Electric power information system fault early warning and explaining method and system based on RAG framework

Abstract

The invention belongs to the field of artificial intelligence operation and maintenance, and discloses an electric power information system fault early warning and explaining method and system based on an RAG framework, and the method comprises the steps: obtaining historical log data with fault tags, coding the historical log data into feature vectors, constructing a vector knowledge base with the fault tags, and carrying out the fault early warning and explaining of the fault tags; therefore, the fault retrieval process can be compared based on the historical real fault features, and the retrieval result has a direct corresponding relation with the actual fault scene, so that the reliability of fault symptom judgment is improved. According to the method, the electric power information system logs are obtained in real time and converted into the feature vectors, retrieval is carried out through the vector knowledge base, similarity judgment is directly carried out on historical fault features when the logs are generated, and potential fault symptoms are rapidly recognized. Through the vector knowledge base with the fault labels, real-time feature vector retrieval and explanation generation based on the enhanced context, the fault early warning process has accuracy, interpretability and engineering practicability at the same time.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence operation and maintenance, specifically involving a method and system for fault early warning and interpretation of power information systems based on the RAG framework. Background Technology

[0002] In power information systems, the accuracy of fault early warnings and the reliability of their interpretations directly impact the continuity of core power operations and operational efficiency, serving as a crucial foundation for ensuring the safe and stable operation of the power grid. As power system architecture upgrades towards a cloud-edge-device collaborative model, information system logs exhibit characteristics such as multi-source heterogeneity, rapid volume growth, and highly complex semantics. According to research statistics from the journal *Automation of Electric Power Systems*, provincial power information systems generate over 100GB of log data daily. Different equipment models, system versions, and vendor specifications lead to significant differences in the semantic expression of fault logs, continuously increasing the difficulty of fault identification and analysis.

[0003] Existing fault early warning technologies for power information systems still have significant shortcomings. While traditional rule-based and machine learning methods offer some real-time capabilities, they suffer from weak feature representation, limited fault coverage, and a lack of interpretability. Rule bases rely on manual maintenance, requiring substantial man-hours for updates with each system upgrade, resulting in maintenance costs that constitute a significant portion of the information system's annual budget. Machine learning models are black-box models, only outputting fault labels without providing early warning criteria, forcing maintenance personnel to re-investigate faults, with an average location time exceeding four hours. Recent direct generation schemes based on general-purpose large language models possess some interpretability, but lacking specialized data support for the power information system domain, they are prone to generating fictitious content and cannot effectively utilize historical fault logs for reasoning, resulting in an accuracy rate of less than 60% for warnings of new fault scenarios. Furthermore, the high inference overhead of large models makes the processing cost per log entry insufficient for large-scale engineering implementation. Summary of the Invention

[0004] The purpose of this invention is to overcome the difficulty of existing technologies in simultaneously meeting the comprehensive requirements of the power industry for early warning accuracy, interpretation reliability, and engineering scalability, and to provide a method and system for fault early warning and interpretation of power information systems based on the RAG framework.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a method for fault early warning and interpretation in power information systems based on the RAG framework, comprising the following steps: Acquire historical information specific to the power information system field, analyze it to obtain historical information system log data with fault labels, encode the historical information system log data with fault labels into feature vectors, and construct a vector knowledge base with fault labels; The system acquires power information system logs in real time, converts the logs into feature vectors, retrieves the feature vectors in a vector knowledge base, determines whether there are fault signs based on the retrieval results, and if there are fault signs, retrieves historical fault logs related to the fault signs. Historical fault logs are parsed to obtain historical fault context information. This historical fault context information is then combined with the corresponding power information system logs to form an enhanced context. Based on this enhanced context, a power information system fault early warning probability explanation report is generated.

[0006] A further improvement of this invention lies in acquiring historical information specific to the power information system field, analyzing it to obtain historical information system log data with fault tags, encoding the historical information system log data with fault tags into feature vectors, and constructing a vector knowledge base with fault tags using the following specific method: To acquire historical information specific to the power information system field, a log encoding neural network specific to the power information system field is trained using supervised learning. By processing historical information specific to the power information system through a log coding neural network dedicated to the power information system field, historical information system log data with fault labels is obtained. Each historical information system log data with fault labels includes a log text sequence and a fault category label. Based on the fault labels in historical information system log data, the log text sequence is specially classified and labeled; The log text sequence is concatenated with a special classification label and then input into the Transformer model to obtain the final hidden state corresponding to the special classification label, which serves as the global feature vector of the log text sequence. By using a vector library to index the global feature vectors of log text sequences, a vector knowledge base with fault labels is obtained.

[0007] During Transformer model training, an initial Transformer model is preset, and supervised fine-tuning is performed on the initial Transformer model using historical information system log data with fault labels. The parameters of the preset Transformer model are optimized using the cross-entropy loss function to obtain the Transformer model.

[0008] A further improvement of this invention is that the preset Transformer model operates as follows: The input layer receives a sequence of log text, segments the log text sequence into words, and obtains a sequence of sub-words. The word sequence is converted into a vector of the target dimension through an embedding matrix, and positional encoding is added to provide sequence order information; The encoder layer consists of several identical encoder blocks stacked together. Each encoder block contains a multi-head self-attention mechanism layer, which uses the multi-head self-attention mechanism to calculate and weight the vectors with added positional encodings for fusion. The feedforward neural network layer uses two linear transformations, where the weighted fused vector is subjected to residual connections and layer normalization through the ReLU activation function. The output layer selects the output vector with a special classification label as the global feature vector of the log text sequence.

