Knowledge graph-based ring main unit fault root cause analysis method and system

Abstract

The application discloses a knowledge graph-based ring network cabinet fault root cause analysis method and system, relates to the technical field of power equipment fault diagnosis, and comprises the following steps: for the protection constraint candidate root cause path, performing physical domain virtual isolation on the interval switch connection, branch propagation and adjacent cabinet linkage relationship, and performing observation domain virtual isolation on the sampling corresponding, terminal reporting and communication forwarding relationship; comparing the broken link positions of the main evidence bearing chains under different isolation conditions, and generating double-domain virtual isolation verification data; based on the double-domain virtual isolation verification data, performing double-domain broken link difference attribution, distinguishing primary equipment failure from sampling communication link abnormality, identifying key root causes in combination with the protection logic compliance degree and the recording wave evidence coverage degree, and generating ring network cabinet fault root cause analysis data. The application realizes domain attribution of primary equipment failure and sampling communication link abnormality, is used for narrowing the key root cause range, and improves fault disposal pertinence and operation and maintenance efficiency.

Description

Technical Field

[0001] This invention relates to the field of power equipment fault diagnosis technology, and in particular to a knowledge graph-based method and system for root cause analysis of ring main unit faults. Background Technology

[0002] With the development of distribution network automation and digital operation and maintenance of power distribution equipment, ring main units (RNBs) are gradually integrating multi-source operational information such as fault recording, protection actions, switch status, terminal reporting, and communication forwarding. Regarding RNB fault analysis, related technologies have evolved from analysis methods relying on single alarm information or human experience to intelligent diagnostic methods oriented towards multi-source event correlation, time-series tracing, and equipment relationship modeling. Knowledge graphs express equipment objects, protection logic, and fault propagation processes through nodes, relationships, and paths, providing a data representation foundation for evidence organization, correlation retrieval, and root cause inference in complex power distribution scenarios. They are suitable for the unified description of relationships such as bay switches, branch connections, and adjacent cabinet linkages within RNBs.

[0003] Existing ring main unit fault diagnosis technologies still have two limitations: First, fault recordings, protection actions, and terminal events usually have different sampling time scales and object identifiers. Simply relying on time proximity or static equipment relationships for correlation can easily mix in accompanying responses into the fault propagation chain, affecting the accuracy of determining the fault trigger location and root cause path. Second, both primary equipment anomalies and sampling communication link anomalies may manifest as missing events, abrupt state changes, or interrupted evidence transmission. Existing analysis methods lack a comparison and verification mechanism oriented towards physical and observational transmission relationships, which can easily lead to confusion of root cause objects and affect the efficiency of fault handling and location. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a knowledge graph-based root cause analysis method for ring main unit faults to solve the problems of erroneous association of multi-source evidence and difficulty in accurately distinguishing the root causes of faults.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: Firstly, this invention provides a knowledge graph-based method for root cause analysis of ring main unit (RNB) faults, comprising: collecting multi-source operational data of the RNB and extracting fault waveform semantic fingerprints; performing time-stamping correction and object attachment on events from different sources to generate an RNB evidence graph; anchoring the RNB evidence graph to physical changes in time sequence, obtaining fault triggering anchor points, and performing physical layering of evidence, dividing main evidence nodes and shadow evidence nodes, while simultaneously mapping protection setting operation states to generate effective protection logic constraint data; combining the effective protection logic constraint data with the RNB evidence graph, extracting fault association ranges, obtaining local fault evidence subgraphs, and performing protection constraint root cause deduction and protection physical evidence analysis on the local fault evidence subgraphs. According to the closure verification, the degree of compliance of protection logic and the coverage of waveform evidence are obtained. At the same time, path constraint screening is performed to generate candidate root cause paths for protection constraints. For the candidate root cause paths for protection constraints, physical domain virtual isolation is performed on the connection of bay switches, branch propagation and the linkage relationship between adjacent cabinets, and observation domain virtual isolation is performed on the sampling correspondence, terminal reporting and communication forwarding relationship. At the same time, the break position of the main evidence transmission chain under different isolation conditions is compared to generate dual-domain virtual isolation verification data. Based on the dual-domain virtual isolation verification data, dual-domain break difference attribution is performed to distinguish between primary equipment failure and sampling communication link anomaly. The key root causes are identified by combining the degree of compliance of protection logic and the coverage of waveform evidence, and ring network cabinet fault root cause analysis data is generated.

[0007] As a preferred embodiment of the knowledge graph-based root cause analysis method for ring main unit failures described in this invention, the steps for generating the ring main unit evidence graph are as follows: Collect fault waveform data and related event data, aggregate event time periods, and establish a unified event index according to the source object and sampling time sequence. At the same time, remove invalid segments that exceed the sampling stability range and lack association identifiers to generate time period aligned running data. Based on time-aligned running data, the physical change locations in the fault recording are semantically attributed, and the change type, occurrence order and associated objects are written into the fingerprint node to generate a fault recording semantic fingerprint. By combining the semantic fingerprint of the fault recording waveform with the time-aligned operational data, time-stamp correction and object attachment are performed. The semantic fingerprint of the fault recording waveform is then connected with the corresponding ring main unit object and its associated relationships to generate a ring main unit evidence map.

[0008] As a preferred embodiment of the knowledge graph-based ring main unit fault root cause analysis method of the present invention, the steps of dividing the main evidence node and shadow evidence node are as follows: Based on the evidence map of the ring network cabinet, time-series anchoring is performed by combining the order of physical changes and the correlation. The semantic fingerprints of fault recordings are arranged in order according to the start time of physical changes, and the physical connection between adjacent fault recording semantic fingerprints is traced along the correlation. The fault recording semantic fingerprint with the earliest start time and that can form a continuous physical connection chain is determined as the anchor fingerprint. At the same time, the fault trigger anchor point is determined according to the equipment object associated with the anchor fingerprint and the time of physical change. Based on the fault triggering anchor point, the related evidence in the ring main unit evidence map is physically connected and layered. Evidence that forms a continuous physical connection with the fault triggering anchor point is classified as main evidence nodes, and evidence that does not form a continuous physical connection but is related to the fault triggering anchor point is classified as shadow evidence nodes, thus generating fault evidence layering data.

[0009] As a preferred embodiment of the knowledge graph-based ring main unit fault root cause analysis method of the present invention, the steps for generating effective protection logic constraint data are as follows: Based on the layered fault evidence data, the protection setting adaptation status and operation status of the corresponding time period of the fault triggering anchor point are traced back, and the protection relationship in the ring network cabinet evidence map is mapped to generate protection status mapping data. Based on the protection status mapping data, action logic constraints are collected for the protection relationships associated with the main evidence node. Protection exit reachability is verified along the protection initiation relationship and exit acceptance relationship. Protection relationships that meet the operating status corresponding to the fault trigger anchor point and pass the protection exit reachability verification are configured as valid protection relationships, and valid protection logic constraint data is generated.

[0010] As a preferred embodiment of the knowledge graph-based ring main unit fault root cause analysis method of the present invention, the step of obtaining the local fault evidence subgraph is as follows: Based on the effective protection logic constraint data and fault triggering anchor points, forward fault propagation is performed along the protection action relationship, electrical connection relationship and physical connection relationship in the ring network cabinet evidence map, and reverse protection reachability is performed along the effective protection relationship. The associated nodes with continuous connection relationship with the fault triggering anchor points are extracted to generate fault association range data. Based on the fault association range data, the corresponding evidence nodes and associations are extracted from the ring main unit evidence map. The intersection nodes of the forward fault propagation recursion and the reverse protection reachable recursion are retained as nodes. Combined with the effective protection logic constraint data, the protection relationship that is compatible with the fault propagation process is retained. The evidence relationship is merged and encapsulated to generate a local fault evidence sub-graph.

[0011] As a preferred embodiment of the knowledge graph-based ring main unit fault root cause analysis method of the present invention, the steps for generating protection constraint candidate root cause paths are as follows: Extract abnormal nodes from the local fault evidence subgraph, combine them with effective protection logic constraint data to perform root cause path search, configure differentiated path weights for the main evidence node and shadow evidence node, perform root cause path search according to the differentiated path weights, and deduce the corresponding protection action acceptance process and waveform physical change process along the candidate root cause path to generate protection constraint deduction data. The protection action takeover process in the protection constraint simulation data is matched with the effective protection logic constraint data to verify the degree of compliance of the protection logic. The physical change process of the waveform is matched with the semantic fingerprint of the fault waveform in the local fault evidence subgraph to verify the closure and calculate the coverage of the waveform evidence. At the same time, the path constraint is screened according to the degree of compliance of the protection logic and the coverage of the waveform evidence to generate candidate root cause paths for protection constraints.

