An unattended substation based on alarm compression disposal

Abstract

The application discloses an unattended substation based on alarm compression treatment, which comprises a multi-source alarm access device, an alarm standardization device, a three-domain correlation modeling device, an event slicing device, a multi-domain causal analysis device, a root cause compression device, a treatment linkage device and a feedback correction device; the multi-source alarm access device is used for accessing in-station remote signaling displacement information, remote measurement overrun information, SOE sequential event information, protection action information, fault recording wave trigger information, communication abnormal information and device self-checking information; the application relates to the technical field of intelligent operation and maintenance of substations; and the three-domain correlation modeling device is arranged to uniformly model the primary equipment topological relationship, the secondary protection action logic relationship and the communication link dependency relationship, so that the alarm analysis can jointly carry out root cause identification from three dimensions of electrical propagation, protection triggering and communication abnormal propagation, and the root cause determination accuracy is improved.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance of substations, and more specifically, to an unattended substation based on alarm compression and processing. Background Technology

[0002] With the increasing number of unattended substations, information such as remote signaling changes, telemetry limit violations, protection actions, fault recording triggers, and communication anomalies continuously accumulates at the monitoring backend. Alarm sources are numerous, arrival times are frequent, and their interrelationships are complex. Maintenance personnel primarily rely on remote monitoring centers for analysis, thus placing higher demands on the rapid screening, correlation analysis, and handling support of alarm information. In existing technologies, Chinese patent CN110535238A discloses an intelligent monitoring system and method for substation equipment, capable of monitoring and alarming anomalies in the substation environment, recordings, communication networks, and dispatching. Chinese patent CN111478324B discloses a substation alarm analysis system, focusing on operational status assessment, alarm analysis, and simulation analysis. Chinese patent CN112286987B discloses a power IoT anomaly alarm compression method based on the Apriori algorithm, capable of classifying and merging massive amounts of alarms. The above solutions provide technical support for monitoring access, alarm analysis, and alarm compression, respectively. However, for multi-source co-occurring alarm processing in unattended substation scenarios, the following problems still exist: root cause localization is not direct enough, the original alarm mapping relationship is not retained enough after compression, the linkage between compression results and handling is not tight, and it is difficult to reverse the analysis strategy after subsequent manual review and defect elimination results. Therefore, it is necessary to propose an unattended substation based on alarm compression processing to improve the efficiency of root cause identification and remote operation and maintenance processing. Summary of the Invention

[0003] The purpose of this invention is to provide an unattended substation based on alarm compression processing, which solves the problems in the processing of multi-source co-occurring alarms in unattended substation scenarios, such as insufficient direct root cause location, insufficient retention of the original alarm mapping relationship after compression, weak linkage between compression results and processing, and difficulty in reverse correction analysis strategies for subsequent manual review and defect elimination results.

[0004] The present invention achieves the above objectives through the following technical solution: an unattended substation based on alarm compression and processing, comprising a multi-source alarm access device, an alarm standardization device, a three-domain correlation modeling device, an event slicing device, a multi-domain causal analysis device, a root cause compression device, a processing linkage device, and a feedback correction device. The multi-source alarm access device is used to access remote signaling change information, telemetry over-limit information, SOE sequence event information, protection action information, fault recording trigger information, communication abnormality information, and device self-test information within the station. The alarm standardization device is connected to the multi-source alarm access device and is used to perform unified time stamping, encoding mapping and semantic standardization processing on the accessed multi-source alarm information to generate a standardized alarm dataset. The three-domain association modeling device is used to construct a primary equipment topology association model, a secondary protection action logic model, and a communication link mapping model based on the primary wiring relationship within the station, equipment ledger information, protection configuration relationship, and communication network configuration relationship. The event slicing device is data coupled to the alarm standardization device and the three-domain association modeling device, respectively, and is used to aggregate and segment the standardized alarm dataset based on time proximity, interval attribution, protection area attribution, and communication path attribution to generate alarm clusters to be analyzed. The multi-domain causal analysis device is data coupled to the event slicing device and the three-domain association modeling device, respectively, and is used to generate multi-domain alarm causal chains for each alarm cluster to be analyzed, and to perform reverse backtracking analysis on the multi-domain alarm causal chains to determine the source event node and the minimum root cause event set. The root cause compression device is connected to the multi-domain causal analysis device for merging derived alarms corresponding to the same minimum root cause event set into root cause alarm objects and establishing a mapping relationship between the root cause alarm objects and the original derived alarms. The handling linkage device is data-connected to the root cause compression device and is used to output the root cause device, scope of impact, triggering sequence, associated evidence, event level and suspected fault category based on the root cause alarm object, and generate corresponding handling suggestions. The feedback correction device is data coupled to the handling linkage device, the root cause compression device and the multi-domain causal analysis device, respectively, and is used to collect event handling results, manual review results, defect elimination records and erroneous compression feedback information, and correct subsequent alarm causal backtracking strategies and compression handling parameters based on the collected results.

[0005] Furthermore, the multi-source alarm access device includes: Remote signaling acquisition unit, telemetry acquisition unit, sequential event acquisition unit, protection information acquisition unit, waveform recording trigger acquisition unit, communication anomaly acquisition unit, and device self-test acquisition unit; The alarm standardization device includes a time alignment unit, an encoding conversion unit, and a semantic normalization unit; The time alignment unit is used to unify alarm information from different sources to the same timing reference. The encoding conversion unit is used to convert the original alarm codes output by different manufacturers and different devices into a unified internal code; The semantic normalization unit is used to map alarm content with different text descriptions to unified semantic tags, and write device identifiers, interval identifiers, protection area identifiers and communication link identifiers into the standardized alarm dataset.

