A power system equipment fault location method based on chain penetration technology

Abstract

The present application relates to the technical field of equipment fault positioning, and more particularly to a power system equipment fault positioning method based on chain penetration technology, and the present application proposes the following scheme: obtaining a target alarm event and process variable data in a corresponding time window; constructing an industrial knowledge graph based on equipment topology relationship, process flow direction relationship, control interlocking relationship and historical fault knowledge; performing multi-level correlation traversal, correlation screening and priority evaluation around the target alarm event to determine a candidate measurement point node set; combining real-time measurement value and prediction value deviation, correlation distance, historical co-occurrence frequency and propagation direction consistency to calculate reason contribution scores, and outputting a potential fault reason set and troubleshooting suggestions. The present application improves the positioning accuracy and interpretability of abnormal alarms of complex industrial equipment.

Description

Technical Field

[0001] This invention relates to the field of equipment fault location technology, and in particular to a method for locating power system equipment faults based on chain penetration technology. Background Technology

[0002] Existing industrial process equipment, especially gas turbines, steam turbines, and their auxiliary equipment, typically have numerous monitoring points for temperature, pressure, vibration, flow rate, liquid level, valve position, and interlock status during operation. These points rely on distributed control platforms, condition monitoring devices, and historical databases to continuously monitor the equipment's operating status. When an anomaly occurs in a local component, process loop, or controlled object, the initial manifestation is often an over-limit alarm or status change alarm triggered at a specific monitoring point. However, the root cause of the fault may be located upstream, in a related component, or at a different node in the control chain than the alarmed monitoring point. Particularly in gas turbine equipment, due to its complex structure, long process chains, and numerous control interlocks, the same anomaly often accompanies fluctuations at multiple monitoring points, leading to spatial separation and temporal misalignment between the target alarm event and the actual fault source.

[0003] In existing technologies, the analysis of abnormal alarms in industrial equipment often employs methods such as single-point threshold judgment, trend curve comparison, manual investigation of alarm lists, or matching based on expert experience rules. While these methods can identify whether an anomaly has occurred at a specific measuring point, they typically struggle to simultaneously integrate equipment topology relationships, process flow relationships, control interlock relationships, and historical fault propagation patterns to perform correlation and source tracing analysis of the target alarm event. In scenarios with multiple concurrent alarms at multiple measuring points, intersecting anomaly propagation paths, or numerous secondary alarms, problems easily arise such as an overly broad investigation scope, too many potential causes, low root cause localization efficiency, and insufficient interpretability of diagnostic results. Therefore, there is an urgent need for a method for equipment fault localization that can convergent analysis of related nodes within a complex industrial equipment relationship network around a target alarm event and output potential fault causes.

[0004] To address the above issues, this application proposes a method for locating equipment faults based on power systems. Summary of the Invention

[0005] The technical problem this invention aims to solve is to address the shortcomings of existing technologies by providing a method for locating equipment faults in power systems. This invention proposes the following approach: acquiring target alarm events and corresponding process variable data within a time window; constructing an industrial knowledge graph based on equipment topology, process flow relationships, control interlocking relationships, and historical fault knowledge; performing multi-level association traversal, correlation filtering, and priority evaluation around the target alarm event to determine a set of candidate measurement point nodes; calculating a cause contribution score by combining the deviation between real-time measured and predicted values, association distance, historical co-occurrence frequency, and consistency of propagation direction, and outputting a set of potential fault causes and troubleshooting suggestions. This application improves the accuracy and interpretability of locating abnormal alarms in complex industrial equipment.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A power system equipment fault location method based on chain penetration technology, applied to the abnormal alarm location of industrial process equipment, the method includes:

[0008] Acquire the target alarm event and parse it to obtain the alarm measurement point identifier, alarm type, alarm occurrence time, and process variable data within the corresponding time window;

[0009] Based on a preset industrial knowledge graph, a set of candidate measurement point nodes associated with the target alarm event is determined, wherein the industrial knowledge graph is constructed through equipment topology relationships, process flow relationships, control interlock relationships and historical fault knowledge;

[0010] For each candidate measurement point node, the cause contribution score of the candidate measurement point node is calculated by combining the deviation between the real-time measurement value and the predicted value of the node, the correlation distance between the node and the target alarm event, the historical co-occurrence frequency, and the consistency of the abnormal propagation direction.

[0011] The candidate test point nodes are sorted according to the cause contribution score, the potential fault cause set of the target alarm event is output, and the corresponding investigation suggestions are generated according to the potential fault cause set.

[0012] The target alarm events include at least one or more of the following: abnormal temperature alarm, abnormal pressure alarm, abnormal vibration alarm, abnormal current alarm, abnormal voltage alarm, abnormal flow alarm, abnormal liquid level alarm, abnormal valve position alarm, abnormal speed alarm, and interlock trigger alarm. The target alarm events are collected through at least one of the following: distributed control system, field instrument acquisition system, equipment monitoring system, and historical database.

[0013] The methods for parsing the process variable data include:

[0014] Based on the alarm measurement point identifier corresponding to the target alarm event, extract the real-time sampling data, historical baseline data, associated device status data, and upstream and downstream associated measurement point data corresponding to the alarm measurement point identifier from a preset time window;

[0015] The extracted process variable data are processed for time alignment, missing data completion, anomaly removal and unit normalization to generate standardized time series data.

[0016] Based on the standardized time-series data, at least one feature information is extracted from the current value, rate of change, fluctuation amplitude, duration, degree of exceeding limit, and recovery trend;

[0017] The feature information is associated and encapsulated with alarm type, alarm occurrence time and alarm measurement point identifier to obtain process variable data for fault location analysis.

[0018] The construction methods of the industrial knowledge graph include:

[0019] Obtain equipment ledger information, process flow information, control logic configuration information, measurement point configuration relationship information, and historical fault handling records for industrial process equipment;

[0020] Based on the equipment ledger information, establish the equipment topology relationship between equipment object nodes, component nodes, and measurement point nodes;

[0021] Based on the process flow information, establish the process flow relationship between different equipment object nodes, component nodes and measuring point nodes;

[0022] Based on the control logic configuration information, a control interlocking relationship is established between the measuring point node and the actuator node;

[0023] Based on the historical fault handling records, the mapping relationship between historical fault phenomena, fault causes, propagation paths and handling measures is extracted to obtain historical fault knowledge.

[0024] The equipment topology, process flow, control interlocking, and historical fault knowledge are integrated to generate an industrial knowledge graph.

[0025] The method for determining the set of candidate measurement point nodes includes:

[0026] Using the node corresponding to the target alarm event in the industrial knowledge graph as the starting node, a multi-level association traversal is performed in the industrial knowledge graph along the equipment topology relationship, process flow relationship and control interlock relationship to obtain an initial candidate node set that has an associated path with the starting node.

[0027] Based on the graph path length, relationship type, temporal correlation, and consistency of process propagation direction between each initial candidate node and the starting node, the initial candidate nodes are screened for relevance.

[0028] Based on the process variable fluctuation characteristics, abnormality degree, and historical co-occurrence records of each initial candidate node within the time window corresponding to the target alarm event, priority evaluation is performed on the selected nodes.

[0029] The nodes whose priority evaluation results meet the preset conditions are determined as the candidate measurement point node set.

[0030] The multi-level associative traversal includes:

[0031] Using the starting node as the root node, perform a breadth-first traversal in the industrial knowledge graph according to a preset traversal depth threshold to obtain adjacent nodes that match the starting node.

[0032] Based on the edge type between the adjacent node and the starting node, the adjacent nodes are expanded hierarchically to generate node path description information, wherein the equipment topology relationship corresponds to the equipment level expansion, the process flow relationship corresponds to the medium transmission direction expansion, and the control interlock relationship corresponds to the control action link expansion.

[0033] The nodes obtained from each level of traversal and their corresponding node path descriptions are summarized to obtain the initial candidate node set.

[0034] The relevance screening includes:

[0035] Obtain the graph path length, edge type combination, alarm occurrence time difference, process variable change trend, and process propagation direction between each initial candidate node and the starting node;

[0036] Based on the process propagation direction, determine whether the initial candidate node and the target alarm event satisfy at least one of the propagation logics of upstream to downstream propagation, actuator to feedback measurement point propagation, and interlocking trigger propagation. If not, the corresponding initial candidate node is removed.

[0037] For the remaining initial candidate nodes, the topological relevance is calculated based on the path length of the graph, and the relationship type weight is determined based on the edge type combination. Among them, the equipment topological relationship, the process flow relationship and the control interlock relationship correspond to different preset weight coefficients. The time relevance is determined based on the alarm occurrence time difference and the process variable change trend.

[0038] The topological relevance, relation type weight, and time relevance are weighted and fused to obtain the comprehensive relevance index of each initial candidate node. Initial candidate nodes with a comprehensive relevance index lower than the preset relevance threshold are eliminated.

[0039] The priority evaluation includes:

[0040] Obtain the process variable fluctuation characteristics, anomaly degree, and historical co-occurrence records of each node within the time window corresponding to the target alarm event after correlation filtering;

[0041] The node fluctuation significance index is calculated based on the fluctuation characteristics of the process variables, wherein the fluctuation significance index is used to characterize the rate of change, fluctuation amplitude, and duration of abnormality of the process variables corresponding to the node.

[0042] The node anomaly intensity index is calculated based on the degree of anomaly, wherein the anomaly intensity index is calculated by the degree of deviation of the node's real-time measurement value from the historical baseline value;

[0043] The node co-occurrence support index is calculated based on the historical co-occurrence records, wherein the co-occurrence support index is used to characterize the frequency of co-occurrence of node anomalies and target alarm events in historical fault samples;

[0044] The priority index of each node is obtained by weighted fusion of the fluctuation significance index, the anomaly intensity index, and the co-occurrence support index.

[0045] The calculation method for the cause contribution score includes:

[0046] For each candidate measurement point node, a prediction deviation component, an association distance component, a historical co-occurrence component, and a propagation consistency component are calculated. The prediction deviation component is determined based on the deviation between the real-time measured value and the predicted value of the candidate measurement point node. The association distance component is determined based on the graph path length between the candidate measurement point node and the corresponding node of the target alarm event. The historical co-occurrence component is determined based on the co-occurrence frequency, co-occurrence probability, or conditional support of the candidate measurement point node and the target alarm event in historical fault samples. The propagation consistency component is determined based on the degree of consistency between the anomaly occurrence time, anomaly change trend, and propagation direction of the candidate measurement point node and the target alarm event.

[0047] The prediction bias component, correlation distance component, historical co-occurrence component, and propagation consistency component are weighted and fused to obtain the cause contribution score of the candidate measurement point node.

[0048] A power system equipment fault location system based on chain penetration technology, the system comprising:

[0049] The alarm event acquisition module is used to acquire target alarm events and parse them to obtain alarm measurement point identifier, alarm type, alarm occurrence time, and process variable data within the corresponding time window;

[0050] The graph construction module is used to construct an industrial knowledge graph, which is constructed through equipment topology relationships, process flow relationships, control interlock relationships, and historical fault knowledge.

[0051] The candidate node determination module is used to determine a set of candidate measurement point nodes associated with the target alarm event based on the industrial knowledge graph.

[0052] The scoring calculation module is used to calculate the cause contribution score of each candidate measurement point node by combining the deviation between the real-time measurement value and the predicted value of the node, the correlation distance between the node and the target alarm event, the historical co-occurrence frequency, and the consistency of the abnormal propagation direction.