[0012] As a preferred embodiment of the knowledge graph-based ring main unit fault root cause analysis method of the present invention, the step of performing physical domain virtual isolation is as follows: Extract the fault propagation direction in the candidate root cause path of the protection constraint, identify the physical connection relationship that maintains the continuity of the main evidence connection chain, screen the physical connection relationship that participates in both the main evidence connection and the fault propagation recursion, and determine the position of the physical relationship to be isolated according to the main evidence connection order, and generate a set of physical domain isolation relationships. Based on the physical domain isolation relationship set, the physical connection relationship to be isolated is adjusted to an unreachable state in the ring network cabinet evidence map, while the protection relationship and observation connection relationship unrelated to the physical connection relationship to be isolated are kept in their original state. The main evidence connection chain is re-traced and the break position of the connection chain is recorded to generate a physical domain break record.

[0013] As a preferred embodiment of the knowledge graph-based ring main unit fault root cause analysis method of the present invention, the steps for generating dual-domain virtual isolation verification data are as follows: Based on the physical domain link break records, the sampling correspondence, terminal reporting relationship and communication forwarding relationship in the candidate root cause path of protection constraints are located, and the location of the observation succession relationship to be isolated is determined in combination with the observation source corresponding to the main evidence node, and the observation domain isolation relationship set is generated. According to the observation domain isolation relationship set, the observation connection relationship to be isolated is adjusted to an unreachable state in the ring network cabinet evidence map. The main evidence connection chain is traced again, and the chain break position obtained by the second trace is compared with the chain break position in the physical domain chain break record to generate dual-domain virtual isolation verification data.

[0014] As a preferred embodiment of the knowledge graph-based ring main unit fault root cause analysis method of the present invention, the steps for generating ring main unit fault root cause analysis data are as follows: Based on dual-domain virtual isolation verification data, we conduct a corresponding analysis of the physical domain chain break location and the observation domain chain break location, identify the difference in the main evidence chain under the two types of isolation conditions, and generate chain break attribution data. Based on the chain breakage attribution data, objects whose main evidence is interrupted after physical domain isolation are classified into the primary equipment failure candidate range, and objects whose abnormal characteristics disappear after observation domain isolation are classified into the sampling communication link abnormality candidate range, thus forming the root cause candidate range. For the candidate range of root causes, the credibility of the root causes is compared by combining the degree of compliance of the protection logic and the coverage of the recorded evidence, the key root causes and the scope of related impacts are identified, and the root cause analysis data of the ring main unit failure is generated.

[0015] Secondly, this invention provides a knowledge graph-based ring main unit fault root cause analysis system, including: The data acquisition module is used to collect multi-source operating data of the ring main unit and extract the semantic fingerprint of the fault waveform, perform time-stamping correction and object attachment for events from different sources, and generate the ring main unit evidence map; The node layering module is used to anchor the physical changes in the evidence map of the ring network cabinet, obtain the fault triggering anchor point, and perform physical layering of evidence, dividing the main evidence node and shadow evidence node. At the same time, it performs protection setting operation status mapping and generates effective protection logic constraint data. The protection constraint module is used to combine effective protection logic constraint data with the ring network cabinet evidence map, extract the fault association range, obtain a local fault evidence sub-map, and perform protection constraint root cause inference and protection physical evidence closure verification on the local fault evidence sub-map to obtain the protection logic compliance degree and waveform evidence coverage degree. At the same time, it performs path constraint screening to generate protection constraint candidate root cause paths. The virtual isolation module is used to perform physical domain virtual isolation for the connection of bay switches, branch propagation and linkage relationship of adjacent cabinets for the candidate root cause path of protection constraints, and to perform observation domain virtual isolation for sampling correspondence, terminal reporting and communication forwarding relationship. At the same time, it compares the break position of the main evidence chain under different isolation conditions and generates dual-domain virtual isolation verification data. The root cause identification module is used to perform dual-domain link failure differential attribution based on dual-domain virtual isolation verification data, distinguish between primary equipment failure and sampling communication link anomaly, and identify key root causes by combining the degree of compliance of protection logic and the coverage of waveform evidence, thereby generating root cause analysis data for ring main unit failures.

[0016] The beneficial effects of this invention are as follows: by time-stamping correction, semantic fingerprint attribution, evidence layering, and protective constraint deduction, the physical temporal closure of the fault propagation path is achieved, which is used to eliminate the interference of accompanying events and improve the accuracy of root cause localization and the interpretability of analysis; by virtual isolation between the physical domain and the observation domain and comparison of the link break location, the domain-specific attribution of primary equipment failure and sampling communication link anomaly is achieved, which is used to narrow down the scope of key root causes and improve the pertinence of fault handling and operation and maintenance efficiency. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of a knowledge graph-based root cause analysis method for ring main unit faults.

[0019] Figure 2 A comparison chart of domain attribution accuracy under different true root cause categories.

[0020] Figure 3 This is a graph showing the relationship between the shrinkage rate of the root cause candidate range and the time taken for single-sample analysis.

[0021] Figure 4 A comparison chart of the synergistic effects of core mechanism indicators. Detailed Implementation

[0022] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0023] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0024] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0025] Reference Figures 1-4 This is one embodiment of the present invention, which provides a knowledge graph-based root cause analysis method for ring main unit faults, including the following steps: S1: Collect multi-source operation data of the ring main unit and extract the semantic fingerprint of the fault waveform. Perform time-stamp correction and object attachment for events from different sources to generate the ring main unit evidence map.

[0026] S1.1: Collect fault waveform data and related event data, aggregate event time periods, establish a unified event index according to the source object and sampling time sequence, and remove invalid segments that exceed the sampling stability range and lack association identifiers to generate time period aligned running data.

[0027] Furthermore, fault recording data and associated event data are read. The associated event data includes protection action events, switch status events, protection setting configuration records, protection operation status records, terminal reporting events, and communication forwarding events. Protection setting configuration records include the protected object identifier, the protected object identifier, the protection setting version, and the setting effectiveness time stamp. Protection operation status records include protection activation / deactivation status, operation mode switching status, protection action status, output status, and corresponding status timestamps. Terminal reporting events include the sampling source identifier, the sampled object identifier, the terminal identifier, the message source identifier, the event timestamp, and the reporting order. Communication forwarding events include the message identifier, the communication forwarding node identifier, the forwarding timestamp, and the forwarding order.

[0028] Using the abnormal occurrence intervals in fault recording data as a collection reference, related event data are grouped into event time periods according to the source object, sampling time sequence, status timestamp, and forwarding timestamp. Protection action events, switch status events, protection setting configuration records, protection operation status records, terminal reporting events, and communication forwarding events corresponding to the same abnormal change process are written into the same event time period. For event records with different source objects but similar time locations, their classification into the same event time period is determined based on their correspondence with the abnormal occurrence interval, the sampled object, the protected object, or the message transmission order.

[0029] A unified event index is established based on the sampling sequence, status activation sequence, and message forwarding sequence within the event time period, enabling traceable positional relationships between fault waveform data and related event data. Records with sampling changes exceeding the sampling stability range, missing source objects, related objects, or time sequence positions are removed. Records with complete sampling sequence, protection status, and observation continuity are retained and aligned to the time period to generate time-aligned operational data.

[0030] It should be noted that protection setting configuration records can be obtained from protection device configuration files, setting management records, or master station setting issuance records; protection operation status records can be obtained from protection device status records, protection action records, or master station operation status records; terminal reported events and communication forwarding events can be obtained from terminal event records, master station event receiving records, communication forwarding records, or communication operation logs, respectively; the sampling stability range is set according to the sampling interval, normal fluctuation amplitude, and continuity of abnormal change process of fault waveform data.

[0031] The sampling stability range (example range: the variation amplitude of adjacent sampling points is within 0.8 to 1.2 times the historical normal fluctuation range of the corresponding waveform data) is set according to the sampling interval of the fault waveform data, the fluctuation amplitude of each source object under normal operating conditions, and the continuity of the effective change process during abnormal periods.

[0032] S1.2: Based on time-aligned running data, semantically assign the physical change locations in the fault recording waveform, and combine the change type, occurrence order and associated objects to write into the fingerprint node to generate the fault recording waveform semantic fingerprint.

[0033] Furthermore, fault waveform segments in the time-aligned operational data are read, and the arrangement position of each waveform segment within the abnormal time period is located according to a unified event index. Continuous change intervals are identified along the waveform change sequence of the same sampled object. For continuous change intervals, the starting position of the waveform transitioning from a stable state to an abnormal state is first determined, and then the continuation and recovery positions of the abnormal state are tracked, ensuring that each physical change position has a clear temporal boundary. The identified physical change positions are matched with the corresponding sampled object's location within the ring main unit to determine whether the physical change was caused by a sudden electrical quantity change, a state switch, or a protection response, thus completing the semantic attribution of the physical change position.

[0034] The occurrence order of physical changes within the same anomalous time period is organized, and related physical change locations are connected to form continuous fingerprint segments. For each continuous fingerprint segment, its corresponding change type, occurrence order, and associated object are written into the fingerprint node, enabling the fingerprint node to characterize where, how, and with which object the physical change occurred. When multiple physical change locations point to the same associated object, the corresponding fingerprint nodes are associated in order of occurrence; when the same physical change location is associated with multiple objects, the object correspondence is preserved, forming a fault recording semantic fingerprint that can be used for subsequent time-stamping correction and object attachment.

