Nuclear power plant risk early warning method and device, electronic equipment and storage medium

Abstract

The application relates to a nuclear power plant risk early warning method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring multi-source working data of a nuclear power plant in real time and screening alarm data from the multi-source working data; performing sliding time window calculation on the alarm data based on a matched time window accumulation rule to obtain a first early warning result; performing correlation analysis on the alarm data based on a time correlation rule, a space correlation rule and / or a cause-effect correlation rule to obtain a second early warning result; screening alarm space-time distribution characteristics from the alarm data based on a clustering analysis algorithm; and generating a risk prompt based on the first early warning result, the second early warning result and / or the alarm space-time distribution characteristics. In this way, the dynamic change of the operation risk situation of the nuclear power plant can be effectively perceived, the risk hotspots can be accurately positioned, the chain risk hidden dangers can be identified, comprehensive and scientific decision-making basis can be provided for the safe operation and maintenance of the nuclear power plant, and the safe and stable operation of the nuclear power plant system can be ensured from multiple dimensions.

Description

Technical Field

[0001] This application relates to the field of nuclear safety technology, and in particular to a method, device, electronic equipment and storage medium for risk early warning of nuclear power plants. Background Technology

[0002] Nuclear power plants are highly complex energy and power systems, and their safe and stable operation is a core requirement and key prerequisite for the development of the nuclear power industry. Risk assessment models, as a multi-level and multi-dimensional analytical tool, have been widely used in nuclear power plant personnel management, equipment operation and maintenance, public safety, and other related fields. The system operation risks of nuclear power plants exhibit significant correlation and coupling characteristics, often triggered by a series of interrelated operational events, easily forming potential chain reactions within the system. Therefore, high demands are placed on the comprehensiveness, relevance, and accuracy of risk assessment.

[0003] Existing multi-source risk assessment technologies for nuclear power plants still have many technical shortcomings, making it difficult to adapt to the actual needs of safe nuclear power plant operation. Current technologies are mostly limited to single-type risk analysis dimensions, lacking a systematic exploration of the inherent correlations between alarm information during nuclear power plant operation. This makes it difficult to accurately identify potential cascading risks in system operation and fails to provide targeted decision-making basis for risk prevention and control. Furthermore, traditional nuclear power plant risk assessment methods rely heavily on fixed analytical models and periodic detection methods, exhibiting poor adaptability to the real-time dynamic changes in nuclear power plant operating conditions. This makes it difficult to achieve timely perception and effective early warning of system risk situations, failing to meet the real-time prevention and control requirements for safe nuclear power plant operation.

[0004] In summary, how to overcome the limitations of existing technologies, achieve in-depth mining of multi-dimensional correlation characteristics of alarm information, and adapt to the dynamic operating conditions of nuclear power plants to complete accurate risk assessment has become an urgent technical problem to be solved in the field of nuclear power plant safety operation. Summary of the Invention

[0005] Therefore, it is necessary to provide a method, device, electronic equipment, and storage medium for risk early warning of nuclear power plants to address the aforementioned technical problems.

[0006] Firstly, this application provides a method for early warning of risks in nuclear power plants, the method comprising: Real-time acquisition of multi-source operating data from nuclear power plants and filtering out alarm data from them; Based on the matching time window accumulation rule, the alarm data is calculated using a sliding time window to obtain the first early warning result; Based on time association rules, spatial association rules and / or causal association rules, the alarm data is analyzed to obtain a second early warning result; Based on clustering analysis algorithms, alarm spatiotemporal distribution characteristics are filtered out from the alarm data; wherein, the alarm spatiotemporal distribution characteristics include alarm hotspot areas, alarm patterns and / or high-frequency alarm sequences; A risk alert is generated based on the first warning result, the second warning result, and / or the spatiotemporal distribution characteristics of the alarm.

[0007] In one embodiment, the time window accumulation rule includes a continuous accumulation rule; the step of performing a sliding time window calculation on the alarm data based on the matching time window accumulation rule to obtain a first warning result includes: Determine the first statistical data within the current sliding time window from the alarm data; If the first statistical data satisfies the continuous accumulation rule, the first warning result is determined to be a continuous accumulation risk; wherein, the first statistical data includes the current number of consecutive alarm days and the daily alarm count; the continuous accumulation rule includes the current sliding time window being in an effective state and the number of days when the daily alarm count reaches the preset daily average accumulation threshold being greater than or equal to the threshold.

[0008] In one embodiment, the time window accumulation rule includes a cumulative sum rule; the step of performing a sliding time window calculation on the alarm data based on the matching time window accumulation rule to obtain a first warning result includes: Determine the second statistical data of the alarm data within the current sliding time window; If the second statistical data satisfies the cumulative summation rule, the first warning result is determined to have a cumulative comprehensive risk; wherein, the second statistical data includes the total number of alarms and the first time length covered by the current sliding time window; the cumulative summation rule includes the current sliding time window being in an effective state, the first time length being greater than a first threshold, and the total number of alarms being greater than or equal to the total cumulative threshold of the window.

[0009] In one embodiment, the step of performing correlation analysis on the alarm data based on time correlation rules, spatial correlation rules, and / or causal correlation rules to obtain a second early warning result includes: Type matching is performed between the alarm events in the alarm data to obtain the matching results; The matching results are filtered from the alarm events to represent the first alarm events that are mutually related, and the time interval between the first alarm events that are mutually related is determined. Filter out second alarm events from the first alarm events whose time interval is less than the first reference threshold, and determine the spatial distance between mutually related second alarm events; The second alarm event where the spatial distance is less than the second reference threshold is determined as the first candidate alarm event; Based on the causal relationship graph, causal logic analysis is performed on the alarm data to obtain a second candidate alarm event; The second early warning result is obtained based on the first candidate alarm event and the second candidate alarm event.

[0010] In one embodiment, the step of performing causal logic analysis on the alarm data based on the causal relationship graph to obtain a second candidate alarm event includes: Upon receiving a new third alarm event, the correlation index between the third alarm event and each alarm event in the alarm data is calculated based on the causal correlation graph; wherein, the correlation index includes support and / or confidence. If the correlation index is greater than the target threshold, the third alarm event is determined as the second candidate alarm event and the corresponding causal chain.

[0011] In one embodiment, the step of filtering out the spatiotemporal distribution characteristics of alarms from the alarm data based on a clustering analysis algorithm includes: The alarm data is analyzed using a density clustering algorithm to obtain the alarm hotspot areas; The alarm data is analyzed using a hierarchical clustering algorithm to obtain the alarm pattern; The alarm data is analyzed using an association rule mining algorithm to obtain the high-frequency alarm sequence.

[0012] In one embodiment, the step of analyzing the alarm data according to a hierarchical clustering algorithm to obtain the alarm pattern includes: Each alarm event in the alarm data is converted into a feature vector; wherein, the feature dimensions of the feature vector include alarm type, source device identifier, trigger time and / or duration; Clustering is initialized based on each feature vector, and the dissimilarity between each cluster is calculated to construct a distance matrix; The distance matrix is ​​iterated based on the dissimilarity until all clusters are merged into the target cluster. Generate a tree diagram based on the iteration records during the iteration process; The dendrogram is segmented according to the dissimilarity threshold to obtain clustering results of different granularities; wherein, the clustering results correspond one-to-one with the alarm modes.