[0053] The result output module is used to sort the candidate test point nodes according to the cause contribution score, output the potential fault cause set of the target alarm event, and generate corresponding troubleshooting suggestions based on the potential fault cause set.

[0054] Compared with the prior art, the beneficial effects of the present invention are:

[0055] This invention constructs an industrial knowledge graph based on equipment topology, process flow, control interlocks, and historical fault knowledge. It then performs constrained hierarchical traversal, correlation screening, and causal contribution analysis on associated measurement points around target alarm events, thereby achieving convergent localization of potential fault causes under conditions of concurrent anomalies at multiple measurement points. Compared to existing methods that rely solely on single-measurement-point threshold judgment, trend comparison, or empirical rule-based troubleshooting, this application reduces the interference of secondary alarms and accompanying fluctuations on fault localization, improves the accuracy, timeliness, and interpretability of anomaly localization in complex industrial equipment, and can output a set of potential fault causes with a troubleshooting order and corresponding suggestions. Attached Figure Description

[0056] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0057] Figure 1 An exemplary application scenario diagram provided for an embodiment of the present invention;

[0058] Figure 2 A flowchart of a power system-based equipment fault location method provided in an embodiment of the present invention. Detailed Implementation

[0059] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0060] The equipment fault location method described in this application is applicable to scenarios involving abnormal alarm analysis and fault cause location in complex industrial process equipment, such as gas turbines, steam turbines, and their auxiliary systems. It is particularly suitable for equipment systems with multiple measurement point couplings, multi-level propagation paths, and overlapping control logic during operation. In such scenarios, the on-site monitoring system is typically not built around a single component, but rather forms a multi-source heterogeneous data environment through the collaborative efforts of distributed control systems, protection interlocking systems, condition monitoring systems, and historical databases. Once an equipment anomaly occurs, it often initially manifests as parameters such as temperature, pressure, vibration, current, voltage, flow rate, liquid level, valve position, or speed exceeding limits at a certain measurement point. Subsequently, it spreads along equipment structural relationships, media transmission relationships, or control action links to adjacent objects, causing the abnormal phenomenon to be temporally misaligned, spatially separated, and logically intertwined with the original fault source, thus significantly increasing the complexity of fault location.

[0061] In the long-term operation and maintenance of gas turbine equipment, those skilled in the art commonly encounter the following situation: while on-site alarm systems can quickly detect anomalies, their output mostly remains at the level of measurement point alarms, only indicating that a certain measurement point has exceeded limits, fluctuated, or been triggered by interlocks, without inherently possessing the ability to trace and analyze the source of the anomaly. For multiple alarm messages occurring simultaneously, maintenance personnel typically need to manually compare flowcharts, equipment lists, operational experience, and historical fault records to determine whether the alarm is caused by upstream medium disturbance, component degradation, actuator failure, lubrication or cooling circuit anomaly, or a secondary alarm triggered by protection logic. Especially in high-speed, highly coupled, and highly continuous industrial equipment like gas turbines, a local failure is not always directly detected at the measurement point where the fault originates. More often, it will first be exposed at peripheral measurement points in the form of bearing temperature rise, casing vibration and lifting, abnormal lubricating oil parameters, flow deviation, or interlock status change, resulting in the measurement point that first alarms not being consistent with the actual location of the anomaly.

[0062] Furthermore, in actual engineering projects, while existing technologies have attempted to improve fault analysis efficiency through threshold rules, expert experience bases, alarm priority management, or trend curve comparison, these methods still have significant limitations in complex equipment systems. On the one hand, traditional threshold discrimination is more suitable for identifying whether a single measurement point anomaly exists, but it is difficult to answer whether there is a causal transmission relationship between multiple alarms, nor can it provide a unified interpretation of the propagation links between different levels and types of nodes. On the other hand, diagnostic methods that rely purely on experience rules often depend heavily on the long-term experience accumulation of specific devices, models, and even specific experts. When the equipment topology is complex, the process flow is long, the interlocking relationships are dense, or the historical samples are incomplete, problems such as an overly broad diagnostic scope, divergent investigation paths, and unclear ranking of potential causes can easily occur. Especially when auxiliary systems and main equipment are involved in anomaly propagation simultaneously, the same anomaly may correspond to multiple potential causes, and different potential causes may present similar alarm manifestations at multiple measurement points, making it difficult to establish stable and interpretable fault location conclusions based solely on single-point alarm text or a single trend curve.

[0063] Those skilled in the art will understand that what is truly valuable in an industrial setting is not merely the discrete event of whether an alarm occurs, but rather the simultaneous existence of equipment structural relationships, process medium flow, control interlocking logic, historical fault propagation experience, and dynamic changes in various measuring points before and after the alarm. In other words, equipment anomalies do not occur in isolation at a single measuring point, but rather propagate within the system along specific physical, control, or functionally dependent paths. While this propagation may superficially manifest as simultaneous fluctuations at multiple measuring points and the overlapping occurrence of multiple types of alarms, its inherent propagation often possesses certain topological constraints, temporal chronological relationships, and directional consistency. Therefore, the core concept of this application is not to perform indiscriminate stacking analysis on all alarm information, nor to simply match a similar case from the historical database. Instead, it takes the target alarm event as the starting point for localization, places it in the network of equipment-component-measuring point-control object described by the industrial knowledge graph, and expands the candidate nodes that are actually related to it layer by layer around the starting point. Then, it combines the deviation between real-time measurement value and predicted value, the correlation distance in the graph, historical co-occurrence relationship and abnormal propagation direction to quantitatively evaluate the causal contribution of each candidate node, thereby obtaining a ranking result of potential fault causes that is more consistent with the on-site propagation mechanism.

[0064] It is important to emphasize that the fundamental principle upon which this application relies is to view the propagation of anomalies during the operation of industrial equipment as a traceable process constrained by equipment topology, process paths, and control actions. For gas turbines and their auxiliary systems, the relationships between different measuring points are not random but inherently exist, such as structural connections between main equipment and auxiliary systems, process relationships involving the transmission of media from upstream to downstream, control relationships caused by actuator actions leading to changes in feedback measuring points, and recurring co-occurrence relationships from historical faults. This application does not presuppose a fixed machine type, a fixed component classification method, or a fixed fault template. Instead, it addresses industrial equipment environments with multi-source monitoring signals, which can be abstracted into a relational network and have anomaly propagation links. It utilizes the aforementioned relational constraints to directionally expand and converge alarm events layer by layer, avoiding boundless investigation across all measuring points. This reduces interference from secondary alarms, accompanying fluctuations, or irrelevant disturbances, and also helps to provide sequential troubleshooting suggestions when multiple candidate causes coexist, transforming the fault location process from experience-driven to a structured, interpretable, and reusable analytical process.

[0065] Based on this, this application is particularly applicable to the following types of industrial application scenarios: First, scenarios where there is a significant linkage between the main equipment and auxiliary systems, and a local failure may generate associated alarms at multiple locations via lubrication, cooling, sealing, air intake / exhaust, or water supply circuits; Second, scenarios where the anomaly initially manifests as increased bearing temperature, vibration changes, flow deviation, pressure fluctuations, or abnormal actuator movement, but the root cause is not located at the initial alarm measurement point; Third, scenarios where the equipment operation is affected by multiple sets of control logic, protection logic, and interlocking logic, resulting in an intertwined occurrence of measurement point anomalies and changes in execution status; Fourth, scenarios where a certain amount of historical operating data and fault handling records have been accumulated on-site, but existing technologies are still unable to effectively transform this discrete knowledge into a unified reasoning basis that can be used for online fault location. For the above scenarios, this application is not limited to the specific structural form of a particular gas turbine, steam turbine, compressor, generator, oil system, or cooling system. As long as the corresponding object has an abstractable equipment relationship, process relationship, or control relationship, and there are observable measurement point responses and propagation characteristics when an anomaly occurs, the method of this application can be used for fault location analysis.

[0066] refer to Figure 1 , Figure 1 This is an exemplary application scenario diagram provided for an embodiment of this application.

[0067] like Figure 1As shown, in the industrial process equipment operation scenario addressed in this application, the field typically consists of alarm devices, processors, and multiple measuring points distributed across different equipment production lines or units, forming a basic monitoring and analysis environment. Each measuring point is deployed on different objects such as equipment production line one, equipment production line two, and equipment production line three, to collect process variable information related to the equipment's operating status. This process variable information may include parameters reflecting the equipment's health status and operating condition changes, such as temperature, pressure, vibration, current, voltage, flow rate, liquid level, valve position, rotational speed, and interlock status. An alarm device establishes a signal interaction relationship with each measuring point to generate a target alarm event when the corresponding measuring point experiences limit exceedances, abnormal fluctuations, abnormal trends, or interlock triggering. The processor communicates with the alarm device and the data source corresponding to each measuring point to receive the target alarm event and, combined with the process variable data before and after the alarm, locates and analyzes the source of the anomaly.

[0068] It should be noted that, Figure 1 The scenario illustrated is not merely used to describe the acquisition process of a single measuring point alarm, but rather to illustrate a more representative industrial operating environment to which this application applies: a complex equipment scenario where equipment is dispersed, numerous monitoring signals are present, and alarm phenomena and fault sources are usually not located in the same place. In the actual operation of gas turbines, steam turbines, and their auxiliary systems, anomalies often do not present linearly as direct alarms from faulty locations. Instead, they more often manifest as a single measuring point exceeding its limit first, followed by responses from other measuring points with process transmission, structural connection, or control interlock relationships. In other words, what the alarm device first captures is often only the external manifestation of the anomaly within the system, not the true initial fault source. For maintenance personnel, manually investigating solely based on the measuring point location corresponding to the target alarm event can easily lead to misjudging secondary anomalies as the root cause, or repeatedly switching between multiple suspected locations, resulting in decreased location efficiency and even affecting the timeliness of handling the situation.

[0069] It should also be understood that, Figure 1 The equipment production lines 1, 2, and 3 in this application are merely illustrative representations. The corresponding production lines can be understood in this application as different equipment units, different functional modules, different process sections, different auxiliary subsystems, or different operating areas, and are not limited to production line structures in a strict sense. Figure 1 The measuring points are not limited to a specific type of sensor, but rather refer to observation nodes that can characterize the operating status, process status, or control status of equipment. For gas turbine equipment, these observation nodes can be located on the main unit, or in the lubrication system, cooling system, air supply system, exhaust system, hydraulic system, sealing system, and other auxiliary systems.

[0070] It should be noted that this application embodiment also provides a power system equipment fault location system based on chain penetration technology, wherein the system can be configured in the processor, and the system includes:

[0071] The alarm event acquisition module is used to acquire target alarm events and parse them to obtain alarm measurement point identifier, alarm type, alarm occurrence time, and process variable data within the corresponding time window;

[0072] The graph construction module is used to construct an industrial knowledge graph, which is constructed through equipment topology relationships, process flow relationships, control interlock relationships, and historical fault knowledge.

[0073] The candidate node determination module is used to determine a set of candidate measurement point nodes associated with the target alarm event based on the industrial knowledge graph.

[0074] The scoring calculation module is used to calculate the cause contribution score of each candidate measurement point node by combining the deviation between the real-time measurement value and the predicted value of the node, the correlation distance between the node and the target alarm event, the historical co-occurrence frequency, and the consistency of the abnormal propagation direction.

[0075] The result output module is used to sort the candidate test point nodes according to the cause contribution score, output the potential fault cause set of the target alarm event, and generate corresponding troubleshooting suggestions based on the potential fault cause set.