[0009] A further improvement of this invention lies in the real-time acquisition of power information system logs, the conversion of these logs into feature vectors, the retrieval of these feature vectors in a vector knowledge base, and the determination of whether fault symptoms exist based on the retrieval results. If fault symptoms are found, the specific method for obtaining historical fault logs related to these symptoms is as follows: Real-time acquisition of power information system logs, and conversion of power information system logs into feature vectors using the Transformer model; The hierarchical navigation small-world graph algorithm is used to calculate the similarity of feature vectors in a vector knowledge base to obtain the similarity of each feature vector; The similarity of each feature vector is sorted in descending order, and the results with the desired relevance are selected as the search results. Based on the search results, determine whether there are any signs of a fault. If there are signs of a fault, retrieve the historical fault logs related to those signs.

[0010] A further improvement of this invention lies in employing a hierarchical navigation small-world graph algorithm to calculate the similarity of feature vectors in a vector knowledge base. The specific method for obtaining the similarity of each feature vector is as follows: The feature vectors are obtained, and the cosine similarity metric is used to quantify the correlation between the real-time feature vectors and the historical feature vectors in the vector knowledge base. Based on the mean correlation between real-time and historical feature vectors, combined with the standard deviation and adjustment coefficient, a dynamic similarity threshold for each feature vector is obtained. The similarity of each feature vector is then filtered according to the dynamic similarity threshold.

[0011] A further improvement of this invention lies in parsing historical fault logs to obtain historical fault context information, combining the historical fault context information with the corresponding power information system logs to form an enhanced context, and generating a power information system fault early warning probability interpretation report based on the enhanced context. The specific method is as follows: Obtain historical fault logs, parse the historical fault logs, and obtain historical fault context information; The historical fault context information is combined with the corresponding power information system log to form an enhanced context. The enhanced context is then formatted using a preset prompt word template to obtain the target enhanced context. A large language model is used to process the target enhanced context to generate a power information system fault early warning probability interpretation report. The power information system fault early warning probability interpretation report includes the similarity analysis of real-time logs and historical faults, inference of potential fault types, and assessment of the probability of occurrence.

[0012] Secondly, the present invention provides a power information system fault early warning and interpretation system based on the RAG framework, comprising: The knowledge base construction module is used to acquire historical information specific to the power information system field, analyze the historical information system log data with fault labels, encode the historical information system log data with fault labels into feature vectors, and construct a vector knowledge base with fault labels. The fault log acquisition module is used to acquire power information system logs in real time, convert the power information system logs into feature vectors, search the feature vectors in the vector knowledge base, determine whether there are fault symptoms based on the search results, and if there are fault symptoms, acquire historical fault logs related to the fault symptoms. The report generation module is used to parse historical fault logs to obtain historical fault context information, combine the historical fault context information with the corresponding power information system logs to form an enhanced context, and generate a power information system fault early warning probability explanation report based on the enhanced context.

[0013] A further improvement of this invention is that the functionality of the knowledge base construction module is implemented through the following method: To acquire historical information specific to the power information system field, a log encoding neural network specific to the power information system field is trained using supervised learning. By processing historical information specific to the power information system through a log coding neural network dedicated to the power information system field, historical information system log data with fault labels is obtained. Each historical information system log data with fault labels includes a log text sequence and a fault category label. Based on the fault labels in historical information system log data, the log text sequence is specially classified and labeled; The log text sequence is concatenated with a special classification label and then input into the Transformer model to obtain the final hidden state corresponding to the special classification label, which serves as the global feature vector of the log text sequence. By using a vector library to index the global feature vectors of log text sequences, a vector knowledge base with fault labels is obtained.

[0014] During Transformer model training, an initial Transformer model is preset, and supervised fine-tuning is performed on the initial Transformer model using historical information system log data with fault labels. The parameters of the preset Transformer model are optimized using the cross-entropy loss function to obtain the Transformer model.

[0015] A further improvement of this invention is that the function of the fault log acquisition module is implemented through the following method: Real-time acquisition of power information system logs, and conversion of power information system logs into feature vectors using the Transformer model; The hierarchical navigation small-world graph algorithm is used to calculate the similarity of feature vectors in a vector knowledge base to obtain the similarity of each feature vector; The similarity of each feature vector is sorted in descending order, and the results with the desired relevance are selected as the search results. Based on the search results, determine whether there are any signs of a fault. If there are signs of a fault, retrieve the historical fault logs related to those signs.

[0016] A further improvement of this invention is that the function of the report generation module is implemented through the following method: Obtain historical fault logs, parse the historical fault logs, and obtain historical fault context information; The historical fault context information is combined with the corresponding power information system log to form an enhanced context. The enhanced context is then formatted using a preset prompt word template to obtain the target enhanced context. A large language model is used to process the target enhanced context to generate a power information system fault early warning probability interpretation report. The power information system fault early warning probability interpretation report includes the similarity analysis of real-time logs and historical faults, inference of potential fault types, and assessment of the probability of occurrence.

