An alarm online prediction method in an alarm flooding situation based on deep learning
By employing a deep learning-based online alarm prediction method, utilizing long short-term memory networks and a sliding window strategy, the problem of rampant alarms in industrial processes is solved, achieving rapid and accurate alarm prediction and meeting the real-time monitoring needs of industry.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA UNIV OF GEOSCIENCES (WUHAN)
- Filing Date
- 2022-11-29
- Publication Date
- 2026-07-03
AI Technical Summary
The problem of rampant invalid alarms caused by the proliferation of alarms in existing industrial processes is addressed by existing alarm prediction methods, which suffer from high time complexity, inaccurate prediction results, and poor real-time performance.
An online alarm prediction method based on deep learning is adopted. By generating an alarm flood sequence library, using a long short-term memory network for feature extraction, and combining a sliding window strategy for real-time updates, an alarm prediction model is established.
It enables rapid calculation and short-time model establishment, meeting the real-time requirements of industrial real-time monitoring and diagnosis, and improving the accuracy and real-time performance of alarm prediction.
Smart Images

Figure CN115758908B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of alarm flooding analysis in industrial processes, and more particularly to an online alarm prediction method based on deep learning under alarm flooding conditions. Background Technology
[0002] In modern industrial processes, alarm systems monitor real-time data and detect anomalies, alerting operators to take timely measures to prevent further deterioration. Their importance in ensuring the safety of industrial operations is self-evident. With the introduction of distributed control systems in modern industry, although alarm settings have become very convenient and inexpensive, the setting of alarm points and thresholds requires extensive knowledge of alarm management. Therefore, existing alarm systems generally suffer from unreasonable design and inefficiency, leading to a large number of invalid alarms and alarm overload.
[0003] Alarm flooding refers to a situation where an alarm system generates a large number of alarms in a short period of time, making it impossible for operators to troubleshoot promptly based on the alarm prompts. According to the ISA-18.2 standard, an alarm flood is considered to begin when the number of alarms exceeds 10 within 10 minutes and to end when the number of alarms falls below 5 within 10 minutes. It is also recommended that alarm flooding should not occur for more than 1% of total operating time. Alarm flooding severely restricts the safety of production processes; if not handled promptly, it can lead to industrial accidents, resulting in personal injury and economic losses. Therefore, the analysis and research of alarm flooding has become a common concern in both academia and industry.
[0004] When an alarm flood is occurring, being able to predict the next alarms that may occur based on the current alarm sequence can provide operators with effective decision-making assistance. However, due to the limited research on alarm flooding in industrial processes, the following problems exist: 1) Most existing alarm prediction studies are based on alarm flooding sequence comparison methods, which compare historical alarm data with the current alarm flooding and predict alarm sequences with high similarity scores. However, this pairwise sequence comparison method has high time complexity, making it difficult to guarantee the real-time performance of alarm prediction. On the other hand, since online alarm flooding sequences are dynamically updated data streams, alarm sequence comparison cannot adapt to such real-time changes during the calculation process, which has a significant impact on the accuracy of prediction results; 2) Due to the complex nature of industrial processes, the propagation and diffusion paths of alarms are generally complex and variable. From actual alarm data, even the same alarm sequence may lead to different subsequent alarms. Therefore, it is obviously more appropriate to provide a set of possible candidate results for alarm prediction. However, most existing studies only provide the most likely alarm and predict the next alarm based on it. When the alarm fails, it may cause subsequent alarms to fail, thus affecting the operator's judgment. Summary of the Invention
[0005] To address the aforementioned issues, this invention provides an online alarm prediction method based on deep learning for alarm flooding scenarios. It utilizes alarm log data collected from industrial process simulation software. After data preprocessing, segments exhibiting alarm flooding are extracted to generate an alarm flooding sequence library. Iterative slicing of the alarm flooding sequences better captures the predictive mapping relationship between consecutive alarms. Furthermore, completion techniques are employed to maintain a unified dimension for alarm flooding sequences of varying lengths, resulting in a labeled dataset. Finally, a Long Short-Term Memory (LSTM) network is used for feature extraction, and through training, an alarm prediction model is obtained.
