Method and device for determining root cause generating alarm, electronic equipment and storage medium
By constructing Bayesian networks and using noisy-or models, the root cause of low-voltage electrical equipment alarms is determined, and the problem of difficulty in identifying the root cause in complex events is solved, and the accuracy and efficiency of analysis is improved.
Patent Information
- Application Number
- CN202411542044.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-31
- Publication Date
- 2025-02-21
AI Technical Summary
In low-voltage electrical equipment, when complex events such as abnormal temperature rise, it is difficult to identify and solve the problem by relying solely on alarm information, and root cause analysis is required to determine the root cause of the alarm.
By building a Bayesian network, use domain knowledge and real-time data to determine the possible reasons for the device to generate alarms, and use the noisy-or model to simplify the network, estimate the parameters of each parent node and the parameters of directed edges to determine the possibility of maximum contribution The reason is the root cause of the alarm.
Quantitative identification of the most likely root cause is achieved, which significantly improves the accuracy and efficiency of root cause analysis, simplifies the calculation process, and reduces the number of parameters.
Smart Images
Figure CN119493685A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure generally relates to the field of factory digitization, and more particularly to a method, device, electronic device and storage medium for determining a root cause of an alarm. Background Art
[0002] Ensuring the proper functioning of low-voltage electrical equipment is essential for safe and efficient operation. Alarms are essential for timely detection of problems. However, for some complex events, such as abnormal temperature rise in a low-voltage cabinet, simply receiving alarm information is not enough to identify and solve the problem. Root Cause Analysis (RCA) plays a vital role in such situations. By systematically analyzing the problem and revealing its root cause, it enables staff to identify the root cause behind the alarm, thereby making informed decisions and providing targeted solutions to ensure effective and accurate problem solving. Summary of the invention
[0003] A brief overview of the present invention is given below in order to provide a basic understanding of certain aspects of the present invention. It should be understood that this overview is not an exhaustive overview of the present invention. It is not intended to identify key or important parts of the present invention, nor is it intended to limit the scope of the present invention. Its purpose is merely to give certain concepts in a simplified form as a prelude to a more detailed description discussed later.
[0004] In view of this, an object of the embodiments of the present disclosure is to provide a method, an apparatus, an electronic device, and a storage medium for determining a root cause of generating an alarm.
[0005] According to one aspect of the present disclosure, a method for determining a root cause of an alarm is provided, which is used for a low-voltage switchgear, and includes:
[0006] Determine multiple possible reasons for the device to generate an alarm based on domain knowledge, and construct a Bayesian network by taking the alarm as a child node and the possible reasons as a parent node;
[0007] Simplifying the Bayesian network using a noisy-or model, estimating parameters of each parent node and parameters of directed edges between parent nodes and child nodes in the simplified Bayesian network, wherein the parameters of each parent node represent a first probability of occurrence of a possible cause, and the parameters of the directed edges represent a second probability that the parent node independently affects the occurrence of the child node, and in the noisy-or model, it is assumed that the effects of the parent node on whether the child node occurs are independent of each other; and
[0008] A possible cause having the greatest contribution among the multiple possible causes is determined as the root cause of the alarm based on the first probability and the second probability.
[0009] According to the method for determining the root cause of an alarm in the embodiment of the present disclosure, domain knowledge and real-time data are fully utilized to construct a Bayesian network, which can quantitatively identify the most likely root cause and significantly improve the accuracy and efficiency of root cause analysis. The Bayesian network is simplified using the noisy-or model, and by assuming that each parent node affects the child node independently, the number of required parameters is greatly reduced, thereby improving computational efficiency.
[0010] Optionally, the parameters of the parent node are determined based on domain knowledge, historical data or real-time data, and the parameters of the directed edge are based on constants determined by domain knowledge, historical data, or real-time data, or functions related to the real-time values of the parameters that generate alarms.
[0011] In this way, the parameters of the directed edges can be estimated using constants or functions according to different types of alarms, further improving the accuracy of the root cause analysis.
