Fault location methods and systems for power communication systems

Abstract

This invention relates to the field of power fault location technology, and discloses a method and system for fault location in a power communication system. The method includes: acquiring an alarm dataset from the power communication system, wherein the alarm dataset comprises a collection of alarm data from multiple alarm events; merging similar alarms in the alarm dataset to obtain a compressed alarm dataset; analyzing the compressed alarm dataset based on a device-fault-handling causal chain association rule base to determine the root cause of the fault, and generating a fault handling plan associated with the root cause. The method and system of this invention achieve efficient, accurate, and intelligent fault location, improving the reliability and operation and maintenance efficiency of the power communication system.

Description

Technical Field

[0001] This invention relates to the field of power fault location technology, and in particular to a fault location method and system for power communication systems. Background Technology

[0002] The power communication system is the "neural network" of the power grid, undertaking data communication tasks for key operations such as power grid dispatch automation, relay protection signal transmission, and production management information exchange. With the expansion of the power grid and the improvement of its intelligence level, the number of devices in the power communication network is growing exponentially (such as optical transmission equipment, switches, and routers), and the topological connections between devices are becoming increasingly complex, leading to an explosive growth in alarm data generated during system operation. At the same time, to ensure the safe and stable operation of the power grid, the power communication system has deployed multi-level and multi-type monitoring and alarm mechanisms (such as equipment performance threshold alarms, link status alarms, and protocol anomaly alarms), further exacerbating the scale and complexity of alarm data.

[0003] The alarm management of current power communication systems faces a significant dilemma of "too many problems and too few solutions," which severely restricts the efficiency and reliability of fault handling.

[0004] High alarm volume: Power communication networks contain tens of thousands of monitoring nodes (e.g., a single substation may deploy dozens of optical transmission devices and hundreds of communication ports). Each node may trigger alarms during operation due to environmental disturbances (such as electromagnetic interference), instantaneous performance fluctuations (such as slight fluctuations in optical power), configuration changes (such as temporary routing adjustments), etc. According to statistics, the daily alarm volume of large provincial power grid communication systems can reach several thousand to tens of thousands, and even exceed one hundred thousand during peak periods.

[0005] Redundancy and duplication are common: In power communication networks, the same fault may trigger alarms from multiple related devices (for example, a fiber optic link interruption may simultaneously cause an upstream optical transmission device to alarm for "low optical power" and a downstream switch to alarm for "no optical input at the port"), or the same fault of the same device may be reported multiple times due to overlapping monitoring policies (such as a sensor repeatedly triggering an "abnormal optical power" alarm every minute). These redundant and duplicate alarms account for 20% to 40% of the total alarms, causing maintenance personnel to spend a lot of time manually screening related events, making it difficult to quickly focus on the core fault point.

[0006] Faced with the problem of "too many" alarms, the current fault handling of power communication systems relies heavily on manual experience: maintenance personnel need to manually screen key events from a massive number of alarms, judge the correlation between alarms by memorizing or consulting documents (such as "whether multiple port outages are caused by the same fiber optic link failure"), and then combine historical cases to deduce possible root causes and formulate handling plans, which is inefficient and has low accuracy. Summary of the Invention

[0007] Therefore, the purpose of this invention is to solve the problems of "two many and one low" in fault location of power communication systems in the prior art, and to provide a fault location method and system for power communication systems, so as to achieve efficient, accurate and intelligent fault location and improve the reliability and operation and maintenance efficiency of power communication systems.

[0008] In a first aspect, to solve the above-mentioned technical problems, the present invention provides a fault location method for a power communication system, comprising:

[0009] Obtain an alarm dataset from a power communication system, wherein the alarm dataset includes a collection of alarm data for multiple alarm events;

[0010] The alarm dataset is then merged with similar alarms to obtain a compressed alarm dataset.

[0011] The compressed alarm dataset is analyzed based on the device-fault-handling causal chain association rule base to determine the root cause of the fault and generate a fault handling plan associated with the root cause of the fault.

[0012] The device-fault-handling causal chain association rule base contains multiple causal chain association rules. Each causal chain association rule includes a mapping of device type, fault phenomenon, root cause conclusion, and handling plan. Each causal chain association rule has a rule triggering condition, which is defined as the condition under which the causal chain association rule is activated. The triggering condition includes a combination of device type and fault phenomenon.

[0013] The analysis of the compressed alarm dataset based on the device-fault-handling causal chain association rule base determines the root cause of the fault, including: extracting features from the alarm data in the compressed alarm dataset to obtain alarm features; performing feature matching between the alarm features and the triggering conditions of the multiple causal chain association rules; and determining the root cause of the fault based on the feature matching results.

