An edge computing method for substation monitoring

Abstract

The application belongs to the technical field of edge computing and relates to an edge computing method for monitoring a transformer substation. The method acquires telemetering, telemetering quantity, alarm records and protection action records at an edge computing node, constructs a virtual topological correlation graph according to primary wiring relationship, interval attribution relationship, protection correlation relationship and monitoring point mapping relationship, maps multiple-source monitoring data to a graph structure and aligns the multiple-source monitoring data according to a unified time window, generates a graph state sequence with data credibility weight, performs topological propagation verification based on power supply connection relationship and protection action constraint relationship, determines an abnormal starting point, an affected topological range and a key state jump sequence, and generates a situation fingerprint containing protection action matching degree, breakpoint identification, conflict evidence segment and original segment index. The application reconstructs point-level data into event-level situation records at the edge side, retains abnormal propagation paths and evidence sources, and reduces the interference of isolated disturbances on fault chains.

Description

Technical Field

[0001] This invention belongs to the field of edge computing technology and relates to an edge computing method for substation monitoring. Background Technology

[0002] Substation monitoring systems typically involve a combination of in-station protection and control devices, remote control units (RCUs), a back-end monitoring host, and a higher-level dispatching platform to collect operational data and process alarms. In existing conventional solutions, protection and control devices collect remote measurements such as current, voltage, power, frequency, and temperature according to a preset sampling period. They also collect remote signaling quantities such as circuit breakers, disconnectors, and grounding switches based on state change triggering methods, generating alarm records when protection actions occur, devices are locked, communication is abnormal, or measurement points exceed limits. The RCUs or station control layer servers typically perform protocol conversion, time stamping, format standardization, quality flag supplementation, and caching of this data before transmitting it to the dispatching side according to periodic, change-based, or alarm-based transmission methods. To alleviate the processing pressure on the central side, some systems configure edge computing nodes at the station end to perform local caching, limit judgment, simple alarm merging, and data forwarding control on the raw monitoring data. This type of edge computing processing often uses a single measurement point or a single alarm as the basic object. The processing logic revolves around the measurement point number, sampled value, alarm type, device name, and timestamp, and performs sorting, filtering, deduplication, and summary generation on the data itself. Even if the edge nodes save the station's equipment ledger and point table configuration, the ledger and point table are mainly used for data naming, channel matching, and display grouping, without changing the processing method of data flowing independently according to the channel.

[0003] In similar existing edge computing solutions, edge nodes further configure rule bases or lightweight analysis programs to place telemetry limit exceedance records, telemetry signal change records, protection action records, and equipment alarm records into the same event buffer, and merge alarms based on temporal adjacency. This solution typically counts the number of similar alarms according to a fixed time window, establishes coarse-grained groupings based on the interval of the measurement point or the device name, and prioritizes uploading limit exceedance values, action messages, or alarm summaries when communication bandwidth is insufficient. For short-term fluctuations, edge nodes can suppress them based on the number of consecutive samples or recovery time; for duplicate alarms, edge nodes can merge them based on the same alarm code and the same device identifier. This type of technology can complete some preprocessing at the station end, but its core basis is still time sequence, measurement point grouping, and preset rules. Electrical primary wiring relationships, linkage constraints between protected objects, and subordinate relationships between monitoring points and topological entities are usually only stored as configuration data and are not transformed into a graph structure state that can participate in anomaly propagation verification during the edge computing process. When there are differences in the refresh cycle and timestamp accuracy of data from different sources, existing solutions often process them by simply filling in the blanks, arranging them by arrival time, or truncating them by a fixed time window. This makes it difficult to express the order of state changes, topological adjacency relationships, and protection action constraints simultaneously within the same calculation process. The summary formed on the edge side usually only retains the number of events, the highest level, and a small number of representative messages.

[0004] The main technical problem with existing technologies is that substation monitoring data lacks a semantic reconstruction mechanism based on electrical topology constraints before being uploaded to the edge. This results in the inability to organize causal evidence among telemetry changes, tele-signal changes, protection actions, and alarm records for the same abnormal event into a traceable situation description within the edge computing node. The technical reason for this problem is that conventional edge processing still uses measurement point-level data streams as the basic object, failing to incorporate primary wiring relationships, bay affiliation relationships, protection action constraint relationships, and monitoring point mapping relationships into the same computing structure. Static configuration cannot constrain the determination of abnormal propagation paths. At the same time, there are time granularity differences between telemetry periodic sampling, tele-signal sudden changes, protection action records, and alarm messages. It is difficult to confirm the abnormal origin, propagation range, and key state transition sequence simply by relying on fixed time windows or identical device identifiers. When the communication link load increases or the central processing delay increases, the edge side can only send a large number of raw fragments or isolated summaries. The topology path, evidence source and credibility of the abnormal event have been weakened before transmission. The subsequent system needs to reassemble the scattered records. Fault judgment and operation tracing are constrained by the lack of data association. Even if the central side obtains more records, it is difficult to restore the original association state when the station-end anomaly was formed. Summary of the Invention

[0005] The purpose of this invention is to provide an edge computing method for substation monitoring, which can solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] An edge computing method for substation monitoring includes: acquiring substation monitoring data at an edge computing node, the substation monitoring data including telemetry data, telesignal data, alarm records, and protection action records; constructing a virtual topology association graph based on primary wiring relationships, bay affiliation relationships, protection association relationships, and monitoring point mapping relationships; mapping the substation monitoring data to the virtual topology association graph and aligning it according to a unified time window to generate a graph state sequence with data credibility weights; performing topology propagation verification based on the graph state sequence to determine the anomaly starting point, the affected topology range, and the critical state transition sequence; generating a situation fingerprint based on the anomaly starting point, the affected topology range, the critical state transition sequence, the protection action matching degree, and the data credibility weights; and performing edge-side storage, summary upload, or original fragment association upload according to the event urgency level of the situation fingerprint.

[0008] Preferably, the step of time alignment according to a unified time window to generate a graph state sequence with data credibility weights includes: using the telemetry jump time, alarm trigger time, and protection action occurrence time as candidate event anchor points, establishing a forward observation window and a backward confirmation window around the candidate event anchor points; maintaining the state of telemetry measurements with different sampling periods according to the refresh period of their respective monitoring points, and marking records with timestamp offsets exceeding the adjacent event sequence constraints with delays; determining the data credibility weights based on the consistency of data source type, refresh period, timestamp offset, continuous missing measurement length, and historical stable intervals, and writing the aligned state values, event markers, and data credibility weights into the corresponding topology nodes or topology edges.

[0009] Preferably, the construction of the virtual topology graph includes: using the logical entities corresponding to buses, main transformers, switches, bays, and protected objects as topology nodes, and using power supply connection relationships, bay affiliation relationships, protection action constraint relationships, and monitoring point affiliation relationships as topology edges; binding each monitoring point to a unique master-slave topology node, and establishing auxiliary mappings for monitoring points with protection linkage relationships or bay-related relationships; setting a unified state container for telemetry, telesignal, alarm records, and protection action records under the same topology node, so that substation monitoring data from different sources participate in subsequent verification in the form of a graph structure state within the edge computing node.