[0012] Optionally, determining a possible cause having the greatest contribution among the multiple possible causes as the root cause of the alarm based on the first probability and the second probability includes:
[0013] For each possible cause, the first probability associated with the possible cause is multiplied by the second probability to calculate the contribution of the possible cause, and the possible cause with the largest contribution is taken as the root cause of the alarm.
[0014] In this way, the contribution of each possible cause can be calculated simply and with high accuracy.
[0015] Optionally, the parent node includes multiple layers of parent nodes, and determining a possible cause having the greatest contribution among the multiple possible causes as the root cause of the alarm based on the first probability and the second probability includes:
[0016] Using a greedy algorithm, starting from the child node representing the alarm, the parent node with the largest contribution is determined layer by layer until a root node with the largest contribution is found as the root cause of the alarm.
[0017] Optionally, using a greedy algorithm, starting from the child node representing the alarm, determining the parent node with the largest contribution layer by layer until a root node with the largest contribution is found as the root cause of the alarm includes:
[0018] Start with the child node representing the alert;
[0019] Initialize the root cause as an alarm;
[0020] Determine whether the parent node of the root cause is a root node. If the parent node is determined to be a root node, determine the parent node as the root cause of the alarm. If the parent node is not a root node, determine all parent nodes of the root cause.
[0021] For each parent node, determining a contribution of the parent node based on its associated first probability and second probability;
[0022] Determine the parent node with the largest contribution;
[0023] Let the root cause be the parent node, and return to the operation of determining whether the parent node of the root cause is the root node, until it is determined that the parent node is the root node.
[0024] In this way, the root cause of the alarm can be determined for the device alarm that has built a multi-layer Bayesian network.
[0025] Optionally, the alarm is an abnormal temperature rise or abnormal system efficiency alarm, and the possible causes include at least one of the following: equipment aging, loose connection, overload, insulation problem, high ambient temperature, three-phase imbalance, harmonics, line aging, abnormal meter data, unknown wiring, high frequency, loose connection screws, oxidation or oil stains on the contact surface, contact aging, overload, and high ambient humidity.
[0026] According to another aspect of the present disclosure, there is provided a device for determining a root cause of an alarm, which is used in a low-voltage switch cabinet and includes:
[0027] A network construction unit is configured to determine multiple possible causes of generating an alarm based on domain knowledge, and construct a Bayesian network by taking the alarm as a child node and the possible cause as a parent node;
[0028] a parameter estimation unit configured to simplify the Bayesian network using a noisy-or model, and estimate parameters of each parent node and parameters of directed edges between parent nodes and child nodes in the simplified Bayesian network, wherein the parameters of each parent node respectively represent a first probability of occurrence of a possible cause, and the parameters of the directed edges represent a second probability that the parent node independently affects the occurrence of the child node, and in the noisy-or model, it is assumed that the effects of the parent node on whether the child node occurs are independent of each other;
[0029] A root cause determination unit is configured to determine, based on the first probability and the second probability, a possible cause with the greatest contribution among the multiple possible causes as a root cause of the alarm.
[0030] According to another aspect of the present disclosure, there is provided an electronic device, comprising a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the method for determining the root cause of an alarm as described in the first aspect.
[0031] According to another aspect of the present disclosure, a computer storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for determining the root cause of generating an alarm as described in the first aspect or any one of the embodiments of the first aspect is implemented.
[0032] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method for determining a root cause of generating an alarm as described in the first aspect or any one of the embodiments of the first aspect is implemented. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] The above and other purposes, features and advantages of the present invention will be more easily understood by referring to the following description of the embodiments of the present invention in combination with the accompanying drawings. The components in the accompanying drawings are only for illustrating the principles of the present invention. In the accompanying drawings, the same or similar technical features or components will be represented by the same or similar reference numerals. In the accompanying drawings:
[0034] Figure 1 A flowchart of an exemplary process of a method for determining a root cause of generating an alarm according to an embodiment of the present disclosure;
[0035] Figure 2 is a Venn diagram used to schematically illustrate the rationality of the method for calculating the contribution of possible causes;
[0036] Figure 3 is a flowchart of an exemplary process of step S106;
[0037] Figure 4 A block diagram of an exemplary configuration of an apparatus for determining a root cause of generating an alarm according to another embodiment of the present disclosure;
[0038] Figure 5 The present invention is a block diagram of an electronic device for determining a root cause of generating an alarm according to an embodiment of the present disclosure.
