Power grid alarm information processing method and device, terminal equipment and storage medium

Abstract

The invention discloses a power grid alarm information processing method and device, terminal equipment and a storage medium, and belongs to the field of power grid information processing, and the method comprises the steps: obtaining to-be-processed alarm information of different power systems in a preset time period; performing text processing on the to-be-processed alarm information according to a preset natural language processing model to obtain first alarm information after text processing; time features, alarm level features, equipment type features and fault type features are extracted according to the first alarm information, and feature attributes of the first alarm information are obtained; according to a preset data mining model and the characteristic attributes, carrying out importance evaluation on the to-be-processed alarm information to obtain an importance evaluation level of the to-be-processed alarm information; clustering the first alarm information according to the feature attributes to generate a plurality of alarm information clusters; and generating an alarm information processing decision according to the abnormal mode and the importance evaluation level corresponding to the alarm information cluster. According to the invention, the accuracy of alarm information processing is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of power system information processing, and in particular to a power grid alarm information processing method, device, terminal equipment and storage medium. Background Art

[0002] In modern power grid operation and management systems, with the continuous expansion and increasing complexity of power grids, alarm information is experiencing an explosive growth. Traditional methods of processing power grid alarm information rely primarily on operations and maintenance personnel manually reviewing alarm texts generated by monitoring systems and relying on their personal experience to make fault diagnosis and handling decisions. Currently, some power grid companies have introduced basic data management systems to achieve initial centralized storage and simple classification of alarm information, which has, to some extent, alleviated the scattered and disorganized nature of alarm information. Natural language processing technology is applied to alarm text parsing, and data mining algorithms are used to discover a small number of association rules between alarm information. However, current power grid alarm information processing has not yet formed an integrated whole. Natural language processing and data mining processes are relatively isolated, lacking a collaborative analysis mechanism. This results in feature engineering relying on manual experience and difficulty in discovering cross-modal association rules, resulting in reduced accuracy in power grid alarm information processing. Summary of the Invention

[0003] The embodiments of the present invention provide a method, apparatus, terminal device and storage medium for processing power grid alarm information, which can effectively solve the problem of reduced accuracy of power grid alarm information processing in the prior art.

[0004] An embodiment of the present invention provides a method for processing power grid alarm information, comprising:

[0005] Obtain pending alarm information of different power systems within a preset time period;

[0006] Performing text processing on the alert information to be processed according to a preset natural language processing model to obtain first alert information after text processing;

[0007] Extracting time features, alarm level features, device type features, and fault type features from the first alarm information to obtain characteristic attributes of the first alarm information;

[0008] Performing an importance assessment on the alarm information to be processed based on a preset data mining model and the characteristic attributes to obtain an importance assessment level of the alarm information to be processed;

[0009] Clustering the first alarm information according to the characteristic attributes to generate a plurality of alarm information clusters;

[0010] An alarm information processing decision is generated according to the abnormal pattern corresponding to the alarm information cluster and the importance evaluation level.

[0011] Furthermore, the natural language processing model includes a multi-layer attention network;

[0012] Performing text processing on the alert information to be processed according to a preset natural language processing model to obtain first alert information after text processing, including:

[0013] Segmenting the alarm information to be processed according to a preset natural language processing model, and removing stop words from the segmented alarm information according to a preset power grid field stop word list to obtain the alarm information after the stop words are removed;

[0014] Normalization processing is performed on the warning information after removing stop words to obtain unified target warning information of the unit after normalization processing;

[0015] The target warning information is subjected to deep semantic understanding according to the multi-layer attention network, so that the multi-layer attention network performs deep semantic understanding on the fuzzy warning information in the target warning information to obtain first warning information.

[0016] Furthermore, time features, alarm level features, device type features, and fault type features are extracted based on the first alarm information to obtain characteristic attributes of the first alarm information, including:

[0017] Performing part-of-speech tagging on the first alarm information to obtain second alarm information after part-of-speech tagging;

[0018] Perform entity recognition according to the second alarm information to obtain a device name recognition result, a fault type recognition result, and a time dimension recognition result of the second alarm information;

[0019] Extracting device type features from the second alarm information according to the device name recognition result to obtain device type features;

[0020] Extracting an alarm level feature and a fault type feature from the second alarm information according to the fault type identification result to obtain an alarm level feature and a fault type feature;

[0021] Extracting time features from the second alarm information according to the time dimension recognition result to obtain a time feature;

[0022] A characteristic attribute of the first alarm information is obtained according to the device type feature, the alarm level feature, the fault type feature, and the time feature.

[0023] Furthermore, the importance of the alarm information to be processed is evaluated based on the preset data mining model and the characteristic attributes to obtain the importance evaluation level of the alarm information to be processed, including:

[0024] Get the current time;

[0025] Perform frequency statistics on the characteristic attributes according to the equipment type characteristics and the fault type characteristics according to the preset data mining model to obtain the equipment type frequency and the fault type frequency respectively;

[0026] Determine the urgency index based on the equipment type frequency and the preset equipment importance table;

[0027] Determining a severity indicator based on the alarm level characteristics;

[0028] Determine a handling difficulty index based on the frequency of the fault type and a preset fault handling difficulty table;

[0029] Calculating a time difference based on the current time and the time feature, and determining a timeliness index based on the time difference;

[0030] Determine the potential risk index for each fault type based on the fault type characteristics and a preset potential risk table;

[0031] Calculating a comprehensive index based on the urgency index, the severity index, the handling difficulty index, the timeliness index, and the potential risk index;

[0032] Determine the indicator importance evaluation level of each comprehensive indicator according to the comprehensive indicator and the preset indicator importance level table, and obtain the importance evaluation level of the alarm information to be processed;

[0033] Among them, the equipment importance table represents the equipment importance level corresponding to each equipment type; the fault handling difficulty table represents the handling difficulty level corresponding to each fault type; the potential risk table represents the risk probability corresponding to each fault type; and the indicator importance level table represents the indicator importance assessment level corresponding to the comprehensive indicator.