[0010] Preferably, the topology propagation verification based on the graph state sequence includes: selecting candidate abnormal nodes from the topology nodes that have experienced state transitions or alarm triggers; expanding candidate propagation paths according to the power supply connection relationships and protection action constraints in the virtual topology association graph; comparing the state transition sequence, telemetry change direction, tele-signaling state transition, and protection action records of adjacent topology nodes within the candidate propagation paths; marking state changes that do not satisfy the topology adjacency relationship and lack protection association records as isolated disturbances; and merging state changes that satisfy the topology adjacency relationship and have continuous state evidence into common-source abnormal segments.

[0011] Preferably, the establishment of the candidate event anchor point includes: deduplicating and merging multiple telemetry change times, alarm trigger times, and protection action occurrence times that occur within the same time period, using the protection action occurrence time as the primary anchor point and the telemetry change times that have the same interval affiliation or protection association with the protection action occurrence time as secondary anchor points; for time periods without protection action records, using the topology node with the highest state change density as a temporary anchor point, and incorporating the telemetry change sequence associated with the temporary anchor point into the forward observation window and the backward confirmation window.

[0012] Preferably, the determination of the data credibility weight includes: forming a time credibility component, a source credibility component, and a state credibility component respectively; the time credibility component is determined based on the relative order of the timestamp offset and the candidate event anchor point; the source credibility component is determined based on the record completeness of telemetry, teleindication, alarm records, and protection action records; the state credibility component is determined based on the fluctuation range and continuous missing measurement length of the same topology node within the historical stable interval; the time credibility component, the source credibility component, and the state credibility component are bound to the same state entry in the graph state sequence, and the source identifier of each component is retained.

[0013] Preferably, the unified state container includes a node state field, an edge state field, and an event evidence field; the node state field records the telemetry changes, current telemetry status, and telemetry jump direction corresponding to the topology node; the edge state field records the power supply connection status, interval affiliation, and protection action constraint relationship between adjacent topology nodes; the event evidence field records alarm records, protection action records, time alignment markers, and the data trust weight; the edge computing node merges and writes multi-source records within the same time window according to the field relationship of the unified state container.

[0014] Preferably, the merging of the same-source anomaly segments includes: reading the state entries of adjacent topology nodes along the candidate propagation path starting from the candidate anomaly node; grouping state entries whose state transition order satisfies the power supply connection direction constraint, whose remote signaling state transition satisfies the switch opening and closing logic, and whose protection action records satisfy the protection object mapping relationship into the same anomaly segment; for intermediate topology nodes with missing test records, generating breakpoint identifiers based on the data credibility weight and the event evidence fields of adjacent nodes, and writing the breakpoint identifiers into the evidence chain position of the same-source anomaly segment.

[0015] Preferably, after binding the time reliable component, the source reliable component, and the state reliable component to the same state entry in the graph state sequence, the method further includes: establishing a reliable weight trajectory within a continuous time window of the same topology node, and identifying three types of reliable anomalies—short-term missing measurement, continuous offset, and source conflict—based on the reliable weight trajectory; for short-term missing measurement, using the state reliable component of the same topology node in adjacent time windows; for continuous offset, setting the corresponding state entry to a state pending verification; for source conflict, retaining telemetry data, teleindication data, alarm records, and protection action records as parallel evidence items.

[0016] Preferably, the generation of the situation fingerprint includes: reading the anomaly origin, affected topology range, key state transition sequence, breakpoint identifier, protection action matching degree, and data credibility weight of each state entry from the homogeneous anomaly fragments, and generating a fingerprint main chain according to the event time sequence; writing isolated disturbances that do not satisfy the topological adjacency relationship into the fingerprint side chain, and writing parallel evidence items into the conflict evidence segment; forming a situation fingerprint record with topological path identifier and evidence source identifier based on the fingerprint main chain, the fingerprint side chain, and the conflict evidence segment, and establishing an index relationship between the situation fingerprint record and the corresponding original fragment.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0018] 1. The edge computing node of this invention no longer treats isolated measurement points as the sole processing object. Instead, it constructs a virtual topology association graph based on primary wiring relationships, interval attribution relationships, protection association relationships, and monitoring point mapping relationships, and writes telemetry measurements, teleindication measurements, alarm records, and protection action records into the same graph structure state. Data from different refresh cycles is aligned using a unified time window, candidate event anchor points, forward observation windows, and backward confirmation windows, ensuring that the timing of protection action occurrences, teleindication transitions, alarm triggering times, and telemetry change sequences fall into the same event context. Data credibility weights are written to topology nodes or topology edges along with state values ​​and event markers, enabling subsequent verification to distinguish evidence differences caused by time offsets, continuous missing measurements, and source conflicts. When performing topology propagation verification based on the graph state sequence, the edge side expands candidate propagation paths according to power supply connection relationships and protection action constraint relationships, and compares the state transition order, telemetry change direction, teleindication state transition, and protection action records of adjacent topology nodes. Changes that do not conform to topology adjacency relationships and lack protection association records are marked as isolated disturbances, while changes with continuous state evidence are merged into common-source anomaly fragments. The anomaly origin, affected topology range, key state transition sequence, protection action matching degree, and data credibility weight are jointly written into the situation fingerprint. The measurement point-level data stream is reconstructed into event-level data with topological paths and evidence sources. The unified state container simultaneously stores node state fields, edge state fields, and event evidence fields, ensuring that records from different sources within the same time window have the same topological reference basis during the writing phase. After establishing an index relationship between the situation fingerprint and the corresponding original fragment, a traceable data chain is maintained between the event summary and the original evidence. The situation description can be formed at the edge before data upload, solving the technical problem that existing edge processing cannot retain causal evidence of abnormal events at the station end.

[0019] 2. This invention also enables clearer event boundaries for edge-side data uploads and local storage. The situation fingerprint consists of a main fingerprint chain, side chains, and conflict evidence segments. Homogeneous anomaly segments, isolated disturbances, and parallel evidence items are recorded separately. When the central side receives the summary, it can still obtain the anomaly path, breakpoint location, and evidence source, without needing to reassemble the event process from a large number of disordered original records. For events with high credibility and a clear topological range, edge computing nodes can upload summaries according to the event urgency level and save the original segment index. For events with missing data, continuous offsets, or source conflicts, the edge side retains parallel evidence items and pending verification status, and establishes an index relationship between the relevant original segments and the situation fingerprint. For short-term changes that do not meet the topology propagation conditions, the edge side records them as fingerprint side chains instead of directly merging them into the main anomaly chain. The organization of event evidence is determined by candidate event anchor deduplication and merging, data trust component binding, unified state container writing, and breakpoint identifier generation. This allows edge computing nodes to prioritize the transmission of summary data containing the anomaly origin, propagation range, and key transition sequence even when communication bandwidth is limited, while retaining an index locally that allows for backtracking of the original record. Trusted weight trajectories differentiate between short-term missing data, continuous offsets, and source conflicts, preventing missing data records from directly truncating anomaly segments and preventing conflict sources from being covered by a single summary. After breakpoint identifiers are written to the evidence chain position of the same-source anomaly segment, subsequent verification can directly locate the topology node with missing data or discontinuous evidence. Because isolated disturbances, same-source anomaly segments, and conflict evidence segments are stored separately, data in the station-side cache is no longer mixed and piled up according to a single time order, creating a clear separation boundary between summary upload, original segment association upload, and local retention. This process reduces the masking of key events by duplicate alarms and irrelevant fluctuations, lowers the computational burden on the central side to re-aggregate events based on timestamps, and enables subsequent verification to locate the corresponding monitoring segment along the situation fingerprint. Attached Figure Description

[0020] Figure 1 This is a flowchart of the overall edge computing process for substation monitoring according to the present invention;

[0021] Figure 2 This is a flowchart illustrating the generation process of candidate event anchors, time alignment, and data credibility weights in this invention.

