors is obtained by extracting accident precursor features from historical fault records of this station and similar integrated energy stations. For example, historical records show that the gas turbine exhaust temperature rose at a rate exceeding 2 degrees Celsius per second for 5 minutes before a fault, occurring 3 times in total, with 2 of those ultimately triggering a protective shutdown. Under the current operating conditions, if the gas turbine exhaust temperature rises at a rate of 1.8 degrees Celsius per second, the historical accident precursor sensitivity of this grid cell, calculated using Gaussian kernel density estimation, is 2 divided by 3, which equals 0.667.

[0033] The initial value of the virtual pre-simulation influence is 0, which is provided by the feedback and closed-loop control module after the first cycle.

[0034] Based on the above calculations, the normalized distribution of attention weights for each grid unit in this round is as follows: gas turbine unit 0.82, waste heat boiler unit 0.65, first lithium bromide heat pump unit 0.45, second lithium bromide heat pump unit 0.38, first electric chiller unit 0.28, second electric chiller unit 0.25, third electric chiller unit 0.22, energy storage battery unit 0.55, natural gas pressure regulating and metering unit 0.72, cooling water circulation unit 0.18, chilled water circulation unit 0.15, power grid connection unit 0.20, station control system unit 0.12, first gas pipeline section unit 0.35, and second gas pipeline section unit 0.30. Based on the classification criteria of a first threshold of 0.7 and a second threshold of 0.3, the gas turbine unit and the natural gas pressure regulating and metering unit are classified as high attention areas; the waste heat boiler unit, the energy storage battery unit, the first lithium bromide heat pump unit, the second lithium bromide heat pump unit, the first gas pipeline section unit and the second gas pipeline section unit are classified as medium attention areas; and the remaining units are classified as low attention areas.

[0035] Step 4: Attention Heatmap Visualization. The visualization module displays the attention weight distribution of each grid cell in real time on the 3D map, using red to represent high attention areas, yellow to represent medium attention areas, and green to represent low attention areas. Operations personnel can view the current security attention level of each area within the site through the human-machine interface.

[0036] Implementation results: This embodiment achieves a precise mapping of the integrated energy station from physical space to digital space. The virtual-physical mapping module continuously synchronizes the physical station's operational data in 100-millisecond increments, ensuring the real-time performance and fidelity of the digital twin. The safety attention heatmap generation module automatically calculates the attention weight of each grid unit on a 30-minute cycle, successfully identifying the gas turbine unit and natural gas pressure regulating and metering unit as high-concern areas, providing accurate guidance for subsequent differentiated counterfactual analysis. The visualization module enables maintenance personnel to intuitively grasp the distribution of safety attention levels in various areas within the station, enhancing situational awareness.

[0037] Example 2 Purpose of implementation: The purpose of this embodiment is to provide a specific implementation of an attention-oriented counterfactual generation module to solve the problem of excessive computational load and inability to run in real time during counterfactual inference in integrated energy station security analysis. Its core lies in employing different fidelity inference strategies for different regions based on the level of attention weight, thereby significantly reducing computational requirements while ensuring the comprehensiveness of the security analysis.

[0038] Implementation System: The system used in this embodiment includes a security attention heatmap generation module and an attention-oriented counterfactual generation module. The attention-oriented counterfactual generation module divides grid cells into high, medium, and low attention regions based on the comparison results of attention weights with a first threshold and a second threshold, and generates high-fidelity, low-fidelity, or no counterfactual scenarios for the high, medium, and low attention regions, respectively. Specifically, a low-fidelity counterfactual scenario is forcibly generated for the low-attention region when the operational condition mutation rate exceeds a sixth threshold.

[0039] Based on the attention weighting results in Example 1, the gas turbine unit (attention weight 0.82) and the natural gas pressure regulating and metering unit (attention weight 0.72) are high attention regions; the waste heat boiler unit (0.65), the energy storage battery unit (0.55), the first lithium bromide heat pump unit (0.45), the second lithium bromide heat pump unit (0.38), the first gas pipeline section unit (0.35), and the second gas pipeline section unit (0.30) are medium attention regions; and the remaining units are low attention regions.

[0040] Implementation steps: Step 1: High-fidelity counterfactual generation in the high-attention region. For the gas turbine unit in the high-attention region, exhaust temperature and fuel flow rate are selected as key parameters. Historical operating data for this unit shows that the historical standard deviation of exhaust temperature fluctuation is 4.2 degrees Celsius, and the historical standard deviation of fuel flow rate fluctuation is 0.15 kg / s.

[0041] The attention-oriented counterfactual generation module generates high-fidelity counterfactual scenarios with the following three perturbation combinations. The first is applying a positive maximum amplitude perturbation, increasing the exhaust temperature by one historical standard deviation (SSD), i.e., an increase of 4.2 degrees Celsius. The second is applying a negative maximum amplitude perturbation, decreasing the exhaust temperature by one SSD, i.e., a decrease of 4.2 degrees Celsius. The third is applying a half-amplitude perturbation in the same direction as the rate of change of the key parameter. If the current rate of change of the exhaust temperature is increasing by 1.8 degrees Celsius per second, indicating an upward trend, then the exhaust temperature is increased by 0.5 times the historical SSD, i.e., an increase of 2.1 degrees Celsius. All three perturbations use a full-order nonlinear differential equation model and extrapolate forward for 60 seconds using the same 100-millisecond time step as the virtual-real mapping module. During the extrapolation, the model calculates the dynamic responses of related variables such as compressor outlet pressure, turbine output power, and bearing temperature in real time.

[0042] For the natural gas pressure regulating and metering unit in the high-attention area, the pressure after the pressure regulating valve is selected as the key parameter. The historical fluctuation standard deviation is 0.08 MPa. Similarly, a high-fidelity counterfactual scenario of the above three perturbation combinations is generated, with a simulation time of 60 seconds.

[0043] Each high-fidelity counterfactual scenario records accident-related indicators for each spatial unit during the simulation process, including the time of pressure exceeding limits, the magnitude of temperature exceeding limits, and the duration of gas concentration exceeding standards.

[0044] Step Two: Low-fidelity counterfactual generation in the mid-attention region. For the energy storage battery cells in the mid-attention region, the battery state of charge and charge / discharge current are selected as key parameters. The historical fluctuation standard deviations are 3% and 50 amps, respectively.