[0034] Furthermore, the first alarm information is clustered according to the characteristic attributes to generate several alarm information clusters, including:

[0035] clustering the first alarm information according to the characteristic attributes to generate an initial alarm information cluster;

[0036] Mapping the characteristic attributes of the current alarm information cluster to the corresponding hash space according to a preset hash function to generate a hash value; wherein the current alarm information cluster at the time of the first mapping is the initial alarm information cluster;

[0037] Calculating the similarity of every two characteristic attributes in the current alarm information cluster according to the hash value, and obtaining the similarity of the current alarm information cluster according to the similarity of every two characteristic attributes in the current alarm information cluster;

[0038] Determine whether the similarity of the current alarm information cluster is greater than a preset similarity threshold;

[0039] If so, obtain several alarm information clusters based on the current alarm information cluster;

[0040] If not, the current alarm information cluster is updated according to the similarity of the current alarm information cluster and is used as the current alarm information cluster for the next mapping.

[0041] Furthermore, generating an alarm information processing decision according to the abnormal pattern corresponding to the alarm information cluster and the importance assessment level includes:

[0042] Identifying the corresponding abnormal pattern according to the characteristic attributes in the alarm information cluster;

[0043] Determine the alarm information processing rule corresponding to the abnormal pattern according to the abnormal pattern and the preset processing rule correspondence table; wherein the processing rule correspondence table represents the correspondence between the abnormal pattern and the alarm information processing rule;

[0044] Determining the priority of the alarm information to be processed according to the importance assessment level;

[0045] An alarm information processing decision for the alarm information to be processed is generated according to the corresponding alarm information processing rule and the priority.

[0046] Furthermore, it also includes:

[0047] Obtaining grid topology data;

[0048] generating an initial topology diagram according to the power grid topology data and the alarm information to be processed;

[0049] According to the frequency of the device types, the corresponding device types are marked in the initial topology diagram with different colors to obtain a final topology diagram.

[0050] As an improvement to the above solution, another embodiment of the present invention provides a power grid alarm information processing device, including:

[0051] An alarm information acquisition module is used to obtain pending alarm information of different power systems within a preset time period;

[0052] A natural language processing module is used to perform text processing on the alarm information to be processed according to a preset natural language processing model to obtain the first alarm information after text processing;

[0053] An information feature extraction module, configured to extract a time feature, an alarm level feature, a device type feature, and a fault type feature from the first alarm information to obtain characteristic attributes of the first alarm information;

[0054] A data mining module is used to evaluate the importance of the alarm information to be processed based on a preset data mining model and the characteristic attributes to obtain an importance evaluation level of the alarm information to be processed;

[0055] An information clustering module, configured to cluster the first alarm information according to the characteristic attributes to generate a plurality of alarm information clusters;

[0056] The processing decision generating module is used to generate an alarm information processing decision according to the abnormal pattern corresponding to the alarm information cluster and the importance evaluation level.

[0057] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, a power grid alarm information processing method as described in the above embodiment is implemented.

[0058] Another embodiment of the present invention provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a power grid alarm information processing method described in the above embodiment.

[0059] By implementing the present invention, at least the following beneficial effects are achieved:

[0060] The present invention provides a power grid alarm information processing method, device, terminal equipment and storage medium. The method can perform text processing on the pending alarm information of different power systems within a preset time period through a preset natural language processing model, parse the alarm information to obtain the first alarm information after text processing, reduce manual intervention, and provide a basis for subsequent data mining; then, the importance of the characteristic attributes of the first alarm information is evaluated according to the preset data mining model, and the importance evaluation level of the corresponding pending alarm information is obtained, and the importance of the pending alarm information is objectively judged. Through the collaborative analysis of the natural language processing model and the data mining model, the alarm information cluster obtained by clustering can classify similar pending alarm information together, and generate corresponding alarm information processing decisions according to the importance evaluation level. Extracting time, alarm level, device type, and fault type features, compared to relying on manual experience to extract features, automatically parsing large amounts of pending alarm information and identifying key information in pending alarm information allows for more comprehensive and accurate acquisition of the characteristic attributes of alarm information, reducing the risk of incomplete or inaccurate feature extraction due to insufficient manual experience or bias. Accurately parsing pending alarm information through natural language processing models, combined with data mining models to assess the importance of characteristic attributes and cluster analysis of alarm information, can more accurately determine abnormal patterns in pending alarm information. Generating alarm information processing decisions based on these accurate analysis results can avoid misjudgments and missed judgments, thereby improving the accuracy of power grid alarm information processing and enabling power grid operation and maintenance personnel to handle alarms more specifically, promptly discover and resolve power grid faults, and ensure the safe and stable operation of the power grid. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 This is a flow chart of a method for processing power grid alarm information provided by one embodiment of the present invention;

[0062] Figure 2 This is a schematic diagram of a process architecture provided by an embodiment of the present invention;

[0063] Figure 3 The present invention provides a schematic structural diagram of a power grid alarm information processing device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0064] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0065] See also Figure 1To solve the problem of low accuracy in processing power grid alarm information, an embodiment of the present invention provides a power grid alarm information processing method, comprising:

[0066] S1. Obtain pending alarm information of different power systems within a preset time period;

[0067] Specifically, different power systems in the power grid, such as the SCADA system, equipment fault diagnosis system, etc.; preset time periods, such as one week; the alarm information to be processed includes detailed and accurate alarm text descriptions, covering various surface characteristics of equipment failures, abnormal sounds, indicator light status and other details. The alarm occurrence time is accurate to the millisecond level, and the alarm device identification is unique and strictly corresponds to the power grid asset coding system.

