A knowledge graph-based method for anomaly recognition and diagnosis of hydropower station monitoring events

Abstract

The present invention discloses a method for identifying and diagnosing abnormalities in monitoring events of a hydropower station based on a knowledge graph, which belongs to the technical field of monitoring equipment of a hydropower station. The method comprises obtaining and filtering maintenance signals and processing frequent alarm signals according to monitoring system signals and control system signals of the hydropower station to obtain an initial signal sequence; constructing a comprehensive event library, using the comprehensive event library as a matching template to slice the initial signal sequence, and obtaining an event slicing result; constructing a signal relationship knowledge graph based on business experience and graph reasoning technology; and using the comprehensive event library and the signal relationship knowledge graph to perform abnormality detection according to the event slicing result, and outputting the results of identifying and diagnosing abnormalities in monitoring events of a hydropower station. The present invention solves the problems of high monitoring difficulty and low intelligence level of existing monitoring technology for equipment of hydropower stations.

Description

Technical Field

[0001] The present invention belongs to the technical field of hydropower station equipment monitoring, and in particular relates to a method for identifying and diagnosing abnormalities in hydropower station monitoring events based on a knowledge graph. Background Art

[0002] The handling of abnormal events and the analysis of the causes of accidents in hydropower stations face a series of significant challenges, including a wide variety of equipment, a large number of signals, the complexity of large-scale real-time data processing, frequent alarms, increased difficulty and risk of monitoring, and the high-intensity nature of monitoring work. At present, relying on experienced technicians to identify and diagnose abnormal accidents has the following problems: (1) The monitoring system presents data in the form of individual signals, making it difficult to capture the business processes and correlations between signals. (2) The workload and pressure of production and operation monitoring personnel are huge. Monitoring abnormal events requires these experienced production and operation monitoring personnel to maintain a high degree of concentration in order to detect abnormalities in a timely manner and make correct disposal. (3) It takes a long time to accumulate experience in the discovery and handling of abnormal events, and it is not possible to achieve rapid automatic search and alarm through the knowledge base. (4) For abnormal events that have not occurred and have complex correlations, relying on manual experience cannot meet the safety requirements of "zero fault tolerance" for signal monitoring judgment. Summary of the invention

[0003] In view of the above-mentioned deficiencies in the prior art, the present invention provides a method for identifying and diagnosing abnormalities in hydropower station monitoring events based on knowledge graph, which solves the problems of high monitoring difficulty and low intelligence level of existing hydropower station equipment monitoring technology.

[0004] In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is: a method for identifying and diagnosing abnormalities in monitoring events of a hydropower station based on a knowledge graph, comprising the following steps:

[0005] S1. Obtain and filter the maintenance signal and the frequency alarm signal according to the hydropower station monitoring system signal and the control system signal to obtain the initial signal sequence;

[0006] S2, constructing a comprehensive event library, using the comprehensive event library as a matching template to perform event slicing on the initial signal sequence, and obtaining event slicing results;

[0007] S3. Based on the event slicing results, anomaly detection is performed using the comprehensive event library to obtain anomaly identification results;

[0008] S4, construct a signal relationship knowledge graph;

[0009] S5. Based on the anomaly identification results, the signal relationship knowledge graph is used to output the results of anomaly identification and diagnosis of hydropower station monitoring events.

[0010] The beneficial effects of the present invention are as follows: the present invention transforms the monitoring business from the traditional logic signal stacking mode to the intelligent event-based anomaly identification and diagnosis mode. By comprehensively organizing the operating procedures, dispatching procedures, fault cause information and related materials of the hydropower station, the real-time monitoring signals of the hydropower equipment are classified and sliced ​​according to business events. Business event slicing serves as the basic analysis interval for signal anomaly analysis and judgment to support anomaly identification and diagnosis of the correlation relationship of real-time signals within a specific time interval. This method helps to improve the intelligence and operability of the hydropower equipment monitoring system and better cope with the many challenges in the production and operation monitoring of hydropower stations.

[0011] Furthermore, the step S1 is specifically as follows:

[0012] S101, obtaining monitoring system signals and control system signals of the hydropower station;

[0013] S102, fusing the monitoring system signal and the control system signal of the hydropower station based on the time series to obtain a fused signal sequence;

[0014] S103, acquiring a control system signal in a fused signal sequence, and obtaining a maintenance signal set based on a maintenance operation instruction;

[0015] S104, according to the maintenance signal set based on the maintenance operation instruction, obtaining the device to which each maintenance signal belongs, and obtaining a maintenance device list;

[0016] S105, removing the monitoring system signals of the equipment in the fusion signal sequence that is not in the maintenance equipment list, to obtain a filtered signal sequence;

[0017] S106. Filter the frequency-reporting signal according to the filtered signal sequence to obtain an initial signal sequence.

[0018] The beneficial effect of the above further scheme is that the maintenance signal of the equipment that has been detected to be abnormal and is undergoing maintenance is filtered, which can reduce the calculation complexity and make the abnormal identification and diagnosis of the monitoring events of the hydropower station more accurate.