[0035] S1.3: Combine the fault recording semantic fingerprint with the time-aligned operation data, perform time stamp correction and object attachment, and connect the fault recording semantic fingerprint with the corresponding ring network cabinet object and its association to generate a ring network cabinet evidence map.

[0036] Furthermore, based on the semantic fingerprint of fault recordings and time-time aligned operational data, the order of occurrence of physical changes in the semantic fingerprint of fault recordings is used as a correction reference to compare the relative positions of protection action events, switch status events, terminal reporting events, and communication forwarding events in a unified event index. For event records with deviations in index positions, time stamp correction is performed based on their relative temporal relationship with the corresponding semantic fingerprint of fault recordings, ensuring that physical changes, protection responses, status changes, and observed events are under the same temporal reference. For protection setting configuration records and protection operation status records, their applicable positions within the current abnormal time period are determined based on the setting effective time stamp and status time stamp, generating fingerprint association results.

[0037] According to the associated objects corresponding to the fault waveform semantic fingerprints, each fingerprint node is attached to the corresponding ring network cabinet object, and a graph connection is established along the equipment ownership relationship, physical connection relationship and action succession relationship; for multiple fault waveform semantic fingerprints of the same object that appear in the abnormal period, the temporal relationship within the object is established according to the corrected occurrence order; for multiple objects associated with the same physical change process, a cross-object succession relationship is established.

[0038] Write the associated events that have been calibrated to the corresponding objects and fingerprint nodes, and write the protected object identifier, protected object identifier, protection setting version, setting effective time stamp and protection start relationship from the protection setting configuration record to the corresponding protection relationship. Write the protection enable / disable status, operation mode switching status, protection action status, exit status and corresponding status time stamp from the protection operation status record to the status attribute of the corresponding protection relationship, so that the protection relationship can be traced back to the corresponding protection setting version and operation status.

[0039] A sampling correspondence is established based on the sampling source identifier and the sampled object identifier. A terminal reporting relationship is established based on the terminal identifier, message source identifier, event timestamp, and reporting order. A communication forwarding relationship is established based on the message identifier, communication forwarding node identifier, forwarding timestamp, and forwarding order. Adjacent communication forwarding nodes are connected according to the communication forwarding order, so that the main evidence node can trace back to the corresponding observation source along the sampling correspondence, terminal reporting relationship, and communication forwarding relationship, and generate a ring network cabinet evidence map.

[0040] It should be noted that the sampling correspondence is used to connect the sampling source node and the sampled object node, and includes at least the sampling source identifier, the sampled object identifier, and the sampling time stamp; the terminal reporting relationship is used to connect the terminal node and the corresponding event record node, and includes at least the terminal identifier, the event identifier, the message source identifier, the reporting time stamp, and the reporting order; the communication forwarding relationship is used to connect adjacent communication forwarding nodes, and includes at least the identifier of the previous communication forwarding node, the identifier of the next communication forwarding node, the message identifier, the forwarding time stamp, and the forwarding order.

[0041] Among them, the sampling time stamp is used to determine the original observation time corresponding to the sampling data, the reporting time stamp is used to determine the acceptance time of the event record entering the terminal reporting process, and the forwarding time stamp and forwarding order are used to determine the transmission direction and sequential position of the same message in the communication link; the sampling correspondence, terminal reporting relationship and communication forwarding relationship together constitute the observation acceptance path of the main evidence node, and are used to locate the observation acceptance relationship to be isolated when the observation domain is virtually isolated in the subsequent observation domain.

[0042] S2: Perform physical change timing anchoring on the ring main unit evidence map, obtain fault trigger anchor points, and perform physical acceptance layering of evidence, divide the main evidence nodes and shadow evidence nodes, and simultaneously perform protection setting operation status mapping to generate effective protection logic constraint data. S2.1: Based on the evidence map of the ring network cabinet, time-series anchoring is performed by combining the order of physical changes and the correlation. The semantic fingerprints of fault recordings are arranged in order according to the start time of physical changes, and the physical connection between adjacent fault recording semantic fingerprints is traced along the correlation. The fault recording semantic fingerprint with the earliest start time and that can form a continuous physical connection chain is determined as the anchor fingerprint. At the same time, the fault trigger anchor point is determined according to the equipment object associated with the anchor fingerprint and the time of physical change.

[0043] Furthermore, the fault waveform semantic fingerprints in the ring main unit evidence map are read and arranged sequentially according to the start time of the physical change corresponding to each fault waveform semantic fingerprint, so that the physical change processes within the same fault period form a continuous temporal sequence. For fault waveform semantic fingerprints with similar start times, it is determined whether they belong to the same physical change process by combining their associated objects and map connection relationships; for fault waveform semantic fingerprints that do not belong to the same process, their independent temporal positions are retained to avoid mixing concurrent changes without direct connection into the same anchor chain.

[0044] After sequential arrangement, the physical continuity of adjacent fingerprints is traced along the correlation between the semantic fingerprints of the fault waveform to determine whether the physical changes reflected in the previous fault waveform semantic fingerprint can form a continuous response in subsequent fingerprints. If adjacent fingerprints have a continuity relationship in terms of associated objects, direction of change, and order of occurrence, they are connected to form a physical continuity chain; if there is only a temporal proximity relationship but no continuity of physical change, they are not included in the physical continuity chain. By comparing the starting position and continuity of each physical continuity chain, candidate fingerprints that can reflect the initial physical change process of the fault are selected.

[0045] The fault waveform semantic fingerprint with the earliest start time and continuous physical continuity is selected from the candidate fingerprints as the anchor fingerprint. The device object and physical change time associated with this anchor fingerprint are then read. The spectral location corresponding to the device object and the physical change time are written together into the fault trigger anchor point. This allows the fault trigger anchor point to identify the device location where the anomaly first occurred and to serve as a unified tracing starting point for subsequent analysis of the main evidence node, shadow evidence node, and protection relationship, thus generating the fault trigger anchor point.

[0046] S2.2: Based on the fault triggering anchor point, perform physical connection layering on the related evidence in the ring main unit evidence map. Evidence that forms a continuous physical connection with the fault triggering anchor point is classified as main evidence node, and evidence that does not form a continuous physical connection but is related to the fault triggering anchor point is classified as shadow evidence node, generating fault evidence layering data.

[0047] Furthermore, based on the equipment object corresponding to the fault triggering anchor point, the time of physical change, and its associated position in the ring main unit evidence map, associated evidence is retrieved along the existing map relationships, starting from the fault triggering anchor point. For the retrieved associated evidence, a step-by-step acceptance judgment is made according to its temporal position, object association position, and physical change direction with the fault triggering anchor point. This involves tracing whether the associated evidence can be continuously derived from the initial physical change reflected by the fault triggering anchor point, or whether it can continue to support subsequent physical change processes. If the associated evidence is temporally located after the fault triggering anchor point, and its associated object is within an acceptable physical change path, then the associated evidence is retained and included in the physical acceptance layer scope; if the associated evidence has no traceable association position with the fault triggering anchor point, it is not considered as the layer object corresponding to the current fault triggering anchor point.

[0048] For related evidence entering the physical continuity layer, check whether it maintains continuous physical continuity with preceding and subsequent evidence. For related evidence that can form a continuous continuity chain along the relationship and jointly explain the subsequent physical changes of the fault trigger anchor point, configure it as a primary evidence node; the primary evidence node retains its sequential position and the position of the related object in the continuity chain. For related evidence that has a relationship with the fault trigger anchor point but only manifests as proximity in time, accompanying state, or subsequent response, and cannot form a continuous physical continuity with preceding or subsequent evidence, configure it as a shadow evidence node. Write the primary evidence node, shadow evidence node, and their layering relationship into the ring main unit evidence map to generate fault evidence layering data.

[0049] S2.3: Based on the fault evidence layered data, trace back the protection setting adaptation status and operation status of the time period corresponding to the fault triggering anchor point, perform state mapping on the protection relationship in the ring network cabinet evidence map, and generate protection state mapping data.

[0050] Furthermore, based on the fault triggering anchor points in the fault evidence layered data, and according to the physical change time corresponding to the fault triggering anchor points, the protection relationships within the same fault period as the fault triggering anchor points are read from the ring main unit evidence map. The protected object identifier, protected object identifier, protection setting version, setting effective time stamp, protection activation status, protection deactivation status, operation mode switching status, protection action status, and exit status corresponding to each protection relationship are also read. According to the protected objects, protected objects, and their associated main evidence nodes connected by the protection relationships, the effective time stamp of the protection setting version is compared with the physical change time corresponding to the fault triggering anchor point. The protection setting version that was in effect when the fault triggering anchor point was formed and matches the current operation mode is determined as the protection setting adaptation status. Simultaneously, the operation status of the protection relationship is determined based on the protection activation status, protection deactivation status, operation mode switching status, protection action status, and exit status.

[0051] Protection relationships that have been switched, exited, not put into operation, or whose protection setting version has not taken effect within the time period corresponding to the fault trigger anchor point are not considered as valid mapping objects for the current fault process; for protection relationships whose protection settings are in an adapted state, whose protection relationships are in an operational state, and which can be associated with the main evidence node, their temporal correspondence with the fault trigger anchor point is retained.

