Multi-alarm code and alarm level joint inference method and system based on device state time series data, electronic device and storage medium

Abstract

The application discloses a kind of based on equipment state time series data, multi-alarm code and alarm level joint inference method, system, electronic equipment and storage medium.The method includes: collecting equipment state time series data, equipment identity field, event context field and work order feedback field;According to equipment identification and time alignment, construct sample sequence;Based on multiple review time windows, construct equipment state characteristics, including statistical characteristics, trend characteristics, overrun characteristics and interphase difference characteristics;Teacher model is trained using human-labeled samples and outputs each alarm code probability;Based on each alarm code threshold and sorting rule, high-confidence pseudo-labels are filtered;Human-labeled samples and high-confidence pseudo-label samples are jointly trained student model according to different weights;Alarm code set and corresponding alarm level are output by student model;Human correction and work order disposal results are backflowed to update samples and threshold.The application realizes the joint inference of multi-alarm code and alarm level, effectively utilizes unlabeled data under the condition of limited human labeling, and has continuous optimization capability.

Description

Technical Field

[0001] This invention relates to the field of intelligent equipment operation and maintenance technology, specifically to a method, system, electronic device, and storage medium for joint reasoning of multiple alarm codes and alarm levels based on equipment status time-series data.

[0002] This invention can be applied to intelligent operation and maintenance scenarios of power distribution equipment, power safety monitoring equipment, energy equipment, industrial control equipment, sensor nodes or other monitored equipment with alarm identification requirements, and is especially suitable for intelligent operation and maintenance scenarios at the building end. Background Technology

[0003] Intelligent operation and maintenance of electrical equipment, energy equipment, industrial equipment, and other monitored equipment is a key technological aspect of ensuring the safe and stable operation of equipment. Existing systems typically convert collected equipment status data, such as current, voltage, temperature, status variables, and switching variables, into alarm records using fixed thresholds, expert rules, or single classification models. However, with the increasing variety of equipment types, the complexity of operating conditions, and the increase in on-site noise, simple rule-based alarms are becoming increasingly difficult to reliably output alarm codes and alarm levels that can be used for coordinated response.

[0004] A search revealed that existing technologies similar to this application mainly fall into the following categories.

[0005] First, alarm parsing and tiered push notification. Chinese patent application CN122116579A discloses an alarm parsing method and apparatus based on wind farm operation data and machine learning. This scheme acquires raw data from the wind farm and, combined with an alarm code information database, a dynamic anti-jitter window, and an expert database, parses, tiers, and pushes alarm trigger records. Its focus is on parsing trigger / regression records from the wind farm data and determining downstream push strategies based on alarm levels. However, this scheme still relies on a pre-built alarm code information database and expert database, emphasizing alarm parsing, anti-jitter, and tiered push notification, but does not disclose a mechanism for establishing independent probabilities, code-by-code thresholds, teacher / student pseudo-label training, and a joint learning mechanism for the alarm code set and alarm level for each alarm code.

[0006] Second, general multi-label classification. Chinese patent application CN122196183A discloses a label enhancement method and system for multi-label requirement classification with few samples. This scheme targets requirement text, uses BERT to encode text and label descriptions, constructs a label graph, enhances label semantics through graph neural networks, and then performs matching-based multi-label classification. However, this scheme is applied to text requirement classification, and its innovation lies in label semantic enhancement and graph propagation. It does not involve device status time-series data, continuous over-limit duration, inter-phase differences, alarm level linkage, nor does it provide an alarm inference closed loop that is jointly trained by high-confidence pseudo-labels and human ground truth values.

[0007] Third, a two-stage visual diagnosis using multi-label recognition. Chinese patent application CN122176366A discloses a method for identifying bridge rubber bearing defects based on target detection and multi-label classification. This scheme first locates the target bearing in the image, then performs multi-label classification of defects, and avoids contradictory outputs by coupling the overall state vector and the defect label vector. However, this scheme belongs to image target detection and visual defect recognition, focusing on the mutual exclusion of localization and defect labels, and does not address the joint output of equipment runtime sequence samples, code-by-code probability calibration, pseudo-label screening, sample weight differences, and alarm levels.

[0008] Fourth, alarm codes assist in fault location. Chinese patent application CN121441395A discloses a machine learning-based optical path fault location method and system in an intelligent computing center's optical network. This scheme constructs the optical network topology and monitoring path, generates decimal alarm codes as training data, and uses machine learning to generate monitoring paths and correct the uniqueness of alarm codes. However, the alarm codes in this scheme are mainly used for optical path location and monitoring path correction; they do not jointly infer multiple alarm codes and alarm levels from device status time-series data, nor does it disclose the use of a continuous training closed loop of manual annotation and pseudo-labels.

[0009] The aforementioned existing technologies have the following main drawbacks:

[0010] First, rule maintenance costs are high. Due to differences in equipment type, model, installation environment, and operating conditions, thresholds and rule branches require frequent manual adjustments, making it difficult to guarantee consistency as rules expand.

[0011] Second, the cross-device generalization capability is weak. Existing solutions typically build alarm parsing logic around specific scenarios or specific devices. When migrating to other devices or scenarios, a large number of rules need to be reconfigured.

[0012] Third, the ability to identify multiple alarm codes concurrently is insufficient. Equipment malfunctions often manifest as changes in multiple status variables simultaneously, and a single alarm or single tag output cannot adequately represent the situation where multiple alarm codes are active at the same time.

[0013] Fourth, alarm codes and alarm levels are disconnected. Some solutions generate alarm codes first and then map alarm levels using independent rules. The alarm levels cannot fully utilize model probabilities, time window features, and historical handling feedback.

[0014] Fifth, the unlabeled data is underutilized. In actual systems, there is far more unlabeled operational data than manually labeled data. Existing solutions lack a controllable pseudo-label filtering mechanism, which easily introduces noise during self-learning.

[0015] Sixth, there is a lack of a continuous feedback mechanism. The alarm output, manual correction, and business processing results do not form a closed loop that can be periodically retrained, making it difficult to optimize the system in the long term.

[0016] In summary, existing publicly available solutions cover specific technologies such as "alarm parsing / grading," "general multi-label classification," "visual disease multi-label recognition," and "alarm code-assisted fault location." However, no solution has been found that combines equipment status time-series characteristics, alarm code-by-alarm probability modeling, alarm code-by-alarm threshold and Top-K decision-making, high-confidence pseudo-label screening, manual ground truth and pseudo-label differential weight training, alarm code set and alarm level joint output, and result feedback training into a complete alarm reasoning closed loop. Summary of the Invention

[0017] To address the aforementioned shortcomings of existing technologies, this invention primarily solves the following technical problems: First, how to automatically infer one or more alarm codes from device status time-series data and simultaneously provide the alarm level; second, how to utilize a large amount of unlabeled operational data under limited manual annotation conditions, while avoiding error propagation caused by low-quality pseudo-labels; third, how to enable different alarm codes to have independent thresholds and sorting mechanisms to adapt to the sample ratio, triggering difficulty, and business tolerance of different alarm types; fourth, how to connect alarm model output with display, linkage, manual correction, and periodic retraining to continuously improve alarm recognition capabilities.

