CN114239866A - Power grid dispatching information flow abnormity and fault discrimination method - Google Patents

Abstract

The invention relates to the field of power grid dispatching fault identification, in particular to a method for judging abnormity and fault of power grid dispatching information flow, which comprises the following steps of 1: monitoring message data uploaded by a plant station, and acquiring message quintuple information and an IEC104 message of the message data; step 2: analyzing according to the message data, and splicing the acquired message analysis information into multi-dimensional sequence information S according to the timestamp; and step 3: importing the multidimensional sequence information S into a trained deep convolutional neural network, carrying out anomaly identification, and if no anomaly phenomenon exists, executing the step 1; otherwise, judging the error type through the message analysis information, and judging the fault. The method effectively realizes the quick judgment of the abnormal fault of the dispatching automation information flow, and is convenient for the operation and maintenance of the power dispatching automation system.

Description

Power grid dispatching information flow abnormity and fault discrimination method

Technical Field

The invention relates to the field of power grid dispatching fault identification, in particular to a method for judging abnormity and fault of power grid dispatching information flow.

Background

The appearance of the power dispatching automation system greatly improves the operation efficiency of the power industry in China, solves a plurality of problems faced by the power system and greatly promotes the rapid development of the power industry in China. Under the drive of the socioeconomic and scientific and technological development levels, the development of power dispatching automation has strong scientific and technological support, the dispatching level is gradually improved, a power dispatching data network is a special data network for power dispatching and production service, and the safe, stable and reliable operation of the power dispatching data network is the basic guarantee of the safety production of the whole power grid.

However, due to the fact that data are sent by mistake by a communication channel or a station master control device, a scheduling automation system sometimes has the problem of misinformation or information omission, many hidden defects are generated in an information flow, the accuracy of the data is damaged, and the operation and maintenance difficulty of operation and maintenance personnel of the power system is high; the existing document' quick fault location of a dispatching automation system, quick fault detection and sensitive waiting is disclosed to carry out abnormity judgment by carrying out remote measurement on an SCADA picture of the dispatching automation system and quickly checking the information quantity of remote signaling, but the reliability of the judged data is low, and manual analysis and operation and maintenance are needed if necessary.

In view of the above, to overcome the above drawbacks, a method for determining abnormal and faulty flow of power grid dispatching information is provided.

Disclosure of Invention

The invention aims to provide a method for judging the abnormal and fault of the dispatching information flow of a power grid, which effectively realizes the quick judgment of the abnormal fault of the dispatching automation information flow and is convenient for operating and maintaining an automatic power dispatching system.

In order to solve the technical problems, the technical scheme of the invention is as follows: a method for judging abnormity and fault of power grid dispatching information flow comprises the following steps:

step 1: monitoring message data uploaded by a plant station, and acquiring message quintuple information and an IEC104 message of the message data;

step 2: analyzing according to the message data, and splicing the acquired message analysis information into multi-dimensional sequence information S according to the timestamp;

and step 3: importing the multidimensional sequence information S into a trained deep convolutional neural network, carrying out anomaly identification, and if no anomaly phenomenon exists, executing the step 1; otherwise, judging the error type through the message analysis information, and judging the fault.

Preferably, the step of splicing the message parsing information into the multidimensional sequence information S is:

step 2.1: combining the obtained message analysis information into a sequence with the length of n, which is expressed as a sequence S¹={S₁,S₂,S₃,...,S_n}; wherein S is₁Represents the sequence S ¹1 st information of (1), S_nRepresents the sequence S¹The nth information of (1);

step 2.2: the obtained multidimensional sequence S¹With the preceding 4 sets of multidimensional sequences S⁰,S^-1,S^-2,S^-3The combination gave a multidimensional sequence S1, denoted S1= { S = }^-3,S^-2,S^-1,S⁰,S¹A dimension of 5 × n, 5 indicating the number of rows of the matrix S1, and n indicating the number of columns of the matrix S1; wherein the multidimensional sequence S⁰Representing the current multidimensional sequence S¹Of the last moment, denoted as S⁰={S₀,S₁,S₂,...,S_n-1}, multidimensional sequence S^-1,S^-2,S^-3And so on;

step 2.3: splicing the obtained multidimensional sequence S1 with the previous multidimensional sequence S0, S-1,.., S-m to obtain multidimensional sequence information S; wherein the multidimensional sequence S0 represents the multidimensional sequence at the last time instant of the current multidimensional sequence S1, as S0= { S = { (S) }^-4,S^-3,S^-2,S^-1,S⁰H, multidimensional sequences S0, S-1.