[0019] Furthermore, the step S106 is specifically as follows:

[0020] S1061, setting a threshold for the number of signal occurrences within the time window;

[0021] S1062, obtaining a signal whose occurrence number in a time window of a filtered signal sequence is greater than a threshold value, and obtaining a frequent alarm signal;

[0022] S1063. Delete the frequent signal in the filtered signal sequence to obtain an initial signal sequence.

[0023] The beneficial effect of the above further scheme is: setting a threshold for the number of signal occurrences within a time window can more accurately judge frequent alarm signals, and at the same time, can reduce the computational complexity, making the abnormal identification and diagnosis of hydropower station monitoring events more accurate.

[0024] Furthermore, the step S2 is specifically as follows:

[0025] S201, setting the event library format;

[0026] S202, obtaining historical manual diagnosis events of the hydropower station, and arranging them based on the event library format to obtain a first event library;

[0027] S203, obtaining historical operation instructions of the hydropower station, and performing signal statistics according to the historical operation instructions of the hydropower station and the historical operation data of the hydropower station to obtain a second event library;

[0028] S204, integrating the first event library and the second event library to obtain a comprehensive event library;

[0029] S205 , using the comprehensive event library as a matching template, performing event slicing on the initial signal sequence based on the event combination signal flag, the signal flag and the event uniqueness signal flag to obtain an event slicing result.

[0030] The beneficial effect of the above further scheme is: converting the huge and discrete signal data generated by the hydropower station into specific business events, thereby organizing the related signals in the form of events. Realize the transformation of the monitoring business from the logical signal stacking mode to the event-based abnormality identification and diagnosis mode. By analyzing all business scenarios in the daily dispatch business process, including business processes such as start-up and shutdown, operation, accidents, and failures, sorting out the relationship between business events and characteristic signals in the business process, marking the key signals, cause signals, signal time limits, timing and other relationships and attributes of the events in the event library, and signalizing the events, it lays the foundation for the research of intelligent event cause analysis models.

[0031] Furthermore, the event library format in step S201 specifically includes event summary information and event signal information; the event summary information mainly includes event ID, event category and historical estimated duration; the event signal information mainly includes event ID, event combination signal flag, event uniqueness signal flag, signal flag and key signal sequence; the event summary information and event signal information are mutually associated through the event ID.

[0032] The beneficial effect of the above further scheme is: combining the signal of the event occurrence process with the summary information of the event, signaling the event from the outside to the inside, and laying the foundation for the research of intelligent event cause analysis model.

[0033] Furthermore, the step S205 is specifically as follows: using the comprehensive event library as a matching template, based on the event combination signal flag, signal flag and event unique signal flag, extracting a signal sequence matching the matching template from the initial signal sequence, determining the time point of the event occurrence, and obtaining an event slicing result.

[0034] The beneficial effects of the above further scheme are: based on various events summarized from historical data, a comprehensive event library is obtained, which is used as a matching template to match the signals in the initial signal sequence, so that the corresponding event signal representation can be found quickly and accurately, thereby improving the accuracy of diagnosis; and based on the comprehensive event library, multiple events can be sliced ​​at the same time, which speeds up the diagnosis process.

[0035] Furthermore, the step S203 is specifically as follows:

[0036] S2031. Obtaining a device signal relationship table of the hydropower station;

[0037] S2032, obtaining historical operation instructions of the hydropower station, and combining historical operation data of the hydropower station, counting the signals that appear after the operation instructions are issued, and obtaining an instruction issuance event signal table;

[0038] S2033, according to the command issuing event signal table and the device signal relationship table, respectively filter out the relevant signals of the device to which each operation command belongs, and obtain aggregated data;

[0039] S2034, using the Apriori association rule mining algorithm to perform frequent pattern mining on the aggregated data to obtain a second high-frequency signal sequence;

[0040] S2035 . Integrate each high-frequency signal in the second high-frequency signal sequence and its corresponding operation instruction based on the event library format to obtain a second event library.

[0041] The beneficial effect of the above further scheme is that the huge and discrete signal data generated by the hydropower station is converted into specific business events, thereby organizing related signals in the form of events. It is an important basic data for realizing the transformation of monitoring business from the logical signal stacking mode to the event-based abnormality identification and diagnosis mode. By analyzing all business scenarios in the daily dispatch business process, including business processes such as start-up and shutdown, operation, accidents, and failures, sorting out the relationship between business events and characteristic signals in the business process, marking the key signals, cause signals, signal time limits, timing and other relationships and attributes of the events in the event library, and signalizing the events, it lays the foundation for the research of intelligent event cause analysis models.

[0042] Furthermore, the step S3 is specifically as follows:

[0043] S301. Obtain corresponding events in the comprehensive event library according to the event slicing result;

[0044] S302, judging whether the key signal of the event slicing result is missing according to the signal flag of the corresponding event in the comprehensive event library, if so, obtaining the event key signal missing abnormal judgment result and proceeding to step S304, otherwise, directly proceeding to step S303;

[0045] S303, judging whether the signal sequence of the event slicing result matches the key signal sequence of the corresponding event according to the comprehensive event library, if not, obtaining the event key signal disorder abnormality judgment result and proceeding to step S304, otherwise, directly proceeding to step S304;

[0046] S304, determine whether the event duration of the event slicing result exceeds the historical estimated duration of the corresponding event, if so, obtain the event timeout exception judgment result and proceed to step S305, otherwise, directly proceed to step S305;

[0047] S305. Obtain an abnormality recognition result according to the judgment results of step S302, step S303 and step S304.

