# Substation Operation Information Maintenance Based on Intelligent Data Mining

Authors: Songtao Zhang; Guijun Yuan
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

In order to solve the problems of redundancy of substation operation information, diversification of monitoring system versions, and heterogeneous data, the author proposes a remote-based intelligent data mining system for substation automation. Use data mining technology to classify and standardize the original alarm data, and associate it with the equipment ledger system to obtain a data warehouse of equipment parameters, status information, and related historical fault information. On this basis, the improved Apriori algorithm is used to extract strong association rules that satisfy the minimum trust threshold from the data warehouse, which provides decision-making basis for the operation and maintenance management of substation equipment. Experimental results show that using the improved Apriori algorithm to perform data mining on the substation operation alarm information in 143 intervals of a power supply bureau substation, the following strong association rules are obtained: association rule 1, “handcart test position ∩ device running alarm ∩ alarm signal has been reset interval debugging and maintenance”,γsupport=57%, γconfidence=69%, and association rule 2, “Protection action∩ switch sectional position ∩ reclosing action ∩ total accident (hold) ∩ switch sectional signal has been reset ∩ reclosing action signal has been reset ∩ total accident (hold) signal has been reset Temporary equipment failure”, γsupport=41%, γconfidence=79%. The effectiveness of the proposed data mining method is verified by a field case.


---

## Body

## 1. Introduction

With the development of economy and society, the scale of modern power system is getting larger and larger, and power quality has received more attention. Voltage is an important indicator to measure power quality. With the change of grid load, the main reason for the decline of voltage quality is the insufficient, excess, or unreasonable distribution of reactive power in the system. The voltage quality is closely related to the system reactive power: if the reactive power of the system is insufficient, it will cause the reduction of the system voltage quality and the increase of the network loss; if the reactive power of the system is excessive, the operating voltage of the system will increase and the transmission capacity will decrease, which will affect the safety and stability of the system; it is not conducive to the operation and scheduling of the power grid. In modern power system, reactive power and voltage control is a very important problem. If the voltage quality is not guaranteed, it will not only make the network loss too large but also threaten the safe and stable operation of the system and even cause serious power outages or voltage collapses. Therefore, the qualified voltage quality is of great significance to the safe and stable operation of the power system, ensuring the quality of power supply, reducing network losses, and saving electric energy [1]. The substation-integrated automation system can perform unified monitoring, management, and control of the equipment and microcomputer protection in the substation, conduct real-time and effective information exchange and information sharing with the power grid dispatching automation system, optimize the power grid operation, and improve the safe and stable operation level of the power grid. The basic functions of the substation-integrated automation system are data acquisition, operation detection and control, relay protection, data communication, etc. The substation automation technology is the key to realize the transformation of the substation from manned to unmanned; the various subsystems of the substation-integrated automation system are interconnected through a computer network to exchange information and share data with each other, so as to monitor, manage, coordinate and control the operation of the substation, and improve the protection and control performance of the substation; it makes the operation of the substation more stable and reliable, and at the same time, it can reduce the operating personnel and floor space of the substation, reduce the operation and maintenance cost of the substation, improve the economic benefits of the power system, and improve the management level of the power grid.


## 2. Literature Review

In response to this research problem, Nyebuchi aimed at the problem of inaccurate raw data in line loss calculation; the line loss calculation scheme is designed using the cluster analysis method in the data mining technology, which realizes the preprocessing of the original data involved in the line loss calculation and ensures the accuracy and completeness of the original data, and at the same time, aiming at the incompleteness of the original data, a replacement method for missing values is proposed to make it closer to the actual data [2]. Nekovar et al. used cluster analysis to explore methods for short-term load forecasting. Uncertainty theory methods include neural networks, rough set theory, fuzzy logic, and Bayesian networks [3]. Wang et al. used neural network to conduct clustering research on coincidence curve and transformer fault classification, respectively. Machine learning includes inductive learning methods, case-based learning, and genetic algorithms [4]. Gusev et al. applied data mining technology to improve the reactive power optimization algorithm and established a global reactive power optimization mathematical model. Database methods mainly include attribute-oriented induction methods and multidimensional database analysis methods [5]. Aiming at the current situation that a large amount of data in the power system cannot be effectively used, Zhao et al. proposed a data warehouse-based method for sorting, extracting, purifying, and transforming existing data, which can provide fast and efficient decision support systems and solutions for efficient data response [6]. Chen et al. compared the performance of data mining technology using fuzzy inference system and traditional methods in short-term load forecasting; the analysis shows that the data mining technology using the fuzzy inference system can better conform to the actual situation of power production in the prediction [7]. Zhou applied data mining technology to predict the electricity price successfully [8]. Sornalakshmi et al. established a multi-Bayesian-support vector machine, combined classifier and a decision tree classifier, and compared the classification accuracy and classification speed, in order to achieve a certain degree of auxiliary decision-making for smart substations [9].Aiming at the characteristics of substation operation information redundancy, monitoring system version diversity, data heterogeneity, etc., taking the substation automation information system of the regional power grid as the research object, the remote-based data mining technology is used to mine the massive alarm information of each substation [10]. Based on the analysis and deconstruction of the alarm data source of the monitoring system, according to the characteristics and operation requirements of the regional power grid substation automation information system, the data mining system architecture is constructed, and the application of the association rules based on the improved Apriori algorithm, such as extraction technology, event query and statistics, historical fault database, and expert database module, is introduced. Finally, the feasibility and effectiveness of the association rule mining technology and mining system proposed by the author are verified by actual engineering cases.


## 3. Research Methods

### 3.1. Data Mining Technology Based on Association Rules

Association rule mining is mainly used to discover interesting associations or correlations between items or attributes in a database, that is, the process of identifying frequently occurring attribute sets from the data set, also known as frequent itemsets, and then using these frequent itemsets to describe and create association rules. Association rules are not based on properties inherent in the data itself (such as functional dependencies), but on the cooccurrence of data items.