[0014] Preferably, merging similar alarms in the alarm dataset includes: grouping the alarm dataset according to the region to which the alarm device belongs to obtain multiple alarm subsets; aggregating alarm events within the alarm subsets into a temporary alarm set with alarm timestamps within a preset time window as the granularity; filtering alarm events related to the fault phenomenon by matching fault phenomenon keywords to obtain similar alarm candidate groups; and merging alarm events in the similar alarm candidate groups into similar alarms.

[0015] Preferably, before merging similar alarms in the alarm dataset, the method further includes: extracting key fields from the alarm data of each alarm event; the key fields include the device's region, device type, device topology location, link identifier, fault phenomenon keywords, alarm timestamp, alarm quantity, and alarm level; for each...

[0016] Preferably, for a single alarm event, if the alarm feature matches any of the triggering conditions, the root cause conclusion in the causal chain association rule corresponding to the triggering condition is taken as the root cause of the fault, and the handling scheme in the causal chain association rule is output.

[0017] Preferably, for a single alarm event, if the alarm features partially overlap with multiple triggering conditions, the method includes: filtering out a set of candidate causal chain association rules where the triggering conditions partially overlap with the alarm features; quantifying and scoring each causal chain association rule in the set of candidate causal chain association rules by combining at least three of the following: rule priority, alarm feature similarity, alarm quantity ratio, and topological correlation, to obtain a candidate causal chain association rule score; normalizing the candidate causal chain association rule score to a confidence level, using the root cause conclusion in the candidate causal chain association rule with the highest confidence level as the root cause of the fault, and outputting the handling scheme in the candidate causal chain association rule with the highest confidence level.

[0018] Preferably, the method further includes: filtering the compressed alarm dataset based on association conditions to identify multiple alarm events with correlation, thereby obtaining a group of associated alarm events; analyzing each alarm event in the group of associated alarm events based on a device-fault-handling causal chain association rule base to obtain candidate root causes of faults; obtaining a set of candidate root causes of faults for the group of associated alarm events based on the candidate root causes of each alarm event in the group of associated alarm events; determining the topological association between faulty devices involved in the group of associated alarm events based on a power communication network topology map; and deriving the common upstream root cause of faults for the group of associated alarm events by combining the topological association and the set of candidate root causes of faults.

[0019] Preferably, the association conditions include physical association, logical association, and spatiotemporal association; the physical association is defined as alarm devices being connected through the same physical link; the logical association is defined as alarm devices belonging to the same logical path; and the spatiotemporal association is defined as alarm events triggered in the same area within a set time period.

[0020] Secondly, to solve the above-mentioned technical problems, the present invention provides a fault location system for a power communication system, comprising:

[0021] Alarm data acquisition module: used to acquire alarm datasets in the power communication system, wherein the alarm dataset includes a collection of alarm data for multiple alarm events;

[0022] Similar alarm merging module: used to merge similar alarms in the alarm dataset to obtain a compressed alarm dataset;

[0023] Causal chain reasoning and handling generation module: used to analyze the compressed alarm dataset based on the device-fault-handling causal chain association rule library, determine the root cause of the fault, and generate a fault handling plan associated with the root cause of the fault.

[0024] Compared with the prior art, the above-described technical solution of the present invention has the following advantages:

[0025] The fault location method and system for power communication systems described in this invention achieve efficient, accurate, and intelligent fault location, thereby improving the reliability and operation and maintenance efficiency of power communication systems.

[0026] By filtering the alarm dataset and merging multiple similar alarm events, including merging alarms from multiple related devices triggered by the same fault, or multiple repeated alarms from the same device into a representative group, the interference of a large amount of duplicate information is avoided, the scale of alarm data is greatly reduced, and the amount of data to be processed is significantly reduced, providing a more streamlined data foundation for subsequent fault location.

[0027] By merging similar alarms and using causal chain association rules for reasoning and analysis, manual reviewers no longer need to sift through and analyze massive amounts of raw alarm data one by one. Instead, they can make further judgments and decisions based on the merged, compressed alarm data and the results derived from system reasoning. Simultaneously, the system can quickly locate the root cause of a fault and generate relevant handling solutions, providing clear guidance for manual reviewers, reducing the time spent searching for information and relying on experience, and improving processing speed.

[0028] Analysis based on a rule base for causal chain association between devices, faults, and handling can more accurately determine the correlation and causal relationship between alarms, avoiding erroneous judgments caused by insufficient human experience or incomplete information. Through topological association analysis and causal chain combination reasoning, the logical connections between multiple alarm events can be comprehensively considered to accurately locate the root cause of the fault, rather than judging based solely on a single alarm or superficial phenomenon. Simultaneously, the generated fault handling plan is also based on accurate root cause location, improving the targeting and effectiveness of the handling. Attached Figure Description

[0029] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings, wherein:

[0030] Figure 1 This is a flowchart of a fault location method for a power communication system in a preferred embodiment of the present invention;

[0031] Figure 2 This is a flowchart of merging similar alarms in an alarm dataset in a preferred embodiment of the present invention;

[0032] Figure 3 This is a flowchart of rule-based fuzzy matching in a preferred embodiment of the present invention;

[0033] Figure 4 This is a flowchart illustrating the derivation of the common root cause of multiple related alarm events in a preferred embodiment of the present invention.