[0039] The reference numerals are as follows:
[0040] 100: Method for determining the root cause of the alarm S102, S104, S106, S1061, S1062, S1063, S1064, S1065, S1066, S1067, S1068: Steps 200: Venn diagram Y1, Y2, Y3, Y4, Y5: five mutually exclusive events
[0043] 400: Device that determines the root cause of the alarm 402: Network building block
[0044] 404: Parameter Estimation Unit 406: Root Cause Determination Unit
[0045] 500: Electronic device 502: Processor
[0046] 504: Memory DETAILED DESCRIPTION
[0047] The subject matter described herein will now be discussed with reference to example embodiments. It should be understood that the discussion of these embodiments is only to enable those skilled in the art to better understand and implement the subject matter described herein, and is not a limitation of the scope of protection, applicability or examples set forth in the claims. The function and arrangement of the elements discussed can be changed without departing from the scope of protection of the present disclosure. Various examples can omit, replace or add various processes or components as needed. For example, the described method can be performed in an order different from the described order, and various steps can be added, omitted or combined. In addition, the features described relative to some examples can also be combined in other examples.
[0048] As used herein, the term "including" and its variations represent open terms, meaning "including but not limited to". The term "based on" means "based at least in part on". The terms "one embodiment" and "an embodiment" mean "at least one embodiment". The term "another embodiment" means "at least one other embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other definitions may be included below, whether explicit or implicit. Unless the context clearly indicates otherwise, the definition of a term is consistent throughout the specification.
[0049] In view of this, the present disclosure proposes a root cause analysis method for analyzing the root cause of alarms generated by equipment, such as low-voltage switchgear, by combining domain knowledge, Bayesian networks and field data.
[0050] A Bayesian network is a probabilistic graphical model that represents the dependencies between variables through nodes and directed edges, making it very suitable for root cause analysis. In root cause analysis, Bayesian networks can help identify and infer potential causes of specific problems or failures. A Bayesian network consists of two parts: a directed acyclic graph (DAG) and a conditional probability distribution (CPD). DAG is used to represent the dependencies between variables, while CPD describes the conditional probability distribution of the current node given the state of the parent node.
[0051] In an exemplary embodiment according to the present disclosure, an alarm is taken as a child node, and possible causes of the alarm are taken as parent nodes to construct a Bayesian network, and then the Bayesian network is used to deduce the root cause of the alarm.
[0052] The specific implementation of the embodiments of the present disclosure is further explained below in conjunction with the accompanying drawings of the embodiments of the present disclosure.
[0053] Figure 1 The flowchart is an exemplary process of a method 100 for determining a root cause of an alarm for a low-voltage switchgear according to an embodiment of the present disclosure.
[0054] In step S102, multiple possible causes of generating an alarm are determined based on domain knowledge and real-time data of the device, and a Bayesian network is constructed by taking the alarm as a child node and the possible cause as a parent node.
[0055] In this step, all possible causes of an alarm are determined based on pre-set domain knowledge of related fields and real-time data of specific equipment and alarms.
[0056] In an exemplary embodiment, the low-voltage switch cabinet generates an alarm of abnormal temperature rise, and possible causes include: equipment aging, loose connection, overload, insulation problem, excessively high ambient temperature, etc.
[0057] Taking abnormal temperature rise as a child node, which is a leaf node without its child nodes, and equipment aging, loose connection, overload, insulation problem, and high ambient temperature as a parent node, a Bayesian network can be constructed.
