Secondary equipment fault diagnosis and positioning method and system based on correlation analysis

Abstract

The application relates to the technical field of electric power automation, and discloses a secondary equipment fault diagnosis and positioning method and system based on correlation analysis. The method comprises the following steps: a dynamic space-time correlation graph is constructed, and based on topological weight, alarm time difference, system state and historical feedback, a double exponential decay model is used to calculate correlation weight. Through the collection of multi-time alarm sequences and a graph propagation algorithm, the fault source probability of each subgraph is iteratively calculated, and combined with window credibility weighted fusion, accurate fault source positioning results are output. By introducing a multi-level correlation and space-time weighting mechanism, the fault diagnosis and positioning are not only based on current fault information, but also can fully utilize historical data feedback for adjustment, so that the dynamic operation environment and complex fault scenarios of the power system can be better adapted.

Description

Technical Field

[0001] This application relates to the field of power automation technology, and in particular to a method and system for secondary equipment fault diagnosis and location based on correlation analysis. Background Technology

[0002] In modern power systems, secondary equipment (such as protection devices, monitoring and control devices, communication equipment, and remote control devices) plays a crucial role in ensuring the safe and stable operation of the power system. These devices not only monitor the real-time operating status of power equipment but also promptly issue alarm signals when faults occur, assisting operators in fault diagnosis and handling. Currently, fault diagnosis methods for secondary equipment in power systems typically rely on manual analysis based on equipment alarms or fault location through simple rules. However, these traditional diagnostic methods often lack the ability to handle complex fault scenarios and are susceptible to false alarms and missed alarms, significantly compromising the accuracy and timeliness of fault location.

[0003] Existing fault diagnosis methods typically rely on single-type alarm information, neglecting the potential spatiotemporal correlations between alarms. This introduces significant uncertainty into the fault location process, particularly in complex systems or large-scale power networks where the diversity and timeliness of alarm information are more pronounced. Due to inconsistent processing methods for different alarm sources and the lack of sufficient spatiotemporal correlation models, traditional methods often struggle to provide accurate fault location in large-scale power systems. Furthermore, traditional methods cannot flexibly address complex factors such as changes in system operating conditions, equipment aging, and load fluctuations, and are also inadequate for extracting effective feedback information from historical data for fault prediction and prevention. Summary of the Invention

[0004] This application provides a method and system for secondary equipment fault diagnosis and location based on correlation analysis. By constructing a dynamic spatiotemporal correlation graph and combining multi-dimensional information such as time differences between equipment nodes, topology weights, and alarm levels, it can fully capture the complex correlations between equipment, avoiding the limitations of relying solely on a single alarm. Simultaneously, through multi-window alarm acquisition and iterative calculation based on a graph propagation algorithm, this invention can effectively reduce errors in fault location and demonstrate high accuracy and reliability under various complex fault modes. Therefore, the innovation of this application lies in introducing a multi-level correlation and spatiotemporal weighting mechanism, enabling fault diagnosis and location not only based on current fault information but also fully utilizing historical data feedback for adjustments, thereby better adapting to the dynamic operating environment and complex fault scenarios of the power system.

[0005] Firstly, this application provides a method for secondary equipment fault diagnosis and location based on correlation analysis, the method comprising:

[0006] Step S1: Obtain the topology connection relationship of secondary equipment. Based on the topology weight, alarm time difference, system operating status and historical feedback factor, calculate the dynamic spatiotemporal correlation weight through the double exponential decay model and construct the dynamic spatiotemporal correlation graph.

[0007] Step S2: Set up fast window, medium window and slow window, collect alarm information respectively, and generate corresponding fast alarm sequence, medium alarm sequence and slow alarm sequence;

[0008] Step S3: Map the fast alarm sequence, medium alarm sequence and slow alarm sequence to the device nodes of the dynamic spatiotemporal correlation graph, calculate the correlation strength between nodes based on the dynamic spatiotemporal correlation weight, and obtain the fast correlation subgraph, medium correlation subgraph and slow correlation subgraph.

[0009] Step S4: Based on the graph propagation algorithm with attention weights, perform probability iteration calculations on the fast, medium, and slow correlation subgraphs to obtain the probability distributions of fast, medium, and slow fault sources, respectively.

[0010] Step S5: Calculate the window confidence level based on the number of alarms and alarm level in each window, perform weighted fusion on the probability distribution of fast fault sources, medium-speed fault sources and slow fault sources, and output the fault source location result.

[0011] Secondly, this application provides a secondary equipment fault diagnosis and location system based on correlation analysis, the secondary equipment fault diagnosis and location system based on correlation analysis comprising:

[0012] The acquisition module is used to acquire the topology connection relationship of secondary devices. Based on the topology weight, alarm time difference, system operating status and historical feedback factors, it calculates the dynamic spatiotemporal correlation weight through a double exponential decay model and constructs a dynamic spatiotemporal correlation graph.

[0013] The data acquisition module is used to set fast, medium, and slow windows to collect alarm information and generate corresponding fast, medium, and slow alarm sequences.

[0014] The calculation module is used to map the fast alarm sequence, medium alarm sequence and slow alarm sequence to the device nodes of the dynamic spatiotemporal correlation graph, calculate the correlation strength between nodes based on the dynamic spatiotemporal correlation weight, and obtain the fast correlation subgraph, medium correlation subgraph and slow correlation subgraph.

[0015] The iterative module is used to perform probability iterative calculations on the fast, medium, and slow association subgraphs based on a graph propagation algorithm with attention weights, to obtain the probability distributions of fast, medium, and slow fault sources, respectively.

[0016] The location module is used to calculate the window confidence level based on the number and level of alarms in each window, perform weighted fusion of the probability distributions of fast, medium and slow fault sources, and output the fault source location result.

[0017] Thirdly, a secondary equipment fault diagnosis and location device based on correlation analysis is provided, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor invokes the instructions in the memory to cause the secondary equipment fault diagnosis and location device based on correlation analysis to execute the aforementioned secondary equipment fault diagnosis and location method based on correlation analysis.

[0018] Fourthly, a computer-readable storage medium is provided, wherein instructions are stored therein, which, when executed on a computer, cause the computer to perform the aforementioned method for secondary equipment fault diagnosis and location based on correlation analysis.

[0019] The technical solution provided in this application uses secondary equipment topology as the framework and constructs a dynamic spatiotemporal correlation graph through a double exponential decay model using topology weights, alarm time differences, system operating status, and historical feedback factors. This ensures that the correlation between devices is constrained by physical / logical connections, temporal coupling, and operating background, reducing interference and offset of occasional alarms on the positioning link from the source. It facilitates the separation of the true causal chain from simultaneity / proximity, thus enabling subsequent calculations to be based on an "interpretable, condition-adaptive" graphical model. Three time windows (fast, medium, and slow) are designed in parallel on the acquisition side to separately encode alarms of different rhythms, such as millisecond-level protection / switch tripping, hundred-millisecond-level telemetry / telecommunication, and second-level communication / temperature, forming a multi-granular, ordered alarm sequence. This allows rapid disturbances and slow evolutions to be properly positioned, avoiding miscorrelation caused by mismatch of a single time scale. Subsequently, the three types of sequences are mapped to device nodes, and the correlation strength between nodes is calculated by combining dynamic spatiotemporal weights. Corresponding correlation subgraphs are constructed, and elements such as alarm level and type correlation matrix are incorporated into the strength calculation, making the edge retention / sparserization closer to the real linkage relationship of the secondary system. On the inference side, graph propagation with attention weights is introduced for probabilistic iteration. It utilizes both adjacency strength and out-degree weights for robust diffusion and alarm type / time / device type similarity to weight the propagation channel, improving the ability to distinguish between cases of the same cause but different tables and cases of the same table but different causes, resulting in three sets of fault source probability distributions with consistent rhythms and complementarity. Finally, the three sets of distributions are weighted and fused according to the credibility of each window and corrected by historical accuracy to output the location result. This avoids the one-sidedness of a certain window's occasional dominance and also settles the consistent performance of the device as prior modulation, so that the overall location decision has both current on-site evidence and historical stability. The above links are interdependent: from graph construction to multi-scale acquisition, to correlation and propagation, and then to credibility fusion and historical modulation.

[0020] The dynamic spatiotemporal correlation graph unifies device-time-operating condition-history onto computable graph weights, providing structural priors for subsequent learning / reasoning. The three-window mechanism separates evidence from different dynamic rhythms and unifies attribution at the end, which is beneficial for online streaming processing and also facilitates modeling of uncertainties at different time scales. The combination of correlation strength and attention propagation upgrades graph reasoning from anonymous diffusion to similarity-based optimal propagation, which is naturally compatible with graph learning / GNN-like methods or rule-based graph iterative reasoning, and is also friendly to hybrid architectures (rule framework + lightweight learning). The two-level weighting of "window credibility + historical accuracy" provides an interpretable fusion interface and robust priors for any upper-level algorithm (such as MPC-style derivation strategy, Bayesian posterior correction or online calibrator), so that the model is not biased by single alarm noise and can precipitate the long-term performance of the device as a credible bonus. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of an embodiment of the secondary equipment fault diagnosis and location method based on correlation analysis in this application.

[0023] Figure 2 This is a schematic diagram of an embodiment of the secondary equipment fault diagnosis and location system based on correlation analysis in this application.