[0068] S2. Performing text processing on the alert information to be processed according to a preset natural language processing model to obtain first alert information after text processing;

[0069] Specifically, the natural language processing model includes a multi-layer attention network;

[0070] Performing text processing on the alert information to be processed according to a preset natural language processing model to obtain first alert information after text processing, including:

[0071] Segmenting the alarm information to be processed according to a preset natural language processing model, and removing stop words from the segmented alarm information according to a preset power grid field stop word list to obtain the alarm information after the stop words are removed;

[0072] Normalization processing is performed on the warning information after removing stop words to obtain unified target warning information of the unit after normalization processing;

[0073] The target warning information is subjected to deep semantic understanding according to the multi-layer attention network, so that the multi-layer attention network performs deep semantic understanding on the fuzzy warning information in the target warning information to obtain first warning information.

[0074] In a preferred embodiment of the present invention, a multi-layer attention network adopts an innovative model that integrates a long short-term memory network (LSTM) and an attention mechanism, focusing on key information in the text, and performing deep semantic understanding and intent recognition on ambiguous situations such as complex sentences, metaphorical expressions, and polysemous words. First, based on the fuzzy alarm information in the alarm information to be processed, the number of LSTM layers and units is determined. A three-layer LSTM layer and 300 LSTM units are used. The model performance under different settings is compared, the number of layers and the number are adjusted, and the optimal parameter configuration is selected. Then, the Xavier initialization method is used to calculate the initialization weight of the LSTM unit, and multiple LSTM layers are connected in sequence to form a multi-layer LSTM network structure. Then, an attention mechanism is added to the output of each LSTM layer to highlight key information. Then, the attention weight is calculated, and the output of the LSTM is mapped to a vector with a dimension of 1 through a fully connected layer, and then normalized using the softmax function to obtain the attention weight of each time step. Next, a bottom-up approach is employed, stacking multiple single-layer attention mechanisms in a specific manner to form a multi-layer attention architecture. The model is trained using a cross-entropy loss function to deeply mine key information from the text and more accurately understand complex, ambiguous alarm messages. Ambiguous alarm messages in the processed alarm information represent alarm text that is difficult to directly parse and accurately locate faults due to unclear natural language expression, semantic ambiguity, or missing features.

[0075] In a preferred embodiment of the present invention, the alarm information to be processed is segmented according to a preset natural language processing model, such as using the professional Chinese segmentation tool jieba for word segmentation, and stop words are removed according to a preset stop word list in the power grid field to obtain the alarm information after the stop words are removed; the alarm information after the stop words are removed is normalized, for example, all texts are converted into lowercase letters, and unit values ​​are converted into international unified standard units to obtain target alarm information with unified units after normalization; finally, the target alarm information is deeply semantically understood according to the multi-layer attention network to obtain the first alarm information.

[0076] Removing stop words from the segmented to-be-processed alarm information through a preset stop word list in the power grid field can filter out words such as "of", "in", "etc." that do not contribute to the substantial content of the alarm information. While reducing the data volume, it highlights key information and improves the accuracy and efficiency of subsequent processing. Normalizing the alarm information after removing stop words and converting it into target alarm information with a unified unit can unify the data format, avoid errors or deviations caused by inconsistent data representations, help improve the model's processing ability for alarm information from different sources and in different formats, and make subsequent analysis more accurate and reliable. Using a multi-layer attention network for in-depth semantic understanding of the target alarm information, especially for the processing of fuzzy alarm information, can automatically learn and capture semantic features and context relationships in the alarm information. The attention mechanism allows the model to focus on key semantic parts, thereby more accurately understanding the meaning of fuzzy alarm information, effectively solving the problem of difficult parsing and precise fault location caused by the fuzzy expression of natural language, improving the understanding and analysis ability of alarm information, and providing a more accurate basis for subsequent fault location, handling decisions, etc.

[0077] S3. Extract time features, alarm level features, device type features, and fault type features from the first alarm information to obtain the feature attributes of the first alarm information;

[0078] Preferably, extracting time features, alarm level features, device type features, and fault type features from the first alarm information to obtain the feature attributes of the first alarm information includes:

[0079] Perform词性标注 on the first alarm information to obtain the second alarm information after词性标注;

[0080] Perform entity recognition on the second alarm information to obtain the device name recognition result, fault type recognition result, and time dimension recognition result of the second alarm information;

[0081] Extract device type features from the second alarm information according to the device name recognition result to obtain device type features;

[0082] Extract alarm level features and fault type features from the second alarm information according to the fault type recognition result to obtain alarm level features and fault type features;

[0083] Extract time features from the second alarm information according to the time dimension recognition result to obtain time features;

[0084] Obtain the feature attributes of the first alarm information according to the device type features, the alarm level features, the fault type features, and the time features. It should be noted that the "词性标注" in the translation of item needs to be replaced with the accurate English expression for "词性标注" in the relevant field, and the same goes for other terms that need to be accurately translated according to professional content. Here, it is temporarily retained in Chinese for the purpose of showing the translation process.

[0085] Specifically, a BiLSTM-CRF model is used to perform part-of-speech tagging on the first alarm information to obtain the tagged second alarm information. Entity recognition is then performed on the second alarm information to obtain device name recognition results, fault type recognition results, and time dimension recognition results. The device name recognition results, as the alarm object, represent the bulk of alarm information in the power grid system, specifically including equipment such as transformers, transmission lines, circuit breakers, and disconnectors. Fault type recognition results refer to specific fault types, such as those indicating excessive temperature of the protection device, such as equipment fault alarms, protection device alarms, abnormal operation alarms, system status alarms, and external factor alarms. After entity recognition is performed on the second alarm information, characteristic attributes of the second alarm information are further extracted. These attributes, based on the device type feature, alarm level feature, fault type feature, and time feature, are used as characteristic attributes of the first alarm information.