[0018] To solve the above-mentioned technical problems, the present invention provides the following overall technical solution:

[0019] 1. Method Overview

[0020] A method for joint reasoning of multiple alarm codes and alarm levels based on device status time-series data includes:

[0021] Collect the status time-series data, device identity field, event context field, and work order feedback field of the monitored device;

[0022] Construct sample sequences by aligning them with device identifiers and time.

[0023] The device status features of the sample sequence are constructed based on multiple review time windows. The device status features include statistical features, trend features, limit-breaking features, and inter-phase difference features.

[0024] A teacher model is trained using manually labeled samples, and the teacher model outputs the probability of each alarm code for unlabeled samples.

[0025] High-confidence pseudo-labels are selected from the unlabeled samples based on alarm code thresholds and sorting rules. The alarm code thresholds are independent thresholds set for different alarm codes.

[0026] The manually labeled samples and the high-confidence pseudo-labeled samples are jointly trained with different weights to train the student model;

[0027] The student model outputs a set of alarm codes and corresponding alarm levels.

[0028] The results of manual corrections and work order processing are fed back to update the training samples, pseudo-label screening conditions, and the alarm code threshold.

[0029] The multiple review time windows include short time windows, medium time windows, and long time windows; the statistical features include one or more of the following: mean, variance, standard deviation, maximum value, minimum value, peak-to-peak value, skewness, and kurtosis within the window; the trend features include one or more of the following: linear regression slope, exponential smoothing trend change, moving average change rate, first-order difference, and second-order difference; the limit-crossing features include one or more of the following: duration of limit-crossing, integral of limit-crossing amplitude, and frequency of limit-crossing; and the phase-to-phase difference features include one or more of the following: three-phase current imbalance, three-phase voltage imbalance, and maximum phase-to-phase difference.

[0030] Furthermore, for the sampling sequence of the device within the time window W Among the statistical characteristics, the mean is: ;variance: Standard deviation: Maximum value: Minimum value: Peak-to-peak value: ;

[0031] Skewness: ;

[0032] Kuroshi: ;

[0033] Where ε is a preset small positive number.

[0034] Among the trend features, the linear regression slope (W) is the slope obtained by performing a least-squares fit on the sequence within the window with respect to the time index; the exponential smoothing trend change is...

[0035] The trend change is Where α is the smoothing coefficient; moving average rate of change: First-order difference: Second-order difference: .

[0036] Among the out-of-limit features, the duration of continuous out-of-limit behavior is: Continuous satisfaction Number of sampling points × sampling interval; integral of the over-limit amplitude: Sampling interval; frequency exceeding limits: The number of events within the window that transitioned from never exceeding the limit to exceeding the limit; where θ is the preset limit threshold.

[0037] Among the phase-to-phase difference characteristics, the three-phase current imbalance is:

[0038] ,in, ;

[0039] Three-phase voltage imbalance:

[0040] ,in ;

[0041] Maximum interphase difference: ;

[0042] Where I_a, I_b, and I_c are three-phase currents, and V_a, V_b, and V_c are three-phase voltages.

[0043] Furthermore, the per-alarm-code threshold T_k is dynamically determined based on the verification set and service cost. For the k-th alarm code, the threshold that optimizes the objective function is searched from the candidate threshold set.

[0044] ;

[0045] Where Precision_k(T) represents the precision of the k-th alarm code under threshold T, Recall_k(T) represents the recall of the k-th alarm code under threshold T, FalseAlarmCost_k(T) represents the false alarm cost of the k-th alarm code under threshold T, MissCost_k(T) represents the false negative cost of the k-th alarm code under threshold T, and a, b, c, and d are non-negative weighting coefficients;

[0046] The candidate threshold set is generated by one or more of the following methods: sampling at equal intervals with a fixed step size in the [0,1] interval; sampling at quantiles based on the probability distribution of the corresponding alarm codes on the validation set; and using adaptive sampling for high-risk alarm codes.

[0047] The optimal threshold for the objective function is determined through grid search, Bayesian optimization, or multi-objective search based on the Pareto front.

[0048] Furthermore, the sorting rules include one or more of the following: Top-K restriction, probability interval restriction, data integrity restriction, and business consistency restriction;

[0049] The Top-K restriction is as follows: only the top K candidate alarm codes with the highest probability are retained, and K is dynamically determined based on the device type and the total number of alarm codes. Where N_code is the total number of alarm codes that the device can trigger, ρ is the scaling factor, and K_max is the preset maximum number of output alarm codes;

[0050] The probability interval is limited to: the difference between the first candidate probability p_(1) and the second candidate probability p_(2). When the value is less than the preset threshold, the corresponding sample will be marked as a boundary sample or a sample to be manually reviewed.

[0051] The data integrity restriction is as follows: no pseudo-labels are generated when the sample missing rate (miss_rate) is higher than a preset threshold; data quality scoring. Where q_complete is the integrity score, q_stable is the stability score, q_sync is the synchronization score, and q_sensor is the sensor quality score. Pseudo-labels are generated only when Q_data is higher than a preset threshold.

[0052] The business consistency restriction is as follows: consistency verification is performed using the mutual exclusion relationship, implication relationship and prior relationship between alarm codes. If the candidate alarm code set violates the preset prior relationship, the pseudo-label weight is reduced, the output is corrected or it is transferred to manual review.

[0053] Further, the manually labeled samples are denoted as set D_l, and the samples include feature vector X_i, alarm code multi-label vector Y_i, and alarm level L_i; the unlabeled samples are denoted as set D_u; the teacher model outputs the probability P_i,k of each alarm code for the unlabeled samples D_u;

[0054] For alarm code k, a dedicated threshold T_k is set. The alarm code is written into the pseudo-label only when P_i,k is greater than T_k and the sample satisfies the sorting rule. The high-confidence pseudo-label samples are denoted as set D_p.

[0055] The student model is jointly trained using D_l and D_p, and the training objective is split into alarm code multi-label loss L_code and alarm level loss L_level;

[0056] definition: ; ;

[0057] Then, the joint loss is expressed as: ;

[0058] Where i is the sample index, k is the alarm code index, and c is the alarm level index. For sample weights, This indicates whether the k-th alarm code of the i-th sample is valid. Let l_i be the probability of the k-th alarm code output by the student model, and l_i be the ground truth value of the alarm level. Let be the predicted probability of alarm level c, 1(·) be the indication function, λ be the alarm level loss coefficient, L_reg be the regularization term, and μ be the weight of the regularization term;

[0059] The training weight w_l of the manually labeled sample is greater than the training weight w_p of the high-confidence pseudo-label sample;

[0060] The training weights of the high-confidence pseudo-label samples are dynamically determined based on the pseudo-label confidence, data quality score, and business consistency score.

[0061] ;

[0062] in, Q_data(i) represents the basic weight of the pseudo-label, conf_i represents the confidence level of the pseudo-label, Q_data(i) represents the data quality score, and Q_rule(i) represents the business consistency score.

[0063] When a pseudo-labeled sample does not have a reliability level label, the sample only participates in the calculation of L_code and not in the calculation of L_level.

[0064] Furthermore, the student model includes a shared feature layer, an alarm code output header, and an alarm level output header;

[0065] The shared feature layer is represented as: Where Encoder is the encoder function and X_t is the input sample feature;

[0066] The alarm code output header indicates that... Where W_code is the alarm code output header weight matrix, and b_code is the alarm code output header bias vector;

[0067] The alarm level output header is represented as ; G_code]+b_level), where W_level is the alarm level output header weight matrix, b_level is the alarm level output header bias vector, G_code is the auxiliary representation obtained from the intermediate representation of the alarm code or the probability aggregation of the alarm code, and [;] represents the vector concatenation operation;

[0068] The shared feature layer consists of 2 to 4 layers of LSTM, TCN, or Transformer blocks; when using Transformer, the number of attention heads is 2 to 8, and the hidden dimension is 64 to 256.