[0024] Figure 3 This is a schematic block diagram of the secondary equipment fault diagnosis and location device based on correlation analysis in an embodiment of the present invention. Detailed Implementation

[0025] This application provides a method and system for secondary equipment fault diagnosis and location based on correlation analysis. The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0026] For ease of understanding, the specific process of the embodiments of this application is described below. Please refer to [link / reference]. Figure 1 One embodiment of the secondary equipment fault diagnosis and location method based on correlation analysis in this application includes:

[0027] Step S1: Obtain the topology connection relationship of secondary equipment. Based on the topology weight, alarm time difference, system operating status and historical feedback factor, calculate the dynamic spatiotemporal correlation weight through the double exponential decay model and construct the dynamic spatiotemporal correlation graph.

[0028] Step S2: Set up fast window, medium window and slow window, collect alarm information respectively, and generate corresponding fast alarm sequence, medium alarm sequence and slow alarm sequence;

[0029] Step S3: Map the fast alarm sequence, medium alarm sequence and slow alarm sequence to the device nodes of the dynamic spatiotemporal correlation graph, calculate the correlation strength between nodes based on the dynamic spatiotemporal correlation weight, and obtain the fast correlation subgraph, medium correlation subgraph and slow correlation subgraph.

[0030] Step S4: Based on the graph propagation algorithm with attention weights, perform probability iteration calculations on the fast, medium, and slow correlation subgraphs to obtain the probability distributions of fast, medium, and slow fault sources, respectively.

[0031] Step S5: Calculate the window confidence level based on the number of alarms and alarm level in each window, perform weighted fusion of the probability distributions of fast fault sources, medium-speed fault sources and slow fault sources, and output the fault source location result.

[0032] It is understood that the executing entity of this application can be a secondary equipment fault diagnosis and location system based on correlation analysis, or it can be a terminal or a server; the specific implementation is not limited here. This application's embodiment uses a server as an example for illustration.

[0033] Specifically, the topological connections between all secondary equipment in the power system are collected, including the physical connections and logical relationships between protection devices, measurement and control devices, communication equipment, and remote control devices. The connection types between devices are determined based on the secondary circuit wiring diagram. Direct electrical connections are assigned a topological weight of 1.0, communication connections 0.8, and logical relationships 0.6, establishing a secondary equipment topology graph containing a set of device nodes and a set of connection edges. Next, the dynamic spatiotemporal association weight is calculated, consisting of four components. The time decay function is calculated using a double exponential decay model, which includes a fast component and a slow component. The time constant of the fast component is set to 50 milliseconds to capture the propagation of rapid faults such as protection actions, while the time constant of the slow component is set to 2 seconds to capture the propagation of slow faults such as communication degradation. The time decay function value is obtained by a weighted combination of the fast component weight coefficient and the slow component weight coefficient. The calculation of the state modulation function requires obtaining the current system operating state. The topology state vector records the switch positions of each circuit breaker, the load level vector records the load rate of each feeder, and the equipment maintenance state vector records the equipment's service life and historical fault count. When the electrical path between devices is connected under the current topology, the state modulation function takes the base value plus the adjustment amount for load and maintenance status; when disconnected, it takes the smaller value. The historical feedback factor is calculated based on the accurate contribution rate of the connection edge in past fault diagnosis, with an initial value set to 0.5. The dynamic spatiotemporal correlation weight is obtained by multiplying the topology weight, time decay function, state modulation function, and historical feedback factor. This weight is then used to assign a weight value to each connection edge to construct a dynamic spatiotemporal correlation graph. Taking a substation secondary system as an example, there is a direct electrical connection between protection device A and switch B, so the topology weight is 1.0. In a certain fault, A sends a protection action signal at time T1, and B sends a switch trip signal at time T2. The alarm time difference is T2 minus T1. Substituting this time difference into the double exponential decay model, the time decay function value is calculated. The current system topology shows that the electrical path between A and B is connected and the load rate of this feeder is high. At the same time, equipment A has been in operation for a long time. Substituting these parameters into the state modulation function, the modulation value is calculated. The accurate contribution rate of this connection edge in historical diagnosis is obtained by querying the historical database. The above four components are multiplied to obtain the dynamic spatiotemporal correlation weight between A and B. All equipment pairs are traversed to complete the construction of the entire dynamic spatiotemporal correlation graph.

[0034] Alarm information at different time scales is collected by setting three parallel time windows. The fast window has a window length of 100 milliseconds and a sampling interval of 10 milliseconds. This window specifically collects protection device action signals, switch position change signals, and fault recording start signals, which are millisecond-level fast fault events. The medium-speed window has a window length of 1 second and a sampling interval of 100 milliseconds. It collects telemetry over-limit alarms, remote signaling change signals, and device self-test anomaly signals, which are hundred-millisecond-level medium-speed fault events. The slow window has a window length of 10 seconds and a sampling interval of 1 second. It collects communication delay alarms, equipment temperature alarms, and memory alarms, which represent second-level slow fault evolution processes. The three windows run in parallel using independent threads. Each window maintains an independent alarm sequence queue, and the alarm information collected within the window is sorted according to timestamps to generate an ordered alarm sequence. Alarm information is uniformly formatted as alarm data tuples containing device identifier, alarm type, alarm time, and alarm level. Alarm weight coefficients are assigned according to the alarm level: 1.0 for emergency level, 0.7 for important level, and 0.4 for general level. Taking a fault scenario as an example, within 100 milliseconds starting at time T0, the fast window collects alarm data: protection device C issues a protection action signal at time T0 + 3 milliseconds, marked as emergency level; switch D issues a position change signal at time T0 + 8 milliseconds, marked as emergency level; and fault recording device E issues a start signal at time T0 + 5 milliseconds, marked as important level. These three alarms are sorted by timestamp to form a fast alarm sequence, formatted as alarm data tuples containing device identifier C with a weight coefficient of 1.0, alarm data tuples containing device identifier D with a weight coefficient of 1.0, and alarm data tuples containing device identifier E with a weight coefficient of 0.7. The medium-speed window collects medium-speed signals such as telemetry over-limit alarms and remote signaling change signals within 1 second under the same fault scenario, while the slow-speed window collects slow signals such as communication delay alarms within 10 seconds, generating medium-speed alarm sequences and slow-speed alarm sequences respectively.

[0035] Alarm data tuples from fast, medium, and slow alarm sequences are mapped to corresponding device nodes in a dynamic spatiotemporal correlation graph. Each device identifier in the alarm data tuple corresponds to a node in the graph. The correlation strength between nodes is calculated based on the dynamic spatiotemporal correlation weight and alarm weight coefficient. The correlation strength is calculated by multiplying the dynamic spatiotemporal correlation weight between two device nodes by the alarm weight coefficients of the two nodes, and then multiplying by the alarm type correlation coefficient. The alarm type correlation coefficient is obtained by querying a preset alarm type correlation matrix, which records the degree of correlation between different alarm types. The correlation coefficient between protection action and circuit breaker tripping is 0.95, and the correlation coefficient between protection action and communication interruption is 0.3. The correlation strength matrix is ​​obtained by traversing and calculating, where each element represents the degree of correlation between two device nodes. The correlation strength matrix is ​​sparsified, retaining node connections with correlation strength greater than a preset threshold. The threshold for the fast window is set to 0.4, the threshold for the medium window to 0.3, and the threshold for the slow window to 0.2, forming fast, medium, and slow correlation subgraphs respectively. Taking the aforementioned fault scenario as an example, after the alarms of protection device C and switch D are mapped to the dynamic spatiotemporal correlation graph, the dynamic spatiotemporal correlation weight value between C and D is queried. This weight value is multiplied by the alarm weight coefficients of C (1.0) and D (1.0), and then multiplied by the correlation coefficient of protection action and switch tripping (0.95) to obtain the correlation strength value between C and D. This value is compared with the fast window threshold of 0.4. If it is greater than the threshold, the connection edge between C and D is retained in the fast correlation subgraph. The fast correlation subgraph is constructed by traversing all device node pairs in the fast alarm sequence. The medium and slow correlation subgraphs are constructed in the same way.