#### 3.1.1. Mining Definition of System Association Rules

The basic definitions of association rules are given below:Definition 1.
The record set mined by association rules is recorded asD (transaction database), and D=t1,t2,t3,⋯,tk,⋯,tn and tk=i1,i2,i3,⋯,ij,⋯,ipk=1,2,3,⋯,n are a transaction; elements ijj=1,2,3,⋯,n in tk are called itemsets.Definition 2.
LetI=i1,i2,i3,⋯,ij,⋯,im be the set of all items in D, any subset A of I is called the itemset in D, and X=k is called the set X which is the itemset of k. Let tk and X be transactions and itemsets in D, respectively; if X⊆tk, transaction CC is said to contain itemset X.Definition 3.
The essence of association rules is the implication in the form ofX⟹Y, where X⊂I,Y⊂I,X∩Y=∅ and ∅ are empty sets. Rule A⟹B has confidence c in transaction set D; if the percentage of D that contains A transaction also contains B is c, then it is the conditional probability PBA. That is, the support degree is the following:
(1)supportA⇒B=PA∪B.
The confidence level is the following:(2)confidenceA⇒B=PBA=support_countA∪Bsupport_countA.
Among them,support_countA∪B is the number of records containing itemset A∪B; support_countA is the number of transaction records containing itemset A.Definition 4 (supportγsupport).
The support degree of the association ruleX⟹Y is the proportion of transactions that the transaction database D contains X∪Y, which is represented by PX∪Y, that is, γsupportX⟹Y=PX∪Y. For example, X is the worker who repairs the transformer, Y is the worker who repairs the capacitor, and D is the various types of workers; then, γsupport is the proportion of the workers who only need to participate in one of the two inspections.Definition 5 (confidenceγconfidence).
The confidence level of the association ruleX⟹Y is the percentage that D contains X transactions and also contains Y transactions, which is represented by PX∣Y, that is, γconfidenceX⟹Y=PX∣Y. Same as the example of Definition 4, at this time γconfidence represents the proportion of employees who are involved in overhauling both transformers and capacitors. Support and confidence are two important concepts to describe association rules; the statistical importance of association rules in the entire data set is mainly measured by support, while confidence is used to measure the credibility of association rules. For example, overhauling transformers and overhauling capacitors, γsupport=20%, γconfidence=50%, that is, a support degree of 20% means that the employees involved in overhauling transformers or capacitors account for 20% of all the transactions analyzed. A confidence level of 50% means that 50% of the staff involved in overhauling transformers also overhauled capacitors.Definition 6.
Define the minimum supportγsupport,min and the minimum confidence γconfidence,min. In order to meet certain requirements, general users need to specify the support and corresponding confidence thresholds required by the rules to meet the conditions; that is, γsupportX⟹Y and γconfidenceX⟹Y are greater than or equal to their respective thresholds, which are called the minimum support threshold γsupport,min and the minimum confidence threshold γconfidence,min, respectively.Definition 7 (strong association rules).
If the association ruleX⟹Yin the transaction database D satisfies that γsupportX⟹Y is greater than or equal to γsupport,min and γconfidenceX⟹Y is greater than or equal to γconfidence,min, then the association rule X⟹Yis called a strong association rule.


#### 3.1.2. Classification of Association Rules of the System

In order to be able to determine specific mining methods, such as data classification, clustering, and rule extraction, the classification of association rules is necessary. Several classifications are introduced below and cases are attached for intuitive understanding.The categories of rule-based processing variables can be divided into Boolean and quantified. Boolean association rules are mainly used for the existence or nonexistence of associated items, and they deal with classified and discretized data. For example, a capacitor failure and transformer failure, the associated fault relationship belongs to the Boolean association rule. The fault association rules are extracted by the author from substation alarm information; most of them belong to Boolean association rules. Quantitative association rules can be used in combination with multilayer or multidimensional association rules by dynamically dividing numerical fields or directly processing raw data. For example, if the line frequency is too high frequencyf=65Hz, the system frequency involved is of numerical type, which belongs to the numerical association rule.Based on the different levels of abstraction in the alarm signal, it can be divided into single-layer and multilayer association rules. For example, for trip protection device capacitor, variable does not take into account that the data has multiple different levels; it is a single-level association rule on detailed data. The protection device ABB transformer is a multilayer association rule between higher level and detail level, and the multilayer nature of the data has been fully considered.Based on the different dimensions of the alarm information data structure involved, the association rules can also be divided into single-dimensional and multidimensional association rules. In the single-dimensional association rule, only one dimension of the alarm information is involved, such as the equipment type of the substation: capacitor protection device. Multidimensional association rules deal with the relationship between multiple attributes. For example, the rule that primary equipment is equal to “circuit breaker”⟹ secondary equipment “protection device” contains two fields of information, which belong to the association rules in two dimensions. In addition, there are multidimensional association rules.


#### 3.1.3. Improved Apriori Algorithm

This paper focuses on the algorithm based on hierarchical partitioning technology, such as the DIC algorithm. The DIC algorithm mainly logically divides the transactions in the transaction databaseD into N nonoverlapping intervals and then places these intervals in the memory for processing, which can speed up the operation rate of the algorithm. When the DIC algorithm scans the database D for the first time, the database is divided into I table areas according to some partition characteristics of the database, and count the local frequent itemsets Cik of each data area Dk1≤k≤i to form local candidate itemsets, and then repeat the algorithm until all local frequent itemsets are determined and the global frequent itemsets Ci are formed. The number of times the DIC algorithm scans the database is much smaller than that of the Apriori algorithm; if the data slices are properly divided, the DIC algorithm only needs to scan the database twice to obtain all frequent itemsets. Although the candidate itemsets generated by the DIC algorithm may be relatively large, and the accuracy of the frequent itemsets determined by the DIC algorithm cannot reach the labeling of the Apriori algorithm, the DIC algorithm has a high degree of parallelism and can reduce the number of scans and reduce the frequency of I/O operation, thereby improving the efficiency of the algorithm.


#### 3.1.4. Information Mining Process of System Association Rules

For massive alarm information of substations, with the problems of mass, redundancy, uncertainty, etc., it is very important to formulate a set of accurate and effective mining process. According to the characteristics of substation alarm information, the process steps are as follows:Preprocessing of raw alarm information: because the original alarm information and point table information (various quantities collected by field devices) directly derived from each substation are massive, the efficiency of the entire association rule extraction depends to a large extent on the preprocessing of the data.Preprocess data: the redundancy of the alarm information is reduced and the accuracy is increased, which will better guarantee the extraction of strong association rules later.Association rule formulation: at this stage, the same type of association rules will be formulated according to the characteristics and categories of the alarm information, and the failure mode will be found from the massive information, and the mode will be described as a method that is easy for technicians to understand.Expert analysis: the association rules formulated in the previous step are used to traverse new alarm information, and the association rules are evaluated and confidence levels are established for them, so that the accuracy of the data mining strategy of the system can be continuously improved.Knowledge formation: during system testing, technicians will continuously evaluate and make statistics on the established association rules and finally form a knowledge that can assist the stable operation of the power system and be commonly recognized. The above process can be represented by Figure1.Figure 1
Information mining flow chart of system association rules (high-end).