[0017] Compared with the prior art, the present invention has the following beneficial effects: This invention acquires historical log data tagged with faults and encodes it into feature vectors, constructing a vector knowledge base with fault tags. This enables the fault retrieval process to compare against historical real fault features. Because it uses labeled historical logs and corresponding feature vectors, the retrieval results directly correspond to actual fault scenarios, thus improving the reliability of fault symptom judgment and avoiding the problem of traditional rule-based methods failing to cover complex fault modes. This invention acquires power information system logs in real time and converts them into feature vectors. Retrieving these vectors through the vector knowledge base allows for direct similarity judgment with historical fault features at the time of log generation, quickly identifying potential fault symptoms. Since the retrieval results are directly based on the similarity of the vector space, they more accurately reflect the semantic closeness of the logs. Compared to methods relying on fixed rules or keywords, this is more effective in identifying situations where semantic expressions are inconsistent but the essential faults are the same, thereby improving early warning accuracy. This invention parses the historical fault logs corresponding to the retrieval results to obtain historical fault context information. This historical fault context information is then combined with real-time logs to form an enhanced context, allowing interpretation generation to no longer rely on a single log entry but rather on reasoning based on the joint semantics of real-time information and historical fault scenarios. This processing method provides sufficient contextual basis for the generated fault warning probability explanation report, ensuring consistency between the explanation content and the actual fault cause, thereby improving the credibility of the explanation results. This invention expands the warning process from simply whether there are fault symptoms to what those symptoms are and why they occur, by generating explanation reports based on enhanced context. The results not only include fault judgment but also explanations of the fault symptoms and similar historical scenarios, enabling maintenance personnel to understand the alarm triggering logic and facilitating judgment and handling in actual engineering projects. In summary, this invention, through a vector knowledge base with fault tags, real-time feature vector retrieval, and enhanced context-based explanation generation, enables the fault warning process to simultaneously possess accuracy, interpretability, and engineering practicality, effectively overcoming the shortcomings of existing technologies in complex power log scenarios where it is difficult to balance warning performance and explanation quality. Attached Figure Description

[0018] Figure 1 This is a flowchart of the present invention; Figure 2 This is a system diagram of the present invention; Figure 3 This is a flowchart of Example 5; Figure 4 A schematic diagram of the log encoding neural network (Transformer architecture); Figure 5 This is a schematic diagram of the HNSW algorithm similarity retrieval process; Figure 6 This is a diagram illustrating the generation and output of early warning interpretation reports; Figure 7 This is a schematic diagram of the system in Example 6. Detailed Implementation

[0019] To further understand the content of this invention, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments are merely illustrative and not limiting of the invention.

[0020] Example 1: See Figure 1 A method for fault early warning and interpretation in power information systems based on the RAG framework includes the following steps: S1. Obtain historical information specific to the power information system field, analyze the historical information system log data with fault labels, encode the historical information system log data with fault labels into feature vectors, and construct a vector knowledge base with fault labels.

[0021] S2: Real-time acquisition of power information system logs, conversion of power information system logs into feature vectors, retrieval of feature vectors in a vector knowledge base, determination of whether fault signs exist based on retrieval results, and acquisition of historical fault logs related to fault signs if fault signs exist.

[0022] S3 parses the historical fault logs to obtain historical fault context information, combines the historical fault context information with the corresponding power information system logs to form an enhanced context, and generates a power information system fault early warning probability explanation report based on the enhanced context.

[0023] Example 2: See Figure 2 A power information system fault early warning and interpretation system based on the RAG framework, including: The knowledge base construction module is used to acquire historical information specific to the power information system field, analyze the historical information system log data with fault labels, encode the historical information system log data with fault labels into feature vectors, and construct a vector knowledge base with fault labels.

[0024] The fault log acquisition module is used to acquire power information system logs in real time, convert the power information system logs into feature vectors, search the feature vectors in the vector knowledge base, determine whether there are fault symptoms based on the search results, and if there are fault symptoms, acquire historical fault logs related to the fault symptoms.

[0025] The report generation module is used to parse historical fault logs to obtain historical fault context information, combine the historical fault context information with the corresponding power information system logs to form an enhanced context, and generate a power information system fault early warning probability explanation report based on the enhanced context.

[0026] Example 3: This embodiment comprises four stages: vector knowledge base construction, real-time log vector retrieval, similarity calculation, and context enhancement and interpretation generation. Its main steps are as follows: Step 1: Obtain historical information specific to the power information system domain. Train a log encoding neural network specific to the power information system domain using supervised learning. Process the historical information specific to the power information system domain using the log encoding neural network to obtain historical system log data with fault labels. Each historical system log data with fault labels includes a log text sequence and a fault category label. Based on the fault labels in the historical system log data, perform special classification labeling on the log text sequence. Concatenate the log text sequence with the special classification label and input it into the Transformer model to obtain the final hidden state corresponding to the special classification label, which serves as the global feature vector of the log text sequence. Use a vector library to index the global feature vector of the log text sequence to construct a vector knowledge base with fault labels. During Transformer model training, a preset initial Transformer model is used. Supervised fine-tuning of the preset Transformer model is performed using historical system log data with fault labels, and the parameters of the preset Transformer model are optimized using the cross-entropy loss function to obtain the final Transformer model.