[0069] The input to the alarm level output header depends on one or more of the output of the shared feature layer and the intermediate representation of the alarm code.

[0070] Furthermore, the inference input for the alarm level also includes one or more of the following: duration of continuous over-limit, integral of over-limit amplitude, frequency of historical anomalies, device importance, degree of phase imbalance, and alarm combination mode;

[0071] The alarm level output undergoes one or more post-processing steps, including level smoothing, minimum hold duration control, and device importance adjustment.

[0072] The level smoothing adopts a majority voting smoothing, exponential smoothing, or minimum hold time strategy.

[0073] When the manual correction results are fed back, the system performs a credibility assessment on the manually fed-back data. The credibility assessment includes one or more of the following: consistency judgment of multiple annotations, consistency judgment with the original state of the equipment and the work order results, judgment of the experience level of the annotator, and judgment of time sequence and business consistency rules.

[0074] The retraining adopts a strategy combining incremental learning and periodic full retraining: incremental updates are performed first during the high-frequency retraining phase, followed by periodic full retraining; to prevent catastrophic forgetting, old sample replay, representative historical sample retention, old model distillation, or stability regularization are used.

[0075] Before a new model goes live, it undergoes offline evaluation. Once the evaluation is passed, it enters a phased rollout. During the phased rollout, the new model gradually increases the proportion of traffic it processes according to a preset ratio. If the false alarm rate, false negative rate, or work order validity rate exceeds the preset warning line during the phased rollout, it will automatically roll back to the old model.

[0076] Furthermore, in the cold start phase where there is a lack of validation sets or labeled samples, the threshold for each alarm code is set based on expert experience or on the quantile of the probability distribution of unlabeled data. As manual annotation and work order feedback samples accumulate, it gradually transitions to dynamic threshold optimization based on validation sets and cost functions.

[0077] The sample structure of the device status time-series data includes device identity field, status time-series field, event context field, work order feedback field, and environment and business field;

[0078] The device identity field includes one or more of the following: device identifier, device type, location identifier, circuit identifier, rated current, and installation time.

[0079] The status timing field includes one or more of the following: A-phase current, B-phase current, C-phase current, A-phase voltage, B-phase voltage, C-phase voltage, power, temperature, leakage current, switch status, and communication status.

[0080] The event context field includes one or more of the following: original alarm code, alarm time, recovery time, action status, and manual confirmation flag;

[0081] The work order feedback fields include one or more of the following: work order identifier, work order type, processing result, false alarm flag, missed alarm flag, and confirmation level;

[0082] The environment and business fields include one or more of the following: building type, floor identifier, load category, equipment importance, and maintenance shift.

[0083] 2. System Module Architecture

[0084] The system of this invention includes the following modules:

[0085] (1) Equipment status acquisition module: used to access equipment operating status data, including but not limited to current, voltage, power, temperature, leakage current, switch status, communication status, protection action status and equipment self-test status.

[0086] (2) Time alignment and sample construction module: used to construct sample sequences according to device identifier, sampling time and inference time point, and to handle the alignment problem between missing values, duplicate points, abnormal sampling points and data of different frequencies.

[0087] (3) Multi-time window feature construction module: used to calculate statistical features, trend features, limit-breaking features and phase difference features in multiple preset review windows, so that the model can simultaneously obtain short-term fluctuations, medium-term trends and continuous abnormal information.

[0088] (4) Teacher model training and inference module: used to train the initial multi-label model based on manually labeled samples and output the probability of each alarm code for unlabeled samples.

[0089] (5) Code-by-code threshold and pseudo-label screening module: used to set different thresholds for different alarm codes, and to screen high-confidence pseudo-labels by combining Top-K sorting, probability interval, sample quality and rule consistency.

[0090] (6) Joint training sample generation module: used to merge artificial ground truth samples and pseudo-labeled samples, and set different training weights for samples from different sources.

[0091] (7) Student model training module: used to train the final inference model on joint training samples and output alarm code set, alarm code probability, alarm level and optional explanation information.

[0092] (8) Business linkage and result storage module: used to use the reasoning results for page display, alarm push, linkage control, work order suggestions or manual review.

[0093] (9) Manual correction and retraining module: used to receive manual confirmation, false alarm marking, omission supplementation and processing results, and convert them into subsequent training samples.

[0094] 3. Sample Data Structure

[0095] To distinguish this invention from conventional multi-label classification methods, in a preferred embodiment, device data, alarm records, and work order feedback are organized into a unified sample structure. Each sample includes the following field categories and example fields:

[0096]

[0097] During sample construction, the system uses the inference time point t as an index to map the above fields to sample X_t. For samples formed by the same device at different time points, the system retains the time sequence and the lookback window; for samples formed by different devices, the system normalizes them by device type, rating, and location attributes, enabling the model to migrate between similar devices.

[0098] 4. Construction of multi-time window features

[0099] The multi-time-window feature construction module is used to calculate statistical features, trend features, limit-crossing features, and phase difference features in multiple preset review windows.

[0100] (1) Basis for selecting time window length and window strategy

[0101] It is not arbitrarily set, but corresponds to different physical processes:

[0102] Short time windows (e.g., 5 to 30 minutes) are used to capture transient events, action transients, surges, short-term communication jitter, and current surges;

[0103] Medium time windows (e.g., 30 to 60 minutes) are used to capture the evolution of repeated limit violations, periodic fluctuations, and alarm combinations;

[0104] Long-term windows (e.g., 60 to 180 minutes) are used to capture gradual degradation such as temperature rise, insulation aging, slow rise in leakage current, and poor contact.

[0105] Time window matching with equipment type and alarm type: medium and long time windows are suitable for temperature and aging alarms, short time windows are suitable for current surge and trip alarms, and medium and long time windows are suitable for three-phase imbalance alarms.

[0106] The window strategy can be a fixed window, a sliding window, or an event-triggered window. Online inference preferably uses a combination of "sliding window + event-triggered window": the system calculates basic features by sliding the window in fixed steps, and once a candidate anomaly is detected, an event-triggered window is added with the anomaly starting point as the anchor point to calculate fine features.

[0107] (2) Statistical characteristics

[0108] For the sampling sequence of the device within the time window W Statistical characteristics include:

[0109] Mean: This reflects the baseline of equipment load;

[0110] variance: This reflects the intensity of the fluctuation;

[0111] Standard deviation: ;

[0112] Maximum value, minimum value, and peak-to-peak value: , Peak-to-peak value reflects the magnitude of the impact;

[0113] Skewness: This reflects the skewness of the abnormal distribution;

[0114] Kuroshi: This reflects the degree of peak in the abnormal distribution;

[0115] Where ε is a preset small positive number to prevent division by zero.

[0116] (3) Trend characteristics

[0117] Preferred trend features include:

[0118] (a) Linear regression slope: The least squares fit is performed on the sequence within the window with respect to the time index. The slope (W) represents the rising or falling trend of indicators such as current, temperature, and leakage current.