[0086] By performing part-of-speech tagging and entity recognition on the first alarm information, key entity information such as device name, fault type, and time can be accurately extracted from the text. This helps to clearly classify and locate the key elements in the alarm information, providing a basis for subsequent feature extraction for different types of information, avoiding omissions and errors that may occur in manual identification, and improving the accuracy and efficiency of information extraction. By extracting device type features, alarm level features, fault type features, and time features from the device name recognition results, fault type recognition results, and time dimension recognition results, respectively, multi-dimensional feature extraction of alarm information is achieved. This can fully tap into the various useful information contained in the alarm information, describe the nature and characteristics of the alarm from different perspectives, and provide rich and comprehensive data support for subsequent importance assessment, cluster analysis, and processing decisions.

[0087] S4. Evaluate the importance of the alarm information to be processed based on the preset data mining model and the characteristic attributes to obtain an importance evaluation level of the alarm information to be processed;

[0088] Specifically, the importance of the alarm information to be processed is evaluated based on the preset data mining model and the characteristic attributes to obtain the importance evaluation level of the alarm information to be processed, including:

[0089] Get the current time;

[0090] Perform frequency statistics on the characteristic attributes according to the equipment type characteristics and the fault type characteristics according to the preset data mining model to obtain the equipment type frequency and the fault type frequency respectively;

[0091] Determine the urgency index based on the equipment type frequency and the preset equipment importance table;

[0092] Determining a severity indicator based on the alarm level characteristics;

[0093] Determine a handling difficulty index based on the frequency of the fault type and a preset fault handling difficulty table;

[0094] Calculating a time difference based on the current time and the time feature, and determining a timeliness index based on the time difference;

[0095] Determine the potential risk index for each fault type based on the fault type characteristics and a preset potential risk table;

[0096] Calculating a comprehensive index based on the urgency index, the severity index, the handling difficulty index, the timeliness index, and the potential risk index;

[0097] Determine the indicator importance evaluation level of each comprehensive indicator according to the comprehensive indicator and the preset indicator importance level table, and obtain the importance evaluation level of the alarm information to be processed;

[0098] Among them, the equipment importance table represents the equipment importance level corresponding to each equipment type; the fault handling difficulty table represents the handling difficulty level corresponding to each fault type; the potential risk table represents the risk probability corresponding to each fault type; and the indicator importance level table represents the indicator importance assessment level corresponding to the comprehensive indicator.

[0099] In a preferred embodiment of the present invention, the preset data mining model first performs a big data cleaning operation on the first alarm information to remove duplicate alarm information, and at the same time checks and corrects obviously erroneous alarm data, such as checking whether the alarm time is within a reasonable time range. If a future time or an obviously unreasonable past time (such as exceeding the power grid operation record time) appears, it is determined to be obviously erroneous alarm data. The equipment importance table represents the equipment importance level corresponding to each equipment type; the fault handling difficulty table represents the handling difficulty level corresponding to each fault type; the potential risk table represents the risk probability corresponding to each fault type; the indicator importance level table represents the indicator importance assessment level corresponding to the comprehensive indicator. First, frequency statistics are performed according to the equipment type characteristics and the fault type characteristics to obtain the equipment type frequency and the fault type frequency respectively, and then the urgency index is determined based on the equipment type frequency and the preset equipment importance table. The urgency index includes two sub-indicators: urgency and impact range. The higher the frequency of the equipment type, the higher the level in the equipment importance table, indicating a higher urgency and a larger impact range. For example, urgency is divided into non-emergency, relatively urgent, very urgent, and extremely urgent, and the impact range is divided into small, medium, large, and extremely large, with scores of 1, 2, 3, and 4 points respectively. The severity index is determined based on the alarm level characteristics. The severity index is divided into two sub-indicators: fault level and equipment importance. The fault level is divided into minor fault, medium fault, serious fault, and extremely serious fault. The equipment importance is divided into non-critical equipment, secondary equipment, important equipment, and critical equipment, with scores of 1, 2, 3, and 4 points respectively. The alarm level characteristics indicate the level of the alarm information to be processed. The higher the alarm level, the higher the severity index. Based on the frequency of the fault types and a preset fault handling difficulty table, a handling difficulty index is determined. The handling difficulty index is divided into two sub-indicators: handling complexity and historical handling effect. Handling complexity is divided into simple handling, medium handling, relatively complex handling, and very complex handling. Historical handling effect is divided into poor historical handling effect, average historical handling effect, good historical handling effect, and excellent handling effect, with scores of 1, 2, 3, and 4, respectively. Historical handling effect is evaluated based on historical fault information data and historical handling decisions. A higher fault type frequency indicates that the device is prone to failure and is simple to handle, so the corresponding fault handling difficulty is low and the score is low. Based on the current time and the time characteristics, a time difference is calculated, and a timeliness index is determined based on the time difference. The timeliness index is divided into two sub-indicators: real-time and persistence. Real-time is divided into poor real-time, average real-time, high real-time, and extremely high real-time. Persistence is divided into short duration, medium duration, long duration, and extremely long duration, with scores of 1, 2, 3, and 4, respectively. A larger time difference indicates that the fault information to be handled has been generated for a longer time, and a longer duration indicates a higher score.Based on the characteristics of the fault type and a pre-defined potential risk table, a potential risk indicator is determined for each fault type. The potential risk indicator is divided into two sub-indicators: risk probability and risk consequence. Risk probability is categorized as low, medium, high, and extremely high. Risk consequence is categorized as minor, medium, severe, and extremely severe, with scores of 1, 2, 3, and 4, respectively. Each risk probability is assigned to a fault type, and the potential risk table records the risk probability for each fault type. The resulting composite indicator of the 10 sub-indicators across the five dimensions ranges from 10 to 40 points. The final importance assessment is as follows: Low importance: 15 points or less indicates that the alarm is of limited importance and can be temporarily ignored or delayed. Medium importance: 16-23 points indicates that the alarm is of some importance and requires prompt attention and action. High importance: 24-31 points indicates that the alarm is of great importance and requires immediate action. Extreme importance: 32-40 points indicates that the alarm is extremely important and requires urgent attention and appropriate emergency measures.