[0027] The Transformer model works as follows: The input layer receives a log text sequence, segments it into sub-word sequences, and converts these sub-word sequences into vectors of the target dimension using an embedding matrix, adding positional encoding to provide sequence order information. The encoder layer consists of several identical encoder blocks stacked together, each containing a multi-head self-attention mechanism layer. The multi-head self-attention mechanism is used to calculate and weight the vectors with added positional encodings. The feedforward neural network layer uses two linear transformations, where the ReLU activation function is used to perform residual connections and layer normalization on the weighted fused vectors. The output layer selects an output vector with a special classification label as the global feature vector of the log text sequence.

[0028] Step two: During system operation, real-time power information system logs are acquired. A Transformer model is used to convert these logs into feature vectors, and a hierarchical navigation small-world graph algorithm is employed to calculate the similarity of these feature vectors within a vector knowledge base. Specifically, after acquiring the feature vectors, a cosine similarity metric is used to quantify the correlation between the real-time feature vectors and historical feature vectors in the vector knowledge base. Based on the mean correlation between the real-time and historical feature vectors, combined with the standard deviation and adjustment coefficient, a dynamic similarity threshold for each feature vector is obtained. The similarity of each feature vector is then filtered based on this threshold. Subsequently, the similarity scores of each feature vector are sorted in descending order, and the results with the desired relevance are selected as the search results. The search results are used to determine if any fault symptoms exist. If fault symptoms are found, historical fault logs related to those symptoms are retrieved.

[0029] Step three involves parsing historical fault logs after acquisition to obtain historical fault context information. This historical fault context information is then combined with the corresponding power information system logs to form an enhanced context. A preset prompt word template is used to format the enhanced context, resulting in the target enhanced context. A large language model is then used to process the target enhanced context, generating a power information system fault early warning probability interpretation report. The power information system fault early warning probability interpretation report includes similarity analysis between real-time logs and historical faults, inference of potential fault types, and assessment of the probability of occurrence.

[0030] Through the above steps, this embodiment can realize real-time fault symptom identification and interpretation generation from power information system logs. By combining Transformer encoding, vector knowledge base retrieval, hierarchical navigation small world graph similarity calculation, and large language model context enhancement analysis, it can realize power information system fault early warning and interpretation based on the RAG framework.

[0031] Example 4: This embodiment includes three steps: constructing a fault feature vector knowledge base, real-time log vectorization and similarity retrieval, and generating early warning interpretations based on the RAG architecture. Real-time fault early warnings and interpretations are generated through the Transformer language model, vector database, hierarchical navigation small world graph algorithm, and large language model.

[0032] I. Construction of Fault Feature Vector Knowledge Base: Historical information specific to the power information system domain is acquired, and a log encoding neural network specific to the power information system domain is trained using supervised learning. The historical information specific to the power information system domain is then processed by the log encoding neural network to obtain historical information system log data with fault labels. Each historical information system log data with fault labels includes a log text sequence and a fault category label.

[0033] When constructing the fault feature vector knowledge base, a pre-trained language model based on the Transformer architecture is used as the basic model architecture, and supervised fine-tuning training is performed using a fault-labeled power information system log dataset. First, a historical log dataset D with fault labels is collected, where each sample in D consists of log text. and corresponding fault category labels This component provides labeled samples for supervised learning of log coding neural networks, ensuring that the model can learn the correspondence between "log text and fault category" and avoid the problem of inaccurate fault feature capture caused by unlabeled data.

[0034] Then the log text sequence With special classification marks After concatenation, the data is input into a Transformer model, processed through multiple encoders, and finally obtained. Mark the corresponding final hidden state It serves as a global feature representation of the entire log sequence. Its acquisition process is as follows:

[0035] Wherein, [CLS] represents the classification marker placed at the beginning of the sequence. This represents the i-th token in the input sequence. For model parameters, This is the output d-dimensional feature vector.

[0036] The global feature vectors of the log text sequence are input into a vector database, and an index is built using the vector database to construct a vector knowledge base with fault labels. The indexing format of the vector knowledge base adopts Faiss to achieve efficient similarity retrieval.

[0037] Supervised fine-tuning of the Transformer model was performed, using the cross-entropy loss function to optimize the parameters:

[0038] Where N is the number of samples and M is the number of fault categories. Let i be the true label of sample i in category c. To predict probabilities.

[0039] Furthermore, a hierarchical learning rate scheduling strategy is adopted:

[0040] in, Let l be the learning rate of the l-th layer. Based on the learning rate, This is the attenuation coefficient.

[0041] The cross-entropy loss function is an improved form with class weights:

[0042] in, The system is set inversely based on the number of samples in each category to improve the ability to identify fault categories with fewer samples.

[0043] II. Architecture and Feature Vector Generation of Transformer Encoding Networks: Log-encoding neural networks are based on the Transformer architecture, which consists of four layers: an input embedding layer, an encoder layer, a feedforward neural network layer, and an output layer. The processing flow is as follows: The input layer receives a sequence of tokens. Sub-word sequences are obtained through word segmentation. Transformed into a dimension of through word embedding matrix The vector representation, with added positional encoding:

[0044]

[0045] Ensure that sequence order information is not lost.

[0046] The encoder layer consists of N identical encoder blocks stacked together. Each block contains a multi-head self-attention mechanism, which is calculated as follows:

[0047] in:

[0048] The feedforward neural network layer uses two linear transformations, and the calculation formula is as follows:

[0049] Residual connections and layer normalization are then performed.

[0050] Output layer The corresponding output vector serves as the global semantic representation of the sequence:

[0051] This vector serves as a unified feature carrier for subsequent vector retrieval.