[0022] Figure 3 This is a flowchart of the topology propagation verification and situation fingerprinting process of the present invention. Detailed Implementation

[0023] refer to Figure 1In one embodiment, an edge computing method for substation monitoring includes: acquiring substation monitoring data at an edge computing node, the substation monitoring data including telemetry data, telesignal data, alarm records, and protection action records; constructing a virtual topology association graph based on primary wiring relationships, bay attribution relationships, protection association relationships, and monitoring point mapping relationships; mapping the substation monitoring data to the virtual topology association graph, and performing time alignment according to a unified time window to generate a graph state sequence with data reliability weights; performing topology propagation verification based on the graph state sequence to determine the abnormal starting point, the affected topology range, and the critical state transition sequence; and performing topology propagation verification based on the abnormal starting point, the affected topology range, and the critical state transition sequence. The system generates a situation fingerprint by influencing the topology range, the key state transition sequence, the protection action matching degree, and the data credibility weight. It then performs edge-side storage, summary upload, or original fragment association upload according to the event urgency level of the situation fingerprint. The edge computing node accesses the existing monitoring data stream at the substation end, without altering the physical composition of the substation's primary equipment, protection and control devices, and communication channels. All processing is completed at the software data layer. The working principle of this embodiment is to convert data that originally flowed independently according to measurement point numbers into a graph state with electrical topology reference relationships, and then use time alignment and evidence credibility constraints to determine anomaly propagation, enabling the edge side to form a retrievable situation fingerprint before uploading data.

[0024] In this embodiment, telemetry data includes continuous data records obtained from the existing monitoring system within the station; teleindication data includes discrete status records such as switch opening / closing, protection pressure plates, and device operating status; alarm records include records of exceeding limits, communication interruptions, device anomalies, and event triggering; protection action records include action object, action time, action type, and reset status; and edge computing nodes perform field normalization processing on the above records. Normalized fields include at least the monitoring point identifier, source type, generation time, arrival time, status value, quality flag, and record sequence number. The generation time expresses the time when the device within the station generates the record, the arrival time expresses the time when the edge computing node receives the record, and the status value expresses the telemetry value and teleindication data. The status or action status, quality flags are used to express missing measurements, exceeding limits, refresh delays, and source conflicts. Record sequence numbers are used to maintain the original sequential relationship within the same source. After normalization, the records are not immediately judged for single-point exceeding limits, but are placed in the status buffer waiting for mapping. The status buffer retrieves the monitoring point mapping relationship according to the monitoring point identifier and establishes a reference for each record with the topology node or topology edge in the virtual topology association graph. This embodiment uses this processing method of normalization before mapping to ensure that substation monitoring data from different sources have a unified data caliber when entering the edge computing process, avoiding the splitting of telemetry, telesignal, alarm records, and protection action records into unrelated data fragments due to field differences.

[0025] In this embodiment, the virtual topology association diagram is generated by edge computing nodes based on primary wiring relationships, bay affiliation relationships, protection association relationships, and monitoring point mapping relationships. Primary wiring relationships describe the power supply connection direction between buses, main transformers, switches, and outgoing lines. Bay affiliation relationships describe the subordinate relationship between monitoring points and bays. Protection association relationships describe the constraint relationship between protection action objects and protected topology entities. Monitoring point mapping relationships describe the binding relationship between telemetry points, telesignal points, alarm points, and protection record points and topology entities. The topology nodes in the virtual topology association diagram store the state of the device logical entities. The system stores the power supply connections, bay affiliations, protection action constraints, and point dependencies between entities. Before operation, the edge computing node reads the station point table and topology configuration and generates a graph index. The graph index is jointly stored using the topology node index, topology edge index, and monitoring point reverse index. The topology node index is used to retrieve the status according to the device logical entity, the topology edge index is used to retrieve adjacent entities according to the connection relationship, and the monitoring point reverse index is used to locate the primary topology node and auxiliary associated objects according to the monitoring point identifier. This embodiment converts the static configuration into a computable graph structure, so that anomaly judgment can be subject to the joint constraints of electrical connection and protection linkage relationship.

[0026] In this embodiment, time alignment uses a unified time window as the basic processing unit. Edge computing nodes form candidate event anchors based on the telemetry jump time, alarm trigger time, and protection action occurrence time. They then read adjacent telemetry measurements, telemetry data, alarm records, and protection action records around these candidate event anchors. For periodically sampled telemetry measurements, a state-preserving method is used to fill in adjacent time windows. For suddenly generated telemetry data, alarm records, and protection action records, they are entered into the corresponding time windows according to their generation time. Records with significant deviations between their generation and arrival times retain a delay marker. Records with consecutive missing measurements from the same source retain a missing value. Each state record, after length measurement and time alignment, is written into the graph state sequence. The graph state sequence forms a four-level index based on time window, topological node, topological edge, and source type. When generating data credibility weights, edge computing nodes do not directly delete missing records or treat delayed records as invalid records. Instead, they convert the consistency of source type, refresh cycle, timestamp offset, continuous missing length, and historical stable interval into credibility components and save them along with the state value. The advantage of this embodiment is that data with different refresh cycles and different arrival orders can enter the same computing sequence, and each state evidence retains its own credibility source.

[0027] In a preferred computational implementation, the data confidence weight is generated according to the following formula:

[0028]

[0029] Where i represents a single state record in the graph state sequence. This represents the absolute offset of the moment the state record was generated relative to the anchor point of the candidate event. This indicates the refresh cycle baseline corresponding to the source type of the status record. Represents the time-based reliable component. This indicates the number of complete fields that have been obtained in the status record. This indicates the number of fields that should be present for the same source type. Indicates the source's credibility. This represents the value of the consecutive missing measurement length after being normalized by a time window. This represents the normalized value of the state value that deviates from the historical stable range. Represents the state confidence component, This represents the data reliability weight, such as the weight of a certain telemetry record. , , , , ,but , , , The calculation result is 0.683, and the calculation result is used as the evidence weight when the remote signaling record enters the topology propagation verification.