[0034] Figure 5 This is a structural block diagram of a fault location system for a power communication system according to a preferred embodiment of the present invention. Detailed Implementation

[0035] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0036] The purpose of this invention is to solve the "two many and one low" problem of alarm data in power communication systems, namely, the large number of alarms and the high redundancy and repetition, which leads to low efficiency, low accuracy and reliance on experience in manual processing, so as to achieve efficient, accurate and intelligent fault location and improve the reliability and operation and maintenance efficiency of power communication systems.

[0037] Example 1: Refer to Figure 1 As shown in the figure, an embodiment of the present invention discloses a fault location method for a power communication system, comprising:

[0038] S100. Obtain the alarm dataset from the power communication system. The alarm dataset includes a collection of alarm data for multiple alarm events.

[0039] S200. Merge similar alarms in the alarm dataset to obtain a compressed alarm dataset;

[0040] S300: Analyze the compressed alarm dataset based on the device-fault-handling causal chain association rule base, determine the root cause of the fault, and generate a fault handling plan associated with the root cause of the fault.

[0041] In specific application scenarios, raw alarm data is collected from the network management platform or alarm system of the power communication system. The collection method can be real-time collection to obtain the latest alarm information promptly; or batch collection can be performed as needed to collect alarm data accumulated over a period of time. The network management platform and alarm system are devices specifically designed to monitor the operating status of the power communication system. They monitor the operating parameters and status information of various communication devices (such as optical transmission equipment, switches, etc.) in real time. When an abnormality is detected in the operating status of the communication device, or when certain performance indicators exceed preset thresholds, an alarm is triggered, and this alarm information is recorded to form raw alarm data.

[0042] An alarm event is a specific alarm message triggered during the operation of a power communication system when an abnormal situation occurs in a communication device or system. It is a concrete manifestation of a problem in the operating status of the power communication system. For example, if the optical power of an optical transmission device is lower than the preset normal range, the system will trigger an alarm event of "optical power below threshold"; or if a port of a switch experiences frequent intermittent disconnections, it will also trigger a corresponding alarm event of "frequent port disconnections". Each alarm event represents a specific abnormal situation in the power communication system and contains alarm information related to that abnormality.

[0043] Alarm data for alarm events refers to various specific information related to each alarm event, which describes the details of the alarm event. This typically includes: device identifier (e.g., device ID), used to uniquely identify the device that triggered the alarm; device type (e.g., switch, optical transmission equipment), specifying the category of device involved in the alarm event; port / link identifier (e.g., physical port GE1 / 0 / 1 or logical link), indicating the specific location of the alarm or the related connection; description of the fault symptom (e.g., "frequent port interruptions," "abnormal packet loss rate"), visually illustrating the abnormal behavior of the device; alarm timestamp, recording the specific time the alarm event occurred, accurate to the second / millisecond, which helps in analyzing the temporal sequence and correlation of alarm events; alarm level (e.g., urgent / important / general), used to indicate the severity of the alarm event; and the data center or area information to which the device belongs, specifying the physical location of the alarming device, facilitating on-site troubleshooting and handling by maintenance personnel.

[0044] Similar alarms refer to multiple logically related alarm events triggered by the same or related underlying faults within a specific time and space range. These alarms may originate from different devices, different ports, or manifest as different specific phenomena, but essentially point to the same type of problem. For example, an interruption of the same fiber optic link may cause multiple optical transmission devices to report low optical power, or a port configuration error in the same switch cluster may cause multiple port outages. Individual alarms within the same type of alarm may have different specific descriptions (such as "low optical power" and "no input signal from optical module"), but the root cause of the fault is the same. Merging similar alarms can reduce redundant information, focus on the core fault point, and provide a more concise data foundation for subsequent fault location.

[0045] The Equipment-Fault-Handling Causal Chain Association Rule Base is a pre-built database containing multiple causal chain association rules stored in batches. These rules clearly define the causal relationship between a specific equipment type and a fault phenomenon, as well as the corresponding root cause and handling actions. The root cause refers to the most fundamental and direct underlying reason for the alarm event in the power communication system, rather than a superficial phenomenon or derivative problem. Each causal chain association rule is summarized and refined based on expert experience in the power communication field, historical fault cases, equipment operation and maintenance manuals, and standardized operating procedures (SOPs). For example, "Frequent intermittent disconnections of switch + port → The root cause may be port hardware failure or configuration error; the handling action is to check the port hardware connection or reconfigure the port parameters." These causal chain association rules provide standardized guidance for fault location and handling, helping operation and maintenance personnel quickly and accurately determine the cause of the fault and take corresponding solutions.