[0006] To address the issue of excessive time complexity in sequence alignment algorithms leading to a proliferation of predicted alarms and high real-time requirements, this invention uses a trained neural network as the alarm prediction model. Based on this, a sliding window-based real-time alarm sequence update strategy is designed. Whenever a new alarm occurs or no new alarm occurs for a certain period, the sliding window automatically captures that alarm sequence and performs real-time prediction based on it. Since the network structure has already been trained offline, and the sliding window's movement calculation speed is fast, the model setup time is short, which can meet the real-time requirements of practical industrial real-time monitoring and diagnosis.
[0007] The specific steps of the proposed method are as follows:
[0008] 1) Obtain the alarm flood sequence library;
[0009] By triggering faults to generate alarm event logs, historical alarm event logs within a certain time period are obtained and preprocessed using industrial simulation software. Alarm flooding segment sequences are extracted, and the alarm rate is compared with the International Institute of Automation (ISA) standard to obtain the alarm flooding sequence.
[0010] The specific steps for preprocessing alarm event logs are as follows:
[0011] a) Standardize the data format of alarm event information, mainly including: 1. Merging alarm types and alarm variables and mapping them to real numbers as alarm tags; 2. Deleting redundant attributes such as alarm descriptions and alarm units and performing dimensionality reduction; 3. Setting a time step to treat several alarms with similar timestamps as occurring simultaneously;
[0012] b) Redundant alarms in the alarm log are removed by setting delays, filters, dead zones, etc., to avoid their interference with the identification of real alarm flooding segments, and the real alarm flooding segments are extracted according to the ISA-18.2 standard and the timestamp information of the alarm events.
[0013] Ultimately, the resulting industrial alarm sequence library can be represented as: F = {F1, F2, ..., F...} n}, for any one of the alarm flood sequences F i ,i∈[1,n], consists of several alarms in a specific order, i.e., F i =[a i 1, a i 2, ..., a i m , 1≤m≤M]. Where, a m Let M represent the m-th alarm in the alarm flooding sequence F, and let M represent the length of the alarm flooding sequence.
[0014] 2) Slicing and encoding of alarm sequences;
[0015] By iteratively slicing the alarm flood sequence, a long short-term neural network is used to capture and encode the predicted mapping relationship between consecutive alarms. Alarm floods of different sequence lengths are kept at a uniform dimension to obtain a labeled dataset. This labeled dataset is divided into training and testing sets. An alarm prediction model is established and trained to obtain the trained alarm prediction model. Consecutive alarms in the actual alarm flood sequence serve as the input and output of the alarm prediction model, respectively. The specific steps for converting the historical alarm event logs into structured encoding of the alarm event data for the alarm prediction model training and testing datasets are as follows:
[0016] For an alarm flooding sequence F = [a1, a2, ..., a...] with M alarms... M Starting from i=2, with a i As the output label for alarm prediction, the slice S consisting of the first i-1 alarms in the alarm flooding sequence is... i = [a1, a2, ..., a (i-1) As input for alarm prediction, the above slicing process is iterated M-1 times to obtain the predicted slices of the alarm flood sequence F into {S1, S2, ..., S...}. (M-1)}
[0017] The above processing is performed on each alarm flooding sequence in the alarm flooding database F, resulting in the correspondence between the input and output in the alarm prediction model. Let L be the length of the longest alarm sequence in F. max The input slices for alarm prediction are padded with zeros to align all slice lengths. For alarm output tags, one-hot encoding is used, and the encoding length parameter is selected as the number of types of tags for the alarm variable.
[0018] Through the above operations, training and testing data for the alarm prediction model were obtained. The alarm input is a vector of the same dimension, and the label is a vector after one-hot encoding.
[0019] 3) Offline modeling stage;
[0020] 1) Add an embedding layer before the neural network as the first layer of the alarm prediction model. This is a word vector processing method that transforms the sparse features of one-hot encoding into dense features and outputs them in vector form. The embedding vector dimension is also set.
[0021] 2) The second layer of the alarm prediction model is a bidirectional long short-term neural network layer, which is used to capture the temporal relationship between alarms in the alarm flooding sequence, and the Cell State parameter is set to determine the length of the processed context; its third layer is a fully connected layer, the number of nodes is the number of variables in the alarm sequence library, and the activation function is selected as softmax.
[0022] 3) Set a series of parameters for the training process: training loss function; optimization method; evaluation criteria; selection of training and test sets; number of training rounds, etc.
[0023] After the above steps, the training model has been successfully built.
