Abnormal alarm identification method for emergency protection circuit device based on large model

Abstract

The invention relates to an emergency protection circuit device abnormal alarm identification method based on a large model, and the method comprises the following steps: obtaining and analyzing an abnormal alarm record of an emergency protection circuit device, and obtaining structured abnormal alarm data; constructing an abnormal alarm feature vector space; clustering the abnormal alarm data in the feature vector space, and identifying typical alarm modes in different fault modes; dynamically generating induction information aiming at a specific alarm mode in combination with circuit action logic and fault induction factors; screening out unique information with low semantic similarity as an induced action candidate; constructing an induction strategy reinforcement learning model, and finding an optimal induction strategy through iterative optimization; processing real-time abnormal alarms by applying an optimal induction strategy; evaluating a processing effect, and predicting a potential abnormal trend in combination with a maintenance period; and regularly performing incremental training on the large model. According to the method, the processing efficiency and accuracy of the abnormal alarm can be effectively improved, and the reliability and safety of the system are enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of circuit anomaly identification, and in particular to a method for identifying an abnormal alarm of an emergency protection circuit device based on a large model. Background Art

[0002] In the abnormal alarm identification system of emergency protection circuit devices based on large models, we are faced with a complex technical problem. The induced information is a set of key features and patterns extracted and generated by intelligent algorithms based on historical abnormal alarm data. It is used to assist the emergency protection circuit device to quickly and accurately identify and locate abnormal conditions and provide targeted decision support.

[0003] The current system has the problem of low efficiency when processing induced information, which is mainly reflected in the lack of pertinence and diversity in the construction process of induced information. For example, in a certain substation, due to poor contact of the secondary circuit, an abnormal alarm occurs in the differential protection of a certain transformer, but in historical data, similar abnormal alarms may have multiple reasons, such as internal fault of the transformer, CT saturation, harmonic interference, etc.; when analyzing historical data, the system may not be able to accurately distinguish these reasons, so the generated induced information lacks pertinence. Specifically, when analyzing historical alarm data, it is difficult for the system to accurately identify the key factors and patterns that cause the abnormality, which directly affects the quality and effectiveness of the induced information; at the same time, due to the diversity of abnormal types and scenarios, the existing induced information generation mechanism cannot meet the needs in different situations, resulting in the system's slow response or misjudgment when facing complex abnormalities. This means that the accuracy and diversity of induced information generation in the abnormal alarm identification system of emergency protection circuit devices are currently low. Summary of the invention

[0004] In order to solve the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide an abnormal alarm identification method for an emergency protection circuit device based on a large model. The abnormal alarm identification method for an emergency protection circuit device based on a large model significantly improves the efficiency and accuracy of abnormal alarm processing through automatic acquisition, intelligent analysis, cluster analysis, dynamic induced information generation, semantic screening, reinforcement learning optimization and abnormal trend prediction, reduces the need for manual intervention, and enhances system stability and security.

[0005] The present invention discloses a method for identifying abnormal alarms of emergency protection circuit devices based on a large model, comprising the following steps: S1. Obtain and analyze abnormal alarm records of emergency protection circuit devices to obtain structured abnormal alarm data; S2, extracting abnormal alarm key features from the abnormal alarm data and constructing an abnormal alarm feature vector space; S3, clustering the abnormal alarm data in the abnormal alarm feature vector space, and identifying typical abnormal alarm modes under different emergency protection circuit failure modes; S4, dynamically generating induction information according to the action logic of the emergency protection circuit and the typical abnormal alarm mode, combined with the fault inducing factors; S5, performing semantic analysis on the inducing information, calculating the semantic similarity of different inducing information, and selecting the inducing information with a semantic similarity lower than a threshold as an inducing action candidate set; S6. Taking the candidate set of induced actions as the state space and the abnormal alarm processing effect as the reward, an induced strategy reinforcement learning model is constructed, and the optimal induced strategy for different abnormal alarm modes is obtained through iterative optimization; S7, applying the optimal induction strategy to process real-time abnormal alarms; S8. Evaluate the effect of abnormal alarm processing and predict potential abnormal trends in combination with the maintenance cycle of the emergency protection circuit; S9. According to the prediction results of abnormal trends, adjust the state transition probability and reward function parameters in the induced strategy reinforcement learning model, and regularly perform incremental training on the large model.

[0006] Preferably, the step S1 specifically includes: Acquire abnormal alarm record information from a database of the emergency protection circuit device, wherein the abnormal alarm record information includes alarm time, alarm content and alarm code; Analyzing the abnormal alarm triggering condition and the abnormal alarm level according to the abnormal alarm record information to obtain structured abnormal alarm data; The parsing process consists of the following steps: Data cleaning methods were used to remove duplicate records and fill in missing values; Extract key information based on preset regular expression matching to obtain the abnormal alarm data set after preliminary processing; Perform word frequency statistics and TF-IDF analysis on the alarm content in the abnormal alarm data set to extract keywords and features; According to the preset fault component type dictionary and fault mode combination rule base, the alarm content is mapped to the corresponding fault component type and fault mode combination to obtain the structured abnormal alarm data.

[0007] Preferably, the step S2 specifically includes: The key features of the abnormal alarm include the topology of the emergency protection circuit, component parameters, fault mode, fault occurrence time difference and fault location correlation; Constructing the abnormal alarm feature vector space includes the following steps: Acquire abnormal alarm data, process missing values ​​for the abnormal alarm data, remove abnormal values ​​by using a box plot method, and obtain a cleaned abnormal alarm data set; Obtain the cleaned abnormal alarm data set, extract the emergency protection circuit topology structure features from it, convert the circuit topology structure into a vector representation, and obtain the topology structure feature vector; For the component parameters, kernel principal component analysis is used to reduce the dimension, and the principal components whose cumulative contribution rate reaches the preset threshold are selected as the component parameter features; The fault mode is encoded and represented by word embedding technology to obtain the joint feature vector of component parameters and fault mode; Calculate the time difference between adjacent faults and use the sliding window method to extract time series features; Perform spatial clustering on the fault locations, use Gaussian kernel function to perform kernel density estimation, obtain the correlation probability distribution of the fault locations, and generate spatiotemporal feature vectors; The topological structure feature vector, the joint feature vector of the component parameters and the fault mode, and the spatiotemporal feature vector are obtained, and the vectors are integrated by a feature cascade method to construct the abnormal alarm feature vector space.

[0008] Preferably, the step S3 specifically includes: Acquire an abnormal alarm feature vector in the abnormal alarm feature vector space, wherein the abnormal alarm feature vector maps a feature value to a range of zero to one by a minimum-maximum scaling method; Using the UMAP algorithm to reduce the feature dimension of the abnormal alarm feature vector to obtain the abnormal alarm feature vector after dimension reduction; The DBSCAN algorithm is used to perform density clustering on the abnormal alarm feature vector after dimension reduction, and the optimal parameters are determined by the grid search method to obtain the clustering results; Calculate the fault severity index of each cluster by combining the fault impact scope and duration; The typical abnormal alarm modes under different emergency protection circuit failure modes are identified according to the difference in fault severity and the overlap of fault propagation paths.

[0009] Preferably, the step S4 specifically includes: According to the action logic of the emergency protection circuit and the typical abnormal alarm mode, a corresponding induction information template is selected from the induction information template library, and the induction information is dynamically generated based on the action time and reset mode of the emergency protection circuit and in combination with the fault inducing factors; The induction information template selection comprises the following steps: The current fault condition and the pre-established induction information template library are obtained, the similarity score between the induction information template and the current fault condition is calculated according to the TF-IDF algorithm, and the template with the highest similarity score is selected as the induction information template.

[0010] Preferably, the step S5 specifically includes: Performing semantic analysis on the induced information to extract key terms, wherein the key terms include a fault component name, a fault mode description, and a circuit protection action; Calculating the semantic similarity of different induced information, and selecting the induced information with a semantic similarity lower than a threshold as an induced action candidate set; The semantic analysis comprises the following steps: Acquire the induced information, and perform word segmentation processing on the induced information; The hidden Markov model is used to perform part-of-speech tagging on the word segmentation results, and the tagging results including nouns, verbs and adjectives are obtained; According to the annotation results, the Word2Vec algorithm is used to map the key terms into a vector space of preset dimensions; The cosine similarity calculation method is used to determine the semantic similarity between different induced information and generate a semantic similarity matrix.

