Power grid dispatching automation system operation and maintenance alarm analysis method and system

Abstract

The invention discloses a power grid dispatching automation system operation and maintenance alarm analysis method and system, and the method can automatically process and analyze alarm data, carries out the early warning of application faults which may occur in the future according to historical alarm data, and improves the response efficiency and accuracy of system operation and maintenance. Compared with the prior art, through automatic processing and intelligent analysis of a large number of operation and maintenance alarms, the dependence on manual intervention is remarkably reduced, and the alarm processing efficiency and accuracy are improved. By applying the alarm state transition diagram, the diagram algorithm and the calculation of the transition probability, the correlation between alarms is effectively identified, the occurrence probability and the expected time of serious faults possibly occurring in the future can be predicted, and operation and maintenance personnel can take corresponding measures in advance, so that the risk of system faults is reduced, and the stability and the reliability of the system are enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of power grids, and in particular to an operation and maintenance alarm analysis and trend early warning method for a power grid dispatching automation system. Background Art

[0002] In the construction and operation of modern smart grids, the dispatching automation system is responsible for managing and coordinating the dispatching of computer basic resources, network storage and power application software modules. System operation and maintenance failures will affect the availability and generation safety of power applications.

[0003] At present, the processing method of operation and maintenance related alarms in the dispatching automation system mainly relies on manual analysis and confirmation by automation professionals, which is not only time-consuming and labor-intensive, but also difficult to extract valuable information from numerous alarms. When multiple alarms appear in the system, traditional analysis methods often cannot effectively identify the relationship between alarms, nor can they use historical data to predict future alarm patterns.

[0004] Therefore, there is an urgent need for a new method to improve the automation level of operation and maintenance alarm analysis, reduce manual intervention, and accurately predict potential system risks. Summary of the invention

[0005] In order to solve the problem that the traditional alarm data analysis method is single and cannot effectively identify the relationship between alarms, the present invention discloses a power grid dispatching automation system operation and maintenance alarm analysis method, which can automatically process and analyze alarm data, and warn of possible application failures in the future based on historical alarm data, thereby improving the response efficiency and accuracy of system operation and maintenance.

[0006] A method for analyzing operation and maintenance alarms of a power grid dispatching automation system disclosed in the present invention comprises the following steps:

[0007] The power grid dispatching automation system is divided into a production control area and a management and analysis area, which are respectively recorded as Area I and Area III; various types of operation and maintenance alarms generated by the power grid dispatching automation system during operation are screened in Area I and transmitted to Area III by the isolation device; the various types of operation and maintenance alarms include abnormal server performance indicator alarms, application key process status alarms, abnormal public service performance indicator alarms, and abnormal infrastructure indicator alarms;

[0008] According to the distribution of application deployment and the status of the primary and standby machines of the application at the time of the alarm, the operation and maintenance alarm data is supplemented; historical alarm data is collected, different types of alarms are regarded as different alarm states, the transition probabilities between different alarm states are calculated, and the alarm state transition diagram is constructed;

[0009] Mark the critical alarm status and severe alarm status in the alarm status transition diagram, calculate the path transition probability from the critical alarm status to the severe alarm status, and filter out the paths that need to be monitored key points; analyze the alarms in real time in the dispatching automation system and give early warnings for severe alarms.

[0010] Further, the alarm data includes alarm time, alarm ID, alarm level, system area, server name, metric name, metric value, trigger threshold, value unit. If it is an application process alarm, it also includes application name and process name.

[0011] Further, the operation and maintenance alarms are screened in Zone I. First, set the transmission period as T and the observation window of the alarm as w, where w < T. The screening conditions include:

[0012] Within the observation window w, alarms with the same alarm level, system area, server name, application name, process name, and metric name are regarded as duplicate alarms. For duplicate alarms, only keep the one with the latest alarm time.

[0013] Within the observation window w, for alarms with the same system area, server name, process name, and metric name but different alarm levels, only keep the one with the highest alarm level.

[0014] Within the transmission period T, for the same alarms with exactly the same alarm data, only keep the first occurrence of the alarm, and set a silent period of duration s starting from the occurrence time of this alarm. The same alarms occurring within the silent period will be ignored; record the same alarms exceeding the silent period and update the duration of the silent period to twice the original.