### 3.2. System Hierarchy Analysis

#### 3.2.1. Overall Design of the System

The author first studies the characteristics of the information flow (source) of the substation, the composition format of the primary (secondary) system information, and the expert knowledge (procedure data) for fault handling; on this basis, integrate search engine tools and database management tools, and transform according to traditional search engines to capture data, process data, provide retrieval services, and develop a professional data search engine for substations; it is used to construct power system fault information data mining system. The system is mainly divided into raw data collection, data extraction, refinement, data warehouse, data mining, and data presentation layer, and its overall design is shown in Figure2.Figure 2
Overall design of the system.The original data collection is mainly to collect the substation alarm information of each substation into the database. The essence of data extraction is to eliminate redundant alarm information, extract only its valid part, and, after preprocessing the alarm information, transfer the data to the data warehouse of the dispatch center for backup and partition. The data mining layer mainly includes application functions of expert database, rule query, and historical fault database. The data presentation layer mainly includes basic conditional search and statistical functions.


#### 3.2.2. Unified Acquisition and Integration of Heterogeneous Data

The power system, especially the substation, has a complex structure, and the original warning information that needs to be processed is huge. Taking a power supply bureau as an example, its substation automation systems have all used self-developed dedicated power system databases, or with the help of large commercial database systems, but most of them are independently developed relying on their respective subsystems; it is difficult to realize data sharing among various systems. The alarm history data from different substation monitoring systems require different preprocessing.Therefore, in order to mine the massive data of substations, it is necessary to unify the historical alarm information of each substation (substation) automation system into a whole [11]. Although the structure of each substation system is diverse, there are many commonalities in these massive data information. Based on the remote historical alarm data acquisition, in addition to dealing with the connection and acquisition of the historical databases of each substation, the most critical issue is the unified acquisition and integration of heterogeneous data [12].The system adopts the polling method; using the remote database connection technology, the historical alarms of each substation are polled and extracted, and the historical alarms of each substation are passed through the alarm processing subroutine; unified transformations are inserted into the system’s local database, as shown in Figure3.Figure 3
Based on remote raw alert acquisition.Under the condition of digital substation, various monitoring data of substation are highly integrated according to technical regulations such as IEC61970/IEC61850 protocol; the system comprehensively analyzes the substation alarm information and proposes a substation operation abnormal processing plan.


### 3.3. System Function Realization

In the actual operation of substations, dispatchers often need to manually query and count real-time alarm information; at the same time, they also need to analyze this information with solidified expert rules to monitor system failures [13, 14]. Therefore, the system is mainly divided into three functional modules: event query and statistics, expert analysis, and historical fault database. The author mainly introduces the first two modules here, and their functional modules are shown in Figure 4.Figure 4
System function module diagram.


#### 3.3.1. Event Query and Statistics Module

This module is mainly used to realize the query and statistics of alarm information, the dispatcher only needs to select the query scope and query conditions, and then the query function of the alarm information can be performed. Query is divided into basic query and advanced query [15]. The advanced query function of the system is based on the expert rule base query, and its main purpose is to apply the conditions of the solidified rules to traverse the alarm information twice to determine the possibility of faults [16]. The query based on the expert rule base is a composite alarm query with multiple conditions, and the composite alarm query requires multiple nested queries, so the temporary query results need to be stored in a temporary database or a memory table; each condition filters out matching records in the previous condition’s table.The condition of the advanced search function can be defined as a list object:γlist{rule condition, logic constraint, time constraint, frequency}.The rule condition is a specific alarm string, corresponding to each specific alarm. The difficulty of advanced search lies in the logical constraints, time constraints, and frequency constraints between these specific alarms. The basic flow of the advanced query function is shown in Figure5.Figure 5
Basic process of advanced query.The system divides advanced query conditions into rule linked lists, whose conditions are rule strings and logical linked lists, which contain logical constraints, time constraints, and frequency constraints [17]. First, apply each query condition to query the historical alarm table, and save the output query result in the temporary result table. Then, match the records in the temporary result table according to the conditions in the constraint list, traverse all the constraints, and combine the results that meet all the condition output to search results. In addition to the event query function, this module can also perform statistical analysis on specific alarm signals and generate statistical reports according to the needs of dispatchers [18]. Since the substation in this area is located in the coastal area, large-scale lines or equipment in the station is prone to trip due to typhoon season; when the dispatcher conducts statistical analysis on the fault, they need to obtain a large amount of data from the substation monitoring system, in order to register and handle specific switch trip alarm information. The query function developed by this system can assist operators to quickly collect statistics on specific alarm information and provide reports in the professional format of the power system, which greatly reduces the workload of system operators and improves the ability to handle and analyze accidents.


#### 3.3.2. Expert Analysis Module

The expert analysis module is through the formulation and improvement of association rules, the preprocessed alarm information is traversed using the mined association rules, and a specific alarm sequence is discovered; its functional modules are shown in Figure6.Figure 6
Functions of the expert analysis module.The alarm sequence is extracted from the system information database, the data sequence is defined by the association rule principle described above, and the established association rules are put into the expert database to complete the construction of the expert knowledge system. During the operation of the system, through the use of the established rules by the technicians, the association rules are constantly self-improving and self-learning. Depending on the confidence, expert rules can define rule states for specific patterns (alert sequences), including normal, concerned, critically concerned, faulty, and overhauled. Therefore, through the expert analysis of the established expert rules, the pattern (alarm sequence) corresponding to the rule is found from the historical database, so as to complete the identification of the state type and then mine the historical operation information of the substation [19].