[0024] 4) Online prediction phase: The alarm rate is calculated in real time based on online alarm data. When the alarm rate first exceeds 10 times / 10 minutes, alarm flooding occurs. Alarm event data during this period of alarm flooding is collected to generate an alarm sequence. This period of alarm flooding ends when the alarm rate drops below 5 times / 10 minutes. The alarm prediction method during this period is as follows:
[0025] After filling the training set vector with the currently occurring alarm sequence F, it is input into the offline-trained model, resulting in the probability distribution vector of each alarm occurrence derived from the softmax activation function. This vector is then traversed, and the indices of the c alarm variables with the highest probabilities are output as candidate alarm prediction results. The number of candidate alarm sets C must satisfy the constraint that the sum of alarm probabilities in the candidate sets is greater than the confidence level μ.
[0026] To ensure the real-time nature and accuracy of alarms, the system continuously detects and determines if new alarms are detected. If so, the alarm flooding sequence is updated and prediction is performed immediately; otherwise, a periodic prediction is performed after a certain period of time. Prediction is based on a sliding window selection mechanism, requiring a sliding window of length W. The selection mechanism is as follows: if a new alarm occurs, the updated alarm flooding sequence is directly input into the trained alarm prediction model; if no new alarm occurs after a certain period, the system predicts the candidate alarm set A based on the current alarm flooding sequence F, and then selects the alarm A with the highest probability. max The alarm flood sequence F2 is obtained by adding the data to F, and the above process is repeated to achieve dynamic alarm prediction. The sliding window selection mechanism can effectively prevent subsequent predictions from becoming incorrect when the prediction is wrong. The window length W means that only the W alarms closest to the current time are considered when an alarm is triggered. As data items arrive, the model slides along the time axis, with new data constantly entering the window while old data items are discarded and no longer included in the analysis. The method to evaluate the accuracy of this prediction model is to calculate the number of correctly predicted alarms divided by the number of predicted alarms.
[0027] In summary, the data processing for the online alarm prediction phase has been completed.
[0028] The beneficial effects of the technical solution provided by this invention are: fast calculation speed, short model establishment time, which can meet the real-time requirements of actual industrial real-time monitoring and diagnosis. Attached Figure Description
[0029] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings:
[0030] Figure 1 This is a flowchart of an online alarm prediction method based on deep learning in the case of alarm overload, as described in an embodiment of the present invention. Detailed Implementation
[0031] To provide a clearer understanding of the technical features, objectives, and effects of the present invention, specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.
[0032] Please refer to Figure 1 , Figure 1 This is a flowchart of an online alarm prediction method based on deep learning in the case of alarm overload, according to an embodiment of the present invention. This embodiment is based on a VAM alarm platform model and a simulation experiment is designed to verify the effectiveness of the method.
[0033] Step 1: Offline Training
[0034] The data used comes from VAM platform simulation experiments. Alarm event logs are generated by triggering faults. By configuring 1019 alarm tags, and to generate a certain alarm flooding sequence, the simulation includes several faults, including significant faults MAL15, 16, 17, 23, 24, and 25. After a period of monitoring, the alarm event logs are finally exported. Table 1 shows a portion of the alarm event logs obtained using VAM simulation in this invention:
[0035] Table 1
[0036]
[0037] Step 1.1, Alarm Flood Sequence Extraction: Alarm flooding occurs when the real-time alarm rate exceeds the alarm flooding threshold. By collecting alarm event data within this period, the alarm flooding sequence is obtained. The preprocessing of historical alarm event logs is as follows: a) Standardizing the alarm log format: Modifying or deleting irregular data to ensure data format uniformity is an important preprocessing step for alarm data. This mainly includes: 1. Merging alarm types and alarm variables and mapping them to real numbers as alarm labels; 2. Deleting redundant attributes such as alarm descriptions and alarm units and performing dimensionality reduction; 3. Setting a time step to treat several alarms with similar timestamps as occurring simultaneously; b) Obtaining the true alarm flooding sequence: This indicates that a delay timer is used, configured to 300 seconds, to suppress false alarm flooding such as jitter alarms, greatly reducing the number of annoying alarms in the historical alarm event logs.