[0006] Furthermore, the three-domain association modeling device includes: Topology modeling unit, protection logic modeling unit, and communication mapping modeling unit; The topology modeling unit is used to generate electrical connection relationships and bay assignment relationships between equipment within the station based on primary wiring relationships and equipment ledger information; The protection logic modeling unit is used to generate the action logic relationship between protection start-up, output trip, blocking and signal return based on the protection configuration relationship; The communication mapping modeling unit is used to generate link dependencies between monitoring hosts, measurement and control devices, protection devices, switches, and communication channels based on the communication network configuration relationship.

[0007] Furthermore, the event slicing device is used to first perform initial aggregation based on the time interval between adjacent alarms, and then perform secondary screening based on the interval identifier, protection area identifier, and communication link identifier in the standardized alarm dataset; Alarms corresponding to the same disturbance process are grouped into the same alarm cluster to be analyzed, and alarms with inconsistent electrical locations, inconsistent protection ranges, or inconsistent communication dependency paths are divided into different alarm clusters to be analyzed.

[0008] Furthermore, the multi-domain causal analysis device includes: Electrical propagation identification unit, action sequence identification unit, communication propagation identification unit, and causal chain fusion unit; The electrical propagation identification unit is used to identify the electrical connection propagation path between alarm nodes within the alarm cluster to be analyzed based on the primary equipment topology association model. The action sequence identification unit is used to identify the triggering sequence between protection start-up, action output, trip change and waveform recording trigger based on the secondary protection action logic model. The communication propagation identification unit is used to identify the propagation path of communication anomalies between devices, switching nodes, and communication channels based on the communication link mapping model. The causal chain fusion unit is used to fuse the electrical connection propagation path, action triggering sequence, and communication anomaly propagation path into a multi-domain alarm causal chain.

[0009] Furthermore, the multi-domain causal analysis device also includes: Reverse backtracking unit, coverage determination unit, and redundancy reduction unit; The reverse backtracking unit is used to start from the derived alarms in the alarm cluster to be analyzed and search for candidate source event nodes in reverse along the multi-domain alarm causal chain; The coverage determination unit is used to statistically analyze the interpretation coverage of each candidate source event node for the current alarm cluster to be analyzed. The redundancy reduction unit is used to cross-compare multiple candidate source event nodes, delete candidate nodes whose explanation scope is included, and output the minimum root cause event set used to explain the current alarm cluster to be analyzed.

[0010] Furthermore, the root cause compression device is used to group out-of-limit alarms, action alarms, lockout alarms, disconnection alarms and device malfunction alarms corresponding to the same minimum root cause event set into a single root cause alarm object; The mapping relationship stores the association number, alarm time, alarm type, source device identifier, and evidence chain location identifier between the root cause alarm object and each original derived alarm, in order to support compressed display, detailed expansion, and event tracing.

[0011] Furthermore, the handling linkage device includes: Equipment positioning unit, range assessment unit, evidence aggregation unit, level determination unit, and suggestion generation unit; The device positioning unit is used to identify the root cause device; The range assessment unit is used to determine the affected interval range, protection range, and communication range; The evidence aggregation unit is used to extract topological evidence, protection logic evidence, and communication path evidence that support root cause determination. The level determination unit is used to generate event levels; The suggestion generation unit is used to output remote confirmation suggestions, video review suggestions, link troubleshooting suggestions, protection verification suggestions, or on-site inspection suggestions according to the suspected fault category.

[0012] Furthermore, the feedback correction device includes: Feedback collection unit, knowledge storage unit, and parameter correction unit; The feedback collection unit is used to collect the handling results, manual review results, defect elimination records and erroneous compression feedback information corresponding to the root cause alarm object; The knowledge storage unit is used to bind and store the collected results with the root cause alarm object, the original derived alarm, and the multi-domain alarm causal chain; The parameter correction unit is used to update the event slicing rules, causal chain backtracking priority, root cause coverage determination conditions, and compression determination conditions based on the feedback samples that have been entered into the database.

[0013] Furthermore, it also includes a collaborative interface device: The collaborative interface device is connected to the remote monitoring center, the centralized control platform and the operation and maintenance terminal respectively, and is used to receive the disposal suggestions, root cause equipment information, impact range information, triggering sequence information and related evidence information generated by the disposal linkage device. It also receives confirmation results, review results, troubleshooting results, and verification results from the remote monitoring center, centralized control platform, and operation and maintenance terminal; The results are transmitted to the feedback correction device to form a closed-loop processing structure of alarm identification, compressed display, coordinated handling and feedback correction.

[0014] The beneficial effects of this invention are as follows: 1. By setting up multi-source alarm access devices and alarm standardization devices in unattended substations, alarms from remote signaling, telemetry, protection, waveform recording, communication, and device self-testing can be uniformly accessed and standardized, reducing the impact of differences in expression between heterogeneous alarm sources on subsequent analysis.

[0015] 2. By setting up a three-domain correlation modeling device, the topological relationship of primary equipment, the logical relationship of secondary protection actions, and the dependency relationship of communication links are modeled in a unified manner, so that alarm analysis can jointly carry out root cause identification from three dimensions: electrical propagation, protection triggering, and communication anomaly propagation, thereby improving the accuracy of root cause determination.

[0016] 3. By setting up an event slicing device and a multi-domain causal analysis device, it is possible to aggregate, segment, and establish causal relationships among multiple derived alarms generated under the same disturbance process, extract the smallest root cause event set from a large number of apparent alarms, and avoid duplicate alarms and accompanying alarms interfering with operation and maintenance judgment.

[0017] 4. By setting up a root cause compression device, the mapping relationship between the root cause alarm object and the original derived alarm is preserved while compressing and merging derived alarms from the same source. Compared with the simple merging based on the Apriori algorithm in the prior art, this application can still trace the source and time sequence of each original alarm through the association number and evidence chain position identifier after compression, which meets the requirements of power dispatch audit for alarm integrity. It not only reduces the number of alarms displayed on the monitoring interface, which can be compressed from dozens to 1-3 root cause alarms in typical scenarios, but also allows for detailed analysis and event tracing when needed.