## 3.1. Data Mining Technology Based on Association Rules

Association rule mining is mainly used to discover interesting associations or correlations between items or attributes in a database, that is, the process of identifying frequently occurring attribute sets from the data set, also known as frequent itemsets, and then using these frequent itemsets to describe and create association rules. Association rules are not based on properties inherent in the data itself (such as functional dependencies), but on the cooccurrence of data items.


### 3.1.1. Mining Definition of System Association Rules

The basic definitions of association rules are given below:Definition 1.
The record set mined by association rules is recorded asD (transaction database), and D=t1,t2,t3,⋯,tk,⋯,tn and tk=i1,i2,i3,⋯,ij,⋯,ipk=1,2,3,⋯,n are a transaction; elements ijj=1,2,3,⋯,n in tk are called itemsets.Definition 2.
LetI=i1,i2,i3,⋯,ij,⋯,im be the set of all items in D, any subset A of I is called the itemset in D, and X=k is called the set X which is the itemset of k. Let tk and X be transactions and itemsets in D, respectively; if X⊆tk, transaction CC is said to contain itemset X.Definition 3.
The essence of association rules is the implication in the form ofX⟹Y, where X⊂I,Y⊂I,X∩Y=∅ and ∅ are empty sets. Rule A⟹B has confidence c in transaction set D; if the percentage of D that contains A transaction also contains B is c, then it is the conditional probability PBA. That is, the support degree is the following:
(1)supportA⇒B=PA∪B.
The confidence level is the following:(2)confidenceA⇒B=PBA=support_countA∪Bsupport_countA.
Among them,support_countA∪B is the number of records containing itemset A∪B; support_countA is the number of transaction records containing itemset A.Definition 4 (supportγsupport).
The support degree of the association ruleX⟹Y is the proportion of transactions that the transaction database D contains X∪Y, which is represented by PX∪Y, that is, γsupportX⟹Y=PX∪Y. For example, X is the worker who repairs the transformer, Y is the worker who repairs the capacitor, and D is the various types of workers; then, γsupport is the proportion of the workers who only need to participate in one of the two inspections.Definition 5 (confidenceγconfidence).
The confidence level of the association ruleX⟹Y is the percentage that D contains X transactions and also contains Y transactions, which is represented by PX∣Y, that is, γconfidenceX⟹Y=PX∣Y. Same as the example of Definition 4, at this time γconfidence represents the proportion of employees who are involved in overhauling both transformers and capacitors. Support and confidence are two important concepts to describe association rules; the statistical importance of association rules in the entire data set is mainly measured by support, while confidence is used to measure the credibility of association rules. For example, overhauling transformers and overhauling capacitors, γsupport=20%, γconfidence=50%, that is, a support degree of 20% means that the employees involved in overhauling transformers or capacitors account for 20% of all the transactions analyzed. A confidence level of 50% means that 50% of the staff involved in overhauling transformers also overhauled capacitors.Definition 6.
Define the minimum supportγsupport,min and the minimum confidence γconfidence,min. In order to meet certain requirements, general users need to specify the support and corresponding confidence thresholds required by the rules to meet the conditions; that is, γsupportX⟹Y and γconfidenceX⟹Y are greater than or equal to their respective thresholds, which are called the minimum support threshold γsupport,min and the minimum confidence threshold γconfidence,min, respectively.Definition 7 (strong association rules).
If the association ruleX⟹Yin the transaction database D satisfies that γsupportX⟹Y is greater than or equal to γsupport,min and γconfidenceX⟹Y is greater than or equal to γconfidence,min, then the association rule X⟹Yis called a strong association rule.


### 3.1.2. Classification of Association Rules of the System

In order to be able to determine specific mining methods, such as data classification, clustering, and rule extraction, the classification of association rules is necessary. Several classifications are introduced below and cases are attached for intuitive understanding.The categories of rule-based processing variables can be divided into Boolean and quantified. Boolean association rules are mainly used for the existence or nonexistence of associated items, and they deal with classified and discretized data. For example, a capacitor failure and transformer failure, the associated fault relationship belongs to the Boolean association rule. The fault association rules are extracted by the author from substation alarm information; most of them belong to Boolean association rules. Quantitative association rules can be used in combination with multilayer or multidimensional association rules by dynamically dividing numerical fields or directly processing raw data. For example, if the line frequency is too high frequencyf=65Hz, the system frequency involved is of numerical type, which belongs to the numerical association rule.Based on the different levels of abstraction in the alarm signal, it can be divided into single-layer and multilayer association rules. For example, for trip protection device capacitor, variable does not take into account that the data has multiple different levels; it is a single-level association rule on detailed data. The protection device ABB transformer is a multilayer association rule between higher level and detail level, and the multilayer nature of the data has been fully considered.Based on the different dimensions of the alarm information data structure involved, the association rules can also be divided into single-dimensional and multidimensional association rules. In the single-dimensional association rule, only one dimension of the alarm information is involved, such as the equipment type of the substation: capacitor protection device. Multidimensional association rules deal with the relationship between multiple attributes. For example, the rule that primary equipment is equal to “circuit breaker”⟹ secondary equipment “protection device” contains two fields of information, which belong to the association rules in two dimensions. In addition, there are multidimensional association rules.


### 3.1.3. Improved Apriori Algorithm

This paper focuses on the algorithm based on hierarchical partitioning technology, such as the DIC algorithm. The DIC algorithm mainly logically divides the transactions in the transaction databaseD into N nonoverlapping intervals and then places these intervals in the memory for processing, which can speed up the operation rate of the algorithm. When the DIC algorithm scans the database D for the first time, the database is divided into I table areas according to some partition characteristics of the database, and count the local frequent itemsets Cik of each data area Dk1≤k≤i to form local candidate itemsets, and then repeat the algorithm until all local frequent itemsets are determined and the global frequent itemsets Ci are formed. The number of times the DIC algorithm scans the database is much smaller than that of the Apriori algorithm; if the data slices are properly divided, the DIC algorithm only needs to scan the database twice to obtain all frequent itemsets. Although the candidate itemsets generated by the DIC algorithm may be relatively large, and the accuracy of the frequent itemsets determined by the DIC algorithm cannot reach the labeling of the Apriori algorithm, the DIC algorithm has a high degree of parallelism and can reduce the number of scans and reduce the frequency of I/O operation, thereby improving the efficiency of the algorithm.