[0011] Preferably, in step S6, constructing the induction strategy reinforcement learning model includes the following steps: Acquire the induced action candidate set, and map the induced action candidate set into a discrete action space; The observation space is constructed according to the type, severity, and duration characteristics of the abnormal alarm, and the observation space is obtained by using one-hot encoding and normalization processing; The induced strategy reinforcement learning model is constructed according to discrete action space and observation space.

[0012] Preferably, in step S7, applying the optimal induction strategy to process the real-time abnormal alarm includes the following steps: Obtain data including alarm information from the monitoring system, determine whether unknown alarm trigger conditions appear in the alarm information, and determine the corresponding alarm information level. The determination method is as follows: Perform keyword matching according to the alarm information and determine whether it is a known alarm type. If the match is successful, it is determined to be a known alarm type. If the match fails, it is determined to be an unknown alarm type and the alarm information is marked as an unknown alarm trigger condition. Obtain keywords in the alarm information and calculate the severity score and occurrence frequency of the keywords; The alarm score is determined based on the severity score and the frequency of occurrence, and the alarm level of the alarm information is determined based on whether the alarm score exceeds the preset alarm level threshold.

[0013] Preferably, in step S8, evaluating the abnormal alarm processing effect includes the following steps: After applying the optimal induction strategy to handle the real-time abnormal alarm, obtain the current abnormal alarm information, and calculate the comprehensive processing effect score according to the preset evaluation index system, the evaluation index system includes the alarm resolution time, the system recovery degree and the operator feedback score; If the comprehensive processing effect score is lower than the preset threshold, the pre-trained BERT model is called to perform semantic analysis on the historical alarm text; A multi-head attention mechanism is used to extract key event sequences and timestamp information from historical alarm texts to construct a time-series evolution graph of fault modes. According to the time series evolution graph, a long short-term memory network is used to model the development trend of the fault mode, obtain the time series evolution law of the fault mode, and learn the time series evolution law.

[0014] Preferably, in step S9, regularly performing incremental training on the large model includes the following steps: According to the calculation results of the transition frequencies between each state, the state transition probability matrix in the reinforcement learning model is updated; The gradient descent method is used to optimize the weight coefficients of various indicators in the reward function, and the learning rate of the gradient descent method is set to a preset value; Obtain newly emerged abnormal alarm samples, pre-process the abnormal alarm samples, and use the Word2Vec algorithm to vectorize the pre-processed abnormal alarm samples to obtain a new training data set; The new abnormal alarms are added to the training corpus, combined with the new training data set, and the stochastic gradient descent algorithm is used to perform incremental training on the large model.

[0015] The method for identifying abnormal alarms of emergency protection circuit devices based on a large model described in the present invention has the following advantages: The invention discloses an abnormal alarm identification method for an emergency protection circuit device based on a large model, which realizes intelligent identification and classification of abnormal alarms by automatically acquiring and parsing abnormal alarm records, extracting key features, and performing cluster analysis, thereby greatly reducing the need for manual intervention and improving processing efficiency and accuracy; dynamically generates induced information in combination with the action logic of the emergency protection circuit and the fault-inducing factors, and can flexibly respond to different types of fault modes; screens induced information with low semantic similarity through semantic analysis, thereby enhancing the pertinence and effectiveness of the strategy; uses a reinforcement learning model for iterative optimization, which can continuously learn and adapt to new abnormal alarm modes, dynamically adjusts the induced strategy to achieve the optimal processing effect, and can continuously improve the accuracy and efficiency of abnormal alarm processing; and predicts potential abnormal trends by evaluating the abnormal alarm processing effect and combining it with the maintenance cycle of the emergency protection circuit, which helps to discover and deal with potential problems in advance, reduce the risk of faults, and improve the reliability and safety of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flow chart of a method for identifying abnormal alarms of emergency protection circuit devices based on a large model described in the present invention. DETAILED DESCRIPTION

[0017] like Figure 1 As shown, the method for identifying abnormal alarms of emergency protection circuit devices based on a large model of the present invention comprises the following steps: S1. Obtain and analyze abnormal alarm records of emergency protection circuit devices to obtain structured abnormal alarm data; S2. Extract key features of abnormal alarm from abnormal alarm data and construct abnormal alarm feature vector space; extract key features of abnormal alarm from abnormal alarm data by using feature engineering method; S3, clustering the abnormal alarm data in the abnormal alarm feature vector space, and identifying typical abnormal alarm patterns under different emergency protection circuit failure modes; S4. Dynamically generate induction information based on the action logic of the emergency protection circuit and typical abnormal alarm mode, combined with the fault inducing factors; S5. Perform semantic analysis on the induced information, calculate the semantic similarity of different induced information, and select the induced information with semantic similarity lower than a threshold as the induced action candidate set; calculating the semantic similarity of different induced information requires mapping the induced information into a vector space, and measuring the difference between the induced information according to the intersection of the fault impact range; S6. Taking the candidate set of induced actions as the state space and the abnormal alarm processing effect as the reward, an induced strategy reinforcement learning model is constructed, and the optimal induced strategy for different abnormal alarm modes is obtained through iterative optimization; S7. Apply the optimal induction strategy to handle real-time abnormal alarms; S8. Evaluate the effect of abnormal alarm processing and predict potential abnormal trends in combination with the maintenance cycle of the emergency protection circuit; S9. According to the prediction results of abnormal trends, adjust the state transition probability and reward function parameters in the induced strategy reinforcement learning model, and regularly perform incremental training on the large model; regularly perform incremental training on the large model to continuously improve the recognition and prediction capabilities of abnormal alarms.