[0052] III. Real-time Log Vectorization and Similarity Retrieval: The log encoding neural network, after being trained, converts real-time collected log text into feature vectors. The process is as follows:

[0053] in, .

[0054] Vector Database The storage format is as follows:

[0055] in, For historical feature vectors, For historical log text, For fault labels (normal, fault type A, fault type B, etc.) For timestamps, Metadata such as device identifiers and system component information.

[0056] Similarity retrieval was performed using the Hierarchical Navigable Small World (HNSW) algorithm, with cosine similarity as the metric.

[0057] The dynamic similarity threshold is:

[0058] The search results are sorted in descending order of similarity, and the top K results are selected:

[0059] If it exists If so, it is determined that there are signs of a fault in the current real-time log.

[0060] HNSW graph construction uses the parameter efConstruction (the number of candidate neighbors during graph index construction), whose optimal value is obtained through grid search:

[0061] The significance of the similarity threshold was verified by a one-sample t-test:

[0062] IV. Early Warning Interpretation Generation Based on RAG Architecture: Combine real-time log content with retrieved historical fault context to create an enhanced context:

[0063] Where q represents the real-time log text. For historical log text, Fault type Here, m represents the similarity score, and m represents metadata.

[0064] Use structured prompt templates:

[0065] Where s stands for "You are a power information system operation and maintenance expert", q stands for real-time log, c stands for enhanced context, and [SYS], [USR], [CTX], and [ANS] are separators.

[0066] The large language model generates a fault early warning probability explanation report for power information systems based on enhanced context. The report includes similarity analysis of real-time logs and historical faults, inference of potential fault types, and assessment of the probability of occurrence.

[0067] Example 5: See Figure 3 This implementation example includes three steps: constructing a fault feature vector knowledge base, real-time log vectorization and similarity retrieval, and generating early warning interpretations based on the RAG architecture. It combines a log-encoded neural network based on the Transformer architecture, a vector database, a hierarchical navigation small world graph algorithm (HNSW), and a large language model to realize early warning and interpretation of faults in the power information system.

[0068] Step 1: Collect historical log data with fault labels generated during the operation of the power information system to construct a historical log dataset, denoted as D. Each sample in this dataset D consists of two parts: one is the log text. The first part includes operational logs from various sources such as servers, databases, and network components; the second part includes fault category tags corresponding to the log text. .

[0069] Therefore, each sample in dataset D can be represented as This provides labeled samples for supervised learning of log coding neural networks, ensuring that the model can learn the correspondence between "log text and fault category" and avoid the problem of inaccurate fault feature capture due to unlabeled data.

[0070] In this embodiment, a pre-trained language model based on the Transformer architecture is used as the basic model architecture, and supervised fine-tuning training is performed using the power information system log dataset D with fault labels.

[0071] In this embodiment, the log coding neural network employs, as follows: Figure 4The Transformer architecture shown above extracts semantic features from log text through a four-layer structure consisting of an input embedding layer, an encoder layer, a feedforward neural network layer, and an output layer. Its specific working principle and implementation process are as follows: The first step is processing the input embedding layer, starting with the log text. Perform word segmentation to obtain a sequence of subwords. Where n is the number of sub-words, adjusted according to the log length; then special category tags are added. Joined to the beginning of the sub-word sequence, forming:

[0072] The role of [CLS] is to aggregate the global semantic information of the entire log sequence, providing a unified "sequence representative" for subsequent feature extraction.

[0073] Subsequently, the sub-word sequence is transformed into a sequence with dimension 1 using a word embedding matrix. The vector representation of the word embedding is added, along with positional encoding to supplement sequence order information. The formula for calculating the positional encoding is:

[0074]

[0075] Where pos represents the position of the word in the sequence, and i represents the vector dimension index. This represents the dimension of the model's hidden layers. By adding word embeddings and positional encodings, an input vector representation containing semantic and sequential information is obtained, ensuring that the sequence information of the log text is not lost and improving the semantic accuracy of subsequent feature extraction.

[0076] The encoder layer consists of N identical encoder blocks stacked together (N can be adjusted according to the model accuracy requirements, usually taken as 12). The core of each encoder block is a multi-head self-attention mechanism, the calculation process of which is as follows:

[0077] The formula for calculating a single attention head is:

[0078] In the above formula, Q, K, and V represent the query, key, and value matrices, respectively. , , This is the corresponding projection weight matrix. The output projection matrix is ​​used. Multi-head self-attention mechanisms capture key patterns and anomalous signals in logs by modeling intra-sequence correlations in different subspaces.

[0079] The feedforward neural network layer performs a nonlinear transformation on the output of the encoder layer, and the calculation formula is as follows:

[0080] in, , The weight matrix is ​​the linear transformation matrix. , This is the bias vector. Feedforward neural network layers are often used in conjunction with residual connections and layer normalization to enhance the model's ability to learn features of "low-frequency, complex" faults and avoid overfitting during model training.

[0081] The output layer extracts the final hidden state corresponding to the [CLS] marker in the input sequence as the global feature representation of the entire log sequence. The calculation formula is as follows:

[0082] in, For all parameters of the Transformer model, d represents the dimension of the feature vector. This vector serves as both a global feature representation of the log text and a unified "semantic carrier" for subsequent fault classification and vector retrieval.