### 3.1.4. Information Mining Process of System Association Rules

For massive alarm information of substations, with the problems of mass, redundancy, uncertainty, etc., it is very important to formulate a set of accurate and effective mining process. According to the characteristics of substation alarm information, the process steps are as follows:Preprocessing of raw alarm information: because the original alarm information and point table information (various quantities collected by field devices) directly derived from each substation are massive, the efficiency of the entire association rule extraction depends to a large extent on the preprocessing of the data.Preprocess data: the redundancy of the alarm information is reduced and the accuracy is increased, which will better guarantee the extraction of strong association rules later.Association rule formulation: at this stage, the same type of association rules will be formulated according to the characteristics and categories of the alarm information, and the failure mode will be found from the massive information, and the mode will be described as a method that is easy for technicians to understand.Expert analysis: the association rules formulated in the previous step are used to traverse new alarm information, and the association rules are evaluated and confidence levels are established for them, so that the accuracy of the data mining strategy of the system can be continuously improved.Knowledge formation: during system testing, technicians will continuously evaluate and make statistics on the established association rules and finally form a knowledge that can assist the stable operation of the power system and be commonly recognized. The above process can be represented by Figure1.Figure 1
Information mining flow chart of system association rules (high-end).


## 3.1.1. Mining Definition of System Association Rules

The basic definitions of association rules are given below:Definition 1.
The record set mined by association rules is recorded asD (transaction database), and D=t1,t2,t3,⋯,tk,⋯,tn and tk=i1,i2,i3,⋯,ij,⋯,ipk=1,2,3,⋯,n are a transaction; elements ijj=1,2,3,⋯,n in tk are called itemsets.Definition 2.
LetI=i1,i2,i3,⋯,ij,⋯,im be the set of all items in D, any subset A of I is called the itemset in D, and X=k is called the set X which is the itemset of k. Let tk and X be transactions and itemsets in D, respectively; if X⊆tk, transaction CC is said to contain itemset X.Definition 3.
The essence of association rules is the implication in the form ofX⟹Y, where X⊂I,Y⊂I,X∩Y=∅ and ∅ are empty sets. Rule A⟹B has confidence c in transaction set D; if the percentage of D that contains A transaction also contains B is c, then it is the conditional probability PBA. That is, the support degree is the following:
(1)supportA⇒B=PA∪B.
The confidence level is the following:(2)confidenceA⇒B=PBA=support_countA∪Bsupport_countA.
Among them,support_countA∪B is the number of records containing itemset A∪B; support_countA is the number of transaction records containing itemset A.Definition 4 (supportγsupport).
The support degree of the association ruleX⟹Y is the proportion of transactions that the transaction database D contains X∪Y, which is represented by PX∪Y, that is, γsupportX⟹Y=PX∪Y. For example, X is the worker who repairs the transformer, Y is the worker who repairs the capacitor, and D is the various types of workers; then, γsupport is the proportion of the workers who only need to participate in one of the two inspections.Definition 5 (confidenceγconfidence).
The confidence level of the association ruleX⟹Y is the percentage that D contains X transactions and also contains Y transactions, which is represented by PX∣Y, that is, γconfidenceX⟹Y=PX∣Y. Same as the example of Definition 4, at this time γconfidence represents the proportion of employees who are involved in overhauling both transformers and capacitors. Support and confidence are two important concepts to describe association rules; the statistical importance of association rules in the entire data set is mainly measured by support, while confidence is used to measure the credibility of association rules. For example, overhauling transformers and overhauling capacitors, γsupport=20%, γconfidence=50%, that is, a support degree of 20% means that the employees involved in overhauling transformers or capacitors account for 20% of all the transactions analyzed. A confidence level of 50% means that 50% of the staff involved in overhauling transformers also overhauled capacitors.Definition 6.
Define the minimum supportγsupport,min and the minimum confidence γconfidence,min. In order to meet certain requirements, general users need to specify the support and corresponding confidence thresholds required by the rules to meet the conditions; that is, γsupportX⟹Y and γconfidenceX⟹Y are greater than or equal to their respective thresholds, which are called the minimum support threshold γsupport,min and the minimum confidence threshold γconfidence,min, respectively.Definition 7 (strong association rules).
If the association ruleX⟹Yin the transaction database D satisfies that γsupportX⟹Y is greater than or equal to γsupport,min and γconfidenceX⟹Y is greater than or equal to γconfidence,min, then the association rule X⟹Yis called a strong association rule.


## 3.1.2. Classification of Association Rules of the System

In order to be able to determine specific mining methods, such as data classification, clustering, and rule extraction, the classification of association rules is necessary. Several classifications are introduced below and cases are attached for intuitive understanding.The categories of rule-based processing variables can be divided into Boolean and quantified. Boolean association rules are mainly used for the existence or nonexistence of associated items, and they deal with classified and discretized data. For example, a capacitor failure and transformer failure, the associated fault relationship belongs to the Boolean association rule. The fault association rules are extracted by the author from substation alarm information; most of them belong to Boolean association rules. Quantitative association rules can be used in combination with multilayer or multidimensional association rules by dynamically dividing numerical fields or directly processing raw data. For example, if the line frequency is too high frequencyf=65Hz, the system frequency involved is of numerical type, which belongs to the numerical association rule.Based on the different levels of abstraction in the alarm signal, it can be divided into single-layer and multilayer association rules. For example, for trip protection device capacitor, variable does not take into account that the data has multiple different levels; it is a single-level association rule on detailed data. The protection device ABB transformer is a multilayer association rule between higher level and detail level, and the multilayer nature of the data has been fully considered.Based on the different dimensions of the alarm information data structure involved, the association rules can also be divided into single-dimensional and multidimensional association rules. In the single-dimensional association rule, only one dimension of the alarm information is involved, such as the equipment type of the substation: capacitor protection device. Multidimensional association rules deal with the relationship between multiple attributes. For example, the rule that primary equipment is equal to “circuit breaker”⟹ secondary equipment “protection device” contains two fields of information, which belong to the association rules in two dimensions. In addition, there are multidimensional association rules.