[0030] In this embodiment, topology propagation verification selects topology nodes that have experienced state transitions or alarm triggers from the graph state sequence as candidate abnormal nodes, and forms candidate propagation paths along the power supply connection relationships and protection action constraints in the virtual topology association graph. The edge computing node performs edge-by-edge checks on the candidate propagation paths. The checks include whether adjacent topology nodes have power supply connections or belong to the same interval, whether the state transition sequence of adjacent topology nodes conforms to the event time sequence, whether the telemetry change direction is in the same direction or complementary to the state change of adjacent nodes, whether the telemetry state transition is consistent with the switch opening and closing logic, and whether the protection action record points to the protected object within the candidate propagation path. When a state change lacks topology adjacency and protection association records, the edge computing node marks the corresponding state change as an isolated disturbance. When multiple state changes satisfy topology adjacency and have continuous state evidence, the edge computing node merges the corresponding state changes into a common-source abnormal fragment. The common-source abnormal fragment saves the abnormal starting point, the affected topology range, the key state transition sequence, the protection action matching degree, and the record index participating in the merging. The working process of this embodiment enables the edge side to complete the basic reconstruction of abnormal events without relying on secondary splicing on the central side.

[0031] In a preferred implementation of propagation path evaluation, the conformity of candidate propagation paths is generated according to the following formula:

[0032]

[0033] Where P represents the candidate propagation path, This represents the number of adjacent relationships involved in the verification of the candidate propagation path, where j represents the index of the adjacent relationship. This indicates whether the j-th adjacent relationship satisfies the topological adjacency constraint; a value of 1 indicates satisfaction, and a value of 0 indicates non-satisfaction. This indicates whether the j-th adjacent relation satisfies the state transition order constraint; a value of 1 indicates satisfaction, and a value of 0 indicates non-satisfaction. This indicates whether the j-th adjacent relationship satisfies the protection action constraint; a value of 1 indicates satisfaction, and a value of 0 indicates non-satisfaction. This indicates the propagation conformity of candidate propagation paths. For example, if a candidate propagation path contains 3 adjacent relationships, The values ​​of are (1, 1, 1) in sequence. The values ​​of are (1, 0, 1) in sequence. The values ​​of are (1, 1, 0), then This value, together with the data credibility weight, is used to determine whether to write the candidate propagation path into the same-origin anomaly fragment.

[0034] In this embodiment, the situation fingerprint is composed of the anomaly origin, affected topology range, key state transition sequence, protection action matching degree, data credibility weight, isolated disturbance identifier, breakpoint identifier, conflict evidence segment, and original fragment index. The edge computing node generates the fingerprint main chain in the time order of the same source anomaly segments, generates the fingerprint side chain with isolated disturbances that do not meet the topology propagation verification, and generates the conflict evidence segment with source conflict or parallel evidence. Each fingerprint element is bound to the original record sequence number and graph state sequence index. The event urgency level of the situation fingerprint is calculated based on the affected topology range, protection action matching, evidence conflict status, and data credibility weight. Situation fingerprints at the local retention level only retain the summary and original record index. Situation fingerprints at the summary upload level upload the fingerprint main chain and key evidence fields. Situation fingerprints at the original fragment association upload level upload the conflict evidence segment, breakpoint identifier, and corresponding original fragment simultaneously. The advantage of this embodiment is that the edge computing node can organize the original data, event summary, and back-lookup index into the same situation record, reducing the interference of isolated alarms on the anomaly chain.

[0035] refer to Figure 2In a preferred embodiment, the step of time alignment according to a unified time window to generate a graph state sequence with data reliability weights includes using the telemetry jump time, alarm trigger time, and protection action occurrence time as candidate event anchor points, establishing a forward observation window and a backward confirmation window around the candidate event anchor points; maintaining the state of telemetry measurements with different sampling periods according to the refresh period of their respective monitoring points, and marking records with timestamp offsets exceeding the adjacent event sequence constraints with delays; determining the data reliability weights based on the consistency of data source type, refresh period, timestamp offset, continuous missing measurement length, and historical stable intervals, and then aligning the data... The state value, event marker, and data trust weight are written to the corresponding topology node or topology edge. The forward observation window is used to read the telemetry trend and telemetry preparation status that have been formed before the candidate event anchor point, and the backward confirmation window is used to read the protection reset, telemetry stability, and alarm recovery status after the candidate event anchor point. The state holding does not arbitrarily interpolate the telemetry values, but uses the last telemetry value with source identifier of the same monitoring point in the previous refresh cycle and saves the state holding mark in the state entry. In this embodiment, by binding the event anchor point, state holding, and trust weight, the time window boundary will not cut off the evidence before and after the substation abnormal event.

[0036] Furthermore, candidate event anchor points are merged in the edge computing nodes according to event source and topology location. When multiple telemetry jump times, alarm trigger times, and protection action occurrence times occur within the same time period, the edge computing nodes do not directly generate multiple independent time windows. Instead, they first search the topology nodes and topology edges bound to these events. Events with the same interval affiliation, adjacent power supply connection, or protection action constraint are merged. The protection action occurrence time is set as the main anchor point, and telemetry jump times with the same interval affiliation or protection association with the main anchor point are set as secondary anchor points. The alarm trigger time is written as an evidence anchor point into the event evidence field. For time periods without protection action records, the edge computing nodes calculate the state jump density of each topology node and use the topology node with the highest state jump density as a temporary anchor point. The telemetry change sequence associated with the temporary anchor point is included in the forward observation window and the backward confirmation window. This embodiment can avoid the same abnormal event being split into multiple discontinuous records due to multiple trigger times.

[0037] In a preferred implementation of anchor point selection, the state transition density is generated according to the following formula:

[0038]

[0039] Where v represents a candidate topology node. This represents the state transition density of candidate topology nodes. This indicates the number of state transitions of the candidate topology node within the current time period. Let u represent the set of adjacent nodes that have a power supply connection or belong to the same interval as the candidate topology node. This represents the relationship weight between adjacent node u and candidate topology node v. It is set to 1 when there is a power supply connection, and 0.5 when there is only a same interval affiliation. This represents the number of adjacent nodes. For example, if a candidate topology node has a self-jump count of 4, and has 2 adjacent nodes with jump counts of 2 and 1 respectively, and relationship weights of 1 and 0.5 respectively, then... When there are no protection action records, the edge computing node is selected. The topology node with the higher value is used as a temporary anchor point.

[0040] In a preferred embodiment, the construction of the virtual topology graph includes using logical entities corresponding to buses, main transformers, switches, bays, and protected objects as topology nodes, and power supply connection relationships, bay affiliation relationships, protection action constraint relationships, and monitoring point affiliation relationships as topology edges; binding each monitoring point to a unique master-slave topology node, and establishing auxiliary mappings for monitoring points with protection linkage relationships or bay-related relationships; setting a unified state container for telemetry, telesignal, alarm records, and protection action records under the same topology node, so that substation monitoring data from different sources participate in subsequent verification in the form of a graph structure state within the edge computing node. The unique master topology node is used to ensure that a single record has a definite master position in the graph state sequence. The auxiliary mapping is used to call the associated status of the protected object, the same interval entity and the adjacent power supply entity during topology propagation verification. When the graph is initialized, the edge computing node checks whether there are multiple master topology nodes for the same monitoring point. If there are multiple master candidate objects, the unique master object is determined according to the device ownership field, interval field and protected object field in the point configuration, and the remaining associated objects are written into the auxiliary mapping. This embodiment ensures that the point data will not be written repeatedly between multiple topology nodes, and can still participate in the association verification in the anomaly propagation judgment.