Preferably, the message five-tuple information includes a source port, a source IP, a destination port, a destination IP, and a sending time.

Preferably, the IEC104 message signal includes a remote control message, a remote signaling message, and a remote measurement message, where the remote control message includes: the remote control method comprises the steps of remotely controlling a selection message, a remote control execution message, a remote control cancellation message, a remote control response message and a remote control ending message.

Preferably, the error types include: the method comprises the following steps of frequent switching abnormity of a telecontrol device, frequent main station total calling abnormity, protocol false online fault, main station remote control failure fault and downlink command negative response fault.

Preferably, the method for determining the error type according to the message parsing information includes:

step A: and (3) judging the frequent switching abnormity of the telecontrol device, wherein the judging method comprises the following steps:

step A1: reading which station lower channel the IEC104 message transmission IP belongs to;

step A2: finding out other lower channel IP according to the station;

step A3: searching IP switching times of each channel within +/-5 s- +/-10 s in message analysis information;

step A4: if the switching times are more than 3, judging that the telecontrol device is frequently switched abnormally;

and B: and (3) judging the main station frequent total calling abnormity, wherein the judging method comprises the following steps:

step B1: reading whether a total calling message exists in the message analysis information of the IEC104 message within the previous 15 minutes;

step B2: if the total calling message exists, comparing the total calling message with the current total calling message, and judging whether a connection message exists in the two-time total calling message or not;

step B3: if the connection message exists, judging that the master station frequent total calling is abnormal;

and C: the protocol false online fault judgment is carried out by the following steps:

step C1: reading the telemetering information of each channel within 5s-10s in the message analysis information of the IEC104 message;

step C2: comparing whether the telemetering information changes or not;

step C3: if the protocol is not changed, judging that the protocol is a false online fault;

step D: and (3) judging remote control failure faults of the main station, wherein the remote control failure faults of the main station comprise remote control correction overtime faults and remote control failure faults, and the judging method comprises the following steps:

step D1: storing the remote control selection message and the message quintuple information into a set, and monitoring whether the remote control selection message is responded within 8 seconds;

step D2: if not, judging the remote control recalibration overtime fault; if so, executing step D3;

step D3: monitoring whether the remote control execution message or the remote control cancellation message is responded in 60s, and if not, indicating that the remote control state is finished; if yes, continuing to monitor whether the corresponding remote control response message exists within 8 seconds;

step D4: if not, judging the remote control recalibration overtime fault; if so, executing step D5;

step D5: monitoring whether the remote control end message exists within 8 seconds, and if not, judging that the remote control fails; if yes, continuing to monitor the next remote signaling message;

step D6: comparing whether the remote signaling message uploading value corresponds to the remote control message, if not, determining that the master station fails in remote control;

step E: and (3) judging the negative response fault of the downlink command, wherein the judging method comprises the following steps:

step E1: storing the request message and the message quintuple information into a set, and monitoring whether a corresponding response message exists within 8 seconds;

step E2: if yes, finishing the judgment, otherwise, judging that the downlink command does not answer the fault;

the steps A, B, C, D and E are synchronous arbitration or polling arbitration.

The invention has the following beneficial effects:

the method and the device identify whether an abnormal event occurs or not according to the multi-dimensional sequence of the message through the neural network, and judge the error type through message analysis information after the abnormal event is detected to obtain the specific type of the abnormal fault, so that the method and the device effectively realize the rapid judgment of the abnormal fault of the dispatching automation information flow, can monitor the abnormal fault events such as frequent switching abnormity of a telecontrol device, frequent total calling abnormity of a main station, protocol false online fault and the like, provide positioning decision support suggestions for operation and maintenance personnel, and eliminate potential safety hazards in the operation of a dispatching automation system;

the invention carries out multi-dimensional sequence combination on the message analysis data to obtain a three-dimensional matrix as a data base for abnormal judgment, so that the content information is richer and more comprehensive, and the judgment precision is improved.