[0058] In another exemplary embodiment, the low-voltage switchgear generates a system efficiency abnormality alarm. Possible causes include: three-phase imbalance, harmonics, excessive temperature rise of the circuit breaker, line aging, abnormal meter data, unknown wiring, etc. Among them, excessive temperature rise of the circuit breaker may be caused by a variety of different reasons, including: excessive frequency, loose connecting screws, oxidation or oil on the contact surface, contact aging, overload, excessive ambient humidity, etc.
[0059] In this case, the constructed Bayesian network is a multi-layer network, with system efficiency anomalies as leaf nodes, three-phase imbalance, harmonics, excessive temperature rise of circuit breaker, line aging, abnormal meter data, and unknown wiring as the first-layer parent nodes, and excessive temperature rise of circuit breaker also has its second-layer parent nodes: excessive frequency, loose connection screws, oxidation or oil stains on the contact surface, aging of contacts, overload, and excessive ambient humidity.
[0060] According to the specific equipment type and alarm type, a corresponding Bayesian network can be constructed, which can be a single-layer Bayesian network or a multi-layer Bayesian network. It can be understood that the above-mentioned low-voltage switchgear equipment and alarm types are only used to illustrate the technical solution according to the embodiment of the present disclosure, and the technical solution according to the embodiment of the present disclosure is not limited to specific equipment and specific alarms.
[0061] In step S104, the noisy-or model is used to simplify the Bayesian network, and the parameters of each parent node and the directed edges between the parent node and the child node are estimated in the simplified Bayesian network, wherein the parameters of each parent node respectively represent a first probability of a possible cause occurring, and the parameters of the directed edge represent the second probability that the parent node independently affects the occurrence of the child node. In the noisy-or model, it is assumed that the influence of the parent node on whether the child node occurs is independent of each other.
[0062] In an exemplary embodiment according to the present disclosure, a noisy-or model is used to simplify the conditional probability distribution of the parameters of the constructed Bayesian network.
[0063] The Noisy-or model is a generalization of the logical "or". When all the preconditions are false, the result event is false. In the Noisy-or model, a basic assumption is that the influence of all parent nodes on whether the child node occurs is independent of each other, that is, the influence of each parent node on whether the child node occurs is not affected by other parent nodes. Due to the independence assumption of the Noisy-or model, the parameters of each parent node can be estimated independently without considering the joint probability distribution with other parent nodes.
[0064] If you use q i Represents the i-th parent node R i The probability of the occurrence of the child node E is independently affected, then q i It can be expressed as:
[0065] q i =P(E=T|R1=F,R2=F,…,R i =T,R i+1 =F,…,R n =F)
[0066] Then, the conditional probability of child node E being true (T) calculated based on the Noisy-or model is:
[0067]
[0068] Therefore, based on the Noisy-or model, for a child node with n parent nodes, the number of its parameters increases from 2 n Reduced to n.
[0069] Table 1 below is a conditional probability distribution table of a Bayesian network where a child node E has three parent nodes R1, R2 and R3.
[0070] E T(True) F(false) <![CDATA[P(E|R1=T,R2=T,R3=T)]]> <![CDATA[p e1 ]]> <![CDATA[1-p e1 ]]> <![CDATA[P(E|R1=T,R2=T,R3=F)]]> <![CDATA[p e2 ]]> <![CDATA[1-p e2 ]]> <![CDATA[P(E|R1=T,R2=F,R3=T)]]> <![CDATA[p e3 ]]> <![CDATA[1-p e3 ]]> <![CDATA[P(E|R1=T,R2=F,R3=F)]]> <![CDATA[p e4 ]]> <![CDATA[1-p e4 ]]> <![CDATA[P(E|R1=F,R2=T,R3=T)]]> <![CDATA[p e5 ]]> <![CDATA[1-p e5 ]]> <![CDATA[P(E|R1=F,R2=T,R3=F)]]> <![CDATA[p e6 ]]> <![CDATA[1-p e6 ]]> <![CDATA[P(E|R1=F,R2=F,R3=T)]]> <![CDATA[p e7 ]]> <![CDATA[1-p e7 ]]> <![CDATA[P(E|R1=F,R2=F,R3=F)]]> <![CDATA[p e8 ]]> <![CDATA[1-p e8 ]]>
[0071] Table 1
[0072] As can be seen from Table 1, there are 8 independent parameters.