[0052] The retained protection relationships are re-marked according to the status of the fault trigger anchor point during the corresponding time period, so that each protection relationship can reflect its applicable status in the current fault process. For cases where multiple protection relationships are associated with the same protected object, the currently valid relationship and the non-currently valid relationship are distinguished based on the correspondence between its operating status and the fault trigger anchor point, avoiding the introduction of historical or incompatible protection relationships into the protection action analysis. The re-marked protection relationships are then written back to the ring main unit evidence map, and a status mapping relationship is established with the fault trigger anchor point and the main evidence node to generate protection status mapping data.

[0053] S2.4: Based on the protection status mapping data, collect the action logic constraints of the protection relationships associated with the main evidence node, perform protection exit reachability verification along the protection initiation relationship and exit acceptance relationship, configure the protection relationships that meet the operating status corresponding to the fault trigger anchor point and pass the protection exit reachability verification as valid protection relationships, and generate valid protection logic constraint data.

[0054] Furthermore, based on the protection relationships corresponding to the main evidence node in the protection status mapping data, and according to the operating status of the fault trigger anchor point during its time period, the action conditions and connection positions of each protection relationship are collected. Protection relationships that can participate in fault response for the same protected object under the current operating status are organized into action logic constraint ranges, and the physical connection chain associated with the main evidence node is checked to see if the protection initiation relationship has a corresponding abnormal triggering basis. Protection relationships whose initiation is incompatible with the physical change process of the main evidence node, or whose operating status is inconsistent with the time period corresponding to the fault trigger anchor point, are not included in the subsequent exit connection analysis scope to avoid interference from protection logic outside the current operating status in fault root cause deduction.

[0055] Protection exit reachability is verified along the protection initiation and exit acceptance relationships that retain the protection relationships, tracing whether an exit path can be formed in the current operating state after protection initiation, connecting with subsequent actions. Protection relationships where a continuous correspondence can be formed between protection initiation, exit acceptance, and associated main evidence nodes are configured as valid protection relationships; protection relationships lacking exit acceptance positions or unable to correspond to main evidence nodes retain their state mapping results but are not configured as valid protection relationships. Valid protection relationships and their corresponding action logic constraint positions are written into the ring main unit evidence map, forming valid protection logic constraint data for subsequent fault association range extraction and protection constraint root cause inference.

[0056] S3: Combine the effective protection logic constraint data with the ring main unit evidence map, extract the fault association range, obtain the local fault evidence sub-map, and perform protection constraint root cause inference and protection physical evidence closure verification on the local fault evidence sub-map to obtain the protection logic compliance degree and waveform evidence coverage degree. At the same time, perform path constraint screening to generate protection constraint candidate root cause paths.

[0057] S3.1: Based on the effective protection logic constraint data and fault triggering anchor points, forward fault propagation is performed along the protection action relationship, electrical connection relationship and physical connection relationship in the ring network cabinet evidence map, and reverse protection reachability is performed along the effective protection relationship. The associated nodes that have a continuous connection relationship with the fault triggering anchor points are extracted to generate fault association range data.

[0058] Furthermore, based on effective protection logic constraint data and fault triggering anchor points, the device objects associated with the fault triggering anchor points serve as the starting point for forward fault propagation. The system traces subsequent associated locations layer by layer along the protection action relationships, electrical connection relationships, and physical connection relationships in the ring main unit evidence map. At each associated location, it checks whether the location can inherit the physical change process of the previous location and whether it falls within the action range allowed by the effective protection logic constraint data. Associated locations that meet the acceptance conditions continue as the starting point for the next layer of propagation; associated locations that do not meet the acceptance conditions stop expanding backward. Through forward fault propagation, continuous fault propagation paths extending outward from the fault triggering anchor points are identified, and the associated nodes in the paths and their acceptance order are preserved.

[0059] Based on the forward fault propagation recursion, starting from the effective protection relationships associated with the fault triggering anchor point, a reverse protection reachability recursion is performed along the reachable direction of protection actions to trace the preceding associated positions that can support the formation of the current protection response. The associated positions obtained from the reverse protection reachability recursion are mapped to the associated positions obtained from the forward fault propagation recursion, and associated nodes that are simultaneously in both the fault propagation path and the protection reachable path are selected. Nodes that can only be reached by a single path and cannot form a connection with another recursion direction are not considered core nodes in the current fault association range. The selected associated nodes, their corresponding connection sequences, and their association relationships with the fault triggering anchor point are aggregated to generate fault association range data.

[0060] S3.2: Based on the fault association range data, extract the corresponding evidence nodes and association relationships from the ring main unit evidence map, retain the intersection nodes of the forward fault propagation recursion and the reverse protection reachable recursion as the retained nodes, and retain the protection relationship that is compatible with the fault propagation process in combination with the effective protection logic constraint data, merge and encapsulate the evidence relationship, and generate a local fault evidence sub-map.

[0061] Furthermore, based on the fault association range data and the recorded associated nodes and their succession order, the evidence nodes and association relationships corresponding to the current fault propagation process are located in the ring main unit evidence map. The path nodes obtained from the forward fault propagation recursion are matched one-to-one with the path nodes obtained from the reverse protection reachability recursion, identifying the intersection nodes simultaneously covered by both types of recursion paths. Intersection nodes indicate that the location can both accept the physical changes propagating outward from the fault triggering anchor point and support the reachability process of the current effective protection relationship; therefore, intersection nodes are marked as reserved nodes. For nodes located only in a single-sided recursion path, their association positions with reserved nodes are retained to maintain the integrity of the local map, but they are not used as core supporting nodes for local fault analysis.

[0062] From the ring main unit evidence map, retainable nodes, evidence nodes connected to the retainable nodes, and their relationships are extracted. Based on valid protection logic constraint data, each protection relationship is checked to ensure it matches the current fault propagation process. Protection relationships that can form a protection action connection with the retainable node and conform to the operating state corresponding to the fault trigger anchor point are retained; protection relationships that cannot form a corresponding connection are not included in the local scope. The extracted evidence nodes, retained protection relationships, and their physical connection relationships are merged and encapsulated according to the fault propagation direction, so that the node relationships within the local scope can continuously represent the propagation process from the fault trigger anchor point to the protection response location, generating a local fault evidence sub-graph.

[0063] S3.3: Extract abnormal nodes from the local fault evidence subgraph, perform root cause path search in combination with effective protection logic constraint data, configure differentiated path weights for main evidence nodes and shadow evidence nodes, perform root cause path search according to differentiated path weights, and deduce the corresponding protection action acceptance process and waveform physical change process along the candidate root cause path to generate protection constraint deduction data.

[0064] Furthermore, abnormal nodes are extracted from the local fault evidence subgraph. The associated locations of these abnormal nodes are used as the starting point for root cause path searching, and valid protection logic constraint data is retrieved to constrain the protection relationships within the search scope. The search traces back along the physical connections, protection action relationships, and electrical connection relationships in the local fault evidence subgraph to the possible source of the anomaly. The search stops in the direction of an anomaly if a relationship is encountered that is incompatible with the valid protection relationship or cannot form a continuous connection. The relationships that can be traced back from the abnormal node to the possible source of the anomaly are sequentially connected to form initial candidate root cause paths, ensuring that each initial candidate root cause path retains the connection process between the source of the anomaly and the abnormal node.

[0065] Differentiated path weights are configured for the primary evidence nodes and shadow evidence nodes in the initial candidate root cause paths. This ensures that the primary evidence nodes have a significant impact on path extension and retention, while the shadow evidence nodes serve only as auxiliary references for path association. The initial candidate root cause paths are then searched again according to these differentiated path weights, retaining those with continuous primary evidence and conforming to valid protection logic constraints. The protection action response process triggered by the anomaly source is deduced along the retained candidate root cause paths, and the corresponding waveform physical change process is tracked. The deduced protection action response process and waveform physical change process are written into the candidate root cause paths to generate protection constraint deduction data.

[0066] S3.4: Verify the correspondence between the protection action takeover process in the protection constraint deduction data and the effective protection logic constraint data, calculate the degree of compliance of the protection logic, and perform a closure verification between the recorded physical change process and the fault recorded semantic fingerprint in the local fault evidence subgraph, calculate the degree of coverage of recorded evidence, and at the same time, perform path constraint screening based on the degree of compliance of the protection logic and the degree of coverage of recorded evidence to generate candidate root cause paths for protection constraints.

[0067] Furthermore, the protection action acceptance process in the protection constraint deduction data is read and matched segment by segment with the valid protection relationships retained in the valid protection logic constraint data. For each candidate root cause path, the deduced protection initiation position, action transmission sequence, and exit acceptance position are checked to see if they are within the action range allowed by the valid protection relationship. Protection action acceptance processes that can continuously correspond to the valid protection logic constraint data are retained; those with reversed action sequences, missing exit acceptances, or incompatible operating states are marked as non-compliant positions. Based on the overall correspondence of protection action acceptance processes in the candidate root cause paths, the degree of protection logic compliance is calculated, so that this degree can reflect the matching level between the candidate root cause path and the actual protection logic during the fault period.