[0036] The initial fault source probability is calculated based on the alarm weight coefficient of each device node. The normalized initial fault source probability is obtained by dividing the alarm weight coefficient of each node by the sum of the alarm weight coefficients of all nodes. Based on the association strength between device nodes and the out-degree weights of nodes in the fast association subgraph, the probability propagation value from neighboring nodes to the current node is calculated. All neighboring nodes of the current node are traversed to obtain the association strength from each neighboring node to the current node. The out-degree weights of each neighboring node are calculated, which is the sum of the association strengths from that neighboring node to all its neighboring nodes. The current fault source probability of each neighboring node is multiplied by its association strength to the current node and then divided by the out-degree weights of that neighboring node to obtain the single-node probability propagation value. The sum of the single-node probability propagation values ​​of all neighboring nodes is obtained to obtain the total probability propagation value. The alarm feature similarity between nodes is calculated based on alarm type, alarm time, and device type. The alarm feature similarity is calculated using the three-dimensional vector cosine similarity. Attention weights are calculated based on association strength and alarm feature similarity. The attention weights are obtained by softmax normalization of the product of association strength and alarm feature similarity. Attention weights are incorporated into the calculation of the probability propagation value. The total probability propagation value is obtained by multiplying the attention weights of each neighboring node with its current fault source probability and summing the results. The fault source probability of the current node is updated based on the preservation coefficient and the total probability propagation value. The initial fault source probability of the current node is multiplied by the preservation coefficient, and then the total probability propagation value is multiplied by the complement of the preservation coefficient. The two are added together to obtain the updated fault source probability of the current node. The preservation coefficient is set to 0.15. The fast association subgraph is iteratively updated in multiple rounds, with the number of iterations set to 10 rounds. The process terminates early when the maximum change in probability of all nodes in two adjacent rounds is less than 0.001, resulting in a fast fault source probability distribution. The top 5 device nodes with the highest probability values ​​are selected to form a candidate fault source node set. The same probability iteration calculation method is used to process the medium-speed association subgraph and the slow-speed association subgraph respectively, resulting in the medium-speed fault source probability distribution and the slow-speed fault source probability distribution, as well as the corresponding candidate fault source node set.Taking the aforementioned fast correlation subgraph as an example, the initial fault source probability of protection device C is calculated by dividing its alarm weight coefficient of 1.0 by the sum of the alarm weight coefficients of all nodes. C's neighboring nodes include switch D and waveform recorder E. The correlation strength value of D pointing to C has been calculated in step S3. The out-degree weight sum of D is the sum of the correlation strengths of D pointing to all its neighboring nodes. Multiplying the current fault source probability of D by the correlation strength of D pointing to C and then dividing by the out-degree weight sum of D, we obtain the single-node probability propagation value of D propagating to C. Similarly, we calculate the single-node probability propagation value of E propagating to C. The sum of the two yields the total probability propagation value of C. The alarm feature similarity between C and D is obtained by comparing the protection action alarm type of C with the switch trip alarm type of D and the alarm time of C. The vector cosine similarity is calculated based on three dimensions: the time difference between T0 + 3 milliseconds and the alarm time T0 + 8 milliseconds of D, the protection device type of C and the switching device type of D. The attention weight is calculated based on the correlation strength between C and D and the alarm feature similarity. The attention weight of D is multiplied by the current fault source probability of D. The calculation method for E is the same. The sum of the two is used to obtain the total probability propagation value after introducing the attention weight. The initial fault source probability of C is multiplied by the holding coefficient 0.15. Then the total probability propagation value is multiplied by the complement of the holding coefficient 0.85. The sum of the two is used to obtain the fault source probability of C updated after the first round of iteration. The iteration continues in subsequent rounds until the termination condition is met. All nodes are traversed to complete the calculation of the fast fault source probability distribution.

[0037] Window confidence is calculated based on the number and level of alarms in the fast, medium, and slow windows. The fast window confidence is calculated by multiplying the number of alarms in the fast window by the average alarm level. The medium and slow window confidence are calculated in the same way. The sum of the three window confidences is used as the normalized denominator, and each is divided by this denominator to obtain the normalized fast, medium, and slow window confidences. The probability distributions of fast, medium, and slow fault sources are weighted and fused based on these three window confidences. For a device node that appears in multiple candidate fault source node sets simultaneously, its probability value in the fast fault source probability distribution is multiplied by its fast window confidence, plus its probability value in the medium fault source probability distribution multiplied by its medium window confidence, and finally its probability value in the slow fault source probability distribution multiplied by its slow window confidence, to obtain the global fault source probability of that node. The global fault source probability is corrected based on the accuracy of device nodes as actual fault sources in historical fault diagnosis records. The accuracy of a node as an actual fault source in historical diagnosis records is queried. The global fault source probability is multiplied by the base weight 0.7 plus the product of the accuracy and modulation weight 0.3 to obtain the final fault source probability. If a node has no historical records, the accuracy is defaulted to 0.5. The final fault source probabilities are sorted from highest to lowest value, and the fault source location results are output. Taking the aforementioned fault scenario as an example, the fast window collects 3 alarms, including 2 emergency level and 1 important level. The average alarm level is calculated by multiplying the emergency level weight coefficient 1.0 by 2, adding the important level weight coefficient 0.7, and then dividing by 3. The fast window confidence is the product of the number of alarms (3) and the average alarm level. The medium-speed and slow-speed windows use the same method to calculate confidence. After summing the three, each is divided by the sum to complete normalization. Protection device C appears in both the fast and medium-speed candidate fault source node sets. The probability distribution of C in the fast fault source probability distribution is then calculated. The probability value is multiplied by the normalized fast window confidence level, and then multiplied by the probability value of C in the medium-speed fault source probability distribution and the normalized medium-speed window confidence level to obtain the global fault source probability of C. The accuracy of C as the true fault source is obtained by querying historical diagnostic records. The global fault source probability of C is multiplied by the base weight 0.7 and the product of the accuracy and the modulation weight 0.3 to obtain the final fault source probability of C. The final fault source probability is calculated by traversing all candidate nodes. The fault source location result is output after sorting the probability values ​​from high to low.

[0038] In one specific embodiment, step S1 includes:

[0039] Collect the physical connections and logical relationships between protection devices, measurement and control devices, communication equipment and remote control devices in the power system, establish a secondary equipment topology graph containing a set of equipment nodes and a set of connection edges, and assign corresponding topology weights to the connection edges according to direct electrical connections, communication connections and logical relationships;

[0040] Based on the alarm time difference, a time decay function is calculated using a double exponential decay model. The time decay function includes a fast component and a slow component. The time constant of the fast component is set to 50 milliseconds, and the time constant of the slow component is set to 2 seconds.

[0041] Based on the topology state vector, load level vector and equipment maintenance state vector in the current system operation status, calculate the state modulation function. The topology state vector records the switch position of each circuit breaker, the load level vector records the load rate of each feeder, and the equipment maintenance state vector records the equipment operating years and the number of historical faults.

[0042] The dynamic spatiotemporal correlation weight is obtained by multiplying the topology weight, time decay function, state modulation function and historical feedback factor. Based on the dynamic spatiotemporal correlation weight, each connecting edge of the secondary device topology graph is assigned a weight value to construct the dynamic spatiotemporal correlation graph.

[0043] Specifically, the physical connections and logical relationships between protection devices, measurement and control devices, communication equipment, and remote control devices in the power system are collected. Physical connections refer to direct connections between devices via cables or optical fibers, while logical relationships refer to relationships formed between devices through communication protocols or functional cooperation. A secondary equipment topology graph is established, containing a set of device nodes and a set of connection edges. The set of device nodes records the identifiers and types of all secondary devices in the system, while the set of connection edges records the connection relationships and connection types between devices. Topology weights are assigned to connection edges based on direct electrical connections, communication connections, and logical relationships. A weight of 1.0 for a direct electrical connection indicates a strong physical relationship between devices; a weight of 0.8 for a communication connection indicates information transmission between devices via a network; and a weight of 0.6 for a logical relationship indicates functional cooperation between devices but no direct physical connection. The time decay function is calculated based on the alarm time difference using a double exponential decay model. The alarm time difference refers to the time interval between alarm signals issued by two devices. The double exponential decay model includes two exponential decay terms: a fast component and a slow component. The time constant of the fast component is set to 50 milliseconds to describe the decay law of the correlation strength over time during the rapid fault propagation process. The time constant of the slow component is set to 2 seconds to describe the decay law of the correlation strength over time during the slow fault evolution process. The sum of the weight coefficients of the fast component and the slow component is 1. The time decay function value is equal to the fast component weight coefficient multiplied by the exponential decay value of the fast component plus the slow component weight coefficient multiplied by the exponential decay value of the slow component. The exponential decay value of the fast component is equal to the negative alarm time difference of the natural constant divided by the power of the fast component time constant. The exponential decay value of the slow component is equal to the negative alarm time difference of the natural constant divided by the power of the slow component time constant. The state modulation function is calculated based on the topology state vector, load level vector, and equipment maintenance state vector in the current system operation status. The topology state vector records the switch positions of each circuit breaker, including both closed and open states. The load level vector records the load rate of each feeder, i.e., the ratio of the current load to the rated load. The equipment maintenance state vector records the equipment's service life and the number of historical faults. The calculation of the state modulation function requires determining whether the electrical path between the devices is connected under the current topology. When the electrical path between two devices is connected, the state modulation function takes the base value plus the product of the average load rate of the two devices and the load coefficient, plus the product of the average maintenance state of the two devices and the maintenance coefficient. When the electrical path is disconnected, the state modulation function takes a smaller fixed value. The dynamic spatiotemporal correlation weight is obtained by multiplying the topology weight, time decay function, state modulation function, and historical feedback factor. The historical feedback factor is calculated based on the accurate contribution rate of the connection edge in historical fault diagnosis, with a value range between 0 and 1. Based on the dynamic spatiotemporal correlation weight, a weight value is assigned to each connection edge of the secondary equipment topology graph to construct a dynamic spatiotemporal correlation graph.A substation has a direct electrical connection between its protection device and switchgear, therefore its topology weight is 1.0. In a fault, the time when the protection device sends an action signal is denoted as T1, and the time when the switchgear sends a trip signal is denoted as T2. The alarm time difference is equal to T2 minus T1. Substituting the alarm time difference into a double exponential decay model to calculate the time decay function, the fast component weight coefficient is 0.7, and the slow component weight coefficient is 0.3. The exponential decay value of the fast component is equal to the negative alarm time difference of the natural constant divided by 50 milliseconds, and the exponential decay value of the slow component is equal to the negative alarm time difference of the natural constant divided by 2 seconds. The time decay function value is equal to 0.7 multiplied by the exponential decay value of the fast component plus 0.3 multiplied by the exponential decay value of the slow component. The current system topology status shows that the circuit breaker between the protection device and the switchgear is in the closed position, indicating that the electrical path is connected. Querying the load horizontal vector yields the load rate of the feeder where the protection device is located and the load rate of the feeder where the switchgear is located. The average of the two is recorded as the load rate average. The equipment maintenance status vector is queried to obtain the operating years and historical fault counts of the protection device and the switching equipment. The operating years and historical fault counts are normalized and then averaged to obtain the maintenance status average. The status modulation function is equal to the base value 1.0 plus the product of the load rate average and the load coefficient 0.1 plus the product of the maintenance status average and the maintenance coefficient 0.05. The historical fault diagnosis database is queried to obtain the accurate contribution rate of the connection edge in past diagnoses, that is, the proportion of accurate diagnoses in the number of diagnoses in which the edge participated. The historical feedback factor is equal to 0.5 plus 0.5 multiplied by the accurate contribution rate. The topology weight 1.0, the time decay function value, the status modulation function value, and the historical feedback factor value are multiplied to obtain the dynamic spatiotemporal association weight of the connection edge between the protection device and the switching equipment. All connection edges in the secondary equipment topology graph are traversed to complete the construction of the dynamic spatiotemporal association graph.