[0073] Table 2 is a conditional probability distribution table of the simplified Bayesian network of the Noisy-or model, which also has three parent nodes R1, R2 and R3.
[0074] E T(True) F(false) <![CDATA[P(E|R1=T,R2=T,R3=T)]]> <h2 style=";text-align:left;direction:ltr"><![CDATA[p <h2 style=";text-align:left;direction:ltr"> e1 <h2 style=";text-align:left;direction:ltr"> =1-(1-q1)(1-q2)(1-q3)]]><h2 style=";text-align:left;direction:ltr"> <![CDATA[1-p e1 ]]> <![CDATA[P(E|R1=T,R2=T,R3=F)]]> <h2 style=";text-align:left;direction:ltr"><![CDATA[p <h2 style=";text-align:left;direction:ltr"> e2 <h2 style=";text-align:left;direction:ltr"> =1-(1-q1)(1-q2)]]><h2 style=";text-align:left;direction:ltr"> <![CDATA[1-p e2 ]]> <![CDATA[P(E|R1=T,R2=F,R3=T)]]> <![CDATA[p e3 =1-(1-q1)(1-q3)]]> <![CDATA[1-p e3 ]]> <![CDATA[P(E|R1=T,R2=F,R3=F)]]> <![CDATA[p e4 =q1]]> <![CDATA[1-p e4 ]]> <![CDATA[P(E|R1=F,R2=T,R3=T)]]> <h2 style=";text-align:left;direction:ltr"><![CDATA[p <h2 style=";text-align:left;direction:ltr"> e5 <h2 style=";text-align:left;direction:ltr"> =1-(1-q2)(1-q3)]]><h2 style=";text-align:left;direction:ltr"> <![CDATA[1-p e5 ]]> <![CDATA[P(E|R1=F,R2=T,R3=F)]]> <h2 style=";text-align:left;direction:ltr"><![CDATA[p <h2 style=";text-align:left;direction:ltr"> e6 <h2 style=";text-align:left;direction:ltr"> =q2]]><h2 style=";text-align:left;direction:ltr"> <![CDATA[1-p e6 <!-- 5 -->]]> <![CDATA[P(E|R1=F,R2=F,R3=T)]]> <![CDATA[p e7 =q3]]> <![CDATA[1-p e7 ]]> <![CDATA[P(E|R1=F,R2=F,R3=F)]]> <![CDATA[p e8 =0]]> <![CDATA[1-p e8 ]]>
[0075] Table 2
[0076] As can be seen from Table 2, in the simplified Bayesian network, the conditional probability distribution table can be obtained from the three parameters q1, q2, and q3. Therefore, the number of required parameters is greatly reduced and the computational efficiency is improved.
[0077] In step S104, for the i-th parent node R i , that is, for each possible cause, based on domain knowledge, historical data or real-time data, first estimate its first probability p i , and then estimate the second probability q that the parent node independently affects the occurrence of the child node i .
[0078] Regarding the first probability, for example, for the reason of equipment aging, since it is strongly correlated with the service life of the equipment, we can use the service life of the equipment to estimate its probability.
[0079] In the case of only one layer of parent nodes, the second probability is the probability that a certain possible cause will cause an alarm to occur. For the case of multiple layers of parent nodes, it will be explained in detail below.
[0080] In a preferred embodiment, the parameter of the directed edge, i.e., the second probability, can be a function related to the real-time value of the child node determined based on historical data or by domain experts. In this case, a possible reason is that the probability of the alarm occurring is not a constant value, but a function related to the magnitude of the parameter generating the alarm.
[0081] For example, harmonics will cause increased system losses, but the increased losses usually do not exceed 50%. Therefore, for the directed edge from harmonics to loss anomalies, when the degree of loss anomaly is low (such as less than 30%), the probability will be relatively large. When the degree of loss anomaly is very high (such as greater than 50%), the probability of this edge will be significantly reduced.