[0048] The beneficial effect of the above further scheme is: by comparing the comprehensive event library information, anomaly detection is performed on the event slicing results, and the identified anomaly types include event timeout anomaly, event key signal missing anomaly, and event key signal disorder anomaly, which can improve the system reliability, data quality and decision accuracy.

[0049] Furthermore, the step S4 is specifically as follows:

[0050] S401, obtaining historical operation data of the hydropower station, and obtaining the association relationship between the equipment and the signal according to the historical operation data of the hydropower station;

[0051] S402, according to the association relationship between the device and the signal, using the signal as a node and the relationship as an edge, using the knowledge graph technology to obtain a signal relationship graph;

[0052] S403, according to the signal relationship graph, using the graph depth-first search algorithm and the graph breadth-first search algorithm, extract the knowledge graph subgraphs corresponding to different relationships;

[0053] S404, according to the knowledge graph subgraphs and signal relationship graphs corresponding to different relationships, based on the reasoning logic rules, a link prediction method is used to complete the signal relationship to obtain a first signal relationship graph;

[0054] S405. Use association rule mining technology to mine the association relationship between equipment and signals in the historical operation data of the hydropower station, and expand the first signal relationship graph based on the association relationship between equipment and signals in the historical operation data of the hydropower station to obtain a signal relationship knowledge graph.

[0055] The beneficial effects of the above further scheme are: introducing knowledge graph completion and association rule mining technology, further expanding the signal relationship graph based on the existing knowledge graph, which can more accurately reflect the association and dependency between signals, and provide more dimensions and depth of perspective for in-depth understanding of data, helping to achieve event anomaly tracing.

[0056] Furthermore, the step S5 is specifically as follows:

[0057] S501. According to the abnormal identification result, determine whether there is an abnormal judgment result of missing key signal of the event. If so, use the signal relationship knowledge graph to query the signal, obtain the associated signal of the missing key signal, obtain the signal abnormality detection result, and enter step S502. Otherwise, directly enter step S502;

[0058] S502, according to the event slicing result, using the comprehensive event library, obtain the event category and anomaly recognition result;

[0059] S503, integrating the event category, anomaly identification result and signal anomaly detection result to obtain the result of anomaly identification and diagnosis of hydropower station monitoring events, outputting the result of anomaly identification and diagnosis of hydropower station monitoring events, and completing anomaly identification and diagnosis of hydropower station monitoring events.

[0060] The beneficial effects of the above further scheme are: summarizing the abnormal event identification and diagnosis results, filtering redundant information, retaining important information, streamlining push processing, improving the monitoring efficiency of system monitoring messages, reducing the monitoring workload of operation monitoring personnel, assisting operation monitoring personnel to focus on key signals, and ensuring the safe production and operation of hydropower stations. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0062] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0063] like Figure 1As shown, in one embodiment of the present invention, a method for identifying and diagnosing abnormalities in monitoring events of a hydropower station based on a knowledge graph comprises the following steps:

[0064] S1. Obtain and filter the maintenance signal and the frequency alarm signal according to the hydropower station monitoring system signal and the control system signal to obtain the initial signal sequence;

[0065] S2, constructing a comprehensive event library, using the comprehensive event library as a matching template to perform event slicing on the initial signal sequence, and obtaining event slicing results;

[0066] S3. Based on the event slicing results, anomaly detection is performed using the comprehensive event library to obtain anomaly identification results;

[0067] S4, construct a signal relationship knowledge graph;

[0068] S5. Based on the anomaly identification results, the signal relationship knowledge graph is used to output the results of anomaly identification and diagnosis of hydropower station monitoring events.

[0069] In this embodiment, the present invention obtains the monitoring system signal and the control system signal of the hydropower station, and performs filtering and processing of the frequent alarm signal and the maintenance signal; based on the data mining method, the event type is sorted out according to the typical scene event, the system level event, and the active operation event, and the event library is constructed to determine the signal and key information contained in the event; based on the event library, the real-time signal time series is sliced; the sequence similarity method is used to calculate the difference between the event library and the event slicing result, and anomaly detection is performed, and the anomaly type includes event timeout anomaly identification, event key signal missing anomaly identification, and event key signal disorder anomaly identification; based on business experience, a signal relationship knowledge graph is constructed, and the association rule mining method and graph reasoning technology are used to complete the knowledge graph. On this basis, based on the relationship graph reasoning, it is found whether the associated signal of the missing key signal is abnormal. Combined with the results of event anomaly identification and graph relationship reasoning, an event anomaly diagnosis summary is formed, redundant information of monitoring events is filtered, and push processing is simplified.