[0018] Furthermore, in this embodiment, step S1 specifically includes: Acquire abnormal alarm record information from a database of the emergency protection circuit device, the abnormal alarm record information including alarm time, alarm content and alarm code; Analyze the abnormal alarm trigger conditions and abnormal alarm levels according to the abnormal alarm record information to obtain structured abnormal alarm data; the abnormal alarm trigger conditions include the combination of fault component types and the combination of fault modes; The parsing process consists of the following steps: Data cleaning methods were used to remove duplicate records and fill in missing values; Extract key information based on preset regular expression matching to obtain the abnormal alarm data set after preliminary processing; Perform word frequency statistics and TF-IDF analysis on the alarm contents in the abnormal alarm data set to extract keywords and features; According to the preset fault component type dictionary and fault mode combination rule base, the alarm content is mapped to the corresponding fault component type and fault mode combination to obtain structured abnormal alarm data; Furthermore, for the structured abnormal alarm data, combined with the multi-dimensional characteristics of alarm frequency, duration and impact range, a weighted sum score is performed on each abnormal alarm record; The K-means clustering algorithm is used to divide the scoring results into different alarm levels to obtain a complete structured abnormal alarm data set containing alarm level information; Perform statistical analysis on the complete structured abnormal alarm data set to extract the frequently occurring fault component type combinations and fault mode combinations; High-frequency combinations of fault component types and fault mode combinations are used for subsequent abnormal alarm prediction and diagnosis; The Apriori algorithm is used to identify the correlation patterns between abnormal alarms in the complete structured abnormal alarm data set; Generate an abnormal alarm trigger condition rule set based on the correlation pattern, and the abnormal alarm trigger condition rule set is used for subsequent abnormal alarm prediction and diagnosis; Here is an example: Acquire abnormal alarm record information from the database of the emergency protection circuit device. The abnormal alarm record information includes alarm time, alarm content and alarm code. Remove duplicate records and fill missing values ​​through data cleaning. Use regular expression matching to extract key information. For example, use "[AZ]\d{3}" to match the alarm code to obtain the abnormal alarm data set after preliminary processing. According to the preset fault component type dictionary and fault mode combination rule base, the alarm content in the abnormal alarm data set is counted by word frequency and TF-IDF analysis, and keywords and features such as alarm duration and number of affected devices are extracted. The alarm content is mapped to the corresponding fault component type and fault mode combination, and structured abnormal alarm data containing fault types and modes is generated; For structured abnormal alarm data, combined with the multi-dimensional features of alarm frequency, duration, and impact range, each abnormal alarm record is weighted and scored. The K-means clustering algorithm is used to divide the scoring results into different alarm levels to form a complete structured abnormal alarm data set containing alarm level information. Perform statistical analysis on the complete structured abnormal alarm data set, extract the frequently occurring fault component type combinations and fault mode combinations, use the Apriori algorithm to identify the correlation patterns between abnormal alarms, and generate abnormal alarm trigger condition rule sets as the basis for subsequent abnormal alarm prediction and diagnosis; Specifically, abnormal alarm record information is extracted from the database of the emergency protection circuit device. During the data cleaning process, duplicate records are removed and missing values ​​are filled, for example, missing alarm time is filled with the time of the most recent record; Use the regular expression "[AZ]\d{3}" to match the alarm code and extract key information such as "E001" and "A102"; Perform word frequency statistics and TF-IDF analysis on the cleaned data set, extract keywords such as "overvoltage" and "short circuit", and calculate features such as alarm duration (in hours) and the number of affected devices; Map the keyword "overvoltage" to the fault component type "power module" and the fault mode to "voltage abnormality"; Score the structured abnormal alarm data, for example, the alarm frequency (number of occurrences per hour) is weighted 0.3, the duration (hours) is weighted 0.4, the impact scope (number of affected devices) is weighted 0.3, and the weighted score is calculated; Use the K-means clustering algorithm, set k=3, and divide the scoring results into three alarm levels: high, medium, and low; Perform statistical analysis on the complete structured abnormal alarm data set to extract frequently occurring fault component type combinations such as "power module + signal processing unit" and fault mode combinations such as "voltage abnormality + signal loss"; Use the Apriori algorithm, set the minimum support to 0.1, and the minimum confidence to 0.8, to identify the association pattern between abnormal alarms. For example, if the voltage of the power module is abnormal, there is an 80% probability that the signal processing unit will lose the signal. Generate an abnormal alarm trigger condition rule set. Furthermore, natural language processing methods are used to extract information from the acquired abnormal alarm records. The pre-trained large model is used to locate the fault component type and key information of the fault mode through the named entity recognition method. The relationship between entities is extracted based on syntactic dependency analysis to construct the logical combination of abnormal alarm triggering conditions. Specifically, abnormal alarm records are obtained, word segmentation and part-of-speech tagging are performed on the abnormal alarm records, and the abnormal alarm records are encoded using a pre-established BERT-base-chinese model to obtain a text vector set; According to the text vector set, the BiLSTM-CRF model is used to perform entity labeling on the text vector set. By setting the input layer, BiLSTM hidden layer and CRF output layer, the key entities are identified and the entity recognition result set is obtained. For the entity recognition result set, the Stanford dependency parser is used to perform syntactic structure analysis, extract the subject-verb-object relationship, and obtain the syntactic analysis results; The semantic dependency graph method is used to process the syntactic analysis results, determine the semantic relationship between entities, and form an entity relationship graph; Obtain an entity relationship diagram, use a template-based rule generation method to build a logical expression of the trigger condition, generate a specific logical combination by filling in the preset template, and obtain the logical combination of the abnormal alarm trigger condition; Here is an example: Obtain abnormal alarm records from the database, perform word segmentation and part-of-speech tagging on the record content, use the BERT-base-chinese pre-trained model to encode the text, and obtain a set of preliminarily processed text vectors; Based on the BiLSTM-CRF model, the text vector set is labeled with the entity of the fault component type and fault mode. By setting the input layer, BiLSTM hidden layer and CRF output layer, key entities such as "transformer" and "overheating" are identified, and the entity recognition result set is constructed. The Stanford dependency parser is used to perform syntactic structure analysis on the entity recognition result set to extract the subject-verb-object relationship. The semantic dependency graph method is used to determine the semantic relationship between entities, such as the causal relationship between "transformer" and "overheating", to form an entity relationship graph. According to the entity relationship diagram, the template-based rule generation method is used to build the logical expression of the trigger condition, define the logical operators and templates, such as "if [entity 1][relationship][entity 2], then trigger [alarm type]", and generate specific logical combinations by filling in the template, such as "if the transformer temperature is greater than the preset threshold, then trigger the overheating alarm", and finally generate the logical combination of the abnormal alarm trigger condition; Obtain abnormal alarm records from the database, such as "The temperature of the transformer A phase is too high, triggering the protection", segment the records to obtain "Transformer / A phase / temperature / too high / , / trigger / protection", and mark the part of speech as "n / n / n / a / w / v / vn"; The BERT-base-chinese pre-trained model is used to encode the word segmentation results and generate a 768-dimensional vector representation. The BiLSTM-CRF model is used for entity labeling, with the input layer set to 768 dimensions, the BiLSTM hidden layer set to 256 dimensions, and the CRF output layer set to the number of entity labels. The entity "transformer" is identified as the fault component type, and "overtemperature" is identified as the fault mode. Use the Stanford Dependency Parser to analyze the sentence structure and obtain the dependency relations "nsubj (too high - 4, temperature - 3)" and "dobj (trigger - 6, protection - 7)"; Using the semantic dependency graph method, an "attribute-attribute" relationship is established between "transformer" and "overtemperature", and a "cause-effect" relationship is established between "overtemperature" and "protection"; According to the entity relationship diagram, use the predefined template "If [entity 1] [relationship] [entity 2], then trigger [alarm type]" to fill in the logical expression "If the transformer temperature is greater than 80°C, then trigger the overheat alarm"; By connecting multiple conditions through the logical operators "AND" and "OR", a logical combination of abnormal alarm triggering conditions is finally generated. For example, "if the temperature of phase A of the transformer is greater than 80°C and lasts for more than 10 minutes, or the temperature of phase B is greater than 85°C, the transformer overheating alarm is triggered."

[0019] Furthermore, in this embodiment, step S2 specifically includes: The key features of abnormal alarms include emergency protection circuit topology, component parameters, fault mode, fault occurrence time difference and fault location correlation; Constructing the abnormal alarm feature vector space includes the following steps: Acquire abnormal alarm data, process missing values ​​for abnormal alarm data, remove outliers through box plot method, and obtain the cleaned abnormal alarm data set; the missing values ​​of abnormal alarm data are processed by median filling method; Obtain the cleaned abnormal alarm data set, extract the emergency protection circuit topology structure features from it, convert the circuit topology structure into a vector representation, and obtain the topology structure feature vector; convert the circuit topology structure into a vector representation by using the Node2Vec algorithm; For the component parameters, kernel principal component analysis is used to reduce the dimension, and the principal components whose cumulative contribution rate reaches the preset threshold are selected as the component parameter features; The fault mode is encoded and represented by word embedding technology to obtain the joint feature vector of component parameters and fault mode; Calculate the time difference between adjacent faults and use the sliding window method to extract time series features; The fault locations are spatially clustered, and the Gaussian kernel function is used to estimate the kernel density to obtain the correlation probability distribution of the fault locations and generate the spatiotemporal feature vectors. The DBSCAN algorithm is used to spatially cluster the fault locations. Obtain the topological structure feature vector, the joint feature vector of component parameters and fault modes, and the spatiotemporal feature vector, integrate the vectors through the feature cascade method, and construct the abnormal alarm feature vector space; Specifically, the abnormal alarm data is cleaned, the missing values ​​are processed by the median filling method, the outliers are removed by the box plot method, and the data format is unified by the regularization method to obtain the cleaned abnormal alarm data set; The topological structure features of the emergency protection circuit are extracted from the cleaned abnormal alarm data set. The circuit topological structure is converted into a vector representation using the Node2Vec algorithm. The importance of key nodes is quantified by calculating the node degree centrality and betweenness centrality to obtain the topological structure feature vector. Kernel principal component analysis is used to reduce the dimension of component parameters, and the principal components with a cumulative contribution rate of 95% are selected as component parameter features. The fault mode is encoded and represented by combining the word embedding method, and the joint feature vector of component parameters and fault modes is constructed. Calculate the time difference between adjacent faults, use the sliding window method to extract time series features, combine the DBSCAN algorithm to perform spatial clustering of fault locations, use the Gaussian kernel function to perform kernel density estimation, calculate the correlation probability distribution of fault locations, and generate a spatiotemporal feature vector; The topological structure feature vector, component parameters, joint feature vector of fault mode and spatiotemporal feature vector are integrated through the feature cascade method to construct the final abnormal alarm feature vector space. Here is an example: Clean the abnormal alarm data and use the median filling method to handle missing values. For example, fill the missing voltage value with 120V. Use the box plot method to set 1.5 times the interquartile range as the threshold to remove abnormal values. Use the regular expression "^\d{4}-\d{2}-\d{2}\d{2}:\d{2}:\d{2}$" to unify the time format. The circuit topology is extracted from the cleaned data, and the topology is converted into a 128-dimensional vector using the Node2Vec algorithm. The walk length is set to 80, the window size is set to 10, and the node degree centrality and betweenness centrality are calculated. For example, the node with the highest degree centrality is 0.85, and the highest betweenness centrality is 0.72. Kernel principal component analysis was applied to the component parameters, and the first five principal components were selected, with a cumulative contribution rate of 96.3%. The fault mode was encoded into a 50-dimensional vector using the Word2Vec algorithm; Calculate the time difference between adjacent faults and use a 60-minute sliding window to extract time series features such as fault frequency and duration; The DBSCAN algorithm is used for spatial clustering. EPS=0.5 and min_samples=5 are set to obtain three fault clusters. The Gaussian kernel function with a standard deviation of 0.1 is used for kernel density estimation to calculate the correlation of fault locations. The 128-dimensional topological features, 55-dimensional component parameters, fault mode features, and 60-dimensional spatiotemporal features are cascaded to construct a 243-dimensional abnormal alarm feature vector space.