[0044] In one specific embodiment, step S2 includes:

[0045] Set up a quick window to collect protection device action signals, switch position change signals and fault recording start signals through the quick window, and generate a quick alarm sequence according to the timestamp.

[0046] Set a medium-speed window, collect telemetry over-limit alarms, remote signaling change signals and device self-test abnormal signals through the medium-speed window, and generate a medium-speed alarm sequence according to the timestamp.

[0047] Set a slow window, collect communication delay alarms, device temperature alarms and memory alarms through the slow window, and generate a slow alarm sequence according to the timestamp.

[0048] The alarm information in the fast alarm sequence, medium alarm sequence, and slow alarm sequence is uniformly formatted into alarm data tuples containing device identifier, alarm type, alarm time, and alarm level. Alarm weight coefficients corresponding to emergency, important, and general are assigned according to the alarm level.

[0049] Specifically, a fast window is set up to collect protection device action signals, switch position change signals, and fault recording start signals. The window length of the fast window is set to 100 milliseconds, and the sampling interval is set to 10 milliseconds. The window length refers to the time range of a single acquisition, and the sampling interval refers to the time interval between two adjacent samples. The protection device action signal refers to the trip command signal issued by the protection device after detecting a fault. The switch position change signal refers to the state change signal of the circuit breaker or disconnector from the closed position to the open position or from the open position to the closed position. The fault recording start signal refers to the trigger signal of the fault recording device to start recording after detecting an electrical abnormality. The alarm information collected in the fast window is sorted according to the timestamp to generate a fast alarm sequence. The timestamp records the precise time of alarm information generation with millisecond accuracy. The sorting is based on the timestamp value from smallest to largest so that the alarm information in the fast alarm sequence is arranged in the order of occurrence time. A medium-speed window is set to collect telemetry over-limit alarms, remote signaling change signals, and device self-test anomaly signals. The window length of the medium-speed window is set to 1 second, and the sampling interval is set to 100 milliseconds. Telemetry over-limit alarms refer to alarm information generated when telemetry measurements such as voltage, current, and power exceed the set threshold range. Remote signaling change signals refer to signals generated when the status of remote signaling quantities such as switch position and disconnector position changes. Device self-test anomaly signals refer to alarm information generated when the internal self-test program of the secondary equipment detects hardware faults or software anomalies. The alarm information collected within the medium-speed window is sorted according to the timestamp to generate a medium-speed alarm sequence. A slow window is set up to collect communication delay alarms, device temperature alarms, and memory alarms. The window length of the slow window is set to 10 seconds and the sampling interval is set to 1 second. Communication delay alarms refer to alarm information generated when the communication response time between devices exceeds the normal range. Device temperature alarms refer to alarm information generated when the internal temperature of the device exceeds the safety threshold. Memory alarms refer to alarm information generated when the device's memory capacity is insufficient or when there are read / write errors. The alarm information collected within the slow window is sorted by timestamp to generate a slow alarm sequence. Alarm information in fast, medium, and slow alarm sequences is uniformly formatted into alarm data tuples containing device identifier, alarm type, alarm time, and alarm level. The device identifier uniquely identifies the secondary device that generated the alarm, including the device name and device number. The alarm type indicates the specific category of the alarm information, including types such as protection action switch displacement and telemetry limit exceedance. The alarm time records the precise time of alarm occurrence using a unified time format. The alarm level is divided into three levels: urgent, important, and general, based on the severity and urgency of the alarm information. Alarm weight coefficients are assigned to the alarm levels according to their respective priorities: an urgent level with a weight coefficient of 1.0 (highest priority), an important level with a weight coefficient of 0.7 (medium priority), and a general level with a weight coefficient of 0.4 (lower priority). The alarm weight coefficients are used as weighting factors in subsequent correlation analysis and probability calculations.When a short-circuit fault occurs at a substation, the fast alarm window collects data within 100 milliseconds starting at time T0. The protection device issues a protection action signal at time T0 + 3 milliseconds, the switchgear issues a position change signal at time T0 + 8 milliseconds, and the fault recording device issues a start signal at time T0 + 5 milliseconds. These three alarm messages are then sorted by timestamp, with the protection device alarm first at time T0 + 3 milliseconds, the fault recording device alarm second at time T0 + 5 milliseconds, and the switchgear alarm third at time T0 + 8 milliseconds, forming a fast alarm sequence. The protection device alarm is formatted as an alarm data tuple. The device identifier is protection device A, number 001. The alarm type is protection action. The alarm time is T0 + 3 milliseconds. The alarm level is emergency. Querying the alarm level, the corresponding alarm weight coefficient for emergency is 1.0. The fault recording device alarm is formatted as an alarm data tuple. The device identifier is recording device E, number 005. The alarm type is recording start. The alarm time is T0 + 5 milliseconds. The alarm level is important. Querying the alarm level, the corresponding alarm weight coefficient for important is 0.7. The switchgear alarm is formatted as an alarm data tuple. The alarm, identified as switch D, number 004, is a position change alarm. The alarm time is T0 + 8 milliseconds, and the alarm level is emergency. The query shows that the alarm weight coefficient for the emergency level is 1.0. Within 1 second of the same fault scenario, the medium-speed window collects data from the monitoring and control device, which issues a telemetry over-limit alarm at T0 + 150 milliseconds. The alarm level is important, formatted as an alarm data tuple, and assigned a weight coefficient of 0.7. The communication management unit issues a device self-test abnormal signal at T0 + 800 milliseconds, with a general alarm level, formatted as an alarm data tuple, and assigned a weight coefficient of 0.4. According to... The timestamp sorting generates a medium-speed alarm sequence. The slow-speed window collects communication delay alarms issued by communication devices within 10 seconds at time T0 plus 3 seconds. The alarm level is generally formatted as an alarm data tuple and assigned a weight coefficient of 0.4. The timestamp sorting generates a slow-speed alarm sequence. All alarm data tuples in the three alarm sequences contain four fields: device identifier, alarm type, alarm time, and alarm level, as well as the corresponding alarm weight coefficient. The unified data format ensures consistent data processing logic when mapping to the dynamic spatiotemporal correlation graph and calculating the correlation strength, and facilitates batch processing.

[0050] In one specific embodiment, step S3 includes:

[0051] The alarm data tuples in the fast alarm sequence, medium alarm sequence, and slow alarm sequence are mapped to the corresponding device nodes in the dynamic spatiotemporal correlation graph, respectively.

[0052] Based on the dynamic spatiotemporal correlation weight and alarm weight coefficient, the correlation strength between any two device nodes in the fast alarm sequence is calculated. The correlation strength is obtained by multiplying the dynamic spatiotemporal correlation weight by the alarm weight coefficient of the two nodes and the alarm type correlation coefficient.

[0053] The correlation strength matrices calculated for fast alarm sequences, medium alarm sequences, and slow alarm sequences are sparsified, and the node connection edges with correlation strength greater than a preset threshold are retained to form fast correlation subgraphs, medium correlation subgraphs, and slow correlation subgraphs, respectively.