[0068] The physical change process of the recorded waveforms in the protection constraint deduction data is read, and the corresponding fault waveform semantic fingerprint is located in the local fault evidence subgraph. The starting position, sequence of changes, and associated objects of the deduced physical changes are checked to see if they can be closed and supported by existing fault waveform semantic fingerprints. The physical change processes that receive corresponding support are included in the covered range, while processes whose corresponding fingerprints cannot be found in the local fault evidence subgraph are included in the uncovered range. The coverage degree of the recorded waveform evidence is calculated accordingly. Based on the degree of compliance with protection logic and the coverage degree of recorded waveform evidence, path constraint screening is performed on candidate root cause paths. Paths with a high degree of closure in both protection action continuation and physical change of recorded waveforms are retained, generating candidate root cause paths for protection constraints.

[0069] The formula for calculating the degree of compliance of protection logic is: ; in, Indicates the degree of compliance of the protection logic. This indicates the number of protective action acceptance processes in the candidate root cause path. Indicates the first The path weight of each protection action receiving process Indicates the first Protection activation matching value during the protection action takeover process Indicates the first The achievable value of the protection output during the protection action receiving process. Indicates the first The sequence of protection actions in each protection action succession process is consistent. This indicates the number of broken protection chains in the candidate root cause path. This indicates a non-zero adjustment value to prevent the denominator from being zero.

[0070] The formula for calculating the coverage of recorded evidence is: ; in, Indicates the coverage of recorded evidence. This indicates the number of recorded physical change processes obtained from candidate root cause path deduction. Indicates the first The weight of evidence for each recorded physical change process Indicates the first The change type matching value between the inferred physical change process and the semantic fingerprint of the fault recording waveform. Indicates the first The correlation value between the inferred physical change process and the semantic fingerprint of the fault recording is a matching value of the associated object. Indicates the first The order of physical changes between the deduced physical change process and the semantic fingerprint of the fault recording is consistent. This indicates the number of adjacent recorded physical change processes that cannot form a closed loop. This indicates a non-zero adjustment value to prevent the denominator from being zero.

[0071] It should be noted that the protection action acceptance process in the candidate root cause path consists of the protection initiation position, action transmission sequence, and exit acceptance position derived from the protection constraint deduction. The path weight of each protection action acceptance process is determined based on whether the corresponding node belongs to the main evidence node or the shadow evidence node, its position in the main evidence acceptance chain, and its degree of support for the continuity of fault propagation. Among them, the weight of the process corresponding to the main evidence node is higher than that of the process corresponding to the shadow evidence node. The protection initiation matching value is obtained by comparing the deduced initiation position with the initiation conditions in the effective protection relationship. The protection exit reachability value is obtained by checking whether the deduced exit can reach the corresponding exit position along the effective protection relationship. The protection action sequence consistency value is obtained by comparing the deduced action sequence with the protection action acceptance sequence. During the calculation, the average of the three matching results for each protection action acceptance process is first taken, then the results are weighted and summarized according to the path weight, and finally the continuity is deducted based on the number of protection acceptance chain breaks. The number of protection acceptance chain breaks is obtained by statistically analyzing the positions where there is no continuous correspondence between protection initiation, action transmission, or exit acceptance. The non-zero adjustment value is a fixed small positive number to avoid the denominator being zero when the candidate root cause path contains only a single acceptance process.

[0072] The protection logic compliance formula is designed around the protection initiation matching, protection exit reachability, and protection action sequence consistency in candidate root cause paths. It simultaneously verifies whether protection actions have an initiation basis, can form an effective exit connection, and conform to the actual action sequence. Furthermore, it emphasizes the impact of the protection action connection process corresponding to the main evidence node through path weights, and deducts based on the number of protection connection chain breaks to prevent paths with matching local protection actions but interrupted overall protection connection chains from being retained. The waveform evidence coverage formula is designed around the change type matching, associated object matching, and physical change occurrence sequence consistency between the inferred physical change process and the fault waveform semantic fingerprint. It verifies whether the physical changes inferred from candidate root cause paths can be fully supported by existing waveform evidence. It further emphasizes the role of the waveform process corresponding to the main evidence node through evidence weights, and deducts based on the number of adjacent waveform physical change processes that cannot form a closed connection to prevent paths with only scattered waveform responses or time proximity from being considered to have sufficient evidence coverage.

[0073] S4: For candidate root cause paths of protection constraints, perform physical domain virtual isolation on the connection of bay switches, branch propagation and linkage relationship of adjacent cabinets, and perform observation domain virtual isolation on the sampling correspondence, terminal reporting and communication forwarding relationship. At the same time, compare the break position of the main evidence chain under different isolation conditions and generate dual-domain virtual isolation verification data. S4.1: Extract the fault propagation direction in the candidate root cause path of the protection constraint, identify the physical connection relationship that maintains the continuity of the main evidence connection chain, screen the physical connection relationship that participates in both the main evidence connection and the fault propagation recursion, and determine the position of the physical relationship to be isolated according to the main evidence connection order, and generate a set of physical domain isolation relationships.

[0074] Furthermore, following the fault propagation direction from the fault triggering anchor point to the anomalous node in the candidate root cause path of the protection constraint, the physical connection relationships between the main evidence nodes are traced segment by segment. For each physical connection relationship, it is checked whether it is located within the continuous propagation path of the main evidence connection chain, and it is determined whether removing the physical connection relationship would prevent the main evidence nodes from continuing to form connections in the original order. Physical connection relationships that are only associated with shadow evidence nodes, or that are within the candidate root cause path of the protection constraint but do not affect the continuity of the main evidence connection chain, are not included in the isolation scope. Physical connection relationships that can maintain the connection between the main evidence nodes and are located in the fault propagation direction are retained as the initial isolation objects.

[0075] Building upon the initial isolation, the system further examines whether each physical connection simultaneously participates in the fault propagation recursion. That is, does the physical connection not only support continuous connection between primary evidence nodes but also enable fault propagation from the previous associated position to the next? For physical connections that simultaneously satisfy both primary evidence connection and fault propagation recursion conditions, their physical relationship positions are determined according to their order of appearance in the primary evidence connection chain, ensuring that each position to be isolated corresponds to a different connection stage in the fault propagation process. The determined physical relationship positions and their associated physical connections are then aggregated to generate a physical domain isolation relationship set.

[0076] It should be noted that the scope to be isolated (example scope: 1 to 3 consecutive physical connection relationships in the main evidence connection chain) is set according to the length of the fault propagation path, the continuous connection position of the main evidence node, and the identifiability of the broken chain of the main evidence connection chain after isolation.

[0077] The continuation of primary evidence refers to the ability of adjacent primary evidence nodes to form a continuous causal relationship according to the sequence of physical changes after a fault is triggered. This is used to characterize the actual continuation process of an anomaly from the previous physical change location to the next physical change location.

[0078] Fault propagation recursion refers to tracing the location of the abnormal impact outward from the fault triggering anchor point, layer by layer along the physical connection and association relationships. It is used to characterize the propagation direction and propagation stage of the fault in the candidate root cause path of protection constraints.

[0079] S4.2: Based on the physical domain isolation relationship set, the physical connection relationship to be isolated is adjusted to an unreachable state in the ring network cabinet evidence map, while the protection relationship and observation connection relationship unrelated to the physical connection relationship to be isolated are kept in their original state. The main evidence connection chain is re-traced and the location of the chain break is recorded to generate a physical domain chain break record.

[0080] Furthermore, based on the physical relationship locations within the physical domain isolation relationship set, the corresponding physical connection relationships to be isolated are located in the ring main unit evidence map. These physical connection relationships are then changed from their original reachable state to an unreachable state, preventing them from participating in the transmission of physical changes and fault propagation between the current main evidence nodes. During the adjustment process, only the reachability attribute of the physical connection relationship to be isolated is changed; the associated equipment objects, fault waveform semantic fingerprints, and original timing positions remain unchanged to preserve the basis for comparing relationships before and after isolation. For protection and observation connections that are not directly related to the physical connection relationship to be isolated, their original connection status is maintained to avoid the impact of changes in protection action acceptance or observation sources on the physical domain isolation results.

[0081] Starting from the fault trigger anchor point, the physical connection between the main evidence nodes is traced again. Each main evidence node is checked to see if it can still be continuously reached from the previous main evidence node according to the main evidence connection order. When the tracing process reaches the position corresponding to the physical connection to be isolated and cannot continue to subsequent main evidence nodes, this position is determined as the break point of the main evidence connection chain. If there are multiple physical connections to be isolated, the first break point under each isolation condition and its corresponding connection order are recorded. The physical connections to be isolated, the tracing results, and the break point are linked and recorded to generate a physical domain break record.

[0082] S4.3: Based on the physical domain link break records, locate the sampling correspondence, terminal reporting relationship and communication forwarding relationship in the candidate root cause path of protection constraints, and determine the location of the observation succession relationship to be isolated by combining the observation source corresponding to the main evidence node, and generate the observation domain isolation relationship set.