[0046] By merging similar alarms and using causal chain association rules for reasoning and analysis, manual reviewers no longer need to sift through and analyze massive amounts of raw alarm data one by one. Instead, they can make further judgments and decisions based on the merged, compressed alarm data and the results derived from system reasoning. Simultaneously, the system can quickly locate the root cause of a fault and generate relevant handling solutions, providing clear guidance for manual reviewers, reducing the time spent searching for information and relying on experience, and improving processing speed.

[0047] Analysis based on a rule base for causal chain association between devices, faults, and handling can more accurately determine the correlation and causal relationship between alarms, avoiding erroneous judgments caused by insufficient human experience or incomplete information. Through topological association analysis and causal chain combination reasoning, the logical connections between multiple alarm events can be comprehensively considered to accurately locate the root cause of the fault, rather than judging based solely on a single alarm or superficial phenomenon. Simultaneously, the generated fault handling plan is also based on accurate root cause location, improving the targeting and effectiveness of the handling.

[0048] Based on the above embodiments, before merging similar alarms in the alarm dataset, a preprocessing process of "key field extraction → structured transformation → keyword standardization" is required to transform the original unstructured / semi-structured alarm data into a set of structured key fields that can be used for efficient grouping and merging. Specifically, the following steps are included: Extract the following eight key fields from the original alarm data of each alarm event (which may be unstructured text descriptions or semi-structured log information): Key fields include the device's region, device type, device topology location, link identifier, fault phenomenon keywords, alarm timestamp, alarm quantity, and alarm level; these fields are the core basis for subsequent judgment on whether alarms are similar, related, and merged.

[0049] The device's region (e.g., "XX Substation Communication Room" or "East China Regional Power Grid") identifies the physical location of the alarm device, which is used for subsequent analysis by region.

[0050] The type of equipment (such as optical transmission equipment, switch, router) clearly indicates the type of alarming device, and the failure modes of different equipment types differ significantly.

[0051] Device topology location (such as core node, access node, link intermediate node) describes the device's level or role in the network topology, affecting the determination of the scope of fault impact.

[0052] Link identifiers (such as physical port "GE1 / 0 / 1" or logical link "Fiber Link AB") precisely point to the specific connection or port where the alarm occurred, and are used to associate alarms from multiple devices on the same link.

[0053] Fault symptom keywords (core words extracted from the original fault symptom description, such as "optical power", "below", "threshold", "port", "flashover") describe the specific phenomenon of the alarm, but may be non-standardized text, such as "optical power below -30dBm".

[0054] Alarm timestamps record the time when alarms occur, and users can subsequently aggregate them by time window.

[0055] The number of alarms (such as the number of similar alarms triggered by the same device in a short period of time, for example, the "low optical power" alarm being triggered 3 times in a row) reflects the density or persistence of the fault.

[0056] Alarm level indicates the severity of an alarm and is used for priority ranking.

[0057] The above eight key fields cover all dimensions of information regarding the alarm's spatial location, device object, fault manifestation, time characteristics, and severity, and serve as the basis for subsequent judgments on similar alarms.

[0058] For each alarm event, the eight key fields extracted are organized into a structured field record (such as JSON or a row in a database table) in a uniform format to ensure that the data format of all alarm events is consistent, and to convert the original messy data into a structured format for subsequent automated processing by the program.

[0059] Since the original fault symptom keywords are mostly non-standardized text (such as "optical power below -30dBm" and "frequent port interruptions"), directly using them for similar judgments would lead to semantic ambiguity. Therefore, it is necessary to take the fault symptom keywords as input and convert them into standardized keyword combinations through the following method:

[0060] A keyword mapping table is predefined, which contains the correspondence between common non-standard fault descriptions and standardized keywords. For example, "optical power is lower than" → "optical power is low"; "frequent port interruptions" → "port interruptions"; "abnormal packet loss rate" → "abnormal packet loss". The original fault phenomenon keywords (such as "optical power is lower than -30dBm") are replaced with standardized combinations (such as "optical power is low") by string matching or regular expressions.

[0061] For complex descriptions that cannot be matched by simple rules (such as "signal jitter causes packet loss rate fluctuations"), NLP technology can be used to extract noun + adjective combinations, or standardized keywords can be generated based on semantic analysis.

[0062] Finally, standardized keyword combinations were used to replace fault phenomenon keywords to update the structured fields, resulting in structured key fields.

[0063] The preprocessing process transforms the raw, complex, and non-standardized alarm data into a structured, standardized, and concise set of key fields, thereby providing a unified and reliable data foundation for subsequent merging of similar alarms. Specific objectives include eliminating data heterogeneity, clustering core related attributes, supporting efficient grouping and merging, and ultimately improving the accuracy of merging similar alarms and enhancing the basic quality of root cause localization.