[0054] Specifically, a fast window is set up to collect protection device action signals, switch position change signals, and fault recording start signals. The window length of the fast window is set to 100 milliseconds, and the sampling interval is set to 10 milliseconds. The window length refers to the time range of a single acquisition, and the sampling interval refers to the time interval between two adjacent samples. The protection device action signal refers to the trip command signal issued by the protection device after detecting a fault. The switch position change signal refers to the state change signal of the circuit breaker or disconnector from the closed position to the open position or from the open position to the closed position. The fault recording start signal refers to the trigger signal of the fault recording device to start recording after detecting an electrical abnormality. The alarm information collected in the fast window is sorted according to the timestamp to generate a fast alarm sequence. The timestamp records the precise time of alarm information generation with millisecond accuracy. The sorting is based on the timestamp value from smallest to largest so that the alarm information in the fast alarm sequence is arranged in the order of occurrence time. A medium-speed window is set to collect telemetry over-limit alarms, remote signaling change signals, and device self-test anomaly signals. The window length of the medium-speed window is set to 1 second, and the sampling interval is set to 100 milliseconds. Telemetry over-limit alarms refer to alarm information generated when telemetry measurements such as voltage, current, and power exceed the set threshold range. Remote signaling change signals refer to signals generated when the status of remote signaling quantities such as switch position and disconnector position changes. Device self-test anomaly signals refer to alarm information generated when the internal self-test program of the secondary equipment detects hardware faults or software anomalies. The alarm information collected within the medium-speed window is sorted according to the timestamp to generate a medium-speed alarm sequence. A slow window is set up to collect communication delay alarms, device temperature alarms, and memory alarms. The window length of the slow window is set to 10 seconds and the sampling interval is set to 1 second. Communication delay alarms refer to alarm information generated when the communication response time between devices exceeds the normal range. Device temperature alarms refer to alarm information generated when the internal temperature of the device exceeds the safety threshold. Memory alarms refer to alarm information generated when the device's memory capacity is insufficient or when there are read / write errors. The alarm information collected within the slow window is sorted by timestamp to generate a slow alarm sequence. Alarm information in fast, medium, and slow alarm sequences is uniformly formatted into alarm data tuples containing device identifier, alarm type, alarm time, and alarm level. The device identifier uniquely identifies the secondary device that generated the alarm, including the device name and device number. The alarm type indicates the specific category of the alarm information, including types such as protection action switch displacement and telemetry limit exceedance. The alarm time records the precise time of alarm occurrence using a unified time format. The alarm level is divided into three levels: urgent, important, and general, based on the severity and urgency of the alarm information. Alarm weight coefficients are assigned to the alarm levels according to their respective importance and generality. The urgent level is assigned a weight coefficient of 1.0, representing the highest priority; the important level is assigned a weight coefficient of 0.7, representing medium priority; and the general level is assigned a weight coefficient of 0.4, representing lower priority.When a short-circuit fault occurs in a substation, the fast alarm window collects data within 100 milliseconds starting at time T0. The protection device issues a protection action signal at time T0 + 3 milliseconds, the switchgear issues a position change signal at time T0 + 8 milliseconds, and the fault recording device issues a start signal at time T0 + 5 milliseconds. These three alarm messages are sorted by timestamp, with the protection device alarm first at time T0 + 3 milliseconds, the fault recording device alarm second at time T0 + 5 milliseconds, and the switchgear alarm third at time T0 + 8 milliseconds, forming a fast alarm sequence. The protection device alarm is formatted as an alarm data tuple, with device identifier A (number 001), alarm type "protection action," alarm time T0 + 3 milliseconds, and alarm level "emergency." The alarm weight coefficient corresponding to the alarm level "emergency" is 1.0. The fault recording device alarm is formatted as an alarm data tuple, with device identifier E (number 005), alarm type "recording start," and alarm time T0 + 5 milliseconds. The alarm level is "Important," and the corresponding alarm weight coefficient for "Important" is 0.7. The switchgear alarm is formatted as an alarm data tuple, with the device identifier being switch D number 004, the alarm type being "location change," and the alarm time being T0 + 8 milliseconds. The alarm level is "Emergency," and the corresponding alarm weight coefficient for "Emergency" is 1.0. In the medium-speed window, if the same fault scenario is detected within 1 second, the monitoring and control device issues a telemetry over-limit alarm at time T0 + 150 milliseconds. The alarm level is "Important," formatted as an alarm data tuple, and assigned a weight coefficient of 0.7. The communication management unit issues a device self-test abnormal signal at time T0 + 800 milliseconds. The alarm level is "General," formatted as an alarm data tuple, and assigned a weight coefficient of 0.4. A medium-speed alarm sequence is generated by sorting by timestamp. In the slow-speed window, if the communication device issues a communication delay alarm within 10 seconds, at time T0 + 3 seconds, the alarm level is "General," formatted as an alarm data tuple, and assigned a weight coefficient of 0.4. A slow-speed alarm sequence is generated by sorting by timestamp.

[0055] In one specific embodiment, step S4 includes:

[0056] Based on the alarm weight coefficients of each device node in the fast, medium, and slow correlation subgraphs, calculate the initial fault source probability of each device node.

[0057] Based on the association strength between device nodes and the out-degree weight of nodes in the fast association subgraph, the probability propagation value from neighboring nodes to the current node is calculated, and the fault source probability of the current node is updated according to the preservation coefficient and the probability propagation value.

[0058] The alarm feature similarity between nodes is calculated by alarm type, alarm time and device type. Attention weight is calculated based on association strength and alarm feature similarity. The attention weight is introduced into the calculation of probability propagation value. The fast association subgraph is iteratively updated in multiple rounds to obtain the fast fault source probability distribution.

[0059] The same probability iteration calculation method is used to process the medium-speed correlation subgraph and the slow-speed correlation subgraph respectively to obtain the probability distribution of medium-speed fault sources and the probability distribution of slow fault sources. The device node with the highest probability value is selected from each probability distribution to form the corresponding candidate fault source node set.

[0060] Specifically, the initial fault source probability of each device node is calculated based on the alarm weight coefficients of each device node in the fast, medium, and slow association subgraphs. The initial fault source probability is calculated by dividing the alarm weight coefficient of each device node by the sum of the alarm weight coefficients of all device nodes in the association subgraph and then normalizing it. The normalization process ensures that the sum of the initial fault source probabilities of all device nodes is equal to 1. The initial fault source probability reflects the likelihood of each device node being a fault source when only the alarm level is considered. Based on the association strength between device nodes and the out-degree weights of nodes in the fast association subgraph, the probability propagation value of neighbor nodes to the current node is calculated. All neighbor nodes of the current node are traversed to obtain the association strength of each neighbor node pointing to the current node. The out-degree weights of nodes refer to the sum of the association strengths of each neighbor node pointing to all its neighbor nodes. The current fault source probability of each neighbor node is multiplied by its association strength pointing to the current node and then divided by the out-degree weights of that neighbor node to obtain the single-node probability propagation value. The single-node probability propagation value represents the contribution of the fault source probability propagated from the neighbor node to the current node. The sum of the single-node probability propagation values ​​of all neighbor nodes is used to obtain the total probability propagation value of the current node. The fault source probability of the current node is updated according to the retention coefficient and the probability propagation value. The retention coefficient is set to 0.15, indicating the proportion of the node retaining its initial probability. The initial fault source probability of the current node is multiplied by the retention coefficient to obtain the retained portion. The total probability propagation value is then multiplied by the complement of the retention coefficient, which is 0.Multiplying by 85 yields the propagation part, and adding the retained part to the propagation part gives the updated fault source probability of the current node. The alarm feature similarity between nodes is calculated based on alarm type, alarm time, and device type. Alarm type similarity is determined by whether the alarm types of two nodes belong to the same or related categories. Alarm time similarity is calculated based on the absolute value of the alarm time difference between two nodes; the smaller the time difference, the higher the similarity. Device type similarity is determined by whether the device types of two nodes are the same or belong to related categories. The similarity of these three dimensions forms a feature vector, and the vector cosine similarity is calculated to obtain the alarm feature similarity. The vector cosine similarity is calculated by dividing the inner product of two feature vectors by the product of the magnitudes of the two vectors, and its value ranges from 0 to 1. Attention weights are calculated based on association strength and alarm feature similarity. The association strength is multiplied by the alarm feature similarity to obtain an initial attention score. The initial attention scores of all neighboring nodes are then subjected to softmax normalization to obtain the attention weights. Softmax normalization is achieved by taking the exponential function of each initial attention score and dividing by the sum of the exponential function values ​​of all neighboring nodes. The sum of the normalized attention weights equals 1, and each weight value is between 0 and 1. The attention weights reflect the importance of different neighboring nodes in contributing to the probability of the current node's fault source. These attention weights are then incorporated into the calculation of the probability propagation value. The attention weights of each neighboring node are multiplied by their current fault source probability and summed to obtain the total probability propagation value after incorporating the attention weights. This total probability propagation value replaces the previously calculated total probability propagation value based on the out-degree weights in the fault source probability update. The updated fault source probability of the current node is obtained by multiplying the initial fault source probability of the current node by the hold coefficient and adding the total probability propagation value after incorporating the attention weights by the complement of the hold coefficient. The fast association subgraph is iteratively updated in multiple rounds, with 10 rounds per round. In each round, all device nodes in the fast association subgraph are traversed, and the fault source probability of each node is updated in the manner described above. The iteration is terminated early when the maximum change in probability of all nodes in two adjacent rounds is less than 0.001. After the iteration is completed, the fast fault source probability distribution is obtained, which is the final fault source probability of each device node in the fast association subgraph. The same probability iteration calculation method is used to process the medium-speed association subgraph and the slow association subgraph. The initial fault source probability calculation, probability propagation value calculation, attention weight calculation, and multi-round iterative update process of the medium-speed association subgraph and the slow association subgraph are exactly the same as those of the fast association subgraph. The medium-speed fault source probability distribution and the slow fault source probability distribution are obtained respectively. The device node with the highest probability value is selected from each probability distribution to form the corresponding candidate fault source node set. Specifically, the top 5 device nodes are selected after sorting the fault source probabilities from high to low. In a short-circuit fault scenario at a substation, the fast correlation subgraph includes alarm weight coefficients of 1.0 for protection device A, 1.0 for switch D, and 0 for waveform recorder E.7. For the three device nodes, the initial fault source probability of protection device A is equal to its alarm weight coefficient 1.0 divided by the sum of the alarm weight coefficients of the three nodes, i.e., 1.0 + 1.0 + 0.7 equals 2.7. The calculated initial fault source probability of protection device A is approximately 0.37. The initial fault source probability of switch D is approximately 0.37, and the initial fault source probability of waveform recording device E is approximately 0.26. The neighboring nodes of protection device A include switch D and waveform recording device E. The association strength value of switch D pointing to protection device A has been calculated in step S3 and is denoted as RDA. The out-degree weight of switch D is equal to the sum of the association strengths of switch D pointing to all its neighboring nodes and is denoted as OutD. The current fault source probability of switch D, i.e., the initial fault source probability of 0.37, is then compared with the association strength... Multiplying the degree RDA and dividing by the out-degree weight and OutD yields the single-node probability propagation value of switch D propagating to protection device A. The single-node probability propagation value of waveform recording device E propagating to protection device A is calculated in the same way. Summing the two yields the total probability propagation value of protection device A. The alarm type of protection device A is protection action, the alarm type of switch D is position change, and the alarm type of waveform recording device E is waveform recording start. Protection action and position change are strongly correlated and have high alarm type similarity. Protection action and waveform recording start are moderately correlated and have moderate alarm type similarity. The alarm time of protection device A is T0 + 3 milliseconds, and the alarm time of switch D is T0 + 8 milliseconds, with a time difference of 5 milliseconds. The alarm time of protection device A and the alarm time of waveform recording device E... Adding 5 milliseconds to T0 results in a time difference of 2 milliseconds. Since a time difference of 2 milliseconds is less than a time difference of 5 milliseconds, the alarm time similarity between protection device A and recording device E is higher than that between protection device A and switch D. Protection device A is a protection device, switch D is a switch, and recording device E is a recording device. Although all three have different device types, the protection device and the switch are functionally closely integrated and have high device type similarity. The alarm type similarity, alarm time similarity, and device type similarity are used to construct feature vectors. The cosine similarity of the vectors between protection device A and switch D, and between protection device A and recording device E, is then calculated to obtain the alarm feature similarity. The correlation strength RDA between switch D and protection device A is then calculated. The initial attention score is obtained by multiplying the similarity of the corresponding alarm features. The initial attention score between the waveform recording device E and the protection device A is calculated in the same way. The two initial attention scores are subjected to softmax normalization to obtain the attention weight of switch D to protection device A and the attention weight of waveform recording device E to protection device A. The attention weight of switch D is multiplied by the current fault source probability of switch D, and then multiplied by the attention weight of waveform recording device E and the current fault source probability of waveform recording device E to obtain the total probability propagation value after introducing the attention weight. The initial fault source probability of protection device A, 0.37, is multiplied by the retention coefficient, 0.15, to obtain the retained part. The total probability propagation value after introducing the attention weight is multiplied by the complement of the retention coefficient, 0.Multiplying by 85 yields the propagated portion. Adding the retained portion to the propagated portion gives the updated fault source probability of protection device A after the first iteration. Similarly, the fault source probabilities of switch D and waveform recording device E are updated to complete the first iteration. Subsequent iterations continue until the termination condition is met. After iteration, a fast fault source probability distribution is obtained. The top 5 device nodes with the highest probability values ​​are selected to form a fast candidate fault source node set.