[0100] Features are extracted from multiple dimensions, including device type, fault type, alarm level, and time, and converted into indicators of urgency, severity, difficulty, timeliness, and potential risk. This comprehensively considers various factors that influence the importance of alarm information. This consideration of the potential risk probabilities associated with different fault types helps prevent potential serious consequences and provides more comprehensive protection for the safe and stable operation of the power grid.

[0101] S5. Clustering the first alarm information according to the characteristic attributes to generate a plurality of alarm information clusters;

[0102] Specifically, the first alarm information is clustered according to the characteristic attributes to generate several alarm information clusters, including:

[0103] clustering the first alarm information according to the characteristic attributes to generate an initial alarm information cluster;

[0104] Mapping the characteristic attributes of the current alarm information cluster to the corresponding hash space according to a preset hash function to generate a hash value; wherein the current alarm information cluster at the time of the first mapping is the initial alarm information cluster;

[0105] Calculating the similarity of every two characteristic attributes in the current alarm information cluster according to the hash value, and obtaining the similarity of the current alarm information cluster according to the similarity of every two characteristic attributes in the current alarm information cluster;

[0106] Determine whether the similarity of the current alarm information cluster is greater than a preset similarity threshold;

[0107] If so, obtain several alarm information clusters based on the current alarm information cluster;

[0108] If not, the current alarm information cluster is updated according to the similarity of the current alarm information cluster and is used as the current alarm information cluster for the next mapping.

[0109] In a preferred embodiment of the present invention, clustering the first alarm information is to group the alarm information with similar characteristic attributes so that the alarm information in the same group has similar fault causes or impact ranges, specifically using local sensitive hash and edit distance algorithms. The local sensitive hash algorithm performs similarity and clustering operations through hash mapping, and designs a local sensitive hash function (preset hash function) so that similar characteristic attributes have a higher probability of being mapped to the same bucket in the hash space. The characteristic attributes are mapped to the hash space through the preset hash function to form a hash value or hash bucket. In the hash space, the similarity of the hash values ​​is compared to determine the similarity of each two characteristic attributes in the current alarm information cluster. The similarity of the current alarm information cluster is measured by obtaining the hash value similarity through the Hamming distance. The Hamming distance calculation formula is: Where h i (x) and h i (y) are the hash values ​​of data points x and y (every two feature attributes in the current alarm information cluster) under the i-th hash function. Then, it is determined whether the similarity of the current alarm information cluster is greater than the preset similarity threshold (0.85). If so, several alarm information clusters are obtained based on the current alarm information cluster; if not, the current alarm information cluster is updated according to the similarity of the current alarm information cluster and used as the current alarm information cluster for the next mapping until the similarity of the current alarm information cluster is greater than the preset similarity threshold. Preferably, the edit distance algorithm further calculates the similarity based on the local sensitive hash algorithm, and uses the dynamic programming method to construct a two-dimensional matrix with a size of (m+1)x(n+1), where m and n are the lengths of two strings (feature attributes), respectively. Each element dp[i][j] in the matrix represents the minimum number of editing operations required to convert the string s[0:i] to t[0:j]. The final edit distance is the last element dp[m][n] of the matrix. The similarity can be calculated by the formula: 1-edit distance / max(string length).

[0110] By mapping characteristic attributes to a hash space using a preset hash function to generate a hash value, and then using the hash value to calculate the similarity between characteristic attributes, this method can more accurately measure the degree of similarity between characteristic attributes. Determining whether to further divide or update alarm information clusters based on similarity can make clustering results more realistic, avoiding the misclassification that can occur with traditional clustering methods, thereby improving the accuracy of alarm information clustering. For example, alarm information with similar characteristic attributes such as device type and fault type can be more accurately clustered together, ensuring that the alarm information within each alarm information cluster has high relevance and consistency.

[0111] S6. Generate an alarm information processing decision according to the abnormal pattern corresponding to the alarm information cluster and the importance evaluation level.

[0112] Specifically, generating an alarm information processing decision according to the abnormal pattern corresponding to the alarm information cluster and the importance assessment level includes:

[0113] Identifying the corresponding abnormal pattern according to the characteristic attributes in the alarm information cluster;

[0114] Determine the alarm information processing rule corresponding to the abnormal pattern according to the abnormal pattern and the preset processing rule correspondence table; wherein the processing rule correspondence table represents the correspondence between the abnormal pattern and the alarm information processing rule;

[0115] Determining the priority of the alarm information to be processed according to the importance assessment level;

[0116] An alarm information processing decision for the alarm information to be processed is generated according to the corresponding alarm information processing rule and the priority.

[0117] In a preferred embodiment of the present invention, a processing rule correspondence table represents the correspondence between abnormal patterns and alarm information processing rules. The device types involved in the alarm information cluster are examined to determine whether they are concentrated in a specific type or types of equipment. For example, if a large number of alarms are related to transformers, this may indicate a common abnormality in the transformers, such as overload or insulation aging. If a cluster of high-level alarms (such as emergency or critical alarms) accounts for a large proportion, it indicates that the abnormality corresponding to that cluster is more serious and requires immediate attention and processing. Determining the processing priority of pending alarms based on their importance assessment levels ensures that limited operation and maintenance resources are allocated preferentially to high-importance alarms. For example, a "busbar short circuit" alarm with a high importance assessment level will be prioritized for personnel and equipment processing, while general alarms of lower importance can be appropriately deferred. This avoids resource waste and improves resource utilization efficiency. When faced with a large number of alarms, processing priorities can be quickly and accurately determined, enabling operation and maintenance personnel to respond quickly to important alarms and take timely measures to prevent the escalation of faults, reduce the scope and duration of power outages, and improve the emergency response capabilities and reliability of the power grid.