[0119] (b) Exponentially smoothed trend: and with This indicates a smoothed trend change, where α is the smoothing coefficient;

[0120] (c) Moving average rate of change: ;

[0121] (d) First-order difference and second-order difference: .

[0122] (4) Limit Exceeding Characteristics

[0123] The preferred features for exceeding the limit include:

[0124] Duration of continuous overruns: Number of sampling points × sampling interval;

[0125] Integral for exceeding the limit: Sampling interval;

[0126] Frequency of exceeding the limit: The number of events that never exceeded the limit and then became exceeded;

[0127] Where θ is the preset threshold for exceeding limits.

[0128] (5) Characteristics of phase differences

[0129] For three-phase equipment, the preferred phase-to-phase difference characteristics include:

[0130] Three-phase current imbalance:

[0131] ,in ;

[0132] Three-phase voltage imbalance:

[0133] ,in ;

[0134] Maximum interphase difference: Alternatively, voltage can be used instead of current.

[0135] The above features are particularly suitable for alarms related to overload, imbalance, poor contact, temperature rise, and leakage.

[0136] 5. Teacher-Student Joint Training Mechanism

[0137] The teacher model is trained using manually labeled samples. The manually labeled samples are denoted as set D_l, and each sample includes a feature vector X_i, an alarm code multi-label vector Y_i, and an alarm level L_i. The teacher model outputs the probability P_i,k of each alarm code for the unlabeled samples D_u.

[0138] For alarm code k, the system sets a dedicated threshold T_k. The code is written to the pseudo-label only if P_i,k is greater than T_k, and the sample satisfies the conditions of Top-K, probability interval, data integrity, and business consistency. The pseudo-label sample is denoted as D_p.

[0139] The student model is jointly trained using D_l and D_p. The training objective is split into alarm code multi-label loss and alarm level loss.

[0140] For sample i and alarm code k, let y_i,k represent whether the k-th alarm code is true (1 indicates true, 0 indicates false), and p_i,k represent the probability of the k-th alarm code output by the student model. Let l_i represent the true value of the alarm level, q_i,c represent the predicted probability of alarm level c, and l(·) be the indicator function.

[0141] The multi-label loss L_code for alarm codes is a weighted sum of the binary cross-entropy losses calculated for each alarm code:

[0142] ;

[0143] The alarm level loss L_level is a weighted sum of the multi-class cross-entropy losses:

[0144] ;

[0145] The joint loss L_total is the weighted sum of the alarm code multi-tag loss and the alarm level loss, plus an optional regularization term:

[0146] ;

[0147] Where wᵢ is the sample weight, the weight of the artificial ground truth sample w_l is greater than the weight of the pseudo-label sample w_p; λ is the alarm level loss coefficient; L_reg is an optional regularization term used to constrain model complexity or probability calibration; μ is the regularization term weight.

[0148] The initial value of λ can be from 0.3 to 1.0, and the initial value of μ can be... If a course-based learning strategy is adopted, λ can be reduced in the early stages of training to allow the model to first learn alarm code recognition stably, and then the task weight of alarm level can be gradually increased.

[0149] L_reg can employ L1 regularization, L2 regularization, probabilistic calibration regularization, or consistency regularization. Probabilistic calibration regularization preferably uses MMCE regularization or temperature scaling calibration loss; consistency regularization is used to constrain the output stability of the same device at adjacent time points.

[0150] If a pseudo-label sample only has an alarm code pseudo-label but no reliability level label, then the sample will only participate in the calculation of L_code, or participate in the calculation of L_level with a lower weight.

[0151] The reliability level pseudo-label can be inferred from the combination of high confidence alarm codes, the extent of exceeding the limit, the duration, and manual rules.

[0152] In addition to satisfying In addition, the sample weights can be further refined:

[0153] (1) Internal differentiation of artificial truth values: The weight of samples with senior experts, those that have been reviewed and confirmed in multiple rounds or have been closed-loop is greater than that of ordinary samples;

[0154] (2) Internal differentiation of pseudo-labels: pseudo-labels with high confidence, high data quality, and strong business consistency have a greater weight than boundary pseudo-labels;

[0155] (3) The dynamic pseudo-label weight can be expressed as:

[0156] .

[0157] 6. Code-by-code threshold determination and dynamic calibration

[0158] (1) Logic for determining and updating the code-by-code threshold

[0159] The per-code threshold T_k is not a fixed empirical value, but is dynamically determined based on the validation set and business costs. For the k-th alarm code, the threshold that optimizes the objective function is searched from the candidate threshold set:

[0160] ;

[0161] Where Precision_k(T) represents the precision of the k-th alarm code under threshold T, Recall_k(T) represents the recall of the k-th alarm code under threshold T, FalseAlarmCost_k(T) represents the false alarm cost of the k-th alarm code under threshold T, MissCost_k(T) represents the false negative cost of the k-th alarm code under threshold T, and a, b, c, and d are non-negative weighting coefficients.

[0162] High-risk alarm codes can be upgraded to b or d to reduce missed alarms; high-frequency false alarm codes can be upgraded to a or c to reduce invalid dispatches.

[0163] The candidate threshold set can be generated in the following way:

[0164] (1) Sample at equal intervals with a fixed step size within the interval [0,1];

[0165] (2) Sampling is performed based on the probability distribution of the corresponding alarm codes on the validation set at quantiles;

[0166] (3) More intensive adaptive sampling is used for high-risk alarm codes.

[0167] The optimal threshold can be searched using grid search, Bayesian optimization, or a multi-objective search based on the Pareto front. Preferably, grid search is used first in engineering implementation, and then more efficient multi-objective optimization is used as the scale of the backflow sample increases.

[0168] When precision and recall cannot be optimized simultaneously, the final threshold can be determined based on business priorities: high-risk alarms should be recalled first, and low-risk alarms should be prioritized for precision. Threshold updates can be triggered in batches during a unified retraining cycle, or individually when the false positive or false negative rate of a certain alarm code exceeds a preset warning line.

[0169] (2) Threshold setting for cold start phase

[0170] In the cold start phase, where there is a lack of validation sets or very few labeled samples, initial thresholds can be set for different alarm codes based on expert experience, or based on the quantiles (e.g., the 90th percentile) of the probability distribution of unlabeled data. As manual annotation and work order feedback samples accumulate, the system can gradually transition to dynamic threshold optimization based on validation sets and cost functions.

[0171] 7. Sorting rules for pseudo-tag filtering

[0172] For a single sample of alarm code candidate set, it is preferable to satisfy the following constraints simultaneously:

[0173] (1) Top-K restriction: Only the top K candidate alarm codes with the highest probability are retained. K is dynamically determined based on the device type and the total number of alarm codes.

[0174] ;

[0175] Where N_code is the total number of alarm codes that the device can trigger, ρ is the scaling factor (e.g., 0.3), and K_max is the preset maximum number of output alarm codes.

[0176] (2) Probability interval restriction: If the probability of the first candidate is The probability of the second candidate is ,but If the sample is less than a preset threshold, it can be marked as a boundary sample or a sample to be manually reviewed.

[0177] (3) Data integrity conditions: These can be controlled by the missing rate and quality score. No pseudo-labels are generated when the miss_rate exceeds a threshold. The data quality score can be defined as:

[0178] ;

[0179] Among them, q_complete is the integrity score, q_stable is the stability score, q_sync is the synchronization score, and q_sensor is the sensor quality score; samples participate in high-confidence pseudo-labels or online high-confidence output only when Q_data is higher than the threshold.