[0083] Using the previously constructed fault-labeled historical log dataset D, the Transformer model is subjected to supervised fine-tuning to optimize its parameters. To avoid excessive modification of the underlying general semantic features of the pre-trained model, a hierarchical learning rate scheduling method is employed, calculated using the following formula:

[0084] in, Let l be the learning rate of the l-th layer of the model. Based on the learning rate, This represents the learning rate decay coefficient. The learning rate is smaller in the lower layers of the model (closer to the input layer) to preserve general semantic extraction capabilities; the learning rate is larger in the upper layers of the model (closer to the output layer) to quickly adapt to the log features of the power information system domain.

[0085] Considering the imbalance in sample size between "normal logs" and "fault logs" and among different fault types in power fault logs, a cross-entropy loss function with class weights is used to optimize the model. The calculation formula is as follows:

[0086] Where N is the total number of samples, The category to which the i-th sample belongs The weight, For the model to determine the category to which the i-th sample belongs The predicted probability. By assigning higher weights to fault types with smaller sample sizes, the model's accuracy in identifying these faults can be improved, alleviating the class imbalance problem.

[0087] After fine-tuning, all historical log texts are input into the trained log encoding neural network and converted into feature vectors of fixed dimension d. That is, for any log text... To obtain its corresponding global feature vector .

[0088] Subsequently, a Faiss index was built using a vector database to index these feature vectors. The index type was chosen to support efficient similarity retrieval, and a vector knowledge base with fault labels was constructed. The vector database used to store historical log feature vectors and associated information is denoted as [reference needed]. The structure of each record is as follows:

[0089] in: The feature vector of the historical log; Historical log text; For fault labels, L = {Normal, Fault Type A, Fault Type B, Fault Type C, ...}; For timestamps; This is metadata, which includes device identifiers and system component information.

[0090] Step 2: Real-time log vectorization and similarity retrieval.

[0091] Real-time acquisition of operational logs from the power information system (including logs from servers, databases, network devices, and other components) is performed. For each real-time log entry, the same word segmentation and [CLS] tagging operations as in "historical log preprocessing" are executed. The log encoding neural network trained in step one is then input, and the output is a feature vector of the real-time log. The calculation formula is as follows:

[0092] in, This represents the trained log-encoding neural network (parameters) (This is already fixed), log represents real-time log text. This is the feature vector of the real-time log.

[0093] See Figure 5 Next, the Hierarchical Navigation Small World Graph (HNSW) algorithm is used in the vector database. In the context of real-time log feature vectors Similarity retrieval is performed. The HNSW algorithm works by constructing a multi-layer graph structure to achieve efficient retrieval: the upper graph is the "coarse search layer," containing a small number of nodes, used to quickly locate candidate retrieval regions; the lower graph is the "fine search layer," containing all nodes, used to accurately filter high-similarity vectors within the candidate regions.

[0094] The similarity metric uses cosine similarity. With historical vectors The semantic similarity is calculated using the following formula:

[0095] in, The dot product of two vectors. , These are the magnitudes of the two vectors, respectively.

[0096] To avoid false alarms or missed alarms caused by fixed thresholds, dynamic similarity thresholds are set based on the distribution characteristics of historical similarity data. The calculation formula is:

[0097] in, The average of historical similarity data. Standard deviation The range of values ​​for adjusting the coefficients can be configured according to the required operational accuracy. Threshold It supports adaptive adjustment to adapt to changes in log data distribution. The adjustment formula is as follows:

[0098] in, Let be the threshold at time t. To adjust the learning rate, Let be the retrieval recall rate at time t-1, and target be the preset target recall rate.

[0099] All historical vectors and The similarity scores are sorted in descending order, and the top K most relevant results are selected to form the result set:

[0100] in, Let be the similarity score for the i-th result, and .

[0101] The fault symptom judgment logic is as follows: If there exists any result in the result set R that satisfies... If the current real-time log shows no signs of failure, it is determined that there are signs of failure; otherwise, it is determined that there are no signs of failure, thus realizing real-time fault risk identification based on historical fault patterns.

[0102] In the HNSW algorithm, the core parameter efConstruction is determined through a grid search: traversing the range [100, 500] with a step size of 50, and... The score is the objective function:

[0103] Select to make The efConstruction value with the highest score is used as the optimal parameter to balance index building efficiency and retrieval accuracy, ensuring that the index quality meets the fault retrieval requirements of the power information system.

[0104] Similarity threshold The statistical significance can be verified based on a one-sample t-test, and the test statistic is calculated as follows:

[0105] in, The sample mean of the historical similarity distribution. Let n be the sample standard deviation and n be the sample size. When the calculated p-value is less than the significance level... At that time, the null hypothesis was rejected, and the threshold setting was considered statistically significant.

[0106] Step 3: Generate warning interpretations based on the RAG architecture.

[0107] See Figure 6 First, the real-time log content, retrieved historical fault context information, and metadata are combined into an enhanced context according to a preset format, defined as follows:

[0108] Where q is the raw text of the real-time log; The i-th historical fault information retrieved in step two includes historical log text. Fault type Similarity score ;m represents the metadata of the real-time log, including device identifier, acquisition time, system components, etc. By introducing historical fault cases and device context information, the historical fault experience of the general large language model in the field of power information systems is enriched, improving the accuracy and credibility of subsequent interpretation reports.