[0070] The step S1 is specifically as follows:

[0071] S101, obtaining monitoring system signals and control system signals of the hydropower station;

[0072] S102, fusing the monitoring system signal and the control system signal of the hydropower station based on the time series to obtain a fused signal sequence;

[0073] S103, acquiring a control system signal in a fused signal sequence, and obtaining a maintenance signal set based on a maintenance operation instruction;

[0074] S104, according to the maintenance signal set based on the maintenance operation instruction, obtaining the device to which each maintenance signal belongs, and obtaining a maintenance device list;

[0075] S105, removing the monitoring system signals of the equipment in the fusion signal sequence that is not in the maintenance equipment list, to obtain a filtered signal sequence;

[0076] S106. Filter the frequency-reporting signal according to the filtered signal sequence to obtain an initial signal sequence.

[0077] The step S106 is specifically as follows:

[0078] S1061, setting a threshold for the number of signal occurrences within the time window;

[0079] S1062, obtaining a signal whose occurrence number in a time window of a filtered signal sequence is greater than a threshold value, and obtaining a frequent alarm signal;

[0080] S1063. Delete the frequent signal in the filtered signal sequence to obtain an initial signal sequence.

[0081] In this embodiment, multi-source signal collection and processing: In the monitoring of the hydropower system, various types of monitoring equipment signal sources may be involved. Multi-source signal fusion is to integrate data from different signal sources to provide a comprehensive system view. In this method, it is necessary to integrate the business operation instruction information of the centralized control center and the real-time equipment monitoring signal reported by the hydropower station, and mainly focus on the switch signal. The signal generated by the equipment maintenance will have an impact on the monitoring, and it is necessary to filter the signals related to the maintenance equipment based on the maintenance operation instructions. The name of the maintenance equipment is determined by checking the equipment maintenance flag in the operation instruction, and added to the maintenance equipment list. Receive the real-time signal sequence and check in real time whether the device to which the signal belongs belongs to the maintenance equipment list. If it belongs, the signal is filtered. If not, these signal sequences will be retained and enter the subsequent processing. There is redundant state information frequently reported by some equipment in the fused signal sequence, which interferes with the monitoring exception processing and event slicing. Therefore, by monitoring the number of times the signal occurs within the set time window, if it exceeds the preset threshold, the signal will be regarded as a frequent alarm signal and filtered out; conversely, if the number of times the signal occurs does not reach the threshold, it will be retained and enter subsequent processing; there is equipment maintenance during the production and operation of hydropower equipment.

[0082] The step S2 is specifically as follows:

[0083] S201, setting the event library format;

[0084] S202, obtaining historical manual diagnosis events of the hydropower station, and arranging them based on the event library format to obtain a first event library;

[0085] S203, obtaining historical operation instructions of the hydropower station, and performing signal statistics according to the historical operation instructions of the hydropower station and the historical operation data of the hydropower station to obtain a second event library;

[0086] S204, integrating the first event library and the second event library to obtain a comprehensive event library;

[0087] S205 , using the comprehensive event library as a matching template, performing event slicing on the initial signal sequence based on the event combination signal flag, the signal flag and the event uniqueness signal flag to obtain an event slicing result.

[0088] The event library format in step S201 specifically includes event summary information and event signal information; the event summary information mainly includes event ID, event category and historical estimated duration; the event signal information mainly includes event ID, event combination signal flag, event uniqueness signal flag, signal flag and key signal sequence; the event summary information and event signal information are mutually associated through the event ID.

[0089] In this embodiment, by combing the business process in detail and focusing on key nodes, signal data related to these key event processes are sorted out, such as the power on and off business of the hydropower unit and accident scenarios; by deeply analyzing the event business process, the association between business events and characteristic signals is established, including cause signals, trigger signals, end signals and other key signals in the event process. In addition, information such as the duration of business events and the sequence of key signals are summarized; since the format of typical scenario event documents is inconsistent, the content is scattered and difficult to maintain, and there may be some important information that is not fully recorded, secondary processing is required to build a new event library with unified format; this processing process includes extracting keywords of event signals from typical scenario event files, and matching these keywords with corresponding signal unique codes; in order to facilitate management, simpler and easier-to-use digital codes are used to identify some special signals in the event and determine the occurrence order of key signals; finally, storage is defined according to the unified format of the event library.

[0090] In this embodiment, the event library format is shown in Table 1 and Table 2, Table 1 is an event summary information table, and Table 2 is an event signal information table.

[0091] Table 1

[0092]

[0093] Table 2

[0094]

[0095]

[0096] The step S205 is specifically as follows: using the comprehensive event library as a matching template, based on the event combination signal flag, signal flag and event unique signal flag, extracting a signal sequence matching the matching template from the initial signal sequence, determining the time point of the event occurrence, and obtaining an event slicing result.