[0064] Building upon the above embodiments, similar alarm merging involves multi-dimensional aggregation and filtering of the alarm dataset to integrate multiple alarm events with similar characteristics or correlations into a small number of representative similar alarms, thereby reducing redundant information and focusing on core faults. (Refer to...) Figure 2As shown, the specific steps include: grouping the alarm dataset according to the region to which the alarm device belongs to obtain multiple alarm subsets; aggregating alarm events within the alarm subsets into temporary alarm sets with a preset time window as the granularity; filtering alarm events related to the fault phenomenon by matching fault phenomenon keywords to obtain similar alarm candidate groups; merging alarm events in similar alarm candidate groups into similar alarms.

[0065] In specific application scenarios, the entire alarm dataset is first divided into multiple alarm subsets based on the device region field of each alarm event. Each alarm subset contains alarm events from all devices within the same physical region (such as the same computer room or the same substation). In power communication systems, devices within the same region typically share a physical environment (such as shared fiber optic links or power buses) or logical topology (such as a cluster of switches within the same VLAN), resulting in stronger fault correlation. Grouping by region can prioritize focusing on alarm clustering within a local area and avoid interference from irrelevant alarms across regions.

[0066] For each subset of alarm events, a preset time window (e.g., 5 minutes, 10 minutes) is set. All alarm events whose timestamps fall within this time window are aggregated into a temporary alarm set. For example, if the time window is 5 minutes, all alarms triggered between 10:00:00 and 10:04:59 on August 4, 2025, are grouped together. In actual operation and maintenance, sensors or monitoring systems may repeatedly trigger the same alarm within a short period of time due to transient interference (e.g., reporting "abnormal optical power" once per minute). Time window aggregation can merge these short-term, dense, and repetitive alarms into a group, reducing redundant data. At the same time, the time window can preserve the alarm aggregation characteristics during the sudden fault period.

[0067] For each temporary alarm set, alarm events related to the fault phenomenon are filtered out by matching their "fault phenomenon keyword" field, forming candidate groups of similar alarms. Keyword matching can be exact matching (e.g., keywords are exactly the same) or fuzzy matching (e.g., alarms containing "optical power" and with abnormal values ​​are considered relevant). Alarm events in the same area and within the same time window may involve multiple fault types. By filtering by fault phenomenon keywords, alarms of irrelevant fault types can be excluded, retaining only alarm events with potential correlation, providing a more accurate candidate set for subsequent merging of similar faults.

[0068] Finally, all alarm events in the same candidate alarm group are merged into a single group of similar alarms. Multiple similar or related alarm events are compressed into a single representative record, reducing the total amount of alarm data while retaining core fault information. For example, three "low optical power" alarms and two "no optical input at port" alarms triggered by the same fiber optic link interruption are merged into a single alarm, "Fiber optic link AB interruption (5 alarms in total)," enabling maintenance personnel to quickly identify the core fault point.

[0069] The essence of merging similar alarms is to identify alarm clusters that truly require attention through the dual constraints of spatiotemporal dimensions and fault types, providing an efficient and accurate data foundation for subsequent fault root cause localization, and ultimately achieving a dual improvement in the operation and maintenance efficiency and reliability of power communication systems.

[0070] Furthermore, the specific sequence of regional grouping → time window aggregation → fault phenomenon screening → merging of similar alarms is the optimal processing flow verified by the characteristics of fault scenarios in power communication systems. The dependencies and irreversibility between the steps determine that this specific sequence must be strictly followed. Its core logic is to gradually narrow the scope of alarm analysis through layer-by-layer screening of "spatial range constraints → time density compression → fault type focus → data simplification and aggregation", and finally accurately locate the similar alarms that need to be merged.

[0071] Based on the above embodiments, the device-fault-disposal causal chain association rule base contains multiple causal chain association rules. Each causal chain association rule includes a mapping of device type-fault phenomenon-root cause conclusion-disposal plan. Each causal chain association rule has a rule triggering condition, which is defined as the condition for the causal chain association rule to be activated. The triggering condition includes a combination of device type and fault phenomenon.

[0072] In specific application scenarios, the device-fault-handling causal chain association rule base is a knowledge base specifically designed for fault location and handling in power communication systems. Its core consists of multiple causal chain association rules, each of which is a set of verified fault handling experience summaries with clear logical connections, specifically including the following key elements:

[0073] Mapping relationship: Equipment type - Fault phenomenon - Root cause conclusion - Solution;

[0074] The equipment type clearly defines the category of power communication equipment to which the rules apply. Different equipment types may have different failure modes and root causes due to differences in their hardware structure, functional characteristics, and operating environment. The failure phenomenon describes the abnormal behavior of the equipment during operation. The root cause conclusion is the most fundamental cause of the failure phenomenon inferred based on the experience of experts in the field of power communication, analysis of historical failure cases, and knowledge of equipment principles. The handling plan is a set of specific failure handling steps and measures formulated for the specific root cause conclusion, including the required operational actions (such as cleaning the fiber end face, replacing the pigtail, restarting the equipment), the required tools and resources (such as fiber cleaning tools, spare pigtails, and spare parts of specific models), the operation priority (such as prioritizing emergency handling steps), and the scope of equipment and services that may be affected.