[0118] Indicatively, it also includes:

[0119] Obtaining grid topology data;

[0120] generating an initial topology diagram according to the power grid topology data and the alarm information to be processed;

[0121] According to the frequency of the device types, the corresponding device types are marked in the initial topology diagram with different colors to obtain a final topology diagram.

[0122] In another preferred embodiment of the present invention, alarm handling suggestions and results are presented to power grid operators via a visual interface. This interface displays alarm information distribution, fault correlations, and handling progress, making it easier for operators to understand the power grid's operational status. The visual monitoring interface utilizes WebGL-based visualization components to achieve three-dimensional dynamic display. Operators can use mouse gestures such as rotation, zooming, and clicking to view the distribution of alarm information. The high-incidence fault situation in each area is presented in the form of a heat map, and fault correlations are clearly displayed using a correlation diagram. The processing process and decision-making basis are recorded to form a complete operation and maintenance log, facilitating subsequent review and optimization.

[0123] In a preferred embodiment of the present invention, Figure 2 In the process architecture shown, the intelligent decision-making model defines the alarm processing process and strategy and automatically generates corresponding handling suggestions, including instructions such as issuing maintenance work orders, adjusting equipment operating parameters, and switching to backup equipment. The human-computer interaction interface is used to visualize alarm information and alarm processing decisions.

[0124] In a preferred embodiment of the present invention, alarm information for a period of time (e.g., one week) is collected from various monitoring systems of the power grid (such as SCADA systems, equipment fault diagnosis systems, etc.), with a total of 1000 alarm messages to be processed. The following are some examples: "The oil temperature of the No. 1 main transformer in a certain substation is too high, the current oil temperature is 85°C, exceeding the normal threshold of 80°C", "The instantaneous overcurrent protection of phase A of a certain line trips, and the fault current is 500 A", "The voltage on the low-voltage side of a certain distribution transformer is too low, the measured value is 350 V, and the standard value is 400 V". The professional Chinese word segmentation tool Jieba is used to perform word segmentation operations on these alarm messages to be processed. For example, for the alarm message "The oil temperature of the No. 1 main transformer in a certain substation is too high, the current oil temperature is 85°C, exceeding the normal threshold of 80°C", the word segmentation results are: "XX", "substation", "No. 1", "main transformer", "oil temperature", "too high", "alarm", "current", "oil temperature", "85", "°C", "exceeding", "normal", "threshold", "80", "°C". According to the pre-set stop word list in the power grid field (including common conjunctions, auxiliary words, meaningless quantifiers, etc., such as "of", "already", "a", "in", etc.), the stop words in the above word segmentation results are removed, and we get: "XX", "substation", "No. 1", "main transformer", "oil temperature", "too high", "alarm", "oil temperature", "85", "°C", "exceeding", "normal", "threshold", "80", "°C". The temperature values in all alarm messages are uniformly converted to the International System of Units (converting Fahrenheit temperature to Celsius temperature), the units of electrical quantities such as voltage and current are unified into standard units (kilovolts, amperes), and all texts are converted to lowercase letter form, obtaining a preprocessed alarm information text data set, which provides basic data for subsequent steps. For the alarm message "The oil temperature of the No. 1 main transformer in a certain substation is too high, the current oil temperature is 85°C, exceeding the normal threshold of 80°C", the identified alarm object is "the No. 1 main transformer in a certain substation", the alarm content is "the oil temperature is too high", and the词性标注结果为: "a certain" (noun), "substation" (noun), "No. 1" (quantifier), "main transformer" (noun), "oil temperature" (noun), "too high" (adjective), "alarm" (verb), etc. On the basis of entity recognition, the characteristic attributes of the alarm information are further extracted to form a feature vector representation of each alarm message. It includes time characteristics. For the alarm message "The oil temperature of the No. 1 main transformer in a certain substation is too high, the current oil temperature is 85°C, exceeding the normal threshold of 80°C", the time stamp when the alarm occurs, the alarm level characteristic is general, the equipment type characteristic is substation, and the fault type characteristic is that the oil temperature is too high. Duplicate alarm messages are removed (for example, the same alarm that appears multiple times in a short period, only one record is retained), and at the same time, obviously incorrect alarm data is checked and corrected (such as garbled characters and unreasonable numerical values that occur during data transmission). After cleaning, the data set is reduced to 800 alarm messages. The frequency statistics of the cleaned alarm messages are carried out according to dimensions such as alarm type and equipment.For example, statistics revealed that the "main transformer oil temperature is too high" alarm occurred 50 times within a week, and the "line current quick-trip protection" alarm occurred 30 times. Each alarm message was then labeled with its frequency of occurrence. A significance score was calculated for each alarm message based on a pre-defined significance assessment index system. For example, the "main transformer oil temperature is too high alarm" at a certain substation was assigned a significance score of 30, as it involves critical equipment, has a high alarm level, and occurs frequently within a week. In contrast, minor voltage fluctuation alarms might only receive a score of 8. Through significance assessment, 200 critical alarms with scores above 24 were selected as the focus for further analysis and processing. The similarity between the two alarm messages, "main transformer oil temperature is too high alarm at a certain substation, current oil temperature is 85°C, exceeding the normal threshold of 80°C," and "main transformer oil temperature is too high alarm at a certain substation, current oil temperature is 86°C, exceeding the normal threshold of 80°C," was calculated using the edit distance algorithm to be 0.9. Based on a set similarity threshold (e.g., 0.8), alarms with similarities above the threshold are clustered together to form multiple alarm pattern clusters. Through alarm data clustering and pattern recognition, a total of 50 alarm pattern clusters were discovered, including 10 abnormal patterns. When a moderate fault, such as excessive oil temperature in the main transformer, is identified, the corresponding rules in the rule base generate handling recommendations, including: immediately sending a maintenance work order to the maintenance team. The work order details the faulty device ("main transformer No. 1 of a certain substation"), the fault phenomenon ("oil temperature is too high, currently 95°C"), and the estimated maintenance time ("two hours").