[0097] In this embodiment, event slicing uses the data filtered and preprocessed in step S1 as the data source, and then uses the comprehensive event library constructed in step S2 as the matching template. Through the content matching between the data source and the matching template, the real-time signal sequence is sliced ​​to obtain the event slicing results within a specific time period; this method has the ability to slice multiple events at the same time, can manage the event control cache of operation instructions, and realize many-to-one redundant management of signals and dynamic life window management of events. Event slicing includes the following sub-steps:

[0098] ① First, read the comprehensive event library constructed in step S2 as a matching template: In the event slicing method, matching templates are key. They are representations of known events and are used to compare with real-time data sources to determine whether a matching event has occurred;

[0099] ② Real-time sequence signal processing: Once the matching template successfully matches the data source, the event slicing method will slice the corresponding real-time sequence signal; this includes extracting the part that matches the template from the entire signal and determining the exact time point when the event occurred;

[0100] ③Multi-event processing: The power of this method lies in its ability to process multiple events simultaneously; this means that different matching templates can be set for different types of events, and multiple events can be sliced ​​and processed in the same time period without losing efficiency.

[0101] The step S203 is specifically as follows:

[0102] S2031. Obtaining a device signal relationship table of the hydropower station;

[0103] S2032, obtaining historical operation instructions of the hydropower station, and combining historical operation data of the hydropower station, counting the signals that appear after the operation instructions are issued, and obtaining an instruction issuance event signal table;

[0104] S2033, according to the command issuing event signal table and the device signal relationship table, respectively filter out the relevant signals of the device to which each operation command belongs, and obtain aggregated data;

[0105] S2034, using the Apriori association rule mining algorithm to perform frequent pattern mining on the aggregated data to obtain a second high-frequency signal sequence;

[0106] S2035 . Integrate each high-frequency signal in the second high-frequency signal sequence and its corresponding operation instruction based on the event library format to obtain a second event library.

[0107] In this embodiment, the equipment hierarchy relationship table includes the main system name, main system code, subsystem name, subsystem code and the power plant to which the subsystem belongs; the equipment signal relationship table includes the equipment name, equipment code and signal name.

[0108] In this embodiment, by analyzing the business operation instructions of the hydropower monitoring system and the scope of the instruction action events, combined with the historical operation instruction data, the signals that may appear after the operation instruction is issued are counted to form an instruction issuance event signal table; this process first obtains the signal sequence within a period of time after the operation instruction is issued, that is, the event duration, based on the instruction content and instruction time of the business operation instruction data; then, the signal sequence is obtained by comparing the device and signal relationship table, and the relevant signals of the device to which the instruction belongs are screened out. The purpose of the operation is to summarize the historical signal data of the same instruction in different time periods, so that these data can be effectively organized in order, so as to more accurately capture frequent items in subsequent data analysis; with the help of the aforementioned aggregate data after data preprocessing According to the data, the classic association rule mining Apriori algorithm is used to mine frequent itemsets. The process is as follows: first, the support of each single item in the data set, that is, a single signal, is calculated, and then those items whose support is higher than the preset threshold, that is, the minimum support, are retained. This step constructs the so-called frequent 1-item set; then, these frequent 1-item sets are used to generate candidate 2-item sets, which are again screened by support to obtain frequent 2-item sets. In a similar way, larger candidate item sets are generated and support screening is performed, and the iteration continues until no new candidate item sets can be generated, and the second high-frequency signal sequence is obtained; finally, all high-frequency signal sequences under the same instruction are compared to obtain the possible signal sequence of the corresponding event of the instruction, and the signal verification is performed again.

[0109] The step S3 is specifically as follows:

[0110] S301. Obtain corresponding events in the comprehensive event library according to the event slicing result;

[0111] S302, judging whether the key signal of the event slicing result is missing according to the signal flag of the corresponding event in the comprehensive event library, if so, obtaining the event key signal missing abnormal judgment result and proceeding to step S304, otherwise, directly proceeding to step S303;

[0112] S303, judging whether the signal sequence of the event slicing result matches the key signal sequence of the corresponding event according to the comprehensive event library, if not, obtaining the event key signal disorder abnormality judgment result and proceeding to step S304, otherwise, directly proceeding to step S304;

[0113] S304, determine whether the event duration of the event slicing result exceeds the historical estimated duration of the corresponding event, if so, obtain the event timeout exception judgment result and proceed to step S305, otherwise, directly proceed to step S305;

[0114] S305. Obtain an abnormality recognition result according to the judgment results of step S302, step S303 and step S304.

[0115] In this embodiment, event timeout anomaly recognition refers to the occurrence time of an event exceeding the expected range or threshold, which may be caused by system failure, network delay or other unusual situations; by obtaining the event slicing results and the corresponding event matching template, an event duration anomaly judgment is performed. If the event duration of the real-time event slicing result exceeds the historical expected duration stored in the corresponding event library, the event timeout anomaly judgment result is output; rapid detection of event timeout anomalies helps ensure that timely measures are taken to avoid the expansion of potential problems.

[0116] Event key signal missing anomaly recognition refers to the failure to detect key signal parts in the event slicing results; by comparing the key signals of the event slicing results with the key signals in the corresponding event matching template, if there are some missing key signals, the event key signal missing anomaly judgment result is output; the validity and integrity of the event are closely related to the existence of key signals;

[0117] Event key signal disorder anomaly identification refers to the discovery of a signal sequence in the event slice that is inconsistent with expectations; if no key signal missing anomaly is found in S32, the key signals in the real-time event slice signal sequence will continue to be compared with the sequence of key signals in the corresponding event matching template. If a sequence mismatch occurs, the event disorder anomaly judgment result is output; in some cases, the sequence and timing relationship of events are crucial to correct interpretation and response.