[0020] Furthermore, in this embodiment, step S3 specifically includes: Obtaining an abnormal alarm feature vector in an abnormal alarm feature vector space, and mapping a feature value of the abnormal alarm feature vector to a range of zero to one by using a minimum-maximum scaling method; The UMAP algorithm is used to reduce the feature dimension of the abnormal alarm feature vector to obtain the abnormal alarm feature vector after dimension reduction; The DBSCAN algorithm is used to perform density clustering on the abnormal alarm feature vector after dimension reduction, and the optimal parameters are determined by the grid search method to obtain the clustering results; Calculate the fault severity index of each cluster by combining the fault impact scope and duration; Identify typical abnormal alarm patterns under different emergency protection circuit failure modes based on fault severity differences and fault propagation path overlaps; Furthermore, the fault severity index is received, and a fault propagation network is constructed based on graph theory. The fault propagation network calculates the shortest propagation path between nodes through the Dijkstra algorithm, and determines whether the shortest propagation path meets the preset conditions. If the preset conditions are met, a typical abnormal alarm mode is identified; Specifically, the abnormal alarm feature vector is normalized, the minimum-maximum scaling method is used to map the feature value to the interval of 0 to 1, the feature dimension is reduced by the UMAP algorithm, the local structure information is retained, and the feature vector after dimension reduction is obtained; In the feature space after dimensionality reduction, the DBSCAN algorithm is used for density clustering. The optimal parameters are determined by the grid search method in the range of neighborhood radius 0.1 to 1.0 and minimum sample number 3 to 10. The silhouette coefficient is used to evaluate the clustering effect of different parameter combinations. The parameter combination with the largest silhouette coefficient is selected as the final clustering parameter to classify the noise points into separate categories. According to the clustering results, the fault severity index of each cluster is calculated. Combined with the fault impact range and duration, the weights obtained based on the statistical analysis of historical data are used for weighted summation to obtain a comprehensive severity score. The clusters are sorted and divided into three severity levels: high, medium, and low. Based on the graph theory method, a fault propagation network is constructed. The faulty equipment is regarded as a node and the fault propagation relationship is regarded as an edge. The Dijkstra algorithm is used to calculate the shortest propagation path between nodes. The overlap degree of the fault propagation path is quantified by calculating the co-occurrence frequency of the edge. Combined with the fault severity and propagation path information, the frequent subgraph mining technology is used to identify typical abnormal alarm patterns. Here is an example: Normalize the abnormal alarm feature vector and use the minimum-maximum scaling method to map the feature value to the range of 0 to 1, for example, map the original voltage value of 380V to 0.75; The UMAP algorithm was used to reduce the 256-dimensional features to 30 dimensions, retaining 95% of the local structural information. In the feature space after dimensionality reduction, the DBSCAN algorithm was applied for density clustering. The grid search method was used to search for the optimal parameters in the range of neighborhood radius 0.1 to 1.0 and minimum sample number 3 to 10. For example, the neighborhood radius was finally determined to be 0.3, the minimum sample number was 5, 3000 samples were clustered into 15 categories, and 20 samples were marked as noise points and classified into the 16th category; Calculate the fault severity index of each cluster, for example, the impact range weight is 0.4, the duration weight is 0.6, and the comprehensive severity score is obtained. Clusters with scores greater than 0.8 are classified as high severity, 0.5 to 0.8 as medium severity, and less than 0.5 as low severity; Construct a fault propagation network containing 500 nodes and use the Dijkstra algorithm to calculate the shortest path between nodes. For example, the shortest path length from node A to node B is 3. The co-occurrence frequency of edges is calculated, and edges with a frequency greater than 0.6 are considered to be overlapping paths; The gSpan algorithm is used to mine frequent subgraphs, and the support threshold is set to 0.1. 20 typical abnormal alarm patterns are obtained. For example, the support of the pattern "transformer overheating → circuit breaker tripping → load interruption" is 0.15.