[0082] That is to say, the parameter of a directed edge can be a constant, or a linear increasing function, a linear decreasing function, or various nonlinear functions. According to the type of alarm and cause, based on domain knowledge, historical data, or real-time data, an appropriate constant or function can be selected to estimate the second probability that the parent node causes the child node to occur.
[0083] In step S106, a possible cause with the greatest contribution is determined as the root cause of the alarm among the multiple possible causes based on the first probability and the second probability.
[0084] Specifically, for each possible cause, the first probability p associated with it is i Multiply by the second probability q i The product of the possible causes is taken as the contribution of the possible cause, and the possible cause with the largest contribution is taken as the root cause of the alarm.
[0085] The rationality of multiplying the first probability by the second probability to calculate the contribution of the possible cause is explained below.
[0086] Assuming that the parent nodes are independent of each other, for a child node with n parent nodes, the probability that the alarm E is true is:
[0087]
[0088] Define n new mutually exclusive events Y1, Y2, ..., Y n , whose probability distribution is P(Y i =T) = p i q i (i=1,2,...,n)
[0089] Then there is (Indicates that the set E is the union of all sets Yi from i=1 to n).
[0090] Figure 2 is a Venn diagram 200 including a set of Y1-Y5, wherein the size of the circle may represent the contribution of the corresponding event.
[0091] It can be seen from this that it is reasonable to consider the factor that has the greatest contribution to the alarm as the most likely root cause.
[0092] In another exemplary embodiment according to the present disclosure, the constructed Bayesian network has multiple layers, that is, some parent nodes are not root nodes, and also have their own parent nodes. In this case, step S106 specifically includes: using a greedy algorithm, starting from the child node representing the alarm, determining the parent node with the greatest contribution layer by layer until the root node with the greatest contribution is found as the root cause of the alarm. A greedy algorithm is an algorithm strategy that takes the best or optimal (i.e., most favorable) choice in the current state in each step of selection, thereby hoping to result in the best or optimal result globally.
[0093] Figure 3 This is a flowchart of an exemplary process of step S106 when constructing a multi-layer Bayesian network according to an embodiment of the present disclosure. Specifically, it includes:
[0094] In block S1061, starting from a child node representing an alarm;
[0095] In block S1062, the root cause is initialized as an alarm;
[0096] In block S1063, it is determined whether the parent node of the root cause is a root node. If it is determined that the parent node is a root node, the operation in block S1068 is performed to determine that the parent node is the root cause of the alarm. If the parent node is not a root node, the operation in block S1064 is performed to determine all parent nodes of the root cause.
[0097] At block S1065, for each parent node, determine the contribution of the parent node based on its associated first probability and second probability;
[0098] In block S1066, determining the parent node with the greatest contribution;
[0099] In block S1067, let the root be the parent node;
[0100] The method then returns to the operation in block S1063 until it is determined that the parent node is the root node.
[0101] After the root cause is determined, the root cause can also be traced back to the propagation route of the alarm.
[0102] Through this process, the root cause of the device alarm can be determined by building a multi-layer Bayesian network, and the root cause can be fed back to the user for further processing.
[0103] The present disclosure proposes a root cause analysis method for analyzing the root cause of alarms generated by equipment by combining domain knowledge, Bayesian networks, and field data. The technical solution according to the embodiment of the present disclosure has at least one of the following technical advantages:
[0104] By constructing a Bayesian network to handle uncertainty, the most likely root cause can be quantitatively identified, significantly improving the accuracy and efficiency of root cause analysis.
[0105] The noisy-or model is used to simplify the Bayesian network. By assuming that each parent node affects its child nodes independently, the number of required parameters is greatly reduced and the computational efficiency is improved.
[0106] Domain knowledge and real-time data are fully utilized, and the network structure built based on domain knowledge is more reliable and more accurate.
[0107] Estimating network parameters does not require a large amount of training data and requires very few parameters, so the method for determining the root cause of an alarm according to an embodiment of the present disclosure is easy to deploy.