[0038] Furthermore, according to the ISA-18.2 standard, for any alarm flooding sequence F = <a1,a2,…,a m > Its timestamp sequence is T i = < t1, t2, ..., t m , 1≤m≤M>, and satisfy the following time constraints:
[0039] ζ(t1,t1+10)>10
[0040] ζ(t m ,t m +10)<5
[0041] Where ζ(a,b) refers to the number of alarms occurring within the time interval from t=a to t=a. By performing the above timestamp detection on the alarms in the historical alarm database, a database of 130 alarm flood sequences composed of real alarm flood sequences can be obtained, namely F={F1,F2,…,F…}. 130}
[0042] Step 1.2, Slicing and Encoding of Alarm Sequences: Since alarm event sequences are text information, they cannot be processed directly and the causal relationship of alarms during prediction cannot be quantitatively represented. Therefore, this invention constructs a prediction mapping relationship between alarm event data before and after based on a simple statistical idea, that is, the alarms before and after in the alarm flood sequence are respectively used as the input and output of alarm prediction.
[0043] For an alarm flooding sequence F = [a1, a2, ..., a...] with M alarms... M Starting from i=2, with a i As the output label for alarm prediction, S is a slice consisting of the first i-1 alarms in the alarm flooding sequence. i = [a1, a2, ..., a (i-1) As input for alarm prediction, the above slicing process is iterated M-1 times to obtain the predicted slices of the alarm flood sequence F into {S1, S2, ..., S...}. (M-1) The above processing is performed on each alarm flood sequence in the alarm flood database F, resulting in a hash structure H representing the correspondence between inputs and outputs in the alarm prediction model, with its key S. i For the input vector to be predicted, the value a i The predicted label (i.e., the most likely alarm to occur next) can be represented as:
[0044] H F ={(S i :a i )|S i = [a1, a2, ..., a (i-1) ],a i ∈F,i∈[1,M-1]}
[0045] In order to process the alarm flooding sequences, all alarm flooding sequences need to have the same dimension. Let the longest length of the alarm sequence in F be L. max The input slices for alarm prediction are padded with zeros to align all slice lengths. For the labels of the alarm output, one-hot encoding is used, and the encoding length parameter is selected as the number of types of labels of the alarm variable, and represented in the form of a sparse vector.
[0046] Taking a flood of alarms sequence [426,429,483,…,483,916] as an example, it contains 38 alarms. Therefore, after processing this flood of alarms, we get a hash structure containing 37 predicted input sequences and their corresponding predicted labels, represented as follows:
[0047] {[0,0,0,…,0,426]:(1019,
[428] ,1),
[0048] [0,0,…,426,429]:(1019,
[482] ,1),
[0049] …
[0050] [0,…,392,404,483]:(1019,
[915] ,1)}
[0051] A hash structure is a data structure consisting of key-value pairs.
[0052] [0,0,0,…,0,426]:(1019,
[428] ,1)
[0053] [0,0,0,…,0,426] is the key.
[0054] (1019,
[428] ,1) is a value, and the two correspond one-to-one;
[0055] The key of the hash structure is the input vector padded to the same dimension, and the value is the sparse vector representation of the label after one-hot encoding (a, [b], c). The three parameters mean: the vector dimension is a, the value at position b+1 is c, and the rest are 0. After slicer encoding, the slice and encoding results of an alarm flood sequence are shown in Table 2:
[0056] Table 2
[0057]
[0058] Step 1.3, Offline Modeling: First, the sparse features of one-hot encoding are transformed into dense features and output as vectors using word embedding. The dimension of the embedding vector is set to 100. Then, considering the significant advantages of Long Short-Term Neural Networks (LSTNs) in temporal feature extraction and their suitability for longer alarm flooding sequences, a bidirectional LSTN layer is selected to extract temporal features between alarms in the alarm flooding sequence. The Cell State parameter is set to 10 to determine the length of the processed context. Since alarm prediction can be viewed as a multi-classification problem, the softmax activation function is chosen.
[0059]
[0060] Softmax assigns a probability value to the prediction result for each alarm tag, representing the probability that the alarm will occur next, where z i Let Z be the output value of the i-th node, and let the dimension of the vector Z be the number of output nodes, i.e., the number of categories. The Softmax function can be used to convert the output values of multi-class classification into a probability distribution ranging from [0,1] to 1.
[0061] The loss function for the training process is specified as classification cross-entropy; the optimization method is selected as Adam optimizer; the evaluation criterion is selected as prediction accuracy; training and test sets are randomly selected, with 100 records used as the training set for the alarm prediction model and the remaining 30 records used as the test set for the prediction model; finally, the number of training rounds is set to 100.