[0013] Secondly, this application also provides a nuclear power plant risk early warning device, the device comprising: The acquisition module is used to acquire multi-source operating data from nuclear power plants in real time and filter out alarm data from them. The first analysis module is used to perform sliding time window calculation on the alarm data based on the matching time window accumulation rule to obtain the first early warning result; The second analysis module is used to perform correlation analysis on the alarm data based on time correlation rules, spatial correlation rules and / or causal correlation rules to obtain a second early warning result; The third analysis module is used to filter out the spatiotemporal distribution characteristics of alarms from the alarm data based on a clustering analysis algorithm; wherein, the spatiotemporal distribution characteristics of alarms include alarm hotspot areas, alarm patterns and / or high-frequency alarm sequences; The alert module is used to generate risk alerts based on the first alert result, the second alert result, and / or the spatiotemporal distribution characteristics of the alarm.

[0014] Thirdly, this application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the steps of the method described in any embodiment of this application.

[0015] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in any embodiment of this application.

[0016] The aforementioned nuclear power plant risk early warning method acquires and filters alarm data from multiple sources of nuclear power plant operating data in real time. It then uses a sliding time window calculation based on a cumulative time window rule to achieve real-time initial screening and early warning of alarm data. By relying on time, space, and causal correlation rules, it mines the inherent relationships between alarm information to identify potential cascading risks. Finally, it uses clustering analysis algorithms to extract spatiotemporal distribution characteristics such as alarm hotspots, typical patterns, and high-frequency sequences. The method integrates multi-dimensional analysis results to generate risk alerts. This approach achieves comprehensive and multi-dimensional in-depth analysis of nuclear power plant alarm data while also ensuring the real-time nature, relevance, and accuracy of risk assessment. It effectively perceives the dynamically changing operational risk situation of nuclear power plants, accurately locates risk hotspots, and identifies cascading risk hazards, providing comprehensive and scientific decision-making basis for the safe operation and maintenance of nuclear power plants. This multi-dimensional approach ensures the safe and stable operation of nuclear power plant systems. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating a nuclear power plant risk warning method according to an exemplary embodiment;

[0018] Figure 2 This is a structural block diagram of a nuclear power plant risk warning device according to an exemplary embodiment;

[0019] Figure 3This is an internal structural diagram of an electronic device according to an exemplary embodiment. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0021] The terms "first," "second," and "third" used in the embodiments of this application are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first," "second," or "third" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus.

[0022] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0023] The nuclear power plant risk warning method provided in this application embodiment can be applied to electronic devices. The electronic device can be any mobile terminal or fixed terminal. The terminal can be a device that provides voice and / or data connectivity to the user. For example, the terminal can be an Internet of Things (IoT) terminal, such as a sensor device, a mobile phone or so-called "cellular" phone, and a computer with an IoT terminal; for example, it can be a fixed, portable, pocket-sized, handheld, or computer-embedded device. In related technologies, electronic devices have interactive components, such as a touch screen or a non-touch screen.

[0024] In some embodiments, such as Figure 1 As shown, a method for early warning of risks in nuclear power plants is provided, the method comprising the following steps:

[0025] S101 acquires multi-source operating data from the nuclear power plant in real time and filters out alarm data from it.

[0026] In this embodiment of the application, multi-source working data refers to the full amount of operational monitoring data generated during the operation of a nuclear power plant from different sources. Specifically, it includes real-time data streams output by monitoring equipment that reflect physical states or events, personnel safety management data related to personnel behavior alarms, and area security monitoring data related to area safety alarms.

[0027] In this application embodiment, the monitoring equipment specifically refers to various data acquisition and status monitoring devices such as sensors and controllers, radiation monitoring instruments, fire alarm probes, and video surveillance systems in the distributed control system (DCS) of nuclear power plants.

[0028] In this embodiment of the application, the alarm data indicates various original event stream data that are filtered from the multi-source working data of the nuclear power plant and reflect safety anomalies in equipment, personnel, and areas. Specifically, it may include, but is not limited to, data related to equipment parameter exceeding the standard, controller failure, abnormal personnel behavior, and perimeter intrusion.

[0029] For example, alarm data for abnormal personnel behavior can be data related to abnormal behavior identified in real time by personnel safety management systems such as personnel positioning systems and access control systems based on personnel location, movement trajectory and other status; such as entering unauthorized areas, staying in high-risk workstations for a long time, and not performing operations according to procedures.

[0030] For example, alarm data for area security anomalies can be area security systems such as perimeter intrusion detection systems and critical area access control systems, which identify area anomalies such as unauthorized entry and abnormal gatherings based on area status monitoring; for example, security doors opening abnormally or unidentified objects appearing in important isolation areas.

[0031] In some embodiments, the electronic device performs preprocessing operations on the alarm data, extracts the core feature parameters of each alarm event, and constructs a standardized alarm information structure based on the parameters; wherein, the core feature parameters include, but are not limited to, at least one of the following: alarm event unique identifier ID, alarm type, alarm occurrence timestamp, alarm device code, alarm level, and alarm description information (specific fault description).

[0032] S102, based on the matching time window accumulation rule, the alarm data is calculated using a sliding time window to obtain the first warning result.

[0033] In this embodiment of the application, the time window accumulation rule indicates a flexibly definable alarm data analysis rule, which includes two key parameters: time window and accumulation threshold. The time window accumulation rule includes, but is not limited to, at least one of the continuous accumulation rule and the cumulative summation rule.

[0034] In this embodiment, the time window is a fixed time range preset for different alarm accumulation calculation modes in the nuclear power plant alarm data accumulation statistical analysis method, used to carry out alarm data statistical analysis. As the time boundary for calculating the sliding time window of alarm data, it can be flexibly configured to different durations according to the analysis requirements and the time window accumulation rules.

[0035] In this embodiment, the cumulative threshold is a preset alarm quantity threshold that is matched with each time window. Its numerical standard can be flexibly set according to the differences in monitoring targets, time window types and calculation modes. It is the core basis for judging whether the cumulative statistical results of alarm data have reached the risk triggering conditions.

[0036] In some embodiments, the electronic device can construct a target-rule mapping table. When a new alarm event is received in real time, the monitoring target information of the alarm event is extracted, and all effective judgment rules corresponding to the monitoring target are matched through the target-rule mapping table as the basis for the cumulative calculation of this alarm event. Subsequently, for each monitoring target and each time window accumulation rule associated with the monitoring target, a sliding time window is dynamically maintained according to the calculation mode corresponding to the rule. Wherein, when the time association rule is a continuous accumulation rule, new alarm events are added to the window in real time, and expired alarm events in the window are removed. At the same time, the total number of alarm events in the window is counted in real time. When the time association rule is a continuous accumulation rule, the current continuous alarm days and the daily alarm count in the most recent continuous alarm period are recorded. For example, if the number of alarms on a certain day reaches the corresponding accumulation threshold, the current continuous alarm days are incremented by 1; otherwise, the current continuous alarm days are reset to zero. Finally, the cumulative result obtained by the above real-time statistical calculation is matched with the accumulation threshold in the preset rule in real time. The IF-THEN logic judge is used for condition judgment. When the accumulation condition of any time window accumulation rule is met, the corresponding risk event is immediately triggered. The risk trigger result is the first warning result.

[0037] S103, based on time association rules, spatial association rules and / or causal association rules, perform association analysis on the alarm data to obtain a second early warning result.