[0015] Further, the screened operation and maintenance alarms in Zone I are transmitted to Zone III. Alarm collection agent programs are deployed on each server in Zone I. The agent programs save the screened alarms as files and forward the files to the specified path of the Zone I transmission server; the isolation device transfers the files at the specified path of the Zone I transmission server to the specified path of the Zone III transmission server according to the period T. The alarm analysis program in Zone III scans the path periodically, transfers to the alarm analysis server, and performs alarm analysis after parsing the files.

[0016] Further, the steps to complete the operation and maintenance alarm data are as follows:

[0017] 2.1) Regularly read the system application distribution table to obtain the mapping relationship between applications such as SCADA and FES and server names.

[0018] 2.2) Regularly send requests to the system management service to obtain the primary and standby machine information of applications such as SCADA and FES.

[0019] 2.3) If the alarm is a server performance issue, you need to add all the applications running on the server at the time the alarm occurs, and clearly indicate whether these applications are running on the host; if the alarm is a process alarm, you need to add the application to which the process belongs and whether the application is running on the host.

[0020] Furthermore, the steps of calculating the transition probabilities between different alarm states and constructing an alarm state transition diagram are:

[0021] 3.1) Treat each type of alarm as a state, and use edges to represent the possibility of one alarm state transferring to another state. The weight of the edge is the transition probability based on historical alarm data, and the attribute of the edge is the average interval time of state transition;

[0022] 3.2) Convert the transition frequency to probability, set the threshold p, the transition frequency from state A to state B is f(A,B), the total number of transitions of A is T(A), then the transition probability is expressed as:

[0023] P(A→B)=f(A,B) / T(A)

[0024] When the state transition probability is greater than the threshold p, an edge is established between state A and state B, and the average interval time between the two alarm states is calculated as the attribute of the edge.

[0025] Further, the severe alarm state in the marking alarm state transition diagram is to mark the operation and maintenance alarm data, and the types of operation and maintenance alarm data that need to be metered include key process stop and deadlock of the application, and public service failure to respond; the steps of marking the critical alarm state in the alarm state transition diagram are:

[0026] 4.1) Based on the PageRank algorithm, each node is assigned an initial PageRank value, which is usually 1 / the total number of nodes;

[0027] 4.2) For each node, the PageRank value of the node is determined by calculating the weighted average of the PageRank values ​​of all the incoming nodes of the node; the weighting coefficient depends on the weight of each incoming edge, that is, the transition probability;

[0028] 4.3) Use an iterative algorithm to update the PageRank value of each node, and recalculate the PageRank value of the node every iteration until all PageRank values ​​converge to a stable state, or the number of iterations reaches a preset maximum value;

[0029] 4.4) In the alarm state transition diagram, a higher PageRank value indicates that the node has higher importance and influence, and the alarm state of the PageRank value Top K is set as the critical alarm state.

[0030] Furthermore, the calculation of the path transition probability from the critical alarm state to the severe alarm state, and screening out the paths that need to be monitored intensively, comprises the following steps:

[0031] 5.1) Based on the transition probabilities represented by the edges in the alarm state transition graph, construct the corresponding state transition matrix P. Each element p of the matrix ij Indicates that the critical alarm state S i To severe alarm state S j The transition probability of

[0032] 5.2) In the alarm state transition diagram, for any pair of states S i With state S j , find the i Status to S j All paths of the state, record the longest path length as n;

[0033] 5.3) From state S i To state S j After n steps, calculate the nth power of matrix P n , P n Elements in That means from state S i To state S j The path transition probability;

[0034] 5.4) Set the probability threshold ρ, if The path is considered to be in the critical alarm state S i Points to severe alarm status S j Key monitoring paths.

[0035] Furthermore, the real-time analysis of alarms in the dispatching automation system comprises the following steps:

[0036] 6.1) During the real-time alarm analysis of operation and maintenance, use visualization tools to display the alarm status transition diagram;

[0037] 6.2) When a critical alarm state is detected, monitoring of the key monitoring path is started, and an early warning mechanism is started at the same time; the early warning mechanism analyzes the real-time alarm data based on historical alarm data mining and prediction models; the early warning content includes the probability of a serious alarm state occurring in the future and the expected time of occurrence. The probability of a serious alarm state occurring in the future is the path transfer probability. The expected occurrence time of the severe alarm state in the future is the sum of the time intervals on the path;

[0038] 6.3) Calculate the real-time transition probability between the current alarm state and the severe alarm state in real time. If the real-time transition probability drops below the threshold ρ or the time interval exceeds the set maximum time sum, the warning is canceled.