[0076] Example 1:

[0077] Next, with reference to the accompanying drawings, a power system equipment fault location method based on chain penetration technology provided in this application will be further described. Figure 2 The method shown is applied to the location of abnormal alarms in industrial process equipment, and the method includes:

[0078] S1: Obtain the target alarm event and parse it to obtain the alarm measurement point identifier, alarm type, alarm occurrence time, and process variable data within the corresponding time window;

[0079] In this embodiment, the target alarm event can originate from any alarm record in the field alarm device, distributed control platform, protection logic unit, equipment status monitoring unit, or historical operation database that can reflect equipment abnormality.

[0080] Those skilled in the art will understand that operational data can be collected according to actual working conditions and access conditions. Specific types of data can include temperature, pressure, vibration, current, voltage, flow rate, liquid level, valve position, speed, and interlock status, etc. It is sufficient to at least meet the requirement of identifying the operating status and abnormal changes of the equipment based on the operational data. This application does not impose any further limitations on this.

[0081] To avoid making biased judgments based solely on single-point values ​​at a particular moment, this step typically traces back and extends forward within a pre-defined time window, centered on the occurrence of the target alarm event. This allows for the simultaneous extraction of data from the alarm measurement point itself, data related to related equipment components, and data related to upstream and downstream processes. The collected results undergo time alignment, missing data completion, anomaly removal, and dimensional normalization, transforming data from scattered sources with different sampling periods and inconsistent physical meanings into a directly comparable sequence of process variables. This process preserves the dynamic evolution information before and after the target alarm event, preventing occasional fluctuations from being misidentified as genuine fault symptoms. Furthermore, it provides a unified data foundation for subsequent judgments regarding the sequence of anomalies, the intensity of changes, and the direction of propagation. This ensures that subsequent location analysis is not limited to static alarm text but is built upon a traceable operational process.

[0082] S2: Based on a preset industrial knowledge graph, determine a set of candidate measurement point nodes associated with the target alarm event;

[0083] The industrial knowledge graph mentioned above is constructed using equipment topology relationships, process flow relationships, control interlock relationships, and historical fault knowledge.

[0084] In this embodiment, the industrial knowledge graph does not require rigid modeling based on fixed machine types or fixed fault templates. Instead, it is based on the abstraction of relationships between equipment objects, component objects, measurement point objects, execution objects, and fault knowledge. It unifies the long-term accumulated equipment ledgers, process flows, control configurations, measurement point configurations, and historical handling records into a searchable and traceable relational structure. For gas turbines and turbines, the propagation of anomalies is usually not random but is constrained by the equipment connection method, medium flow path, execution feedback link, and protection action logic. Therefore, in this step, when starting from the node corresponding to the target alarm event and expanding candidate nodes outward along the equipment topology, process flow, and control interlocking relationships, we are actually searching for potential anomaly sources according to the actual operating mechanism of the equipment, rather than blindly screening across all measurement points.

[0085] S3: For each candidate measurement point node, calculate the cause contribution score of the candidate measurement point node by combining the deviation between the real-time measurement value and the predicted value of the node, the correlation distance between the node and the target alarm event, the historical co-occurrence frequency, and the consistency of the abnormal propagation direction.

[0086] In this embodiment, the judgment of candidate measurement point nodes does not rely on a single rule, but rather adopts a multi-factor joint measurement method to form a causal contribution score. Specifically, the deviation between the real-time measurement value and the predicted value is used to reflect the anomaly intensity of the node within the current time window; the correlation distance between the node and the target alarm event is used to characterize the proximity of the node in the relationship graph; the historical co-occurrence frequency is used to characterize the accompanying stability of the node's anomaly and the current alarm in past fault samples; and the consistency of the anomaly propagation direction is used to determine whether the node's change trend, occurrence sequence, and propagation path conform to the anomaly propagation logic in the actual operation of the equipment.

[0087] S4: Sort the candidate test point nodes according to the cause contribution score, output the potential fault cause set of the target alarm event, and generate corresponding troubleshooting suggestions based on the potential fault cause set;

[0088] It is understandable that actual anomalies in industrial settings, especially in gas turbines and turbine equipment, often exhibit coupled characteristics. The same alarm phenomenon may be triggered by multiple factors such as decreased lubrication, insufficient cooling capacity, abnormal load conditions, actuator deviation, or component degradation. Directly outputting a single-point conclusion is not conducive to on-site verification and can easily amplify the risk of misjudgment when the sample size is insufficient. This step further maps potential fault causes to pre-defined handling knowledge, generating corresponding troubleshooting paths, verification locations, suggested inspection items, and handling priorities, extending the output from cause identification to on-site actionability. Operation and maintenance personnel no longer face isolated alarm text or difficult-to-interpret score values, but rather a troubleshooting conclusion that combines ranking relationships, mechanistic basis, and operational guidance. This helps shorten the location link, reduce the probability of accidental disassembly and repair, and improve the timeliness of handling anomalies in complex equipment.

[0089] Before delving into the specific technical details of the steps, the embodiments of this application need to be emphasized again.

[0090] The implementation method of this application does not focus on static judgment of a single alarm measurement result, nor on simply applying historical experience to the current anomaly in the form of a rule table. Instead, it treats anomalies in the operation of industrial process equipment as an evolutionary process with transmission constraints, hierarchical responses, and temporal characteristics. For gas turbines, turbines, and their auxiliary devices, anomalies in their operating state usually do not remain in a single isolated location, nor are they fully expressed by a single measuring point. Instead, the same anomaly often occurs within the equipment first in the form of local imbalance, changes in medium conditions, control deviation, or abnormal component response, and then gradually manifests as external signs such as increased temperature, increased vibration, pressure deviation, abnormal flow, or interlocking actions at peripheral measuring points. The alarm results observed on-site are essentially closer to the manifestation after the anomaly has propagated, rather than necessarily corresponding to the location of the initial disturbance source. Therefore, subsequent processing does not rely solely on which measuring point alarms first, but rather identifies the coupling relationships between related objects layer by layer, based on how the anomaly unfolds in the relational network.

[0091] Furthermore, the reason why this application's implementation method adopts a processing approach that revolves around the correlation of target alarm events is mainly because the propagation of anomalies in industrial equipment is not a disorderly spread, but rather governed by existing structural relationships and operating mechanisms. Taking rotating equipment and its auxiliary circuits as an example, when an anomaly occurs in a certain local link, its impact range, direction of action, and subsequent response location are usually constrained by the equipment connection method, process medium path, execution feedback link, and protection interlocking logic. This means that although fluctuations may appear on the surface between different measuring points, not all fluctuations have the same causal status, nor should all responses be treated equally. In engineering practice, those skilled in the art can often make a preliminary judgment based on experience that some anomalies are more likely to come from upstream disturbances, while others are more likely to belong to downstream responses. However, when there are many equipment levels, strong circuit intersections, and dense concurrent alarms, it is difficult to reliably maintain the consistency of such judgments by relying solely on human experience.

[0092] From an implementation perspective, the basic judgment principle upon which the embodiments of this application rely can be understood as follows: For a single target alarm in complex industrial equipment, if a certain associated object is indeed a potential source of failure or a key propagation node, its abnormal behavior should generally satisfy several constraints simultaneously. First, the object should have a traceable connection with the target alarm in terms of equipment structure, process flow, or control function, rather than appearing simultaneously by chance; second, the timing, direction of change, and response trend of the object's abnormal occurrence should have an interpretable consistency with the formation process of the target alarm; third, the object should show a certain degree of support for similar alarms in past operating samples or failure samples, rather than being random noise completely detached from empirical basis. Therefore, in the subsequent development of this embodiment, model prediction, spectral distance, historical co-occurrence, and propagation direction are not treated as independent and isolated conditions, but rather used together as complementary judgment criteria.

[0093] Based on the above understanding, the processing steps in the following implementation process are not several isolated analytical actions, but rather a convergence process completed step by step under the same diagnostic approach: First, the dynamic context of the anomaly at the time of occurrence is recovered from the operational information carried by the target alarm; then, the possible propagation range is constrained using equipment relationship knowledge; subsequently, within the constrained candidate range, it is determined which nodes are more likely to bear the root cause or key propagation role, ultimately forming a result of potential fault causes with a sequential order and investigation direction. Therefore, the focus of subsequent development is not on interpreting a single piece of data, but on explaining how various judgment criteria cooperate with each other in the analysis of the same target alarm, thereby consolidating the originally scattered, concurrent, and difficult-to-interpret field anomaly table into location conclusions that can be directly used by operation and maintenance personnel.

[0094] Next, we will further elaborate on the technical aspects of the method in this application regarding target alarm events.

[0095] In one example, the target alarm event includes at least one or more of the following: abnormal temperature alarm, abnormal pressure alarm, abnormal vibration alarm, abnormal current alarm, abnormal voltage alarm, abnormal flow rate alarm, abnormal liquid level alarm, abnormal valve position alarm, abnormal speed alarm, and interlock trigger alarm. The target alarm event is collected through at least one of the following: a distributed control system, a field instrument acquisition system, an equipment monitoring system, and a historical database.

[0096] It is understandable that the target alarm event is not simply an alarm message triggered by a single measuring point, but rather the result of an abnormality in the equipment's operating status at a specific moment, presented externally in the form of an alarm record. To ensure traceability in subsequent fault location, in this embodiment, the acquisition of the target alarm event is not merely about extracting the alarm name or alarm time, but rather about collecting and organizing the complete context surrounding the alarm. Specifically, when an abnormal record that meets preset conditions appears in the distributed control platform, field instrument acquisition device, dedicated status monitoring device, or historical database, the corresponding measuring point identifier, alarm category, first trigger time, release time, alarm level, and associated equipment object of the abnormal record are first read, and then the operating data sequence within a preset time range before and after the alarm is generated is further correlated and extracted. This preset time range can be set according to equipment characteristics, sampling period, and abnormality propagation speed. For example, for temperature-related abnormalities with large thermal inertia, the pre-alarm tracing period can be appropriately extended; for vibration, speed, or interlock-triggered abnormalities, the time window can be shortened to retain critical transient changes. Those skilled in the art will understand that the granularity of data collection, refresh frequency, and retention period of relevant operational data can all be adjusted according to the on-site deployment conditions, as long as it can at least reflect the state change process before and after the alarm is formed. This application does not impose any stricter limitations on this. Through the above processing, the target alarm event is no longer an isolated text record, but is restored to an event data unit corresponding to the evolution process of the equipment state, providing a basic input for subsequent analysis of its causes.

[0097] In this embodiment, unified parsing of target alarm events from different sources is necessary because the same equipment anomaly may leave different forms of records in different data sources simultaneously. For example, alarms in a distributed control platform are usually manifested as measurement point exceeding limits or state changes; field instrument acquisition links are closer to the original process quantity changes; dedicated monitoring devices may record higher frequency state characteristics; and historical databases often retain information on alarm confirmation, cancellation, and handling processes. If these heterogeneous data are not uniformly mapped, problems such as the same anomaly being repeatedly identified, inconsistent naming of the same measurement point in different databases, or alarm times not corresponding to the original process quantity time axis can easily occur. Therefore, in specific implementations, it is usually necessary to first establish a mapping relationship between alarm identifiers, measurement point identifiers, and equipment object identifiers, then uniformly correct the timestamps from different sources, and record the alarm type, the object to which it belongs, the time of occurrence, the duration, and related process variable fragments according to a unified event structure. For interlocking trigger alarms, their triggering preconditions, action objects, and feedback states can be further parsed; for vibration, temperature, or pressure alarms, their exceeding-limit direction, exceeding-limit amplitude, duration range, and recovery characteristics can also be additionally recorded.