[0038] In this embodiment of the application, the time association rule is an association rule based on time proximity discrimination. By judging whether the time interval between alarm events is less than a first reference threshold, it is determined whether there is a time correlation between events, which is used to capture related alarm events that occur densely in a short period of time.

[0039] In this embodiment of the application, the spatial association rule is an association rule based on spatial proximity discrimination. By judging whether the distance between the geographical or logical locations where the alarm event occurs is less than a second reference threshold, it is determined whether there is a spatial association between the events, which is used to locate abnormal alarm clusters with concentrated physical locations.

[0040] In this embodiment, the causal association rule (logical relevance judgment) is a rule for determining the logical / causal relationship between alarm events, which includes two core methods: one is based on the relevance of alarm types, that is, the system predefines logical grouping of alarm types, and alarm events in the same group are considered logically related; the other is based on the relevance of the causal graph, that is, the system relies on the causal association graph (nodes are alarm types, edges are causal relationships, and the strength is quantified by confidence and support) generated by historical data mining to determine whether there is a valid causal relationship between predecessor and successor alarm types.

[0041] In some embodiments, the step of performing correlation analysis on the alarm data based on time correlation rules, spatial correlation rules, and / or causal correlation rules to obtain a second early warning result includes: Type matching is performed between the alarm events in the alarm data to obtain the matching results; The matching results are filtered from the alarm events to represent the first alarm events that are mutually related, and the time interval between the first alarm events that are mutually related is determined. Filter out second alarm events from the first alarm events whose time interval is less than the first reference threshold, and determine the spatial distance between mutually related second alarm events; The second alarm event where the spatial distance is less than the second reference threshold is determined as the first candidate alarm event; Based on the causal relationship graph, causal logic analysis is performed on the alarm data to obtain a second candidate alarm event; The second early warning result is obtained based on the first candidate alarm event and the second candidate alarm event.

[0042] In some embodiments, the electronic device can perform type matching based on the alarm type of each alarm event, and combine predefined alarm type logical grouping (such as a nuclear power plant alarm type association library) to complete the type correlation determination between alarm events, and obtain a matching result indicating whether there is a mutual correlation between the alarm events; then, based on the matching result, the first alarm event indicating mutual correlation is selected from all alarm events, that is, the type correlation condition is met, and the occurrence time information of each first alarm event is extracted, and the actual time interval between the mutually related first alarm events is calculated and determined; the time interval between the mutually related first alarm events is compared with a first reference threshold. If the time interval is less than the first reference threshold, it can be determined that the group of first alarm events meets the time proximity condition; the alarm event group that meets the type correlation and time proximity conditions is merged, the common fields of the group of alarm events are extracted, the different fields (such as alarm event unique identifier ID, alarm description information, device code) are merged, and duplicate and redundant information (such as the same alarm level, the same triggering condition) is removed.

[0043] In some embodiments, the electronic device filters out second alarm events with a time interval less than a first reference threshold from the first alarm events, then extracts the geographical or logical location information of each second alarm event, such as the physical coordinates of the alarm device, the area number of the device, and the location type, and performs standardization processing on the location information to remove invalid data such as missing coordinates and incorrect area numbers; based on the standardized geographical or logical location information, it calculates and determines the spatial distance between each related second alarm event; it compares the actual spatial distance between the second alarm events with the second reference threshold, and if the spatial distance is less than the second reference threshold, it filters out the second alarm events with a spatial distance less than the second reference threshold and determines them as first candidate alarm events. These events simultaneously satisfy type association and time interval... The system identifies alarm events that are geographically or spatially adjacent. It then uses a causal relationship graph generated from historical data mining. This graph uses alarm types as nodes and causal relationships between types as edges. The strength of the relationship is quantified using confidence and support metrics. Based on this graph, causal logic analysis is performed on all alarm data to identify alarm events with valid causal relationships from preceding to subsequent alarm types, which are then designated as second candidate alarm events. Finally, the system integrates the relationship characteristics and distribution patterns of the first and second candidate alarm events to identify alarm relationship anomalies in the nuclear power plant across type, time, space, and causal logic dimensions. Based on the relationship anomalies reflected by the two candidate alarm events, a corresponding risk warning is generated, which serves as the second warning result.

[0044] For example, the electronic device calculates the spatial distance between each related second alarm event based on the physical coordinates of the device to which the alarm belongs, combined with the Euclidean distance formula; for the second alarm event with the area number to which the device belongs, the distance deviation relative to the center point of the area is additionally calculated to help determine the degree of clustering of alarm events in the area.

[0045] In this embodiment, time correlation is used to capture anomalies occurring frequently in a short period of time, and spatial correlation is used to accurately locate anomaly clusters at the geographical / logical level. Combined with a causal correlation map constructed based on historical data mining, the inherent causal logic and chain correlation between alarm events can be deeply mined. The three types of rules can be flexibly combined to suit the complex operating scenarios of nuclear power plants. They can extract multi-dimensional correlation features between events from seemingly scattered alarm data, effectively identify potential system-level correlation anomalies and chain risks that are difficult to discover with a single analysis method, greatly improve the comprehensiveness, accuracy and depth of risk assessment, reduce the omission and misjudgment of correlation risks, and at the same time give clear correlation logic support to the second warning result, making the warning result more targeted and valuable for reference, and providing clear anomaly indications for the subsequent risk management of nuclear power plants.

[0046] S104, Based on a clustering analysis algorithm, the spatiotemporal distribution characteristics of alarms are filtered out from the alarm data; wherein, the spatiotemporal distribution characteristics of alarms include alarm hotspot areas, alarm modes and / or high-frequency alarm sequences.

[0047] In some embodiments, the step of filtering out the spatiotemporal distribution characteristics of alarms from the alarm data based on a clustering analysis algorithm includes: The alarm data is analyzed using a density clustering algorithm to obtain the alarm hotspot areas; The alarm data is analyzed using a hierarchical clustering algorithm to obtain the alarm pattern; The alarm data is analyzed using an association rule mining algorithm to obtain the high-frequency alarm sequence.

[0048] In this embodiment of the application, the density clustering algorithm (such as the Density-Based Spatial Clustering of Applications with Noise (DBSCAN algorithm)) is a clustering analysis algorithm based on spatial density. It does not require pre-setting the number of clusters and can autonomously discover density clusters of arbitrary shapes in physical space. At the same time, it can effectively identify noise points (isolated alarm events) and is suitable for mining the distribution pattern of alarm data in physical space.

[0049] In this embodiment, the alarm hotspot area is the core distribution feature of alarm data in the spatial dimension. After analysis by density clustering algorithm, the alarm hotspot area can be identified as a specific location in the physical space of the nuclear power plant where the density of alarm events is significantly higher than that in the surrounding area, reflecting the spatial aggregation pattern of alarms.

[0050] In this embodiment, the hierarchical clustering algorithm is a clustering analysis algorithm based on feature similarity. By calculating the dissimilarity between data feature attributes, it constructs a tree-like clustering structure (dendrogram) with bottom-up agglomerative logic, which can reveal the grouping rules of alarm data at different granularities and is suitable for mining the inherent rules from the similarity of alarm features.

[0051] In this embodiment, the alarm pattern is the core distribution feature of alarm data in the feature dimension. The alarm pattern can be summarized into several typical types after the alarm data is analyzed by hierarchical clustering algorithm. This can realize the accurate classification of similar alarm events and provide a basis for identifying common cause faults.