Drawings

FIG. 1 is a flow chart of a method for determining power grid dispatching information flow abnormity and fault according to the present invention;

FIG. 2 is a schematic diagram of the deep convolutional neural network anomaly identification in the present invention;

FIG. 3 is a flowchart of a method for determining an abnormal frequent switching of a telemechanical device according to the present invention;

FIG. 4 is a flowchart of a method for judging the main station frequent total calling abnormality in the present invention;

FIG. 5 is a flowchart of a protocol false online fault determination method according to the present invention;

FIG. 6 is a flowchart of a protocol false online fault determination method according to the present invention;

FIG. 7 is a flowchart of a method for determining Negative Acknowledgement (NACK) failure in a downlink command.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in further detail with reference to the accompanying drawings and specific embodiments.

Referring to fig. 1 to 7, the present invention is a method for determining abnormal and faulty flow of power grid dispatching information, referring to fig. 1, the method includes the following steps:

step 1: monitoring message data uploaded by a plant station, and acquiring message quintuple information and an IEC104 message of the message data; the message five-tuple information comprises a source port, a source IP, a destination port, a destination IP and sending time; the IEC104 message signal comprises a remote control message, a remote signaling message and a remote measuring message, wherein the remote control message comprises: remote control selection message, remote control execution message, remote control cancellation message, remote control response message and remote control end message;

step 2: analyzing according to the message data, and splicing the acquired message analysis information into multi-dimensional sequence information S according to the timestamp; referring to fig. 2, the step of splicing the message parsing information into the multidimensional sequence information S is as follows:

step 2.1: combining the obtained message analysis information into a sequence with the length of n, which is expressed as a sequence S¹={S₁,S₂,S₃,...,S_n}; wherein S is₁Represents the sequence S ¹1 st information of (1), S_nRepresents the sequence S¹The nth information of (1);

step 2.2: the obtained multidimensional sequence S¹With the preceding 4 sets of multidimensional sequences S⁰,S^-1,S^-2,S^-3The combination gave a multidimensional sequence S1, denoted S1= { S = }^-3,S^-2,S^-1,S⁰,S¹A dimension of 5 × n, 5 indicating the number of rows of the matrix S1, and n indicating the number of columns of the matrix S1; wherein the multidimensional sequence S⁰Representing the current multidimensional sequence S¹Of the last moment, denoted as S⁰={S₀,S₁,S₂,...,S_n-1}, multidimensional sequence S^-1,S^-2,S^-3And so on;

step 2.3: splicing the obtained multidimensional sequence S1 with previous multidimensional sequences S0, S-1, a.and S-m to obtain multidimensional sequence information S, wherein m represents the number of the previous multidimensional sequences S1 used for splicing; wherein the multidimensional sequence S0 represents the multidimensional sequence at the last time instant of the current multidimensional sequence S1, as S0= { S = { (S) }^-4,S^-3,S^-2,S^-1,S⁰H, multidimensional sequences S0, S-1, S-m, and so on;

and step 3: importing the multidimensional sequence information S into a trained deep convolutional neural network, carrying out anomaly identification, and if no anomaly phenomenon exists, executing the step 1; otherwise, judging the error type through the message analysis information, and judging the fault.

As shown in fig. 2, compared with other abnormal recognition networks, the dimension of the input data of the deep convolutional neural network in the present invention is not fixed, and can be changed according to the change of the dimension of the data; the implementation has the advantage that a change condition of the power grid dispatching information flow can be transmitted into the abnormity identification model, so that the abnormity can be found by the model in time.

In this embodiment, the error types include a frequent switching abnormality of the telemechanical apparatus, a frequent total calling abnormality of the master station, a protocol false online fault, a remote control failure fault of the master station, and a downlink command negative response fault.

