Filtering method and system based on same-site alarm aggregation

Abstract

The present application relates to the technical field of alarm aggregation, in particular to a filtering method and system based on same-site alarm aggregation, in the present application, the non-closed main alarm cluster and the historical closed main alarm cluster jointly participate in state comparison, the trigger state, the recovery state and the upgrade / downgrade state form a repeated fault sequence voucher according to state interval, sequence number and level change direction, the Viterbi algorithm is used to select the state chain corresponding to the trigger observation state, the recovery observation state, the repeated trigger observation state, the level change observation state and the recovery failure observation state, the Dijkstra algorithm is used to select the value of the candidate path between the root node, the intermediate node, the terminal node and the recovery node, the type consistent value, the level gap value and the interval gear value jointly participate in path comparison, the number of repeated display, repeated forwarding and repeated dispatching is reduced with the registration of the merged voucher, and the fault process tracing range is expanded from discrete alarms to the internal state, path, window and filtering reason of the main alarm cluster.

Description

Technical Field

[0001] This invention relates to the field of alarm aggregation technology, and in particular to a filtering method and system based on alarm aggregation at the same location. Background Technology

[0002] The field of alarm aggregation technology aims to merge, deduplicatize, compress, and associate multiple alarm messages generated by the same device, the same location, the same event source, or the same faulty link. This reduces the number of duplicate alarms, lowers the pressure on the alarm platform for display, forwarding, and dispatching, and transforms the alarm processing object from multiple discrete alarm records into a traceable main alarm or alarm cluster, thereby improving alarm identification efficiency, handling efficiency, and consistency of fault location.

[0003] The purpose of a filtering method based on alarm aggregation at the same location is to aggregate and determine multiple duplicate alarms generated at the same location within a set time window, and to filter duplicate alarms covered by the main alarm, thereby reducing the number of alarms received, displayed, forwarded and dispatched by the alarm platform, avoiding the generation of multiple processing tasks at the same fault location, and thus improving the efficiency of alarm handling and the consistency of fault process traceability.

[0004] Existing technologies typically perform merging, deduplication, compression, and correlation merging around the same device, the same location, the same event source, and a set time window. In actual operation, the alarm reception time, event source identifier, and location field are often used as the main judgment boundaries. The processing object is biased towards single discrete alarm records. When the set time window is too narrow, the same location may experience intermittent processes such as triggering, recovery, re-triggering, and re-recovery. Subsequent trigger records are prone to deviating from the previous main alarm, forming new display items, new forwarding items, and new dispatch items. Furthermore, existing technologies are ineffective in scenarios where multiple alarms propagate from the same source. In the process, alarms are often compressed based on the same type, location, and time. There is a lack of a registerable link sequence between root cause alarms, intermediate alarms, terminal alarms, and recovery alarms. In scenarios with a large number of high-frequency and repetitive reports, if the filtering criteria rely solely on the equality of fixed fields, differences in serial numbers, batch numbers, and receiving queues will result in duplicate records. The display queue, forwarding queue, and dispatch queue carry multiple tasks from the same source, increasing the number of alarm handling objects. Fault process tracing requires splicing across multiple records, and the operation and maintenance closed-loop records are prone to duplication, omissions, and inconsistencies in attribution. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by proposing a filtering method and system based on the aggregation of alarms at the same location.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a filtering method based on the aggregation of alarms at the same location, comprising the following steps:

[0007] S1: Based on the alarm entry of the intelligent patrol system, extract the location index, equipment index, alarm category, direction code, level, and window number, remove the serial number and batch number, and splice the location index and alarm category to establish a clustered index for the same location;

[0008] S2: Based on the same location aggregation index, retrieve the unclosed main alarm cluster and the historical closed main alarm cluster, arrange the trigger state, recovery state, and escalation / demotion state, and use the Viterbi algorithm to compare the state interval, sequence number, and level change direction to obtain the duplicate fault sequence certificate.

[0009] S3: Based on the repeated fault sequence credentials, aggregate the triggered observation state, recovery observation state, repeated triggered observation state, level change observation state, and recovery failure observation state, compare the transition probability with the output probability, select the state chain, and obtain the state window merging credentials;

[0010] S4: Based on the status window merging certificate, match the root cause node, intermediate node, terminal node, recovery node, propagation direction, and sequence number. Use Dijkstra's algorithm to accumulate the type consistency value, level difference value, and interval level value to obtain the fault link merging certificate.

[0011] S5: Based on the fault link merging certificate, summarize the main alarm number, subordinate alarm number, window expiration time, recovery waiting status, and lock status, sort the window nodes, register the number of repetitions, the most recent occurrence time, and the filter code, and obtain the main alarm cluster filter list.

[0012] As a further embodiment of the present invention, the same-location aggregation index includes a unique location code, a unique device code, an alarm category code, an alarm direction code, a level code, and an aggregation window code; the repeated fault sequence credential includes a historical fault sequence number, a current sequence number, a status sequence code, a status interval difference, a level change code, and a sequence matching value; the status window merging credential includes a status chain number, a main alarm cluster number, a window start timestamp, a window end timestamp, a closing waiting time, and a merging status code; the fault link merging credential includes a fault template number, a root cause node number, an end node number, a merging path number, a path cost value, and a link blocking code; and the main alarm cluster filtering list includes a main alarm cluster number, a subordinate alarm number, a repeated count value, a most recent occurrence timestamp, a highest level code, and a filtering reason code.

[0013] As a further aspect of the present invention, the specific steps for generating the same-location aggregation index are as follows:

[0014] Based on the alarm entry point of the intelligent patrol system, extract the point index, device index, interval number, alarm category, direction code, level, and window number; delete the serial number, batch number, and receiving queue number; verify the binding relationship between the point index and the device index; mark the alarm record of the same point under the same device; and obtain the alarm aggregation field set.

[0015] Based on the alarm aggregation field set, the point index, device index, alarm category, direction code, level, and window number are concatenated. The consistency relationship between alarm category and direction code under the same window number is compared, and duplicate fields under the same point index are merged to create a same point aggregation index.

[0016] As a further aspect of the present invention, the specific steps for generating the duplicate fault sequence certificate are as follows:

[0017] Based on the same location aggregation index, retrieve the unclosed main alarm clusters and historical closed main alarm clusters, verify the consistency of the location index, device index, alarm category, direction code, level, and window number, remove records of main alarm clusters with status of abandoned, transferred, or canceled, and retain records of main alarm clusters with status of processing, recovery waiting, or closure confirmation, and generate a main alarm cluster reference set.