[0062] Step 2, Online Diagnosis Stage:
[0063] In online diagnostics, the prediction of input alarm flood sequences mainly includes the following steps:
[0064] a. The alarm rate is calculated in real time based on online alarm data. When the alarm rate exceeds 10 times / 10 minutes for the first time, alarm flooding occurs. The alarm event data of this alarm flooding is collected to generate an alarm sequence until the alarm rate is lower than 5 times / 10 minutes and this alarm flooding ends.
[0065] b. The currently occurring alarm flood sequence F is padded with leading zeros to match the dimension of the training set vector. This is then input into the trained alarm prediction model, resulting in the probability distribution vectors of each alarm occurrence derived from the softmax activation function. This vector is iterated through, and the alarm variables corresponding to the c highest probabilities are output as candidate alarm prediction results, thus obtaining the alarm candidate set. If the number of alarm candidate sets C = {0.66, 0.2, 0.1}, then this set contains three elements, c = 3. The constraint that the number of alarm candidate sets C must satisfy is that the sum of the alarm probabilities in the candidate set is greater than the confidence level μ.
[0066]
[0067] in This indicates that the activation function softmax affects alarm a. i The result of the action, i.e., a i The probability of occurrence, where m is the probability of each alarm occurring in the candidate alarm set A. This represents a decreasing sequence, i.e. There always Where j and k both satisfy j,k∈[1,n];
[0068] c. To ensure the real-time nature and accuracy of alarms, the system continuously detects and judges whether new alarms are present. If so, the alarm flood sequence is updated and prediction is performed immediately; otherwise, a periodic prediction is performed after a certain period of time. The prediction process utilizes a sliding window selection mechanism, requiring a sliding window of length W. The selection mechanism is as follows: if a new alarm occurs, the updated alarm flood sequence is directly input into the alarm prediction model; if no new alarm occurs after a certain period, the system predicts the candidate set of alarms A based on the current alarm flood sequence F using the trained alarm prediction model. A contains all possible alarms, and the probability of each alarm forms a set C. Then, the alarm with the highest probability in A is selected. max Added to F, a new alarm sequence F2 is obtained, alarm A. max This refers to the alarm variable corresponding to the highest probability. For example, given a candidate set A = {564, 256, 536}, and its count set C = {0.66, 0.2, 0.1}, if this set contains three elements m1 = 0.66, m2 = 0.2, and m3 = 0.1, then A... max =564. By repeatedly executing the above process, dynamic prediction of alarms is achieved. The sliding window selection mechanism can prevent subsequent predictions from becoming increasingly incorrect when the prediction is wrong. The window length W means that only the W alarms closest to the current time are considered when an alarm is triggered. As data items arrive, the model slides along the time axis, with new data constantly entering the window while older data items are discarded and no longer participate in the analysis. The final results are shown in Table 3, representing some of the results used for online prediction of industrial alarms.
[0069] Table 3
[0070]
[0071] Since alarm prediction is essentially a multi-class classification problem, the performance of the prediction model can be evaluated using Micro-F1 and Macro-F1. It's important to note that Micro-F1 considers the number of classes in each category; classes with a larger number of classes will have a greater impact on Micro-F1. Macro-F1, on the other hand, averages the precision and recall for each category; therefore, classes with higher precision and recall will have a greater impact on Macro-F1. The Micro-F1 calculation method is as follows:
[0072] The formula for calculating the micro-average Micro-F1 is as follows:
[0073]
[0074] Among them, recall mi With precision mi Calculated using the following formulas respectively
[0075]
[0076]
[0077] The formula for calculating the macro average (Macro-F1) is as follows:
[0078]
[0079] Calculate TP i This means that the i-th alarm tag is correctly predicted and belongs to the positive class; FP i This refers to the erroneous prediction of the i-th alarm tag as positive; TN i This means that the i-th alarm tag is correctly predicted and belongs to the negative class; FN i This indicates that the prediction for the i-th type of alarm tag was incorrect, and the prediction was negative.
[0080]
[0081] The table above shows that the online alarm prediction model established using the proposed method has high performance. Therefore, it can be considered that the proposed prediction method based on deep learning and sliding windows is effective for online alarm prediction when alarm flooding occurs.