[0018] 5. By setting up a handling linkage device and a feedback correction device, the root cause analysis results can be directly converted into remote confirmation suggestions, video review suggestions, link troubleshooting suggestions, protection verification suggestions, or on-site inspection suggestions. Based on the subsequent handling results, manual review results, defect elimination records, and erroneous compression feedback information, the analysis strategy and parameters are continuously corrected, thereby forming an alarm compression handling closed loop suitable for unattended substation scenarios. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart illustrating the overall system flow of the present invention. Figure 2 This is a forward flowchart of the multi-domain causal analysis of the present invention; Figure 3 This is a diagram of the closed-loop processing structure of the present invention. Detailed Implementation

[0020] The present application will now be described in further detail with reference to the accompanying drawings. It should be noted that the following specific embodiments are only used to further illustrate the present application and should not be construed as limiting the scope of protection of the present application. Those skilled in the art can make some non-essential improvements and adjustments to the present application based on the above application content.

[0021] Example 1:

[0022] Please see Figure 1-3 This invention provides an unattended substation based on alarm compression and processing. The unattended substation can be a 110kV substation, a 220kV substation, or a centralized control station under unified supervision by a remote monitoring center. The unattended substation is equipped with a multi-source alarm access device, an alarm standardization device, a three-domain correlation modeling device, an event slicing device, a multi-domain causal analysis device, a root cause compression device, a processing linkage device, and a feedback correction device. These devices can be integrated and deployed in the substation's monitoring backend, edge computing devices, or the main station's analysis server, or they can be implemented using a collaborative approach of partial substation-level deployment and partial main station deployment.

[0023] It should be noted that the multi-source alarm access device, alarm standardization device, three-domain correlation modeling device, event slicing device, multi-domain causal analysis device, root cause compression device, handling linkage device, and feedback correction device in this embodiment can be software functional modules deployed in the station-side monitoring backend, edge computing device, main station-side server, or centralized control platform server, or they can be functional units formed by combining software and hardware interfaces; the data connection, data coupling, or communication connection between the devices refers to the data transmission, data call, and processing result transmission relationship realized through data interfaces, databases, message queues, service call interfaces, inter-process communication interfaces, or network interfaces, and is not limited to fixed physical line connections.

[0024] 1. Multi-source alarm access device The multi-source alarm access device is used to access operational alarm information from multiple sources within the station. Specifically, the multi-source alarm access device includes a remote signaling acquisition unit, a telemetry acquisition unit, a sequential event acquisition unit, a protection information acquisition unit, a waveform recording trigger acquisition unit, a communication anomaly acquisition unit, and a device self-test acquisition unit.

[0025] The system includes several components: a remote signaling acquisition unit for accessing status change information from circuit breakers, disconnectors, grounding switches, and primary equipment; a telemetry acquisition unit for accessing current, voltage, active power, reactive power, temperature, and operational limit exceedance information; a sequence event acquisition unit for accessing SOE sequence event information; a protection information acquisition unit for accessing protection start-up, protection action, protection interlocking, and tripping information; a waveform recording trigger acquisition unit for accessing trigger information from fault waveform recorders; a communication anomaly acquisition unit for accessing communication anomaly information from monitoring hosts, measurement and control devices, protection devices, switches, and communication channels; and a device self-test acquisition unit for accessing self-test anomaly information from protection devices, measurement and control devices, waveform recorders, and intelligent electronic devices. By setting up multi-source alarm access devices, it is possible to ensure that the main alarm sources related to abnormal disturbances are uniformly accessed, providing a complete data foundation for subsequent alarm compression and handling.

[0026] 2. Alarm standardization device The alarm standardization device is connected to the multi-source alarm access device and is used to perform unified time stamping, encoding mapping, and semantic standardization processing on the accessed multi-source alarm information to generate a standardized alarm dataset. The alarm standardization device includes a time alignment unit, an encoding conversion unit, and a semantic normalization unit.

[0027] The time alignment unit is used to unify alarm information from different devices, communication links, and data acquisition sources to the same time reference. Preferably, the time reference adopts a unified clock source within the station or a master station time reference to ensure that alarms from protection devices, monitoring systems, communication equipment, and waveform recording devices are compared on a unified time axis.

[0028] The encoding conversion unit is used to convert the original alarm codes output by different manufacturers and different device types into a unified internal code. For example, for trip alarms with the same meaning but different codes in different protection devices, they are converted into a unified internal identifier through a preset mapping table.

[0029] The semantic normalization unit is used to map alarm content with different text descriptions to a unified semantic label, and writes the device identifier, interval identifier, protection area identifier, and communication link identifier into the standardized alarm dataset. For example, "circuit breaker position", "circuit breaker tripped", and "circuit breaker position changed to position" are all normalized to the same semantic label.

[0030] If the same alarm attribute has different dimensions or different value ranges, it is normalized before entering the subsequent calculation, so that the relevant indicators are mapped to the range of 0 to 1, so that data from different sources can participate in the unified weighted calculation. After processing by the alarm standardization device, a standardized alarm dataset is formed, so that alarms from heterogeneous sources can participate in subsequent aggregation, slicing and causal analysis under the same analysis framework.

[0031] 3. Three-domain association modeling device The three-domain correlation modeling device is used to construct a primary equipment topology correlation model, a secondary protection action logic model, and a communication link mapping model based on the primary wiring relationships, equipment ledger information, protection configuration relationships, and communication network configuration relationships within the station. The three-domain correlation modeling device includes a topology modeling unit, a protection logic modeling unit, and a communication mapping modeling unit. The three-domain correlation modeling device is data-connected to the alarm standardization device.