[0018] Based on the main alarm cluster reference set, the trigger state, recovery state, level increase state, level decrease state, confirmation failure state, and recovery failure state are extracted, the state positions are arranged according to the time of occurrence, the interval value between adjacent states is calculated, and the direction from trigger state to recovery state, the direction from level increase state to level decrease state, and the position of recovery failure state are marked to obtain the alarm state difference table.

[0019] Based on the alarm status difference table, the Viterbi algorithm is used to compare the current status position with the historical status position, compare the adjacent status interval value with the interval threshold, compare the consistent value of the level change direction, exclude the status inversion record, the over-threshold interval record, and the level direction conflict record, select the matching sequence number, the historical main alarm cluster number, the status position number, and the level change code to obtain the duplicate fault sequence certificate.

[0020] As a further aspect of the present invention, the Viterbi algorithm first sets the hidden state set as stable state, anomaly initiation state, fault persistence state, oscillation recovery state, and fault closure state, and sets the observation state set as triggered state, recovery state, repeated triggered state, level increase state, level decrease state, and recovery failure state. It then calls the current state position, adjacent state interval value, level change direction consistency value, state transition probability table, and observation output probability table from the alarm state difference table, and establishes a time column in ascending order of state occurrence time. At the first time, the initial probability of each hidden state is multiplied by the corresponding observation state output probability to obtain the state probability value in the first column. At subsequent time points, the probability values ​​of each hidden state at the previous time point and the transition probability from the previous hidden state to the current candidate hidden state are calculated respectively. The probability of the observed state corresponding to the current candidate hidden state is multiplied by the probability of the current candidate hidden state to obtain multiple candidate path probability values. The probability value of the first candidate path ranked numerically is selected and written into the probability field of the current candidate hidden state. The corresponding previous hidden state number is written into the predecessor state field. The probability field and predecessor state field are registered step by step. At the last time step, the first hidden state ranked numerically is selected as the tail state. The predecessor state field is backtracked to the first time step to obtain the state chain number, tail state code, state sequence code in the chain, and cumulative probability value. If the tail state code is a fault closure state, a closure mark is written. If the tail state code is any of the abnormal initiation state, fault persistence state, or oscillation recovery state, a merging mark is written. The state chain selection field in the duplicate fault sequence certificate is generated.

[0021] As a further aspect of the present invention, the specific steps for generating the status window merging certificate are as follows:

[0022] Based on the repeated fault sequence certificate, the following are collected: trigger observation state, recovery observation state, repeated trigger observation state, level increase observation state, level decrease observation state, and recovery failure observation state. The observation state numbers are arranged in the order of occurrence of the state, and the interval value between adjacent observation states is recorded to obtain the alarm observation state group.

[0023] Based on the alarm observation state group, the transition probabilities between adjacent observation states are compared, the output probabilities between the observation state and the candidate state are compared, the state chain with the highest cumulative probability value is selected, the main alarm cluster number, window start point, window end point, and closing waiting period are bound, and the state window merging certificate is obtained.

[0024] As a further aspect of the present invention, the specific steps for generating the fault link merging certificate are as follows:

[0025] Based on the status window merging certificate, extract the main alarm cluster number, window start timestamp, window end timestamp, and merging status code; match the root cause node, intermediate node, end node, and recovery node; verify the consistency of node number, alarm category, location index, and window number; and generate a link node matching table.

[0026] Based on the link node matching table, the propagation direction from the root node to the intermediate node is compared, the sequence number from the intermediate node to the terminal node is compared, and the sequence number from the terminal node to the recovery node is compared. Blocking flags, allowed backoff nodes, and failed recovery nodes are identified. The type consistency value, level difference value, interval level value, source priority value, and template priority value are accumulated to obtain the merged path cost table.

[0027] Based on the merged path cost table, the Dijkstra algorithm is used to select the record with the lowest path cost. The sequence number of the new alarm node is compared with the highest confirmed sequence number of the main alarm cluster. It is determined whether the new alarm node triggers the blocking flag. The template number, root cause node number, end node number, node sequence number, merged path number, and link blocking code are registered to obtain the fault link merge certificate.

[0028] As a further aspect of the present invention, the Dijkstra algorithm first calls the template number, root cause node number, intermediate node number, terminal node number, recovery node number, node sequence number, propagation direction, blocking flag, type consistency value, level difference value, interval level value, source priority value, and template priority value from the merge path cost table. It then sets the confirmed nodes of the main alarm cluster as the starting node, the new alarm nodes as the target nodes, sets the accumulated cost value of the starting node to zero, and sets the accumulated cost value of the remaining nodes to null. It then reads the edges of adjacent nodes one by one according to the propagation direction, accumulates the type consistency value, level difference value, interval level value, source priority value, and template priority value to form the edge cost value, and sets the accumulated cost value of the starting node... The cumulative value of the neighboring node is obtained by adding the value of the neighboring node to the value of the neighboring node. When the cumulative value of the neighboring node is lower than the cumulative value of the neighboring node, the cumulative value of the neighboring node, the predecessor node number, and the merging path number are updated. When the blocking flag is in the triggered state, the extension of the corresponding edge is stopped. When the fallback node is allowed to be hit, the fallback node sequence number is retained. When the recovery failure node is hit, the recovery failure node number is registered. The nodes with the lower limit of the cumulative value in the undetermined node set are processed in a loop until the target node enters the determined node set. The node is backtracked to the starting node in reverse order according to the predecessor node number of the target node. The template number, root cause node number, end node number, node sequence number, merging path number, and link blocking code are registered to generate the fault link merging certificate.

[0029] As a further aspect of the present invention, the specific steps for generating the main alarm cluster filter list are as follows:

[0030] Based on the fault link merging certificate, the main alarm number, subordinate alarm number, merging path number, window expiration time, recovery waiting status, lock status, and fault closure status are summarized. The window expiration time is compared with the main alarm status to obtain the window handling field set.

[0031] Based on the window handling field set, window nodes are sorted in ascending order by window expiration time, the earliest expiring window node is selected, the locked state and the recovery waiting state are determined, the number of repetitions, the most recent occurrence time, the highest level code, the merge path number, and the filter code are recorded, and the main alarm cluster filter list is obtained.