[0098] Next, we will further elaborate on the technical content of the method of this application regarding process variable data.

[0099] In one example, the method for parsing the process variable data includes:

[0100] Based on the alarm measurement point identifier corresponding to the target alarm event, extract the real-time sampling data, historical baseline data, associated device status data, and upstream and downstream associated measurement point data corresponding to the alarm measurement point identifier from a preset time window;

[0101] The extracted process variable data are processed for time alignment, missing data completion, anomaly removal and unit normalization to generate standardized time series data.

[0102] Based on the standardized time-series data, at least one feature information is extracted from the current value, rate of change, fluctuation amplitude, duration, degree of exceeding limit, and recovery trend;

[0103] The feature information is associated and encapsulated with alarm type, alarm occurrence time and alarm measurement point identifier to obtain process variable data for fault location analysis.

[0104] It is understandable that the extraction, preprocessing, and feature organization of the aforementioned process variable data are conventional techniques in industrial data analysis. Their purpose is to transform raw operational data into time-series feature data that is easy to use for subsequent analysis. In this embodiment, after the alarm measurement point identifier corresponding to the target alarm event is determined, it is usually necessary to select a preset time window before and after the alarm occurs, and read the continuous sampled values ​​of the measurement point from the real-time database, historical database, or monitoring records. At the same time, combined with the equipment object relationship, relevant equipment status quantities and synchronous data of upstream and downstream related measurement points are further extracted. The so-called historical baseline data can generally be understood as the normal operating reference value of the measurement point under the same or similar operating conditions. It can be obtained through long-term historical sample statistics, or through sliding window averaging, segmented modeling by operating condition, trend extrapolation, etc. The so-called related equipment status data can be information that reflects the equipment operating background, such as equipment start-up and shutdown status, load status, control mode switching status, valve opening and closing status, and interlock activation and deactivation status. Those skilled in the art will understand that the aforementioned data acquisition methods, time window setting methods, and baseline generation methods can all be flexibly selected according to the specific device and acquisition conditions, as long as they can at least satisfy the requirement of restoring the operating status before and after the alarm and characterizing the change process of the measuring points. This type of data extraction method has been widely used in data playback of distributed control platforms, trend diagnosis in equipment status monitoring, and industrial time series analysis, and will not be elaborated further here.

[0105] After obtaining the raw process variable data, time alignment, missing data completion, anomaly removal, and dimensional normalization are all relatively mature data preprocessing steps in this field. Specifically, since the sampling period, refresh frequency, and data storage cycle of different measuring points are often inconsistent, resampling or interpolation alignment is usually performed first based on a unified time axis. For missing data caused by communication jitter, short-term packet loss, or measuring point refresh delay, methods such as previous value preservation, linear interpolation, spline interpolation, or local window estimation can be used to complete the missing data. For isolated pulse values ​​that are significantly outside the physically reasonable range and do not reflect the actual working conditions, they can be identified and removed according to preset rules. Dimensional normalization is used to eliminate the direct differences in numerical scales between different physical quantities such as temperature, pressure, vibration, and current, facilitating subsequent unified analysis. The aforementioned processing methods are already implemented using numerous existing technologies in process industry data cleaning, condition monitoring preprocessing, fault diagnosis modeling, and industrial intelligent analysis. For example, methods such as sliding window-based data smoothing and point filling, timestamp-based multi-source time series alignment, outlier removal methods based on statistical thresholds or box-shaped distributions, and normalization methods based on minimum-maximum scaling or standard deviation standardization can all be directly used for data preparation in this step. Therefore, this embodiment does not focus on improving the data preprocessing methods themselves, but rather uses the standardized time series data processed by the aforementioned conventional techniques as the basic input for subsequent fault location analysis.

[0106] After standardized time-series data is generated, further extracting features such as current value, rate of change, fluctuation amplitude, duration, degree of exceeding limits, and recovery trend is also a common practice in time-series operational status analysis. Specifically, the rate of change can be obtained by the difference between adjacent sampling points, the fluctuation amplitude can be characterized by the window range, variance, or mean square fluctuation, the duration of the anomaly can be characterized by the length of the exceeding-limit interval, the degree of exceeding limits can be characterized by the deviation of the current value from the threshold, baseline value, or predicted value, and the recovery characteristics can be judged by the subsequent fall rate, fall direction, or trend of recovery to the steady-state interval. Such feature extraction techniques have mature implementation paths in equipment status assessment, alarm compression, operational trend identification, and industrial fault early warning, and this application will not elaborate on them.

[0107] Next, we will further elaborate on the technical content of the industrial knowledge graph method in this application.

[0108] In one example, the industrial knowledge graph is constructed in the following ways:

[0109] Obtain equipment ledger information, process flow information, control logic configuration information, measurement point configuration relationship information, and historical fault handling records for industrial process equipment;

[0110] Based on the equipment ledger information, establish the equipment topology relationship between equipment object nodes, component nodes, and measurement point nodes;

[0111] Based on the process flow information, establish the process flow relationship between different equipment object nodes, component nodes and measuring point nodes;

[0112] Based on the control logic configuration information, a control interlocking relationship is established between the measuring point node and the actuator node;

[0113] Based on the historical fault handling records, the mapping relationship between historical fault phenomena, fault causes, propagation paths and handling measures is extracted to obtain historical fault knowledge.

[0114] The equipment topology, process flow, control interlocking, and historical fault knowledge are integrated to generate an industrial knowledge graph.

[0115] It is understood that the industrial knowledge graph described in this embodiment is not an abstract collection of knowledge, but a structured association model that unifies the expression of object-relationship-operational semantics in industrial process equipment. Its construction begins with engineering data such as equipment ledger information, process flow information, control logic configuration information, measurement point configuration relationship information, and historical fault handling records. Equipment ledger information typically corresponds to equipment codes, equipment names, equipment levels, equipment types, affiliated units, installation locations, hierarchical relationships, and main technical parameters. For example, in a gas turbine scenario, it can be further refined into objects such as the main unit, bearing housing, lubricating oil pump, cooler, filter, actuator, valve, transmitter, and protection circuit. Process flow information typically corresponds to media type, flow direction, inlet / outlet connection relationship, process sequence, and material or energy exchange relationship. For example, lubricating oil enters the bearing oil supply branch from the oil tank via the oil pump, filter, and cooler, or the cooling medium enters the heat exchange component from the inlet side and flows to the outlet side. Control logic configuration information... Information typically corresponds to controller input / output point tables, logical expressions, interlocking conditions, action objects, feedback objects, and protection activation / deactivation relationships. For example, a valve position feedback condition may trigger an actuator action, or a combination of temperature, vibration, and pressure conditions may trigger alarm, load limiting, or shutdown logic. Measurement point configuration information typically corresponds to the measurement point number, measurement object, installation location, measurement type, sampling period, alarm threshold, associated equipment object, and mapping relationship with actuators and process nodes. Historical fault handling records typically include fault phenomenon descriptions, initial alarms, accompanying alarms, final confirmed causes, involved equipment objects, on-site handling measures, and handling results. Those skilled in the art will understand that the above information can originate from design drawings, DCS configuration files, equipment management ledgers, point lists, and maintenance records, or from data configuration files accumulated during actual operation. As long as it can at least support the extraction of equipment object relationships, the establishment of measurement point affiliations, and the organization of anomaly propagation knowledge, this application does not impose further limitations.

[0116] In the specific construction process, the aforementioned engineering data is first parsed into nodes and edges in a graph. Nodes can include at least equipment object nodes, component nodes, measurement point nodes, actuator nodes, and fault knowledge nodes. Equipment object nodes represent entities with independent functional unit attributes, such as gas turbine bodies, lubrication stations, cooling devices, oil pumps, valve assemblies, and bearing housings. Component nodes describe finer-grained structural units within the equipment object, such as bearing pads, seals, cooling coils, filter elements, valve cores, and actuators. Measurement point nodes represent observation locations associated with the object, such as bearing temperature measurement points, inlet pressure measurement points, outlet flow measurement points, vibration measurement points, valve position feedback measurement points, and motor current measurement points. Actuator nodes represent actionable objects, such as regulating valves, electric doors, actuators, motors, and interlocked output objects. Fault knowledge nodes represent knowledge units such as fault phenomena, fault causes, handling measures, or propagation events. Edges describe the relationships between nodes, including at least equipment topology relationships, process flow relationships, control interlock relationships, and historical fault knowledge mapping edges. Equipment topology edges typically correspond to relationships such as "contains," "connects," "installed in," and "belongs to." For example, a bearing temperature measuring point is installed in the bearing housing, the bearing housing belongs to the main unit, and the cooler is connected to the lubrication circuit. Process flow relationship edges typically correspond to the direction of medium or energy transfer. For example, the oil pump outlet flows to the filter inlet, the filter outlet flows to the cooler inlet, and the cooler outlet flows to the bearing oil supply branch. Control interlock relationship edges typically correspond to logical relationships such as "control, feedback, trigger, interlock, and protection." For example, the controller output drives the regulating valve, the valve position feedback returns to the controller, and a certain interlock condition triggers a shutdown command. Historical fault knowledge mapping edges can be used to connect the association between abnormal phenomena, potential causes, propagation paths, and handling measures. For example, an increase in bearing temperature can be mapped to one or more of insufficient oil supply, lubrication deterioration, decreased cooling capacity, and abnormal load, and connected to the corresponding historical propagation chain. To facilitate subsequent calculations, additional information can be written into the node or edge attributes, such as equipment type, measuring point type, upstream and downstream direction, logical weight, typical propagation delay, historical occurrence frequency, and handling success rate.

[0117] Furthermore, to ensure that the graph can directly serve subsequent fault location, this embodiment also requires the fusion and standardization of multi-source relationships. The fusion in this application is not simply piecing together several types of data, but rather unifying and semantically merging descriptions from different sources that point to the same object or relationship. For example, the equipment number in the equipment ledger, the object name in the DCS point table, the equipment identifier in the process flow diagram, and the common name in historical maintenance records may all correspond to the same actual equipment object. In this case, they need to be merged into the same graph node through encoding mapping, name standardization, or master data dictionary methods. Another example is a temperature measuring point that belongs to a bearing component in the measuring point configuration table, participates in high-temperature interlock judgment in the control logic, and frequently co-occurs with lubrication abnormalities in historical faults. In this case, these three types of relationships should be written into the topology, control, and historical knowledge dimensions respectively, rather than retaining only its single attribution information. In practical implementation, an object identifier dictionary can be established first to standardize equipment names, component names, measurement point numbers, and controlled object names. Then, based on rule parsing or script extraction methods, data in the form of triplets can be extracted from ledgers, flowcharts, configuration files, and historical records. Examples include bearing temperature measurement point - installed in - bearing housing, oil pump outlet pressure - upstream connection - oil pump, interlock condition A - trigger - shutdown command, and bearing temperature rise - possible cause - insufficient oil supply. The extraction results are then written into a graph database or relational mapping structure. For historical fault knowledge, terminology can be further normalized for fault texts. For example, low oil pressure, insufficient oil supply pressure, and decreased lubrication supply pressure can be grouped into similar cause labels to improve the reuse capability of historical knowledge.

[0118] Next, we will further elaborate on the technical content of the method of this application regarding the candidate measurement point node set.

[0119] It should be noted that the candidate measurement point nodes in this application are not all nodes in the industrial knowledge graph, nor are they equivalent to all object nodes that have arbitrary connections with the target alarm event. Rather, they refer to observation nodes that, under the analysis time, analysis scope, and propagation conditions corresponding to the current target alarm event, have the potential to become an anomaly source node, a key propagation node, or a key response node.