## 3.1.3. Improved Apriori Algorithm

This paper focuses on the algorithm based on hierarchical partitioning technology, such as the DIC algorithm. The DIC algorithm mainly logically divides the transactions in the transaction databaseD into N nonoverlapping intervals and then places these intervals in the memory for processing, which can speed up the operation rate of the algorithm. When the DIC algorithm scans the database D for the first time, the database is divided into I table areas according to some partition characteristics of the database, and count the local frequent itemsets Cik of each data area Dk1≤k≤i to form local candidate itemsets, and then repeat the algorithm until all local frequent itemsets are determined and the global frequent itemsets Ci are formed. The number of times the DIC algorithm scans the database is much smaller than that of the Apriori algorithm; if the data slices are properly divided, the DIC algorithm only needs to scan the database twice to obtain all frequent itemsets. Although the candidate itemsets generated by the DIC algorithm may be relatively large, and the accuracy of the frequent itemsets determined by the DIC algorithm cannot reach the labeling of the Apriori algorithm, the DIC algorithm has a high degree of parallelism and can reduce the number of scans and reduce the frequency of I/O operation, thereby improving the efficiency of the algorithm.


## 3.1.4. Information Mining Process of System Association Rules

For massive alarm information of substations, with the problems of mass, redundancy, uncertainty, etc., it is very important to formulate a set of accurate and effective mining process. According to the characteristics of substation alarm information, the process steps are as follows:Preprocessing of raw alarm information: because the original alarm information and point table information (various quantities collected by field devices) directly derived from each substation are massive, the efficiency of the entire association rule extraction depends to a large extent on the preprocessing of the data.Preprocess data: the redundancy of the alarm information is reduced and the accuracy is increased, which will better guarantee the extraction of strong association rules later.Association rule formulation: at this stage, the same type of association rules will be formulated according to the characteristics and categories of the alarm information, and the failure mode will be found from the massive information, and the mode will be described as a method that is easy for technicians to understand.Expert analysis: the association rules formulated in the previous step are used to traverse new alarm information, and the association rules are evaluated and confidence levels are established for them, so that the accuracy of the data mining strategy of the system can be continuously improved.Knowledge formation: during system testing, technicians will continuously evaluate and make statistics on the established association rules and finally form a knowledge that can assist the stable operation of the power system and be commonly recognized. The above process can be represented by Figure1.Figure 1
Information mining flow chart of system association rules (high-end).


## 3.2. System Hierarchy Analysis

### 3.2.1. Overall Design of the System

The author first studies the characteristics of the information flow (source) of the substation, the composition format of the primary (secondary) system information, and the expert knowledge (procedure data) for fault handling; on this basis, integrate search engine tools and database management tools, and transform according to traditional search engines to capture data, process data, provide retrieval services, and develop a professional data search engine for substations; it is used to construct power system fault information data mining system. The system is mainly divided into raw data collection, data extraction, refinement, data warehouse, data mining, and data presentation layer, and its overall design is shown in Figure2.Figure 2
Overall design of the system.The original data collection is mainly to collect the substation alarm information of each substation into the database. The essence of data extraction is to eliminate redundant alarm information, extract only its valid part, and, after preprocessing the alarm information, transfer the data to the data warehouse of the dispatch center for backup and partition. The data mining layer mainly includes application functions of expert database, rule query, and historical fault database. The data presentation layer mainly includes basic conditional search and statistical functions.


### 3.2.2. Unified Acquisition and Integration of Heterogeneous Data

The power system, especially the substation, has a complex structure, and the original warning information that needs to be processed is huge. Taking a power supply bureau as an example, its substation automation systems have all used self-developed dedicated power system databases, or with the help of large commercial database systems, but most of them are independently developed relying on their respective subsystems; it is difficult to realize data sharing among various systems. The alarm history data from different substation monitoring systems require different preprocessing.Therefore, in order to mine the massive data of substations, it is necessary to unify the historical alarm information of each substation (substation) automation system into a whole [11]. Although the structure of each substation system is diverse, there are many commonalities in these massive data information. Based on the remote historical alarm data acquisition, in addition to dealing with the connection and acquisition of the historical databases of each substation, the most critical issue is the unified acquisition and integration of heterogeneous data [12].The system adopts the polling method; using the remote database connection technology, the historical alarms of each substation are polled and extracted, and the historical alarms of each substation are passed through the alarm processing subroutine; unified transformations are inserted into the system’s local database, as shown in Figure3.Figure 3
Based on remote raw alert acquisition.Under the condition of digital substation, various monitoring data of substation are highly integrated according to technical regulations such as IEC61970/IEC61850 protocol; the system comprehensively analyzes the substation alarm information and proposes a substation operation abnormal processing plan.


## 3.2.1. Overall Design of the System

The author first studies the characteristics of the information flow (source) of the substation, the composition format of the primary (secondary) system information, and the expert knowledge (procedure data) for fault handling; on this basis, integrate search engine tools and database management tools, and transform according to traditional search engines to capture data, process data, provide retrieval services, and develop a professional data search engine for substations; it is used to construct power system fault information data mining system. The system is mainly divided into raw data collection, data extraction, refinement, data warehouse, data mining, and data presentation layer, and its overall design is shown in Figure2.Figure 2
Overall design of the system.The original data collection is mainly to collect the substation alarm information of each substation into the database. The essence of data extraction is to eliminate redundant alarm information, extract only its valid part, and, after preprocessing the alarm information, transfer the data to the data warehouse of the dispatch center for backup and partition. The data mining layer mainly includes application functions of expert database, rule query, and historical fault database. The data presentation layer mainly includes basic conditional search and statistical functions.


## 3.2.2. Unified Acquisition and Integration of Heterogeneous Data

The power system, especially the substation, has a complex structure, and the original warning information that needs to be processed is huge. Taking a power supply bureau as an example, its substation automation systems have all used self-developed dedicated power system databases, or with the help of large commercial database systems, but most of them are independently developed relying on their respective subsystems; it is difficult to realize data sharing among various systems. The alarm history data from different substation monitoring systems require different preprocessing.Therefore, in order to mine the massive data of substations, it is necessary to unify the historical alarm information of each substation (substation) automation system into a whole [11]. Although the structure of each substation system is diverse, there are many commonalities in these massive data information. Based on the remote historical alarm data acquisition, in addition to dealing with the connection and acquisition of the historical databases of each substation, the most critical issue is the unified acquisition and integration of heterogeneous data [12].The system adopts the polling method; using the remote database connection technology, the historical alarms of each substation are polled and extracted, and the historical alarms of each substation are passed through the alarm processing subroutine; unified transformations are inserted into the system’s local database, as shown in Figure3.Figure 3
Based on remote raw alert acquisition.Under the condition of digital substation, various monitoring data of substation are highly integrated according to technical regulations such as IEC61970/IEC61850 protocol; the system comprehensively analyzes the substation alarm information and proposes a substation operation abnormal processing plan.