[0180] (4) Business consistency conditions: Consistency verification is performed using mutual exclusion, implication and prior relationships. For example, the same device should not trigger certain mutually exclusive alarm codes at the same time; certain high-level alarms must be accompanied by underlying anomalies; if the candidate set violates prior relationships, the weight of the pseudo-label is reduced, the output is corrected or it is transferred to manual review.

[0181] 8. Model Structure and Joint Output

[0182] This invention does not limit the specific model, but two basic models are recommended in the preferred embodiments:

[0183] (1) Tree model route: LightGBM, XGBoost or random forest, suitable for structured time series statistical features, applicable to cold start and small sample stages;

[0184] (2) Temporal neural network route: LSTM, TCN or Transformer, suitable for directly modeling time dependence and multivariate interaction.

[0185] In a preferred embodiment of the neural network, a shared feature layer + dual output head structure can be used:

[0186]

[0187]

[0188]

[0189] Wherein, Encoder is the encoder function (such as LSTM, TCN, or Transformer encoder), X_t is the input sample feature, W_code is the alarm code output header weight matrix, b_code is the alarm code output header bias vector, W_level is the alarm level output header weight matrix, b_level is the alarm level output header bias vector, G_code is the auxiliary representation obtained from the intermediate representation of the alarm code or the probability aggregation of the alarm code, and [;] indicates the vector concatenation operation.

[0190] The shared feature layer can consist of 2 to 4 layers of LSTM, TCN, or Transformer blocks; if a Transformer is used, the number of attention heads can be 2 to 8, and the hidden dimension can be 64 to 256. The alarm code output head and the alarm level output head preferably use different fully connected layers to avoid the two tasks completely sharing the parameters of the last layer.

[0191] The inference inputs for alarm levels also include one or more of the following: duration of continuous over-limit, integral of over-limit magnitude, frequency of historical anomalies, device importance, degree of phase imbalance, and alarm combination mode.

[0192] Alarm levels are preferably categorized into four levels: Emergency, High, Medium, and Low, or Level 1, Level 2, and Level 3. Their operational meanings can correspond to immediate handling, priority handling, planned handling, and observation and recording, respectively.

[0193] Constraints can be set between alarm levels and alarm codes. For example, some high-risk alarm codes correspond to a high level when they appear alone; some low-risk alarm codes only increase the level when they appear in combination; and some alarm code combinations will inevitably lead to a high-level output.

[0194] To avoid frequent changes in grade within a short period, grade smoothing can be performed after output, for example, by using majority voting, exponential smoothing, or minimum hold time strategies. For highly important equipment, the grade can be readjusted after smoothing based on the equipment's importance.

[0195] 9. Retraining and Canary Deployment

[0196] The system uses the results of manual processing as highly reliable samples for feedback and controls the risk of model replacement through offline evaluation and canary release.

[0197] Manually corrected data is not unconditionally reliable. The system assesses the reliability of human feedback, including:

[0198] (1) Whether the multiple annotations are consistent;

[0199] (2) Whether it contradicts the original state of the equipment and the result of the work order;

[0200] (3) Whether it comes from highly experienced annotation personnel;

[0201] (4) Whether the time sequence and business consistency rules are met.

[0202] The optimal continuous learning strategy is a combination of incremental learning and periodic full retraining: incremental updates are performed during high-frequency reflow phases, followed by periodic full retraining. To prevent catastrophic forgetting, methods such as old sample replay, retention of representative historical samples, old model distillation, or stability regularization can be used.

[0203] Offline evaluation criteria may include: the precision, recall, F1-score, and false alarm rate of key alarm codes must reach a preset threshold before they can be entered into grayscale testing.

[0204] During a canary rollout, the new model can initially handle 5% of the traffic, then gradually expand to 20%, 50%, and the full volume. If the false positive rate, false negative rate, or ticket validity rate significantly deteriorates during the canary rollout, it will automatically roll back to the old model.

[0205] 10. Key Technical Parameters

[0206] The key technical parameters involved in this invention are as follows:

[0207]

[0208] Compared with the prior art, the present invention has the following advantages:

[0209] 1. Shift from fixed rules to multi-label probabilistic inference. The system outputs a probability for each alarm code and controls the output results through code-by-code thresholds and Top-K control. This is more suitable for multiple devices and multiple scenarios than single thresholds or fixed rules, effectively reducing rule maintenance costs.

[0210] 2. Improve model performance in scenarios with few labels. Use a teacher model to filter high-confidence pseudo-labels and assign different weights to human-generated ground truth and pseudo-labels. This approach can reduce the cost of manual annotation while controlling noise propagation, and make full use of the much larger amount of unlabeled runtime data in the actual system compared to manually annotated data.

[0211] 3. Unified modeling of alarm codes and alarm levels. The system not only outputs the set of alarm codes, but also outputs the alarm level simultaneously, reducing inconsistencies in subsequent rule mapping. This allows the alarm level to fully utilize model probability, time window features, and historical handling feedback, enabling differentiated level output for the same alarm code in different contexts.

[0212] 4. Reduce false alarms and missed alarms. The multi-time window feature can integrate short-term sudden changes, continuous limit violations and long-term trends. The code-by-code threshold can be calibrated differently for different alarm codes, enabling the system to maintain recall capability for high-risk alarms, while raising the output threshold for alarms that are prone to false alarms.

[0213] 5. Possesses sustainable optimization capabilities. The results of manual correction and handling are fed back into the training, enabling the model to continuously iterate as equipment ages, the on-site environment changes, and business strategies are adjusted, thus solving the problem of the lack of a continuous feedback mechanism in existing technologies.

[0214] 6. Facilitates project deployment. The model output can be directly stored in the database and used in display, push, linkage, and review processes, without relying on manual interpretation of each rule, thus reducing the difficulty of project deployment. Attached Figure Description

[0215] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0216] Figure 1 This is a block diagram of the module structure of the system of the present invention.

[0217] Figure 2 This is a flowchart of the overall training and inference closed loop of this invention. The system first trains the teacher model based on manually labeled samples, and then uses the teacher model to perform code-by-code probabilistic inference on unlabeled samples. Pseudo-labels are not directly adopted in their entirety, but are selected through code-by-code thresholding, Top-K filtering, and sample quality screening before being used in student model training. After the student model goes online, the output results continue to flow back, forming a long-term optimization closed loop.

[0218] Figure 3 This is a flowchart illustrating the multi-time-window feature construction process of this invention. Different anomaly features are expressed through short, medium, and long time windows. Short windows are used to capture sudden changes, medium windows to capture fluctuations and trends, and long windows to capture persistent exceedances and chronic anomalies. Combining multiple windows can reduce false alarms caused by single-point noise.

[0219] Figure 4This is a flowchart of the code-by-code threshold and pseudo-label screening process of this invention. Different alarm codes have different sample numbers, triggering conditions, and business impacts; therefore, this invention sets an independent threshold for each alarm code. By using Top-K and probability interval constraints, the model can avoid outputting too many alarm codes on uncertain samples.

[0220] Figure 5 This is a flowchart illustrating the joint output process of alarm codes and alarm levels in this invention. The alarm level is not a simple manual rule mapping, but rather based on reasoning derived from the alarm code set, alarm code probability, persistent violation characteristics, and business severity. This allows the same alarm code to be presented with different levels in different contexts.