[0032] A filtering system based on co-location alarm aggregation, wherein the filtering system based on co-location alarm aggregation is used to execute the above-described filtering method based on co-location alarm aggregation, the system comprising:

[0033] Index module: Based on the alarm entry of the intelligent patrol system, extract the location index, equipment index, alarm category, direction code, level, and window number, remove serial number and batch number, and establish an aggregated index for the same location;

[0034] Sequence module: Based on the same location aggregation index, retrieve the unclosed main alarm cluster and the historical closed main alarm cluster, arrange the trigger state, recovery state, and escalation / demotion state, and use the Viterbi algorithm to compare the state interval, sequence number, and direction of level change to obtain the duplicate fault sequence certificate;

[0035] Window module: Based on the repeated failure sequence credentials, it aggregates the triggered observation state, recovery observation state, repeated triggered observation state, level change observation state, and recovery failure observation state, compares the transition probability with the output probability, selects the state chain, and obtains the state window merging credentials;

[0036] Link module: Based on the status window merging certificate, match the root cause node, intermediate node, terminal node, recovery node, propagation direction, and sequence number, and use Dijkstra's algorithm to accumulate type consistency value, level difference value, and interval level value to obtain the fault link merging certificate;

[0037] Registration module: Based on the fault link merging certificate, it summarizes the main alarm number, subordinate alarm number, window expiration time, recovery waiting status, and lock status, sorts the window nodes, registers the number of repetitions, the most recent occurrence time, and the filter code, and obtains the main alarm cluster filter list.

[0038] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0039] In this invention, the location index, equipment index, alarm category, direction code, level, and window number are extracted from the alarm entry of the intelligent patrol system, and the serial number and batch number are removed. This allows the main alarm aggregation basis to shift from receiving records to stable fields such as location, equipment, category, direction, level, and window. When multiple records are generated for the same fault location due to differences in serial number or batch, they can be grouped into the same location aggregation index.

[0040] In this invention, unclosed main alarm clusters and historically closed main alarm clusters jointly participate in state comparison. Triggering state, recovery state, and escalation / deceleration state form repeated fault sequence credentials according to state interval, sequence number, and direction of level change. The Viterbi algorithm is used to select the corresponding state chains of triggering observation state, recovery observation state, repeated triggering observation state, level change observation state, and recovery failure observation state. The transition probability and output probability jointly limit the state window merging credentials, and the newly added alarm attribution, window boundary, and closing waiting relationship have a registrable basis.

[0041] In this invention, the Dijkstra algorithm is used to select candidate paths among root cause nodes, intermediate nodes, terminal nodes, and recovery nodes based on their cost. Type consistency value, level difference value, and interval level value are all used in path comparison to form a fault link merging certificate. The main alarm number, subordinate alarm number, window expiration time, recovery waiting status, locked status, number of repetitions, most recent occurrence time, and filter code are fixed in the main alarm cluster filter list. The alarm filtering object is expanded from a single record to the status chain and fault link at the same point. The number of repeated displays, repeated forwardings, and repeated dispatches decreases as the merging certificate is registered. The scope of fault process tracing is expanded from discrete alarms to the internal status, path, window, and filtering reason of the main alarm cluster. Attached Figure Description

[0042] Figure 1 This is a schematic diagram of the workflow of the present invention;

[0043] Figure 2 This is a system module diagram of the present invention. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0045] Example 1

[0046] Please see Figure 1 This invention provides a technical solution: a filtering method based on the aggregation of alarms at the same location, comprising the following steps:

[0047] S1: Based on the alarm entry of the intelligent patrol system, extract the location index, equipment index, alarm category, direction code, level, and window number, remove the serial number and batch number, and splice the location index and alarm category to establish a clustered index for the same location;

[0048] S2: Based on the same location aggregation index, retrieve the unclosed main alarm cluster and the historical closed main alarm cluster, arrange the trigger state, recovery state, and upgrade / downgrade state, and use the Viterbi algorithm to compare the state interval, sequence number, and level change direction to obtain the duplicate fault sequence certificate.

[0049] S3: Based on repeated fault sequence credentials, aggregate the triggered observation state, recovery observation state, repeated triggered observation state, level change observation state, and recovery failure observation state, compare the transition probability with the output probability, select the state chain, and obtain the state window merging credentials;

[0050] S4: Based on the status window merging credentials, match the root cause node, intermediate node, terminal node, recovery node, propagation direction, and sequence number. Use Dijkstra's algorithm to accumulate the type consistency value, level difference value, and interval level value to obtain the fault link merging credentials.

[0051] S5: Based on the fault link merging certificate, summarize the main alarm number, subordinate alarm number, window expiration time, recovery waiting status, and lock status, sort the window nodes, register the number of repetitions, the most recent occurrence time, and the filter code, and obtain the main alarm cluster filter list.

[0052] The same-location aggregation index includes a location unique code, device unique code, alarm category code, alarm direction code, level code, and aggregation window code. The duplicate fault sequence credential includes historical fault sequence number, current sequence number, status sequence code, status interval difference, level change code, and sequence matching value. The status window merging credential includes status chain number, main alarm cluster number, window start timestamp, window end timestamp, closure waiting time, and merging status code. The fault link merging credential includes fault template number, root cause node number, end node number, merging path number, path cost, and link blocking code. The main alarm cluster filtering list includes main alarm cluster number, subordinate alarm number, duplicate count value, most recent occurrence timestamp, highest level code, and filtering reason code.

[0053] The specific steps for generating a clustered index of the same location are as follows:

[0054] Based on the alarm entry point of the intelligent patrol system, a field whitelist projection method is used to extract point index, equipment index, interval number, alarm category, direction code, level, and window number. The field whitelist consists of seven items: point index, equipment index, interval number, alarm category, direction code, level, and window number. The field reading order is: point index, equipment index, interval number, alarm category, direction code, level, and window number. Field names and values ​​are read one by one from the alarm entry record. When a field name matches the whitelist, it is written to a field temporary storage table. The field names are serial number, batch number, and receiving team. When selecting column numbers, a field removal operation is performed, including deleting serial numbers, batch numbers, and receiving queue numbers. A key-value table binding verification method is used to check the binding relationship between the location index and the device index. The primary key of the key-value table is set as the device index, and the content of the key-value table is set as the location index set. The device index and the location index are read one by one. If the device index does not exist, a new device index record is created. If the device index exists, the set of registered location indexes is read. If the location index already exists, a duplicate location mark is written. If the location index does not exist, it is written to the location index set, and alarm records for the same location under the same device are marked, generating an alarm aggregation field set.

[0055] Based on the alarm aggregation field set, a fixed-order delimited concatenation method is used to concatenate the point index, equipment index, alarm category, direction code, level, and window number. The field concatenation order is set as point index, equipment index, alarm category, direction code, level, and window number. The field separator is a vertical bar, and empty fields are replaced with null values. The content of each of the six fields is read item by item. If the field content is empty, a null value marker is written; if the field content is not empty, the original field content is written. An aggregation key is then generated. A window grouping comparison method is used to compare the consistency between alarm categories and direction codes under the same window number. The grouping field is set to window number, and the comparison fields within the group are set to alarm category and direction code. Records with the same window number are read one by one in each group, and the alarm category text value is compared with the direction code text value one by one. When the alarm category and direction code are the same, a consistent flag is written in the same group. When the alarm category or direction code is different, a difference flag is written in the same group. Duplicate fields under the same location index are merged. An ordered dictionary index construction method is adopted, with the location index as the main index item and the device index, alarm category, direction code, level, and window number as the index content. Index records are written in ascending order of window number to create a clustered index for the same location.