[0120] In other words, candidate measurement point nodes should first be observable, meaning that abnormal equipment operation can be quantitatively characterized through process variables, state variables, or action variables; secondly, they should be interpretable, meaning that there is a relationship path between the node and the target alarm event that conforms to the equipment's operating mechanism; and thirdly, they should be discriminable, meaning that the node's abnormal performance within the current time window is sufficient to support subsequent differentiated evaluation. Based on this definition, although equipment object nodes, component nodes, fault knowledge nodes, and handling measure nodes in the industrial knowledge graph play an important role in relation organization and semantic constraints, they are not automatically included in the candidate measurement point node set. Only nodes that are directly related to measurement, feedback, action, or state acquisition and can reflect the abnormal propagation process are considered as candidates for subsequent scoring analysis.

[0121] In practical implementation, candidate measurement points typically originate from the following types of observation locations: First, the alarm measurement point itself corresponding to the target alarm event, such as bearing temperature measurement points, lubricating oil pressure measurement points, housing vibration measurement points, valve position feedback measurement points, etc.; Second, adjacent measurement points located in the same equipment object, the same component object, or the same functional circuit as the alarm measurement point, such as temperature and vibration measurement points on the same bearing housing, or inlet pressure and return oil temperature measurement points on the same lubrication circuit; Third, related measurement points that have a clear upstream, downstream, or control relationship with the alarm measurement point, such as observation nodes that have a media supply function, execution control function, or feedback confirmation function for the target measurement point; Fourth, key auxiliary measurement points that have high co-occurrence stability with similar alarms during historical fault processes. Therefore, the candidate measurement point node set is not simply obtained by mechanically truncating the map distance, nor is it included in whole segments according to equipment level. Instead, it focuses on the question of why the target alarm was formed, and performs constrained convergence on the observation nodes with interpretive capabilities. This compresses the originally complex map objects into a set of analytical entry points that are truly relevant to the determination of the current alarm cause. For those skilled in the art, this process does not increase the complexity of map construction, but it can significantly reduce the probability of interference from irrelevant nodes in subsequent calculations, so that the same alarm event can maintain a relatively stable candidate range under different equipment operating conditions.

[0122] In one example, the method for determining the set of candidate measurement point nodes includes:

[0123] S2.1: Using the node corresponding to the target alarm event in the industrial knowledge graph as the starting node, perform multi-level association traversal along the equipment topology relationship, process flow relationship and control interlock relationship in the industrial knowledge graph to obtain an initial candidate node set that has an associated path with the starting node;

[0124] Specifically, once a target alarm event is identified, the process doesn't involve directly searching for abnormal nodes across all measurement points. Instead, the target alarm event is first mapped to a specific starting position within the industrial knowledge graph. This starting position is typically not an abstract alarm record, but rather a measurement point node in the graph corresponding to the alarm. If necessary, it can also be associated with its component node and its corresponding equipment object node. In gas turbine and turbine scenarios, the starting node could be a bearing temperature measurement point, lubricating oil pressure measurement point, valve position feedback measurement point, vibration measurement point, or interlocking status point, etc. If the alarm itself is a state-related event rather than a continuous measurement point, the state point and its corresponding control object node can be used together as a composite starting object. After completing the initial mapping, the graph is expanded from this starting position, ensuring that all nodes subsequently included in the analysis have a clear relationship with the alarm, rather than being based on generalized searches of keywords on the alarm text.

[0125] In this embodiment, multi-level associative traversal is implemented using a constrained graph search method, rather than boundless expansion. Specifically, the edges directly connected to the starting node are first read, and traversal channels are divided according to the relationship type of the edges: for equipment topology relationships, nodes in the same equipment object, component level, or with installation connections as the starting node are prioritized; for process flow relationships, upstream and downstream nodes with the same medium or energy transfer direction as the target alarm are prioritized; for control interlock relationships, control-related nodes involved in the driving, interlock judgment, status feedback, or execution response of the measurement point are visited. During traversal, the node sequence, edge sequence, level depth, and direction attributes of each access path are retained. For example, when the starting node is a high-temperature measurement point of a bearing, the equipment topology channel can be extended to the bearing housing, the unit to which the bearing belongs, and related measurement points on adjacent support components; the process flow channel can be extended to pressure, flow, and temperature measurement points related to the bearing's lubrication, cooling, oil supply, and return; and the control interlock channel can be extended to control points related to cooling switching valves, oil pump start / stop signals, and interlock engagement / disengagement states. To avoid excessive divergence in the graph traversal, a maximum traversal depth is typically preset in implementations. For example, the depth in the device topology direction can be limited to two to four layers, the process flow direction to three to six hops, and the control interlock direction to two to three hops. For loops with very dense relationships, a maximum number of expanded nodes per layer can also be set, for example, only retaining the top ten or top twenty nodes in terms of relationship weight with the starting node in each layer. Through this channel- and depth-based limited expansion, the initial candidate range can cover the main observation nodes that have a reasonable relationship with the target alarm, while avoiding the introduction of a large number of semantically reachable but diagnostically irrelevant nodes due to an excessively large graph size.

[0126] In one example, the multi-level associative traversal includes:

[0127] Using the starting node as the root node, perform a breadth-first traversal in the industrial knowledge graph according to a preset traversal depth threshold to obtain adjacent nodes that match the starting node.

[0128] Based on the edge type between the adjacent node and the starting node, the adjacent nodes are expanded hierarchically to generate node path description information, wherein the equipment topology relationship corresponds to the equipment level expansion, the process flow relationship corresponds to the medium transmission direction expansion, and the control interlock relationship corresponds to the control action link expansion.

[0129] The nodes obtained from each level of traversal and their corresponding node path descriptions are summarized to obtain the initial candidate node set.

[0130] S2.2: Based on the graph path length, relationship type, temporal correlation, and consistency of process propagation direction between each initial candidate node and the starting node, the initial candidate nodes are screened for relevance.

[0131] Specifically, although the initial candidate node set has been constrained by relationships, it still contains a large number of nodes that may be related but may not actually constitute the explanation for the current alarm cause. Therefore, it is necessary to further screen them from four aspects: spatial location, relationship nature, temporal correlation and propagation logic.

[0132] It should be noted that the nodes most prone to misjudgment in industrial settings are not completely unrelated nodes, but rather those nodes that are indeed connected in the graph and show some fluctuations in operational data, but do not have the ability to effectively interpret the current target alarm formation process.

[0133] For example, multiple temperature measurement points within the same device may fluctuate together when the load changes, but only some of these nodes are located upstream of the target alarm. Similarly, some control status points may passively change after an alarm occurs; although they are temporally close to the target alarm, they should not be mistaken for anomaly source nodes. Therefore, correlation screening is not about determining whether there is a connection, but whether that connection is sufficient to support a causal explanation. After this step, subsequent priority assessment will no longer deal with a broad range of correlations, but rather a set of nodes that are spatially, temporally, and mechanistically close to the formation process of the target alarm.

[0134] In this embodiment, the calculation of the path length is not simply a record of the number of edges, but rather an assignment of different interpretation weights based on the type of edges along the path. Specifically, the total number of hops in the candidate main path between the candidate node and the starting node is first counted. Then, based on whether the path traverses equipment topology edges, process flow edges, or control interlocking edges, different distance interpretations are assigned to different relationship segments. For example, measurement points located within the same component and directly connected by installation relationships are usually closer to the target alarm than measurement points connected across equipment objects; two-hop paths between consecutive upstream and downstream nodes in the same process branch are usually more causally interpretable than two-hop control relationships across multiple functional modules. In engineering implementation, the relative distance levels of relationship types can be predefined. For example, installation relationships within the same component are recorded as level one distance, connections within the same equipment are recorded as level two distance, direct upstream and downstream process relationships are recorded as level one or two distance, and cross-control loop feedback relationships are recorded as level two or three distance. The path length is then represented by accumulating the levels of the entire path. At the same time, the relationship types are classified and identified, distinguishing different categories such as structural proximity, media transmission, execution feedback, interlock triggering, and historical co-occurrence assistance, and only retaining the relationship combinations that can explain the current alarm type.

[0135] For example, for pressure anomaly alarms, priority is given to retaining the relationship combinations formed along the medium supply path and the execution control path; for vibration anomaly alarms, more attention is paid to the topological relationships in coaxial, support, and transmission links, as well as protection trigger relationships. After this processing, even if some nodes are not far apart in terms of the number of edges, they will be eliminated in advance if their relationship combination does not match the current alarm type.

[0136] It is understandable that correlation screening is not simply a matter of reducing the number of nodes after the initial candidate node set is formed, but rather a further identification of which nodes can truly explain the formation process of the target alarm event. Although the initial candidate nodes have undergone graph traversal and node validity verification, they may still include some nodes that are only structurally adjacent, only reachable in the process loop, or only connected in the control logic. These nodes may not all have practical explanatory value for the current target alarm. Especially in the operating scenarios of gas turbines, turbines, and auxiliary units, many measuring points naturally have interconnected relationships. The same operating condition disturbance may cause multiple measuring points to change simultaneously. If candidate objects are retained only based on node reachability, it is easy to include nodes that change along with the current situation, passive response nodes, and nodes that are inconsistent with the current anomaly propagation direction, thus leading to an overly broad scope of subsequent analysis. Therefore, in this embodiment, correlation screening adopts a propagation logic prediction and multi-dimensional correlation fusion approach to converge layer by layer. That is, it first determines whether the candidate node and the target alarm meet the basic propagation conditions, and then comprehensively compares the topological location, relational properties, and temporal behavior of the nodes that meet the conditions to see if they are sufficient to support their inclusion in the subsequent analysis scope.

[0137] In this embodiment, the graph path length, edge type combination, alarm occurrence time difference, process variable change trend, and process propagation direction are all obtained based on the aforementioned multi-level association traversal results and the running data within the time window corresponding to the target alarm event.

[0138] Specifically, for each initial candidate node, the main path between it and the starting node is first read from the node path description information, and the number of edges traversed, the edge type sequence, and the number of equipment and process levels crossed by the main path are calculated. The path length in the graph is not simply equivalent to the number of edges, but rather a semantic representation of the distance based on the relational properties on the path. For example, two directly connected measurement points within the same component, even if their path lengths are the same as those of two measurement points connected across process sections, will have different interpretability for target alarms. Therefore, in actual processing, the path length can be decomposed into three sub-distances: structural level distance, process section distance, and control chain distance, and then a unified path length description result can be formed. Edge type combination refers to the arrangement of edge types traversed from the starting node to the candidate node, such as equipment topology relationship and process flow relationship, process flow relationship and control interlock relationship, and equipment topology relationship and control interlock relationship. Many anomaly propagations are not completed along a single relationship, but rather manifest in target alarms only after the combined effects of structural connections, media changes, and control actions. The alarm occurrence time difference is obtained by comparing the candidate node's anomaly start time with the target alarm event trigger time. Specifically, it can be calculated by differentiating the time when the candidate node's process variable first crosses the normal fluctuation range, the time when it enters a continuous abnormal state, or the time when the state point first switches with the target alarm occurrence time. If it is a continuous measurement point, the start time when several consecutive sampling points deviate from the historical baseline in the same direction can be used as the anomaly start point. If it is a state variable point, the state position switching time can be used as the anomaly start point. The process variable change trend is used to characterize the change pattern of the candidate node within the time window before and after the target alarm, specifically including continuous rise, continuous fall, rise followed by stabilization, fall followed by stabilization, pulse mutation, reciprocating oscillation, and state switching maintenance patterns. The process propagation direction is determined based on the process flow relationship and control interlock relationship to determine whether the candidate node is located on the supply side, receiving side, feedback side, or triggering side relative to the target alarm event.