[0075] Rule triggering conditions: A combination of device type and fault symptoms. Rule triggering conditions are the conditions under which a causal chain rule is activated. That is, when the device type and fault symptoms in an alarm event match the combination of device type and fault symptoms defined in the rule, the rule will be triggered and applied to the current fault location and handling process. As a filtering mechanism for the rule base, the rule triggering conditions ensure that only rules that match the characteristics of the current alarm event are considered, improving the accuracy and efficiency of fault location.

[0076] Specifically, the compressed alarm dataset is analyzed based on the device-fault-handling causal chain association rule base to determine the root cause of the fault. This includes: extracting features from the alarm data in the compressed alarm dataset to obtain alarm features; performing feature matching between the alarm features and the triggering conditions of multiple causal chain association rules; and determining the root cause of the fault based on the feature matching results.

[0077] In specific application scenarios, a logical chain of feature extraction, rule matching, and root cause inference is used to combine compressed alarm data with predefined fault handling knowledge to accurately locate the root cause of the fault. First, alarm features are extracted from each representative alarm data point. These features include basic device attribute features, fault phenomenon features, and related context features. Basic device attribute features include device type, link identifier, and device region; fault phenomenon features include fault phenomenon keywords, alarm events, and alarm levels; and related context features include the device's location in the network topology and its association with other alarms. The representative alarm data is then transformed into a structured, matchable feature set, focusing on core information that reflects the essence of the fault.

[0078] The extracted alarm features are matched with the triggering conditions of each causal chain association rule in the device-fault-handling causal chain association rule library to determine whether there is a matching rule. The matching includes exact matching and fuzzy matching. By matching alarm features with causal chain association rules, causal chain rules applicable to the current alarm scenario are selected, and the root cause of the fault is determined based on the feature matching results.

[0079] One implementation scheme involves determining the root cause of a fault based on feature matching results. For a single alarm event, if the alarm features precisely match any triggering condition, the root cause conclusion in the causal chain association rule corresponding to the triggering condition is taken as the root cause of the fault, and the handling plan in the causal chain association rule is output. Precise matching refers to a matching method where the alarm features of the alarm event (including device type and fault phenomenon) are completely consistent with the triggering condition of a certain causal chain association rule in the device-fault-handling causal chain association rule base. This complete consistency requires that the alarm features of the alarm event and the content defined by the triggering condition are semantically and numerically identical, representing a strict and precise correspondence. For precise matching and root cause handling plan output for a single alarm event, the simplified process of precise feature comparison → direct location of the root cause and handling plan achieves high efficiency, accuracy, standardization, and automation in fault location.

[0080] In another implementation, when the alarm characteristics of a single alarm event cannot precisely match the triggering conditions of any causal chain association rule, but partially overlap with the triggering conditions of multiple causal chain association rules (e.g., the equipment type is the same but the fault phenomenon parameters are slightly different, or the fault phenomenon keywords are partially contained), the most likely root cause conclusion and handling plan are selected from the candidate rules through multi-dimensional comprehensive evaluation, referring to... Figure 3 As shown, the specific steps include: selecting a set of candidate causal chain association rules that partially overlap with the triggering conditions and alarm features; quantifying and scoring each causal chain association rule in the set of candidate causal chain association rules by combining at least three of the following: rule priority, alarm feature similarity, alarm quantity ratio, and topological correlation, to obtain a candidate causal chain association rule score; normalizing the candidate causal chain association rule score to a confidence level, taking the root cause conclusion in the candidate causal chain association rule with the highest confidence level as the root cause of the fault, and outputting the handling plan in the candidate causal chain association rule with the highest confidence level.

[0081] In specific application scenarios, partial overlap manifests as: matching device types but different fault phenomenon parameters, or partial inclusion of fault phenomenon keywords. For each causal chain association rule in the candidate causal chain association rule set, a quantitative score is performed based on at least three of the following key dimensions:

[0082] Rule priority: The importance of rules predefined by domain experts (e.g., rules related to core devices have high weights, such as a weight of 0.4 for core router failures and a weight of 0.2 for edge device rules).

[0083] Alarm feature similarity: the ratio of alarm events to fault phenomenon keywords that match the rule triggering conditions (e.g., 0.6 points for sharing the keyword "optical power", and 0 points for no match).

[0084] Alarm count percentage: The percentage of alarms that support the candidate root cause in the total number of similar merged alarms (e.g., 3 alarms pointing to a certain root cause, total 5 alarms → percentage = 0.6%).

[0085] Topology relevance: The criticality of the devices involved in the candidate root cause in the network topology (e.g., the weight of the backbone fiber is 0.3, and the weight of the branch link is 0.1).