[0041] In this embodiment, the unified state container is set as a data structure referenced by both topological nodes and topological edges. The field relationships of the unified state container are shown in the table below. The fields in the table are not physical structures, but rather data record formats maintained by edge computing nodes in memory and cache files. The node state field, edge state field, and event evidence field are associated with the same time window identifier and the same topological identifier. When an edge computing node writes any field, it also saves the original record sequence number so that the original fragment can be retrieved after the situation fingerprint is generated. In this embodiment, data from different sources are converged into the same topological state expression through the field relationships shown in Table 1.

[0042] Table 1. Relationship Table of Fields in Uniform State Container

[0043]

[0044] Furthermore, the unified state container includes a node state field, an edge state field, and an event evidence field. The node state field records the telemetry changes, current telemetry status, and telemetry jump direction corresponding to the topology node. The edge state field records the power supply connection status, interval affiliation, and protection action constraint relationship between adjacent topology nodes. The event evidence field records alarm records, protection action records, time alignment markers, and the data trust weight. The edge computing node merges and writes multi-source records within the same time window according to the field relationship of the unified state container. Specifically, during writing, telemetry data enters the node state field and calculates the changes relative to the previous stable time window; telemetry data enters the node state field and marks the jump direction; the power supply connection status is jointly determined by the topology configuration and the switch telemetry status; alarm records enter the event evidence field and retain the alarm code and generation time; protection action records enter the event evidence field and are associated with the protected object; and the time alignment marker stores candidate event anchor points, forward observation windows, backward confirmation windows, state maintenance, and delay markers. In this embodiment, multi-source records under the same topology node no longer participate in the judgment in the form of isolated messages, but instead enter the subsequent propagation verification in the form of fielded evidence.

[0045] refer to Figure 3 In a preferred embodiment, the topology propagation verification based on the graph state sequence includes selecting candidate abnormal nodes from the topology nodes where state transitions or alarms have occurred, and expanding the candidate propagation path according to the power supply connection relationship and protection action constraint relationship in the virtual topology association graph; comparing the state transition sequence, telemetry change direction, tele-signaling state transition, and protection action record of adjacent topology nodes within the candidate propagation path; marking state changes that do not satisfy the topology adjacency relationship and lack protection association records as isolated disturbances, and merging state changes that satisfy the topology adjacency relationship and have continuous state evidence into homogeneous abnormal segments. Specifically, edge computing is used in the processing. The node reads the time window of the candidate abnormal node and its adjacent time windows in the graph state sequence, and loads the node state field, edge state field and event evidence field of the adjacent topological nodes into the same verification context. The expansion of the candidate propagation path does not cross the topological edge that lacks power supply connection relationship, interval affiliation relationship and protection action constraint relationship. For adjacent relationships where the telemetry change direction is inconsistent with the telemetry state transition, conflict evidence items are retained. For adjacent relationships with protection action records but missing measurements of intermediate topological nodes, breakpoint identifiers are retained. In this embodiment, the abnormal propagation path is restricted by the relationship constraints and evidence fields to avoid merging alarms that occur simultaneously without topological association into the same event.

[0046] Furthermore, the merging of the same-source anomaly segments includes reading the state entries of adjacent topology nodes along the candidate propagation path, starting from the candidate anomaly node, and grouping state entries whose state transition order satisfies power supply connection direction constraints, whose remote signaling state transition satisfies switch opening and closing logic, and whose protection action records satisfy the protection object mapping relationship into the same anomaly segment; for intermediate topology nodes with missing test records, a breakpoint identifier is generated based on the data credibility weight and the event evidence field of adjacent nodes, and the breakpoint identifier is written into the evidence chain position of the same-source anomaly segment. Specifically, during merging, the edge computing node uses the event evidence field of the candidate anomaly node as the starting point for the merging process. The anchor point is used as the segment start time. The status entries of adjacent topology nodes are read one by one along the candidate propagation path. If the event marker of the adjacent status entry is located in the backward confirmation window and the corresponding edge status field is in the connectable state, the adjacent status entry is added to the same source abnormal segment. If there is a missing test record in the middle topology node but the protection action object and remote signaling state transition of the two side nodes meet the same propagation direction, a breakpoint identifier containing the missing node identifier, adjacent node identifier, missing test time window and confidence weight is generated. This embodiment ensures that the propagation chain with incomplete evidence will not be directly broken, nor will it be unconditionally identified as a complete propagation chain.

[0047] In a preferred implementation of event urgency level calculation, the shunting value of the situation fingerprint is generated according to the following formula:

[0048]

[0049] Where m represents the sequence number of the situation fingerprint record, This indicates the diversion value recorded in the situation fingerprint. This represents the value of the affected topology range after normalizing the number of nodes. Indicates the degree of matching of protective actions. This indicates the presence or absence of conflicting evidence segments; a value of 1 indicates the presence of conflicting evidence segments, and a value of 0 indicates their absence. This represents the mean of the data confidence weights of each state record within a common anomaly segment. This represents the splitting coefficient in the software configuration and satisfies... ,For example , , , If all four diversion coefficients are taken as 0.25, then Edge computing nodes based on The software distribution range in which it is located selects edge-side storage, summary upload, or original fragment association upload.

[0050] In a preferred embodiment, establishing the candidate event anchor point includes deduplicating and merging multiple telemetry signaling jump times, alarm trigger times, and protection action occurrence times occurring within the same time period. During merging, the protection action occurrence time is used as the primary anchor point, and telemetry signaling jump times with the same interval affiliation or protection association as the protection action occurrence time are used as secondary anchor points. For time periods without protection action records, the topology node with the highest state jump density is used as a temporary anchor point, and the telemetry change sequence associated with the temporary anchor point is included in the forward observation window and the backward confirmation window. Specifically... Edge computing nodes store the source identifiers of primary anchor points, secondary anchor points, evidence anchor points, and temporary anchor points in the candidate anchor point cache. The primary anchor point is used to determine the center of the time window, the secondary anchor point is used to correct the time relationship between remote signaling changes and protection actions, the evidence anchor point is used to store auxiliary descriptions of alarm triggering, and the temporary anchor point is used to process event segments with concentrated state changes but no protection action records. The candidate anchor point cache is deduplicated according to the topology node identifier and the time window identifier to avoid generating duplicate graph state sequences at multiple similar trigger times within the same interval. This embodiment enables anomalies without protection action records to also obtain a computable event center.