[0045] The module applies the following two combinations of perturbations in a low-fidelity counterfactual scenario. The first is applying a positive maximum amplitude perturbation, increasing the state of charge by 3% from its original value. This is done using a reduced-order model, a simplified second-order RC model based on the equivalent circuit model, with a time step of 500 milliseconds (five times the virtual-to-real mapping step of 100 milliseconds), extrapolating forward for 60 seconds. The second is applying a negative maximum amplitude perturbation, decreasing the state of charge by 3% from its original value, also extrapolating forward for 60 seconds with a 500-millisecond step.

[0046] For the waste heat boiler unit in the central attention region, the outlet steam pressure is selected as the key parameter, with a historical fluctuation standard deviation of 0.12 MPa. A multinomial regression surrogate model based on response surface methodology is adopted to extrapolate 60 seconds forward with a time step of 800 milliseconds, generating low-fidelity counterfactual scenarios in both positive and negative directions.

[0047] Step 3: Scenario reuse and forced triggering in low-attention regions. For the cooling water circulation unit in the low-attention region, the current cycle operating condition mutation rate is 0.08, which is less than the sixth threshold of 0.2. Therefore, no new counterfactual scenario is generated, and the counterfactual scenario of the same grid unit in the previous cycle is reused.

[0048] For the chilled water circulation unit in the low-attention region, if the current cycle operating condition mutation rate is 0.25, exceeding the sixth threshold of 0.2, a low-fidelity counterfactual scenario generation is forcibly triggered. The forced generation uses the same reduced-order model and 500-millisecond time step as the medium-attention region, selects the chilled water outlet temperature as the key parameter, has a historical fluctuation standard deviation of 0.5 degrees Celsius, applies perturbations in both positive and negative directions, and extrapolates forward by 60 seconds.

[0049] Step 4: Parallel Simulation of Multiple Scenarios. In this embodiment, a total of 6 high-fidelity counterfactual scenarios were generated, namely 3 gas turbine units and 3 natural gas pressure regulating and metering units; and 14 low-fidelity counterfactual scenarios, namely 2 energy storage battery units, 2 waste heat boiler units, 2 first lithium bromide heat pump units, 2 second lithium bromide heat pump units, 2 first gas pipeline section units, 2 second gas pipeline section units, and 2 forced-triggered chilled water circulation units. A total of 20 counterfactual scenarios were generated. All scenarios were computed in parallel in the thermal and temperature layers of the edge server, with the total simulation time controlled within 120 seconds.

[0050] Implementation results: In this embodiment, the attention-oriented counterfactual generation module successfully achieved differentiated counterfactual inference. The high-attention region (gas turbine, natural gas pressure regulation and metering) obtained six high-fidelity counterfactual scenarios, the medium-attention region obtained fourteen low-fidelity scenarios, and the low-attention region reused historical scenarios when operating conditions were stable, only forcibly generating new scenarios during sudden changes, thus avoiding waste of computational resources. The total inference time was controlled within 120 seconds, far less than the 30-minute cycle length, making near real-time safety analysis possible. The forced triggering mechanism ensured that the low-attention region would not miss safety assessments due to the use of outdated data during drastic changes in operating conditions.

[0051] Example 3 Purpose of implementation: The purpose of this embodiment is to provide a specific implementation of a safety redundancy boundary identification module to address the long-standing problem of the inability to quantitatively assess "which redundancies are truly effective and which are ineffective and wasteful" in the safety redundancy configuration of integrated energy stations. Its core lies in identifying ineffective redundancies by statistically analyzing the effective trigger counts of safety redundancy elements in counterfactual scenarios, and quantifying the residual risk increment after removing redundancy, thus providing a decision-making basis for the dynamic balance between safety and economy.

[0052] Implementation System: The system used in this embodiment includes an attention-oriented counterfactual generation module and a security redundancy boundary identification module. The security redundancy boundary identification module is used to count the number of times security redundancy elements are effectively triggered in all counterfactual scenarios, calculate the necessity score, mark redundancy elements with necessity scores below the third threshold as candidate redundancies, calculate the residual risk increment, output removal suggestions when the residual risk increment is below the fourth threshold, and count the percentage of times protection logic or backup paths are not effectively triggered within a consecutive preset number of cycles, output simplification suggestions when the percentage exceeds the fifth threshold.

[0053] Based on the deduction results of the 20 counterfactual scenarios generated in Example 2, this example identifies and quantifies the safety redundancy elements in the integrated energy station.

[0054] Implementation steps: Step 1: Definition of Safety Redundancy Elements. In this embodiment, the safety redundancy elements configured in the integrated energy station include three categories: redundant sensors, protection logic, and backup paths. Redundant sensors include: a 2 / 3 redundant sensor for gas turbine exhaust temperature (containing 3 thermocouples, any 2 of which need to be functioning correctly); a 1 / 2 redundant sensor for pressure after the natural gas pressure regulating valve (containing 2 pressure transmitters); and a 1 / 2 redundant sensor for voltage in the energy storage battery management system (containing 2 voltage sampling boards). Protection logic includes: high exhaust temperature protection for the gas turbine (tripping when the exhaust temperature reaches 580 degrees Celsius); high pressure protection after the natural gas pressure regulating valve (shutting down when the pressure reaches 2.8 MPa); overcharge protection for the energy storage battery (cutting off charging when the state of charge reaches 95%); and low-temperature protection for the lithium bromide heat pump refrigerant water (shutting down when the temperature drops to 3 degrees Celsius). Backup paths include: a backup discharge circuit for the energy storage battery, a natural gas bypass pipeline, and a backup cooling water pump.

[0055] Step Two: Necessity Score Calculation. The safety redundancy boundary identification module counts the number of times each safety redundancy element is effectively triggered in all 20 counterfactual scenarios. Effective triggering is defined as follows: in a counterfactual scenario, after an incident indicator exceeds a preset alarm threshold, the safety redundancy element activates, and the peak value of the incident indicator after activation decreases by more than 10% within 15 seconds compared to the peak value immediately before activation.