[0056] The specific steps for generating duplicate fault sequence vouchers are as follows:

[0057] Based on the same-location aggregated index, a dual-queue status filtering method is used to search for unclosed main alarm clusters and historically closed main alarm clusters. Search queue 1 is designated as the unclosed queue, and search queue 2 as the historically closed queue. Search fields include location index, device index, alarm category, direction code, level, window number, main alarm cluster status, main alarm cluster number, and occurrence time. The search scope is limited to records within the same window number. A default window flag is written when the window number is empty. Writing to the current record is stopped when both the location index and device index are empty. A field-by-field equality comparison method is used to verify the consistency of location index, device index, alarm category, direction code, level, and window number. The comparison order is: location index, device index, alarm category, direction code, level, window number... The system reads unclosed queue records and historical closed queue records one by one, comparing the point index, then the device index, then the alarm category, then the direction code, then the level, and then the window number. If all six fields are consistent, a consistency flag is written; if any field is inconsistent, a difference flag is written. The system uses a status enumeration exclusion method to filter the status of the main alarm cluster. The exclusion status enumeration is set to discard, reassign, and cancel, while the retention status enumeration is set to processing, recovery waiting, and closure confirmation. The system reads the status of the main alarm cluster one by one. If the exclusion status enumeration is hit, the current record is removed. If the retention status enumeration is hit, the record is written to the reference cache. The system also registers the main alarm cluster number, point index, device index, alarm category, direction code, level, window number, and main alarm cluster status, generating a main alarm cluster reference set.

[0058] Based on the main alarm cluster reference set, a fixed state enumeration encoding method is used to extract the trigger state, recovery state, level increase state, level decrease state, confirmation failure state, and recovery failure state. The state enumeration is set to six items: trigger state, recovery state, level increase state, level decrease state, confirmation failure state, and recovery failure state. The state bit encoding is set to trigger state 01, recovery state 02, level increase state 03, level decrease state 04, confirmation failure state 05, and recovery failure state 06. The main alarm cluster number, state name, occurrence time, level, and direction code are read one by one. When the state name matches the state enumeration, it is written to the state bit cache; when the state name does not match the state enumeration, writing to the current state stops. A stable time sorting method is used to arrange the state bit order according to the occurrence time. The sorting primary key is set to ascending order of occurrence time, and the sorting subkey is set to ascending order of state bit encoding. The alarm states are arranged in the following order: trigger state, recovery state, level increase state, level decrease state, confirmation failure state, and recovery failure state. The state position number is registered. The adjacent time difference method is used to calculate the interval value between adjacent states. The time unit is set to seconds. The occurrence time of the previous state and the occurrence time of the next state are read and written into the interval value in chronological order. When the interval value is less than 0, a state inversion mark is written. The direction link mark method is used to mark the direction from trigger state to recovery state, the direction from level increase state to level decrease state, and the position of recovery failure state. The direction code reading range is set to forward, reverse, and unknown. When the recovery state appears after the trigger state, the trigger recovery direction mark is written. When the level decrease state appears after the level increase state, the level fallback direction mark is written. When the recovery state does not appear after the recovery failure state, the recovery failure retention mark is written. The alarm state difference table is obtained.

[0059] Based on the alarm state difference table, the Viterbi algorithm is used to compare the current state position with the historical state position. The state set is set as trigger state, recovery state, level increase state, level decrease state, confirmation failure state, and recovery failure state. The observation sequence is set as the current state position, and the reference sequence is set as the historical state position. The initial path value is set as the matching value corresponding to the first state position, and the matching value range is set to 0 to 1. When the states are consistent, 1 is written, and when the states are inconsistent, 0 is written. The state transition range is set to three categories: maintaining the same state, advancing to adjacent states, and staying in the fault state. The prohibited transition range is set as recovery state returning to trigger state, level decrease state returning to level increase state, and confirmation failure state returning to trigger state. The current state position number and the historical state position number are read bit by bit. Candidate paths are registered according to the current state, historical state, previous state, and previous path value. The candidate with the highest path value is retained bit by bit, and the predecessor state position number is recorded. After processing the last state, backtracking is performed according to the predecessor state position number. A threshold enumeration comparison method is used for comparison. The system uses an interval value and an interval threshold for adjacent states. The interval threshold is set as follows: 1800 seconds from trigger state to recovery state, 900 seconds from level increase state to level decrease state, 600 seconds from confirmation failure state to recovery failure state, and 1200 seconds for recovery failure state lingering. The system reads the interval value of adjacent states one by one. If the interval exceeds the corresponding interval threshold, an over-threshold interval record is written. If the interval does not exceed the corresponding interval threshold, a record within the threshold is written. The system uses a level direction consistency comparison method to compare the consistency values ​​of level change directions. The level change code is set as increase, decrease, hold, and conflict. If the current level direction and the historical level direction are both increase, an increase record is written. If the current level direction and the historical level direction are both decrease, a decrease record is written. If the current level direction and the historical level direction are both hold, hold record is written. If the current level direction and the historical level direction are opposite, conflict record is written. The system also excludes state inversion records, over-threshold interval records, and level direction conflict records. The system selects the matching sequence number, historical main alarm cluster number, state bit sequence number, and level change code to obtain the duplicate fault sequence certificate.

[0060] The Viterbi algorithm first defines the hidden state set as stable state, anomaly initiation state, fault persistence state, oscillation recovery state, and fault closure state, and the observation state set as triggered state, recovery state, repeated triggered state, level increase state, level decrease state, and recovery failure state. It calls the current state position, adjacent state interval, level change direction consistency value, state transition probability table, and observation output probability table from the alarm state difference table, and establishes a time column in ascending order of state occurrence time. At the first time step, the initial probability of each hidden state is multiplied by the corresponding observation state output probability to obtain the state probability value in the first column. In subsequent time steps, the probability values ​​of each hidden state from the previous time step, the transition probability from the previous hidden state to the current candidate hidden state, and the probability values ​​of the current candidate hidden state are multiplied respectively. Multiply the output probabilities of the hidden state and the observed state to obtain multiple candidate path probability values. Select the probability value of the first candidate path ranked by value and write it into the probability field of the current candidate hidden state. Write the corresponding previous hidden state number into the predecessor state field. Complete the registration of the probability field and the predecessor state field at each time step. At the last time step, select the first hidden state ranked by value as the chain tail state. Backtrack to the first time step according to the predecessor state field to obtain the state chain number, chain tail state code, chain state sequence code, and cumulative probability value. If the chain tail state code is a fault closure state, write a closure mark. If the chain tail state code is any of the abnormal initiation state, fault persistence state, or oscillation recovery state, write a merge mark. Generate the state chain selection field in the duplicate fault sequence certificate.