[0109] Structured prompting engineering techniques are employed to design specialized prompt word templates for formatting enhanced context. The template construction function is as follows:

[0110] Wherein: [SYS] is the system role field, containing the role setting instruction s, used to set "the large language model to act as an operation and maintenance expert of the power information system"; [USR] is the user input field, containing the real-time log text q; [CTX] is the context field, containing the formatted enhanced context c; [ANS] is the output format field, which specifies the output structure of the large language model.

[0111] The formatted prompt words, i.e., the output of T(s,q,c), are input into the large language model. The large language model then performs inference based on the enhanced context (covering real-time log details, historical fault case features, equipment and time metadata) to generate a power information system fault early warning probability explanation report.

[0112] The generated power information system fault early warning probability interpretation report shall include at least the following: similarity analysis between real-time logs and historical faults, inference of potential fault types, and assessment of the probability of fault occurrence.

[0113] The final interpretation report can be directly provided to maintenance personnel, providing timely and reliable interpretation basis for fault diagnosis and handling, thereby improving the maintainability and fault handling efficiency of the power information system.

[0114] Example 6: See Figure 7 The present invention also provides an electronic device 100 for a power information system fault early warning and interpretation method based on the RAG framework; the electronic device 100 includes a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on the at least one processor 102, and at least one communication bus 104.

[0115] The memory 101 can be used to store the computer program 103. The processor 102 implements the steps of the power information system fault early warning and interpretation method based on the RAG framework described in Embodiment 1 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101. The memory 101 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device 100 (such as audio data), etc. In addition, the memory 101 may include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other non-volatile solid-state storage device.

[0116] The at least one processor 102 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor. The processor 102 is the control center of the electronic device 100, connecting various parts of the electronic device 100 via various interfaces and lines.

[0117] The memory 101 in the electronic device 100 stores multiple instructions to implement a power information system fault early warning and interpretation method based on the RAG framework, and the processor 102 can execute the multiple instructions to achieve the following: Acquire historical information specific to the power information system field, analyze it to obtain historical information system log data with fault labels, encode the historical information system log data with fault labels into feature vectors, and construct a vector knowledge base with fault labels; The system acquires power information system logs in real time, converts the logs into feature vectors, retrieves the feature vectors in a vector knowledge base, determines whether there are fault signs based on the retrieval results, and if there are fault signs, retrieves historical fault logs related to the fault signs. Historical fault logs are parsed to obtain historical fault context information. This historical fault context information is then combined with the corresponding power information system logs to form an enhanced context. Based on this enhanced context, a power information system fault early warning probability explanation report is generated.

[0118] Example 7: If the modules / units integrated in the electronic device 100 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0119] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0120] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0121] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0122] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A method for fault early warning and interpretation in power information systems based on the RAG framework, characterized in that, Includes the following steps: Acquire historical information specific to the power information system field, analyze it to obtain historical information system log data with fault labels, encode the historical information system log data with fault labels into feature vectors, and construct a vector knowledge base with fault labels; The system acquires power information system logs in real time, converts the logs into feature vectors, retrieves the feature vectors in a vector knowledge base, determines whether there are fault signs based on the retrieval results, and if there are fault signs, retrieves historical fault logs related to the fault signs. Historical fault logs are parsed to obtain historical fault context information. This historical fault context information is then combined with the corresponding power information system logs to form an enhanced context. Based on this enhanced context, a power information system fault early warning probability explanation report is generated.

2. The method for fault early warning and interpretation of power information systems based on the RAG framework according to claim 1, characterized in that, The specific method for acquiring historical information specific to the power information system field, analyzing it to obtain historical information system log data with fault tags, encoding the historical information system log data with fault tags into feature vectors, and constructing a vector knowledge base with fault tags is as follows: To acquire historical information specific to the power information system field, a log encoding neural network specific to the power information system field is trained using supervised learning. By processing historical information specific to the power information system through a log coding neural network dedicated to the power information system field, historical information system log data with fault labels is obtained. Each historical information system log data with fault labels includes a log text sequence and a fault category label. Based on the fault labels in historical information system log data, the log text sequence is specially classified and labeled; The log text sequence is concatenated with a special classification label and then input into the Transformer model to obtain the final hidden state corresponding to the special classification label, which serves as the global feature vector of the log text sequence. A vector knowledge base with fault labels is obtained by indexing the global feature vectors of log text sequences using a vector library. During Transformer model training, an initial Transformer model is preset, and supervised fine-tuning is performed on the initial Transformer model using historical information system log data with fault labels. The parameters of the preset Transformer model are optimized using the cross-entropy loss function to obtain the Transformer model.

3. The method for fault early warning and interpretation of power information systems based on the RAG framework according to claim 2, characterized in that, The default working method of the Transformer model is as follows: The input layer receives a sequence of log text, segments the log text sequence into words, and obtains a sequence of sub-words. The word sequence is converted into a vector of the target dimension through an embedding matrix, and positional encoding is added to provide sequence order information; The encoder layer consists of several identical encoder blocks stacked together. Each encoder block contains a multi-head self-attention mechanism layer, which uses the multi-head self-attention mechanism to calculate and weight the vectors with added positional encodings for fusion. The feedforward neural network layer uses two linear transformations, where the weighted fused vector is subjected to residual connections and layer normalization through the ReLU activation function. The output layer selects the output vector with a special classification label as the global feature vector of the log text sequence.