[0039] A power grid dispatching automation system operation and maintenance alarm analysis system, comprising:

[0040] The alarm collection module is used to screen various types of operation and maintenance alarms generated by the power grid dispatching automation system during operation in Zone I and transmit them to Zone III through the isolation device;

[0041] The transition probability module is used to complete the operation and maintenance alarm data; different types of alarms are regarded as different alarm states, the transition probabilities between different alarm states are calculated, and the alarm state transition diagram is constructed;

[0042] The analysis and warning module is used to mark the critical alarm status and serious alarm status in the alarm status transition diagram, calculate the path transition probability from the critical alarm status to the serious alarm status, and screen out the paths that need to be monitored; analyze the alarms in real time in the dispatching automation system and issue warnings for serious alarms.

[0043] The dispatching automation system operation and maintenance alarm analysis and trend warning method provided by the present invention has the following advantages compared with the existing technology: through automatic processing and intelligent analysis of a large number of operation and maintenance alarms, the dependence on manual intervention is significantly reduced, and the efficiency and accuracy of alarm processing are improved.

[0044] By applying alarm state transition diagrams, graph algorithms, and calculation of transition probabilities, the associations between alarms can be effectively identified, and the probability and expected time of serious failures that may occur in the future can be predicted, allowing operation and maintenance personnel to take corresponding measures in advance, thereby reducing the risk of system failures and enhancing system stability and reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The present invention is a flow chart of a method for analyzing operation and maintenance alarms of a power grid dispatching automation system.

[0046] Figure 2 This is a schematic diagram of the starting point and key monitoring path of the early warning mechanism of the dispatching automation system. DETAILED DESCRIPTION

[0047] The present invention discloses a method and system for analyzing the operation and maintenance alarms of a power grid dispatching automation system. The technical scheme of the present invention is further described in conjunction with the accompanying drawings and embodiments. Figure 1 shown.

[0048] First, the power grid dispatching automation system is divided into production control area and management analysis area, which are marked as area I and area III respectively. The production control area in the dispatching automation system has limited computing resources and high security requirements, while the management analysis area has more storage and computing resources and is more suitable for processing alarm data analysis and mining tasks; however, the partitions transmit files one-way through the isolation device, and the bandwidth is limited. Therefore, all alarms cannot be gathered in the management analysis area, and they need to be filtered and screened before transmission.

[0049] Various types of operation and maintenance alarms include server performance indicator abnormality alarms, application key process status alarms, public service performance indicator abnormality alarms, and infrastructure indicator abnormality alarms. Specifically:

[0050] 1) Server performance indicator abnormal alarms, including CPU usage exceeding the limit, memory usage exceeding the limit, memory usage climbing alarm, disk IO exceeding the limit, disk usage exceeding the limit, and network traffic exceeding the limit.

[0051] 2) Status alarms for key processes of SCADA, FES and other applications, including start, stop, and freeze; process performance indicators, such as CPU usage exceeding the limit, memory size exceeding the limit, and disk IO exceeding the limit.

[0052] 3) Abnormal alarms for public service performance indicators, including alarms for message bus and service bus process start, stop, and inability to respond to requests; abnormal port status of real-time data services, excessive number of service connections, average request response time exceeding the limit, and excessive number of database connections.

[0053] 4) Abnormal alarms of infrastructure indicators, including large differences in server time synchronization and abnormal status alarms of switches within the system.

[0054] Among them, the over-limit alarm adopts the threshold alarm and trend alarm strategy, that is, it is triggered when the indicator exceeds or falls below the set threshold, such as when the CPU usage exceeds 90%, the CPU usage over-limit alarm is triggered; or when an abnormal trend of the indicator is detected over a period of time, such as when the memory usage rises by more than 20% within 5 consecutive minutes, the memory usage climbing alarm is triggered. Abnormal pattern alarm triggers alarms by detecting abnormal behavior through pattern recognition, such as triggering a critical process zombie alarm when the process status is detected as a zombie process.