## 3.3. System Function Realization

In the actual operation of substations, dispatchers often need to manually query and count real-time alarm information; at the same time, they also need to analyze this information with solidified expert rules to monitor system failures [13, 14]. Therefore, the system is mainly divided into three functional modules: event query and statistics, expert analysis, and historical fault database. The author mainly introduces the first two modules here, and their functional modules are shown in Figure 4.Figure 4
System function module diagram.


### 3.3.1. Event Query and Statistics Module

This module is mainly used to realize the query and statistics of alarm information, the dispatcher only needs to select the query scope and query conditions, and then the query function of the alarm information can be performed. Query is divided into basic query and advanced query [15]. The advanced query function of the system is based on the expert rule base query, and its main purpose is to apply the conditions of the solidified rules to traverse the alarm information twice to determine the possibility of faults [16]. The query based on the expert rule base is a composite alarm query with multiple conditions, and the composite alarm query requires multiple nested queries, so the temporary query results need to be stored in a temporary database or a memory table; each condition filters out matching records in the previous condition’s table.The condition of the advanced search function can be defined as a list object:γlist{rule condition, logic constraint, time constraint, frequency}.The rule condition is a specific alarm string, corresponding to each specific alarm. The difficulty of advanced search lies in the logical constraints, time constraints, and frequency constraints between these specific alarms. The basic flow of the advanced query function is shown in Figure5.Figure 5
Basic process of advanced query.The system divides advanced query conditions into rule linked lists, whose conditions are rule strings and logical linked lists, which contain logical constraints, time constraints, and frequency constraints [17]. First, apply each query condition to query the historical alarm table, and save the output query result in the temporary result table. Then, match the records in the temporary result table according to the conditions in the constraint list, traverse all the constraints, and combine the results that meet all the condition output to search results. In addition to the event query function, this module can also perform statistical analysis on specific alarm signals and generate statistical reports according to the needs of dispatchers [18]. Since the substation in this area is located in the coastal area, large-scale lines or equipment in the station is prone to trip due to typhoon season; when the dispatcher conducts statistical analysis on the fault, they need to obtain a large amount of data from the substation monitoring system, in order to register and handle specific switch trip alarm information. The query function developed by this system can assist operators to quickly collect statistics on specific alarm information and provide reports in the professional format of the power system, which greatly reduces the workload of system operators and improves the ability to handle and analyze accidents.


### 3.3.2. Expert Analysis Module

The expert analysis module is through the formulation and improvement of association rules, the preprocessed alarm information is traversed using the mined association rules, and a specific alarm sequence is discovered; its functional modules are shown in Figure6.Figure 6
Functions of the expert analysis module.The alarm sequence is extracted from the system information database, the data sequence is defined by the association rule principle described above, and the established association rules are put into the expert database to complete the construction of the expert knowledge system. During the operation of the system, through the use of the established rules by the technicians, the association rules are constantly self-improving and self-learning. Depending on the confidence, expert rules can define rule states for specific patterns (alert sequences), including normal, concerned, critically concerned, faulty, and overhauled. Therefore, through the expert analysis of the established expert rules, the pattern (alarm sequence) corresponding to the rule is found from the historical database, so as to complete the identification of the state type and then mine the historical operation information of the substation [19].


## 3.3.1. Event Query and Statistics Module

This module is mainly used to realize the query and statistics of alarm information, the dispatcher only needs to select the query scope and query conditions, and then the query function of the alarm information can be performed. Query is divided into basic query and advanced query [15]. The advanced query function of the system is based on the expert rule base query, and its main purpose is to apply the conditions of the solidified rules to traverse the alarm information twice to determine the possibility of faults [16]. The query based on the expert rule base is a composite alarm query with multiple conditions, and the composite alarm query requires multiple nested queries, so the temporary query results need to be stored in a temporary database or a memory table; each condition filters out matching records in the previous condition’s table.The condition of the advanced search function can be defined as a list object:γlist{rule condition, logic constraint, time constraint, frequency}.The rule condition is a specific alarm string, corresponding to each specific alarm. The difficulty of advanced search lies in the logical constraints, time constraints, and frequency constraints between these specific alarms. The basic flow of the advanced query function is shown in Figure5.Figure 5
Basic process of advanced query.The system divides advanced query conditions into rule linked lists, whose conditions are rule strings and logical linked lists, which contain logical constraints, time constraints, and frequency constraints [17]. First, apply each query condition to query the historical alarm table, and save the output query result in the temporary result table. Then, match the records in the temporary result table according to the conditions in the constraint list, traverse all the constraints, and combine the results that meet all the condition output to search results. In addition to the event query function, this module can also perform statistical analysis on specific alarm signals and generate statistical reports according to the needs of dispatchers [18]. Since the substation in this area is located in the coastal area, large-scale lines or equipment in the station is prone to trip due to typhoon season; when the dispatcher conducts statistical analysis on the fault, they need to obtain a large amount of data from the substation monitoring system, in order to register and handle specific switch trip alarm information. The query function developed by this system can assist operators to quickly collect statistics on specific alarm information and provide reports in the professional format of the power system, which greatly reduces the workload of system operators and improves the ability to handle and analyze accidents.


## 3.3.2. Expert Analysis Module

The expert analysis module is through the formulation and improvement of association rules, the preprocessed alarm information is traversed using the mined association rules, and a specific alarm sequence is discovered; its functional modules are shown in Figure6.Figure 6
Functions of the expert analysis module.The alarm sequence is extracted from the system information database, the data sequence is defined by the association rule principle described above, and the established association rules are put into the expert database to complete the construction of the expert knowledge system. During the operation of the system, through the use of the established rules by the technicians, the association rules are constantly self-improving and self-learning. Depending on the confidence, expert rules can define rule states for specific patterns (alert sequences), including normal, concerned, critically concerned, faulty, and overhauled. Therefore, through the expert analysis of the established expert rules, the pattern (alarm sequence) corresponding to the rule is found from the historical database, so as to complete the identification of the state type and then mine the historical operation information of the substation [19].