[0061] The specific steps for generating status window merge vouchers are as follows:

[0062] Based on repeated fault sequence vouchers, a fixed observation state encoding table method is used to aggregate trigger observation states, recovery observation states, repeated trigger observation states, level escalation observation states, level escalation observation states, and recovery failure observation states. The observation state encoding table is set as trigger observation state 01, recovery observation state 02, repeated trigger observation state 03, level escalation observation state 04, level escalation observation state 05, and recovery failure observation state 06. The read fields are set as matching sequence number, historical main alarm cluster number, status bit sequence number, level change code, status name, occurrence time, and adjacent status interval value. Repeated fault sequence voucher records are read one by one. When the status name matches the observation state encoding table, it is written to the observation state cache; when the status name does not match the observation state encoding table, the writing of the current record is stopped. The stable temporal arrangement method arranges the observation state numbers according to the order of state occurrence. The main sorting item is set to ascending order of occurrence time, and the secondary sorting item is set to ascending order of observation state code. When the occurrence times are the same, the observation states are written in the following order: triggered observation state, recovered observation state, repeated triggered observation state, level increase observation state, level decrease observation state, and recovery failure observation state. The adjacent observation state interval registration method is adopted to record the interval value between adjacent observation states. The time unit is set to seconds. The occurrence times of the previous and next observation states are read and the interval values ​​are written in the order of occurrence. When the interval value is less than 0, an inverted flag is written. When the interval value is empty, a default interval flag is written. The matching sequence number, historical main alarm cluster number, observation state number, occurrence time, and adjacent observation state interval value are registered to obtain the alarm observation state group.

[0063] Based on the alarm observation state group, the Viterbi dynamic programming algorithm is used to compare the transition probabilities between adjacent observation states. The candidate state set is set as triggered state, recovery state, repeated triggered state, level increase state, level decrease state, and recovery failure state. The observation state set is set as triggered observation state, recovery observation state, repeated triggered observation state, level increase observation state, level decrease observation state, and recovery failure observation state. The initial state probabilities are set as 0.5 for triggered state, 0.1 for recovery state, 0.1 for repeated triggered state, 0.1 for level increase state, 0.1 for level decrease state, and 0.1 for recovery failure state. Allowed transitions are set as follows: triggered state to recovery state, triggered state to repeated triggered state, repeated triggered state to recovery state, level increase state to level decrease state, recovery state to closed waiting state, and recovery failure state to repeated triggered state. Prohibited transitions are set as follows: recovery state to triggered state and level decrease state. From the level-up state, the closed waiting state, to the repeated trigger state, the output probability matrix comparison method is used to compare the output probabilities between the observed state and the candidate state. The output probability corresponding to the candidate state and the same-named observed state is set to 0.9, the output probability corresponding to the candidate state and the adjacent observed state is set to 0.3, and the output probability corresponding to the candidate state and the non-adjacent observed state is set to 0.05. The observed state number, candidate state number, predecessor state number, transition probability, and output probability are read bit by bit, and multiple candidate paths are registered. The first path is retained in descending order of cumulative probability value, and the predecessor state number is recorded. After processing the last observed state, the process is reversed according to the predecessor state number to select the state chain with the highest cumulative probability value. The main alarm cluster number, window start point, window end point, and closed waiting period are bound. The window start point is the time when the first observed state occurs, the window end point is the time when the last observed state occurs, and the closed waiting period is set to 1200 seconds. The state window merging certificate is obtained.

[0064] The specific steps for generating fault link merging certificates are as follows:

[0065] Based on status window merging vouchers, a field delimitation projection method is used to extract the main alarm cluster number, window start timestamp, window end timestamp, and merge status code. The field projection items are set to four: main alarm cluster number, window start timestamp, window end timestamp, and merge status code. The field reading order is: main alarm cluster number, window start timestamp, window end timestamp, and merge status code. Status window merging voucher records are read one by one. Writing to the current record stops when the main alarm cluster number is empty. A default start marker is written when the window start timestamp is empty, a default end marker is written when the window end timestamp is empty, and a default status marker is written when the merge status code is empty. A four-level node template matching method is used to match root cause nodes, intermediate nodes, terminal nodes, and recovery nodes. The node role set is set as root cause node, intermediate node, terminal node, and recovery node. The system includes four items: node, end node, and recovery node. The matching fields are set as node number, alarm category, location index, window number, node role, and template number. First, the main alarm cluster number is read and associated with the template number. Then, the four types of node roles are read according to the template number. Next, the node number, alarm category, location index, and window number are read one by one. A multi-field equal value verification method is used to check the consistency of node number, alarm category, location index, and window number. The comparison order is set as node number, alarm category, location index, and window number. When all four items are consistent, a node matching flag is written. When any item is inconsistent, a node difference flag is written. The main alarm cluster number, window start timestamp, window end timestamp, merge status code, template number, node role, node number, alarm category, location index, and window number are recorded to generate a link node matching table.

[0066] Based on the link node matching table, a directional link sequence comparison method is used to compare the propagation direction from the root node to intermediate nodes. The direction field is set to four items: uplink, downlink, lateral, and unknown. The direction codes of the root node and intermediate nodes are read. If the direction codes are the same, a direction consistency mark is written; if the direction codes are different, a direction difference mark is written. A node sequence number increment verification method is used to compare the sequence numbers from intermediate nodes to terminal nodes. The sequence number reading range is set to 1 to 999. If the intermediate node sequence number is less than the terminal node sequence number, a sequence increment mark is written; if the intermediate node sequence number is not less than the terminal node sequence number, a sequence anomaly mark is written. A recovery segment sequence verification method is used to compare the sequence numbers from terminal nodes to recovery nodes. If the terminal node sequence number is less than the recovery node sequence number, a recovery sequence increment mark is written; if the terminal node sequence number is not less than the recovery node sequence number, a recovery sequence anomaly mark is written. A blocking node enumeration identification method is used to identify blocking flags and allow return. For nodes that fail to recover, the blocking flags are enumerated as open circuit, locked, and communication interrupted. The allowed rollback nodes are enumerated as intermediate nodes and root cause nodes. The failed recovery nodes are enumerated as recovery timeout, recovery rejection, and recovery missing. The node status code is read one by one and the corresponding flag is written. A weighted cost accumulation method is used to accumulate the type consistency value, level difference value, interval level value, source priority value, and template priority value. The weight of the type consistency value is set to 10, the weight of the level difference value is set to 8, the weight of the interval level value is set to 6, the weight of the source priority value is set to 4, and the weight of the template priority value is set to 2. The alarm category, level level, adjacent interval level, source number, and template number of each node are read one by one and written to the cost cache in weight order. The template number, root cause node number, intermediate node number, end node number, recovery node number, propagation direction flag, sequential increment flag, blocking flag, allowed rollback node, and failed recovery node are recorded to obtain the merged path cost table.