[0221] Figure 6 This is a flowchart of the retraining and canary deployment process of this invention. The system uses the results of manual processing as high-reliability samples for retraining and controls the risk of model replacement through offline evaluation and canary deployment. This process enables the model to be continuously optimized as devices and scenarios change. Detailed Implementation

[0222] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the above-mentioned objectives, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be further described below in conjunction with the accompanying drawings.

[0223] It should be noted that the descriptions of these embodiments are for the purpose of aiding understanding the present invention, but do not constitute a limitation thereof. Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0224] Example 1 (corresponding to claims 1-8)

[0225] refer to Figures 1 to 6 This embodiment provides a method for joint reasoning of multiple alarm codes and alarm levels based on device status time-series data, including:

[0226] Collect the status time-series data, device identity field, event context field, and work order feedback field of the monitored device;

[0227] Construct sample sequences by aligning them with device identifiers and time.

[0228] The equipment status characteristics of the sample sequence are constructed based on multiple review time windows. The equipment status characteristics include statistical characteristics, trend characteristics, limit-breaking characteristics, and inter-phase difference characteristics.

[0229] The teacher model is trained using manually labeled samples, and the teacher model outputs the probability of each alarm code for unlabeled samples.

[0230] High-confidence pseudo-labels are selected from unlabeled samples based on alarm code thresholds and sorting rules. The alarm code threshold is an independent threshold set for different alarm codes.

[0231] The student model was jointly trained using manually labeled samples and high-confidence pseudo-labeled samples with different weights.

[0232] The student model outputs a set of alarm codes and their corresponding alarm levels.

[0233] The results of manual corrections and work order processing are fed back to update training samples, pseudo-label screening conditions, and alarm code thresholds.

[0234] The multiple review time windows include short time windows, medium time windows, and long time windows; statistical features include one or more of the following: mean, variance, standard deviation, maximum value, minimum value, peak-to-peak value, skewness, and kurtosis within the window; trend features include one or more of the following: linear regression slope, exponential smoothing trend change, moving average change rate, first-order difference, and second-order difference; limit violation features include one or more of the following: duration of limit violation, integral of limit violation amplitude, and frequency of limit violation; phase-to-phase difference features include one or more of the following: three-phase current imbalance, three-phase voltage imbalance, and maximum phase-to-phase difference.

[0235] Preferably,

[0236] For the sampling sequence of the device within the time window W Among the statistical characteristics:

[0237] Mean: ;variance: Standard deviation: Maximum value: Minimum value: ;

[0238] Peak-to-peak value: ;

[0239] Skewness: ;

[0240] Kuroshi: ;

[0241] Where ε is a preset small positive number;

[0242] In the trend characteristics:

[0243] Linear regression slope (W): The slope obtained by least-squares fitting of the sequence within the window with respect to the time index; Exponential smoothing trend change: The trend change is , where α is the smoothing coefficient;

[0244] Moving average rate of change: ;

[0245] First-order difference: Second-order difference: ;

[0246] Among the features that exceed the limit:

[0247] Duration of continuous overruns: Continuous satisfaction Number of sampling points × sampling interval; integral of the over-limit amplitude: Sampling interval; frequency exceeding limits: The number of events within the window that transitioned from never exceeding the limit to exceeding the limit; where θ is the preset limit exceeding threshold.

[0248] Among the phase differences:

[0249] Three-phase current imbalance:

[0250] ,in, ;

[0251] Three-phase voltage imbalance:

[0252] ,in, ;

[0253] Maximum interphase difference: ;

[0254] Where I_a, I_b, and I_c are three-phase currents, and V_a, V_b, and V_c are three-phase voltages.

[0255] Preferably, the threshold T_k for each alarm code is dynamically determined based on the verification set and service cost. For the k-th alarm code, the threshold that optimizes the objective function is searched from the candidate threshold set.

[0256] ;

[0257] Where Precision_k(T) represents the precision of the k-th alarm code under threshold T, Recall_k(T) represents the recall of the k-th alarm code under threshold T, FalseAlarmCost_k(T) represents the false alarm cost of the k-th alarm code under threshold T, MissCost_k(T) represents the false negative cost of the k-th alarm code under threshold T, and a, b, c, and d are non-negative weighting coefficients;

[0258] The candidate threshold set is generated by one or more of the following methods: sampling at equal intervals with a fixed step size in the [0,1] interval; sampling at quantiles based on the probability distribution of the corresponding alarm codes on the validation set; and using adaptive sampling for high-risk alarm codes.

[0259] The threshold for the optimal objective function is determined by grid search, Bayesian optimization, or multi-objective search based on the Pareto front.

[0260] Preferably, the sorting rules include one or more of the following: Top-K restriction, probability interval restriction, data integrity restriction, and business consistency restriction;

[0261] The Top-K constraint is to retain only the top K candidate alarm codes with the highest probability, where K is dynamically determined based on the device type and the total number of alarm codes. Where N_code is the total number of alarm codes that the device can trigger, ρ is the scaling factor, and K_max is the preset maximum number of output alarm codes;

[0262] The probability interval is limited as follows: when the difference between the first candidate probability p_(1) and the second candidate probability p_(2) Δ_k=p_(1)-p_(2) is less than the preset threshold, the corresponding sample is marked as a boundary sample or a sample to be manually reviewed.

[0263] Data integrity is limited to: no pseudo-labels are generated when the sample missing rate (miss_rate) exceeds a preset threshold; data quality scoring. Where q_complete is the integrity score, q_stable is the stability score, q_sync is the synchronization score, and q_sensor is the sensor quality score. Pseudo-labels are generated only when Q_data is higher than a preset threshold.

[0264] Business consistency is restricted by using the mutual exclusion, implication and prior relationships between alarm codes for consistency verification. If the candidate alarm code set violates the preset prior relationship, the weight of the pseudo-label is reduced, the output is corrected or it is transferred to manual review.

[0265] Preferably, the manually labeled samples are denoted as set D_l, and the samples include feature vector X_i, alarm code multi-label vector Y_i, and alarm level L_i; the unlabeled samples are denoted as set D_u; the teacher model outputs the probability P_i,k of each alarm code for the unlabeled samples D_u;

[0266] For alarm code k, a dedicated threshold T_k is set. The alarm code is written into the pseudo-label only when P_i,k is greater than T_k and the sample satisfies the sorting rule. The high-confidence pseudo-label samples are denoted as set D_p.

[0267] The student model is jointly trained using D_l and D_p, and the training objective is split into alarm code multi-label loss L_code and alarm level loss L_level;

[0268] definition: ; ;

[0269] Then, the joint loss is expressed as: ;

[0270] Where i is the sample index, k is the alarm code index, and c is the alarm level index. Let y_i,k represent the sample weights, y_i,k represent whether the k-th alarm code of the i-th sample is valid, p_i,k represent the probability of the k-th alarm code output by the student model, l_i represent the true value of the alarm level, q_i,c represent the predicted probability of alarm level c, 1(·) represent the indicator function, λ represent the alarm level loss coefficient, L_reg represent the regularization term, and μ represent the weight of the regularization term.

[0271] The training weight w_l of the manually labeled sample is greater than the training weight w_p of the high-confidence pseudo-label sample;

[0272] The training weights of the high-confidence pseudo-label samples are dynamically determined based on the pseudo-label confidence, data quality score, and business consistency score.