[0082] The advantages of this invention are: fast calculation speed and short model establishment time, which can meet the real-time requirements of actual industrial real-time monitoring and diagnosis.
[0083] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A deep learning-based online prediction method for alarm flooding, characterized in that: include: Offline training section: By triggering a fault to generate an alarm event log, alarm log data is collected and preprocessed. The alarm rate is compared with the ISA standard to obtain an alarm flood sequence. The alarm flood sequence is iteratively sliced, and the mapping relationship between the predictions of alarms before and after is captured based on a long short-term neural network and encoded. Alarm floods with different sequence lengths are kept in a uniform dimension to obtain a labeled dataset. The labeled dataset is divided into a training set and a test set. An alarm prediction model is built and trained to obtain a trained alarm prediction model. The alarms before and after in the real alarm flood sequence are used as the input and output of the alarm prediction model, respectively. Online alarm prediction section: When the real-time alarm rate exceeds the alarm flooding threshold, alarm flooding occurs. By collecting alarm event data within this period, an alarm flooding sequence is obtained, and new alarms are detected in real time. If so, the alarm flooding sequence is updated and prediction is made immediately. If not, a periodic prediction is performed after a certain period of time. During prediction, the alarm flooding sequence is input into the trained alarm prediction model according to the sliding window selection mechanism to obtain the alarm candidate set and probability distribution. The alarm with the highest probability is added to the updated alarm sequence. This process is repeated until the real-time alarm rate is lower than the alarm flooding threshold, so as to achieve dynamic prediction of alarms. The slicing and encoding process of the alarm sequence is as follows: The structured coding of the alarm prediction model involves converting alarm event logs into structured encodings of alarm event data for both the training and testing datasets of the alarm prediction model. This process includes the following steps: For an alarm flooding sequence F = [a1, a2, ..., aM] with M alarms, starting from i = 2, ai is used as the output label for alarm prediction. The slice Si = [a1, a2, ..., a(i-1)] consisting of the first i-1 alarms in the alarm flooding sequence is used as the input of the alarm prediction model. By iterating the above slicing process M-1 times, the predicted slice of the alarm flooding sequence F can be obtained as {S1, S2, ..., S(M-1)}. The above processing is performed on each alarm flooding sequence in the alarm flooding database F to obtain the correspondence between the input and output in the alarm prediction model. Let the longest length of the alarm sequence in F be Lmax. Then, zero-padding is applied to the slices of the input of the alarm prediction model to align the lengths of all slices. One-hot encoding is used for the labels of the alarm output, and the encoding length parameter is selected as the number of types of labels of the alarm variable. Through the above operations, the training set and test set for training the alarm prediction model were obtained.
2. The online warning prediction method for warning flooding based on deep learning according to claim 1, characterized in that: The preprocessing process for alarm data is as follows: a) Standardize the data format for alarm event information; b) By setting delays, filters, and dead zones, redundant alarms in the alarm log are removed to avoid interference with the identification of real alarm flooding segments, and real alarm flooding segments are extracted according to the ISA-18.2 standard and the timestamp information of alarm events.
3. The online warning prediction method for warning flooding based on deep learning according to claim 2, characterized in that: The process of standardizing the data format of alarm event information is as follows: (1) Merge alarm types and alarm variables and map them to real numbers as alarm labels; (2) Delete redundant attributes such as alarm description and alarm unit to perform dimensional reduction; (3) Set the time step to treat several alarms with similar timestamps as occurring simultaneously.
4. The online alarm prediction method based on deep learning for alarm overload as described in claim 1, characterized in that: Get the current alarm flood sequence F After padding the training set vectors with added dimensions, the data is input into the offline-trained alarm prediction model. This yields the probability distribution vectors of each alarm occurrence derived from the softmax activation function. The process then iterates through these vectors and selects the appropriate vectors. c The index of the alarm variable corresponding to the highest probability is output as the candidate alarm prediction result, where the number of alarm candidate sets is... C The constraint to be satisfied is that the sum of the alarm probabilities in the candidate set is greater than the confidence level. μ ,Right now: in This indicates that the activation function softmax applies to the first... i One alarm a i The result of the action, namely a i The probability of occurrence m Candidate alarm set A The probability of each alarm occurring. This represents a decreasing sequence, i.e. There will always be ,in j, k All meet j, k ∈[1, n ].