[0021] Furthermore, in this embodiment, step S4 specifically includes: According to the action logic of the emergency protection circuit and the typical abnormal alarm mode, the corresponding induction information template is selected from the induction information template library, and the induction information is dynamically generated based on the action time and reset mode of the emergency protection circuit and combined with the fault inducing factors; The selection of the induction information template includes the following steps: Obtain the current fault condition and the pre-established induction information template library, calculate the similarity score between the induction information template and the current fault condition according to the TF-IDF algorithm, and select the template with the highest similarity score as the induction information template; Furthermore, the action time series of the emergency protection circuit is extracted, the time pattern of the action time series is identified by using a sliding window method, the abnormal action time is detected by a moving average, and it is determined whether the abnormal action time exceeds a preset time threshold; Construct a reset mode classifier. The reset mode classifier classifies the reset modes into automatic reset, manual reset, and remote reset based on the random forest algorithm, and selects the corresponding reset guidance information according to the classification results. Analyze the correlation between fault-inducing factors, calculate support and confidence through Apriori algorithm, extract association rules whose support and confidence are higher than the preset threshold, and integrate the factors corresponding to the association rules into the induced information template; Integrate the above results, fill the results into the basic template, and optimize the textual expression of the basic template by combining the rule-based natural language generation method to obtain dynamic induced information; Specifically, according to the action logic of the emergency protection circuit and the typical abnormal alarm mode, the TF-IDF algorithm is used to calculate the similarity between the induction information template and the current fault condition, and the template with the highest similarity score is selected as the induction information template; The time series analysis method is used to extract the action time sequence of the emergency protection circuit, the sliding window method is used to identify the action time pattern, the moving average is combined to detect the abnormal action time, the action frequency is determined by the time threshold obtained by historical data statistics, and the time information is integrated into the basic template; A reset mode classifier is built based on the random forest algorithm, and the reset modes are divided into three categories: automatic reset, manual reset and remote reset. The corresponding reset guidance information is selected according to the classification results and inserted into the specified position of the template; The Apriori algorithm is used to analyze the correlation between fault-inducing factors, calculate the support and confidence, extract high-frequency association rules, and dynamically integrate the association factors into the induction information template; The template filling technology is used to integrate the results of the previous steps, and the text expression is optimized by combining rules and natural language generation technology to generate the final dynamic induction information; Here is an example: According to the "overcurrent tripping" action logic of the emergency protection circuit and the abnormal alarm mode of "frequent tripping of circuit breaker", the TF-IDF algorithm is used to calculate the similarity between the template in the induced information template library and the current fault situation. For example, the TF-IDF vector of the "frequent tripping of circuit breaker" template is [0.3, 0.5, 0.2], and the current fault situation vector is [0.25, 0.45, 0.3]. The calculated cosine similarity is 0.97, and it is selected as the basic template. Extract the action time series within the last 24 hours, use a 30-minute sliding window to identify the action pattern, and detect anomalies through a 5-point moving average. For example, if the interval between three consecutive actions is less than the preset threshold of 10 minutes, it is determined to be a frequent action. Using the random forest algorithm, 100 decision trees with a maximum depth of 10 were trained on historical reset data to build a reset mode classifier with an accuracy of 85%, classifying the current fault condition as "remote reset"; The Apriori algorithm was used to analyze the fault-inducing factors. The minimum support was set to 0.1 and the minimum confidence was set to 0.7. It was found that the support of the rule "ambient temperature is too high → circuit breaker sensitivity increases" was 0.15 and the confidence was 0.8. Fill the basic template with information such as "frequent action", "remote reset" and "ambient temperature", and use rule-based natural language generation technology to optimize the text. Generate an inductive message that the circuit breaker frequently trips. Please check the ambient temperature and perform a remote reset. Note that excessively high ambient temperature may increase the sensitivity of the circuit breaker. Furthermore, the induction information template library includes predefined induction action templates for different emergency protection circuit failure modes, each template contains fixed semantic blocks of fault description, impact range, and disposal suggestion; According to the abnormal alarm mode, the corresponding induced information template is retrieved and matched, and the key elements in the alarm information are extracted, including the specific components where the fault occurred and the triggered protection actions, and filled into the variable placeholder position of the template; Specifically, the abnormal alarm pattern is converted into a numerical vector to obtain a preliminary classification result of the alarm pattern; According to the preliminary classification results, the cosine similarity between the warning mode and each template in the induction information template library is calculated, and the template with the highest similarity is selected as the matching result; Extract the specific components where the fault occurred and the triggered protection actions from the alarm information, build entity and relationship diagrams, and determine the associations between key elements; Identify direct and indirect relationships between entities in the entity and relationship graph through graph traversal algorithms and generate relationship triples; Locate the variable placeholders in the matching results, and generate a filling rule set based on the structure and entity type of the matching results. The filling rule set includes the placeholder type, the corresponding entity category, and the filling priority. Fill the key elements in the relation triple into the variable placeholder position of the matching result according to the filling rule set to obtain the filled content; Perform dependency syntax analysis on the filled content to determine whether the filled content conforms to grammatical rules and contextual semantics; If the filled content complies with the grammatical rules and contextual semantics, the filled content is determined to be the final induced information; Here is an example: The TF-IDF method is used to convert the abnormal alarm pattern into a numerical vector, and the alarm pattern is preliminarily classified. The similarity with each template in the induced information template library is calculated by cosine similarity, and the template with the highest similarity is selected as the matching result. The BiLSTM-CRF model is used to extract the specific components where the fault occurs and the triggered protection actions from the alarm information, build an entity and relationship graph, determine the association between key elements, identify the direct and indirect relationships between entities through the graph traversal algorithm, and generate relationship triples; Locate variable placeholders in the template based on the regular expression matching method, and generate a filling rule set based on the template structure and entity type. The rule set includes the placeholder type, the corresponding entity category, and the filling priority. Fill the extracted key elements into the corresponding variable placeholder positions according to the filling rule set, and use the dependency-based syntax analysis method to perform semantic consistency check to ensure that the filled content conforms to the grammatical rules and contextual semantics; The template library is dynamically updated using the incremental learning method. New template structures are automatically generated based on emerging fault modes and alarm types, and new templates are verified and optimized through human-computer interaction. For the abnormal alarm mode "transformer overheating triggers the action of the protection device", the TF-IDF method is used to calculate the word frequency-inverse document frequency, and the vector [0.3, 0.5, 0.2, 0.4, 0.1] is obtained, which is initially classified as an "equipment overheating" alarm; Through cosine similarity calculation, the similarity between this vector and the "transformer fault" template in the template library is 0.92, and it is selected as the best matching template; The BiLSTM-CRF model is used for named entity recognition to identify the entities "transformer" (equipment class) and "overheating" (fault class), as well as "protection device action" (action class). An entity relationship graph is constructed, and the graph structure is traversed using a depth-first search algorithm to generate relationship triples (transformer, occurrence, overheating), (overheating, triggering, protection device action). Use the regular expression "\{([^}]+)\}" to match the placeholders in the template, such as "{device}", "{fault}", "{action}", and generate the filling rules based on the entity type: {device} → device entity, {fault} → fault entity, {action} → action entity; According to the rule, the extracted entities are filled into the template as "{equipment} has {fault}, resulting in {action}", and "the transformer overheats, resulting in the action of the protection device" is obtained; Use dependency parsing to check semantic consistency and confirm that the subject-verb-object structure is complete; The new alarm mode "transformer insulation aging" was added to the template library, and the model was updated through incremental learning, with the accuracy rate increased from the original 95% to 96%.

[0022] Furthermore, in this embodiment, step S5 specifically includes: Perform semantic analysis on the induced information and extract key terms, including fault component name, fault mode description and circuit protection action; Calculate the semantic similarity of different induced information, and select the induced information with semantic similarity lower than the threshold as the induced action candidate set; Semantic analysis includes the following steps: Obtaining induced information, and performing word segmentation processing on the induced information; The hidden Markov model is used to perform part-of-speech tagging on the word segmentation results, and the tagging results including nouns, verbs and adjectives are obtained; According to the annotation results, the Word2Vec algorithm is used to map the key terms into a vector space of preset dimensions; The cosine similarity calculation method is used to determine the semantic similarity between different induced information and generate a semantic similarity matrix; Furthermore, a fault impact diagram is constructed, which is based on the pre-established topological structure of the fault impact range; the intersection of the impact ranges of different faults is calculated by the minimum cut algorithm to obtain the intersection metric matrix; The semantic similarity weight and intersection measurement weight are determined by using the hierarchical analysis method. The comprehensive difference score of the induced information is calculated based on the semantic similarity matrix, intersection measurement matrix and corresponding weights. If the comprehensive difference score is lower than the preset threshold, the induced information is ranked in importance; Importance ranking considers fault severity and time urgency, and uses a weighted scoring method to generate a prioritized set of induced action candidates; Specifically, the generated induced information is segmented, and the hidden Markov model is used for part-of-speech tagging to identify nouns, verbs, and adjectives. In combination with the predefined professional terminology dictionary, key terms such as fault component name, fault mode description, and circuit protection action are extracted; The professional terminology dictionary is regularly updated through domain knowledge input and automatic term extraction algorithms; The extracted key terms are mapped to a 300-dimensional vector space using the Word2Vec algorithm, and the cosine similarity is used to calculate the semantic similarity between different induced information to obtain the similarity matrix of the induced information; Based on the topological structure of the fault impact range, a fault impact diagram is constructed. The intersection of the impact ranges of different faults is calculated by the minimum cut algorithm, the impact degree is quantified, and the intersection measurement matrix is ​​obtained. The analytic hierarchy process is used to determine the weights of semantic similarity and intersection measurement. The semantic similarity matrix and intersection measurement matrix are combined to calculate the comprehensive difference score of the induced information, set the difference threshold, and filter out the induced information with a difference score below the threshold. The selected induced information is ranked by importance, and the fault severity and time urgency are considered. The final ranking result is obtained using the weighted scoring method to form a prioritized set of induced action candidates. Here is an example: The induced information "main transformer overheating triggers differential protection action" is segmented to obtain "main transformer / overheating / triggering / differential protection / action"; Part-of-speech tagging was performed using a hidden Markov model to identify nouns: “main transformer”, “differential protection”, verbs: “trigger”, “action”, and adjectives: “overheating”; According to the predefined professional terminology dictionary, the key terms "main transformer" (fault component), "overheating" (fault mode), and "differential protection action" (protection action) are extracted; The professional terminology dictionary is automatically updated weekly through the input of domain experts and the TF-IDF algorithm. The Word2Vec algorithm is used to map key terms to a 300-dimensional vector space, for example, "main transformer" is mapped to [0.2, 0.5, ..., 0.3]. The cosine similarity between different induced information is calculated to obtain a similarity matrix. For example, the similarity with "circuit breaker misoperation causes line tripping" is 0.75; Construct the fault impact diagram, connect the "main transformer overheating" node to the "differential protection" and "overcurrent protection" nodes, and use the minimum cut algorithm to calculate the intersection of the impact range. For example, the intersection measure with the "high-voltage bushing fault" is 0.6; The weights are determined using the hierarchical analysis method, with a semantic similarity weight of 0.6 and an intersection measure weight of 0.4. The comprehensive difference score is calculated, for example, 0.71; The threshold is set to 0.8, the induced information is included in the candidate set, and the fault severity (9 points, full score 10 points) and time urgency (8 points, full score 10 points) are considered. The final score is 8.6 calculated using the weighted scoring method, and it is ranked second in the candidate set.