[0032] The topology modeling unit is used to generate electrical connection relationships and bay affiliation relationships between equipment within the station based on the primary wiring diagram, bay configuration relationships, and equipment ledger information. Specifically, it includes the electrical connection relationships between busbars, main transformers, lines, circuit breakers, disconnect switches, current transformers, and voltage transformers.

[0033] The protection logic modeling unit is used to generate the action logic relationships between protection initiation, tripping, blocking, and signal return based on the protection configuration relationships. For example, it establishes the logical association between protection initiation and triggering tripping output, waveform recording triggering, and remote signaling change.

[0034] The communication mapping modeling unit is used to generate link dependencies between monitoring hosts, measurement and control devices, protection devices, switches, and communication channels based on communication network configuration relationships. For example, it establishes dependencies on how a switch malfunction may affect the communication status of multiple protection devices. Through the three-domain correlation modeling unit, a structured correlation foundation can be provided for subsequent alarm causal analysis from three dimensions: electrical connections, protection actions, and communication links.

[0035] 4. Event Slicing Device The event slicing device is data-coupled with the alarm standardization device and the three-domain association modeling device, respectively. It is used to aggregate and segment the standardized alarm dataset based on time proximity, interval attribution, protection area attribution, and communication path attribution to generate alarm clusters to be analyzed.

[0036] In this embodiment, the event slicing device first performs initial aggregation based on the time interval between adjacent alarms, and then performs secondary screening based on the interval identifier, protection area identifier, and communication link identifier in the standardized alarm dataset. Alarms corresponding to the same disturbance process are grouped into the same alarm cluster to be analyzed, and alarms with inconsistent electrical locations, inconsistent protection ranges, or inconsistent communication dependency paths are divided into different alarm clusters to be analyzed.

[0037] To ensure the reproducibility of event slicing rules, preferably, for any two alarm events... and Merge relevance Calculate as follows: in, and These represent alarm events. and alarm events Standardized timestamps, in seconds; This represents the time decay constant, in seconds. Indicates the interval attribution association factor; Indicates the association factors of the protected area; Indicates the communication path association factor; , , , For the corresponding weights, and satisfying: In the formula, the numerator and denominator of the exponential term are both time quantities, and the result is a dimensionless value; the other three correlation factors all take dimensionless values ​​between 0 and 1, so the above expression has consistent dimensions.

[0038] In this embodiment, The timeframe is selected from 3 to 10 seconds, with 5 seconds being preferred. The determination is based on the following: protection actions, remote signaling changes, SOE events, and waveform recording triggers typically occur within a short time interval after a fault occurs. If the time synchronization consistency within the station is high, a smaller value is used; if there are differences in transmission delays between devices from different manufacturers, a larger value is used. Preferably, , , , The basis for this is that alarm merging under the same disturbance process is first affected by time proximity and interval attribution, and secondly by the protected area and communication path.

[0039] in, The determination rule is as follows: if two alarms belong to the same interval, then take 1; if they belong to the same bus-related interval, then take 0.7; otherwise, take 0. The determination rule is as follows: if two alarms belong to the same protection area, then take 1; if they belong to the main and backup protection relationship, then take 0.6; otherwise, take 0. The determination rule is as follows: if two alarms depend on the same communication link, then take 1; if they share the same switching node, then take 0.5; otherwise, take 0.

[0040] Preferably, when When the alarms are in the same cluster to be analyzed, the corresponding alarms will be grouped together, where the threshold is... The threshold is set between 0.60 and 0.75, with 0.68 being preferred. This threshold is determined based on the balance between "alarms from the same disturbance process should be merged" and "alarms from different disturbance processes should not be mistakenly merged" in historical samples.

[0041] For example, when a line fault triggers protection activation, circuit breaker tripping, remote signaling change, and waveform recording, the above alarms will be classified into the same alarm cluster to be analyzed because they are close in time, have the same protection area, and have the same electrical bay; while the disconnection alarm caused by communication link jitter in another bay will be classified into another alarm cluster to be analyzed because the communication dependency path is different.

[0042] 5. Multi-domain causal analysis device The multi-domain causal analysis device is data-coupled with the event slicing device and the three-domain correlation modeling device, respectively, to generate multi-domain alarm causal chains for each alarm cluster to be analyzed, and to perform reverse backtracking analysis on the multi-domain alarm causal chains to determine the source event node and the minimum root cause event set.

[0043] The multi-domain causal analysis device includes an electrical propagation identification unit, an action sequence identification unit, a communication propagation identification unit, a causal chain fusion unit, a reverse backtracking unit, a coverage determination unit, and a redundancy reduction unit.

[0044] The electrical propagation identification unit is used to identify the electrical connection propagation path between alarm nodes within the alarm cluster to be analyzed based on the primary equipment topology association model. Specifically, for any two alarm nodes u and v within the alarm cluster, if their corresponding primary equipment has an electrical connection path in the topology model, a propagation path is established, and the path strength is negatively correlated with the electrical distance. The action sequence identification unit is used to identify the triggering sequence between protection start-up, action output, trip change, and waveform recording triggering based on the secondary protection action logic model. The communication propagation identification unit is used to identify the propagation path of communication anomalies between devices, switching nodes, and communication channels based on the communication link mapping model. The causal chain fusion unit is used to fuse the electrical connection propagation path, action triggering sequence, and communication anomaly propagation path into a multi-domain alarm causal chain, thereby forming a complete alarm propagation structure.