[0118] The step S4 is specifically as follows:

[0119] S401, obtaining historical operation data of the hydropower station, and obtaining the association relationship between the equipment and the signal according to the historical operation data of the hydropower station;

[0120] S402, according to the association relationship between the device and the signal, using the signal as a node and the relationship as an edge, using the knowledge graph technology to obtain a signal relationship graph;

[0121] S403, according to the signal relationship graph, using the graph depth-first search algorithm and the graph breadth-first search algorithm, extract the knowledge graph subgraphs corresponding to different relationships;

[0122] S404, according to the knowledge graph subgraphs and signal relationship graphs corresponding to different relationships, based on the reasoning logic rules, a link prediction method is used to complete the signal relationship to obtain a first signal relationship graph;

[0123] S405. Use association rule mining technology to mine the association relationship between equipment and signals in the historical operation data of the hydropower station, and expand the first signal relationship graph based on the association relationship between equipment and signals in the historical operation data of the hydropower station to obtain a signal relationship knowledge graph.

[0124] In this embodiment, the association relationship between devices and signals is organized based on business experience: devices will generate different types of signals in different operations or states, and the timing and correlation between these signals vary greatly, including various complex relationships such as signal association, symbiosis, mutual exclusion, and independence, all of which contain important business implications; manually organizing these relationships is not only a huge workload, but also difficult to exhaust all possibilities; the knowledge graph uses a semi-structured data model, which can not only store various real-world facts and related information, but also provide semantics and context for the data, which is helpful for reasoning, query and analysis; combing common relationships between signals, such as symbiosis, opposition, mutual exclusion, causality, and association.

[0125] In this embodiment, the knowledge graph technology is used to construct a signal relationship graph: all signal relationships are constructed into a knowledge graph, with signals as nodes and relationships as edges;

[0126] In this embodiment, the knowledge graph is expanded by using knowledge graph completion technology: knowledge graph subgraphs corresponding to different relationships are extracted through graph depth-first search and graph breadth-first search algorithms; different reasoning logic rules are established for the five types of relationship knowledge graphs: symbiosis, opposition, mutual exclusion, causality, and association; signal relationships are supplemented by using graph relationship reasoning, i.e., link prediction methods; and signal relationships are completed based on basic signal relationships through the transitive properties, contradictions, and other characteristics of the relationships; for example, based on the co-occurrence relationship between the A<>B signal pair and the B<>C signal pair, it can be inferred that A<>C has a co-occurrence relationship.

[0127] In this embodiment, the knowledge graph is expanded by using association rule mining technology: by mining the association relationship in the historical signal sequence data, the content of the knowledge graph is further enriched and expanded; the historical signal time series is segmented into data sets using different time windows, and the signals in each segmented data set are subjected to frequent K-item set statistics, and the probability of co-occurrence between any two signal pairs and the marginal probability of a single signal are calculated respectively; under the condition that the set support is met, high-confidence signal relationship pairs are screened as signal pairs with an association relationship, and whether the signals are symbiotic or associated relationships is determined based on the timestamps of the signal occurrences; in addition, signal pairs with an "independent" relationship can also be extracted based on the probability that the signals do not co-occur.

[0128] In this embodiment, signal anomaly detection based on relational reasoning: according to the time delay distribution characteristics of the predefined signal relationship, select the appropriate time window length, such as a 3-second time window for the "companion" relationship; for the signal sequence of a given time window length, extract the signal flag information, query the signal relationship graph, and detect whether the signal pair relationship in the current window is consistent with the signal relationship in the knowledge graph, or if there is a relationship missing, if so, it is determined to be abnormal; for the output event key signal missing abnormal identification judgment result, identify the associated signal of the missing key signal based on the knowledge graph reasoning; output the signal anomaly detection result. The current reasoning logic, for example: if signal s and signal i are in a symbiotic relationship, and signal i and signal j are also in a symbiotic relationship, it can be inferred that signal s and signal j are in a symbiotic relationship.

[0129] In this embodiment, the construction of the signal relationship knowledge graph uses the Kafka data stream.

[0130] The step S5 is specifically as follows:

[0131] S501. According to the abnormal identification result, determine whether there is an abnormal judgment result of missing key signal of the event. If so, use the signal relationship knowledge graph to query the signal, obtain the associated signal of the missing key signal, obtain the signal abnormality detection result, and enter step S502. Otherwise, directly enter step S502;

[0132] S502, according to the event slicing result, using the comprehensive event library, obtain the event category and anomaly recognition result;

[0133] S503, integrating the event category, anomaly identification result and signal anomaly detection result to obtain the result of anomaly identification and diagnosis of hydropower station monitoring events, outputting the result of anomaly identification and diagnosis of hydropower station monitoring events, and completing anomaly identification and diagnosis of hydropower station monitoring events.