[0056] The high exhaust temperature protection logic of a gas turbine is illustrated using an example. In six high-fidelity counterfactual scenarios, the first scenario involves applying a positive 4.2°C perturbation. The exhaust temperature reaches 578°C at the 18th second of the simulation, exceeding the alarm threshold of 570°C and triggering the protection logic. After the protection action, the peak exhaust temperature drops to 552°C at the 22nd second, a decrease of (578 - 552) divided by 578, which equals 4.5%, less than 10%, and is therefore not considered a valid trigger. The second scenario involves applying a negative 4.2°C perturbation; the exhaust temperature does not exceed the alarm threshold and is therefore not considered a valid trigger. The third scenario involves applying a positive 2.1°C perturbation in the same direction; the exhaust temperature reaches 575°C at the 15th second of the simulation, triggering the protection logic. After the action, the peak temperature drops to 535°C at the 20th second, a decrease of (575 - 535) divided by 575, which equals 7.0%, less than 10%, and is therefore not considered a valid trigger. Similarly, scenarios four through six did not meet the valid triggering conditions. Therefore, the necessity score for the gas turbine exhaust temperature high protection logic is 0 valid triggers divided by the total number of scenarios (6), which equals 0, lower than the third threshold of 0.05, and is marked as a candidate redundancy.

[0057] The overcharge protection logic of an energy storage battery is used as an example for explanation. In two low-fidelity counterfactual scenarios for the energy storage battery cell, the first scenario involves a 3% increase in the state of charge (SBC). The SBC reaches 94% at the 25th second of the simulation, exceeding the alarm threshold of 90% and triggering overcharge protection. After the protection action, the peak SBC drops to 82% at the 35th second, a decrease of (94 - 82) divided by 94, which equals 12.8%, exceeding 10%, thus considered a valid trigger. The second scenario involves a 3% decrease in the SBC. The SBC does not exceed the alarm threshold and is not considered a valid trigger. The necessity score is calculated as the number of valid triggers (1) divided by the total number of scenarios (2), which equals 0.5, higher than the third threshold of 0.05, and is not marked as a candidate redundancy.

[0058] According to statistics, the safety redundancy elements marked as candidate redundancy include: gas turbine exhaust temperature high protection logic, with a necessity score of 0; and cooling water backup pump, which has never been activated in all 20 scenarios, with a necessity score of 0.

[0059] Step 3: Calculation of Residual Risk Increment. For the gas turbine exhaust temperature high protection logic marked as a candidate redundancy, the safety redundancy boundary identification module generates a counterfactual scenario. In the original 6 high-fidelity counterfactual scenarios, the protection logic is forcibly disabled, that is, the protection logic is made not to act, and the severity of the accident consequences is re-analyzed and calculated.

[0060] The severity of the accident consequences is expressed as an economic loss in units of 10,000 yuan. The conversion rules are as follows: losses from unplanned gas turbine shutdowns are calculated at 50,000 yuan per incident; equipment damage repair costs are estimated based on actual costs; and user losses due to power supply interruptions are calculated at 5,000 yuan per minute.

[0061] In the original scenario (where the protection logic exists), the accident severity of the six scenarios is 0 yuan, 0 yuan, 5000 yuan, 3000 yuan, 0 yuan and 2000 yuan respectively. The average severity is (0 + 0 + 50 ...

[0062] In the control scenario (protection logic removal), the accident severity of the six scenarios is 120,000 yuan, 0 yuan, 80,000 yuan, 60,000 yuan, 0 yuan and 40,000 yuan respectively. The average severity is (120,000 + 00,000 + 80,000 + 60,000 + 40,000) divided by 6, which equals 50,000 yuan.

[0063] The estimated probability of each counterfactual scenario is given by the probability density function of the operating condition in which the intervention variable is located. In this embodiment, based on historical operating data statistics, the probability of the exhaust temperature being in a disturbance condition of +4.2 degrees Celsius is 0.15, the probability of being in a disturbance condition of -4.2 degrees Celsius is 0.20, and the probability of being in a disturbance condition of +2.1 degrees Celsius in the same direction is 0.25. The probabilities of the remaining scenarios are distributed proportionally, and the normalized probabilities of the six scenarios are 0.15, 0.20, 0.25, 0.18, 0.12, and 0.10, respectively.

[0064] The residual risk increment is calculated as follows: For each scenario, subtract the severity of the accident when the protection logic is present from the accident severity after the protection logic is removed, multiply by the probability of that scenario, sum the products of all scenarios, and then divide by the sum of the probabilities of all scenarios. Substituting the values: The first scenario is (12 - 0) multiplied by 0.15, equaling 1.8; the second scenario is (0 - 0) multiplied by 0.20, equaling 0; the third scenario is (8 - 0.5) multiplied by 0.25, equaling 1.875; the fourth scenario is (6 - 0.3) multiplied by 0.18, equaling 1.026; the fifth scenario is (0 - 0) multiplied by 0.12, equaling 0; the sixth scenario is (4 - 0.2) multiplied by 0.10, equaling 0.38. The sum of these values ​​is 5.081, divided by the sum of probabilities (1.0), resulting in a residual risk increment of 50,810,000 yuan.

[0065] Since the residual risk increment is 50,810 yuan, which is much greater than the fourth threshold of 100 yuan, although the necessity score of this protection logic is 0, its residual risk increment is extremely large, and the protection logic cannot be removed. The safety redundancy boundary identification module outputs the conclusion "removal is not recommended" and indicates that this redundancy belongs to the low-frequency, high-consequence type of protection and should be retained.

[0066] For the standby cooling water pump, the necessity score is 0, and it was never activated in any of the 20 scenarios. A counterfactual scenario was generated: the standby pump was removed from the original 20 scenarios, i.e., the backup path was cut off, and the scenario was re-analyzed. The results show that since the main pump did not fail in any scenario, the severity of the accident did not change after removing the standby pump, and the residual risk increment was 0 yuan, less than the fourth threshold of 0.01 yuan. Therefore, the safety redundancy boundary identification module outputs a recommendation to "remove the standby cooling water pump" and marks the residual risk increment as 0 yuan.