[0108] Although method 100 and the steps included therein are described as a series of actions performed in sequence, it should be understood that method 100 may not be limited by this sequence. For example, unless otherwise specified, the order in which certain actions occur may be different from the order described herein. In addition, in some cases, an action may occur simultaneously with another action. In addition, in some cases, not all actions are required to implement the method described herein.
[0109] Based on the method for determining the root cause of an alarm provided in any of the above embodiments, the present disclosure provides a device for determining the root cause of an alarm, such as Figure 4 shown. Figure 4 FIG. 4 is a block diagram of an exemplary configuration of an apparatus 400 for determining a root cause of an alarm according to another embodiment of the present disclosure. The apparatus 400 is used in a low-voltage switch cabinet to perform the following steps: Figure 1 The method for determining the root cause of an alarm is shown.
[0110] like Figure 4 As shown, the device 400 for determining the root cause of generating an alarm includes: a network construction unit 402 , a parameter estimation unit 404 and a root cause determination unit 406 .
[0111] The network construction unit 402 is configured to determine multiple possible causes of generating an alarm based on domain knowledge, and construct a Bayesian network by taking the alarm as a child node and the possible cause as a parent node.
[0112] The parameter estimation unit 404 is configured to simplify the Bayesian network using a noisy-or model, and estimate the parameters of each parent node and the parameters of the directed edges between the parent node and the child node in the simplified Bayesian network, wherein the parameters of each parent node represent a first probability of a possible cause occurring, and the parameters of the directed edge represent a second probability that the parent node causes the child node to occur. In the noisy-or model, it is assumed that the effects of the parent node on whether the child node occurs are independent of each other.
[0113] The root cause determination unit 406 is configured to determine, based on the first probability and the second probability, a possible cause having the greatest contribution among the multiple possible causes as the root cause of the alarm.
[0114] The device for determining the root cause of an alarm in the embodiment of the present disclosure is used to implement the corresponding device for determining the root cause of an alarm in the aforementioned multiple method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described in detail here. In addition, the functional implementation of each module in the device for determining the root cause of an alarm in the embodiment of the present disclosure can refer to the description of the corresponding parts in the aforementioned method embodiments, which will not be described in detail here.
[0115] It should be noted that Figure 4 The structure of the device 400 for determining the root cause of an alarm and its components is only exemplary, and those skilled in the art may modify it as needed. Figure 4 Modify the structure block diagram shown.
[0116] Based on the method for determining the root cause of an alarm described in any of the above embodiments, an embodiment of the present disclosure provides an electronic device 500, which may include at least one processor 502, and the processor 502 executes at least one computer-readable instruction stored or encoded in a computer-readable storage medium (i.e., a memory 504).
[0117] It should be understood that the computer executable instructions stored in the memory 504, when executed, cause at least one processor 502 to perform the above combined operations in various embodiments of the present disclosure. Figure 1-4 Describes the various operations and functions.
[0118] Based on the method for determining the root cause of an alarm described in any of the above embodiments, an embodiment of the present disclosure provides a computer storage medium storing a computer program, which implements the method described in any of the above embodiments when executed by a processor.
[0119] Based on the method for determining the root cause of generating an alarm described in any of the above embodiments, an embodiment of the present disclosure provides a computer program product, including a computer program, which implements the method described in any of the above embodiments when executed by a processor.
[0120] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.
[0121] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as a computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and to be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor or programmable or dedicated hardware (such as an ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the modulation method of the frequency converter described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the target detection method shown here, the execution of the code converts the general-purpose computer into a dedicated computer for executing the target detection method shown here.
[0122] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.
[0123] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.
[0124] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.
[0125] The above implementation methods are only used to illustrate the embodiments of the present application, and are not limitations on the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application. The scope of patent protection of the embodiments of the present application should be limited by the claims.
[0126] Nouns and pronouns relating to persons in this patent application are not limited to a specific gender.