[0023] Furthermore, in this embodiment, in step S6, constructing the induced strategy reinforcement learning model includes the following steps: Obtain an induced action candidate set, and map the induced action candidate set into a discrete action space; The observation space is constructed according to the type, severity, and duration characteristics of the abnormal alarm, and the observation space is obtained by using one-hot encoding and normalization processing; Construct an induced strategy reinforcement learning model based on discrete action space and observation space; Further, a reward function is determined according to the alarm resolution time, the system recovery degree and the operator feedback score, and the reward function is a weighted sum of the alarm resolution time, the system recovery degree and the operator feedback score; The deep Q-network algorithm is used to initialize the induction strategy model, and a three-layer fully connected neural network structure is designed, in which the number of input layer nodes is the same as the dimension of the observation space, the hidden layer uses a preset number of neurons, and the number of output layer nodes is equal to the size of the discrete action space; Collect and store interaction data through the experience replay mechanism, and set the experience replay buffer size to a preset number of records; When the priority experience replay strategy is adopted, the sampling probability is determined according to the time difference prediction error; The ε-greedy strategy is used to balance exploration and utilization during the training process. The initial ε value is set to a preset value, and each round of iteration is multiplied by the attenuation coefficient for attenuation. Update the Q network parameters through multiple rounds of iterative optimization. If the change in reward evaluation for a preset number of consecutive rounds is less than a preset threshold, the model is considered to have converged. Specifically, we construct an induction strategy reinforcement learning environment, map the induced action candidate set into a discrete action space, and construct the observation space through feature engineering, including the type, severity, and duration characteristics of abnormal alarms, using one-hot encoding and normalization processing; The reward function is defined as a quantitative indicator of the alarm processing effect, including the weighted sum of the alarm resolution time, system recovery degree and operator feedback score; The deep Q network algorithm is used to initialize the induction strategy model, and a three-layer fully connected neural network structure is designed. The number of nodes in the input layer is the same as the dimension of the observation space, the hidden layer uses 256 neurons, the number of nodes in the output layer is equal to the size of the action space, and the activation function uses ReLU. The interaction data is collected and stored through the experience replay mechanism, the experience replay buffer size is set to 10,000 records, the priority experience replay strategy is used, and the sampling probability is determined according to the time difference prediction error; The ε-greedy strategy is used to balance exploration and utilization during training. The initial ε value is set to 0.9 and is attenuated by multiplying it by 0.99 in each iteration. The Q network parameters are updated through multiple rounds of iterative optimization. When the reward change for 10 consecutive rounds of evaluation is less than 1%, the model is considered to have converged, and the optimal induction strategy for different abnormal alarm modes is finally obtained. Here is an example: For the abnormal alarm of "transformer overheating", a reinforcement learning environment is built to map 10 induced action candidates into a discrete action space. The observation space contains 8 features such as alarm type (overheating, 1 / 0 coding), severity (0-10 points, normalized processing), and duration (hours, logarithmic transformation); The reward function is defined as 0.5*(120-resolution time) / 120+0.3system recovery+0.2operator score, with a value range of 0-1; The deep Q network structure is 8 nodes in the input layer, 256 nodes in the hidden layer (ReLU activation), and 10 nodes in the output layer; The experience replay buffer stores the most recent 10,000 interaction records and uses priority sampling based on the time difference prediction error. The larger the error, the higher the sampling probability. The ε-greedy strategy starts with ε=0.9, which is multiplied by 0.99 in each iteration. During the training process, for the "transformer overheating" scenario, the action "reduce load" is executed to obtain a reward of 0.8, which is stored in the experience replay buffer; Priority sampling selects 32 records for batch training and updates the Q network parameters. After 1000 iterations, the rewards for the last 10 rounds of evaluation are 0.82, 0.83, 0.82, 0.84, 0.83, 0.85, 0.84, 0.85, 0.84, and 0.85, respectively. The change is less than 1%, and convergence is determined; Finally, for the "transformer overheating" abnormal alarm, the optimal induction strategy was obtained, which was to alternately execute "reducing load" and "increasing cooling".

[0024] Further, in this embodiment, in step S7, applying the optimal induction strategy to process the real-time abnormal alarm includes the following steps: Obtain data including alarm information from the monitoring system, determine whether unknown alarm trigger conditions appear in the alarm information, and determine the corresponding alarm information level. The determination method is as follows: Perform keyword matching according to the alarm information and determine whether it is a known alarm type. If the match is successful, it is determined to be a known alarm type. If the match fails, it is determined to be an unknown alarm type and the alarm information is marked as an unknown alarm trigger condition. Obtain keywords in the alarm information and calculate the severity score and occurrence frequency of the keywords; The alarm score is determined based on the severity score and the frequency of occurrence, and the alarm level of the alarm information is determined based on whether the alarm score exceeds the preset alarm level threshold; Furthermore, the unknown warning information is processed using the word frequency-inverse document frequency algorithm to extract keywords from the unknown warning information; Obtain a pre-established alarm feature template, and generate a supplementary alarm feature vector based on the keyword and the alarm feature template; The DBSCAN algorithm is used to cluster the alarm data containing the supplementary alarm feature vectors, and the density threshold of the DBSCAN algorithm is adjusted; Update the clustering result of the alarm mode according to the adjusted density threshold, and calculate the center point and boundary of the updated clustering result; Obtain updated clustering results, use the random forest algorithm to retrain the alarm pattern recognizer, adjust the output layer weight of the alarm pattern recognizer, and update the induction strategy model according to the adjusted weight; Specifically, the real-time abnormal alarm is processed according to the optimal induction strategy, and the keyword matching is used to determine whether it is a known alarm type. If the match is successful, it is determined to be a known alarm type. If the match fails, it is determined to be an unknown alarm type, and the alarm information is marked as an unknown alarm trigger condition; The Naive Bayes algorithm is used to preliminarily classify the alarm content and make a preliminary alarm level determination. The alarm score is calculated based on the severity and frequency of occurrence of the keywords, and the alarm level is divided. The word frequency-inverse document frequency algorithm is used to extract keywords from unknown alarm information, and the alarm feature template built based on knowledge and historical data statistics is combined to generate a supplementary alarm feature vector, and the new feature vector is added to the original feature space; Use the DBSCAN algorithm to incrementally cluster the alarm data containing new feature vectors, dynamically adjust the density threshold, update the clustering results of the alarm pattern, and calculate the center point and boundary of the newly generated cluster; Based on the updated clustering results, the alarm pattern recognizer is retrained using the random forest algorithm, and the original induction strategy model is adjusted through the progressive learning method, with some network layer weights fixed and only the output layer fine-tuned to adapt it to the new alarm pattern; Here is an example: For the real-time abnormal alarm "main transformer cooling system abnormality", no complete match was found through keyword matching and it was marked as an unknown alarm; Using the naive Bayes algorithm for preliminary classification, the "equipment failure" category was obtained with a confidence level of 0.85. Based on the rule-based alarm level determination, the severity of the keyword "cooling system" was 8 points out of 10 points, the frequency of occurrence was 2 times, and the calculated alarm score was 7.5 points, which was determined to be a medium-level alarm; The TF-IDF algorithm was used to extract keywords, and the weight of "main transformer" was 0.8, the weight of "cooling system" was 0.9, and the weight of "abnormal" was 0.6; Combined with the predefined feature template, a new feature vector [0.8, 0.9, 0.6, 0, 0, 0, 0.5] is generated and added to the original feature space; Use the DBSCAN algorithm for incremental clustering, set the initial density threshold ε=0.3, the minimum number of samples MinPts=5, dynamically adjust the ε value to 0.25, obtain new clustering results, and update the coordinates of the cluster center points to [0.75, 0.85, 0.55, 0.1, 0.1, 0.1, 0.4]; Based on the updated clustering, the alarm pattern recognizer was retrained using random forest, 100 decision trees, and a maximum depth of 10, and the accuracy was improved from 92% to 94%; The induced strategy model was adjusted through progressive learning, the weights of the first three layers of the network were fixed, the output layer was fine-tuned, and the learning rate was set to 0.001. After 100 rounds of iterations, the processing efficiency of the model on the new alarm mode was improved by 15%.