[0052] In this embodiment of the application, the association rule mining algorithm is an algorithm for mining frequent itemsets from data. It focuses on the sequential relationship of data in the time stream and is suitable for revealing the occurrence pattern of alarm data in the time dimension. It can mine frequent alarm combinations with time sequence characteristics.

[0053] In some embodiments, the electronic device preprocesses the physical coordinates of the devices to which the alarms of the first candidate alarm event and the second candidate alarm event belong. Using the reference point of the three-dimensional spatial layout model of the nuclear power plant as a reference, it corrects the deviation of all physical coordinates to reduce the coordinate offset problem caused by different data sources. It also deletes alarm data points with incomplete coordinate information (data missing in any dimension of the three-dimensional coordinates) or abnormal coordinate data to obtain a preprocessed dataset.

[0054] In some embodiments, the electronic device marks all coordinate points in the preprocessed dataset as unvisited, initializes the cluster numbers, and creates an empty set of noise points. It then selects an unvisited coordinate point from the preprocessed dataset, marks it as visited, and calculates the neighborhood range of that coordinate point. If the coordinate point is a core point (the number of coordinate points in its neighborhood reaches or exceeds the minimum number of points), a new cluster is created, and all unvisited coordinate points in the neighborhood of that coordinate point are marked as visited and added to the new cluster. Subsequently, the neighborhood range of each coordinate point within the cluster is recursively calculated. If the coordinate point is a core point, its unvisited coordinate points are marked as visited and added to the current cluster, until all coordinate points within the cluster are visited. After processing is complete; if the selected coordinate point is not a core point (the number of coordinate points in the neighborhood is less than the minimum number of points), then determine whether there is a core point whose neighborhood contains the coordinate point: if so, classify it into the cluster to which the corresponding core point belongs; if not, classify it into the noise point set; repeat the above steps of selecting data points, determining core points, generating clusters, and processing boundary points and noise points until all coordinate points in the preprocessed dataset are marked as visited; for adjacent clusters within the same physical area of ​​the nuclear power plant (the distance between the nearest coordinate points between clusters does not exceed half the neighborhood radius), combine the nuclear power plant area division rules (such as area number, system affiliation) to merge the clusters to avoid the alarm clusters in the same area being incorrectly split due to differences in equipment distribution within the area.

[0055] In some embodiments, the step of analyzing the alarm data according to a hierarchical clustering algorithm to obtain the alarm pattern includes: Each alarm event in the alarm data is converted into a feature vector; wherein, the feature dimensions of the feature vector include alarm type, source device identifier, trigger time and / or duration; Clustering is initialized based on each feature vector, and the dissimilarity between each cluster is calculated to construct a distance matrix; The distance matrix is ​​iterated based on the dissimilarity until all clusters are merged into the target cluster. Generate a tree diagram based on the iteration records during the iteration process; The dendrogram is segmented according to the dissimilarity threshold to obtain clustering results of different granularities; wherein, the clustering results correspond one-to-one with the alarm modes.

[0056] In some embodiments, for each alarm event, feature information such as alarm type, source device identifier, trigger time, and duration is extracted and transformed into a multi-dimensional feature vector. Then, standardization processing is performed on all features to eliminate the analysis bias caused by the difference in the units of different features. At the same time, a corresponding weight is preset for each feature dimension, and finally a standardized feature vector set containing all alarm events is formed, thus completing the transformation from alarm event to feature vector.

[0057] In some embodiments, each vector in the standardized feature vector set is regarded as an independent cluster, forming an initial cluster set; the dissimilarity between all clusters is calculated based on the weighted Euclidean distance, and the calculation is combined with the preset weights of each feature dimension to comprehensively measure the degree of difference between different clusters in feature dimensions such as alarm type and source device identification; the dissimilarity results between all clusters are systematically organized to construct an initial distance matrix, where each value in the matrix corresponds to the dissimilarity between a pair of clusters.

[0058] In some embodiments, iterative processing can be carried out through bottom-up agglomerative clustering logic: In each iteration, the pair of clusters with the smallest dissimilarity is found from the current distance matrix, and these two clusters are merged into a new cluster; the dissimilarity between the new cluster and all remaining unmerged clusters is recalculated, and the distance matrix is ​​updated with the calculation result; the above operations of finding the minimum dissimilarity cluster pair, merging clusters and updating the distance matrix are repeated continuously, and the order of each cluster merging and the corresponding dissimilarity are recorded, until all independent clusters are finally merged into a large cluster containing all alarm events (i.e., the target cluster).

[0059] In some embodiments, a tree-like clustering structure (tree diagram) is constructed based on the clustering merging order recorded throughout the iteration process and the dissimilarity value corresponding to each merging. The nodes of the tree diagram correspond to each cluster in the clustering process, the branches reflect the clustering merging process, and the length of the branches or the labeled values ​​correspond to the dissimilarity during cluster merging, clearly presenting the clustering grouping of alarm events at different stages and the degree of difference between groups.

[0060] In some embodiments, a dissimilarity threshold is preset, and the generated dendrogram is segmented based on this threshold. Clusters with dissimilarity less than the threshold are retained as independent groups, while clusters with dissimilarity greater than the threshold are divided into different groups, thereby obtaining clustering results of different granularities. Each cluster group formed after segmentation corresponds to a typical alarm mode, and each alarm mode is labeled with a unique identifier. The number of alarm events contained in the mode is counted, and the central value or main value of each feature dimension is calculated to form a complete list of typical alarm modes.

[0061] In this embodiment, cluster initialization based on feature vectors, combined with dissimilarity calculation to construct a distance matrix, can accurately measure the degree of difference in multi-dimensional features of different alarm events, ensuring the initial accuracy of cluster analysis. The process of iteratively merging clusters based on dissimilarity until the target cluster is formed adopts a bottom-up agglomerative logic, fully preserving the merging trajectory of alarm events from independent individuals to overall clustering, clearly presenting the similarity association hierarchy between alarm events. The generated dendrogram, based on iterative records, intuitively visualizes the clustering process and the dissimilarity between each cluster, facilitating the understanding of the hierarchical relationship of alarm patterns. Furthermore, cutting the dendrogram according to the dissimilarity threshold yields clustering results of different granularities, flexibly adapting to the risk assessment needs of nuclear power plants at different levels (such as coarse-grained major alarm patterns and fine-grained sub-patterns). The clustering results correspond one-to-one with the alarm patterns, accurately summarizing typical alarm patterns with common characteristics, effectively identifying common-cause faults, and providing a structured and interpretable feature dimension analysis basis for risk tracing and early warning response in nuclear power plants. This comprehensively improves the systematicness, accuracy, and scenario adaptability of alarm pattern mining.

[0062] In some embodiments, the electronic device can convert preprocessed alarm data into a set of historical alarm sequences, associate it with two key types of information, namely, nuclear power plant operating condition labels and historical causal confirmation labels, and integrate them to form an enhanced alarm sequence set containing multi-dimensional features, which serves as the basic data source for association rule mining algorithms.