[0273] ;

[0274] Where w_p_base is the base weight of the pseudo-label, conf_i is the confidence level of the pseudo-label, and Q_data(i) is the data quality score. Score for business consistency;

[0275] When a pseudo-labeled sample does not have a reliability level label, the sample only participates in the calculation of L_code and not in the calculation of L_level.

[0276] Preferably, the student model includes a shared feature layer, an alarm code output header, and an alarm level output header;

[0277] Shared feature layer is represented as Where Encoder is the encoder function and X_t is the input sample feature;

[0278] The alarm code output header indicates that Where W_code is the alarm code output header weight matrix, and b_code is the alarm code output header bias vector;

[0279] The alarm level output header indicates as follows [; G_code] + b_level), where W_level is the alarm level output header weight matrix, b_level is the alarm level output header bias vector, G_code is the auxiliary representation obtained from the intermediate representation of the alarm code or the probability aggregation of the alarm code, and [;] represents the vector concatenation operation;

[0280] The shared feature layer consists of 2 to 4 layers of LSTM, TCN, or Transformer blocks; when using Transformer, the number of attention heads is 2 to 8, and the hidden dimension is 64 to 256.

[0281] The input to the alarm level output header depends on one or more of the output of the shared feature layer and the intermediate representation of the alarm code.

[0282] Preferably, the inference input for the alarm level also includes one or more of the following: duration of continuous over-limit, integral of over-limit magnitude, frequency of historical anomalies, device importance, degree of phase imbalance, and alarm combination mode;

[0283] After the alarm level is output, it undergoes one or more post-processing steps, including level smoothing, minimum hold duration control, and equipment importance adjustment.

[0284] The smoothing of levels employs majority voting smoothing, exponential smoothing, or minimum hold time strategy.

[0285] When the results of manual corrections are fed back, the system performs a credibility assessment on the manually fed-back data. The credibility assessment includes one or more of the following: consistency judgment of multiple annotations, consistency judgment with the original state of the equipment and the work order results, judgment of the experience level of the annotator, and judgment of time sequence and business consistency rules.

[0286] The retraining strategy combines incremental learning with periodic full retraining: incremental updates are performed first during high-frequency retraining phases, followed by periodic full retraining; to prevent catastrophic forgetting, old sample replay, retention of representative historical samples, old model distillation, or stability regularization are employed.

[0287] Before a new model goes live, it undergoes offline evaluation. Once the evaluation is passed, it enters a phased rollout. During the phased rollout, the new model gradually increases the proportion of traffic it processes according to a preset ratio. If the false alarm rate, false negative rate, or work order validity rate exceeds the preset warning line during the phased rollout, it will automatically roll back to the old model.

[0288] Preferably, in the cold start phase where there is a lack of validation sets or labeled samples, the threshold for each alarm code is set based on expert experience or on the quantile of the probability distribution of unlabeled data. As manual annotation and work order feedback samples accumulate, it gradually transitions to dynamic threshold optimization based on validation sets and cost functions.

[0289] The sample structure of device status time-series data includes device identity field, status time-series field, event context field, work order feedback field, and environment and business field;

[0290] The equipment identification field includes one or more of the following: equipment identifier, equipment type, location identifier, circuit identifier, rated current, and installation time.

[0291] The status timing fields include one or more of the following: A-phase current, B-phase current, C-phase current, A-phase voltage, B-phase voltage, C-phase voltage, power, temperature, leakage current, switch status, and communication status.

[0292] The event context fields include one or more of the following: original alarm code, alarm time, recovery time, action status, and manual confirmation flag;

[0293] The work order feedback fields include one or more of the following: work order identifier, work order type, handling result, false alarm flag, missed alarm flag, and confirmation level;

[0294] The environment and business fields include one or more of the following: building type, floor identifier, load category, equipment importance, and maintenance shift.

[0295] Example 2 (corresponding to claim 9)

[0296] refer to Figure 1 This embodiment provides a joint reasoning system for multiple alarm codes and alarm levels based on device status time-series data, including:

[0297] The device status acquisition module is used to collect the status time-series data of the monitored device;

[0298] The temporal alignment and sample construction module is used to construct sample sequences based on device identifiers and time alignment.

[0299] A multi-time-window feature construction module is used to construct device status features of the sample sequence based on multiple review time windows;

[0300] The teacher model training and inference module is used to train the teacher model based on manually labeled samples, and the teacher model outputs the probability of each alarm code for unlabeled samples.

[0301] The pseudo-label filtering module is used to filter high-confidence pseudo-labels from the unlabeled samples based on alarm code thresholds and sorting rules;

[0302] The student model training module is used to jointly train the student model by combining the manually labeled samples and the high-confidence pseudo-label samples with different weights.

[0303] The alarm code and level joint output module is used to output the alarm code set and the corresponding alarm level from the student model;

[0304] The retraining module is used to recycle the manual correction results and work order processing results to update the training samples, pseudo-label screening conditions and the alarm code threshold.

[0305] Each module is used to execute the method as described in Example 1.

[0306] In addition, this embodiment of the invention also provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and the computer program, when executed by the processor, implements the method of embodiment 1.

[0307] This invention provides another computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method of embodiment 1.

[0308] Example 3: Intelligent Transformation of Building Terminal Electricity System

[0309] In this embodiment, the system is deployed in a building-level intelligent electrical system upgrade scenario. One-to-one replacement terminal devices such as smart circuit breakers, smart sockets, smart switches, and temperature control terminals upload status data to the platform via an in-building self-organizing network communication base.

[0310] The system reads the device's status data up to the current time point t every preset period and constructs time window features for 30 minutes, 60 minutes, and 120 minutes respectively. The features include average current, voltage extreme values, temperature slope, power fluctuation, duration of leakage current exceeding the limit, three-phase difference, number of communication interruptions, and historical alarm frequency.

[0311] Manual labelers labeled a subset of samples with alarm codes and alarm levels. The system used these samples to train a teacher model, which output the probability of multiple alarm codes for unlabeled samples. For each alarm code, the system used an independent threshold for judgment and retained only pseudo-labeled samples with high probability, high ranking, and acceptable data quality.

[0312] The system combines manually generated ground truth samples and pseudo-labeled samples to train the student model. After going live, the student model outputs a set of alarm codes and alarm levels for new samples, and provides the results to the digital twin dashboard, the smart electricity platform, and the AI ​​agent. After maintenance personnel confirm false alarms, missed alarms, or incorrect alarm levels, the system writes the feedback into the manually generated ground truth sample pool for the next round of retraining.

[0313] In a preferred embodiment, the tree model route can preferentially use LightGBM or XGBoost as the teacher and student models; when it is necessary to directly utilize the original sequence, LSTM, TCN, or Transformer can be used as the shared feature encoder. For samples from the same device, the system preferably uses a sliding window to calculate the basic features, and supplements transient and recovery features with an event-triggered window when a suspected anomaly occurs.

[0314] Example 4: Joint Training Process of Student Models

[0315] This embodiment details the joint training process of the student model.

[0316] The system acquires a set of manually labeled samples D_l and a set of pseudo-labeled samples D_p. For samples in D_l, a weight w_l = 2.0 is set; for samples in D_p, a base weight w_p_base = 0.5 is set, and further adjustments are made dynamically based on pseudo-label confidence, data quality score, and business consistency score.