[0139] In this embodiment, determining whether the initial candidate node and the target alarm event satisfy at least one of the following propagation logics based on the process propagation direction is the first substantive filter in the correlation screening.

[0140] Specifically, upstream-to-downstream propagation refers to a clear medium or energy transfer direction between the candidate node and the target alarm, where the candidate node is located upstream of the target alarm's process location on the supply side, processing side, or adjacent transmission side, and can physically lead the target alarm. For example, if the oil supply pressure drop measurement point is upstream of the bearing temperature rise measurement point, insufficient oil supply can affect the bearing's thermal balance along the lubrication circuit, thus satisfying the upstream-to-downstream propagation logic. However, if a measurement point is located in the far-end return branch of the target alarm and can only serve as a result-side response in the process, then this propagation logic is not satisfied. Actuator-to-feedback measurement propagation refers to the candidate node being the source of the action, control output point, or action state point, while the target alarm's corresponding measurement point is the feedback result after that action. For example, a change in the opening degree of a control valve precedes a change in the flow measurement point, or a change in the pump's start / stop state precedes a change in the pressure measurement point. Interlocking trigger propagation refers to the process where candidate nodes represent interlocking conditions, protection states, or logical trigger points, and the target alarm or accompanying anomaly is the result of this logical action. For example, the establishment of a protection condition may cause equipment state switching or control mode changes. For each initial candidate node, it must be determined that it satisfies at least one of the three types of propagation logic mentioned above. If it does not satisfy this, even if there is a path between the node and the target alarm in the graph and there are certain changes within the time window, it is still considered that it cannot provide a valid propagation explanation for the current target alarm and should be eliminated. The judgment here is not an abstract rule, but can be verified one by one by combining the flow direction, execution relationship direction, and interlocking trigger sequence recorded in the graph. For example, the process flow edge records directional attributes such as inlet to outlet, upstream to downstream, and supply to consumption, and the control interlock edge records directional attributes such as control output to execution object, execution object to feedback measurement point, and interlocking condition to protection action object. Then, the overall direction of the path where the candidate node is located is compared with the reasonable direction formed by the target alarm.

[0141] Furthermore, for the remaining initial candidate nodes, the topological relevance is calculated based on the graph path length, the relationship type weight is determined based on the edge type combination, and the time relevance is determined based on the alarm occurrence time difference and the trend of process variable changes. This is to continue to compare the proximity and interpretability of the target alarm among the nodes that have achieved propagation.

[0142] Specifically, topological relevance reflects the proximity of candidate nodes to the starting node in the device relationship graph. In practice, path length can be graded into topological proximity levels. For example, directly adjacent measurement points within the same component can be set to the highest proximity level, measurement points crossing one intermediate node within the same device object can be set to the second highest level, and nodes crossing device objects or process sections more than twice can be set to a lower level. Alternatively, it can be differentiated based on the relationship hierarchy span. For example, nodes that do not cross device object boundaries are higher than nodes that cross one boundary, and nodes that cross two or more boundaries are further lower. For instance, in a local component diagnostic scenario, nodes with a path length of one hop and not crossing device boundaries can be considered first-level neighbors, nodes with a path length of two hops or crossing one device boundary can be considered second-level neighbors, and nodes with a path length of more than three hops and crossing multiple functional units can be considered third-level neighbors. Relationship type weights are used to reflect the differences in the interpretability of different edge type combinations for the current alarm; not all relationship types have the same value for all alarm types. For example, for alarms related to process variables such as flow rate, pressure, and level, process flow relationship is usually more explanatory than pure equipment topology relationship; for alarms related to valve position, control mode, and interlock action, control interlock relationship is usually more explanatory; for alarms closely related to component location, such as vibration and temperature, equipment topology relationship and process flow relationship often need to be considered together. Therefore, different weighting coefficients can be preset for different relationship types. For example, in a typical rotating equipment scenario, the equipment topology relationship coefficient can be set between 0.30 and 0.40, the process flow relationship coefficient between 0.35 and 0.45, and the control interlock relationship coefficient between 0.20 and 0.35. If the current target alarm is an actuator abnormality or interlock abnormality, the control interlock relationship coefficient can be appropriately increased; if the current target alarm is a pressure, flow rate, or temperature disturbance, the process flow relationship coefficient can be appropriately increased. These coefficients can be calibrated by replaying historical fault samples. Specifically, several historical events with known root causes are selected, and the retention of true critical nodes under different coefficient combinations is compared. The coefficient combination that can stably retain critical nodes without excessively amplifying the influence of accompanying nodes is chosen. Time correlation is determined based on the alarm occurrence time difference between the candidate node and the target alarm, as well as the trend of process variable changes. For the time difference, if the candidate node exhibits an anomaly before the target alarm and the time interval is within a reasonable propagation range, a high time correlation is assigned; if it is approximately synchronous with the target alarm and conforms to the characteristics of linked changes, a medium time correlation is assigned; if it is significantly lagging and can only be interpreted as a passive response, the time correlation is reduced. This reasonable propagation range can be set in conjunction with the sampling frequency and equipment propagation characteristics. For example, in vibration and state scenarios with second-level sampling, a lead of several seconds to tens of seconds can be considered reasonable; in temperature and lubrication circuit scenarios with high thermal inertia, a lead of several minutes to more than ten minutes can be considered reasonable.Regarding the trend, it is determined whether the direction of change of the candidate node can support the formation of the target alarm. For example, the combination of decreasing supply pressure and rising downstream temperature is explained in terms of trend, while the slow increase of the far-end return oil temperature after the target alarm usually only constitutes a result-oriented response.

[0143] Furthermore, the topological relevance, relation type weight, and temporal relevance are weighted and fused to obtain a comprehensive relevance index for each initial candidate node. Initial candidate nodes with a comprehensive relevance index lower than a preset relevance threshold are eliminated in order to integrate the aforementioned spatial, relational, and temporal information into a unified screening metric.

[0144] In this embodiment, weighted fusion can be achieved by using a hierarchical scoring and then summarizing, rather than requiring the use of a fixed mathematical formula. Specifically, topological relevance can be divided into three levels: high, medium, and low. The relationship type weights can be mapped to high weight, medium weight, and low weight according to the current target alarm category. Temporal relevance can be divided into four levels: strong temporal support, general temporal support, weak temporal support, and no temporal support. Then, a comprehensive relevance index is obtained according to a preset fusion rule. For example, it can be stipulated that only when a candidate node simultaneously meets the following conditions can it enter the high relevance interval: topological proximity is not lower than medium level, there is at least one high-weight relationship in the relationship type, and temporal relevance is not lower than general temporal support. If a candidate node is weak in one dimension but strong in the other two dimensions, it enters the medium relevance interval. If it is strong only in one dimension but insufficient in the other dimensions, it enters the low relevance interval and is eliminated in this step. The comprehensive relevance index can be converted into a level score from 0 to 100, and the relevance threshold can be set between 55 and 70 points, and then calibrated in combination with historical samples.

[0145] For example, several typical historical events with known root causes of failures can be selected first to verify the retention rate of real critical nodes under different thresholds. If a threshold of 55 points results in too many retained nodes and significant redundancy, while a threshold of 70 points leads to the omission of some real critical nodes, the threshold can be adjusted to 60 or 65 points, and the threshold configuration can be maintained separately according to different device types and alarm categories. For scenarios with few historical samples, a combination of sorting truncation and thresholding can be used. That is, nodes below the lowest relevance threshold are first removed, and then the remaining nodes are sorted according to the comprehensive relevance index, retaining only the top-ranked nodes to enter the next stage.

[0146] S2.3: Based on the process variable fluctuation characteristics, abnormality degree, and historical co-occurrence records of each initial candidate node within the time window corresponding to the target alarm event, the priority of the selected nodes is evaluated.

[0147] Specifically, nodes that have passed the relevance screening already have a good foundation for explaining the causes. However, in real-world scenarios, there may still be multiple nodes that simultaneously satisfy spatial proximity, relational matching, and temporal order. In such cases, it is necessary to further distinguish which node is more worthy of being prioritized for inclusion in the final candidate set. Priority evaluation is not about repeating the relevance judgment, but rather comparing the participation intensity, performance quality, and empirical support of these nodes in the current anomaly process.

[0148] Understandably, anomalies in complex industrial equipment typically don't leave traces at a single node; multiple nodes may actually participate in the same anomaly propagation chain. Some are closer to the root cause, some are closer to intermediate links, and others play a more supplementary role in describing the operating conditions. Without prioritization, subsequent scoring analysis will face a large number of candidate nodes with mixed roles, easily leading to scattered calculation results and ambiguous interpretation order. Therefore, assuming correlation is established, further refining the ranking based on the quality of the node's anomaly performance within the current time window and the degree of support from historical experience ensures that the final candidate nodes not only cover possible causes but also possess strong diagnostic focus capabilities.

[0149] In this embodiment, the fluctuation characteristics of process variables are mainly obtained by analyzing the change curves of nodes within the target alarm time window. Specifically, they can be characterized from several aspects, including the magnitude of the current value's deviation from the baseline, short-term change rate, local fluctuation energy, anomaly duration, and recovery characteristics. For continuous measurement points, their standardized time series within the time window is first read, and then the change trends of several consecutive sampling points before and after the alarm are calculated, such as continuous rise, continuous fall, pulse-like sudden change, slow drift, or high-frequency fluctuation; at the same time, the time taken to reach the abnormal peak and whether there is a drop after the peak are recorded. For state variable nodes, the focus is on the number of state switching, the relative position of the switching time with the target alarm, and whether stability is maintained after the switching. The degree of anomaly is used to measure the strength of the node's deviation from the normal operating state, which can be characterized by its deviation from the historical baseline value, the equipment rated range, the statistical range of different operating conditions, or the predicted reference curve.

[0150] For example, if a lubricating oil pressure measuring point typically falls between 0.35 MPa and 0.42 MPa under the corresponding load conditions, but drops continuously to 0.26 MPa ten minutes before the target alarm occurs, then this node exhibits a high degree of anomaly under the current operating conditions. Conversely, if a temperature measuring point shows an increase but remains within the normal fluctuation range of the operating conditions, its degree of anomaly is relatively low. To avoid direct comparison between different units, in practical implementation, the abnormal amplitude of each node can first be converted into a relative deviation level, such as normalized according to levels like "within the normal fluctuation range," "within 10% of the normal fluctuation range," "more than 10% to 30%," and "more than 30%." By judging the combined effect of fluctuation characteristics and anomaly degree, it is possible to distinguish between auxiliary nodes that, although related, show very weak changes within the current time window, and key nodes that are indeed deeply involved in the current abnormal process.

[0151] In one example, the priority evaluation includes:

[0152] Obtain the process variable fluctuation characteristics, anomaly degree, and historical co-occurrence records of each node within the time window corresponding to the target alarm event after correlation filtering;

[0153] The node fluctuation significance index is calculated based on the fluctuation characteristics of the process variables, wherein the fluctuation significance index is used to characterize the rate of change, fluctuation amplitude, and duration of abnormality of the process variables corresponding to the node.

[0154] The node anomaly intensity index is calculated based on the degree of anomaly, wherein the anomaly intensity index is calculated by the degree of deviation of the node's real-time measurement value from the historical baseline value;

[0155] The node co-occurrence support index is calculated based on the historical co-occurrence records, wherein the co-occurrence support index is used to characterize the frequency of co-occurrence of node anomalies and target alarm events in historical fault samples;

[0156] The priority index of each node is obtained by weighted fusion of the fluctuation significance index, the anomaly intensity index, and the co-occurrence support index.