[0134] In this embodiment, based on the abnormal identification results, an event summary is formed; the summary data content is as follows: each event has a unique event identifier and an event name; the time information of the event includes the start time and end time of the event, corresponding to the occurrence time of the start signal and the end signal in the event slicing result; the event category includes normal events, accident events, active events and passive events; the system level to which the event belongs includes the subsystem and main system levels; the event abnormality is divided into timeout abnormality, key signal missing or key signal disorder, and the timeout abnormality information includes the duration estimate and timeout time of the timeout abnormal event; the key signal missing abnormality includes the code and name of the missing signal, and the information whether the symbiotic or associated signals of these missing signals are missing; the key signal disorder abnormality includes the code and name of the disordered signal, the order of the normal signal and the order of the error signal, etc. Event abnormality identification and diagnosis result simplified push: according to the event type and the abnormal situation of the event, it is judged whether to report the abnormal detection results, among which normal active events, all abnormalities and accident events need to be reported, and other events are stored and not reported, thereby reducing the monitoring intensity of the monitoring personnel.

Claims

1. A method for identifying and diagnosing abnormalities in monitoring events of hydropower stations based on knowledge graphs, characterized in that: The following steps are involved: S1. Obtain and filter the maintenance signal and the frequent alarm signal according to the monitoring system signal and the control system signal of the hydropower station to obtain an initial signal sequence; the monitoring system signal is a real-time equipment monitoring signal; the control system signal is a business operation instruction information; the maintenance signal filtering process is: by checking the equipment maintenance flag in the business operation instruction information to determine the name of the maintenance equipment, add it to the maintenance equipment list, and when the device to which the signal belongs belongs to the maintenance equipment list, the signal is filtered; the frequent alarm signal filtering process is: by monitoring the number of occurrences of the signal within the set time window, if it exceeds the preset threshold, the signal will be regarded as a frequent alarm signal and filtered out; S2, constructing a comprehensive event library, using the comprehensive event library as a matching template to perform event slicing on the initial signal sequence, and obtaining event slicing results; The construction of the comprehensive event library is specifically as follows: analyzing the business event process, establishing the association between the business event and the characteristic signal; the characteristic signal includes the cause signal, trigger signal, end signal and key signal in the event process; summarizing the duration of the business event and the order of the key signal; according to the association between the business event and the characteristic signal, the duration of the business event and the order of the key signal, using digital coding to identify the characteristic signal in the business event and storing it to obtain the comprehensive event library; the event slicing is specifically as follows: using the initial signal sequence filtered and pre-processed in step S1 as the data source, using the comprehensive event library constructed in S2 as the matching template, slicing by content matching between the data source and the matching template, and obtaining the event slicing result within a specific time period; S3. Based on the event slicing results, anomaly detection is performed using the comprehensive event library to obtain anomaly identification results; S4. Constructing a signal relationship knowledge graph; the construction of the signal relationship knowledge graph specifically comprises: based on the association relationship between the device and the signal, using the knowledge graph technology to construct all signal relationships into a knowledge graph to obtain a signal relationship graph, and using the knowledge graph completion technology and the association rule mining technology to expand the signal relationship graph to obtain a signal relationship knowledge graph; S5. Based on the event slicing results, the comprehensive event library is used to obtain the event category; based on the anomaly identification results, the signal relationship knowledge graph is used to output the results of anomaly identification and diagnosis of hydropower station monitoring events; The results of the abnormal identification and diagnosis of the hydropower station monitoring events include event categories, abnormal identification results and signal abnormality detection results; the signal abnormality detection results are specifically abnormal identification results for the missing key signals of the output events, and the associated signals of the missing key signals are identified based on signal relationship knowledge graph reasoning.

2. According to claim 1, the method for identifying and diagnosing abnormalities in monitoring events of hydropower stations based on knowledge graphs is characterized in that: The S1 is specifically: S101, obtaining monitoring system signals and control system signals of the hydropower station; S102, fusing the monitoring system signal and the control system signal of the hydropower station based on the time series to obtain a fused signal sequence; S103, acquiring a control system signal in a fused signal sequence, and obtaining a maintenance signal set based on a maintenance operation instruction; S104, according to the maintenance signal set based on the maintenance operation instruction, obtaining the device to which each maintenance signal belongs, and obtaining a maintenance device list; S105, removing the monitoring system signals of the equipment in the fusion signal sequence that is not in the maintenance equipment list, to obtain a filtered signal sequence; S106. Filter the frequency-reporting signal according to the filtered signal sequence to obtain an initial signal sequence.

3. According to claim 2, the method for identifying and diagnosing abnormalities in monitoring events of hydropower stations based on knowledge graphs is characterized in that: The S106 is specifically as follows: S1061, setting a threshold for the number of signal occurrences within the time window; S1062, obtaining a signal whose occurrence number in a time window of a filtered signal sequence is greater than a threshold value, and obtaining a frequent alarm signal; S1063. Delete the frequent signal in the filtered signal sequence to obtain an initial signal sequence.