[0125] By implementing this embodiment, text processing is performed on the pending alarm information of different power systems within a preset time period through a preset natural language processing model, and the alarm information is parsed to obtain the first alarm information after text processing, thereby reducing manual intervention and providing a basis for subsequent data mining; then, the importance of the characteristic attributes of the first alarm information is evaluated according to the preset data mining model, and the importance evaluation level of the corresponding pending alarm information is obtained, and the importance of the pending alarm information is objectively judged. Through the collaborative analysis of the natural language processing model and the data mining model, the alarm information cluster obtained by clustering classifies similar pending alarm information together, and the corresponding alarm information processing decision is generated through the importance evaluation level. Extracting time, alarm level, device type, and fault type features, compared to relying on manual experience to extract features, automatically parsing large amounts of pending alarm information and identifying key information in pending alarm information allows for more comprehensive and accurate acquisition of the characteristic attributes of alarm information, reducing the risk of incomplete or inaccurate feature extraction due to insufficient manual experience or bias. Accurately parsing pending alarm information through natural language processing models, combined with data mining models to assess the importance of characteristic attributes and cluster analysis of alarm information, can more accurately determine abnormal patterns in pending alarm information. Generating alarm information processing decisions based on these accurate analysis results can avoid misjudgments and missed judgments, thereby improving the accuracy of power grid alarm information processing and enabling power grid operation and maintenance personnel to handle alarms more specifically, promptly discover and resolve power grid faults, and ensure the safe and stable operation of the power grid.

[0126] See also Figure 3 , is a schematic structural diagram of a power grid alarm information processing device provided by one embodiment of the present invention, comprising:

[0127] An alarm information acquisition module is used to obtain pending alarm information of different power systems within a preset time period;

[0128] A natural language processing module is used to perform text processing on the alarm information to be processed according to a preset natural language processing model to obtain the first alarm information after text processing;

[0129] An information feature extraction module, configured to extract a time feature, an alarm level feature, a device type feature, and a fault type feature from the first alarm information to obtain characteristic attributes of the first alarm information;

[0130] A data mining module is used to evaluate the importance of the alarm information to be processed based on a preset data mining model and the characteristic attributes to obtain an importance evaluation level of the alarm information to be processed;

[0131] An information clustering module, configured to cluster the first alarm information according to the characteristic attributes to generate a plurality of alarm information clusters;

[0132] The processing decision generating module is used to generate an alarm information processing decision according to the abnormal pattern corresponding to the alarm information cluster and the importance evaluation level.

[0133] The present invention provides a power grid alarm information processing device. The device comprises an alarm information acquisition module, which acquires pending alarm information of different power systems within a preset time period. The device performs text processing on the pending alarm information according to a preset natural language processing model in a natural language processing module to obtain a first alarm information after text processing. The device extracts time features, alarm level features, equipment type features, and fault type features from the first alarm information to obtain characteristic attributes of the first alarm information. The device performs importance assessment on the pending alarm information according to a preset data mining model and the characteristic attributes in a data mining module to obtain an importance assessment level of the pending alarm information. The device then clusters the first alarm information according to the characteristic attributes to generate a plurality of alarm information clusters. Finally, the device generates an alarm information processing decision according to the abnormal patterns corresponding to the alarm information clusters and the importance assessment levels in a processing decision generation module. By accurately parsing the pending alarm information through the natural language processing model, combining the importance assessment of the characteristic attributes by the data mining model and cluster analysis of the alarm information, the abnormal patterns of the pending alarm information can be more accurately determined. Generating alarm information processing decisions based on these accurate analysis results can avoid misjudgments and missed judgments, thereby improving the accuracy of power grid alarm information processing.

[0134] It should be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art can understand and implement the present invention without inventive effort.

[0135] Those skilled in the art can clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0136] Another embodiment of the present invention provides a terminal device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the power grid alarm information processing method described in the above embodiment. The terminal device can be a computing device such as a desktop computer, a notebook computer, a PDA, or a cloud server. The terminal device can include, but is not limited to, a processor and a memory.

[0137] The processor may be a central processing unit (CPU), or other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the terminal device, connecting various parts of the entire terminal device using various interfaces and lines.

[0138] The memory can be used to store the computer program, and the processor implements various functions of the terminal device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created based on the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory and can also include a non-volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device or other volatile solid-state storage device.

[0139] Another embodiment of the present invention provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a power grid alarm information processing method described in the above embodiment.

[0140] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, the steps of each of the above-mentioned method embodiments can be implemented. The computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunications signal, and a software distribution medium.

[0141] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for processing power grid alarm information, characterized in that: include: Obtain pending alarm information of different power systems within a preset time period; Performing text processing on the alert information to be processed according to a preset natural language processing model to obtain first alert information after text processing; Extracting time features, alarm level features, device type features, and fault type features from the first alarm information to obtain characteristic attributes of the first alarm information; Performing an importance assessment on the alarm information to be processed based on a preset data mining model and the characteristic attributes to obtain an importance assessment level of the alarm information to be processed; Clustering the first alarm information according to the characteristic attributes to generate a plurality of alarm information clusters; An alarm information processing decision is generated according to the abnormal pattern corresponding to the alarm information cluster and the importance evaluation level.