4. The method for fault early warning and interpretation of power information systems based on the RAG framework according to claim 1, characterized in that, The process involves real-time acquisition of power information system logs, conversion of these logs into feature vectors, retrieval of these feature vectors in a vector knowledge base, and determination of fault symptoms based on the retrieval results. If fault symptoms are found, the specific method for obtaining historical fault logs related to these symptoms is as follows: Real-time acquisition of power information system logs; and conversion of power information system logs into feature vectors using the Transformer model. The hierarchical navigation small-world graph algorithm is used to calculate the similarity of feature vectors in the vector knowledge base to obtain the similarity of each feature vector; The similarity of each feature vector is sorted in descending order, and the results with the desired relevance are selected as the search results. Based on the search results, determine whether there are any signs of a fault. If there are signs of a fault, retrieve the historical fault logs related to those signs.

5. The method for fault early warning and interpretation of power information systems based on the RAG framework according to claim 4, characterized in that, The hierarchical navigation small-world graph algorithm is used to calculate the similarity of feature vectors in a vector knowledge base. The specific method for obtaining the similarity of each feature vector is as follows: The feature vectors are obtained, and the cosine similarity metric is used to quantify the correlation between the real-time feature vectors and the historical feature vectors in the vector knowledge base. Based on the mean correlation between real-time and historical feature vectors, combined with the standard deviation and adjustment coefficient, a dynamic similarity threshold for each feature vector is obtained. The similarity of each feature vector is then filtered according to the dynamic similarity threshold.

6. The method for fault early warning and interpretation of power information systems based on the RAG framework according to claim 1, characterized in that, The specific method for parsing historical fault logs to obtain historical fault context information, combining the historical fault context information with the corresponding power information system logs to form an enhanced context, and generating a power information system fault early warning probability interpretation report based on the enhanced context is as follows: Obtain historical fault logs, parse the historical fault logs, and obtain historical fault context information; The historical fault context information is combined with the corresponding power information system log to form an enhanced context. The enhanced context is then formatted using a preset prompt word template to obtain the target enhanced context. A large language model is used to process the target enhanced context to generate a power information system fault early warning probability interpretation report. The power information system fault early warning probability interpretation report includes the similarity analysis of real-time logs and historical faults, inference of potential fault types, and assessment of the probability of occurrence.

7. A power information system fault early warning and interpretation system based on the RAG framework, characterized in that, include: The knowledge base construction module is used to acquire historical information specific to the power information system field, analyze the historical information system log data with fault labels, encode the historical information system log data with fault labels into feature vectors, and construct a vector knowledge base with fault labels. The fault log acquisition module is used to acquire power information system logs in real time, convert the power information system logs into feature vectors, search the feature vectors in the vector knowledge base, determine whether there are fault symptoms based on the search results, and if there are fault symptoms, acquire historical fault logs related to the fault symptoms. The report generation module is used to parse historical fault logs to obtain historical fault context information, combine the historical fault context information with the corresponding power information system logs to form an enhanced context, and generate a power information system fault early warning probability explanation report based on the enhanced context.

8. The power information system fault early warning and interpretation system based on the RAG framework according to claim 7, characterized in that, The functionality of the knowledge base building module is implemented through the following methods: To acquire historical information specific to the power information system field, a log encoding neural network specific to the power information system field is trained using supervised learning. By processing historical information specific to the power information system through a log coding neural network dedicated to the power information system field, historical information system log data with fault labels is obtained. Each historical information system log data with fault labels includes a log text sequence and a fault category label. Based on the fault labels in historical information system log data, the log text sequence is specially classified and labeled; The log text sequence is concatenated with a special classification label and then input into the Transformer model to obtain the final hidden state corresponding to the special classification label, which serves as the global feature vector of the log text sequence. A vector knowledge base with fault labels is obtained by indexing the global feature vectors of log text sequences using a vector library. During Transformer model training, an initial Transformer model is preset, and supervised fine-tuning is performed on the initial Transformer model using historical information system log data with fault labels. The parameters of the preset Transformer model are optimized using the cross-entropy loss function to obtain the Transformer model.

9. The power information system fault early warning and interpretation system based on the RAG framework according to claim 7, characterized in that, The functionality of the fault log acquisition module is implemented through the following methods: Real-time acquisition of power information system logs; and conversion of power information system logs into feature vectors using the Transformer model. The hierarchical navigation small-world graph algorithm is used to calculate the similarity of feature vectors in the vector knowledge base to obtain the similarity of each feature vector; The similarity of each feature vector is sorted in descending order, and the results with the desired relevance are selected as the search results. Based on the search results, determine whether there are any signs of a fault. If there are signs of a fault, retrieve the historical fault logs related to those signs.

10. The power information system fault early warning and interpretation system based on the RAG framework according to claim 7, characterized in that, The report generation module's functionality is implemented using the following methods: Obtain historical fault logs, parse the historical fault logs, and obtain historical fault context information; The historical fault context information is combined with the corresponding power information system log to form an enhanced context. The enhanced context is then formatted using a preset prompt word template to obtain the target enhanced context. A large language model is used to process the target enhanced context to generate a power information system fault early warning probability interpretation report. The power information system fault early warning probability interpretation report includes the similarity analysis of real-time logs and historical faults, inference of potential fault types, and assessment of the probability of occurrence.

Images