[0067] Step 4: Over-safety design identification. The safety redundancy boundary identification module counts the percentage of times each protection logic or backup path has never been effectively triggered in the past 20 consecutive cycles. In this embodiment, the gas turbine exhaust temperature high protection logic has never been effectively triggered in the past 20 cycles, with a necessity score of 0 for all of them, accounting for 100%, exceeding the fifth threshold by 80%. The output simplified design suggestion is: It is recommended to evaluate whether the alarm threshold of the gas turbine exhaust temperature high protection logic is set too low, resulting in frequent alarms but none of them reaching the effective triggering condition. It is advisable to consider appropriately increasing the alarm threshold from 570 degrees Celsius to 575 degrees Celsius to reduce the interference of invalid alarms on operation and maintenance personnel.

[0068] Implementation results: In this embodiment, the safety redundancy boundary identification module successfully identified the cooling water standby pump as invalid redundancy (necessity score 0, residual risk increment 0 yuan) from 20 counterfactual scenarios. Simultaneously, it accurately identified the high exhaust temperature protection logic for the gas turbine, although having a low necessity score (0), as a low-frequency, high-consequence protection (residual risk increment 50,810 yuan), and therefore requiring retention. This dynamic and quantitative analytical depth is unattainable with traditional manual fault tree analysis. The module's output recommendations of "removing the cooling water standby pump" and "optimizing the alarm threshold" provide quantitative basis for cost reduction and efficiency improvement in the integrated energy station. Removing the cooling water standby pump can directly save approximately 20,000 yuan in annual maintenance costs.

[0069] Example 4 Purpose of implementation: The purpose of this embodiment is to provide a specific implementation of a hot / cold tiered computing scheduling module to resolve the contradiction between the limited computing resources of edge servers and the massive computing demands for security analysis in integrated energy stations. Its core lies in dynamically dividing computing resources into different precision levels and allocating processing tasks to each region according to attention weight distribution. Simultaneously, it monitors the total computing load in real time and automatically adjusts the attention threshold to narrow the range of high-attention regions when limits are exceeded, ensuring that the system consistently maintains the quality of security analysis in high-attention regions under limited computing power.

[0070] Implementation System: The system used in this embodiment includes a secure attention heatmap generation module, an attention-oriented counterfactual generation module, and a hot / cold tiered computation scheduling module. The hot / cold tiered computation scheduling module dynamically divides computational resources into different precision levels and allocates processing tasks to each region according to attention weight distribution. It also monitors the total computational load and adjusts a first threshold to reduce the range of high-attention regions when the load exceeds a preset capacity threshold. In this module, the hot layer is used to perform high-precision computation tasks, the warm layer is used to perform medium-precision computation tasks, and the cold layer is used to perform low-precision computation tasks.

[0071] Based on the attention weight distribution in Example 1 and the counterfactual generation task in Example 2, this example dynamically allocates and adaptively adjusts computing resources. As an optional implementation, the hot layer can be implemented by a graphics processor, the warm layer by a multi-core CPU, and the cold layer by a single-core CPU.

[0072] Implementation steps: Step 1: Hierarchical Partitioning of Computing Resources. The hot / cold tiered computing scheduling module dynamically divides computing resources into three precision levels. The hot layer is configured to perform high-precision computing tasks, including high-precision real-time mapping of high-attention regions (full-order nonlinear differential equation models, 100-millisecond step size) and high-fidelity counterfactual generation. The warm layer is configured to perform medium-precision computing tasks, including low-fidelity counterfactual generation of medium-attention regions. The cold layer is configured to perform low-precision computing tasks, including static mapping or linear interpolation of low-attention regions. In the edge server of this embodiment, the hot layer consists of two graphics processing units (GPUs), the warm layer consists of eight cores from a 16-core CPU, and the cold layer consists of one core from a 4-core RISC processor.

[0073] Step Two: Task Allocation. Based on the attention heatmap of the current period, the hot and cold layered computation scheduling module allocates the processing tasks of each region to the corresponding layer. Hot layer tasks include: high-precision real-time mapping of the gas turbine unit (full-order model, 100-millisecond step size) and parallel generation of 6 high-fidelity counterfactual scenarios. Temperature layer tasks include: low-fidelity counterfactual scenario generation for the energy storage battery unit, waste heat boiler unit, first lithium bromide heat pump unit, second lithium bromide heat pump unit, first gas pipeline section unit, and second gas pipeline section unit, totaling 14 scenarios. Cold layer tasks include: static mapping or linear interpolation of the cooling water circulation unit, chilled water circulation unit, power grid connection unit, and station control system unit, with a step size of 1 second.

[0074] Step 3: Computational Load Monitoring and Adaptive Adjustment. The hot and cold tiered computing scheduling module monitors the total computational load in real time. In this embodiment, the hot tier load is 72% (characterized by GPU utilization), the warm tier load is 65% (characterized by CPU utilization), and the cold tier load is 20%. The total computational load, after weighted calculation, is 68%, which does not exceed the preset capacity threshold of 85%, so no adjustment to the first threshold is required.

[0075] Suppose that in another operational scenario, the number of high-attention regions increases, for example, five units simultaneously have an attention weight exceeding 0.7, and the hot layer load reaches 92%, exceeding the 85% threshold. In this case, the load adaptive unit automatically increases the first threshold from 0.7 to 0.75 and re-divides the regions. The two units with original attention weights of 0.72 and 0.73 are removed from the high-attention region and reclassified as medium-attention regions; their corresponding counterfactual generation tasks are migrated from the hot layer to the warm layer. After the re-divide, the hot layer load drops to 82%, below the 85% threshold. The load adaptive unit records this instance of exceeding the limit.

[0076] Step 4: Capacity Expansion Prompt. If the number of overloads reaches 3 times in each of the three consecutive second time scale periods (i.e., 3 times of load overload in each of the three consecutive 30-minute periods), the hot and cold tiered computing scheduling module will issue a capacity expansion prompt. This prompt is an early warning message indicating insufficient high-precision computing resources on the edge server, displayed through the human-machine interface and simultaneously sent to the operation and maintenance management platform.

[0077] Effect: In this embodiment, the hot / cold tiered computing scheduling module successfully achieved dynamic optimization of computing resource allocation. The hot tier load stabilized at 72%, and the warm tier load at 65%. The overall utilization rate was significantly improved compared to the comparative scheme where it consistently exceeded 95%. There was no data backlog, and the real-time response latency was controlled within 200 milliseconds. Under extreme conditions, the load adaptive unit automatically adjusted the first threshold from 0.7 to 0.75, reducing two high-attention units to medium-attention units, causing the hot tier load to drop from 92% to 82%, ensuring that the system would not crash due to computing power overload. The capacity expansion prompt mechanism provided maintenance personnel with a forward-looking resource planning basis.