Claims
1. A method for determining the root cause of an alarm, for use in a low voltage switch cabinet, the method comprising: Determine multiple possible reasons for the device to generate an alarm based on domain knowledge, and construct a Bayesian network with the alarm as a child node and the possible reasons as a parent node (S102); Simplifying the Bayesian network using a noisy-or model, estimating the parameters of each parent node and the parameters of the directed edges between the parent node and the child node in the simplified Bayesian network, wherein the parameters of each parent node represent a first probability of occurrence of a possible cause, and the parameters of the directed edge represent a second probability that the parent node independently affects the occurrence of the child node, and in the noisy-or model, it is assumed that the effects of the parent node on whether the child node occurs are independent of each other (S104); and A possible cause having the greatest contribution among the multiple possible causes is determined as the root cause of the alarm based on the first probability and the second probability (S106).
2. The method according to claim 1, wherein: The parameters of the parent node are determined based on domain knowledge, historical data or real-time data, and the parameters of the directed edge are constants determined based on domain knowledge, historical data or real-time data, or are functions related to the real-time values of the parameters that generate alarms.
3. The method according to claim 1, wherein: Determining a possible cause having the greatest contribution among the multiple possible causes as the root cause of the alarm based on the first probability and the second probability (S106) includes: For each possible cause, the first probability associated with the possible cause is multiplied by the second probability to calculate the contribution of the possible cause, and the possible cause with the largest contribution is taken as the root cause of the alarm.
4. The method according to any one of claims 1 to 3, wherein: The parent node includes multiple layers of parent nodes, and determining a possible cause having the greatest contribution among the multiple possible causes as the root cause of the alarm based on the first probability and the second probability (S106) includes: Using a greedy algorithm, starting from the child node representing the alarm, the parent node with the largest contribution is determined layer by layer until a root node with the largest contribution is found as the root cause of the alarm.
5. The method according to claim 4, wherein: Using a greedy algorithm, starting from the child node representing the alarm, determining the parent node with the largest contribution layer by layer until finding the root node with the largest contribution as the root cause of the alarm further includes: Start with the child node representing the alert; Initialize the root cause as an alarm; Determine whether the parent node of the root cause is a root node. If the parent node is determined to be a root node, determine the parent node as the root cause of the alarm. If the parent node is not a root node, determine all parent nodes of the root cause. For each parent node, determining a contribution of the parent node based on its associated first probability and second probability; Determine the parent node with the largest contribution; Let the root cause be the parent node, and return to the operation of determining whether the parent node of the root cause is the root node, until it is determined that the parent node is the root node.
6. The method according to any one of claims 1 to 3, wherein: The alarm is an abnormal temperature rise or abnormal system efficiency alarm, and the possible reasons include at least one of the following: equipment aging, loose connection, overload, insulation problem, high ambient temperature, three-phase imbalance, harmonics, line aging, abnormal meter data, unknown wiring, high frequency, loose connection screws, oxidation or oil on the contact surface, contact aging, overload, and high ambient humidity.
7. A device (400) for determining the root cause of an alarm, used in a low-voltage switch cabinet, the device comprising: A network construction unit (402) is configured to determine multiple possible causes of generating an alarm based on domain knowledge, and construct a Bayesian network using the alarm as a child node and the possible cause as a parent node; a parameter estimation unit (404), configured to simplify the Bayesian network using a noisy-or model, and estimate the parameters of each parent node and the parameters of the directed edges between the parent node and the child node in the simplified Bayesian network, wherein the parameters of each parent node represent a first probability of occurrence of a possible cause, and the parameters of the directed edges represent a second probability that the parent node independently affects the occurrence of the child node, and in the noisy-or model, it is assumed that the effects of the parent node on whether the child node occurs are independent of each other; and A root cause determination unit (406) is configured to determine, based on the first probability and the second probability, a possible cause having the greatest contribution among the multiple possible causes as a root cause of the alarm.
8. A computing device (500), comprising: at least one processor (502); as well as A memory (504) coupled to the at least one processor (502), the memory being used to store instructions, which, when executed by the at least one processor (502), causes the processor (502) to perform the method according to any one of claims 1 to 6.
9. A computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 6.
10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.