[0063] In some embodiments, correlation indicators are dynamically set according to different operating conditions of the nuclear power plant. For example, the minimum confidence level can be set to 0.85 and the minimum lift level to 1.3. Then, the enhanced alarm sequence set is processed in layers according to the operating condition type of the nuclear power plant (full power, start-up and shutdown, maintenance). The FP-Growth algorithm is used to mine frequent alarm itemsets under each operating condition. During the mining process, the support of each alarm itemset under the corresponding operating condition is calculated based on the total number of alarm sequences under the corresponding operating condition, and frequent alarm itemsets that meet the preset support threshold are selected.

[0064] In some embodiments, based on the frequent alarm itemsets mined under each operating condition, candidate time-series association rules in the form of "preceding alarm combination X → subsequent alarm combination Y" are generated. Core indicators such as support, confidence, and lift of the candidate rules are calculated. The core indicators are compared with preset thresholds (dynamically set minimum support, minimum confidence of 0.85, and minimum lift of 1.3). At the same time, the validity of the rules is verified by confirming the causal relationship chain. Valid rules that meet both the threshold requirements and have been confirmed by causality are selected. A list of frequent alarm itemsets for each operating condition is compiled and output. The list includes information such as specific alarm combinations, the support of each combination under the corresponding operating condition, and high-frequency alarm sequences that meet the valid rules.

[0065] In this embodiment, density clustering does not require a preset number of clusters, adapts to the three-dimensional spatial layout characteristics of nuclear power plants, and can effectively identify alarm hotspots of arbitrary shapes while accurately eliminating isolated noise alarm points, thus achieving precise location of alarm clustering risks at the physical space level. Hierarchical clustering, through feature vector construction and agglomerative iterative merging, summarizes typical alarm patterns of different granularities from multiple feature dimensions such as alarm type, source device, and trigger time, which can effectively identify similar alarms caused by common faults, fitting the complex characteristics of multi-type and multi-device alarms in nuclear power plants. Association rule mining combines the full-power, start-up, shutdown, and maintenance conditions of nuclear power plants. By layering and dynamically adapting parameters such as support and confidence, the FP-Growth algorithm accurately mines high-frequency alarm sequences with temporal characteristics, capturing the sequential chaining patterns of alarm events over time. The synergy of these three elements overcomes the limitations of single-dimensional analysis, avoiding the omission of spatial clustering risks, feature similarity risks, and temporal chaining risks. Furthermore, through optimizations tailored to the nuclear power plant scenario (such as 3D coordinate calibration, feature weight setting, and operating condition layered calculation), the relevance and accuracy of the analysis results are improved, providing comprehensive support for nuclear power plant risk assessment in terms of spatial positioning, pattern summarization, and temporal early warning.

[0066] S105, Based on the first warning result, the second warning result and / or the spatiotemporal distribution characteristics of the alarm, generate a risk warning.

[0067] In some embodiments, electronic devices can perform structured analysis on the first warning result, the second warning result, and the spatiotemporal distribution characteristics of the alarm, extract the risk attribute parameters and feature information corresponding to the analysis results of each dimension, and complete the comprehensive judgment of risk level, accurate positioning of risk range, summarization and sorting of fault root causes and prediction and analysis of evolution trend through the logic of cross-verification of multi-dimensional information. Finally, all effective risk information is integrated to generate structured risk prompts and push them to the corresponding operation and maintenance terminals.

[0068] In some embodiments, when the electronic device analyzes the first warning result, it can extract the risk type corresponding to the first warning result and the matching time window accumulation rule parameters. When the first warning result indicates continuous accumulation risk, the corresponding first statistical data is extracted simultaneously, including the current number of consecutive alarm days, the daily alarm count, and the corresponding preset daily average accumulation threshold and threshold, which serve as the basis for judging the degree of risk accumulation. When the first warning result indicates cumulative comprehensive risk, the corresponding second statistical data is extracted simultaneously, including the total number of alarms, the first time length covered by the current sliding time window, and the corresponding total window accumulation threshold and first threshold, which serve as the basis for judging the degree of risk density. When the electronic device analyzes the second warning result, it extracts the corresponding first candidate alarm event set, the second candidate alarm event set, and the corresponding causal relationship chain information, which serve as the core basis for judging the alarm event association characteristics and transmission logic. When the electronic device analyzes the alarm spatiotemporal distribution characteristics, it extracts the alarm hotspot area information obtained by the density clustering algorithm, the various alarm pattern information obtained by the hierarchical clustering algorithm, and the high-frequency alarm sequence information obtained by the association rule mining algorithm, which serve as supplementary basis for judging the alarm spatial distribution law, feature classification law, and temporal evolution law.

[0069] In some embodiments, the electronic device uses the risk accumulation level corresponding to the first warning result as a basic judgment benchmark, and combines it with the characteristics of associated alarm events in the second warning result for comprehensive judgment. When the first warning result indicates continuous accumulation of risk, and the second warning result also contains a second candidate alarm event with a causal relationship chain, the risk warning level is raised accordingly; when there is only a single-dimensional mild accumulation risk and no associated alarm event characteristics, the basic warning level is maintained. At the same time, the electronic device can match and verify the spatial distribution information of the first candidate alarm events that meet the spatial correlation rules in the second warning result with the alarm hotspot areas in the alarm spatiotemporal distribution characteristics, eliminate discrete isolated alarm events, lock the physical area where alarms are concentrated and the range of source devices involved, and complete the precise location of the risk occurrence area.

[0070] In some embodiments, the electronic device can combine the causal chain output by the second early warning result with the alarm patterns and high-frequency alarm sequences in the spatiotemporal distribution characteristics of the alarm to summarize the typical alarm patterns corresponding to the risk, trace the complete transmission path from the preceding alarm event to the subsequent alarm event, and locate the root cause event that triggered the associated alarm, providing a basis for tracing the source for subsequent operation and maintenance. At the same time, based on the cumulative change trend of alarms within the sliding time window in the first early warning result, combined with the temporal correlation pattern of the high-frequency alarm sequence, the electronic device can predict the subsequent evolution direction of the risk and the types of subsequent alarms that may be triggered, supplementing the risk evolution prediction information.

[0071] In some embodiments, electronic devices can adapt the corresponding risk warning generation logic according to the type of analysis results actually obtained. When only the first warning result is obtained, a risk warning of the corresponding degree is generated based on the triggering of the corresponding time window accumulation rule, clearly marking the time accumulation characteristics of the risk. When only the second warning result is obtained, a related risk warning is generated based on the type of the associated alarm event and the corresponding causal relationship chain, clearly marking the association attribute and transmission path of the alarm event. When only the spatiotemporal distribution characteristics of the alarm are obtained, an alarm distribution characteristic warning is generated based on the distribution of alarm hotspot areas, typical alarm patterns, and high-frequency alarm sequences, providing alarm pattern references for operation and maintenance personnel. When two or three types of analysis results exist simultaneously, the risk attribute parameters and feature information corresponding to each dimension of analysis results can be extracted, multi-dimensional information fusion and cross-verification can be performed, and a complete structured risk warning can be generated.

[0072] In some embodiments, the risk alerts ultimately generated by electronic devices may include risk level, risk location, scope of equipment involved, risk type, causal transmission chain, prediction of evolution trend, and operation and maintenance handling suggestions. These alerts can be pushed to the corresponding management terminals in the form of visual alarm messages and standardized operation and maintenance work orders according to the safety operation and maintenance needs of nuclear power plants. This provides a comprehensive and scientific basis for decision-making in the safety operation and maintenance of nuclear power plants, supports rapid response and closed-loop handling of risks, and ensures the safe and stable operation of nuclear power plant systems.