[0078] Example 5 Purpose of implementation: The purpose of this embodiment is to provide a specific implementation of the feedback and closed-loop control module and the model self-calibration unit, and to present the overall process of a complete system operation cycle. Its core lies in feeding back the counterfactual inference results to the attention heatmap generation process, forming a positive feedback closed loop of "risk discovery through inference → attention focusing on the risk area → more refined inference of the risk area in the next round," while maintaining the accuracy of the twin through the model self-calibration unit, thus achieving continuous self-optimization of the system.

[0079] Implementation System: The system used in this embodiment includes a security attention heatmap generation module, a security redundancy boundary identification module, a feedback and closed-loop control module, and a virtual-real mapping module. The feedback and closed-loop control module calculates the virtual pre-simulation influence of each grid cell based on the current counterfactual scenario and updates it to the historical sliding window, outputs the minimum security redundancy configuration scheme, and issues change commands according to a preset execution mode. The virtual-real mapping module also includes a model self-correction unit, which triggers an online update of the digital twin model parameters when the number of removal suggestions and the number of simplified design suggestions output by the security redundancy boundary identification module are zero for three consecutive second timescale periods. As an optional implementation, the online update can be implemented using a Bayesian update method.

[0080] Implementation steps: Step 1: Virtual Pre-Simulation Impact Update. This round of counterfactual simulation generated 20 scenarios. The feedback and closed-loop control module analyzed the accident propagation path for each scenario.

[0081] The following is an example of a high-fidelity counterfactual scenario involving a gas turbine disturbance of 4.2 degrees Celsius. The construction process of the directed graph of accident propagation is as follows: The fault source node is the abnormal rise in the gas turbine exhaust temperature, with an in-degree of zero; it affects the inlet flue gas temperature of the waste heat boiler through the heat conduction path, and this node is intermediate node one; it further affects the temperature of the heat source driven by the lithium bromide heat pump, and this node is intermediate node two; ultimately, it leads to insufficient cooling output, and this node is the terminal node with an out-degree of zero. A breadth-first search algorithm is used to traverse this directed graph, extracting the set of critical path nodes as {gas turbine, waste heat boiler, lithium bromide heat pump}, and the set of causal chains as {gas turbine → waste heat boiler → lithium bromide heat pump → cooling output}.

[0082] The frequency of each grid cell becoming a critical path node in all 20 scenarios was statistically analyzed: the gas turbine cell appeared in the critical path of 18 scenarios, with a frequency of 18 divided by 20, which equals 0.90; the waste heat boiler cell appeared in the critical path of 15 scenarios, with a frequency of 15 divided by 20, which equals 0.75; the lithium bromide heat pump cell appeared in the critical path of 12 scenarios, with a frequency of 12 divided by 20, which equals 0.60; the energy storage battery cell appeared in the critical path of 3 scenarios, with a frequency of 3 divided by 20, which equals 0.15; the frequency of the remaining cells was all below 0.10.

[0083] The severity of accidents in each scenario has been calculated in Example 3. The feedback and closed-loop control module calculates the virtual pre-simulation influence of each grid cell using the following formula: Virtual pre-simulation influence equals 0.5 multiplied by the frequency of the grid cell appearing in the critical path, plus 0.5 multiplied by the accident severity weighted frequency of the grid cell appearing in the causal chain. The accident severity weighted frequency is the sum of the accident severity of the grid cell appearing in the causal chain across all scenarios divided by the sum of the accident severity of all scenarios.

[0084] Substituting the numerical values, we obtain the following virtual pre-simulation influences: The gas turbine unit's influence is 0.5 multiplied by 0.90 plus 0.5 multiplied by (18 multiplied by 0.167) divided by 3.34, which equals 0.45 plus 0.45, equaling 0.90. The waste heat boiler unit's influence is 0.5 multiplied by 0.75 plus 0.5 multiplied by (15 multiplied by 0.167) divided by 3.34, which equals 0.375 plus 0.375, equaling 0.75. The lithium bromide heat pump unit's influence is 0.5 multiplied by 0.60 plus 0.5 multiplied by (12 multiplied by 0.167) divided by 3.34, which equals 0.30 plus 0.30, equaling 0.60.

[0085] The updated virtual preview influence of each unit is stored in a historical sliding window with a window length of 20 cycles, which is used for the attention weight calculation in the next cycle.

[0086] Step Two: Output of the Minimum Safety Redundancy Configuration Scheme. The feedback and closed-loop control module summarizes the analysis results from the safety redundancy boundary identification module and outputs the minimum safety redundancy configuration scheme for this period. The scheme includes: it is recommended to remove the cooling water standby pump, with a residual risk increment of 0 yuan and annual maintenance cost savings of approximately 20,000 yuan; it is recommended to retain the high exhaust temperature protection logic for the gas turbine, and not to remove it, with a residual risk increment of 50,810 yuan, far exceeding the threshold; it is recommended to adjust the alarm threshold of the high exhaust temperature protection logic for the gas turbine from 570 degrees Celsius to 575 degrees Celsius to reduce invalid alarms. The risk assessment conclusion is: after implementing the above configuration changes, the overall residual risk increment of the integrated energy station is 0 yuan, and the safety level remains unchanged only after removing the cooling water standby pump.

[0087] Step 3: Configuration Change Execution. According to the preset semi-automatic mode, recommendations with residual risk increments less than 0.005 million yuan are executed automatically. In this embodiment, the residual risk increment from removing the cooling water standby pump is 0 million yuan, less than 0.005 million yuan. The feedback and closed-loop control module automatically sends the change command to the field programmable logic controller, disconnecting the cooling water standby pump from the operating logic and recording an audit log. The log includes the operation time, operation content, operator, and approval status. For alarm threshold adjustment recommendations, the residual risk increment is not quantified and is not within the scope of automatic execution. A pop-up window on the human-machine interface prompts the maintenance personnel, who then manually confirm and execute the change.