[0045] To ensure that the rules for establishing causal edges are clear and explicit, preferably, for any two alarm nodes... and Causal edge strength Calculate as follows: in, Represents a node With nodes Topological propagation matching degree between them; Indicates the degree of matching between the protection action logic; Indicates the degree of matching in communication anomaly propagation; This represents the time constant for causal propagation, expressed in seconds. , , , Calculate the weights for the causal edge strength, satisfying: In the formula, each matching degree is a dimensionless value between 0 and 1, and the time decay term is also a dimensionless value. Therefore, the above expression has consistent dimensions.

[0046] In this embodiment, The timeframe is 2 to 8 seconds, with 4 seconds being preferred. This is based on the fact that protection activation, action output, tripping change, and waveform recording triggering within the same event chain typically exhibit strong temporal continuity. Preferably, , , , The basis for this determination is that, during fault propagation, topological relationships and protection logic relationships are generally more indicative of root cause identification than communication anomaly propagation relationships, while temporal relationships are mainly used to constrain the propagation direction.

[0047] in, It can be calculated from the shortest electrical connection distance between nodes in a single wiring topology; the shorter the electrical connection distance, the higher the value. It can be determined by the logical adjacency relationship between "start-out-trip-return" in the protection configuration. It is 1 when there is a direct logical adjacency, 0.5 when there is an indirect logical association, and 0 in other cases. The value can be determined by whether the communication link mapping model passes through the same switching node or the same link. If both share the same communication channel, the value is 1; if they only share the same switching node, the value is 0.6; otherwise, the value is 0.

[0048] Preferably, when and At that time, establish a node Pointing to node Causal edges. Threshold. The value is set between 0.55 and 0.70, with 0.60 being preferred. This is based on the principle of ensuring that nodes in the true causal chain can be effectively connected while reducing false connections caused by occasional time overlap alarms.

[0049] The reverse backtracking unit is used to search for candidate source event nodes in reverse along the multi-domain alarm causal chain, starting from the derived alarms in the alarm cluster to be analyzed; the coverage determination unit is used to statistically analyze the explanatory coverage of each candidate source event node for the current alarm cluster to be analyzed; the redundancy reduction unit is used to cross-compare multiple candidate source event nodes, delete candidate nodes whose explanatory scope is included, and output the minimum root cause event set used to explain the current alarm cluster to be analyzed; the minimum root cause event set, that is, the root cause event set that cannot be further deleted, refers to the root cause event set in which the explanatory coverage of the current alarm cluster decreases by more than 10% after any candidate source event node in the set is removed.

[0050] To quantify the explanatory power of candidate source event nodes, preferably, the candidate source event nodes... Explanation coverage Calculate as follows: in, Indicates candidate source event nodes The number of derived alarms that can be explained; This represents the total number of alarms in the current alarm cluster to be analyzed. Since both the numerator and denominator are the number of events, the result of the above expression is a dimensionless ratio.

[0051] Preferably, when At that time, candidate source event nodes As a root cause candidate node. Threshold The value should be between 0.75 and 0.90, with 0.80 being preferred. The rationale is that the true root cause event should be able to explain most of the derived alarms in the current alarm cluster, but considering communication misses, device false alarm codes, and time drift factors, complete coverage is not required.

[0052] To further reduce the probability of misjudgment, preferably, for each root cause candidate node... Calculate root cause confidence : in, Indicates the coverage of explanations; Indicates the source event node from the candidate source. The average strength of the causal edge pointing to the derivational alarms that can be explained by it; Indicates the historical consistency coefficient; , , For the corresponding weights, and satisfying .

[0053] In this embodiment, preferably, , , The basis for this is that: coverage is the primary basis for root cause identification, the average strength of causal edges reflects the reliability of the causal chain structure, and historical consistency is used to improve the stability of judgment by utilizing previously confirmed cases. The determination rule is as follows: Confirmed cases that match the current candidate source event in terms of device type, protection area, and propagation chain structure are selected from the historical knowledge base. The ratio of the number of matching cases to the total number of reference cases is normalized and used as the reference value. . The value range is [0,1]. When there is no matching case in the historical knowledge base, Take 0.5. Preferably, when At that time, candidate source event nodes Identified as a valid root cause node; threshold The value should be between 0.65 and 0.80, with 0.72 being preferred.

[0054] For example, when a fault process simultaneously triggers protection actions, tripping, remote signaling changes, waveform recording triggers, and multiple over-limit alarms, the system can use a multi-domain causal analysis device to trace the above-mentioned apparent alarms back to the same source event node, and finally extract one or a few root cause events, avoiding the need to respond to each derived alarm separately during subsequent processing.

[0055] 6. Root Cause Compression Device The root cause compression device is connected to the multi-domain causal analysis device to merge derived alarms corresponding to the same minimum root cause event set into root cause alarm objects and establish a mapping relationship between root cause alarm objects and original derived alarms.

[0056] Specifically, the root cause compression device groups the over-limit alarms, action alarms, lockout alarms, disconnection alarms and device abnormality alarms corresponding to the same minimum root cause event set into a root cause alarm object, and saves the association number, alarm time, alarm type, source device identifier and evidence chain location identifier between the root cause alarm object and each original derived alarm in the mapping relationship, so as to support compressed display, detailed expansion and event tracing.

[0057] To improve the stability of compression decisions, preferably, for effective root cause nodes... Corresponding compression consistency index Calculate as follows: in, This indicates the confidence level of the aforementioned root cause; Indicates belonging to a node The derived alarm time dispersion is preferably calculated using the standard deviation, with the unit being seconds; This indicates the current event slice time window, in seconds; Indicates the consistency coefficient of evidence; , , For the corresponding weights, and satisfying In the formula, This is a dimensionless time ratio. and All are dimensionless values ​​between 0 and 1, therefore the above expressions have consistent dimensions overall.

[0058] In this embodiment, preferably, , , The rationale is as follows: In the alarm compression process, the reliability of the root cause determination itself should be ensured first, and then the degree of concentration of derived alarms in time and the consistency of the evidence chain should be considered. The value is set between 5s and 30s, with 10s being preferred. This value is determined based on the typical duration from the start of a disturbance process to the completion of the multi-source alarm transmission.