[0073] The aforementioned nuclear power plant risk early warning method acquires and filters alarm data from multiple sources of nuclear power plant operating data in real time. It then uses a sliding time window calculation based on a cumulative time window rule to achieve real-time initial screening and early warning of alarm data. By relying on time, space, and causal correlation rules, it mines the inherent relationships between alarm information to identify potential cascading risks. Finally, it uses clustering analysis algorithms to extract spatiotemporal distribution characteristics such as alarm hotspots, typical patterns, and high-frequency sequences. The method integrates multi-dimensional analysis results to generate risk alerts. This approach achieves comprehensive and multi-dimensional in-depth analysis of nuclear power plant alarm data while also ensuring the real-time nature, relevance, and accuracy of risk assessment. It effectively perceives the dynamically changing operational risk situation of nuclear power plants, accurately locates risk hotspots, and identifies cascading risk hazards, providing comprehensive and scientific decision-making basis for the safe operation and maintenance of nuclear power plants. This multi-dimensional approach ensures the safe and stable operation of nuclear power plant systems.

[0074] In some embodiments, the time window accumulation rule includes a continuous accumulation rule; the calculation of a sliding time window on the alarm data based on the matching time window accumulation rule to obtain a first warning result includes:

[0075] Determine the first statistical data within the current sliding time window from the alarm data;

[0076] If the first statistical data satisfies the continuous accumulation rule, the first warning result is determined to be a continuous accumulation risk; wherein, the first statistical data includes the current number of consecutive alarm days and the daily alarm count; the continuous accumulation rule includes the current sliding time window being in an effective state and the number of days when the daily alarm count reaches the preset daily average accumulation threshold being greater than or equal to the threshold.

[0077] In some embodiments, the electronic device adapts corresponding continuous accumulation rule parameters (the threshold T1 for consecutive days and the daily average accumulation threshold N1) to the monitoring target (such as a specific person, device, or area), and initializes the sliding time window (window duration T2) corresponding to the monitoring target; it continuously monitors the standardized alarm data stream of the monitoring target; wherein, the window can be divided into sub-periods in natural days, and the number of alarms occurring in each sub-period (daily) is counted in real time to form a daily alarm count; at the same time, the current consecutive alarm days are dynamically updated: if the daily alarm count of a certain day reaches or exceeds the preset daily average accumulation threshold N1, the current consecutive alarm days are incremented by 1; if the daily alarm count of a certain day does not reach N1, the current consecutive alarm days are reset to 0; during this process, it is simultaneously confirmed whether the current sliding time window is in a valid state (such as the window has not expired, data acquisition is uninterrupted, and there is no interference from invalid alarm data, etc.), and finally integrates to obtain the first statistical data within the current sliding time window, namely the real-time updated current consecutive alarm days and the daily alarm count of each sub-period.

[0078] In some embodiments, the electronic device verifies the two core conditions of the continuous accumulation rule one by one: First, it checks the status of the current sliding time window to confirm that it is in a valid state; second, it counts the number of days in the first statistical data where the daily alarm count reaches the preset daily average accumulation threshold N1, and determines whether the number of days is greater than or equal to the preset threshold. If both conditions are met simultaneously, the first statistical data is determined to meet the continuous accumulation rule, and the first warning result is directly determined to be that there is a continuous accumulation risk. For example, for the monitoring target of "abnormal human emotions", the preset daily average accumulation threshold is set to N1 = 2 times / day and the threshold is 3 days. When the current sliding time window is valid and the number of days when the daily alarm count of the target reaches 2 times / day is ≥ 3 days, the continuous accumulation rule is met, and the first warning result is determined to be that there is a continuous accumulation risk.

[0079] In some embodiments, the time window accumulation rule includes a cumulative sum rule; the step of performing a sliding time window calculation on the alarm data based on the matching time window accumulation rule to obtain a first warning result includes: Determine the second statistical data of the alarm data within the current sliding time window; If the second statistical data satisfies the cumulative summation rule, the first warning result is determined to have a cumulative comprehensive risk; wherein, the second statistical data includes the total number of alarms and the first time length covered by the current sliding time window; the cumulative summation rule includes the current sliding time window being in an effective state, the first time length being greater than a first threshold, and the total number of alarms being greater than or equal to the total cumulative threshold of the window.

[0080] In some embodiments, the electronic device can configure core parameters of the cumulative summation rule for the monitored target, such as the current sliding time window being T3 (e.g., 7 days) and the total cumulative threshold N2 (e.g., 5 times). It continuously monitors the standardized alarm data stream of the monitored target, incorporating newly generated alarm events into the current sliding time window in real time, while removing expired alarm events with timestamps earlier than the window's start time, ensuring that only valid alarm data within the T3 time period is retained within the window. During this process, the total number of alarm events within the window (i.e., the total number of alarms) is counted in real time, and the actual time length covered by the current sliding time window (i.e., the first time length) is calculated. Simultaneously, it is confirmed whether the current sliding time window is in a valid state (e.g., uninterrupted data acquisition, no invalid alarm data interference, and the window not being manually paused). Finally, the second statistical data within the current sliding window is obtained, namely the total number of alarms within the window and the first time length covered by the current sliding time window.

[0081] In some embodiments, the electronic device verifies the three core conditions of the cumulative summation rule one by one: First, it checks the status of the current sliding time window to confirm that it is in a valid state; second, it determines whether the first time length covered by the current sliding time window is greater than a first threshold, for example, the first threshold can be 80% of the current sliding time window or the complete time length of the current sliding time window; third, it determines whether the total number of alarms in the second statistical data is greater than or equal to the preset total window accumulation threshold N2. If the above three conditions are met simultaneously, it can be determined that the second statistical data conforms to the cumulative summation rule, and at this time, the first warning result is determined to have a cumulative summation risk.

[0082] For example, for the monitoring target of "equipment failure", the current sliding time window T3 is set to 7 days and the total cumulative threshold N2 is set to 5 times. When the current sliding time window is valid and the first time length covered is 5 days, which is greater than or equal to 70% of the current sliding time window, and the total number of equipment failure alarms within 5 days is ≥ 5, the cumulative sum rule is met, and the first warning result is determined to be that there is a cumulative sum risk.

[0083] In this embodiment, the time window accumulation rule is divided into continuous accumulation rule and cumulative summation rule. The core advantage is that it can accurately distinguish between two types of alarm accumulation risks with different evolutionary characteristics in the nuclear power plant scenario, respectively adapting to continuous abnormal risks and high-frequency and frequent risks (such as the cumulative high incidence of equipment failures and regional anomalies). The two types of rules can independently set the judgment logic, threshold parameters and triggering conditions according to the risk characteristics of different monitoring targets such as personnel, equipment and areas in the nuclear power plant, reducing the one-sidedness and misjudgment of a single rule for different types of accumulation risks. At the same time, this split rule design makes risk judgment more flexible. It can be configured, independently activated or adjusted according to the actual operation and maintenance needs of the nuclear power plant, making the early warning logic of sliding window calculation more in line with the actual scenario of safe operation of nuclear power plants, greatly improving the accuracy and relevance of the first early warning result, and providing a more realistic basic early warning basis for subsequent multi-dimensional risk judgment.