[0083] Furthermore, based on the physical domain link break records, and according to the primary evidence node corresponding to the link break location and its receiving position in the candidate root cause path of the protection constraint, the sampling source, terminal reporting position, and communication forwarding position on which the primary evidence node relied when forming the anomaly representation are traced back. The corresponding observation source is located along the pre-established sampling correspondence, terminal reporting relationship, and communication forwarding relationship in the ring network cabinet evidence map. The sampling correspondence, terminal reporting relationship, and communication forwarding relationship corresponding to the observation source are located along the candidate root cause path of the protection constraint and arranged according to the arrival order of the observation information from the sampling position to the primary evidence node. Relationships whose observation source cannot be traced back to the primary evidence node are not included in the current observation domain isolation range; for relationships that can participate in the formation of the anomaly representation of the primary evidence node, their associated positions in the observation receiving process are retained, so that the position of the observation receiving relationship can correspond to the physical domain link break location.

[0084] Each sampling correspondence, terminal reporting relationship, and communication forwarding relationship is checked to ensure they are within the continuous transmission path of the main evidence node's observation source. Relationships that are only related to shadow evidence nodes, or that, although within the candidate root cause path of protection constraints, do not affect the arrival of the main evidence node's observation source, are not considered for isolation. Observational inheritance relationships that, if removed, might cause the main evidence node to lose its original anomaly representation are identified as observational inheritance relationship positions to be isolated. The positions of the observational inheritance relationships to be isolated, their corresponding observation sources, and their order in the observation inheritance process are collected to generate an observation domain isolation relationship set.

[0085] S4.4: According to the observation domain isolation relationship set, adjust the observation connection relationship to be isolated to an unreachable state in the ring network cabinet evidence map, trace the main evidence connection chain again, and compare the chain break position obtained by the second trace with the chain break position in the physical domain chain break record to generate dual-domain virtual isolation verification data.

[0086] Furthermore, based on the location of the observation succession relationships in the isolation relationship set of the observation domain, the sampling correspondence, terminal reporting relationship, or communication forwarding relationship to be isolated is located in the ring network cabinet evidence map, and the path reachability attribute of the corresponding relationship edge is adjusted to an unreachable state, so that the observation succession relationship to be isolated no longer participates in the transmission of observation sources and the tracing of the main evidence succession chain in the current map. The adjustment is only used to construct the virtual isolation conditions of the observation domain and does not change the actual connection status, operation status, or message transmission status of the sampling device, terminal equipment, and communication forwarding node.

[0087] During the adjustment process, the main evidence node, fault recording semantic fingerprint and original timing position are kept unchanged, and the unisolated physical connection relationship, protection relationship and observation connection relationship are kept in their original state to form a basis for comparison of observation connection relationships corresponding to the virtual isolation of the physical domain.

[0088] Starting from the fault trigger anchor point, the main evidence succession chain is traced again according to the main evidence succession order. It is checked whether each main evidence node can maintain continuous succession under the adjusted observation succession relationship. When the main evidence succession chain cannot continue to reach subsequent main evidence nodes, the first point where continuous succession cannot be formed is determined as the observation domain break point. The physical domain break point is read from the physical domain break point record, and a difference comparison is performed according to the main evidence node position and the main evidence succession order. Differences such as identical break point positions, break point positions moving forward, or break point positions moving backward are recorded, generating dual-domain virtual isolation verification data.

[0089] S5: Based on dual-domain virtual isolation verification data, perform dual-domain link failure differential attribution, distinguish between primary equipment failure and sampling communication link anomaly, and identify key root causes by combining the degree of compliance of protection logic and the coverage of waveform evidence, and generate ring main unit failure root cause analysis data.

[0090] S5.1: Based on dual-domain virtual isolation verification data, perform corresponding analysis on the physical domain chain break location and the observation domain chain break location, identify the difference in the main evidence chain under the two types of isolation conditions, and generate chain break attribution data.

[0091] Furthermore, based on the comparison of the physical domain breakpoint and the observation domain breakpoint recorded in the dual-domain virtual isolation verification data, a correspondence between breakpoint locations is established according to the order of the main evidence nodes in the main evidence succession chain. First, the location where the main evidence succession chain first cannot continue under the physical domain virtual isolation condition is located. Then, the location where the main evidence succession chain first cannot continue under the observation domain virtual isolation condition is located, and the two breakpoint locations are mapped to the corresponding main evidence node locations and physical change succession stages, respectively. When the physical domain breakpoint and the observation domain breakpoint fall into the same main evidence node location, it is determined that both types of isolation conditions have a consistent breakpoint impact on the main evidence succession chain; when the physical domain breakpoint and the observation domain breakpoint fall into different main evidence node locations, the difference in succession order between the two breakpoint locations is preserved.

[0092] The differences between the physical domain breakpoint and the observation domain breakpoint within the main evidence chain are assessed. When the observation domain breakpoint precedes the physical domain breakpoint, the anomaly representation of the main evidence node is interrupted earlier in the observation-to-continuity relationship, and the breakpoint attribution data indicates a stronger influence of the observation-to-continuity relationship on the continuity of the anomaly representation. When the observation domain breakpoint follows the physical domain breakpoint, the physical continuity relationship is interrupted before the observation-to-continuity relationship, and the breakpoint attribution data indicates a stronger influence of the physical continuity relationship on the continuity of the main evidence chain. When the physical domain breakpoint coincides with the observation domain breakpoint, both the physical and observational continuities are included in the breakpoint attribution scope to generate breakpoint attribution data.

[0093] S5.2: Based on the link breakage attribution data, objects whose main evidence is interrupted after physical domain isolation are included in the primary equipment failure candidate range, and objects whose abnormal characteristics disappear after observation domain isolation are included in the sampling communication link abnormality candidate range, thus forming the root cause candidate range.

[0094] Furthermore, starting from the primary evidence node corresponding to the physical domain break point in the break-chain attribution data, the physical connection relationships that were adjusted to an unreachable state during the virtual isolation process of the physical domain are traced back to locate the device objects connected on both sides of the physical connection relationship. The primary evidence nodes before and after the physical connection relationship is interrupted are checked to see if they can maintain continuous physical change connection. If, after the physical connection relationship becomes unreachable, subsequent primary evidence nodes cannot continue to extend according to the original connection order, and the device object's location is consistent with the fault propagation direction, the device object is included in the primary device fault candidate range. Device objects that only affect the associated location of shadow evidence nodes, or do not cause a break in the primary evidence connection chain, are not included in the primary device fault candidate range.

[0095] Around the primary evidence node corresponding to the link break location in the observation domain, the observation transmission process of the anomalous representation of the primary evidence node is traced back along the sampling correspondence, terminal reporting relationship, and communication forwarding relationship. When the anomalous representation of the primary evidence node disappears after the isolation observation connection is adjusted to an unreachable state, but the primary evidence connection chain remains continuous under the physical domain virtual isolation condition, the object associated with the observation source is included in the sampling communication link anomalous candidate range. For objects whose primary evidence connection is interrupted by both physical domain isolation and observation domain isolation, the associated positions in the primary equipment failure candidate range and the sampling communication link anomalous candidate range are retained. The two candidate ranges are merged according to the primary evidence node position in the link break attribution data to form the root cause candidate range.

[0096] It should be noted that the candidate range for a single equipment failure (example range: 1 to 3 consecutive equipment objects before and after the physical domain break point) is set based on the first break point of the main evidence chain after physical domain isolation, the direction of failure propagation, and the physical continuity between adjacent equipment objects.

[0097] The candidate range for anomalies in the sampling communication link (example range: 1 to 3 consecutive sampling correspondences, terminal reporting relationships, or communication forwarding relationships corresponding to the link break location in the observation domain) is set based on the location where the anomaly representation disappears after the observation domain is isolated, the observation source of the main evidence node, and the observation transmission order.

[0098] Figure 2 Using primary equipment failure, sampling communication link anomaly, and composite anomaly as the x-axis and domain attribution accuracy as the y-axis, the identification results of the original association group, time-stamped correction group, evidence closure group, and the complete invention group under different true root cause categories were compared. The original association group primarily relies on event temporal proximity and static correlation, resulting in a significant drop in accuracy under composite anomaly scenarios. The time-stamped correction group improved the multi-source event misalignment problem through unified event indexing and object attachment. The evidence closure group further utilized master evidence nodes, shadow evidence nodes, and protection logic constraints to narrow the scope of erroneous associations. The complete invention group maintained high domain attribution accuracy across all three root cause scenarios, exhibiting particularly stable identification performance under sampling communication link anomaly and composite anomaly conditions. These results demonstrate that physical domain virtual isolation and observation domain virtual isolation can distinguish between physical interruptions on the primary equipment side and observational anomalies on the sampling, terminal reporting, or communication forwarding side by differentiating the location of the break in the master evidence transmission chain, thus providing a reliable basis for subsequent root cause candidate range division. The curves in the figure correspond to the original correlation group, the time-scaled correction group, the evidence closure group, and the complete invention group, respectively.