[0059] The determination rule is as follows: if the topological evidence, protection logic evidence, and communication propagation evidence of derived alarms in the same group can corroborate each other, then... Take a value between 0.8 and 1.0; if there are conflicting protection action directions, electrical propagation directions, or communication dependencies, then... Take a value of 0.2 to 0.5; if some evidence is missing, then... Take a value of 0.5 to 0.7. Preferably, when When this happens, the corresponding derived alarms are merged into a single root cause alarm object. Threshold The value should be between 0.65 and 0.80, with 0.70 being preferred. This is based on the principle of reducing the number of alarms on the monitoring interface while avoiding the mistaken compression of alarms with different root causes into the same object.

[0060] For example, when the same fault process triggers one protection action alarm, one trip alarm, two telemetry over-limit alarms, one waveform recording trigger alarm, and two remote signaling change alarms, the root cause compression device can merge these seven alarms into one root cause alarm object, while simultaneously saving the mapping relationship between this root cause alarm object and the seven original derived alarms. The monitoring interface can highlight only the root cause alarm object, and the relevant original alarm list can be expanded when maintenance personnel need to view details.

[0061] 7. Handling linkage device The handling linkage device is connected to the root cause compression device for outputting the root cause device, scope of impact, triggering sequence, related evidence, event level and suspected fault category based on the root cause alarm object, and generating corresponding handling suggestions.

[0062] The response linkage device includes an equipment positioning unit, a range assessment unit, an evidence aggregation unit, a level determination unit, and a suggestion generation unit.

[0063] The system comprises the following components: Equipment Location Unit: Identifies the root cause device, such as whether the fault source corresponds to a line, circuit breaker, main transformer, protection device, or communication switching equipment. Scope Assessment Unit: Determines the affected interval range, protection range, and communication range. Evidence Aggregation Unit: Extracts topological evidence, protection logic evidence, and communication path evidence to support the root cause determination, forming an evidence set available for maintenance personnel. Level Determination Unit: Generates an event level based on the importance of the root cause device, its impact range, propagation intensity, and the sufficiency of evidence. Recommendation Generation Unit: Outputs remote confirmation recommendations, video review recommendations, link investigation recommendations, protection verification recommendations, or on-site inspection recommendations according to the suspected fault category.

[0064] To ensure that the calculation of the event severity level has a clear basis, preferably, the root cause alarm object... Event Level Score Calculate as follows: in, Indicates the importance of root cause devices; Indicates the influence range coefficient; Indicates the degree of triggering timing anomalies; Indicates the sufficiency of relevant evidence; , , , Calculate weights for the levels, and satisfy the following conditions: .

[0065] In this embodiment, preferably, , , , The basis for this is that the priority of anomaly handling is mainly determined by the importance and scope of the root cause equipment, the triggering sequence anomaly degree is used to reflect the urgency of the event, and the sufficiency of evidence is used to ensure the credibility of the level output.

[0066] in, The determination rules are as follows: the spacing between busbars, main transformers, main incoming line bays and main outgoing line bays is 0.8 to 1.0; the spacing between ordinary feeder bays is 0.5 to 0.8; and the spacing between auxiliary equipment is 0.2 to 0.5. The number of affected intervals is determined by normalization to the proportion of the total number of intervals in the station; the number of intervals is determined based on the degree of deviation between the actual triggering sequence and the standard protection action sequence template. The determination is based on the proportion of satisfaction of topological evidence, protection logic evidence, communication evidence, and historical case evidence.

[0067] Preferably, the event levels are divided according to the following rules: when When this occurs, it is classified as a Level 1 event; when At that time, it was determined to be a level 2 event; when At that time, it was determined to be a level three event; when When an event occurs, it is classified as a Level 4 event. The above thresholds are determined based on the priority requirements for remote operation and maintenance, where Level 1 events correspond to immediate handling, Level 2 events correspond to priority handling, Level 3 events correspond to planned verification, and Level 4 events correspond to continuous observation.

[0068] For example, when the system determines that a primary equipment failure is affecting the main transformer bay, it is recommended that the generation unit prioritize generating on-site inspection suggestions and protection verification suggestions; when the system determines that a communication link is abnormal, it should prioritize generating link troubleshooting suggestions and remote confirmation suggestions.

[0069] 8. Feedback correction device The feedback correction device is data coupled with the handling linkage device, the root cause compression device, and the multi-domain causal analysis device. It is used to collect event handling results, manual review results, defect elimination records, and erroneous compression feedback information, and correct subsequent alarm causal backtracking strategies and compression handling parameters based on the collected results.

[0070] The feedback correction device includes a feedback acquisition unit, a knowledge storage unit, and a parameter correction unit.

[0071] The feedback collection unit is used to collect the handling results, manual review results, defect elimination records and erroneous compression feedback information corresponding to the root cause alarm object; the knowledge storage unit is used to bind and store the collected results with the root cause alarm object, the original derived alarm, and the multi-domain alarm causal chain to form a historical knowledge base; the parameter correction unit is used to update the event slicing rules, causal chain backtracking priority, root cause coverage judgment conditions and compression judgment conditions based on the feedback samples that have been stored in the database.

[0072] To ensure that the parameter correction process can be repeated, preferably, the following update rules are applied to the weight parameters and threshold parameters: in, Indicates the first Parameters to be corrected during wheel operation; This indicates the target parameters that were re-estimated based on the most recent batch of confirmed feedback samples; This represents the learning rate.