[0055] In this embodiment, the alarm collection agent collects the power grid dispatching automation system operation and maintenance alarm data on the server in zone I. When the process IO usage exceeds 60%, the process IO usage over-limit alarm is triggered; when the server CPU usage exceeds 90%, the CPU usage over-limit alarm is triggered; when the application process is in the zombie process state, the key process zombie alarm is triggered.

[0056] Each alarm data includes the following information: alarm time, alarm ID, alarm level, system area, server name, indicator name, indicator value, trigger threshold, value unit, and if it is an application process alarm, it should also include the application name and process name.

[0057] After filtering, the alarm is saved as a file and forwarded to the specified path of the transmission server in zone I. The isolation device transfers the file in the specified path of the transmission server in zone I to the specified path of the transmission server in zone III according to the period T, and T is generally 1 minute. The alarm analysis program in zone III scans the path according to the period T, transfers it to the alarm analysis server, and performs alarm analysis after parsing the file.

[0058] Then, the operation and maintenance alarm data is supplemented based on the distribution status of application deployment and the status of the primary and backup machines of the application when the alarm occurs.

[0059] The applications deployed on each server and the status of the primary and secondary machines of the applications need to be obtained by regularly accessing the system application distribution table and system management services. For example, for the alarm "2024-08-12 12:34:56 js-fes1 server fes_prot process IO utilization is high", when querying 2024-08-12 12:34:56, the applications deployed on js-fes1 include FES and PUBLIC, which are in the primary and secondary machines respectively, and the "FES primary / PUBLIC secondary machine" information is supplemented.

[0060] Example 1: The "CPU Utilization High" alarm of the server "js-sca1". At the time of the alarm, the applications deployed on js-sca1 include SCADA, PUBLIC, and DATASRV, which are in the master, backup, and standby states respectively. The "SCADA master / PUBLIC backup / DATASRV backup" information should be added.

[0061] Example 2: The "IO High" alarm of the sca_point process on the server "js-sca2". Since the sca_point process is a key process of the SCADA application, it is necessary to supplement the "SCADA host" information based on the fact that js-sca2 is the host of the SCADA application at the time of the alarm.

[0062] Different types of alarms are regarded as different alarm states. By collecting historical alarm data, the transition probabilities between different alarm states are calculated, and the alarm state transition diagram is constructed accordingly.

[0063] In this embodiment, the transition frequency from the state "FES host fes_prot process IO utilization is high" to the state "FES host server CPU utilization is high" is 20 times, and the total number of transitions of "FES host fes_prot process IO utilization is high" is 50 times, then the transition probability P(A→B)=20 / 50=0.4.

[0064] Let the threshold p = 0.25. Since the state transition probability between the states "FES host fes_prot process IO utilization is high" and "FES host server CPU utilization is high" is greater than p, an edge is established between the two. Calculate the average interval time of 20 transitions between the two alarm states as the attribute of the edge.

[0065] Based on experience, the "FES host FES application failure" that affects the business is marked as a serious alarm state.

[0066] For the alarm state transition graph that has been constructed, the PageRank algorithm is used to calculate the PageRank value of each node in the graph, and the top 5% of the alarm states are taken as critical alarm states. For example, if the PageRank value of the alarm state "FES host fes_prot process IO utilization is high" node ranks in the top 5% of all nodes, then "FES host fes_prot process IO utilization is high" is marked as a critical alarm state.

[0067] In the alarm state transition diagram, all critical alarm states and serious alarm states are path searched one by one to determine whether there is a one-way path. For example, in the alarm state transition diagram, it can be found that there is a one-way path from the critical alarm state "FES host fes_prot process IO utilization is high" to the serious alarm state "FES host FES application failure". The complete path includes {"FES host fes_prot process IO utilization is high", "FES host server CPU utilization is high", "FES host FES application failure"}. Since the path length is 2, the calculated path transition probability is P 2 The value of the corresponding element in . Let the probability threshold ρ = 0.2. When the path transfer probability is greater than 0.2, the path is the key monitoring path.