[0084] In some embodiments, the step of performing causal logic analysis on the alarm data based on the causal relationship graph to obtain a second candidate alarm event includes: Upon receiving a new third alarm event, the correlation index between the third alarm event and each alarm event in the alarm data is calculated based on the causal correlation graph; wherein, the correlation index includes support and / or confidence. If the correlation index is greater than the target threshold, the third alarm event is determined as the second candidate alarm event and the corresponding causal chain.

[0085] In this embodiment of the application, support is used to measure the prevalence of the combination of alarm events involved in the rule.

[0086] In this embodiment of the application, the confidence level is used to measure the conditional probability that the second alarm type will occur subsequently given that the first alarm type has occurred.

[0087] In some embodiments, electronic devices can generate causal relationship graphs based on preprocessed historical alarm data and in conjunction with correlation analysis algorithms (such as the Apriori prior algorithm or the FP-Growth frequent pattern growth algorithm), and store them in a causal relationship rule base; wherein, the causal relationship graphs pre-store potential causal rules in the form of "alarm type A → alarm type B".

[0088] For example, upon receiving a new third alarm event (such as alarm type A), the support and / or confidence correlation indicators between the third alarm event and each other alarm event are calculated respectively. For instance, the support of the third alarm event of alarm type A and the third alarm event of alarm type B can be determined based on the ratio of the number of third alarm events including alarm types A and B to the total number of third alarm events. The confidence of the third alarm event of alarm type A and the third alarm event of alarm type B can be determined based on the support of the third alarm event of alarm type A and the third alarm event of alarm type B / the individual support of the third alarm event of alarm type A, thereby completing the quantitative calculation of all correlation indicators.

[0089] In some embodiments, the calculated support and confidence correlation indices are compared with preset minimum support thresholds (e.g., 0.3, 0.35) and minimum confidence thresholds (e.g., 0.8, 0.7), i.e. target thresholds. If the correlation index is greater than the corresponding target threshold, it is determined that the third alarm event has a valid strong causal relationship with the corresponding alarm event in the alarm data, and weak correlations that are accidental, lack universality, or lack reliability are filtered out. At this time, the third alarm event is directly determined as the second candidate alarm event. At the same time, based on the pre-stored "alarm type A → alarm type B" causal rule in the causal relationship graph, the complete correlation path from the predecessor alarm type in the alarm data to the alarm type of the third alarm event is sorted out and extracted, and the corresponding causal relationship chain is generated to clarify the causal relationship logic between the third alarm event and related alarm events.

[0090] In this embodiment, relying on the causal relationship graph generated by the correlation analysis algorithm, the causal relationship between new alarm events and historical alarm data is calculated by combining support and confidence quantification indicators. Furthermore, by filtering weak relationships through target thresholds, the system can accurately determine effective strong causal relationships between alarm events in a quantitative manner, reducing subjective bias and effectively eliminating accidental false associations, thus improving the objectivity and reliability of causal logic analysis. Simultaneously, real-time calculation and matching of correlation indicators are performed on newly received third alarm events, quickly capturing potential causal chain risks and meeting the real-time requirements of nuclear power plant risk assessment. In addition, the causal relationship rule base supports dynamic updates based on newly added historical data, allowing correlation indicators and causal rules to continuously adapt to changes in the actual operating conditions of the nuclear power plant, ensuring the timeliness and relevance of causal analysis. Moreover, while determining the third alarm event as the second candidate alarm event, a corresponding causal relationship chain is generated simultaneously. This not only accurately identifies causal relationship risks but also clearly outlines the causal propagation path of risks, providing a clear logical basis for subsequent risk tracing, chain risk prevention and control, and targeted handling in nuclear power plants. This effectively reduces the underestimation of potential causal relationship risks and further enhances the reference value of the second early warning results.

[0091] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0092] Based on the same inventive concept, this application also provides a nuclear power plant risk warning device for implementing the aforementioned nuclear power plant risk warning method. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more embodiments of the nuclear power plant risk warning device provided below can be found in the limitations of the nuclear power plant risk warning method described above, and will not be repeated here.

[0093] In one embodiment, such as Figure 2 As shown, a nuclear power plant risk early warning device is provided, the device comprising: The acquisition module 10 is used to acquire multi-source operating data of the nuclear power plant in real time and filter out alarm data from it; The first analysis module 20 is used to perform sliding time window calculation on the alarm data based on the matching time window accumulation rule to obtain the first early warning result; The second analysis module 30 is used to perform correlation analysis on the alarm data based on time correlation rules, spatial correlation rules and / or causal correlation rules to obtain a second early warning result; The third analysis module 40 is used to filter out alarm spatiotemporal distribution features from the alarm data based on a clustering analysis algorithm; wherein, the alarm spatiotemporal distribution features include alarm hotspot areas, alarm patterns and / or high-frequency alarm sequences; The prompting module 50 is used to generate a risk prompt based on the first warning result, the second warning result, and / or the spatiotemporal distribution characteristics of the alarm.

[0094] In one embodiment, the time window accumulation rule includes a continuous accumulation rule; the first analysis module 20 is configured to perform the following steps: Determine the first statistical data within the current sliding time window from the alarm data; If the first statistical data satisfies the continuous accumulation rule, the first warning result is determined to be a continuous accumulation risk; wherein, the first statistical data includes the current number of consecutive alarm days and the daily alarm count; the continuous accumulation rule includes the current sliding time window being in an effective state and the number of days when the daily alarm count reaches the preset daily average accumulation threshold being greater than or equal to the threshold.

[0095] In one embodiment, the time window accumulation rule includes a cumulative summation rule; the first analysis module 20 is configured to perform the following steps: Determine the second statistical data of the alarm data within the current sliding time window; If the second statistical data satisfies the cumulative summation rule, the first warning result is determined to have a cumulative comprehensive risk; wherein, the second statistical data includes the total number of alarms and the first time length covered by the current sliding time window; the cumulative summation rule includes the current sliding time window being in an effective state, the first time length being greater than a first threshold, and the total number of alarms being greater than or equal to the total cumulative threshold of the window.

[0096] In one embodiment, the second analysis module 30 includes: The matching unit is used to perform type matching between various alarm events in the alarm data to obtain matching results; A time correlation unit is used to filter out the matching results representing mutually correlated first alarm events from the alarm events, and to determine the time interval between the mutually correlated first alarm events; A spatial association unit is used to filter out second alarm events whose time interval is less than a first reference threshold from the first alarm events, and to determine the spatial distance between mutually associated second alarm events; The first filtering unit is used to determine the second alarm event whose spatial distance is less than the second reference threshold as the first candidate alarm event; The second screening unit is used to perform causal logic analysis on the alarm data based on the causal relationship graph to obtain a second candidate alarm event; The determining unit is used to obtain the second warning result based on the first candidate alarm event and the second candidate alarm event.

[0097] In one embodiment, the second filtering unit is configured to perform the following steps: Upon receiving a new third alarm event, the correlation index between the third alarm event and each alarm event in the alarm data is calculated based on the causal correlation graph; wherein, the correlation index includes support and / or confidence. If the correlation index is greater than the target threshold, the third alarm event is determined as the second candidate alarm event and the corresponding causal chain.