[0088] Step 4: Rollback Mechanism Verification. Assume that in the counterfactual scenario of the next cycle, a sudden failure of the main cooling water pump, a failure not seen in any previous scenarios, leads to a cooling water interruption after the backup pump is removed, subsequently causing a lithium bromide heat pump shutdown. The residual risk increment rises to 0.5 million yuan, exceeding the fourth threshold of 0.01 million yuan. The feedback and closed-loop control module immediately issues a rollback suggestion, indicating that a new accident path has been detected after the backup cooling water pump was removed, and recommends restoring the backup cooling water pump to its original configuration. Simultaneously, a rollback command is automatically sent to the programmable logic controller to restore the backup pump's online status and record the rollback audit log.

[0089] Step 5: Model self-calibration triggered. If the number of removal suggestions and the number of simplified design suggestions output by the safety redundancy boundary identification module are zero for three consecutive second time scale cycles, the model self-calibration unit of the virtual-real mapping module triggers an online update of the digital twin model parameters.

[0090] As an optional implementation, the model self-calibration unit in this embodiment employs a Bayesian update method. Specifically, the method involves using the current model parameters as the prior distribution and the actual operational data of the physical stations collected within the last three periods as observations. The posterior distribution is then calculated, and the expected value of the posterior distribution is used as the updated model parameters. After the update, the prediction accuracy of the digital twin model improves, and the virtual-to-real mapping error decreases from 3.2% before the update to 1.8% after the update.

[0091] Step Six: Complete System Operation Cycle. Based on the above modules, the system repeats the following closed-loop steps in a fixed 30-minute cycle. Step One: The virtual-real mapping module continuously updates data in 100-millisecond increments; this step continues throughout the entire cycle. Step Two: At minute 0, the security attention heatmap generation module calculates the attention heatmap. Step Three: From minute 0 to minute 2, the cold / hot stratified calculation scheduling module allocates resources. Step Four: From minute 2 to minute 4, the attention-oriented counterfactual generation module generates counterfactual scenarios in parallel. Step Five: From minute 4 to minute 6, the security redundancy boundary identification module calculates redundancy and residual risks. Step Six: From minute 6 to minute 8, the feedback and closed-loop control module updates influence, outputs configurations, and executes changes. Step Seven: From minute 8 to minute 30, the system waits for the next cycle to be triggered; during this period, the virtual-real mapping module continues to run, and all modules remain in standby mode. Throughout the cycle, the visualization module displays the attention weight of each grid cell in real time and shows the minimum security redundancy configuration scheme and residual risk report output for the current cycle.

[0092] Implementation results: In this embodiment, the feedback and closed-loop control module successfully feeds back the counterfactual inference results to the attention heatmap generation process. The gas turbine unit, being a critical path node in most counterfactual scenarios, receives a high virtual pre-simulation influence of 0.90. This value will be used for the attention weight calculation in the next cycle, making the system more focused on this area in the next round, forming a positive feedback loop of "risk discovery through inference → attention focusing on the risk area → more refined inference of the risk area in the next round." As an optional implementation, the model self-calibration unit automatically triggers a Bayesian update when there are no output suggestions for three consecutive cycles, reducing the virtual-real mapping error from 3.2% to 1.8%. The rollback mechanism automatically restores the backup pump configuration in the event of a sudden failure of the main cooling water pump, preventing the accident from escalating. The entire system operates stably in a closed loop with a 30-minute cycle, achieving continuous self-optimization of the integrated energy station's safety management.

[0093] Comparative Example 1 The comparative scheme employs a traditional integrated energy station safety monitoring system based on fixed threshold alarms. This system is also deployed in a park-level integrated energy station, with the same station configuration as in Example 1. The system collects operational data from each device every 1 second via a SCADA system, including parameters such as temperature, pressure, flow rate, and current. The system sets fixed alarm thresholds for all measuring points; for example, an alarm is triggered when the gas turbine exhaust temperature reaches 570 degrees Celsius, and the turbine trips when it reaches 580 degrees Celsius; the natural gas pressure regulating valve shuts off when the pressure reaches 2.8 MPa. The system uses the same sampling frequency and model accuracy for real-time mapping of all devices, lacking differentiated calculation capabilities. Safety redundancy analysis relies on a manually compiled fault tree analysis manual, with a manual assessment conducted by a safety engineer every six months.

[0094] Comparison of the effects of the comparative examples and the embodiments of the present invention: Regarding computational resource consumption, the comparative scheme uses the same 100-millisecond sampling frequency and the same full-order model precision for real-time mapping of all 15 grid cells. The edge server's graphics processor utilization consistently remains above 95%, frequently resulting in data backlog and latency. Especially during sudden changes in station operating conditions, such as gas turbine load adjustments, system response latency can reach 3 to 5 seconds, failing to meet real-time safety monitoring requirements. In this embodiment, a hot-cold hierarchical scheduling guided by attention heatmaps is used. High-precision mapping of 100 milliseconds is applied only to high-attention regions, a reduced-order model with 500 to 800 millisecond steps is used to map medium-attention regions, and static mapping with 1-second steps is used to map low-attention regions. The overall edge server utilization stabilizes at around 68%, with no data backlog and real-time response latency controlled within 200 milliseconds.

[0095] Regarding the depth of safety redundancy analysis, the comparative scheme relies on manually compiled fault trees, covering only 17 pre-identified fault modes. For fault combinations not pre-identified, such as the combined fault of increased gas turbine exhaust temperature and increased cooling water temperature, there is no corresponding analysis path in the fault tree, making it impossible to assess the effectiveness of the relevant redundancy. Although the cooling water standby pump is marked as an important standby device in the fault tree, due to a lack of dynamic verification, it has never been used during the 5 years of operation at the station, resulting in continuous waste of maintenance costs, approximately 20,000 yuan per year. In this embodiment of the invention, 20 disturbance combination scenarios are automatically generated through counterfactual reasoning, covering various operating conditions such as single-parameter disturbances, multi-parameter combination disturbances, and disturbances in the direction of change of rate. Through necessity scoring and residual risk quantification, the cooling water standby pump is accurately identified as an invalid redundancy, with a necessity score of 0 and a residual risk increment of 0 yuan. At the same time, it is found that although the gas turbine exhaust temperature high protection logic has a low necessity score of 0, its residual risk is extremely high at 50,810 yuan, belonging to the low-frequency, high-consequence type of protection, and must be retained. This dynamic, quantitative depth of analysis is something that proportional methods cannot achieve.