[0051] In a preferred embodiment, the determination of the data credibility weight includes forming a time credibility component, a source credibility component, and a state credibility component. The time credibility component is determined based on the relative order of the timestamp offset and the candidate event anchor point. The source credibility component is determined based on the record completeness of telemetry, teleindication, alarm records, and protection action records. The state credibility component is determined based on the fluctuation range and continuous missing measurement length of the same topology node within the historical stable interval. The time credibility component, the source credibility component, and the state credibility component are bound to the same state entry in the graph state sequence, and the source identifier of each component is retained. The historical stable interval is selected from the continuous time window in which the edge computing node has never triggered an alarm, never performed a protection action, and the teleindication status remains unchanged. The fluctuation range is formed by the telemetry change sequence of the same topology node within the historical stable interval. The continuous missing measurement length is formed by the number of time windows in which the same monitoring point has not obtained a record for a consecutive time. The time credibility component does not independently determine whether the state entry participates in the verification. The source credibility component and the state credibility component are included in the data credibility weight calculation along with the time credibility component. This embodiment retains the specific reasons for the decrease in credibility through the component binding method.

[0052] Furthermore, after binding the time-credible component, the source-credible component, and the state-credible component to the same state entry in the graph state sequence, the method further includes establishing a credible weight trajectory within a continuous time window of the same topology node, and identifying three types of credible anomalies—short-term missing measurement, continuous offset, and source conflict—based on the credible weight trajectory. For short-term missing measurement, the state-credible component of the same topology node in adjacent time windows is used. For continuous offset, the corresponding state entry is set to a state pending verification. For source conflict, telemetry data, teleindication data, alarm records, and protection action records are retained as parallel evidence items. Specifically, the credible weight trajectory connects adjacent time windows according to the topology node identifier. The value and source identifier of the reliable component are defined as follows: short-term missing measurement refers to the situation where the continuous missing measurement length is limited and the state before and after is consistent; continuous offset refers to the situation where the time reliable component or state reliable component remains low in multiple consecutive time windows and there is no corresponding operation record; source conflict refers to the situation where there is inconsistency between telemetry changes, tele-signaling status, alarm records or protection action records of the same topology node in the same time window. This embodiment can retain the source of conflict as verifiable evidence without deleting conflict data.

[0053] Table 2. Classification and Handling of Trustworthy Anomalies

[0054]

[0055] In a preferred embodiment, generating a situational fingerprint includes reading the anomaly origin, affected topology range, key state transition sequence, breakpoint identifier, protection action matching degree, and data credibility weight of each state entry from the homogeneous anomaly fragments; generating a fingerprint main chain according to the event time sequence; writing isolated disturbances that do not satisfy the topological adjacency relationship into the fingerprint sidechain; writing parallel evidence items into the conflict evidence segment; forming a situational fingerprint record with topological path identifier and evidence source identifier based on the fingerprint main chain, the fingerprint sidechains, and the conflict evidence segment; and establishing an index relationship between the situational fingerprint record and the corresponding original fragment. Specifically, during generation, the edge... The computing node takes candidate abnormal nodes within the same abnormal segment as the starting point of the abnormality, generates the set of topological nodes added to the abnormal segment along the candidate propagation path as the affected topological range, generates the generation time and event anchor point relationship of each state entry as the key state transition sequence, inserts the breakpoint identifier into the corresponding topological position of the fingerprint main chain, connects isolated disturbances to the fingerprint side chain according to the time window identifier, and writes parallel evidence items into the conflict evidence segment according to the source type. The situation fingerprint record saves the topological path identifier, evidence source identifier, original record sequence number and cache address. This embodiment enables the central side or station end to retrieve the original segment from the situation fingerprint for subsequent review.

[0056] In this embodiment, edge-side storage, summary upload, and original fragment association upload are performed according to the field integrity of the situation fingerprint record. Records on the edge-side storage path save the fingerprint main chain summary, isolated disturbance sidechains, and original record index. Records on the summary upload path upload the abnormal starting point, affected topology range, key state transition order, protection action matching degree, average data trust weight, and topology path identifier. Records on the original fragment association upload path upload the summary field, conflict evidence segment, breakpoint identifier, and indexed original fragment. Before performing upload, the edge computing node deduplicates the situation fingerprints with the same topology path identifier and similar event anchor points. During deduplication, records with higher data trust weight, more complete conflict evidence segments, and more continuous original fragment indexes are retained. For merged situation fingerprints, the merging source identifier and original record index are retained. This embodiment makes the transmission data no longer dependent on a single alarm level for selection, but rather based on the topology path and evidence integrity for traffic distribution.

[0057] In a preferred embodiment, the edge computing node maintains a fingerprint cache, a raw fragment cache, and a topology state cache during operation. The fingerprint cache stores situational fingerprint records, the raw fragment cache stores corresponding telemetry, teleindication, alarm records, and protection action records, and the topology state cache stores the state changes of the virtual topology association graph within a continuous time window. The three types of caches are associated with each other through the raw record sequence number, time window identifier, and topology path identifier. When the situational fingerprint is digested and uploaded, the fingerprint cache retains the corresponding raw fragment cache address. When the raw fragment cache needs to be cleaned up, the edge computing node first checks whether there are any unverified conflict evidence segments or breakpoint identifiers. For cache entries with unverified evidence, the index and necessary raw fragments are retained. For cache entries that have been verified and do not contain conflict evidence segments, the digest field and statistical markers are retained. This embodiment avoids the long-term mixing and accumulation of raw data, while ensuring that event chains containing breakpoints and conflicts can be traced.

[0058] In this embodiment, when the edge computing node processes historical stable intervals, it uses the telemetry changes and tele-signaling status of the same topology node under the same operating mode as a reference for the state credibility component. The operating mode is jointly determined by the switch tele-signaling status, interval activation / deactivation status, and protection action records. When the operating mode changes, the edge computing node does not directly mix the telemetry changes before and after the change into the same stable interval. Instead, it re-establishes the stable interval identifier according to the state container of the topology node. For telemetry measurements within the stable interval, the edge computing node calculates the direction and magnitude of the change and writes them into the node status field. For telemetry measurements outside the stable interval, the edge computing node retains the source identifier and time alignment mark and reduces the participation of the state credibility component. The protection action records and tele-signaling jump records still retain their own source credibility components. This embodiment makes the formation of data credibility weights have operating state boundaries, avoiding the direct mixing of state data under different operating modes.

[0059] In a preferred embodiment, topology propagation verification supports the retention of parallel candidate paths. When the same candidate anomalous node can be extended along multiple power supply connection directions or multiple protection action constraint relationships, the edge computing node does not immediately delete the path with low propagation compliance. Instead, it forms temporary candidate segments for each candidate path and records the topology node set, state transition order, protection action matching degree, and average data credibility weight of each temporary candidate segment. When multiple temporary candidate segments share the same anomalous starting point and there are overlapping topology nodes, the edge computing node merges the temporary candidate segments according to the protection action object and remote signaling state transition. For temporary candidate segments that cannot be merged, parallel evidence items are generated and written into the conflict evidence segment. This embodiment can retain candidate propagation relationships in scenarios with multi-path topology or incomplete evidence, avoiding premature deletion of possible anomalous chains.