[0068] In the process of the above-mentioned real-time alarm analysis of operation and maintenance, the relationship diagram component is used to visualize the alarm state transition diagram to help analyze and monitor the changes in the alarm state. When the critical alarm state "FES host fes_prot process IO utilization is high" appears, the monitoring and early warning mechanism for key paths is activated. The early warning content includes the probability of a serious alarm state occurring in the future and the expected time of occurrence. The probability of a serious alarm state occurring in the future is the path transfer probability. The expected time of occurrence of the severe alarm state in the future is the sum of the time intervals on the path. The early warning mechanism is based on historical alarm data mining and prediction models, and analyzes real-time alarm data. Its main function is to provide predictions and response strategies for future alarm risks by intelligently processing the characteristic data of the alarm state.

[0069] The transition probability between the current alarm state and the severe alarm state is calculated in real time. If the transition probability drops below the threshold ρ or the time interval from the occurrence of "high IO utilization of the FES host fes_prot process" exceeds the expected occurrence time, the warning is canceled.

[0070] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media that include computer-usable program code.

[0071] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for analyzing operation and maintenance alarms in a power grid dispatching automation system, comprising the following steps: Dividing the power grid dispatching automation system into a production control area and a management and analysis area; After various types of operation and maintenance alarms generated during the operation of the power grid dispatching automation system are screened in the production control area, they are transmitted to the management and analysis area by an isolation device; the various types of operation and maintenance alarms include server performance index anomaly alarms, application key process status alarms, public service performance index anomaly alarms, and infrastructure index anomaly alarms; Completing the operation and maintenance alarm data according to the distribution status of application deployment and the primary and standby machine status of the application at the alarm occurrence time; collecting historical alarm data already existing in the dispatching automation system, dividing the historical alarm data into different alarm states according to the alarm type, calculating the transition probability between different alarm states, and constructing an alarm state transition diagram; Marking the key alarm states and serious alarm states in the alarm state transition diagram, calculating the path transition probability from the key alarm state to the serious alarm state, and screening out the paths that need to be monitored key; analyzing alarms in real time in the dispatching automation system and giving early warnings for serious alarms.

2. The operation and maintenance alarm analysis method according to claim 1, characterized in that: The alarm data includes alarm time, alarm id, alarm level, system area, server name, index name, index value, trigger threshold, value unit. If the operation and maintenance alarm type is an application process alarm, the alarm data also includes application name and process name.

3. The operation and maintenance alarm analysis method according to claim 1, characterized in that: The operation and maintenance alarms are screened in the production control area. First, set the transmission period as T and the observation window of the alarm as w, where w < T. The screening conditions include: Within the observation window w, alarms with the same alarm level, system area, server name, application name, process name, and index name are regarded as duplicate alarms, and only the one with the latest alarm time is retained for duplicate alarms; Within the observation window w, for alarms with the same system area, server name, process name, and index name but different alarm levels, only the one with the highest alarm level is retained; Within the transmission period T, for the same alarms with exactly the same alarm data, only the first-occurring alarm is retained, and a silent period of duration s is set starting from the alarm occurrence time. Alarms that appear within the silent period will be ignored; the same alarms that exceed the silent period are recorded, and the duration of the silent period is updated to twice the original.

4. The operation and maintenance alarm analysis method according to claim 1, characterized in that: The production control area transmits the screened operation and maintenance alarms to the management and analysis area. An alarm collection agent program is deployed on each server in the production control area. The agent program saves the screened alarms as files and forwards the files to the specified path of the production control area transmission server; the isolation device transmits the files at the specified path of the production control area transmission server to the specified path of the management and analysis area transmission server according to the period T. The alarm analysis program in the management and analysis area scans the path periodically, transfers to the alarm analysis server, and performs alarm analysis after parsing the files.

5. The operation and maintenance alarm analysis method according to claim 1, characterized in that: The step of completing the operation and maintenance alarm data is: 2.1) Regularly read the system application distribution table to obtain the mapping relationship between SCADA, FES, and the server name; 2.2) Regularly send requests to the system management service to obtain the master and standby machine information of SCADA and FES; 2.3) If the alarm is a server performance issue, you need to add all the applications running on the server at the time the alarm occurs, and clearly indicate whether these applications are running on the host; if the alarm is a process alarm, you need to add the application to which the process belongs and whether the application is running on the host.