2. A method for processing power grid alarm information according to claim 1, characterized in that: The natural language processing model includes a multi-layer attention network; Performing text processing on the alert information to be processed according to a preset natural language processing model to obtain first alert information after text processing, including: Segmenting the alarm information to be processed according to a preset natural language processing model, and removing stop words from the segmented alarm information according to a preset power grid field stop word list to obtain the alarm information after the stop words are removed; Normalization processing is performed on the warning information after removing stop words to obtain unified target warning information of the unit after normalization processing; The target warning information is subjected to deep semantic understanding according to the multi-layer attention network, so that the multi-layer attention network performs deep semantic understanding on the fuzzy warning information in the target warning information to obtain first warning information.

3. A method for processing power grid alarm information according to claim 1, characterized in that: Extracting a time feature, an alarm level feature, a device type feature, and a fault type feature from the first alarm information to obtain characteristic attributes of the first alarm information includes: Performing part-of-speech tagging on the first alarm information to obtain second alarm information after part-of-speech tagging; Perform entity recognition according to the second alarm information to obtain a device name recognition result, a fault type recognition result, and a time dimension recognition result of the second alarm information; Extracting device type features from the second alarm information according to the device name recognition result to obtain device type features; Extracting an alarm level feature and a fault type feature from the second alarm information according to the fault type identification result to obtain an alarm level feature and a fault type feature; Extracting time features from the second alarm information according to the time dimension recognition result to obtain a time feature; A characteristic attribute of the first alarm information is obtained according to the device type feature, the alarm level feature, the fault type feature, and the time feature.

4. A method for processing power grid alarm information according to claim 3, characterized in that: The importance of the alarm information to be processed is evaluated based on the preset data mining model and the characteristic attributes to obtain the importance evaluation level of the alarm information to be processed, including: Get the current time; Perform frequency statistics on the characteristic attributes according to the equipment type characteristics and the fault type characteristics according to the preset data mining model to obtain the equipment type frequency and the fault type frequency respectively; Determine the urgency index based on the equipment type frequency and the preset equipment importance table; Determining a severity indicator based on the alarm level characteristics; Determine a handling difficulty index based on the frequency of the fault type and a preset fault handling difficulty table; Calculating a time difference based on the current time and the time feature, and determining a timeliness index based on the time difference; Determine the potential risk index for each fault type based on the fault type characteristics and a preset potential risk table; Calculating a comprehensive index based on the urgency index, the severity index, the handling difficulty index, the timeliness index, and the potential risk index; Determine the indicator importance evaluation level of each comprehensive indicator according to the comprehensive indicator and the preset indicator importance level table, and obtain the importance evaluation level of the alarm information to be processed; Among them, the equipment importance table represents the equipment importance level corresponding to each equipment type; the fault handling difficulty table represents the handling difficulty level corresponding to each fault type; the potential risk table represents the risk probability corresponding to each fault type; and the indicator importance level table represents the indicator importance assessment level corresponding to the comprehensive indicator.

5. A method for processing power grid alarm information according to claim 1, characterized in that: Clustering the first alarm information according to the characteristic attributes to generate a plurality of alarm information clusters, including: clustering the first alarm information according to the characteristic attributes to generate an initial alarm information cluster; Mapping the characteristic attributes of the current alarm information cluster to the corresponding hash space according to a preset hash function to generate a hash value; wherein the current alarm information cluster at the time of the first mapping is the initial alarm information cluster; Calculating the similarity of every two characteristic attributes in the current alarm information cluster according to the hash value, and obtaining the similarity of the current alarm information cluster according to the similarity of every two characteristic attributes in the current alarm information cluster; Determine whether the similarity of the current alarm information cluster is greater than a preset similarity threshold; If so, obtain several alarm information clusters based on the current alarm information cluster; If not, the current alarm information cluster is updated according to the similarity of the current alarm information cluster and is used as the current alarm information cluster for the next mapping.

6. A method for processing power grid alarm information according to claim 1, characterized in that: Generating an alarm information processing decision according to the abnormal pattern corresponding to the alarm information cluster and the importance assessment level, including: Identifying the corresponding abnormal pattern according to the characteristic attributes in the alarm information cluster; Determine the alarm information processing rule corresponding to the abnormal pattern according to the abnormal pattern and the preset processing rule correspondence table; wherein the processing rule correspondence table represents the correspondence between the abnormal pattern and the alarm information processing rule; Determining the priority of the alarm information to be processed according to the importance assessment level; An alarm information processing decision for the alarm information to be processed is generated according to the corresponding alarm information processing rule and the priority.

7. A method for processing power grid alarm information according to claim 4, characterized in that: Also includes: Obtaining grid topology data; generating an initial topology diagram according to the power grid topology data and the alarm information to be processed; According to the frequency of the device types, the corresponding device types are marked in the initial topology diagram with different colors to obtain a final topology diagram.

8. A power grid alarm information processing device, characterized in that: include: An alarm information acquisition module is used to obtain pending alarm information of different power systems within a preset time period; A natural language processing module is used to perform text processing on the alarm information to be processed according to a preset natural language processing model to obtain the first alarm information after text processing; An information feature extraction module, configured to extract a time feature, an alarm level feature, a device type feature, and a fault type feature from the first alarm information to obtain characteristic attributes of the first alarm information; A data mining module is used to evaluate the importance of the alarm information to be processed based on a preset data mining model and the characteristic attributes to obtain an importance evaluation level of the alarm information to be processed; An information clustering module, configured to cluster the first alarm information according to the characteristic attributes to generate a plurality of alarm information clusters; The processing decision generating module is used to generate an alarm information processing decision according to the abnormal pattern corresponding to the alarm information cluster and the importance evaluation level.

9. A terminal device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the method for processing power grid alarm information according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the power grid alarm information processing method according to any one of claims 1 to 7.

Images