The method for judging the error type according to the message analysis information in the step 3 comprises the following steps:

step A: the determination of the abnormality of the frequent switching of the telemechanical device is performed by referring to fig. 3, and the determination method includes:

step A1: reading which station lower channel the IEC104 message transmission IP belongs to;

step A2: finding out other lower channel IP according to the station;

step A3: searching IP switching times of each channel within +/-5 s- +/-10 s in message analysis information;

step A4: if the switching times are more than 3, judging that the telecontrol device is frequently switched abnormally;

and B: and (3) judging the main station frequent total calling abnormity, referring to fig. 4, wherein the judging method comprises the following steps:

step B1: reading whether a total calling message exists in the message analysis information of the IEC104 message within the previous 15 minutes;

step B2: if no total calling message exists, the judgment can be ended; if the total calling message exists, comparing the total calling message with the current total calling message, and judging whether a connection message exists in the two-time total calling message or not;

step B3: if no connection message exists, the judgment can be ended; if the connection message exists, judging that the master station frequent total calling is abnormal;

and C: and (3) judging the protocol false online fault, and referring to fig. 5, the judging method comprises the following steps:

step C1: reading the telemetering information of each channel within 5s-10s in the message analysis information of the IEC104 message;

step C2: comparing whether the telemetering information changes or not;

step C3: if the change occurs, the judgment is finished; if the protocol is not changed, judging that the protocol is a false online fault;

step D: and (3) judging remote control failure faults of the main station, wherein the remote control failure faults of the main station comprise remote control returning and correcting overtime faults and remote control failure faults, and referring to the figure 6, the judging method comprises the following steps:

step D1: storing the remote control selection message and the message quintuple information into a set, and monitoring whether the remote control selection message is responded within 8 seconds;

step D2: if not, judging the remote control recalibration overtime fault; if so, executing step D3;

step D3: monitoring whether the remote control execution message or the remote control cancellation message is responded in 60s, and if not, indicating that the remote control state is finished; if yes, continuing to monitor whether the corresponding remote control response message exists within 8 seconds;

step D4: if not, judging the remote control recalibration overtime fault; if so, executing step D5;

step D5: monitoring whether the remote control end message exists within 8 seconds, and if not, judging that the remote control fails; if yes, continuing to monitor the next remote signaling message;

step D6: comparing whether the remote signaling message uploading value corresponds to the remote control message, if not, determining that the master station fails in remote control;

step E: and (3) judging the negative response fault of the downlink command, and referring to fig. 7, the judging method comprises the following steps:

step E1: storing the request message and the message quintuple information into a set, and monitoring whether a corresponding response message exists within 8 seconds;

step E2: if yes, finishing the judgment, otherwise, judging that the downlink command does not answer the fault;

the discrimination methods of the steps A, B, C, D and E have no hierarchical division, and are synchronous discrimination or polling discrimination, namely after one of the abnormal fault discrimination methods is finished, other types of abnormal fault discrimination methods can be carried out; or the above various abnormal fault discrimination methods can be carried out simultaneously to find out the accurate abnormal fault type.

The parts not involved in the present invention are the same as or implemented using the prior art.

The foregoing is a more detailed description of the present invention that is presented in conjunction with specific embodiments, and the practice of the invention is not to be considered limited to those descriptions. For those skilled in the art to which the invention pertains, several simple deductions or substitutions can be made without departing from the spirit of the invention, and all shall be considered as belonging to the protection scope of the invention.

Claims (6)

1. A method for judging abnormity and fault of power grid dispatching information flow is characterized in that: comprises that

Step 1: monitoring message data uploaded by a plant station, and acquiring message quintuple information and an IEC104 message of the message data;

step 2: analyzing according to the message data, and splicing the acquired message analysis information into multi-dimensional sequence information S according to the timestamp;

and step 3: importing the multidimensional sequence information S into a trained deep convolutional neural network, carrying out anomaly identification, and if no anomaly phenomenon exists, executing the step 1; otherwise, judging the error type through the message analysis information, and judging the fault.

2. The method for distinguishing the abnormal and fault of the power grid dispatching information flow according to claim 1, wherein: the step of splicing the message analysis information into the multidimensional sequence information S is as follows:

step 2.1: combining the obtained message analysis information into a sequence with the length of n, which is expressed as a sequence S¹={S₁,S₂,S₃,...,S_n}; wherein S is₁Represents the sequence S¹The 1 st letter ofInformation, S_nRepresents the sequence S¹The nth information of (1);