[0096] Regarding adaptive capabilities, the alarm thresholds of 570°C and 580°C in the proportional scheme are fixed values ​​and cannot be automatically adjusted according to factors such as equipment aging, seasonal changes, and load fluctuations. After three years of operation, the average exhaust temperature under normal operating conditions of the gas turbine increased from 510°C to 515°C, causing the false alarm frequency to increase from twice per month to 15 times per month, seriously affecting the operation and maintenance personnel's judgment of actual faults. In this embodiment of the invention, through dynamic calculation of the attention heatmap and continuous updating of counterfactual inference, the system can adaptively identify changes in operating conditions. When the average normal operating condition of the gas turbine drifts, the sensitivity of the historical accident precursors of the gas turbine unit in the attention heatmap will be adjusted accordingly, and the optimization suggestions for the alarm threshold will be automatically output in the redundancy identification stage, realizing dynamic adaptation of the safety threshold.

[0097] Regarding the balance between computational efficiency and security, the proportional scheme, in order to ensure security, has to use the highest precision model for all devices, resulting in a serious waste of computing resources. Low-risk areas consume a large amount of computing power, while high-risk areas cannot obtain sufficient real-time guarantees due to insufficient computing power. This is a security risk caused by egalitarianism. The embodiments of this invention, through a closed-loop mechanism of attention guidance, differentiated inference, and resource hierarchical scheduling, concentrate limited computing resources on truly high-risk, high-attention areas, significantly improving computational efficiency while ensuring overall security. The load adaptive adjustment mechanism shown in Embodiment 4 further ensures that the system will not crash due to computing power overload under extreme conditions.

[0098] Regarding annual operation and maintenance costs, the comparative solution, unable to identify invalid redundancy, continuously incurred annual maintenance costs of approximately 20,000 yuan for the cooling water standby pump, which was never used during its five-year operation. This embodiment of the invention automatically identifies the cooling water standby pump as invalid redundancy through a safety redundancy boundary identification module, with a residual risk increment of 0 yuan. It then outputs a removal recommendation and executes it automatically, saving approximately 20,000 yuan in maintenance costs annually.

[0099] Regarding alarm threshold optimization, the fixed alarm threshold in the proportional scheme leads to an increased false alarm rate due to equipment aging, requiring maintenance personnel to spend a significant amount of time processing invalid alarms. This invention, in its over-safety design identification phase, automatically outputs alarm threshold optimization suggestions, adjusting the alarm threshold for the high exhaust temperature protection logic of the gas turbine from 570 degrees Celsius to 575 degrees Celsius, reducing invalid alarms and improving maintenance efficiency.

[0100] In summary, the comparative scheme lags significantly behind this invention in terms of computational resource utilization, depth of security redundancy analysis, adaptability, efficiency-security balance, and operational cost control. This invention, through security attention-driven counterfactual twin inference and adaptive redundancy configuration, achieves a comprehensive improvement over the comparative scheme, particularly addressing two fundamental shortcomings of traditional schemes: insufficient computing power in high-risk areas due to egalitarianism and the inability of static redundancy analysis to identify invalid redundancies.

[0101] The digital twin-based integrated energy station safety operation virtual-real mapping management system provided by this invention can be widely applied to scenarios such as integrated energy stations that couple multiple energy sources including electricity, heat, cooling, gas, and hydrogen, industrial park energy stations, data center energy stations, and building energy stations. The system can be deployed on edge servers or cloud-edge collaborative platforms, seamlessly integrates with existing SCADA and control systems, and has broad industrial applicability and good market prospects.

[0102] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of protection of the claims.

[0103] In conclusion, the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A virtual-real mapping management system for the safe operation of an integrated energy station based on digital twins, comprising coupling devices for at least two energy forms, characterized in that, The system includes: The virtual-real mapping module constructs a digital twin and collects real-time operational data; The security attention heatmap generation module divides the space into grids and periodically calculates the attention weight of each grid. The attention-oriented counterfactual generation module divides regions based on a comparison of attention weights with preset high and low thresholds, and generates counterfactual scenarios in a differentiated manner. The safety redundancy boundary identification module counts the effective trigger counts of redundant elements in counterfactual scenarios and outputs removal and simplification suggestions. The hot and cold tiered computing scheduling module allocates computing resources based on attention weights and adjusts high thresholds when the load exceeds limits. The feedback and closed-loop control module updates the virtual pre-simulation influence, outputs the minimum safety redundancy configuration, and feeds the influence back to the attention heatmap module. The system also has a preset capacity threshold, a third threshold, a fourth threshold, and a sixth threshold. The third threshold is used to determine the necessity of redundant elements, the fourth threshold is used to determine whether the residual risk increment after removing redundant elements is acceptable, the preset capacity threshold is used to determine whether computing resources are exceeded, and the sixth threshold is used to determine whether low-fidelity counterfactual scenarios are forcibly generated in low-attention regions.

2. The integrated energy station safety operation virtual-real mapping management system based on digital twin as described in claim 1, characterized in that, The attention weight is obtained by weighted summation of the operating condition mutation rate, the sensitivity of historical accident precursors, and the influence of the virtual rehearsal in the previous cycle; the different attention regions are divided as follows: grid cells with attention weights higher than the high attention threshold are high attention regions, grid cells with attention weights higher than the low attention threshold but not higher than the high attention threshold are medium attention regions, and grid cells with attention weights not higher than the low attention threshold are low attention regions. The counterfact generation module generates high-fidelity counterfactual scenarios, low-fidelity counterfactual scenarios, or no counterfactual scenarios for high, medium, and low attention regions, respectively. In the low attention region, a low-fidelity counterfactual scenario is forcibly generated when the operating condition mutation rate exceeds the sixth threshold.

3. The integrated energy station safety operation virtual-real mapping management system based on digital twin as described in claim 1, characterized in that, The output of the virtual-real mapping module is connected to the input of the security attention heatmap generation module. The output of the security attention heatmap generation module is connected to the input of the attention-oriented counterfactual generation module and the cold-hot stratified calculation scheduling module. The output of the attention-oriented counterfactual generation module is connected to the input of the security redundancy boundary identification module. The output of the security redundancy boundary identification module is connected to the input of the feedback and closed-loop control module. The output of the feedback and closed-loop control module is connected to the feedback input of the security attention heatmap generation module, forming a closed-loop control loop.