[0060] In this embodiment, isolated disturbances are written and stored separately from anomaly fragments from the same source. Edge computing nodes write state changes that do not satisfy topological adjacency relationships and lack protection association records into the fingerprint sidechain. The fingerprint sidechain stores the disturbance topological node, disturbance source type, disturbance time window, data trust weight, and original record index. The fingerprint sidechain does not participate in the propagation path calculation of the fingerprint main chain, but shares event anchor references with the fingerprint main chain within the same time window. When a state change with a power supply connection relationship or protection action constraint relationship appears in a subsequent time window, the edge computing node rereads the fingerprint sidechain and attempts to merge it with the newly generated candidate propagation path. If the topological adjacency relationship and protection action constraint relationship are still not satisfied, it continues to be retained as an isolated disturbance. This embodiment avoids short-term irrelevant fluctuations directly polluting the anomaly main chain, while retaining the evidence entry point required for subsequent backtracking.

[0061] In a preferred embodiment, the edge computing node performs supplementary verification on the delayed marker records. When the delayed marker records enter the graph state sequence, they retain the generation time, arrival time, and adjacent event order constraints. If the generation time of the delayed record falls within the forward observation window or backward confirmation window of the already generated situation fingerprint, the edge computing node determines whether it has been written into the fingerprint main chain, fingerprint side chain, or conflict evidence segment based on the original record sequence number. Delayed records that have not been written are appended to the state container of the corresponding event anchor point, and the average data credibility weight and breakpoint identifier of the corresponding situation fingerprint are recalculated. Delayed records that have already been written are only updated with the arrival time and source credibility component, without changing the original generation time. This embodiment enables late-arriving records caused by communication delays to be included in the existing event chain without generating duplicate abnormal segments.

[0062] In this embodiment, the matching degree of the protection action is compared with the candidate propagation path based on the protection object, action time, and action type in the protection action record. The edge computing node reads the protection object mapping relationship of the protection action record, maps the protection object to one or more topology nodes in the virtual topology association graph, and then checks whether the time of the protection action is within the adjacent time window of the candidate event anchor point, and checks whether the candidate propagation path passes through the protected topology node or its adjacent topology edge. In the case where the protection action object is consistent with the candidate path but there is a delay in the remote signaling state transition, the edge computing node retains the state entry as a breakpoint identifier or conflict evidence item. In the case where the protection action object is inconsistent with the candidate path, the protection action record is not written to the fingerprint main chain but to the conflict evidence segment. This embodiment ensures that the protection action record is subject to the dual constraints of topology object and event time when participating in abnormal reconstruction.

[0063] In a preferred embodiment, the edge computing node uses a closure-based reading method when generating the affected topology range. It reads topology nodes that meet the propagation compliance requirements along the candidate propagation path, starting from the abnormal origin, and reads related objects and protection linkage objects along the auxiliary mapping. The result of the closure-based reading is written into the affected topology range field. At the same time, the basis for each topology node entering the range is retained. The basis for entering includes power supply connection entry, same-interval entry, protection linkage entry, and conflict evidence entry. When the edge computing node uploads the summary, it does not upload the complete virtual topology association graph, but uploads the topology path identifier and entry basis within the affected topology range. When the central side or station verifies, it can look up the node status field, edge status field, and event evidence field in the graph status sequence based on the topology path identifier. This embodiment reduces irrelevant content in the summary field and makes the boundary of the affected range have verifiable data basis.

[0064] In this embodiment, the critical state transition sequence is generated according to the event anchor point and the time of state entry generation. The edge computing node sorts the state entries in the same source anomaly segment according to the time of generation, and then uses the topology edge direction to correct the order of state entries at the same or similar times. The remote signaling state transition is prioritized according to the switch opening and closing logic. The protection action record is sorted according to the positional relationship between the protected object and the candidate propagation path. The telemetry change sequence is sorted according to the state maintenance mark and refresh cycle benchmark. If multiple state entries cannot be distinguished in time, the edge computing node writes them into the same transition layer and retains parallel evidence items. The critical state transition sequence is composed of the transition layer number, topology node identifier, state source type and original record sequence number. This embodiment can retain a reasonable event sequence expression when the timestamp accuracy is insufficient.

[0065] In a preferred embodiment, when the edge computing node persists the graph state sequence, it establishes a segmented index according to the time window identifier, topology node identifier, and source type. The segmented index is used to support fast backtracking between the situation fingerprint and the original fragment. Each state record in the graph state sequence saves the normalized field, trusted component, data trusted weight, time alignment mark, state container field position, and original record sequence number. The situation fingerprint record saves the fingerprint main chain, fingerprint side chain, conflict evidence segment, topology path identifier, and original fragment index. The segmented index does not change the content of the original record. All append, merge, and review operations save the processing traces through new records. The old records retain the original sequence number and generation time. This embodiment enables the edge-side processing process to have a traceable data version relationship.

[0066] In this embodiment, the edge computing node adopts a rolling time window mechanism when substation monitoring data continuously enters. The rolling time window dynamically expands around the event anchor point. When no candidate event anchor point appears, only a low-frequency state summary is generated. When a candidate event anchor point appears, the forward observation window and backward confirmation window are started to read, and the update frequency of the graph state sequence of the corresponding topology node and its adjacent topology nodes is temporarily increased. After the backward confirmation window ends, the edge computing node generates or updates the situation fingerprint. If a protection action record or a high-confidence remote signaling jump record appears before the backward confirmation window ends, the candidate event anchor point is re-merged and the confirmation range is extended. If only isolated disturbances exist after the backward confirmation window ends, a fingerprint sidechain record is generated and a shorter original fragment index is retained. This embodiment enables the event chain formation process to be corrected according to the actual data arrival order.

[0067] In a preferred embodiment, after the verification results are returned from the central side, the edge computing node marks the status of the situation fingerprint record. The verification results are only saved as additional markers for the situation fingerprint record and do not directly overwrite the original graph state sequence. If the central side confirms that the homologous abnormal segment is valid, the edge computing node marks the corresponding fingerprint main chain as confirmed and retains the abnormal starting point, the affected topology range, and the key state transition order. If the central side confirms that a certain source in the conflict evidence segment is an invalid source, the edge computing node only forms a reference mark for the trusted components of the same source type. If the central side confirms that the isolated disturbance is an independent event, the edge computing node converts the fingerprint sidechain into a new fingerprint main chain and retains the conversion relationship. This embodiment enables the subsequent processing on the edge side to utilize the verification results without destroying the traceability of the original record.

[0068] In this embodiment, the complete operation process begins with the edge computing node receiving substation monitoring data and ends with the storage or uploading of situation fingerprints. After the monitoring data enters, field normalization and monitoring point mapping are first completed, and then it is written into a unified state container in the virtual topology association graph. After the candidate event anchor points are formed, forward observation windows and backward confirmation windows are generated. After time alignment is completed, time credibility components, source credibility components, state credibility components and data credibility weights are formed for each state record. Topology propagation verification expands the candidate propagation path according to the power supply connection relationship, bay affiliation relationship, protection action constraint relationship and monitoring point affiliation relationship. Same-source abnormal segments, isolated disturbances, breakpoint identifiers and conflict evidence segments are respectively entered into the situation fingerprint structure. The situation fingerprint is then stored on the edge side, uploaded as a summary or uploaded as an original segment according to the event urgency level. This embodiment converts the original data stream at the station end into an event-level record with topology path, time sequence, evidence credibility and original segment index, which can support the local reconstruction, diversion and transmission and subsequent tracing of abnormal events in the substation monitoring edge computing process.