[0157] S2.4: Nodes whose priority evaluation results meet the preset conditions are determined as the candidate measurement point node set;

[0158] In this embodiment, the preset conditions can be composed of quantity conditions, level conditions, and redundancy removal conditions. The quantity condition controls the size of the final candidate nodes, and an upper limit can be set according to the device complexity and alarm type. For example, for a single device with local anomalies, retaining five to twelve candidate measurement point nodes is sufficient to cover the main cause range; for complex scenarios involving propagation across auxiliary machine loops, this can be relaxed to eight to twenty. The level condition ensures that the retained nodes meet the minimum analyzable priority requirements, and can be implemented using either relative ranking truncation or absolute level truncation. Relative ranking truncation refers to retaining the top-ranking nodes, such as the top eight or top twelve; absolute level truncation normalizes the priority results and sets a retention threshold, for example, only retaining nodes at the "high priority" and "higher priority" levels. If numerical stratification is used, the comprehensive priority can be converted into a level score of 0 to 100, where scores above 70 are considered the priority retention range, scores between 50 and 70 are considered the conditional retention range, and scores below 50 are not retained. The score of 70 is not a fixed value, but can be determined through historical sample playback. For example, in several historical events with known root causes, observe the coverage of the true key nodes when the retention threshold is set to 60, 70, and 80, and select a threshold that can cover the main key nodes without introducing too many interfering nodes. For scenarios with fewer samples, the inflection point method can also be used to determine the threshold, that is, select the boundary position at the turning point from high partition to low partition according to the ranking curve.

[0159] In yet another example, the calculation method for the cause contribution score includes:

[0160] For each candidate measurement point node, a prediction deviation component, an association distance component, a historical co-occurrence component, and a propagation consistency component are calculated. The prediction deviation component is determined based on the deviation between the real-time measured value and the predicted value of the candidate measurement point node. The association distance component is determined based on the graph path length between the candidate measurement point node and the corresponding node of the target alarm event. The historical co-occurrence component is determined based on the co-occurrence frequency, co-occurrence probability, or conditional support of the candidate measurement point node and the target alarm event in historical fault samples. The propagation consistency component is determined based on the degree of consistency between the anomaly occurrence time, anomaly change trend, and propagation direction of the candidate measurement point node and the target alarm event.

[0161] The prediction bias component, correlation distance component, historical co-occurrence component, and propagation consistency component are weighted and fused to obtain the cause contribution score of the candidate measurement point node.

[0162] Example 2:

[0163] Based on the above embodiments, this application also provides a cause contribution correction method based on fault penetration path combination weights. This method is used to further determine a fault penetration path that better matches the current target alarm event propagation mechanism when there are many candidate measurement point nodes, intersecting abnormal propagation paths, or multiple potential causes all have a certain explanatory power. It should be noted that fault penetration in this application does not refer to the fault signal simply being transmitted from one node to another, nor is it an unconstrained combination of all candidate nodes. Instead, it treats the abnormal impact corresponding to the target alarm event as a propagation process that can penetrate layer by layer along equipment topology paths, process flow paths, control interlocking paths, and historical fault paths. This propagation process can be understood as a modeling principle similar to Cartesian product path penetration, that is, selecting path segments that meet the constraints from different types of relational path sets, combining these path segments into candidate fault penetration paths, and then determining the optimal fault penetration path based on the combination weights.

[0164] Specifically, after determining the candidate measurement point node set, the alarm measurement point node corresponding to the target alarm event can be used as the endpoint, and each candidate measurement point node or candidate fault cause node can be used as the starting point to extract equipment topology path set, process flow path set, control interlock path set, and historical fault path set from the industrial knowledge graph. The equipment topology path set represents the structural association between candidate nodes and target alarm nodes in terms of equipment level, component connection, or installation affiliation; the process flow path set represents the directional association of media, energy, or process state transmission from candidate nodes to target alarm nodes; the control interlock path set represents the control action association between actuators, control outputs, feedback measurement points, and interlock conditions; and the historical fault path set represents the empirical association between fault phenomena, fault causes, propagation chains, and handling results in historical fault samples. The paths in each of these path sets can be unilateral paths or multi-level paths formed by sequentially connecting multiple edges, as long as they can form a path from a candidate node to a target alarm node or have an interpretable association with the target alarm node in the industrial knowledge graph.

[0165] To avoid meaningless combinations of all path segments, this embodiment first performs constraint screening on each path segment before performing path combination similar to a Cartesian product. Specifically, screening can be based on path endpoint continuity, propagation direction consistency, temporal compatibility, and relationship type compatibility. Path endpoint continuity means that different path segments should be able to form a connectable relationship in terms of equipment objects, component objects, measurement point objects, or control objects. For example, the upstream equipment object of a certain process flow path should correspond to the same equipment object or adjacent component object in the equipment topology path. Propagation direction consistency means that the combined path as a whole should be able to explain the direction in which the anomaly is transmitted from the candidate cause node to the target alarm node, and there should be no obvious reverse propagation or looping. Temporal compatibility means that the anomaly occurrence time of the upstream node in the candidate path should not be significantly later than that of the downstream node, or their time difference should be within a reasonable propagation range of the corresponding process medium, thermal inertia, mechanical response, or control action. Relationship type compatibility means that the equipment topology relationship, process flow relationship, control interlock relationship, and historical fault relationship should be able to form a combined explanation under the same fault mechanism, rather than being forcibly combined simply because there is a formal connection in the graph.

[0166] After satisfying the above constraints, valid path segments from the equipment topology path set, process flow path set, control interlock path set, and historical fault path set can be combined to obtain a candidate fault penetration path set. It's important to understand that this "Cartesian product-like" approach does not mean a mathematically indiscriminate multiplication of all elements, but rather the selection of compatible path segments from multiple relational dimensions and their combination into a complete fault propagation interpretation unit. For example, a candidate fault penetration path can simultaneously include the "process flow path from the lubricating oil pump outlet pressure measuring point to the lubricating oil supply branch," the "equipment topology path from the lubricating oil supply branch to the bearing temperature measuring point," the "control interlock path triggering a high-temperature alarm at the bearing temperature measuring point," and the "fault knowledge path from historical fault samples where insufficient oil supply leads to bearing temperature rise." This candidate fault penetration path can jointly interpret the target alarm event from multiple aspects, including structural connections, process transmission, control response, and historical experience, thus possessing greater fault location significance compared to a single measuring point anomaly.

[0167] Next, for each candidate fault penetration path, the corresponding combined path weight is determined. The combined path weight can be obtained by fusing at least two of the following: topology support weight, process support weight, control support weight, historical support weight, real-time anomaly support weight, and time support weight. The topology support weight is used to characterize the tightness of the candidate path in the equipment structure. The shorter the path, the fewer intermediate objects it passes through, and the more direct the relationship, the higher the topology support weight. The process support weight is used to characterize whether the candidate path conforms to the direction of media flow, energy transfer, or process state propagation. If the candidate node is located reasonably upstream of the target alarm node or before the function, the process support weight is higher. The control support weight is used to characterize whether the candidate path conforms to the logical relationship between control output, feedback response, interlock trigger, or protection action. The historical support weight is used to characterize the frequency of occurrence, number of handling confirmations, or condition support of the path or similar paths in historical fault samples. The real-time anomaly support weight is used to characterize the anomaly intensity, fluctuation significance, and prediction deviation of each measuring point on the path within the current time window. The time support weight characterizes whether the order in which the anomalies of each node on the path occur conforms to the fault penetration process.

[0168] In a specific example, the various weights mentioned above can be normalized to ensure they fall within a uniform numerical range. Then, they can be weighted and fused according to preset weight coefficients to obtain the combined path weights for each candidate fault penetration path. The preset weight coefficients can be determined by replaying historical fault samples. For example, historical alarm events with known root causes can be selected, and the evaluation criteria can be based on whether the optimal path under different weight combinations covers the actual fault source, retains key propagation nodes, and excludes accompanying response nodes. This determines the appropriate weight combination for the current equipment type or alarm type. For alarms such as pressure, flow, and temperature, which are strongly affected by process transmission, the process support weight and time support weight can be increased. For alarms involving abnormal valve positions, actuator failures, or interlock triggering, the control support weight can be increased. For typical fault modes that recur historically, the historical support weight can be increased.

[0169] Furthermore, embodiments of this application can also determine the influence intensity of the dispersion of candidate fault penetration paths based on information entropy. Specifically, after obtaining the combined path weights of each candidate fault penetration path, the combined path weights can be normalized to obtain the path weight proportion corresponding to each candidate fault penetration path. Subsequently, the path information entropy is calculated based on the path weight proportions. The path information entropy is used to characterize the dispersion of abnormal evidence under the current target alarm event among multiple candidate fault penetration paths. If the path weights of multiple candidate fault penetration paths are relatively close, it indicates that the current abnormal evidence is relatively dispersed among different paths, the fault penetration direction is not concentrated, and the path information entropy is high. If the path weights of a few candidate fault penetration paths are significantly higher than those of other paths, it indicates that the current abnormal evidence is concentrated on a few propagation paths, the fault penetration direction is relatively clear, and the path information entropy is low.

[0170] To facilitate subsequent calculations, path information entropy can be converted into discrete influence strength. For example, the path information entropy can be normalized, and then the discrete influence strength can be obtained by subtracting the normalized path information entropy from the normalized entropy. Therefore, a larger discrete influence strength indicates that the abnormal evidence is more concentrated in a few candidate fault penetration paths, and the fault penetration relationship corresponding to the current target alarm event is clearer; a smaller discrete influence strength indicates that the abnormal evidence is highly dispersed among multiple candidate fault penetration paths, and the current target alarm event may be affected by multiple parallel disturbances, accompanying fluctuations, or secondary responses, making it unsuitable to directly identify a single path as the root cause path. By introducing information entropy, this application can transform the "dispersion degree among multiple candidate paths" into a technical quantity that can participate in scoring correction, thereby avoiding one-sided judgments based solely on the weight of a single path or the anomaly strength of a single node.

[0171] After determining the impact strength of dispersion, the fault penetration score of each candidate fault penetration path can be further calculated. The fault penetration score can be determined based on the combined path weight, dispersion impact strength, and consistency of propagation direction of the candidate fault penetration paths. For candidate paths with high combined path weight, high dispersion impact strength, and propagation direction consistent with the current target alarm event, their fault penetration score is high, indicating that this path is more likely to be the dominant propagation path of the current anomaly from the potential fault source to the target alarm node. For candidate paths with high combined path weight but low dispersion impact strength, it indicates that this path is only one of several possible explanations, and its exclusivity judgment needs to be reduced. For paths with inconsistent propagation directions or incompatible time sequences, even if the local node anomaly strength is high, their fault penetration score should be reduced to avoid misjudging the result response node as the root cause node.

[0172] Based on the fault penetration scores of each candidate fault penetration path, the optimal fault penetration path or a top few preferred fault penetration paths can be determined from the set of candidate fault penetration paths. The optimal fault penetration path can be understood as the propagation explanation path that best satisfies structural correlation, process transmission, control response, historical support, real-time anomaly, and evidence concentration under the current target alarm event. Preferred fault penetration paths can be used to represent alternative propagation explanations when multiple reasonable causes exist. For operational scenarios, outputting preferred fault penetration paths does not mean forcibly providing a single root cause, but rather ranking multiple potential causes according to their fault penetration credibility, allowing on-site investigations to prioritize verification along paths with high penetration scores.