6. The operation and maintenance alarm analysis method according to claim 1, characterized in that: The steps of calculating the transition probabilities between different alarm states and constructing an alarm state transition diagram are: 3.1) Treat each type of alarm as a state, and use edges to represent the possibility of one alarm state transferring to another state. The weight of the edge is the transition probability based on historical alarm data, and the attribute of the edge is the average interval time of state transition; 3.2) Convert the transition frequency to probability, set the threshold p, the transition frequency from state A to state B is f(A,B), the total number of transitions of A is T(A), then the transition probability is expressed as: P(A→B)=f(A,B) / T(A) When the state transition probability is greater than the threshold p, an edge is established between state A and state B, and the average interval time between the two alarm states is calculated as the attribute of the edge.

7. The operation and maintenance alarm analysis method according to claim 1, characterized in that: The severe alarm state in the marking alarm state transition diagram is to mark the operation and maintenance alarm data. The operation and maintenance alarm data types that need to be metered include key application process stop, deadlock, and public service failure to respond; The steps of marking the key alarm states in the alarm state transition diagram are: 4.1) Based on the PageRank algorithm, an initial PageRank value is assigned to each node, which is usually 1 / total number of nodes; 4.2) For each node, the PageRank value of the node is determined by calculating the weighted average of the PageRank values ​​of all the incoming nodes of the node; the weighting coefficient depends on the weight of each incoming edge, that is, the transition probability; 4.3) Use an iterative algorithm to update the PageRank value of each node, and recalculate the PageRank value of the node every iteration until all PageRank values ​​converge to a stable state, or the number of iterations reaches a preset maximum value; 4.4) In the alarm state transition diagram, a higher PageRank value indicates that the node has higher importance and influence, and the alarm state of the PageRank value Top K is set as the critical alarm state.

8. The operation and maintenance alarm analysis method according to claim 1, characterized in that: The steps of calculating the path transition probability from the critical alarm state to the severe alarm state and selecting the path that needs to be monitored are: 5.1) Based on the transition probabilities represented by the edges in the alarm state transition graph, the corresponding state transition matrix P is constructed. Each element p of the state transition matrix P ij Indicates that the critical alarm state S i To severe alarm state S j The transition probability of 5.2) In the alarm state transition diagram, for any pair of states S i With state S j , find the i Status to S j All paths of the state, record the longest path length as n; 5.3) From state S i To state S j After n steps, calculate the nth power of matrix P n , P n Elements in That means from state S i To state S j The path transition probability; 5.4) Set the probability threshold ρ, if The path is considered to be in the critical alarm state S i Points to severe alarm status S j Key monitoring paths.

9. The operation and maintenance alarm analysis method according to claim 1, characterized in that: The steps of real-time analysis of alarms in the dispatching automation system are: 6.1) During the real-time alarm analysis of operation and maintenance, use visualization tools to display the alarm status transition diagram; 6.2) When a critical alarm state is detected, monitoring of the key monitoring path is initiated and an early warning mechanism is initiated; The warning mechanism analyzes real-time warning data based on historical warning data mining and prediction models; the warning content includes the probability of a severe alarm state occurring in the future and the expected time of occurrence. The probability of a severe alarm state occurring in the future is the path transfer probability. The expected occurrence time of the severe alarm state in the future is the sum of the time intervals on the path; 6.3) Calculate the real-time transition probability between the current alarm state and the severe alarm state in real time. If the real-time transition probability drops below the threshold ρ or the time interval exceeds the set maximum time sum, the warning is canceled.

10. A power grid dispatching automation system operation and maintenance alarm analysis system, characterized in that: include: The alarm collection module is used to transmit various types of operation and maintenance alarms generated by the power grid dispatching automation system during operation to the management and analysis area through the isolation device after screening in the production control area; The transition probability module is used to complete the operation and maintenance alarm data; different types of alarms are regarded as different alarm states, the transition probabilities between different alarm states are calculated, and the alarm state transition diagram is constructed; The analysis and warning module is used to mark the critical alarm status and serious alarm status in the alarm status transition diagram, calculate the path transition probability from the critical alarm status to the serious alarm status, and screen out the paths that need to be monitored; analyze the alarms in real time in the dispatching automation system and issue warnings for serious alarms.

Images