[0067] Based on the merged path cost table, Dijkstra's algorithm is used to select the record with the lowest path cost. The node set is divided into root node, intermediate node, terminal node, recovery node, and new alarm node. The edge set is divided into four categories: root node to intermediate node, intermediate node to terminal node, terminal node to recovery node, and new alarm node to terminal node. The starting point is set as the root node, the ending point is set as the terminal node, the initial visit flag is set to unvisited, the initial path cost is set to 999999, and the path cost of the root node is set to 0. In each round, the node with the lowest path cost among the unvisited nodes is selected as the current node. The cost of the adjacent edges of the current node is read and written into the candidate path cost in the order of type consistency value, level difference value, interval level value, source priority value, and template priority value. If the candidate path cost is lower than the registered path cost, it is replaced. The path cost is calculated and the predecessor node is registered. After the current node finishes processing, an "accessed" flag is written. This continues until the end node writes an "accessed" flag. A sequence threshold comparison method is used to compare the sequence number of the new alarm node with the highest confirmed sequence number of the main alarm cluster. The sequence number of the new alarm node and the highest confirmed sequence number of the main alarm cluster are read. If the former is greater than the latter, a mergeable sequence flag is written. If the former is not greater than the latter, a backtracking sequence flag is written. A blocking trigger determination method is used to determine whether the new alarm node triggers a blocking flag. The blocking flag reading range is set to open circuit, blocked, communication interruption, and no blocking. If an open circuit, blocked, or communication interruption is hit, a link blocking code is written. If no blocking is hit, a link pass code is written. The template number, root cause node number, end node number, node sequence number, merge path number, and link blocking code are registered to obtain the fault link merging certificate.

[0068] Dijkstra's algorithm first calls the template number, root cause node number, intermediate node number, terminal node number, recovery node number, node sequence number, propagation direction, blocking flag, type consistency value, level difference value, interval level value, source priority value, and template priority value from the merge path cost table. It sets the confirmed nodes of the main alarm cluster as the starting node and the new alarm nodes as the target nodes. The cumulative cost value of the starting node is set to zero, and the cumulative cost value of the remaining nodes is set to null. It then reads the edges of adjacent nodes one by one according to the propagation direction, accumulating the type consistency value, level difference value, interval level value, source priority value, and template priority value to form the edge cost value. Finally, it calculates the edge cost value by multiplying the cumulative cost value of the starting node by the edge cost value. The values ​​are added together to obtain the candidate cumulative cost value of adjacent nodes. When the candidate cumulative cost value is lower than the registered cumulative cost value of adjacent nodes, the cumulative cost value of adjacent nodes, the predecessor node number, and the merging path number are updated. When the blocking flag is in the triggered state, the extension of the corresponding edge is stopped. When the fallback node hit is allowed, the fallback node sequence number is retained. When the recovery failure node hit is recovered, the recovery failure node number is registered. The nodes with the lower limit of the cumulative cost value in the undetermined node set are processed in a loop until the target node enters the determined node set. The node is backtracked to the starting node in reverse according to the predecessor node number of the target node. The template number, root cause node number, end node number, node sequence number, merging path number, and link blocking code are registered to generate the fault link merging certificate.

[0069] The specific steps for generating the primary alarm cluster filter list are as follows:

[0070] Based on the fault link merging voucher, a field delimitation and aggregation method is used to summarize the main alarm number, subordinate alarm number, merge path number, window expiration time, recovery waiting status, lock status, and fault closure status. The summarized fields are set to seven items: main alarm number, subordinate alarm number, merge path number, window expiration time, recovery waiting status, lock status, and fault closure status. The field reading order is: main alarm number, subordinate alarm number, merge path number, window expiration time, recovery waiting status, lock status, and fault closure status. Fault link merging voucher records are read one by one. Writing to the current record stops when the main alarm number is empty. A subordinate default flag is written when the subordinate alarm number is empty. A path default flag is written when the merge path number is empty. An expiration default flag is written when the window expiration time is empty. An unknown waiting flag is written when the recovery waiting status is empty. An unknown lock flag is written when the lock status is empty. An unknown closure flag is written when the fault closure status is empty. The system uses a dual-condition comparison method based on time and status to compare the window expiration time with the main alarm status. The time comparison benchmark is set to the current system timestamp. The main alarm status enumeration is set to five items: processing, recovery waiting, closure confirmation, closed, and locked. The system reads the window expiration time and the main alarm status one by one. If the window expiration time is earlier than or equal to the current system timestamp, an expiration flag is written. If the window expiration time is later than the current system timestamp, an unexpired flag is written. If the main alarm status is processing, a processing flag is written. If the main alarm status is recovery waiting, a recovery waiting flag is written. If the main alarm status is closure confirmation, a closure confirmation flag is written. If the main alarm status is closed, a closure flag is written. If the main alarm status is locked, a locked flag is written. The system also records the main alarm number, subordinate alarm number, merge path number, window expiration time, recovery waiting status, locked status, fault closure status, expiration flag, and main alarm status flag to obtain the window handling field set.