[0173] In one example, if the target alarm event is an increase in bearing temperature, multiple abnormal measurement points exist simultaneously among the candidate nodes, such as increased bearing vibration, decreased lubricating oil supply pressure, increased cooling water outlet temperature, and changes in the position of a remote valve. Using conventional single-point scoring methods, these multiple nodes may all receive high causal contribution scores, resulting in a still wide investigation scope. By adopting the fault penetration modeling method of this embodiment, candidate fault penetration paths can be formed, such as "decreased lubricating oil supply pressure—insufficient bearing oil supply—increased bearing temperature," "decreased cooling water heat exchange capacity—insufficient lubricating oil cooling—increased bearing temperature," and "increased bearing vibration—frictional heating—increased bearing temperature." If the lubricating oil supply pressure decreases significantly before the abnormal bearing temperature in the current time window, and insufficient oil supply and bearing temperature rise have high co-occurrence support in historical samples, while the abnormal evidence for other paths is weak, then the combined path weight of this type of path is high, the path information entropy is low, and the dispersion influence is strong. Ultimately, the path related to insufficient lubricating oil supply can be determined as the priority fault penetration path. Conversely, if the lubricating oil, cooling water, and vibration-related paths all have similar support weights, the path information entropy is high, indicating that the abnormal evidence is scattered. In this case, the system can output multiple preferred paths and reduce the certainty level of the cause contribution score corresponding to a single path.

[0174] Furthermore, after determining the optimal or preferred fault penetration path, the causal contribution scores of candidate measurement point nodes can be corrected using the fault penetration score. Specifically, for candidate measurement point nodes located on the optimal fault penetration path, a penetration gain coefficient can be assigned based on their position in the path, the time of anomaly occurrence, and the node type; for candidate measurement point nodes located on the preferred fault penetration path but not the optimal path, a lower penetration gain coefficient can be assigned; for candidate measurement point nodes that only exhibit anomalies after the target alarm and are not located on an effective fault penetration path, they can be marked as secondary response nodes or accompanying fluctuation nodes, and their causal contribution scores can be attenuated. Thus, this application does not simply recalculate the candidate node scores, but incorporates factors such as whether the node is on the dominant fault penetration path, whether it is upstream of the path, and whether it has historical support and real-time evidence concentration into the causal contribution score correction, making the final output set of potential fault causes closer to the actual fault propagation process.

[0175] Through the above methods, this application's embodiments can further introduce a combined modeling mechanism for fault penetration paths, building upon existing industrial knowledge graph association traversal and causal contribution scoring. This mechanism, on the one hand, utilizes a path combination concept similar to Cartesian products to transform isolated relationships between equipment topology, process flow, control interlocks, and historical fault knowledge into comparable candidate propagation paths; on the other hand, it uses information entropy to characterize the dispersion of anomalous evidence among candidate paths and transforms it into the intensity of dispersion's influence in path scoring. Therefore, when multiple candidate nodes exhibit anomalous behavior, this application can identify whether anomalous evidence is concentrated on a single dominant propagation path or dispersed across multiple possible paths, thereby improving the accuracy, stability, and interpretability of fault localization in complex equipment.

[0176] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for locating faults in power system equipment based on chain penetration technology, characterized in that, A method for locating abnormal alarms in industrial process equipment, comprising: Acquire the target alarm event and parse it to obtain the alarm measurement point identifier, alarm type, alarm occurrence time, and process variable data within the corresponding time window; Based on a preset industrial knowledge graph, a set of candidate measurement point nodes associated with the target alarm event is determined, wherein the industrial knowledge graph is constructed through equipment topology relationships, process flow relationships, control interlock relationships and historical fault knowledge; For each candidate measurement point node, the cause contribution score of the candidate measurement point node is calculated by combining the deviation between the real-time measurement value and the predicted value of the node, the correlation distance between the node and the target alarm event, the historical co-occurrence frequency, and the consistency of the abnormal propagation direction. The candidate test point nodes are sorted according to the cause contribution score, the potential fault cause set of the target alarm event is output, and the corresponding investigation suggestions are generated according to the potential fault cause set.

2. The equipment fault location method based on a power system according to claim 1, characterized in that, The target alarm events include at least one or more of the following: abnormal temperature alarm, abnormal pressure alarm, abnormal vibration alarm, abnormal current alarm, abnormal voltage alarm, abnormal flow alarm, abnormal liquid level alarm, abnormal valve position alarm, abnormal speed alarm, and interlock trigger alarm. The target alarm events are collected through at least one of the following: distributed control system, field instrument acquisition system, equipment monitoring system, and historical database.

3. The equipment fault location method based on a power system according to claim 2, characterized in that, The methods for parsing the process variable data include: Based on the alarm measurement point identifier corresponding to the target alarm event, extract the real-time sampling data, historical baseline data, associated device status data, and upstream and downstream associated measurement point data corresponding to the alarm measurement point identifier from a preset time window; The extracted process variable data are processed for time alignment, missing data completion, anomaly removal and unit normalization to generate standardized time series data. Based on the standardized time series data, at least one feature information is extracted from the current value, rate of change, fluctuation amplitude, duration, degree of exceeding limit, and recovery trend; The feature information is associated and encapsulated with alarm type, alarm occurrence time and alarm measurement point identifier to obtain process variable data for fault location analysis.

4. The equipment fault location method based on a power system according to claim 1, characterized in that, The construction methods of the industrial knowledge graph include: Obtain equipment ledger information, process flow information, control logic configuration information, measurement point configuration relationship information, and historical fault handling records for industrial process equipment; Based on the equipment ledger information, establish the equipment topology relationship between equipment object nodes, component nodes, and measurement point nodes; Based on the process flow information, establish the process flow relationship between different equipment object nodes, component nodes and measuring point nodes; Based on the control logic configuration information, a control interlocking relationship is established between the measuring point node and the actuator node; Based on the historical fault handling records, the mapping relationship between historical fault phenomena, fault causes, propagation paths and handling measures is extracted to obtain historical fault knowledge. The equipment topology, process flow, control interlocking, and historical fault knowledge are integrated to generate an industrial knowledge graph.

5. The equipment fault location method based on a power system according to claim 4, characterized in that, The method for determining the candidate measurement point node set includes: Using the node corresponding to the target alarm event in the industrial knowledge graph as the starting node, a multi-level association traversal is performed in the industrial knowledge graph along the equipment topology relationship, process flow relationship and control interlock relationship to obtain an initial candidate node set that has an associated path with the starting node. Based on the graph path length, relationship type, temporal correlation, and consistency of process propagation direction between each initial candidate node and the starting node, the initial candidate nodes are screened for relevance. Based on the process variable fluctuation characteristics, abnormality degree, and historical co-occurrence records of each initial candidate node within the time window corresponding to the target alarm event, priority evaluation is performed on the selected nodes. The nodes whose priority evaluation results meet the preset conditions are determined as the candidate measurement point node set.

6. The equipment fault location method based on a power system according to claim 5, characterized in that, The multi-level associative traversal includes: Using the starting node as the root node, perform a breadth-first traversal in the industrial knowledge graph according to a preset traversal depth threshold to obtain adjacent nodes that match the starting node. Based on the edge type between the adjacent node and the starting node, the adjacent nodes are expanded hierarchically to generate node path description information, wherein the equipment topology relationship corresponds to the equipment level expansion, the process flow relationship corresponds to the medium transmission direction expansion, and the control interlock relationship corresponds to the control action link expansion. The nodes obtained from each level of traversal and their corresponding node path descriptions are summarized to obtain the initial candidate node set.

7. The equipment fault location method based on a power system according to claim 5, characterized in that, The relevance screening includes: Obtain the graph path length, edge type combination, alarm occurrence time difference, process variable change trend, and process propagation direction between each initial candidate node and the starting node; Based on the process propagation direction, determine whether the initial candidate node and the target alarm event satisfy at least one of the propagation logics of upstream to downstream propagation, actuator to feedback measurement point propagation, and interlocking trigger propagation. If not, the corresponding initial candidate node is removed. For the remaining initial candidate nodes, the topological relevance is calculated based on the path length of the graph, and the relationship type weight is determined based on the edge type combination. Among them, the equipment topological relationship, the process flow relationship and the control interlock relationship correspond to different preset weight coefficients. The time relevance is determined based on the alarm occurrence time difference and the process variable change trend. The topological relevance, relation type weight, and time relevance are weighted and fused to obtain the comprehensive relevance index of each initial candidate node. Initial candidate nodes with a comprehensive relevance index lower than the preset relevance threshold are eliminated.

8. The equipment fault location method based on a power system according to claim 7, characterized in that, The priority evaluation includes: Obtain the process variable fluctuation characteristics, anomaly degree, and historical co-occurrence records of each node within the time window corresponding to the target alarm event after correlation filtering; The node fluctuation significance index is calculated based on the fluctuation characteristics of the process variables, wherein the fluctuation significance index is used to characterize the rate of change, fluctuation amplitude, and duration of abnormality of the process variables corresponding to the node. The node anomaly intensity index is calculated based on the degree of anomaly, wherein the anomaly intensity index is calculated by the degree of deviation of the node's real-time measurement value from the historical baseline value; The node co-occurrence support index is calculated based on the historical co-occurrence records, wherein the co-occurrence support index is used to characterize the frequency of co-occurrence of node anomalies and target alarm events in historical fault samples; The priority index of each node is obtained by weighted fusion of the fluctuation significance index, the anomaly intensity index, and the co-occurrence support index.

9. The equipment fault location method based on a power system according to claim 1, characterized in that, The calculation method for the cause contribution score includes: For each candidate measurement point node, a prediction deviation component, an association distance component, a historical co-occurrence component, and a propagation consistency component are calculated. The prediction deviation component is determined based on the deviation between the real-time measured value and the predicted value of the candidate measurement point node. The association distance component is determined based on the graph path length between the candidate measurement point node and the node corresponding to the target alarm event. The historical co-occurrence component is determined based on the co-occurrence frequency, co-occurrence probability, or conditional support of the candidate measurement point node and the target alarm event in historical fault samples. The propagation consistency component is determined based on the degree of consistency between the anomaly occurrence time, anomaly change trend, and propagation direction of the candidate measurement point node and the target alarm event. The prediction bias component, correlation distance component, historical co-occurrence component, and propagation consistency component are weighted and fused to obtain the cause contribution score of the candidate measurement point node.

10. A power system equipment fault location system based on chain penetration technology, implemented based on the power system equipment fault location method as described in any one of claims 1-9, characterized in that, The system includes: The alarm event acquisition module is used to acquire target alarm events and parse them to obtain alarm measurement point identifier, alarm type, alarm occurrence time, and process variable data within the corresponding time window; The graph construction module is used to construct an industrial knowledge graph, which is constructed through equipment topology relationships, process flow relationships, control interlock relationships, and historical fault knowledge. The candidate node determination module is used to determine a set of candidate measurement point nodes associated with the target alarm event based on the industrial knowledge graph. The scoring calculation module is used to calculate the cause contribution score of each candidate measurement point node by combining the deviation between the real-time measurement value and the predicted value of the node, the correlation distance between the node and the target alarm event, the historical co-occurrence frequency, and the consistency of the abnormal propagation direction. The results output module is used to sort the candidate test point nodes according to the cause contribution score, output the set of potential fault causes of the target alarm event, and generate corresponding troubleshooting suggestions based on the set of potential fault causes.

Images