4. The integrated energy station safety operation virtual-real mapping management system based on digital twin as described in claim 1, characterized in that, The virtual-real mapping module collects data at a first time scale of 100 milliseconds or less; the safety attention heatmap generation module periodically calculates attention weights at a second time scale of 5 to 30 minutes; the attention weight is equal to the sum of the first weight coefficient multiplied by the exponentially weighted moving average of the operating condition mutation rate, the second weight coefficient multiplied by the exponentially weighted moving average of the sensitivity of historical accident precursors, and the third weight coefficient multiplied by the exponentially weighted moving average of the influence of the virtual rehearsal in the previous period, the sum of the first weight coefficient, the second weight coefficient and the third weight coefficient is 1, the decay factor of the exponentially weighted moving average is 0.8 to 0.95, and the historical window length is 20 periods.

5. The integrated energy station safety operation virtual-real mapping management system based on digital twin as described in claim 2, characterized in that, The high-fidelity counterfactual scenario is generated as follows: For each grid cell in the high-attention region, at least three perturbation combinations are generated based on the historical fluctuation amplitude of the cell's key parameters. The perturbation combinations include applying a positive maximum amplitude perturbation, applying a negative maximum amplitude perturbation, and applying a half-amplitude perturbation in the same direction as the rate of change of the key parameters. A full-order nonlinear differential equation model is used to extrapolate forward 30 to 120 seconds with the same time step as the virtual-real mapping module. The historical fluctuation amplitude is the historical fluctuation standard deviation of the cell's key parameters, the maximum amplitude is 1 times the fluctuation standard deviation, and the half amplitude is 0.5 times the fluctuation standard deviation. The key parameters include at least one of temperature, pressure, flow rate, voltage, current, and state of charge.

6. The integrated energy station safety operation virtual-real mapping management system based on digital twin as described in claim 2, characterized in that, The low-fidelity counterfactual scenario is generated as follows: for each grid cell in the attention region, based on the historical fluctuation amplitude of the cell's key parameters, positive maximum amplitude perturbation and negative maximum amplitude perturbation are applied, and a reduced-order model or surrogate model is used to extrapolate forward for 30 to 120 seconds with a time step of 5 to 10 times the virtual-real mapping step size.

7. The integrated energy station safety operation virtual-real mapping management system based on digital twin as described in claim 1, characterized in that, The safety redundancy boundary identification module calculates the necessity score of each safety redundancy element. The necessity score is the number of times the safety redundancy element is effectively triggered in all counterfactual scenarios divided by the total number of scenarios. The safety redundancy elements include redundant sensors, protection logic, and backup paths. The effective triggering is defined as follows: in a counterfactual scenario, the safety redundancy element activates after an accident indicator exceeds a preset alarm threshold, and the peak value of the accident indicator after activation decreases by more than 10% within 5 to 30 seconds relative to the peak value immediately before activation. The accident indicator includes at least one of pressure over-limit time, temperature over-limit magnitude, gas concentration over-limit duration, and current overload time. The third threshold is 0.

05. When the necessity score is lower than the third threshold, the safety redundancy element is marked as a candidate redundancy.

8. The integrated energy station safety operation virtual-real mapping management system based on digital twin as described in claim 1, characterized in that, The safety redundancy boundary identification module also calculates the residual risk increment of each candidate redundancy element. The calculation method for the residual risk increment is as follows: for a safety redundancy element marked as a candidate redundancy, the redundancy element is removed in the original counterfactual scenario and re-deduced. The severity of the accident after removal in each scenario is subtracted from the severity of the accident before removal, multiplied by the probability of occurrence of the scenario, the above products of all scenarios are added together, and then divided by the sum of the probabilities of all scenarios. The fourth threshold is 0.

01. The severity of the accident is expressed as the economic loss value in RMB 10,000 or the normalized accident index time integral. The dimension of the residual risk increment is the same as that of the accident severity. When the residual risk increment is lower than the fourth threshold, a removal suggestion or a simplified design suggestion for the safety redundancy element is output.

9. The integrated energy station safety operation virtual-real mapping management system based on digital twin as described in claim 1, characterized in that, In the hot and cold tiered computing scheduling module, the hot layer is used to execute high-precision computing tasks, the warm layer is used to execute medium-precision computing tasks, and the cold layer is used to execute low-precision computing tasks. The high-precision computing tasks include real-time mapping of full-order models and high-fidelity counterfactual generation in high-attention regions, the medium-precision computing tasks include low-fidelity counterfactual generation in medium-attention regions, and the low-precision computing tasks include static mapping or linear interpolation in low-attention regions. The preset capacity threshold is 85% of the edge server capacity. When the load exceeds the preset capacity threshold, some medium-attention regions are downgraded to the cold layer for processing, and the high-attention threshold is lowered simultaneously. When the number of times the limit is exceeded reaches 3 times in 3 consecutive second time scale periods, an expansion prompt is issued. The expansion prompt is an early warning message that the edge server resources are insufficient.

10. The integrated energy station safety operation virtual-real mapping management system based on digital twin as described in claim 1, characterized in that, The feedback and closed-loop control module is also used to: automatically execute the suggestion if the same removal recommendation is output for the same redundant element in two adjacent second time scale periods and the absolute value of the residual risk increment change is less than 5%; if the counterfactual inference of the next period after execution shows that a new accident path has appeared, causing the residual risk increment to exceed the fourth threshold, then issue a rollback suggestion and restore the redundant element to its original configuration; the virtual-real mapping module also includes a model self-calibration unit, which is used to trigger an online update of the digital twin model parameters when the number of removal recommendations output by the safety redundancy boundary identification module for three consecutive second time scale periods is zero and the number of simplified design recommendations is zero; the third threshold, the fourth threshold and the sixth threshold are manually adjusted by the operator through the human-machine interface; the system also includes a visualization module, which is used to display the attention weight of each grid cell on a two-dimensional or three-dimensional map, and display the minimum safety redundancy configuration scheme and residual risk report output in the current period.

Images