[0061] In one specific embodiment, based on the association strength between device nodes and the sum of node out-degree weights in the fast association subgraph, the probability propagation value from neighboring nodes to the current node is calculated. The fault source probability of the current node is then updated according to the preservation coefficient and the probability propagation value, including:

[0062] Traverse all neighboring nodes of the current node in the fast association subgraph and obtain the association strength of each neighboring node pointing to the current node;

[0063] Calculate the sum of out-degree weights for each neighboring node. The sum of out-degree weights is the sum of the association strengths from that neighboring node to all its neighboring nodes.

[0064] Multiply the current fault source probability of each neighboring node by the association strength pointing to the current node, and then divide by the sum of the out-degree weights of that neighboring node to obtain the single-node probability propagation value of each neighboring node to the current node. Sum the single-node probability propagation values ​​of all neighboring nodes to obtain the total probability propagation value of the current node.

[0065] Multiply the initial fault source probability of the current node by the hold coefficient, then multiply the total probability propagation value by the complement of the hold coefficient, and add the two together to obtain the updated fault source probability of the current node.

[0066] Specifically, the process involves traversing all neighboring nodes of the current node in the fast association subgraph to obtain the association strength of each neighboring node pointing to the current node. A neighboring node refers to a node in the fast association subgraph that has a connecting edge to the current node. The association strength pointing to the current node refers to the association strength value corresponding to the connecting edge from that neighboring node to the current node, which is the corresponding element value in the association strength matrix calculated in step S3. The traversal operation obtains a list of all neighboring nodes of the current node by querying the adjacency list or adjacency matrix of the fast association subgraph, and then reads the association strength value of each neighboring node pointing to the current node one by one. The out-degree weight sum of each neighboring node is calculated. The out-degree weight sum is the sum of the association strengths of each neighboring node pointing to all its neighboring nodes. The out-degree refers to the number of connecting edges that the neighboring node sends out in the fast association subgraph. The calculation of the out-degree weight sum requires traversing all neighboring nodes of the neighboring node, reading the association strength value of each neighboring node pointing to it, and then summing all the association strength values. The out-degree weight sum reflects the influence range of the neighboring node in the fast association subgraph, that is, the total strength of the fault information of the node propagating outward. The single-node probability propagation value is obtained by multiplying the current fault source probability of each neighbor node by its association strength to the current node, and then dividing by the sum of the out-degree weights of that neighbor node. The current fault source probability refers to the fault source probability value of that neighbor node in this iteration. In the first iteration, the initial fault source probability is used; in subsequent iterations, the updated fault source probability from the previous iteration is used. The single-node probability propagation value represents the increment of the fault source probability contributed by that neighbor node to the current node through its association edges. This value is affected by three factors: the fault source probability of the neighbor node itself, the association strength between the neighbor node and the current node, and the sum of the out-degree weights of the neighbor nodes. A stronger association strength indicates a closer association between the neighbor node and the current node, resulting in a larger propagation value. A larger sum of out-degree weights indicates that the neighbor node needs to allocate probabilities to more neighbor nodes, thus relatively reducing the probability propagated to the current node. The total probability propagation value of the current node is obtained by summing the single-node probability propagation values ​​of all neighbor nodes. The total probability propagation value is the sum of the fault source probability contributions received by the current node from all neighbor nodes. The summation operation iterates through all the current node's neighbors, accumulating the single-node probability propagation value of each neighbor node.The updated fault source probability of the current node is obtained by multiplying the initial fault source probability of the current node by the retention coefficient, and then multiplying the total probability propagation value by the complement of the retention coefficient. The retention coefficient is set to 0.15, which means that the node retains its own initial probability during the update process. The complement of the retention coefficient is equal to 1 minus the retention coefficient, which is 0.85, representing the proportion of the probability propagated from neighboring nodes. Multiplying the initial fault source probability by the retention coefficient gives the retained part, which reflects the basic probability of the node itself as a fault source. Multiplying the total probability propagation value by the complement of the retention coefficient gives the propagated part, which reflects the contribution of neighboring nodes to the fault source probability of the current node. The updated fault source probability of the current node is obtained by adding the retained part and the propagated part, which comprehensively considers the node's own characteristics and the influence of neighboring nodes.In a short-circuit fault scenario at a substation, the fast correlation subgraph contains three device nodes: protection device A, switch D, and waveform recorder E. There are connecting edges between A and D, between D and E, and between A and E. The current node is selected as protection device A. Traversing the neighbor node list of protection device A yields two neighbor nodes: switch D and waveform recorder E. Querying the correlation strength matrix, the correlation strength from switch D to protection device A is obtained, denoted as RDA. This value is calculated in step S3 by multiplying the dynamic spatiotemporal correlation weight by the alarm weight coefficient, and then by the alarm type correlation coefficient. Querying the correlation strength matrix, the correlation strength from waveform recorder E to protection device A is obtained, denoted as REA. Switch D... The neighboring nodes include protection device A and waveform recording device E. Querying the association strength matrix yields the association strength RDA of switch D pointing to protection device A and the association strength RDE of switch D pointing to waveform recording device E. Adding RDA and RDE gives the out-degree weight of switch D, denoted as OutD. The neighboring nodes of waveform recording device E include protection device A and switch D. Querying the association strength matrix yields the association strength REA of waveform recording device E pointing to protection device A and the association strength RED of waveform recording device E pointing to switch D. Adding REA and RED gives the out-degree weight of waveform recording device E, denoted as OutE. The current fault source probability of switch D in this iteration is... Let PD be the initial fault source probability in the first iteration and the probability after the previous update in subsequent iterations. Multiply PD by RDA to get the intermediate value, then divide by OutD to get the single-node probability propagation value of switch D to protection device A, denoted as TransDA. Let PE be the current fault source probability of waveform recording device E in this iteration. Let PE be multiplied by REA to get the intermediate value, then divide by OutE to get the single-node probability propagation value of waveform recording device E to protection device A, denoted as TransEA. Let TransDA and TransEA be added to get the total probability propagation value of protection device A, denoted as TotalA. The initial probability of protection device A is... The fault source probability is denoted as P0A. This value is calculated by normalizing the alarm weight coefficient at the beginning of step S4. P0A is multiplied by the retention coefficient 0.15 to obtain the retained part, denoted as KeepA. TotalA is multiplied by the complement of the retention coefficient 0.85 to obtain the propagation part, denoted as PropA. KeepA and PropA are added together to obtain the updated fault source probability of protection device A, denoted as PAnew. This value is used as the current fault source probability of protection device A in the next iteration and continues to participate in the calculation. Similarly, the same probability update operation is performed on switch D and waveform recording device E to complete one iteration. The iteration continues in subsequent rounds until the termination condition is met.