step 2.2: the obtained multidimensional sequence S¹With the preceding 4 sets of multidimensional sequences S⁰,S^-1,S^-2,S^-3The combination gave a multidimensional sequence S1, denoted S1= { S = }^-3,S^-2,S^-1,S⁰,S¹A dimension of 5 × n, 5 indicating the number of rows of the matrix S1, and n indicating the number of columns of the matrix S1; wherein the multidimensional sequence S⁰Representing the current multidimensional sequence S¹Of the last moment, denoted as S⁰={S₀,S₁,S₂,...,S_n-1}, multidimensional sequence S^-1,S^-2,S^-3And so on;

step 2.3: splicing the obtained multidimensional sequence S1 with the previous multidimensional sequence S0, S-1,.., S-m to obtain multidimensional sequence information S; wherein the multidimensional sequence S0 represents the multidimensional sequence at the last time instant of the current multidimensional sequence S1, as S0= { S = { (S) }^-4,S^-3,S^-2,S^-1,S⁰H, multidimensional sequences S0, S-1.

3. The method for distinguishing the abnormal and fault of the power grid dispatching information flow according to claim 1, wherein: the message five-tuple information comprises a source port, a source IP, a destination port, a destination IP and sending time.

4. The method for distinguishing the abnormal and fault of the power grid dispatching information flow according to claim 1, wherein: the IEC104 message signal comprises a remote control message, a remote signaling message and a remote measuring message, wherein the remote control message comprises: the remote control method comprises the steps of remotely controlling a selection message, a remote control execution message, a remote control cancellation message, a remote control response message and a remote control ending message.

5. The method for distinguishing the abnormal and fault of the power grid dispatching information flow according to claim 1, wherein: the error types include: the method comprises the following steps of frequent switching abnormity of a telecontrol device, frequent main station total calling abnormity, protocol false online fault, main station remote control failure fault and downlink command negative response fault.

6. The method for distinguishing the abnormal and fault of the power grid dispatching information flow according to claim 5, wherein: the method for judging the error type according to the message analysis information comprises the following steps:

step A: and (3) judging the frequent switching abnormity of the telecontrol device, wherein the judging method comprises the following steps:

step A1: reading which station lower channel the IEC104 message transmission IP belongs to;

step A2: finding out other lower channel IP according to the station;

step A3: searching IP switching times of each channel within +/-5 s- +/-10 s in message analysis information;

step A4: if the switching times are more than 3, judging that the telecontrol device is frequently switched abnormally;

and B: and (3) judging the main station frequent total calling abnormity, wherein the judging method comprises the following steps:

step B1: reading whether a total calling message exists in the message analysis information of the IEC104 message within the previous 15 minutes;

step B2: if the total calling message exists, comparing the total calling message with the current total calling message, and judging whether a connection message exists in the two-time total calling message or not;

step B3: if the connection message exists, judging that the master station frequent total calling is abnormal;

and C: the protocol false online fault judgment is carried out by the following steps:

step C1: reading the telemetering information of each channel within 5s-10s in the message analysis information of the IEC104 message;

step C2: comparing whether the telemetering information changes or not;

step C3: if the protocol is not changed, judging that the protocol is a false online fault;

step D: and (3) judging remote control failure faults of the main station, wherein the remote control failure faults of the main station comprise remote control correction overtime faults and remote control failure faults, and the judging method comprises the following steps:

step D1: storing the remote control selection message and the message quintuple information into a set, and monitoring whether the remote control selection message is responded within 8 seconds;

step D2: if not, judging the remote control recalibration overtime fault; if so, executing step D3;

step D3: monitoring whether the remote control execution message or the remote control cancellation message is responded in 60s, and if not, indicating that the remote control state is finished; if yes, continuing to monitor whether the corresponding remote control response message exists within 8 seconds;

step D4: if not, judging the remote control recalibration overtime fault; if so, executing step D5;

step D5: monitoring whether the remote control end message exists within 8 seconds, and if not, judging that the remote control fails; if yes, continuing to monitor the next remote signaling message;

step D6: comparing whether the remote signaling message uploading value corresponds to the remote control message, if not, determining that the master station fails in remote control;

step E: and (3) judging the negative response fault of the downlink command, wherein the judging method comprises the following steps:

step E1: storing the request message and the message quintuple information into a set, and monitoring whether a corresponding response message exists within 8 seconds;

step E2: if yes, finishing the judgment, otherwise, judging that the downlink command does not answer the fault;

the steps A, B, C, D and E are synchronous arbitration or polling arbitration.

Images