[0071] Based on the window handling field set, a binary min-heap window sorting method is adopted to sort window nodes in ascending order of window expiration time. The content of the heap node is set as follows: main alarm number, subordinate alarm number, merge path number, window expiration time, recovery waiting status, locked status, fault closure status, highest level code, and most recent occurrence time. The primary key of the heap sort is set as the window expiration time, and the secondary key of the heap sort is set as the main alarm number. When the window expiration time is empty, the maximum timestamp is written to the tail of the heap. Window nodes are read one by one and written to the binary min-heap. When the parent node's window expiration time is later than the child node's window expiration time, the node positions are swapped. When the parent node's window expiration time is equal to the child node's window expiration time, the node positions are swapped in ascending order of main alarm number. The top node of the heap is used as the earliest expiration window node, and the earliest expiration window node is selected. A lock waiting double-flag determination method is used to determine the locked status and the recovery waiting status. The lock status enumeration is set to three items: unlocked, locked, and unknown lock. The recovery waiting status enumeration is set to... For the four categories of no waiting, waiting, waiting timeout, and waiting unknown, the locked state and recovery waiting state are read one by one. When the locked state is locked, filter code L01 is written; when the recovery waiting state is waiting, filter code W01 is written; when the recovery waiting state is waiting timeout, filter code W02 is written; when the locked state is unlocked and the recovery waiting state is no waiting, filter code P01 is written. A group counting registration method is used to register the number of repetitions, the most recent occurrence time, the highest level code, the merge path number, and the filter code. The group key is set to the main alarm number and the merge path number. The initial value of the number of repetitions is set to 1. When the same group appears again, the number of repetitions is incremented by 1. The most recent occurrence time is the record with the largest timestamp in the same group. The highest level code is the highest value in the order of level 1, level 2, level 3, level 4, and level 5. The merge path number is written according to the earliest expired window node registration value. The filter code is written in the order of locked state, recovery waiting state, and fault closure state to obtain the main alarm cluster filter list.

[0072] Please see Figure 2 A filtering system based on alarm aggregation at the same location, the filtering system based on alarm aggregation at the same location is used to execute the above-mentioned filtering method based on alarm aggregation at the same location, the system includes:

[0073] Index module: Based on the alarm entry of the intelligent patrol system, extract the location index, equipment index, alarm category, direction code, level, and window number, remove serial number and batch number, and establish an aggregated index for the same location;

[0074] Sequence Module: Based on the same location aggregation index, it retrieves the unclosed main alarm cluster and the historical closed main alarm cluster, arranges the trigger state, recovery state, and escalation / demotion state, and uses the Viterbi algorithm to compare the state interval, sequence number, and direction of level change to obtain the duplicate fault sequence certificate;

[0075] Window module: Based on repeated failure sequence credentials, it aggregates the triggered observation state, recovery observation state, repeated triggered observation state, level change observation state, and recovery failure observation state, compares the transition probability with the output probability, selects the state chain, and obtains the state window merging credentials;

[0076] Link module: Based on the status window merging certificate, it matches the root cause node, intermediate node, terminal node, recovery node, propagation direction, and sequence number, and uses the Dijkstra algorithm to accumulate the type consistency value, level difference value, and interval level value to obtain the fault link merging certificate;

[0077] Registration module: Based on the fault link merging certificate, it summarizes the main alarm number, subordinate alarm number, window expiration time, recovery waiting status, and lock status, sorts the window nodes, registers the number of repetitions, the most recent occurrence time, and the filter code, and obtains the main alarm cluster filter list.

[0078] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A filtering method based on alarm aggregation at the same location, characterized in that, Includes the following steps: S1: Based on the alarm entry of the intelligent patrol system, extract the location index, equipment index, alarm category, direction code, level, and window number, remove the serial number and batch number, and splice the location index and alarm category to establish a clustered index for the same location; S2: Based on the same location aggregation index, retrieve the unclosed main alarm cluster and the historical closed main alarm cluster, arrange the trigger state, recovery state, and escalation / demotion state, and use the Viterbi algorithm to compare the state interval, sequence number, and level change direction to obtain the duplicate fault sequence certificate. S3: Based on the repeated fault sequence credentials, aggregate the triggered observation state, recovery observation state, repeated triggered observation state, level change observation state, and recovery failure observation state, compare the transition probability with the output probability, select the state chain, and obtain the state window merging credentials; S4: Based on the status window merging certificate, match the root cause node, intermediate node, terminal node, recovery node, propagation direction, and sequence number. Use Dijkstra's algorithm to accumulate the type consistency value, level difference value, and interval level value to obtain the fault link merging certificate. S5: Based on the fault link merging certificate, summarize the main alarm number, subordinate alarm number, window expiration time, recovery waiting status, and lock status, sort the window nodes, register the number of repetitions, the most recent occurrence time, and the filter code, and obtain the main alarm cluster filter list. The specific steps for generating the same-location aggregate index are as follows: Based on the alarm entry point of the intelligent patrol system, extract the point index, device index, interval number, alarm category, direction code, level, and window number; delete the serial number, batch number, and receiving queue number; verify the binding relationship between the point index and the device index; mark the alarm record of the same point under the same device; and obtain the alarm aggregation field set. Based on the alarm aggregation field set, the point index, device index, alarm category, direction code, level, and window number are concatenated. The consistency relationship between alarm category and direction code under the same window number is compared, and duplicate fields under the same point index are merged to create a same point aggregation index. The specific steps for generating the duplicate fault sequence certificate are as follows: Based on the same location aggregation index, retrieve the unclosed main alarm clusters and historical closed main alarm clusters, verify the consistency of the location index, device index, alarm category, direction code, level, and window number, remove records of main alarm clusters with status of abandoned, transferred, or canceled, and retain records of main alarm clusters with status of processing, recovery waiting, or closure confirmation, and generate a main alarm cluster reference set. Based on the main alarm cluster reference set, the trigger state, recovery state, level increase state, level decrease state, confirmation failure state, and recovery failure state are extracted, the state positions are arranged according to the time of occurrence, the interval value between adjacent states is calculated, and the direction from trigger state to recovery state, the direction from level increase state to level decrease state, and the position of recovery failure state are marked to obtain the alarm state difference table. Based on the alarm status difference table, the Viterbi algorithm is used to compare the current status position with the historical status position, compare the adjacent status interval value with the interval threshold, compare the consistent value of the level change direction, exclude the status inversion record, the over-threshold interval record, and the level direction conflict record, select the matching sequence number, the historical main alarm cluster number, the status position number, and the level change code to obtain the duplicate fault sequence certificate. The specific steps for generating the status window merging certificate are as follows: Based on the repeated fault sequence certificate, the following are collected: trigger observation state, recovery observation state, repeated trigger observation state, level increase observation state, level decrease observation state, and recovery failure observation state. The observation state numbers are arranged in the order of occurrence of the state, and the interval value between adjacent observation states is recorded to obtain the alarm observation state group. Based on the alarm observation state group, compare the transition probability between adjacent observation states, compare the output probability between the observation state and the candidate state, select the state chain with the highest cumulative probability value, bind the main alarm cluster number, window start point, window end point, and closing waiting period, and obtain the state window merging certificate. The specific steps for generating the fault link merging certificate are as follows: Based on the status window merging certificate, extract the main alarm cluster number, window start timestamp, window end timestamp, and merging status code; match the root cause node, intermediate node, end node, and recovery node; verify the consistency of node number, alarm category, location index, and window number; and generate a link node matching table. Based on the link node matching table, the propagation direction from the root node to the intermediate node is compared, the sequence number from the intermediate node to the terminal node is compared, and the sequence number from the terminal node to the recovery node is compared. Blocking flags, allowed backoff nodes, and failed recovery nodes are identified. The type consistency value, level difference value, interval level value, source priority value, and template priority value are accumulated to obtain the merged path cost table. Based on the merged path cost table, the Dijkstra algorithm is used to select the record with the lowest path cost. The sequence number of the new alarm node is compared with the highest confirmed sequence number of the main alarm cluster. It is determined whether the new alarm node triggers the blocking flag. The template number, root cause node number, end node number, node sequence number, merged path number, and link blocking code are registered to obtain the fault link merge certificate.