[0067] In one specific embodiment, step S5 includes:

[0068] Based on the number and level of alarms in the fast window, medium window, and slow window, the confidence scores of the fast window, medium window, and slow window are calculated respectively, and the confidence scores of the three windows are normalized.

[0069] Based on the credibility of fast window, medium window, and slow window, the probability distributions of fast, medium, and slow fault sources are weighted and fused to obtain the global fault source probability.

[0070] Based on the accuracy of device nodes as actual fault sources in historical fault diagnosis records, the global fault source probability is corrected to obtain the final fault source probability.

[0071] Sort the final fault source probabilities from high to low and output the fault source location results.

[0072] Specifically, the reliability of the fast window, medium window, and slow window is calculated based on the number and level of alarms in the fast, medium, and slow windows, respectively. The number of alarms refers to the total number of alarm messages collected within the window, and the alarm level refers to the alarm weight coefficient corresponding to each alarm message. The reliability of the fast window is calculated by multiplying the number of alarms in the fast window by the average value of the alarm weight coefficients of all alarm messages within the fast window. The average value of the alarm weight coefficients is calculated by summing the alarm weight coefficients of all alarm messages within the fast window and then dividing by the number of alarms. The reliability of the medium and slow windows is calculated in the same way. The reliability of the three windows is then normalized by summing the reliability of the fast, medium, and slow windows to obtain a normalized denominator, and then dividing each window's reliability by the normalized denominator to obtain the normalized reliability of the fast, medium, and slow windows. The sum of the normalized reliability of the three windows equals 1. The global fault source probability is obtained by weighted fusion of the fast, medium, and slow fault source probability distributions based on the fast window confidence, medium window confidence, and slow window confidence. The weighted fusion is calculated separately for each device node. For a device node that appears in the fast, medium, and slow candidate fault source node sets simultaneously, the probability value of the node in the fast fault source probability distribution is multiplied by the normalized fast window confidence to obtain the fast component. The probability value of the node in the medium fault source probability distribution is multiplied by the normalized medium window confidence to obtain the medium component. The probability value of the node in the slow fault source probability distribution is multiplied by the normalized slow window confidence to obtain the slow component. The fast, medium, and slow components are added together to obtain the global fault source probability of the node. For a device node that appears only in a subset of the candidate fault source node sets, only the probability distribution of its appearance is multiplied by the corresponding window confidence and then weighted and summed. The final fault source probability is obtained by correcting the global fault source probability based on the accuracy of the device node as the actual fault source in historical fault diagnosis records. The accuracy refers to the proportion of times the device node was identified as a fault source in historical fault diagnosis and was indeed the actual fault source, out of the total number of times the node was identified as a fault source. The accuracy of the device node is obtained by querying the historical fault diagnosis database. If the node has no historical diagnosis records, the accuracy is set to 0.5 by default. The final fault source probability is obtained by multiplying the global fault source probability by the base weight of 0.7 and the product of the accuracy and the modulation weight of 0.3. The base weight of 0.7 represents the basic credibility of the current diagnosis result, and the modulation weight of 0.3 represents the modulation effect of the historical accuracy on the current diagnosis. The higher the accuracy, the better the historical diagnosis performance of the node, and the higher the final fault source probability. The lower the accuracy, the lower the final fault source probability.The final fault source probability is sorted from highest to lowest, and the fault source location results are output. The sorting operation traverses all device nodes in the candidate fault source node set and sorts them in descending order according to the final fault source probability. The device node with the highest probability after sorting is most likely to be the actual fault source. In a short-circuit fault scenario in a substation, the fast window collects three alarms: protection device A (alarm weight coefficient 1.0), switch D (alarm weight coefficient 1.0), and waveform recorder E (alarm weight coefficient 0.7). The fast window has 3 alarms, and the sum of the alarm weight coefficients within the fast window is equal to 1.0 plus 1.0 plus 0.7. The average alarm weight coefficient is equal to the sum of the alarm weight coefficients divided by the number of alarms (3). The fast window confidence is equal to the product of the number of alarms (3) and the average alarm weight coefficient. The medium-speed window collects two alarms: a measurement and control device (alarm weight coefficient 0.7) and a communication management unit (alarm weight coefficient 0.4). The medium-speed window has 2 alarms, and the sum of the alarm weight coefficients within the medium-speed window is equal to the sum of the alarm weight coefficients divided by the number of alarms (3). The sum equals 0.7 plus 0.4. The average alarm weight coefficient equals the sum of the alarm weight coefficients divided by the number of alarms (2). The reliability of the medium-speed window equals the product of the number of alarms (2) and the average alarm weight coefficient. The slow-speed window collected one alarm with an alarm weight coefficient of 0.4 from the communication equipment. The reliability of the slow-speed window equals the product of the number of alarms (1) and the alarm weight coefficient of 0.4. The reliability of the fast-speed window, medium-speed window, and slow-speed window is summed to obtain the normalized denominator. The normalized reliability of the fast-speed window equals the reliability of the fast-speed window divided by the normalized denominator. The reliability of the medium-speed window and the reliability of the slow-speed window are calculated in the same way. Protection device A simultaneously appears... In the sets of fast and medium-speed candidate fault source nodes, the probability value of protection device A is obtained by querying the probability distribution of fast fault sources, denoted as ProbfastA. This value is calculated iteratively using the graph propagation algorithm in step S4. The probability value of protection device A is obtained by querying the probability distribution of medium-speed fault sources, denoted as ProbmediumA. ProbfastA is multiplied by the normalized fast window confidence level to obtain the fast component. ProbmediumA is multiplied by the normalized medium-speed window confidence level to obtain the medium-speed component. The fast component and the medium-speed component are added together to obtain the global fault source probability of protection device A, denoted as GlobalA. This global probability is obtained by querying the historical fault diagnosis database. The total number of times protection device A was identified as a fault source in historical diagnostics, and the number of times it was accurately diagnosed, are calculated. The accuracy rate, denoted as AccA, is obtained by dividing the number of accurate diagnoses by the total number of diagnoses. The base weight of 0.7 is multiplied by the accuracy rate AccA and the modulation weight of 0.3, and then added to obtain the correction coefficient. The global fault source probability GlobalA is multiplied by the correction coefficient to obtain the final fault source probability of protection device A, denoted as FinalA. Similarly, the final fault source probabilities of other candidate nodes, such as switch D and waveform recorder E, are calculated. All candidate nodes are traversed and sorted in descending order of final fault source probability. After sorting, the fault source location result is output, that is, the device node with the highest final fault source probability is identified as the fault source.

[0073] The above describes the secondary equipment fault diagnosis and location method based on correlation analysis in the embodiments of this application. The following describes the secondary equipment fault diagnosis and location system based on correlation analysis in the embodiments of this application. Please refer to [link to relevant documentation]. Figure 2 One embodiment of the secondary equipment fault diagnosis and location system based on correlation analysis in this application includes:

[0074] The acquisition module is used to acquire the topology connection relationship of secondary devices. Based on the topology weight, alarm time difference, system operating status and historical feedback factors, it calculates the dynamic spatiotemporal correlation weight through a double exponential decay model and constructs a dynamic spatiotemporal correlation graph.

[0075] The data acquisition module is used to set fast, medium, and slow windows to collect alarm information and generate corresponding fast, medium, and slow alarm sequences.

[0076] The calculation module is used to map the fast alarm sequence, medium alarm sequence and slow alarm sequence to the device nodes of the dynamic spatiotemporal correlation graph, calculate the correlation strength between nodes based on the dynamic spatiotemporal correlation weight, and obtain the fast correlation subgraph, medium correlation subgraph and slow correlation subgraph.

[0077] The iterative module is used to perform probability iterative calculations on the fast, medium, and slow association subgraphs based on a graph propagation algorithm with attention weights, to obtain the probability distributions of fast, medium, and slow fault sources, respectively.

[0078] The location module is used to calculate the window confidence level based on the number and level of alarms in each window, perform weighted fusion of the probability distributions of fast, medium and slow fault sources, and output the fault source location result.

[0079] above Figure 2 The secondary equipment fault diagnosis and location system based on correlation analysis in this embodiment of the invention will be described in detail from the perspective of modular functional entities. The secondary equipment fault diagnosis and location device based on correlation analysis in this embodiment of the invention will be described in detail from the perspective of hardware processing.

[0080] Reference Figure 3 This invention also provides a secondary equipment fault diagnosis and location device based on correlation analysis. This device can be a server, and its internal structure can be as follows: Figure 3As shown, the secondary equipment fault diagnosis and location device based on correlation analysis includes a processor, memory, display screen, input device, network interface, and database connected via a system bus. The processor in this computer design provides computing and control capabilities. The memory of the secondary equipment fault diagnosis and location device based on correlation analysis includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the secondary equipment fault diagnosis and location device based on correlation analysis is used to store the data corresponding to this embodiment. The network interface of the secondary equipment fault diagnosis and location device based on correlation analysis is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements the above-described method.