[0099] S5.3: For the candidate range of root causes, the confidence of the root causes is compared by combining the degree of compliance of the protection logic and the coverage of the recorded evidence, the key root causes and the scope of related influences are identified, and the root cause analysis data of the ring main unit fault is generated.

[0100] Furthermore, focusing on the primary equipment fault candidate range and the sampling communication link anomaly candidate range within the root cause candidate range, the degree of protection logic compliance and the coverage of recorded evidence corresponding to the candidate objects are respectively correlated. For candidate objects within the primary equipment fault candidate range, the focus is on comparing the compliance between the main evidence acceptance location of the candidate object and the protection action acceptance process, and verifying whether the physical changes caused by the candidate object can obtain continuous support from the fault recording semantic fingerprint. For candidate objects within the sampling communication link anomaly candidate range, the focus is on comparing the correspondence between the anomaly disappearance location and the protection action acceptance process, and verifying whether the recorded physical changes before and after the observation acceptance interruption remain continuous. The degree of protection logic compliance and the coverage of recorded evidence form the basis for comparing the root cause credibility of each candidate object.

[0101] Candidate objects with high compliance with protection logic and high coverage of recorded evidence are identified as priority root cause objects. Related nodes are traced along the main evidence receiving position of the priority root cause object towards the fault propagation direction. Positions where main evidence nodes continuously exhibit abnormal receiving, protection actions remain consistent, and fault recorded semantic fingerprints remain closed are included in the associated influence range; positions that only have a weak association with shadow evidence nodes and do not participate in continuous receiving are not included in the associated influence range. The primary equipment fault candidate range and the sampled communication link abnormality candidate range within the root cause candidate range are ranked by credibility to identify key root causes. The associated influence ranges corresponding to the key root causes are collected, generating ring main unit fault root cause analysis data.

[0102] It should be noted that the scope of the associated impact (example scope: 1 to 3 consecutive main evidence nodes and corresponding associated objects along the fault propagation direction of the key root cause object) is set according to the location of the main evidence receiving the key root cause object, the continuity of the protection action, the closure of the fault recording semantic fingerprint, and the extent of the fault propagation path extension.

[0103] Figure 3Using the root cause candidate range shrinkage rate as the x-axis and the single-sample analysis time as the y-axis, this figure illustrates the relationship between the candidate range shrinkage effect and analysis efficiency of different method groups in the fault root cause analysis process. In the figure, hollow circles correspond to the original association group, hollow squares to the time-stamped correction group, hollow triangles to the evidence closure group, and hollow rhombuses to the complete group of this invention. It can be seen that the root cause candidate range shrinkage rate of the original association group is relatively low, and the single-sample analysis time is more dispersed. As time-stamped correction, fault waveform semantic fingerprint attribution, evidence physical connection layering, and protection constraint deduction are gradually added, the candidate object range is further compressed. The data points of the complete group of this invention are mainly concentrated in areas with higher shrinkage rates and lower analysis times, indicating that after the virtual isolation between the physical domain and the observation domain, the candidate range of primary equipment faults and the candidate range of sampling communication link anomalies can be specifically merged, reducing weakly associated objects that do not participate in continuous connection. This figure reflects that this invention does not simply reduce the number of candidate objects, but rather, while retaining the key root cause judgment criteria, reduces the number of subsequent manually verified objects and the single-sample analysis time, reflecting the targeted fault handling and improved operation and maintenance efficiency.

[0104] Figure 4 The performance of the original association group, time-stamped correction group, evidence closure group, and complete invention group was compared using radar charts across six core indicators: correct recovery rate of the main evidence continuation chain, degree of compliance with protection logic, coverage of recorded evidence, path compression rate, shrinkage rate of root cause candidate range, and accuracy of domain attribution. The correct recovery rate of the main evidence continuation chain corresponds to the ability to continuously trace the physical changes after the fault triggering anchor point; the degree of compliance with protection logic and the coverage of recorded evidence correspond to the results of protection constraint deduction and protection physical evidence closure verification; the path compression rate reflects the screening effect of protection constraint candidate root cause paths; and the shrinkage rate of root cause candidate range and accuracy of domain attribution reflect the ability to narrow down key root causes after the dual-domain chain breakage differential attribution. In the figure, the complete invention group exhibits the largest and most balanced coverage across all indicator axes, indicating that the invention does not merely improve the accuracy of a single location, but rather achieves an overall performance improvement from fault propagation path closure to key root cause identification through the collaborative processing of time-stamped correction, semantic fingerprint attribution, evidence layering, protection constraint deduction, virtual isolation of the physical domain, and virtual isolation of the observation domain.

[0105] The formula for calculating the correct restoration rate of the main evidence chain is: ; in, This indicates the correct restoration rate of the main evidence chain. This indicates the number of fault record semantic fingerprints that form a continuous physical chain. This indicates the number of master evidence nodes that correctly correspond to the semantic fingerprint of the fault recording. This indicates the number of physical connection relationships in a continuous physical connection chain. This indicates the number of correctly restored physical connections in the main evidence chain.

[0106] The formula for calculating the path compression ratio is: ; in, Indicates path compression ratio. This indicates the number of initial candidate root cause paths. This represents the number of candidate root cause paths retained after a second search based on differentiated path weights. This represents the number of candidate root cause paths for protection constraints formed after path constraint screening.

[0107] The formula for calculating the root cause candidate range shrinkage rate is: ; in, Indicates the shrinkage rate of the root cause candidate range. This indicates the number of associated objects in the fault association range data. This indicates the number of device objects within the candidate range for a single device failure. This indicates the number of objects associated with the observation source within the candidate range of anomalies in the sampled communication link. This indicates the number of associated objects that are retained in both candidate ranges simultaneously.

[0108] The formula for calculating the domain attribution accuracy is: ; in, This represents the domain attribution accuracy. This indicates the number of samples whose identification results match the true root cause category. This represents the total number of samples corresponding to the three types of true root causes: primary equipment failure, sampling communication link anomaly, and composite anomaly.

[0109] This embodiment also provides a knowledge graph-based ring main unit fault root cause analysis system, including: The data acquisition module is used to collect multi-source operating data of the ring main unit and extract the semantic fingerprint of the fault waveform, perform time-stamping correction and object attachment for events from different sources, and generate the ring main unit evidence map; The node layering module is used to anchor the physical changes in the evidence map of the ring network cabinet, obtain the fault triggering anchor point, and perform physical layering of evidence, dividing the main evidence node and shadow evidence node. At the same time, it performs protection setting operation status mapping and generates effective protection logic constraint data. The protection constraint module is used to combine effective protection logic constraint data with the ring network cabinet evidence map, extract the fault association range, obtain a local fault evidence sub-map, and perform protection constraint root cause inference and protection physical evidence closure verification on the local fault evidence sub-map to obtain the protection logic compliance degree and waveform evidence coverage degree. At the same time, it performs path constraint screening to generate protection constraint candidate root cause paths. The virtual isolation module is used to perform physical domain virtual isolation for the connection of bay switches, branch propagation and linkage relationship of adjacent cabinets for the candidate root cause path of protection constraints, and to perform observation domain virtual isolation for sampling correspondence, terminal reporting and communication forwarding relationship. At the same time, it compares the break position of the main evidence chain under different isolation conditions and generates dual-domain virtual isolation verification data. The root cause identification module is used to perform dual-domain link failure differential attribution based on dual-domain virtual isolation verification data, distinguish between primary equipment failure and sampling communication link anomaly, and identify key root causes by combining the degree of compliance of protection logic and the coverage of waveform evidence, thereby generating root cause analysis data for ring main unit failures.

[0110] In summary, this invention achieves physical temporal closure of the fault propagation path through time-stamping correction, semantic fingerprint attribution, evidence layering, and protective constraint deduction, thereby eliminating interference from accompanying events and improving the accuracy of root cause localization and the interpretability of analysis. Furthermore, by virtually isolating the physical domain from the observation domain and comparing the location of link breaks, it achieves domain-specific attribution of primary equipment faults and sampling communication link anomalies, narrowing down the range of key root causes and improving the targeted nature of fault handling and operational efficiency.

[0111] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A knowledge graph-based root cause analysis method for ring main unit faults, characterized in that, include: Collect multi-source operation data of the ring main unit and extract the semantic fingerprint of the fault waveform. Perform time-stamping correction and object attachment on events from different sources to generate the ring main unit evidence map. Physical change timing anchoring is performed on the ring main unit evidence map to obtain fault triggering anchor points, and physical acceptance layering of evidence is performed to divide the main evidence nodes and shadow evidence nodes. At the same time, protection setting operation status mapping is performed to generate effective protection logic constraint data. By combining effective protection logic constraint data with ring main unit evidence map, fault association range is extracted to obtain local fault evidence sub-maps. Protection constraint root cause inference and protection physical evidence closure verification are performed on the local fault evidence sub-maps to obtain the protection logic compliance degree and waveform evidence coverage degree. At the same time, path constraint screening is performed to generate protection constraint candidate root cause paths. For candidate root cause paths of protection constraints, physical domain virtual isolation is performed on the connection of bay switches, branch propagation and linkage relationship of adjacent cabinets, and observation domain virtual isolation is performed on the sampling correspondence, terminal reporting and communication forwarding relationship. At the same time, the break position of the main evidence chain under different isolation conditions is compared to generate dual-domain virtual isolation verification data. Based on dual-domain virtual isolation verification data, the dual-domain link failure difference attribution is performed to distinguish between primary equipment failure and sampling communication link anomaly. The key root causes are identified by combining the degree of compliance of protection logic and the coverage of waveform evidence, and the root cause analysis data of ring main unit failure is generated.