[0025] Furthermore, in this embodiment, in step S8, evaluating the abnormal alarm processing effect includes the following steps: After applying the optimal induction strategy to handle the real-time abnormal alarm, obtain the current abnormal alarm information and calculate the comprehensive processing effect score based on the preset evaluation index system. The evaluation index system includes alarm resolution time, system recovery degree and operator feedback score; If the comprehensive processing effect score is lower than the preset threshold, the pre-trained BERT model is called to perform semantic analysis on the historical alarm text; A multi-head attention mechanism is used to extract key event sequences and timestamp information from historical alarm texts to construct a time-series evolution graph of fault modes. According to the time series evolution graph, the long short-term memory network is used to model the development trend of the fault mode, obtain the time series evolution law of the fault mode, and learn the time series evolution law; Furthermore, the maintenance cycle information of the emergency protection circuit is obtained and incorporated into the Bayesian network as prior knowledge. The nodes of the Bayesian network include device status, fault type and maintenance time. Use conditional probability tables to describe the relationship between nodes in the Bayesian network, predict potential abnormal trends, and generate future abnormal alarm probability distributions; Specifically, the optimal induction strategy is applied to handle the current abnormal alarm. According to the preset evaluation index system, the weighted average method is used to calculate the comprehensive processing effect score. The weight of the alarm resolution time is 0.4, the weight of the system recovery degree is 0.4, and the weight of the operator feedback score is 0.2. The obtained comprehensive score is compared with the expected threshold of 8.5 points to determine whether the expected effect is achieved; If the processing effect does not meet expectations, the pre-trained BERT model is called to perform semantic analysis on the historical alarm text, and the multi-head attention mechanism is used to extract the key event sequence and timestamp information to build a time-series evolution map of the fault mode. Based on the time series evolution graph, the long short-term memory network (LSTM) is used to model the development trend of the fault mode. The input sequence length is set to 30, and the number of hidden layer neurons is 128. The time series evolution law of the fault mode is obtained; Combined with the maintenance cycle information of the emergency protection circuit, the maintenance cycle is integrated into the Bayesian network as prior knowledge, and nodes are constructed including equipment status, fault type and maintenance time. The conditional probability table is used to describe the relationship between nodes, predict potential abnormal trends, and generate the probability distribution of abnormal alarms in the next 30 days to provide decision support for subsequent preventive maintenance; Here is an example: For the abnormal alarm of "main transformer overheating", after applying the optimal induction strategy, the comprehensive processing effect score was calculated: the alarm resolution time was 2 hours (full score 3 hours, score 0.330.4=0.132), the system recovery degree was 90% (score 0.90.4=0.36), the operator feedback score was 8.5 points (full score 10 points, score 0.85*0.2=0.17), and the comprehensive score was 0.132+0.36+0.17=0.662, which was lower than the expected threshold of 0.85; The pre-trained BERT model (12 layers, 768 hidden units) was used to perform semantic analysis on 1,000 historical alarm texts in the past six months. The 8-head attention mechanism was used to extract key event sequences and identify the typical evolution path of "temperature rise - cooling system alarm - protection device action"; Build an LSTM network (2 layers, 128 neurons per layer), input 30 days of historical data, and predict the failure probability in the next 7 days; Combined with the equipment maintenance cycle of once every three months, a Bayesian network is constructed, with nodes including "transformer temperature", "cooling system status", and "last maintenance time". A conditional probability table is set, for example, P(temperature abnormality|cooling system failure) = 0.8; The final prediction results show that the probability of similar alarms occurring in the next 30 days is 78%, and it is recommended to perform a preventive inspection before the next maintenance cycle (45 days away).

[0026] Furthermore, in this embodiment, in step S9, regularly performing incremental training on the large model includes the following steps: According to the calculation results of the transition frequencies between each state, the state transition probability matrix in the reinforcement learning model is updated; The gradient descent method is used to optimize the weight coefficients of various indicators in the reward function, and the learning rate of the gradient descent method is set to a preset value; Acquire newly emerged abnormal alarm samples, pre-process the abnormal alarm samples, and use the Word2Vec algorithm to vectorize the pre-processed abnormal alarm samples to obtain a new training data set; pre-processing the abnormal alarm samples includes text cleaning and word segmentation; Add new abnormal alarms to the training corpus, combine with new training data sets, and use the stochastic gradient descent algorithm to perform incremental training on the large model; Furthermore, the initial value of the learning rate of the stochastic gradient descent algorithm is set to a preset value, and is decayed by a preset percentage for each preset number of batches; The performance of the large model is evaluated through cross-validation. If the performance index of the preset number of consecutive rounds of evaluation is lower than the preset threshold, the model structure optimization process is triggered. The model structure optimization process includes: using the grid search method to find the optimal hyperparameter combination within the preset parameter range; Here is an example: According to the potential abnormal trend prediction results, the transition frequency between states is calculated, the state transition probability matrix in the reinforcement learning model is updated, and the gradient descent method is used to optimize the weight coefficients of each indicator in the reward function. The learning rate is set to 0.01 and the number of iterations is 1000. Add the newly appeared abnormal alarm samples to the training corpus, preprocess the corpus, including text cleaning and word segmentation, and use the Word2Vec algorithm for vectorization. Set the word vector dimension to 300 and the window size to 5 to generate a new training data set. The stochastic gradient descent (SGD) algorithm is used to incrementally train the large model. New training data is input in batches of 32 samples. The initial value of the learning rate is set to 0.1, and it decays by 10% every 1,000 batches to gradually update the model parameters. After each round of incremental training, the performance of the updated model, including accuracy, recall, and F1 score, is evaluated using a 5-fold cross-validation method. If the F1 score improvement for three consecutive rounds of evaluation is less than 0.1%, the model structure optimization process is triggered, and the grid search method is used to find the optimal hyperparameter combination in the learning rate range [0.001, 0.1] and the number of hidden layer neurons range [64, 256]. Deploy the optimized model to the production environment, verify the model effect through A / B testing, import 10% of the real-time data into the new model for processing, and compare the abnormal alarm recognition accuracy and prediction lead time of the new and old models; For the "main transformer overheating" abnormal alarm, the prediction results show that the probability of occurrence in the next 30 days is 78%, and the probability of "normal→overheating" in the updated state transfer matrix increases from 0.05 to 0.12; Use the gradient descent method to optimize the reward function weights, adjust the solution time weight from 0.4 to 0.45, reduce the system recovery weight from 0.4 to 0.35, and keep the operator score weight unchanged at 0.2; Preprocess the 100 newly added alarm samples, use the Word2Vec algorithm to generate 300-dimensional word vectors, and obtain a new training set; The SGD algorithm was used for incremental training, with an initial learning rate of 0.1. The learning rate was reduced to 0.09 after processing 1,000 batches (32 samples per batch). After 5,000 batches of training, the model performance was evaluated through 5-fold cross validation. The accuracy increased from 92% to 93.5%, the recall increased from 89% to 91%, and the F1 score increased from 90.47% to 92.23%. Since the F1 score increased by more than 0.1%, the model structure optimization was not triggered; The updated model was deployed to the production environment. Through A / B testing and comparative processing of 1,000 real-time alarm data, the new model's anomaly recognition accuracy was 94.2%, an increase of 1.8 percentage points over the old model, and the average prediction lead time increased by 2.5 hours.

[0027] In the description of the present invention, it is necessary to understand that the directions or positional relationships indicated by directional words such as "front, back, up, down, left, right", "lateral, vertical, horizontal" and "top, bottom" are usually based on the directions or positional relationships shown in the drawings. They are only for the convenience of describing the present invention and simplifying the description. Unless otherwise specified, these directional words do not indicate or imply that the device or element referred to must have a specific direction or be constructed and operated in a specific direction. Therefore, they cannot be understood as limiting the scope of protection of the present invention.

[0028] For those skilled in the art, various other corresponding changes and deformations can be made according to the technical solutions and concepts described above, and all of these changes and deformations should fall within the protection scope of the claims of the present invention.