[0086] In the example scoring calculation: If a candidate rule has a rule priority of 0.4 (weight 0.3), alarm feature similarity of 0.6 (weight 0.2), and topological relevance of 0.3 (weight 0.1), then its score is 0.4×0.3 + 0.6×0.2 + 0.3×0.1 = 0.12 + 0.12 + 0.03 = 0.27.

[0087] The scores of all candidate causal chain association rules are normalized to a confidence level within the range of 0 to 1 using the Softmax function. For example, rule A score 0.63 → confidence level = 0.72, rule B score 0.55 → confidence level = 0.48. The root cause conclusion from the candidate causal chain association rule with the highest confidence level is selected as the root cause of the fault, and the handling plan from the candidate causal chain association rule with the highest confidence level is output. In complex power communication systems, many fault phenomena have ambiguous boundaries (such as optical power slightly below the threshold but not completely interrupted). This scheme significantly improves the adaptability of root cause localization through flexible similarity calculation and multi-factor trade-offs. Replacing strict matching of a single feature with data-driven multi-factor comprehensive evaluation improves the flexibility, credibility, and interpretability of root cause conclusions, while providing quantitative basis for human decision-making, ultimately achieving rapid and accurate localization of fault root causes in complex alarm scenarios.

[0088] In power communication systems, multiple devices may simultaneously trigger alarms due to the same underlying fault, forming correlated alarm events. How to deduce the common root cause of these correlated alarm events is a key question. To address this issue, [the following is a reference to a different topic:] Figure 4As shown, this embodiment of the invention further includes, based on the above embodiments, the following steps: filtering the compressed alarm dataset based on association conditions to identify multiple alarm events with correlation, thus obtaining an associated alarm event group; analyzing each alarm event in the associated alarm event group based on the device-fault-handling causal chain association rule base to obtain candidate fault root causes; obtaining a candidate fault root cause set for the associated alarm event group based on the candidate fault root causes of each alarm event in the associated alarm event group; determining the topological association relationship between the faulty devices involved in the associated alarm event group based on the power communication network topology map; and deriving the common upstream fault root cause of the associated alarm event group by combining the topological association relationship and the candidate fault root cause set.

[0089] In specific application scenarios, the correlation conditions include physical correlation, logical correlation, and spatiotemporal correlation. Physical correlation is defined as alarm devices being connected through the same physical link, for example, fiber optic link AB connecting optical transmission device OTN-001 and switch SW-001. Logical correlation is defined as alarm devices belonging to the same logical path, for example, a switch cluster within the same VLAN. Spatiotemporal correlation is defined as alarm events triggered collectively in the same area within a set time period. Based on the correlation conditions, the compressed alarm dataset is filtered to identify multiple correlated alarm events, obtaining correlated alarm event groups. By filtering based on correlation conditions, the analysis scope is narrowed, focusing in-depth reasoning only on alarms from devices that may share a common fault source, avoiding the processing of irrelevant alarms.

[0090] For each alarm event in the associated alarm event group, candidate root causes are obtained based on the above-mentioned precise matching or fuzzy matching methods. Possible fault source hypotheses are matched for each associated alarm event as the basic input for subsequent topological association reasoning. The combination of candidate root causes of all alarm events in the associated alarm event group is the candidate root cause set, which integrates the potential fault sources of multiple alarm events and provides comprehensive candidate options for subsequent derivation of common root causes.

[0091] Based on the pre-stored power communication network topology map, the topological relationships between faulty devices involved in the associated alarm event group are determined. The topological relationships include physical connections and logical path dependencies. The topological relationships provide "spatial correlation basis" for inferring common root causes, clarifying which devices may be affected by the same underlying fault due to topological connections. If the candidate root causes of multiple alarm events all point to a certain type of fault, and these devices are directly or indirectly connected in the topology, then it is inferred that this type of fault is a common upstream root cause.

[0092] This embodiment of the solution uses a closed-loop process of associated alarm screening → single event root cause analysis → topological association reasoning → common root cause derivation to transform alarm information from multiple associated devices into accurate localization of the common upstream fault root cause.

[0093] Example 2: To solve the above technical problems, refer to Figure 5 As shown in the figure, an embodiment of the present invention discloses a fault location system for a power communication system, comprising:

[0094] Alarm data acquisition module: used to acquire alarm datasets in the power communication system. The alarm dataset includes a collection of alarm data from multiple alarm events.

[0095] Similar alarm merging module: Used to merge similar alarms in the alarm dataset to obtain a compressed alarm dataset;

[0096] Causal chain reasoning and handling generation module: It is used to analyze the compressed alarm dataset based on the device-fault-handling causal chain association rule base, determine the root cause of the fault, and generate fault handling solutions associated with the root cause of the fault.

[0097] The embodiments of the present invention are based on the same inventive concept as Embodiment 1 and have the same technical effects, which will not be repeated here.