2. The filtering method based on same-location alarm aggregation according to claim 1, characterized in that, The same-location aggregation index includes a unique location code, a unique device code, an alarm category code, an alarm direction code, a level code, and an aggregation window code. The repeated fault sequence credential includes a historical fault sequence number, a current sequence number, a status sequence code, a status interval difference, a level change code, and a sequence matching value. The status window merging credential includes a status chain number, a main alarm cluster number, a window start timestamp, a window end timestamp, a close waiting time, and a merging status code. The fault link merging credential includes a fault template number, a root cause node number, an end node number, a merging path number, a path cost value, and a link blocking code. The main alarm cluster filtering list includes a main alarm cluster number, a subordinate alarm number, a repeat count value, a most recent occurrence timestamp, a highest level code, and a filtering reason code.

3. The filtering method based on same-location alarm aggregation according to claim 1, characterized in that, The Viterbi algorithm first defines the hidden state set as stable state, anomaly initiation state, fault persistence state, oscillation recovery state, and fault closure state, and the observation state set as triggered state, recovery state, repeated triggered state, level increase state, level decrease state, and recovery failure state. It then calls the current state position, adjacent state interval, level change direction consistency value, state transition probability table, and observation output probability table from the alarm state difference table to establish a time column in ascending order of state occurrence time. At the first time step, the initial probability of each hidden state is multiplied by the corresponding observation state output probability to obtain the state probability value in the first column. At subsequent time steps, the probability values ​​of each hidden state from the previous time step, the transition probability from the previous hidden state to the current candidate hidden state, and the probability of the current candidate hidden state are multiplied respectively. Multiply the output probabilities of the hidden state and the observed state to obtain multiple candidate path probability values. Select the probability value of the first candidate path ranked numerically and write it into the probability field of the current candidate hidden state. Write the corresponding previous hidden state number into the predecessor state field. Complete the registration of the probability field and the predecessor state field at each time step. At the last time step, select the first hidden state ranked numerically as the tail state. Backtrack to the first time step according to the predecessor state field to obtain the state chain number, tail state code, state sequence code in the chain, and cumulative probability value. If the tail state code is a fault closure state, write a closure mark. If the tail state code is any of the abnormal initiation state, fault persistence state, or oscillation recovery state, write a merge mark. Generate the state chain selection field in the duplicate fault sequence voucher.

4. The filtering method based on same-location alarm aggregation according to claim 1, characterized in that, The Dijkstra algorithm first calls the template number, root cause node number, intermediate node number, terminal node number, recovery node number, node sequence number, propagation direction, blocking flag, type consistency value, level difference value, interval level value, source priority value, and template priority value from the merge path cost table. It then sets the confirmed nodes of the main alarm cluster as the starting node, the new alarm nodes as the target nodes, sets the cumulative cost value of the starting node to zero, and sets the cumulative cost value of the remaining nodes to null. Next, it reads the edges of adjacent nodes one by one according to the propagation direction, accumulates the type consistency value, level difference value, interval level value, source priority value, and template priority value to form the edge cost value, and then adds the cumulative cost value of the starting node to the edge cost value. The cumulative cost value of adjacent nodes is obtained by adding the cost values. When the cumulative cost value of the candidates is lower than the cumulative cost value of the adjacent nodes, the cumulative cost value of the adjacent nodes, the predecessor node number, and the merging path number are updated. When the blocking flag is in the triggered state, the extension of the corresponding edge is stopped. When the allowed backtracking node hits, the backtracking node sequence number is retained. When the failed recovery node hits, the failed recovery node number is registered. The nodes with the lower limit of the cumulative cost value in the undetermined node set are processed in a loop until the target node enters the determined node set. The node is backtracked to the starting node in reverse order according to the predecessor node number of the target node. The template number, root cause node number, end node number, node sequence number, merging path number, and link blocking code are registered, and the fault link merging certificate is generated.

5. The filtering method based on same-location alarm aggregation according to claim 1, characterized in that, The specific steps for generating the main alarm cluster filter list are as follows: Based on the fault link merging certificate, the main alarm number, subordinate alarm number, merging path number, window expiration time, recovery waiting status, lock status, and fault closure status are summarized. The window expiration time is compared with the main alarm status to obtain the window handling field set. Based on the window handling field set, window nodes are sorted in ascending order by window expiration time, the earliest expiring window node is selected, the locked state and the recovery waiting state are determined, the number of repetitions, the most recent occurrence time, the highest level code, the merge path number, and the filter code are recorded, and the main alarm cluster filter list is obtained.

6. A filtering system based on the aggregation of alarms at the same location, characterized in that, The filtering method based on same-location alarm aggregation according to any one of claims 1-5, the system comprising: Index module: Based on the alarm entry of the intelligent patrol system, extract the location index, equipment index, alarm category, direction code, level, and window number, remove serial number and batch number, and establish an aggregated index for the same location; Sequence module: Based on the same location aggregation index, retrieve the unclosed main alarm cluster and the historical closed main alarm cluster, arrange the trigger state, recovery state, and escalation / demotion state, and use the Viterbi algorithm to compare the state interval, sequence number, and direction of level change to obtain the duplicate fault sequence certificate; Window module: Based on the repeated failure sequence credentials, it aggregates the triggered observation state, recovery observation state, repeated triggered observation state, level change observation state, and recovery failure observation state, compares the transition probability with the output probability, selects the state chain, and obtains the state window merging credentials; Link module: Based on the status window merging certificate, match the root cause node, intermediate node, terminal node, recovery node, propagation direction, and sequence number, and use Dijkstra's algorithm to accumulate type consistency value, level difference value, and interval level value to obtain the fault link merging certificate; Registration module: Based on the fault link merging certificate, it summarizes the main alarm number, subordinate alarm number, window expiration time, recovery waiting status, and lock status, sorts the window nodes, registers the number of repetitions, the most recent occurrence time, and the filter code, and obtains the main alarm cluster filter list.

Images