Claims

1. A method for identifying abnormal alarms of emergency protection circuit devices based on a large model, characterized in that: The following steps are involved: S1. Obtain and analyze abnormal alarm records of emergency protection circuit devices to obtain structured abnormal alarm data; S2, extracting abnormal alarm key features from the abnormal alarm data and constructing an abnormal alarm feature vector space; S3, clustering the abnormal alarm data in the abnormal alarm feature vector space, and identifying typical abnormal alarm modes under different emergency protection circuit failure modes; S4, dynamically generating induction information according to the action logic of the emergency protection circuit and the typical abnormal alarm mode, combined with the fault inducing factors; S5, performing semantic analysis on the inducing information, calculating the semantic similarity of different inducing information, and selecting the inducing information with a semantic similarity lower than a threshold as an inducing action candidate set; S6. Taking the candidate set of induced actions as the state space and the abnormal alarm processing effect as the reward, an induced strategy reinforcement learning model is constructed, and the optimal induced strategy for different abnormal alarm modes is obtained through iterative optimization; S7, applying the optimal induction strategy to process real-time abnormal alarms; S8. Evaluate the effect of abnormal alarm processing and predict potential abnormal trends in combination with the maintenance cycle of the emergency protection circuit; S9. According to the prediction results of abnormal trends, adjust the state transition probability and reward function parameters in the induced strategy reinforcement learning model, and regularly perform incremental training on the large model.

2. The method for identifying abnormal alarms of emergency protection circuit devices based on a large model according to claim 1, characterized in that: The step S1 specifically includes: Acquire abnormal alarm record information from a database of the emergency protection circuit device, wherein the abnormal alarm record information includes alarm time, alarm content and alarm code; Analyzing the abnormal alarm triggering condition and the abnormal alarm level according to the abnormal alarm record information to obtain structured abnormal alarm data; The parsing process consists of the following steps: Data cleaning methods were used to remove duplicate records and fill in missing values; Extract key information based on preset regular expression matching to obtain the abnormal alarm data set after preliminary processing; Perform word frequency statistics and TF-IDF analysis on the alarm content in the abnormal alarm data set to extract keywords and features; According to the preset fault component type dictionary and fault mode combination rule base, the alarm content is mapped to the corresponding fault component type and fault mode combination to obtain the structured abnormal alarm data.

3. The method for identifying abnormal alarms of emergency protection circuit devices based on a large model according to claim 1, characterized in that: The step S2 specifically includes: The key features of the abnormal alarm include the topology of the emergency protection circuit, component parameters, fault mode, fault occurrence time difference and fault location correlation; Constructing the abnormal alarm feature vector space includes the following steps: Acquire abnormal alarm data, process missing values ​​for the abnormal alarm data, remove abnormal values ​​by using a box plot method, and obtain a cleaned abnormal alarm data set; Obtain the cleaned abnormal alarm data set, extract the emergency protection circuit topology structure features from it, convert the circuit topology structure into a vector representation, and obtain the topology structure feature vector; For the component parameters, kernel principal component analysis is used to reduce the dimension, and the principal components whose cumulative contribution rate reaches the preset threshold are selected as the component parameter features; The fault mode is encoded and represented by word embedding technology to obtain the joint feature vector of component parameters and fault mode; Calculate the time difference between adjacent faults and use the sliding window method to extract time series features; Perform spatial clustering on the fault locations, use Gaussian kernel function to perform kernel density estimation, obtain the correlation probability distribution of the fault locations, and generate spatiotemporal feature vectors; The topological structure feature vector, the joint feature vector of the component parameters and the fault mode, and the spatiotemporal feature vector are obtained, and the vectors are integrated by a feature cascade method to construct the abnormal alarm feature vector space.

4. The method for identifying abnormal alarms of emergency protection circuit devices based on a large model according to claim 1, characterized in that: The step S3 specifically includes: Acquire an abnormal alarm feature vector in the abnormal alarm feature vector space, wherein the abnormal alarm feature vector maps a feature value to a range of zero to one by a minimum-maximum scaling method; Using the UMAP algorithm to reduce the feature dimension of the abnormal alarm feature vector to obtain the abnormal alarm feature vector after dimension reduction; The DBSCAN algorithm is used to perform density clustering on the abnormal alarm feature vector after dimension reduction, and the optimal parameters are determined by the grid search method to obtain the clustering results; Calculate the fault severity index of each cluster by combining the fault impact scope and duration; The typical abnormal alarm modes under different emergency protection circuit failure modes are identified according to the difference in fault severity and the overlap of fault propagation paths.

5. The method for identifying abnormal alarms of emergency protection circuit devices based on a large model according to claim 1, characterized in that: The step S4 specifically includes: According to the action logic of the emergency protection circuit and the typical abnormal alarm mode, a corresponding induction information template is selected from the induction information template library, and the induction information is dynamically generated based on the action time and reset mode of the emergency protection circuit and in combination with the fault inducing factors; The induction information template selection comprises the following steps: The current fault condition and the pre-established induction information template library are obtained, the similarity score between the induction information template and the current fault condition is calculated according to the TF-IDF algorithm, and the template with the highest similarity score is selected as the induction information template.

6. The method for identifying abnormal alarms of emergency protection circuit devices based on a large model according to claim 1, characterized in that: The step S5 specifically includes: Performing semantic analysis on the induced information to extract key terms, wherein the key terms include a fault component name, a fault mode description, and a circuit protection action; Calculating the semantic similarity of different induced information, and selecting the induced information with semantic similarity lower than a threshold as an induced action candidate set; The semantic analysis comprises the following steps: Acquire the induced information, and perform word segmentation processing on the induced information; The hidden Markov model is used to perform part-of-speech tagging on the word segmentation results, and the tagging results including nouns, verbs and adjectives are obtained; According to the annotation results, the Word2Vec algorithm is used to map the key terms into a vector space of preset dimensions; The cosine similarity calculation method is used to determine the semantic similarity between different induced information and generate a semantic similarity matrix.

7. The method for identifying abnormal alarms of emergency protection circuit devices based on a large model according to claim 1, characterized in that: In step S6, constructing the induction strategy reinforcement learning model includes the following steps: Acquire the induced action candidate set, and map the induced action candidate set into a discrete action space; The observation space is constructed according to the type, severity, and duration characteristics of the abnormal alarm, and the observation space is obtained by using one-hot encoding and normalization processing; The induced strategy reinforcement learning model is constructed according to discrete action space and observation space.

8. The method for identifying abnormal alarms of emergency protection circuit devices based on a large model according to claim 1, characterized in that: In step S6, constructing the induction strategy reinforcement learning model includes the following steps: Acquire the induced action candidate set, and map the induced action candidate set into a discrete action space; The observation space is constructed according to the type, severity, and duration characteristics of the abnormal alarm, and the observation space is obtained by using one-hot encoding and normalization processing; The induced strategy reinforcement learning model is constructed according to discrete action space and observation space.

9. The method for identifying abnormal alarms of emergency protection circuit devices based on a large model according to claim 1, characterized in that: In step S8, evaluating the abnormal alarm processing effect includes the following steps: After applying the optimal induction strategy to handle the real-time abnormal alarm, obtain the current abnormal alarm information, and calculate the comprehensive processing effect score according to the preset evaluation index system, the evaluation index system includes the alarm resolution time, the system recovery degree and the operator feedback score; If the comprehensive processing effect score is lower than the preset threshold, the pre-trained BERT model is called to perform semantic analysis on the historical alarm text; A multi-head attention mechanism is used to extract key event sequences and timestamp information from historical alarm texts to construct a time-series evolution graph of fault modes. According to the time series evolution graph, a long short-term memory network is used to model the development trend of the fault mode, obtain the time series evolution law of the fault mode, and learn the time series evolution law.

10. The method for identifying abnormal alarms of emergency protection circuit devices based on a large model according to claim 1, characterized in that: In step S9, regularly performing incremental training on the large model includes the following steps: According to the calculation results of the transition frequencies between each state, the state transition probability matrix in the reinforcement learning model is updated; The gradient descent method is used to optimize the weight coefficients of various indicators in the reward function, and the learning rate of the gradient descent method is set to a preset value; Obtain newly emerged abnormal alarm samples, pre-process the abnormal alarm samples, and use the Word2Vec algorithm to vectorize the pre-processed abnormal alarm samples to obtain a new training data set; The new abnormal alarms are added to the training corpus, combined with the new training data set, and the stochastic gradient descent algorithm is used to perform incremental training on the large model.

Images