2. The knowledge graph-based root cause analysis method for ring main unit faults as described in claim 1, characterized in that, The steps for generating the ring main unit evidence map are as follows: Collect fault waveform data and related event data, aggregate event time periods, and establish a unified event index according to the source object and sampling time sequence. At the same time, remove invalid segments that exceed the sampling stability range and lack association identifiers to generate time period aligned running data. Based on time-aligned running data, the physical change locations in the fault recording are semantically attributed, and the change type, occurrence order and associated objects are written into the fingerprint node to generate a fault recording semantic fingerprint. By combining the semantic fingerprint of the fault recording waveform with the time-aligned operational data, time-stamp correction and object attachment are performed. The semantic fingerprint of the fault recording waveform is then connected with the corresponding ring main unit object and its associated relationships to generate a ring main unit evidence map.

3. The knowledge graph-based root cause analysis method for ring main unit faults as described in claim 2, characterized in that, The steps for dividing the primary evidence node and the shadow evidence node are as follows: Based on the evidence map of the ring network cabinet, time-series anchoring is performed by combining the order of physical changes and the correlation. The semantic fingerprints of fault recordings are arranged in order according to the start time of physical changes, and the physical connection between adjacent fault recording semantic fingerprints is traced along the correlation. The fault recording semantic fingerprint with the earliest start time and that can form a continuous physical connection chain is determined as the anchor fingerprint. At the same time, the fault trigger anchor point is determined according to the equipment object associated with the anchor fingerprint and the time of physical change. Based on the fault triggering anchor point, the related evidence in the ring main unit evidence map is physically connected and layered. Evidence that forms a continuous physical connection with the fault triggering anchor point is classified as main evidence nodes, and evidence that does not form a continuous physical connection but is related to the fault triggering anchor point is classified as shadow evidence nodes, thus generating fault evidence layering data.

4. The knowledge graph-based root cause analysis method for ring main unit faults as described in claim 3, characterized in that, The steps for generating valid protection logic constraint data are as follows: Based on the layered fault evidence data, the protection setting adaptation status and operation status of the corresponding time period of the fault triggering anchor point are traced back, and the protection relationship in the ring network cabinet evidence map is mapped to generate protection status mapping data. Based on the protection status mapping data, action logic constraints are collected for the protection relationships associated with the main evidence node. Protection exit reachability is verified along the protection initiation relationship and exit acceptance relationship. Protection relationships that meet the operating status corresponding to the fault trigger anchor point and pass the protection exit reachability verification are configured as valid protection relationships, and valid protection logic constraint data is generated.

5. The knowledge graph-based root cause analysis method for ring main unit faults as described in claim 3 or 4, characterized in that, The steps for obtaining the local fault evidence sub-graph are as follows: Based on the effective protection logic constraint data and fault triggering anchor points, forward fault propagation is performed along the protection action relationship, electrical connection relationship and physical connection relationship in the ring network cabinet evidence map, and reverse protection reachability is performed along the effective protection relationship. The associated nodes with continuous connection relationship with the fault triggering anchor points are extracted to generate fault association range data. Based on the fault association range data, the corresponding evidence nodes and associations are extracted from the ring main unit evidence map. The intersection nodes of the forward fault propagation recursion and the reverse protection reachable recursion are retained as nodes. Combined with the effective protection logic constraint data, the protection relationship that is compatible with the fault propagation process is retained. The evidence relationship is merged and encapsulated to generate a local fault evidence sub-graph.

6. The knowledge graph-based root cause analysis method for ring main unit faults as described in claim 1, characterized in that, The steps for generating candidate root cause paths with protective constraints are as follows: Extract abnormal nodes from the local fault evidence subgraph, combine them with effective protection logic constraint data to perform root cause path search, configure differentiated path weights for the main evidence node and shadow evidence node, perform root cause path search according to the differentiated path weights, and deduce the corresponding protection action acceptance process and waveform physical change process along the candidate root cause path to generate protection constraint deduction data. The protection action takeover process in the protection constraint simulation data is matched with the effective protection logic constraint data to verify the degree of compliance of the protection logic. The physical change process of the waveform is matched with the semantic fingerprint of the fault waveform in the local fault evidence subgraph to verify the closure and calculate the coverage of the waveform evidence. At the same time, the path constraint is screened according to the degree of compliance of the protection logic and the coverage of the waveform evidence to generate candidate root cause paths for protection constraints.

7. The knowledge graph-based root cause analysis method for ring main unit faults as described in claim 6, characterized in that, The steps for performing physical domain virtual isolation are as follows: Extract the fault propagation direction in the candidate root cause path of the protection constraint, identify the physical connection relationship that maintains the continuity of the main evidence connection chain, screen the physical connection relationship that participates in both the main evidence connection and the fault propagation recursion, and determine the position of the physical relationship to be isolated according to the main evidence connection order, and generate a set of physical domain isolation relationships. Based on the physical domain isolation relationship set, the physical connection relationship to be isolated is adjusted to an unreachable state in the ring network cabinet evidence map, while the protection relationship and observation connection relationship unrelated to the physical connection relationship to be isolated are kept in their original state. The main evidence connection chain is re-traced and the break position of the connection chain is recorded to generate a physical domain break record.

8. The knowledge graph-based root cause analysis method for ring main unit faults as described in claim 1 or 7, characterized in that, The steps for generating dual-domain virtual isolation verification data are as follows: Based on the physical domain link break records, the sampling correspondence, terminal reporting relationship and communication forwarding relationship in the candidate root cause path of protection constraints are located, and the location of the observation succession relationship to be isolated is determined in combination with the observation source corresponding to the main evidence node, and the observation domain isolation relationship set is generated. According to the observation domain isolation relationship set, the observation connection relationship to be isolated is adjusted to an unreachable state in the ring network cabinet evidence map. The main evidence connection chain is traced again, and the chain break position obtained by the second trace is compared with the chain break position in the physical domain chain break record to generate dual-domain virtual isolation verification data.

9. The knowledge graph-based root cause analysis method for ring main unit faults as described in claim 8, characterized in that, The steps for generating root cause analysis data for ring main unit faults are as follows: Based on dual-domain virtual isolation verification data, we conduct a corresponding analysis of the physical domain chain break location and the observation domain chain break location, identify the difference in the main evidence chain under the two types of isolation conditions, and generate chain break attribution data. Based on the chain breakage attribution data, objects whose main evidence is interrupted after physical domain isolation are classified into the primary equipment failure candidate range, and objects whose abnormal characteristics disappear after observation domain isolation are classified into the sampling communication link abnormality candidate range, thus forming the root cause candidate range. For the candidate range of root causes, the credibility of the root causes is compared by combining the degree of compliance of the protection logic and the coverage of the recorded evidence, the key root causes and the scope of related impacts are identified, and the root cause analysis data of the ring main unit failure is generated.

10. A knowledge graph-based ring main unit fault root cause analysis system, based on the knowledge graph-based ring main unit fault root cause analysis method according to any one of claims 1 to 9, characterized in that, include: The data acquisition module is used to collect multi-source operating data of the ring main unit and extract the semantic fingerprint of the fault waveform, perform time-stamping correction and object attachment for events from different sources, and generate the ring main unit evidence map. The node layering module is used to anchor the physical changes in the evidence map of the ring network cabinet, obtain the fault triggering anchor point, and perform physical layering of evidence, dividing the main evidence node and shadow evidence node. At the same time, it performs protection setting operation status mapping and generates effective protection logic constraint data. The protection constraint module is used to combine effective protection logic constraint data with the ring network cabinet evidence map, extract the fault association range, obtain a local fault evidence sub-map, and perform protection constraint root cause inference and protection physical evidence closure verification on the local fault evidence sub-map to obtain the protection logic compliance degree and waveform evidence coverage degree. At the same time, it performs path constraint screening to generate protection constraint candidate root cause paths. The virtual isolation module is used to perform physical domain virtual isolation for the connection of bay switches, branch propagation and linkage relationship of adjacent cabinets for the candidate root cause path of protection constraints, and to perform observation domain virtual isolation for sampling correspondence, terminal reporting and communication forwarding relationship. At the same time, it compares the break position of the main evidence chain under different isolation conditions and generates dual-domain virtual isolation verification data. The root cause identification module is used to perform dual-domain link failure differential attribution based on dual-domain virtual isolation verification data, distinguish between primary equipment failure and sampling communication link anomaly, and identify key root causes by combining the degree of compliance of protection logic and the coverage of waveform evidence, thereby generating root cause analysis data for ring main unit failures.

Images