[0073] In this embodiment, The value is set between 0.05 and 0.20, with 0.10 being preferred. This is based on the principle that parameter adjustments should be able to gradually optimize with the accumulation of operational data, but should not cause drastic fluctuations due to a small number of occasional abnormal samples. Preferably, the target parameters are re-estimated using the most recent 20 to 50 sets of event samples that have completed closed-loop processing as a batch of feedback samples. .

[0074] The target parameters are determined as follows: aiming for high root cause identification accuracy, low false compression rate, and high manual review pass rate, the optimal values ​​are selected within a preset parameter search range. Preferably, the false compression rate is controlled below 5%, and the false negative rate is controlled below 10%.

[0075] For example, when a certain type of communication anomaly alarm is repeatedly confirmed by manual review to not be merged with a single fault alarm, the parameter correction unit adjusts the corresponding communication propagation weight or compression judgment conditions to reduce the probability of subsequent false compression; when the co-occurrence relationship between a certain type of protection action and fault recording is repeatedly confirmed as valid root cause evidence, the parameter correction unit increases its priority in root cause determination.

[0076] 9. Collaborative Interface Structure In this embodiment, the unattended substation also includes a collaborative interface device, which is communicatively connected to the remote monitoring center, the centralized control platform, and the operation and maintenance terminal. The collaborative interface device is used to receive the handling suggestions, root cause equipment information, impact range information, trigger timing information, and related evidence information generated by the handling linkage device, and to receive the confirmation results, review results, investigation results, and verification results from the remote monitoring center, the centralized control platform, and the operation and maintenance terminal. The results are then transmitted to the feedback correction device to form a closed-loop processing structure of alarm identification, compressed display, handling linkage, and feedback correction.

[0077] In unattended scenarios, since there are usually no long-term on-duty personnel in the station, the first round of anomaly identification and handling instructions are usually completed by the remote monitoring center or centralized control platform. Therefore, the collaborative interface device is used to realize information collaboration between the station and the master station, ensuring that the root cause alarm objects and handling suggestions can be pushed to the corresponding terminals in a timely manner, and the subsequent handling results are sent back to the feedback correction device.

[0078] 10. Summary of Default Parameter Values In this embodiment, the time decay constant in the event slicing device The preferred value is 5 seconds, which is the event merging threshold. Preferably 0.68; Causal propagation time constant in multi-domain causal analysis device Preferably 4s, causal edge threshold The preferred value is 0.60, which explains the coverage threshold. The preferred value is 0.80, the root cause confidence threshold. Preferably 0.72; compression determination threshold in the root cause compression device The preferred value is 0.70, for the event slice time window. The preferred value is 10s; the learning rate in the feedback correction device The preferred value is 0.10. The above parameters can be calibrated offline based on confirmed samples in the historical knowledge base, or dynamically corrected by combining online feedback results.

[0079] Example 2:

[0080] Based on the same inventive concept, this invention can also be implemented using a modular distributed deployment approach. Specifically, the multi-source alarm access device, alarm standardization device, and partial event slicing device are deployed on the station-side edge computing device; the three-domain correlation modeling device, multi-domain causal analysis device, root cause compression device, handling linkage device, and feedback correction device are deployed on the remote monitoring center server or centralized control platform server. The station-side is responsible for original alarm collection, time alignment, and preliminary slicing, while the main station is responsible for complex correlation modeling, root cause extraction, handling linkage, and feedback correction. This deployment method can also achieve the technical effects of this invention.

[0081] Example 3:

[0082] In another embodiment, the feedback correction device may update only some parameters. For example, during the initial deployment phase of the system, the event slicing rules and root cause coverage determination conditions are updated only based on the results of manual review; after the historical knowledge base has accumulated to a preset scale, the causal chain backtracking priority and compression determination conditions are further updated. This implementation method also falls within the protection scope of this invention.

[0083] The above embodiments provide a detailed description of the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An unattended substation based on alarm compression processing, characterized in that, It includes a multi-source alarm access device, an alarm standardization device, a three-domain correlation modeling device, an event slicing device, a multi-domain causal analysis device, a root cause compression device, a handling linkage device, and a feedback correction device; The multi-source alarm access device is used to access remote signaling change information, telemetry over-limit information, SOE sequence event information, protection action information, fault recording trigger information, communication abnormality information, and device self-test information within the station. The alarm standardization device is connected to the multi-source alarm access device and is used to perform unified time stamping, encoding mapping and semantic standardization processing on the accessed multi-source alarm information to generate a standardized alarm dataset. The three-domain association modeling device is data-connected to the alarm standardization device and is used to construct a primary equipment topology association model, a secondary protection action logic model, and a communication link mapping model based on the primary wiring relationship, equipment ledger information, protection configuration relationship, and communication network configuration relationship within the station. The event slicing device is data coupled to the alarm standardization device and the three-domain association modeling device, respectively, and is used to aggregate and segment the standardized alarm dataset based on time proximity, interval attribution, protection area attribution, and communication path attribution to generate alarm clusters to be analyzed. The multi-domain causal analysis device is data coupled to the event slicing device and the three-domain association modeling device, respectively, and is used to generate multi-domain alarm causal chains for each alarm cluster to be analyzed, and to perform reverse backtracking analysis on the multi-domain alarm causal chains to determine the source event node and the minimum root cause event set. The root cause compression device is connected to the multi-domain causal analysis device for merging derived alarms corresponding to the same minimum root cause event set into root cause alarm objects and establishing a mapping relationship between the root cause alarm objects and the original derived alarms. The handling linkage device is data-connected to the root cause compression device and is used to output the root cause device, scope of impact, triggering sequence, associated evidence, event level and suspected fault category based on the root cause alarm object, and generate corresponding handling suggestions. The feedback correction device is data coupled to the handling linkage device, the root cause compression device and the multi-domain causal analysis device, respectively, and is used to collect event handling results, manual review results, defect elimination records and erroneous compression feedback information, and correct subsequent alarm causal backtracking strategies and compression handling parameters based on the collected results.