Claims

1. An edge computing method for substation monitoring, characterized in that, include: The substation monitoring data is acquired at the edge computing node, and the substation monitoring data includes telemetry data, telesignal data, alarm records, and protection action records. A virtual topology diagram is constructed based on primary wiring relationships, bay attribution relationships, protection association relationships, and monitoring point mapping relationships. The substation monitoring data is mapped to the virtual topology association graph, and time alignment is performed according to a unified time window to generate a graph state sequence with data reliability weights. Based on the graph state sequence, topology propagation verification is performed to determine the anomaly starting point, the affected topology range, and the sequence of critical state transitions. A situational fingerprint is generated based on the anomaly origin, the affected topology range, the key state transition sequence, the protection action matching degree, and the data trust weight. Perform edge-side storage, digest upload, or raw fragment association upload according to the event urgency level of the situation fingerprint.

2. The edge computing method for substation monitoring according to claim 1, characterized in that, The step of aligning time according to a unified time window and generating a graph state sequence with data reliability weights includes: Using the telemetry jump time, alarm trigger time, and protection action occurrence time as candidate event anchor points, a forward observation window and a backward confirmation window are established around the candidate event anchor points; For telemetry data with different sampling periods, the status is maintained according to the refresh period of the monitoring point to which it belongs, and records with timestamp offsets exceeding the adjacent event sequence constraints are delayed and marked. The data trust weight is determined based on the consistency of data source type, refresh cycle, timestamp offset, consecutive missing test length, and historical stable interval. The aligned state value, event flag, and data trust weight are then written into the corresponding topology node or topology edge.

3. The edge computing method for substation monitoring according to claim 1, characterized in that, The construction of the virtual topological association graph includes: The logical entities corresponding to busbars, main transformers, switches, bays, and protected objects are used as topology nodes, and the power supply connection relationship, bay affiliation relationship, protection action constraint relationship, and monitoring point affiliation relationship are used as topology edges. Each monitoring point is bound to a unique primary topology node, and auxiliary mappings are established for monitoring points that have protection linkage relationships or are associated with the same interval. A unified state container is set up for telemetry, teleindication, alarm records, and protection action records under the same topology node, so that substation monitoring data from different sources can participate in subsequent verification in the form of a graph structure state within the edge computing node.

4. The edge computing method for substation monitoring according to claim 1, characterized in that, The topology propagation verification based on the graph state sequence includes: Candidate abnormal nodes are selected from the topology nodes that have experienced state transitions or alarms, and the candidate propagation paths are expanded according to the power supply connection relationships and protection action constraint relationships in the virtual topology association diagram. Compare the state transition sequence, telemetry change direction, telemetry state transition, and protection action records of adjacent topological nodes within the candidate propagation path; State changes that do not satisfy the topological adjacency relationship and lack protected associated records are marked as isolated disturbances, while state changes that satisfy the topological adjacency relationship and have evidence of continuous state are merged into homologous anomaly fragments.

5. The edge computing method for substation monitoring according to claim 2, characterized in that, The establishment of the candidate event anchor points includes: Multiple remote signaling jump times, alarm trigger times, and protection action occurrence times that occur within the same time period are deduplicated and merged. During merging, the protection action occurrence time is used as the main anchor point, and the remote signaling jump times that have the same interval affiliation or protection association with the protection action occurrence time are used as the auxiliary anchor points. For time periods where no protection action records exist, the topological node with the highest state transition density is used as a temporary anchor point, and the telemetry change sequence associated with the temporary anchor point is included in the forward observation window and the backward confirmation window.

6. The edge computing method for substation monitoring according to claim 2, characterized in that, The determination of the data credibility weight includes: These are respectively formed into a time-based trusted component, a source-based trusted component, and a state-based trusted component; The time confidence component is determined based on the relative order of the timestamp offset and the candidate event anchor point; the source confidence component is determined based on the record completeness of telemetry, teleindication, alarm records and protection action records; and the state confidence component is determined based on the fluctuation range and continuous missing measurement length of the same topology node within the historical stable interval. The time-trusted component, the source-trusted component, and the state-trusted component are bound to the same state entry in the graph state sequence, and the source identifier of each component is retained.

7. The edge computing method for substation monitoring according to claim 3, characterized in that, The unified state container includes node state fields, edge state fields, and event evidence fields; The node status field records the telemetry change, current telemetry status, and telemetry jump direction of the topology node. The edge status field records the power supply connection status, interval affiliation, and protection action constraint relationship between adjacent topology nodes. The event evidence field records alarm records, protection action records, time alignment markers, and the data credibility weight. Edge computing nodes merge and write multi-source records within the same time window according to the field relationships of the unified state container.

8. The edge computing method for substation monitoring according to claim 4, characterized in that, The merging of the homologous abnormal segments includes: Starting from the candidate abnormal node, read the status entries of adjacent topology nodes along the candidate propagation path, and classify the status entries whose state transition sequence satisfies the power supply connection direction constraint, whose remote signaling state transition satisfies the switch opening and closing logic, and whose protection action record satisfies the protection object mapping relationship into the same abnormal segment. For intermediate topology nodes with missing test records, breakpoint identifiers are generated based on the data credibility weight and the event evidence fields of adjacent nodes, and the breakpoint identifiers are written into the evidence chain position of the same source anomaly fragment.

9. The edge computing method for substation monitoring according to claim 6, characterized in that, After binding the time-trusted component, the source-trusted component, and the state-trusted component to the same state entry in the graph state sequence, the method further includes: A trusted weight trajectory is established within a continuous time window of the same topology node, and three types of trusted anomalies are identified based on the trusted weight trajectory: short-term missing data, continuous offset, and source conflict. For short-term missing measurements, the state reliability component of the same topological node in adjacent time windows is used; For persistent offsets, set the corresponding status entry to a pending review status; In the event of a conflict of sources, telemetry data, teleindication data, alarm records, and protection action records will be retained as parallel evidence items.

10. The edge computing method for substation monitoring according to claim 8, characterized in that, The generated situation fingerprint includes: Read the anomaly starting point, affected topology range, key state transition sequence, breakpoint identifier, protection action matching degree, and data credibility weight of each state entry from the same source anomaly fragment, and generate a fingerprint main chain according to the event time sequence; Write isolated perturbations that do not satisfy the topological adjacency relationship into the fingerprint sidechain, and write parallel evidence items into the conflict evidence segment. A situational fingerprint record with topological path identifier and evidence source identifier is formed based on the fingerprint main chain, the fingerprint side chain, and the conflict evidence segment, and an index relationship is established between the situational fingerprint record and the corresponding original segment.

Images