[0081] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present invention and does not constitute a limitation on the secondary equipment fault diagnosis and location device based on correlation analysis to which the present invention is applied.

[0082] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when the instructions are executed on a computer, cause the computer to perform the steps of the secondary equipment fault diagnosis and location method based on correlation analysis.

[0083] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0084] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a secondary equipment fault diagnosis and location device based on correlation analysis (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0085] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for secondary equipment fault diagnosis and location based on correlation analysis, characterized in that, The method includes: Step S1: Obtain the secondary equipment topology connection relationship. Based on the topology weight, alarm time difference, system operating status, and historical feedback factors, calculate the dynamic spatiotemporal correlation weight using a double exponential decay model, and construct a dynamic spatiotemporal correlation graph. This includes: collecting the physical connections and logical correlations between protection devices, measurement and control devices, communication equipment, and remote control devices in the power system; establishing a secondary equipment topology graph containing a set of device nodes and a set of connection edges; assigning topology weights to the connection edges according to direct electrical connections, communication connections, and logical correlations; and calculating the time decay function based on the alarm time difference using a double exponential decay model. The time decay function includes a fast component and a slow component, with the time constant of the fast component set to 50 milliseconds. The time constant of the slow component is set to 2 seconds; a state modulation function is calculated based on the topology state vector, load level vector, and equipment maintenance state vector in the current system operating state. The topology state vector records the switch position of each circuit breaker, the load level vector records the load rate of each feeder, and the equipment maintenance state vector records the equipment operating years and the number of historical faults; the historical feedback factor is calculated based on the accurate contribution rate of the connecting edge in past fault diagnosis; the topology weight, time decay function, state modulation function, and historical feedback factor are multiplied to obtain the dynamic spatiotemporal correlation weight; based on the dynamic spatiotemporal correlation weight, a weight value is assigned to each connecting edge of the secondary equipment topology graph to construct the dynamic spatiotemporal correlation graph; Step S2: Set up fast window, medium window and slow window, collect alarm information respectively, and generate corresponding fast alarm sequence, medium alarm sequence and slow alarm sequence; Step S3: Map the fast alarm sequence, medium alarm sequence and slow alarm sequence to the device nodes of the dynamic spatiotemporal correlation graph, calculate the correlation strength between nodes based on the dynamic spatiotemporal correlation weight, and obtain the fast correlation subgraph, medium correlation subgraph and slow correlation subgraph. Step S4: Based on the graph propagation algorithm with attention weights, perform probability iteration calculations on the fast, medium, and slow correlation subgraphs to obtain the probability distributions of fast, medium, and slow fault sources, respectively. Step S5: Calculate the window confidence level based on the number of alarms and alarm level in each window, perform weighted fusion on the probability distribution of fast fault sources, medium-speed fault sources and slow fault sources, and output the fault source location result.

2. The method for secondary equipment fault diagnosis and location based on correlation analysis according to claim 1, characterized in that, Step S2 includes: The fast window is set up to collect protection device action signals, switch position change signals and fault recording start signals through the fast window, and generate the fast alarm sequence according to the timestamp. The medium-speed window is set up, and telemetry over-limit alarms, remote signaling change signals and device self-test abnormal signals are collected through the medium-speed window. The medium-speed alarm sequence is generated by sorting the signals according to the timestamps. The slow window is set up, and communication delay alarms, device temperature alarms and memory alarms are collected through the slow window. The slow alarm sequence is generated by sorting the alarms according to their timestamps. The alarm information in the fast alarm sequence, medium alarm sequence and slow alarm sequence is uniformly formatted into alarm data tuples containing device identifier, alarm type, alarm time and alarm level, and alarm weight coefficients corresponding to emergency, important and general are assigned according to the alarm level.

3. The method for secondary equipment fault diagnosis and location based on correlation analysis according to claim 1, characterized in that, Step S3 includes: The alarm data tuples in the fast alarm sequence, medium alarm sequence, and slow alarm sequence are respectively mapped to the corresponding device nodes in the dynamic spatiotemporal correlation graph; Based on the dynamic spatiotemporal correlation weight and alarm weight coefficient, the correlation strength between any two device nodes in the fast alarm sequence is calculated. The correlation strength is obtained by multiplying the dynamic spatiotemporal correlation weight by the alarm weight coefficient of the two nodes and the alarm type correlation coefficient. The correlation strength matrices calculated for the fast alarm sequence, medium alarm sequence, and slow alarm sequence are sparsified, and the node connection edges with correlation strength greater than a preset threshold are retained to form the fast correlation subgraph, medium correlation subgraph, and slow correlation subgraph, respectively.

4. The method for secondary equipment fault diagnosis and location based on correlation analysis according to claim 1, characterized in that, Step S4 includes: Based on the alarm weight coefficients of each device node in the fast association subgraph, medium-speed association subgraph, and slow association subgraph, the initial fault source probability of each device node is calculated. Based on the association strength between device nodes and the out-degree weight of the nodes in the fast association subgraph, the probability propagation value from neighboring nodes to the current node is calculated, and the fault source probability of the current node is updated according to the preservation coefficient and the probability propagation value. The alarm feature similarity between nodes is calculated by alarm type, alarm time and device type. Attention weight is calculated based on the association strength and alarm feature similarity. The attention weight is introduced into the calculation of the probability propagation value. The fast association subgraph is iteratively updated in multiple rounds to obtain the fast fault source probability distribution. The medium-speed correlation subgraph and the slow-speed correlation subgraph are processed using the same probability iteration calculation method to obtain the probability distribution of medium-speed fault sources and the probability distribution of slow fault sources. The device node with the highest probability value is selected from each probability distribution to form the corresponding candidate fault source node set.

5. The method for secondary equipment fault diagnosis and location based on correlation analysis according to claim 4, characterized in that, The step of calculating the probability propagation value from neighboring nodes to the current node based on the association strength and out-degree weights between device nodes in the fast association subgraph, and updating the fault source probability of the current node according to the preservation coefficient and the probability propagation value, includes: Traverse all neighboring nodes of the current node in the fast association subgraph and obtain the association strength of each neighboring node to the current node; calculate the sum of the out-degree weights of each neighboring node, where the sum of the out-degree weights is the sum of the association strengths of the neighboring node to all its neighboring nodes; Multiply the current fault source probability of each neighboring node by the association strength pointing to the current node, and then divide by the sum of the out-degree weights of that neighboring node to obtain the single-node probability propagation value of each neighboring node to the current node. Sum the single-node probability propagation values ​​of all neighboring nodes to obtain the total probability propagation value of the current node. Multiply the initial fault source probability of the current node by the hold coefficient, then multiply the total probability propagation value by the complement of the hold coefficient, and add the two together to obtain the updated fault source probability of the current node.

6. The method for secondary equipment fault diagnosis and location based on correlation analysis according to claim 1, characterized in that, Step S5 includes: Based on the number and level of alarms in the fast window, medium window, and slow window, the confidence scores of the fast window, medium window, and slow window are calculated respectively, and the confidence scores of the three windows are normalized. Based on the fast window confidence, medium window confidence, and slow window confidence, the fast fault source probability distribution, medium fault source probability distribution, and slow fault source probability distribution are weighted and fused to obtain the global fault source probability. Based on the accuracy of device nodes as actual fault sources in historical fault diagnosis records, the global fault source probability is corrected to obtain the final fault source probability. The final fault source probabilities are sorted from high to low according to their numerical values, and the fault source location results are output.

7. A secondary equipment fault diagnosis and location system based on correlation analysis, characterized in that, For implementing the secondary equipment fault diagnosis and location method based on correlation analysis as described in any one of claims 1 to 6, the secondary equipment fault diagnosis and location system based on correlation analysis comprises: The acquisition module is used to acquire the topology connection relationship of secondary devices. Based on the topology weight, alarm time difference, system operating status and historical feedback factors, it calculates the dynamic spatiotemporal correlation weight through a double exponential decay model and constructs a dynamic spatiotemporal correlation graph. The data acquisition module is used to set fast, medium, and slow windows to collect alarm information and generate corresponding fast, medium, and slow alarm sequences. The calculation module is used to map the fast alarm sequence, medium alarm sequence and slow alarm sequence to the device nodes of the dynamic spatiotemporal correlation graph, calculate the correlation strength between nodes based on the dynamic spatiotemporal correlation weight, and obtain the fast correlation subgraph, medium correlation subgraph and slow correlation subgraph. The iterative module is used to perform probability iterative calculations on the fast, medium, and slow association subgraphs based on a graph propagation algorithm with attention weights, to obtain the probability distributions of fast, medium, and slow fault sources, respectively. The location module is used to calculate the window confidence level based on the number and level of alarms in each window, perform weighted fusion of the probability distributions of fast, medium and slow fault sources, and output the fault source location result.

8. A secondary equipment fault diagnosis and location device based on correlation analysis, characterized in that, It includes a memory and a processor, the memory storing a computer program that can run on the processor, and the processor executing the computer program to implement the secondary equipment fault diagnosis and location method based on correlation analysis as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor, it causes the processor to execute the secondary equipment fault diagnosis and location method based on correlation analysis as described in any one of claims 1 to 6.

Images