2. The unattended substation based on alarm compression processing according to claim 1, characterized in that, The multi-source alarm access device includes: Remote signaling acquisition unit, telemetry acquisition unit, sequential event acquisition unit, protection information acquisition unit, waveform recording trigger acquisition unit, communication anomaly acquisition unit, and device self-test acquisition unit; The alarm standardization device includes a time alignment unit, an encoding conversion unit, and a semantic normalization unit; The time alignment unit is used to unify alarm information from different sources to the same timing reference. The encoding conversion unit is used to convert the original alarm codes output by different manufacturers and different devices into a unified internal code; The semantic normalization unit is used to map alarm content with different text descriptions to unified semantic tags, and write device identifiers, interval identifiers, protection area identifiers and communication link identifiers into the standardized alarm dataset.

3. The unattended substation based on alarm compression processing according to claim 1, characterized in that, The three-domain association modeling device includes: Topology modeling unit, protection logic modeling unit, and communication mapping modeling unit; The topology modeling unit is used to generate electrical connection relationships and bay assignment relationships between equipment within the station based on primary wiring relationships and equipment ledger information; The protection logic modeling unit is used to generate the action logic relationship between protection start-up, output trip, blocking and signal return based on the protection configuration relationship; The communication mapping modeling unit is used to generate link dependencies between monitoring hosts, measurement and control devices, protection devices, switches, and communication channels based on the communication network configuration relationship.

4. The unattended substation based on alarm compression processing according to claim 2, characterized in that: The event slicing device is used to first perform initial aggregation based on the time interval between adjacent alarms, and then perform secondary screening based on the interval identifier, protection area identifier, and communication link identifier in the standardized alarm dataset; Alarms corresponding to the same disturbance process are grouped into the same alarm cluster to be analyzed, and alarms with inconsistent electrical locations, inconsistent protection ranges, or inconsistent communication dependency paths are divided into different alarm clusters to be analyzed.

5. The unattended substation based on alarm compression processing according to claim 3, characterized in that, The multi-domain causality analysis device includes: Electrical propagation identification unit, action sequence identification unit, communication propagation identification unit, and causal chain fusion unit; The electrical propagation identification unit is used to identify the electrical connection propagation path between alarm nodes within the alarm cluster to be analyzed based on the primary equipment topology association model. The action sequence identification unit is used to identify the triggering sequence between protection start-up, action output, trip change and waveform recording trigger based on the secondary protection action logic model. The communication propagation identification unit is used to identify the propagation path of communication anomalies between devices, switching nodes, and communication channels based on the communication link mapping model. The causal chain fusion unit is used to fuse the electrical connection propagation path, action triggering sequence, and communication anomaly propagation path into a multi-domain alarm causal chain.

6. The unattended substation based on alarm compression processing according to claim 5, characterized in that, The multi-domain causality analysis device also includes: Reverse backtracking unit, coverage determination unit, and redundancy reduction unit; The reverse backtracking unit is used to start from the derived alarms in the alarm cluster to be analyzed and search for candidate source event nodes in reverse along the multi-domain alarm causal chain; The coverage determination unit is used to statistically analyze the interpretation coverage of each candidate source event node for the current alarm cluster to be analyzed. The redundancy reduction unit is used to cross-compare multiple candidate source event nodes, delete candidate nodes whose explanation scope is included, and output the minimum root cause event set used to explain the current alarm cluster to be analyzed.

7. The unattended substation based on alarm compression processing according to claim 6, characterized in that: The root cause compression device is used to group out-of-limit alarms, action alarms, lockout alarms, disconnection alarms and device malfunction alarms corresponding to the same minimum root cause event set into a single root cause alarm object. The mapping relationship stores the association number, alarm time, alarm type, source device identifier, and evidence chain location identifier between the root cause alarm object and each original derived alarm, in order to support compressed display, detailed expansion, and event tracing.

8. The unattended substation based on alarm compression processing according to claim 1, characterized in that, The handling linkage device includes: Equipment positioning unit, range assessment unit, evidence aggregation unit, level determination unit, and suggestion generation unit; The device positioning unit is used to identify the root cause device; The range assessment unit is used to determine the affected interval range, protection range, and communication range; The evidence aggregation unit is used to extract topological evidence, protection logic evidence, and communication path evidence that support root cause determination. The level determination unit is used to generate event levels; The suggestion generation unit is used to output remote confirmation suggestions, video review suggestions, link troubleshooting suggestions, protection verification suggestions, or on-site inspection suggestions according to the suspected fault category.

9. The unattended substation based on alarm compression processing according to claim 7, characterized in that, The feedback correction device includes: Feedback collection unit, knowledge storage unit, and parameter correction unit; The feedback collection unit is used to collect the handling results, manual review results, defect elimination records and erroneous compression feedback information corresponding to the root cause alarm object; The knowledge storage unit is used to bind and store the collected results with the root cause alarm object, the original derived alarm, and the multi-domain alarm causal chain; The parameter correction unit is used to update the event slicing rules, causal chain backtracking priority, root cause coverage determination conditions, and compression determination conditions based on the feedback samples that have been entered into the database.

10. The unattended substation based on alarm compression processing according to claim 9, characterized in that, It also includes collaborative interface devices: The collaborative interface device is connected to the remote monitoring center, the centralized control platform and the operation and maintenance terminal respectively, and is used to receive the disposal suggestions, root cause equipment information, impact range information, triggering sequence information and related evidence information generated by the disposal linkage device. It also receives confirmation results, review results, troubleshooting results, and verification results from the remote monitoring center, centralized control platform, and operation and maintenance terminal; The results are transmitted to the feedback correction device to form a closed-loop processing structure of alarm identification, compressed display, coordinated handling and feedback correction.

Images