[0098] In summary, the fault location method and system for power communication systems described in this invention achieve efficient, accurate, and intelligent fault location, thereby improving the reliability and operation and maintenance efficiency of power communication systems.

[0099] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0100] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0101] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0102] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0103] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method of fault location in a power communication system, characterized by, The method comprises the following steps: obtaining an alarm data set in a power communication system, wherein the alarm data set comprises a set of alarm data of a plurality of alarm events; performing same-type alarm merging on the alarm data set to obtain a compressed alarm data set; analyzing the compressed alarm data set based on a device-fault-disposal causal chain association rule base to determine a fault root cause and generate a fault disposal scheme associated with the fault root cause; wherein the device-fault-disposal causal chain association rule base comprises a plurality of causal chain association rules, each of which comprises a mapping of device type-fault phenomenon-root cause-disposal scheme; each of the causal chain association rules has a rule trigger condition, which is defined as the condition for activating the causal chain association rule; the trigger condition comprises a combination of device type and fault phenomenon; analyzing the compressed alarm data set based on the device-fault-disposal causal chain association rule base to determine the fault root cause, comprising: extracting features from the alarm data in the compressed alarm data set to obtain alarm features; performing feature matching on the alarm features and the trigger conditions of the plurality of causal chain association rules to determine the fault root cause according to the feature matching result; for a single alarm event, if the alarm features partially overlap with multiple trigger conditions, comprising: screening out a candidate causal chain association rule set whose trigger condition partially overlaps with the alarm features; for each causal chain association rule in the candidate causal chain association rule set, at least three of rule priority, alarm feature similarity, alarm quantity proportion and topology association are combined to quantitatively score to obtain a candidate causal chain association rule score; the candidate causal chain association rule score is normalized to a confidence degree, the root cause in the candidate causal chain association rule with the highest confidence degree is taken as the fault root cause, and the disposal scheme in the candidate causal chain association rule with the highest confidence degree is output.

2. The electric power communication system fault locating method of claim 1, wherein, performing same-type alarm merging on the alarm data set, comprising: grouping the alarm data set according to the region to which the alarm device belongs to obtain a plurality of alarm subsets; grouping the alarm events in the alarm subset into temporary alarm sets in a preset time window as a granularity; screening out alarm events related to fault phenomenon from the alarm events in the temporary alarm set by matching fault phenomenon keywords to obtain a same-type alarm candidate group; merging the alarm events in the same-type alarm candidate group into a same-type alarm.

3. The power communication system fault locating method of claim 2, wherein, Before performing same-type alarm merging on the alarm data set, it further comprises the following steps: extracting key fields from the alarm data of each alarm event; the key fields include device region, device type, device topology position, link identifier, fault phenomenon keyword, alarm timestamp, alarm quantity and alarm level; converting the extracted key fields into structured fields for each alarm event; taking the fault phenomenon keyword as input, searching for a corresponding standardized keyword combination in a keyword mapping table; Replace the fault phenomenon keyword with the standardized keyword combination to update the structured field, and obtain a structured key field.

4. The method of claim 1, wherein, For a single alarm event, if the alarm feature matches any of the trigger conditions, the root cause conclusion in the corresponding causal chain association rule of the trigger condition is taken as the fault root cause, and the treatment scheme in the causal chain association rule is output.

5. The electric power communication system fault locating method according to claim 1 or 4, characterized by, Also includes: Filtering the compressed alarm data set based on the association condition to filter out multiple alarm events with association, and obtaining an associated alarm event group; Analyzing each alarm event in the associated alarm event group based on the device-fault-treatment causal chain association rule library to obtain a candidate fault root cause; According to the candidate fault root cause of each alarm event in the associated alarm event group, a candidate fault root cause set of the associated alarm event group is obtained; Based on the power communication network topology graph, the topological association relationship between the fault devices involved in the associated alarm event group is determined; Combined with the topological association relationship and the candidate fault root cause set, the common upstream fault root cause of the associated alarm event group is derived.

6. The power communication system fault locating method of claim 5, wherein, The association condition includes physical association, logical association and space-time association; the physical association is defined as that the alarm devices are connected through the same physical link; the logical association is defined as that the alarm devices belong to the same logical path; and the space-time association is defined as that the alarm events triggered in the same region within a set time are concentrated.

7. A power communication system fault locating system for performing the power communication system fault locating method as claimed in any one of claims 1 to 6, characterized by, Includes: An alarm data acquisition module is configured to acquire an alarm data set in a power communication system, wherein the alarm data set includes a set of alarm data of multiple alarm events; A same-type alarm merging module is configured to merge the same-type alarms in the alarm data set to obtain a compressed alarm data set; A causal chain reasoning and treatment generation module is configured to analyze the compressed alarm data set based on a device-fault-treatment causal chain association rule library, determine a fault root cause, and generate a fault treatment scheme associated with the fault root cause.

Images