[0098] In one embodiment, the third analysis module 40 includes: The first clustering unit is used to analyze the alarm data according to the density clustering algorithm to obtain the alarm hotspot area; The second clustering unit is used to analyze the alarm data according to the hierarchical clustering algorithm to obtain the alarm mode; The third clustering unit is used to analyze the alarm data according to the association rule mining algorithm to obtain the high-frequency alarm sequence.

[0099] In one embodiment, the second clustering unit is configured to perform the following steps: Each alarm event in the alarm data is converted into a feature vector; wherein, the feature dimensions of the feature vector include alarm type, source device identifier, trigger time and / or duration; Clustering is initialized based on each feature vector, and the dissimilarity between each cluster is calculated to construct a distance matrix; The distance matrix is ​​iterated based on the dissimilarity until all clusters are merged into the target cluster. Generate a tree diagram based on the iteration records during the iteration process; The dendrogram is segmented according to the dissimilarity threshold to obtain clustering results of different granularities; wherein, the clustering results correspond one-to-one with the alarm modes.

[0100] Each module in the aforementioned nuclear power plant risk warning device can be implemented entirely or partially through software, hardware, or a combination thereof. Each module can be embedded in the processor of the electronic device in hardware form or independent of the processor, or it can be stored in the memory of the electronic device in software form, so that the processor can call and execute the corresponding operations of each module.

[0101] In one embodiment, an electronic device is provided, the internal structure of which can be shown as follows: Figure 3As shown, the electronic device includes a processor, memory, communication interface, display unit, and input device connected via a method bus. The processor provides computational and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores operating methods and computer programs. The internal memory provides an environment for the operation of the operating methods and computer programs stored in the non-volatile storage medium. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a nuclear power plant risk warning method. The display screen can be an LCD screen or an e-ink display screen. The input device can be a touch layer covering the display screen, or buttons, a trackball, or a touchpad mounted on the device's casing.

[0102] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0103] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0104] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps performed by the processor of the electronic device of any of the above.

[0105] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0106] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, compilable logic units, quantum computing-based data processing logic units, etc., and are not limited to these.

[0107] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0108] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for early warning of risks in nuclear power plants, characterized in that, The method includes: Real-time acquisition of multi-source operating data from nuclear power plants and filtering out alarm data from them; Based on the matching time window accumulation rule, the alarm data is calculated using a sliding time window to obtain the first early warning result; Based on time association rules, spatial association rules and / or causal association rules, the alarm data is analyzed to obtain a second early warning result; Based on clustering analysis algorithms, alarm spatiotemporal distribution characteristics are filtered out from the alarm data; wherein, the alarm spatiotemporal distribution characteristics include alarm hotspot areas, alarm patterns and / or high-frequency alarm sequences; A risk alert is generated based on the first warning result, the second warning result, and / or the spatiotemporal distribution characteristics of the alarm.

2. The method according to claim 1, characterized in that, The time window accumulation rule includes a continuous accumulation rule; the sliding time window calculation based on the matching time window accumulation rule to obtain the first early warning result includes: Determine the first statistical data within the current sliding time window from the alarm data; If the first statistical data satisfies the continuous accumulation rule, the first warning result is determined to be a continuous accumulation risk; wherein, the first statistical data includes the current number of consecutive alarm days and the daily alarm count; the continuous accumulation rule includes the current sliding time window being in an effective state and the number of days when the daily alarm count reaches the preset daily average accumulation threshold being greater than or equal to the threshold.

3. The method according to claim 1, characterized in that, The time window accumulation rule includes a cumulative sum rule; the time window accumulation rule based on the matching process calculates a sliding time window on the alarm data to obtain a first warning result, including: Determine the second statistical data of the alarm data within the current sliding time window; If the second statistical data satisfies the cumulative summation rule, the first warning result is determined to have a cumulative comprehensive risk; wherein, the second statistical data includes the total number of alarms and the first time length covered by the current sliding time window; the cumulative summation rule includes the current sliding time window being in an effective state, the first time length being greater than a first threshold, and the total number of alarms being greater than or equal to the total cumulative threshold of the window.

4. The method according to claim 1, characterized in that, The second early warning result is obtained by performing correlation analysis on the alarm data based on time correlation rules, spatial correlation rules, and / or causal correlation rules, including: Type matching is performed between the alarm events in the alarm data to obtain the matching results; The matching results are filtered from the alarm events to represent the first alarm events that are mutually related, and the time interval between the first alarm events that are mutually related is determined. Filter out second alarm events from the first alarm events whose time interval is less than the first reference threshold, and determine the spatial distance between mutually related second alarm events; The second alarm event where the spatial distance is less than the second reference threshold is determined as the first candidate alarm event; Based on the causal relationship graph, causal logic analysis is performed on the alarm data to obtain a second candidate alarm event; The second early warning result is obtained based on the first candidate alarm event and the second candidate alarm event.

5. The method according to claim 4, characterized in that, The step of performing causal logic analysis on the alarm data based on the causal relationship graph to obtain the second candidate alarm event includes: Upon receiving a new third alarm event, the correlation index between the third alarm event and each alarm event in the alarm data is calculated based on the causal correlation graph; wherein, the correlation index includes support and / or confidence. If the correlation index is greater than the target threshold, the third alarm event is determined as the second candidate alarm event and the corresponding causal chain.

6. The method according to claim 1, characterized in that, The step of filtering out the spatiotemporal distribution characteristics of alarms from the alarm data based on clustering analysis algorithm includes: The alarm data is analyzed using a density clustering algorithm to obtain the alarm hotspot areas; The alarm data is analyzed using a hierarchical clustering algorithm to obtain the alarm pattern; The alarm data is analyzed using an association rule mining algorithm to obtain the high-frequency alarm sequence.

7. The method according to claim 6, characterized in that, The step of analyzing the alarm data using a hierarchical clustering algorithm to obtain the alarm pattern includes: Each alarm event in the alarm data is converted into a feature vector; wherein, the feature dimensions of the feature vector include alarm type, source device identifier, trigger time and / or duration; Clustering is initialized based on each feature vector, and the dissimilarity between each cluster is calculated to construct a distance matrix; The distance matrix is ​​iterated based on the dissimilarity until all clusters are merged into the target cluster. Generate a tree diagram based on the iteration records during the iteration process; The dendrogram is segmented according to the dissimilarity threshold to obtain clustering results of different granularities; wherein, the clustering results correspond one-to-one with the alarm modes.

8. A risk early warning device for nuclear power plants, characterized in that, The device includes: The acquisition module is used to acquire multi-source operating data from the nuclear power plant in real time and filter out alarm data from it. The first analysis module is used to perform sliding time window calculation on the alarm data based on the matching time window accumulation rule to obtain the first early warning result; The second analysis module is used to perform correlation analysis on the alarm data based on time correlation rules, spatial correlation rules and / or causal correlation rules to obtain a second early warning result; The third analysis module is used to filter out the spatiotemporal distribution characteristics of alarms from the alarm data based on a clustering analysis algorithm; wherein, the spatiotemporal distribution characteristics of alarms include alarm hotspot areas, alarm patterns and / or high-frequency alarm sequences; The alert module is used to generate risk alerts based on the first alert result, the second alert result, and / or the spatiotemporal distribution characteristics of the alarm.

9. An electronic device, characterized in that, The method includes a memory and a processor, wherein the memory stores a computer program, which, when executed by the processor, implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it performs the steps of the method according to any one of claims 1 to 7.

Images