4. According to claim 1, the method for identifying and diagnosing abnormalities in monitoring events of hydropower stations based on knowledge graphs is characterized in that: The S2 is specifically: S201, setting the event library format; S202, obtaining historical manual diagnosis events of the hydropower station, and arranging them based on the event library format to obtain a first event library; S203, obtaining historical operation instructions of the hydropower station, and performing signal statistics according to the historical operation instructions of the hydropower station and the historical operation data of the hydropower station to obtain a second event library; S204, integrating the first event library and the second event library to obtain a comprehensive event library; S205 , using the comprehensive event library as a matching template, performing event slicing on the initial signal sequence based on the event combination signal flag, the signal flag and the event uniqueness signal flag to obtain an event slicing result.

5. According to claim 4, the method for identifying and diagnosing abnormalities in monitoring events of hydropower stations based on knowledge graphs is characterized in that: The event library format in S201 specifically includes event summary information and event signal information; the event summary information mainly includes event ID, event category and historical estimated duration; the event signal information mainly includes event ID, event combination signal flag, event uniqueness signal flag, signal flag and key signal sequence; the event summary information and event signal information are mutually associated through the event ID.

6. The method for identifying and diagnosing abnormalities in monitoring events of a hydropower station based on a knowledge graph according to claim 4 is characterized in that: The S205 is specifically as follows: using the comprehensive event library as a matching template, based on the event combination signal flag, signal flag and event unique signal flag, extracting a signal sequence matching the matching template from the initial signal sequence, determining the time point of the event occurrence, and obtaining an event slicing result.

7. The method for identifying and diagnosing abnormalities in monitoring events of a hydropower station based on a knowledge graph according to claim 5 is characterized in that: S203 is specifically: S2031. Obtaining a device signal relationship table of the hydropower station; S2032, obtaining historical operation instructions of the hydropower station, and combining historical operation data of the hydropower station, counting the signals that appear after the operation instructions are issued, and obtaining an instruction issuance event signal table; S2033, according to the command issuing event signal table and the device signal relationship table, respectively filter out the relevant signals of the device to which each operation command belongs, and obtain aggregated data; S2034, using the Apriori association rule mining algorithm to perform frequent pattern mining on the aggregated data to obtain a second high-frequency signal sequence; S2035 . Integrate each high-frequency signal in the second high-frequency signal sequence and its corresponding operation instruction based on the event library format to obtain a second event library.

8. The method for identifying and diagnosing abnormalities in monitoring events of a hydropower station based on a knowledge graph according to claim 1 is characterized in that: The S3 is specifically: S301. Obtain corresponding events in the comprehensive event library according to the event slicing result; S302, judging whether the key signal of the event slicing result is missing according to the signal flag of the corresponding event in the comprehensive event library, if so, obtaining the event key signal missing abnormal judgment result and entering S304, otherwise, directly entering S303; S303, judging whether the signal sequence of the event slicing result matches the key signal sequence of the corresponding event according to the comprehensive event library, if not, obtaining the event key signal disorder abnormality judgment result and entering S304, otherwise, directly entering S304; S304, determine whether the event duration of the event slicing result exceeds the historical estimated duration of the corresponding event, if so, obtain the event timeout exception judgment result and enter S305, otherwise, directly enter S305; S305. Obtain an abnormality recognition result based on the judgment results of S302, S303 and S304.

9. The method for identifying and diagnosing abnormalities in monitoring events of a hydropower station based on a knowledge graph according to claim 1 is characterized in that: The S4 is specifically: S401, obtaining historical operation data of the hydropower station, and obtaining the association relationship between the equipment and the signal according to the historical operation data of the hydropower station; S402, according to the association relationship between the device and the signal, using the signal as a node and the relationship as an edge, using the knowledge graph technology to obtain a signal relationship graph; S403, according to the signal relationship graph, using the graph depth-first search algorithm and the graph breadth-first search algorithm, extract the knowledge graph subgraphs corresponding to different relationships; S404, according to the knowledge graph subgraphs and signal relationship graphs corresponding to different relationships, based on the reasoning logic rules, a link prediction method is used to complete the signal relationship to obtain a first signal relationship graph; S405. Use association rule mining technology to mine the association relationship between equipment and signals in the historical operation data of the hydropower station, and expand the first signal relationship graph based on the association relationship between equipment and signals in the historical operation data of the hydropower station to obtain a signal relationship knowledge graph.

10. The method for identifying and diagnosing abnormalities in monitoring events of a hydropower station based on a knowledge graph according to claim 1 is characterized in that: The S5 is specifically: S501. According to the abnormal identification result, determine whether there is an abnormal judgment result of missing key signal of the event. If so, use the signal relationship knowledge graph to query the signal, obtain the associated signal of the missing key signal, obtain the signal abnormality detection result, and enter S502. Otherwise, directly enter S502; S502, according to the event slicing result, using the comprehensive event library, obtain the event category and anomaly recognition result; S503, integrating the event category, anomaly identification result and signal anomaly detection result to obtain the result of anomaly identification and diagnosis of hydropower station monitoring events, outputting the result of anomaly identification and diagnosis of hydropower station monitoring events, and completing anomaly identification and diagnosis of hydropower station monitoring events.

Images