## 4. Results Analysis

According to the characteristics of substation operation information of a power supply bureau, the author uses the improved Apriori algorithm to analyze the alarm correlation information, extracts effective association rules, and uses these rules to perform an advanced rule-based query on the original alarm information, in order to verify the data mining effectiveness of this system [20].


### 4.1. Association Rule Extraction Example

Using the improved Apriori algorithm to perform data mining on the substation operation alarm information in 143 intervals of a power supply bureau substation, the following strong association rules are obtained: association rule 1, “handcart test position ∩ device operation alarm ∩ alarm signal has been reset interval debugging and maintenance”,γsupport=57%, γconfidence=69%; it means that when the three alarm signals of “handcart test position,” “device operation alarm,” and “alarm signal has been reset” appear at the same time within one day, there will be a 69% probability that the interval between the signals is being debugged and repaired, and operators need to pay attention to prevent maintenance accidents [21].Association rule 2, “Protection action∩ switch position ∩ reclosing action ∩ total accident (hold) ∩ switch position signal has been reset ∩ reclosing action signal has been reset ∩ total accident (hold) signal has been reset Temporary equipment failure”,γsupport=41%, γconfidence=79%, indicates when “protection action,” “switch position,” “reclosing action,” “accident total (maintain),” “switch division signal has been reset,” “reclosing action signal has been reset,” “accident total (maintain)” signal has been restored.” If these 8 alarm signals appear simultaneously within one day, there will be a 79% probability that there is a temporary equipment failure in the signaled interval [22, 23]. At this time, the operator needs to pay close attention to the equipment information, especially the temporary failure of the secondary equipment which will cause the operation information of the substation to be interrupted for a short time and failed to upload to dispatch center [24].


### 4.2. Rule-Based Query of Substation Warning Data

Use several strong association rules defined by rule mining above to query the alarm sequence in the database. The set rule conditions are used to query the alarm sequence in the database [25].


### 4.3. Expert Analysis Module

A horizontal comparison of the fault frequencies of the line protection monitoring and control devices of brand A, brand B, and brand C is carried out, as shown in Figures7 and 8. The data in Figures 7 and 8 are mainly composed of two parts, one is the total number of equipment failures, and the other is the standard value of the number of equipment failures; the total number of failures reflects the historical situation of the manufacturer’s equipment failures, due to the different quantities of equipment put into use between different manufacturers, some manufacturers’ equipment may be used more, and some manufacturers’ equipment may be used less; therefore, the total number of faults cannot fully reflect the fault conditions of equipment between different manufacturers, according to the actual demand of the power grid; the author uses the standard value of the number of failures to compare the failures of equipment between different manufacturers; the smaller the standard value is, the lower the failure rate of the manufacturer’s equipment is, and vice versa, it means that the manufacturer’s equipment often has accidents.Figure 7
The total number of failures of similar equipment from different manufacturers.Figure 8
Standard value of failure times of similar equipment from different manufacturers.


## 4.1. Association Rule Extraction Example

Using the improved Apriori algorithm to perform data mining on the substation operation alarm information in 143 intervals of a power supply bureau substation, the following strong association rules are obtained: association rule 1, “handcart test position ∩ device operation alarm ∩ alarm signal has been reset interval debugging and maintenance”,γsupport=57%, γconfidence=69%; it means that when the three alarm signals of “handcart test position,” “device operation alarm,” and “alarm signal has been reset” appear at the same time within one day, there will be a 69% probability that the interval between the signals is being debugged and repaired, and operators need to pay attention to prevent maintenance accidents [21].Association rule 2, “Protection action∩ switch position ∩ reclosing action ∩ total accident (hold) ∩ switch position signal has been reset ∩ reclosing action signal has been reset ∩ total accident (hold) signal has been reset Temporary equipment failure”,γsupport=41%, γconfidence=79%, indicates when “protection action,” “switch position,” “reclosing action,” “accident total (maintain),” “switch division signal has been reset,” “reclosing action signal has been reset,” “accident total (maintain)” signal has been restored.” If these 8 alarm signals appear simultaneously within one day, there will be a 79% probability that there is a temporary equipment failure in the signaled interval [22, 23]. At this time, the operator needs to pay close attention to the equipment information, especially the temporary failure of the secondary equipment which will cause the operation information of the substation to be interrupted for a short time and failed to upload to dispatch center [24].


## 4.2. Rule-Based Query of Substation Warning Data

Use several strong association rules defined by rule mining above to query the alarm sequence in the database. The set rule conditions are used to query the alarm sequence in the database [25].


## 4.3. Expert Analysis Module

A horizontal comparison of the fault frequencies of the line protection monitoring and control devices of brand A, brand B, and brand C is carried out, as shown in Figures7 and 8. The data in Figures 7 and 8 are mainly composed of two parts, one is the total number of equipment failures, and the other is the standard value of the number of equipment failures; the total number of failures reflects the historical situation of the manufacturer’s equipment failures, due to the different quantities of equipment put into use between different manufacturers, some manufacturers’ equipment may be used more, and some manufacturers’ equipment may be used less; therefore, the total number of faults cannot fully reflect the fault conditions of equipment between different manufacturers, according to the actual demand of the power grid; the author uses the standard value of the number of failures to compare the failures of equipment between different manufacturers; the smaller the standard value is, the lower the failure rate of the manufacturer’s equipment is, and vice versa, it means that the manufacturer’s equipment often has accidents.Figure 7
The total number of failures of similar equipment from different manufacturers.Figure 8
Standard value of failure times of similar equipment from different manufacturers.


## 5. Conclusion

The substation data mining technology and its application are expounded. By analyzing a large number of original alarms and alarm sequences of specific patterns and defining relevant expert rules for data mining, the establishment of the entire database can be completed and the system has good operability. By analyzing the filtered information, the operating status of the system in each historical period can be excavated, so as to provide decision-making basis for the safe and reliable operation of the substation according to the historical status information. At present, the system has been run and debugged in a certain bureau, many postmaintenance and processing work will be gradually improved in the actual work of the data mining system, and the existing processing methods will be improved; thus, the accuracy and credibility of association rule mining can be gradually improved.



---

*Source: 8249606-2022-07-06.xml*