[0317] ;

[0318] The system constructs a student model, including a shared feature layer, an alarm code output header, and an alarm level output header. The shared feature layer uses a 2-layer LSTM with a hidden dimension of 128. The alarm code output header uses a fully connected layer with a sigmoid activation function, and the output dimension is N (total number of alarm codes). The alarm level output header uses a fully connected layer with a softmax activation function, and the output dimension is C (total number of alarm levels).

[0319] For each training batch, the system calculates:

[0320] ;

[0321] ;

[0322] ;

[0323] in, Use L2 regularization.

[0324] For samples that only have alarm code pseudo-labels but not reliability level labels, the samples only participate in the calculation of L_code and not in the calculation of L_level.

[0325] The system is trained using the Adam optimizer with a learning rate of 1e⁻³, a batch size of 256, and 100 training epochs. Early stopping is performed on the validation set.

[0326] Example 5: Retraining and Gray-Scale Deployment Process

[0327] This example details the retraining and canary deployment process.

[0328] After the student model goes live, the system continuously collects the model's alarm output results. Maintenance personnel confirm the alarm results, mark them as false alarms, missed alarms, or incorrect levels, and fill in the work order handling results.

[0329] The system triggers the retraining process periodically (e.g., weekly):

[0330] (1) Data preparation: Extract the newly added manual confirmation samples and work order feedback samples from the database, convert them into training sample format, and add them to the manually labeled sample set D_l.

[0331] (2) Threshold update: Based on the updated validation set (including newly added manually confirmed samples), re-execute the code-by-code threshold search and update the threshold T_k of each alarm code.

[0332] (3) Pseudo-label regeneration: Use the current teacher model (or the previous version of the student model) to re-select pseudo-labels for the unlabeled samples and generate an updated pseudo-label sample set D_p.

[0333] (4) Model retraining: Use the updated D_l and D_p to jointly train a new student model.

[0334] (5) Offline evaluation: Evaluate the precision, recall, F1-score and false positive rate of the new model on the validation set. If the evaluation metrics of the key alarm codes all reach the preset threshold (e.g., the F1-score is not lower than 95% of the old model), then proceed to gray release.

[0335] (6) Gray-scale release: The new model first processes 5% of online traffic and observes for 24 hours. If the false alarm rate and false negative rate are both within the normal range, the traffic ratio is increased to 20% and observed for another 24 hours. This is then increased to 50% and 100% in turn. If the false alarm rate, false negative rate, or work order effectiveness rate exceeds the preset warning line at any stage during the gray-scale release, the system will automatically roll back to the old model.

[0336] The above embodiments can utilize a large amount of historical operational data under limited manual annotation conditions, reducing the workload of rule maintenance. Because alarm codes use a per-code threshold, the system can maintain recall capability for high-risk alarms while raising the output threshold for alarms prone to false alarms. Since alarm levels and alarm codes are output jointly, the system can reduce the complexity of post-processing rules and improve the consistency of alarm linkage.

[0337] Compared to traditional alarm systems that only use fixed thresholds and rule branches, the core improvement of this invention lies in the complete closed loop of "multi-time window features + code-by-code threshold search + high-confidence pseudo-labels + differentiated sample weights + joint output of alarm levels + retraining". Even though semi-supervised learning, multi-task learning, and dynamic threshold adjustment are known technologies, this invention still forms an engineering implementation path different from ordinary model splicing schemes by constraining them to the device alarm inference scenario and deeply coupling them with work order closed loop, business consistency, and level post-processing.

[0338] In offline playback, historical sample verification, or simulation verification scenarios, this invention is expected to reduce false alarms and false negatives compared to fixed-rule alarm systems, and improve the recall capability of high-risk alarms and the consistency of alarm level output. Before formal submission, project samples can be used to further quantify and supplement the precision, recall, F1-score, false alarm rate, and work order effectiveness of key alarm codes.

[0339] The teacher and student models can employ LightGBM, XGBoost, Random Forest, Neural Network, Temporal Transformer, Temporal Convolutional Network, or other machine learning models.

[0340] Feature construction can be done using a fixed window, a sliding window, or an event-triggered window.

[0341] Alarm levels can be output using classification, score mapping, or multi-task learning.

[0342] The above substitutions do not affect the core protection scope of this invention.

[0343] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0344] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions, and variations made to these embodiments without departing from the principles and spirit of the present invention still fall within the protection scope of the present invention.

Claims

1. A method for joint reasoning of multiple alarm codes and alarm levels based on device status time-series data, characterized in that, Includes: Collect the status time-series data, device identity field, event context field, and work order feedback field of the monitored device; Construct sample sequences by aligning them with device identifiers and time. The device status features of the sample sequence are constructed based on multiple review time windows. The device status features include statistical features, trend features, limit-breaking features, and inter-phase difference features. A teacher model is trained using manually labeled samples, and the teacher model outputs the probability of each alarm code for unlabeled samples. High-confidence pseudo-labels are selected from the unlabeled samples based on alarm code thresholds and sorting rules. The alarm code thresholds are independent thresholds set for different alarm codes. The manually labeled samples and the high-confidence pseudo-labeled samples are jointly trained with different weights to train the student model; The student model outputs a set of alarm codes and corresponding alarm levels. The manual correction results and work order processing results are fed back to update the training samples, pseudo-label screening conditions, and the alarm code threshold. The multiple review time windows include short time windows, medium time windows, and long time windows; The statistical characteristics include one or more of the following: mean, variance, standard deviation, maximum value, minimum value, kurtosis, skewness, and kurtosis within the window; The trend features include one or more of the following: linear regression slope, exponential smoothing trend change, moving average change rate, first difference, and second difference. The over-limit characteristics include one or more of the following: duration of continuous over-limit, integral of over-limit amplitude, and frequency of over-limit; The phase-to-phase difference characteristics include one or more of the following: three-phase current imbalance, three-phase voltage imbalance, and maximum phase-to-phase difference.

2. The method according to claim 1, characterized in that, For the sampling sequence of the device within the time window W Among the statistical characteristics: Mean: ᵢ; variance: ; Standard deviation: ; Maximum value: ; Minimum value: ; Peak-to-peak value: ; Skewness: ; Kuroshi: ; Where ε is a preset small positive number; Among the trend characteristics: The linear regression slope (W) is the slope obtained by performing a least-squares fit on the sequence within the window with respect to the time index. Exponentially smoothed trend change: ; The change in trend is , where α is the smoothing coefficient; Moving average rate of change: ; First-order difference: ; Second-order difference: ; In the aforementioned out-of-limit feature: Duration of continuous overruns: Number of sampling points × sampling interval; Integral for exceeding the limit: Sampling interval; Frequency of exceeding the limit: The number of events within the window that went from never exceeding the limit to exceeding the limit; Where θ is the preset threshold for exceeding the limit; Among the phase-to-phase difference features: Three-phase current imbalance: ,in, ; Three-phase voltage imbalance: , among which, ; Maximum interphase difference: ; in, It is a three-phase current. It is a three-phase voltage.

3. The method according to claim 2, characterized in that, The per-alarm-code threshold T_k is dynamically determined based on the verification set and service cost. For the k-th alarm code, a threshold that optimizes the objective function is searched from the candidate threshold set. ； Where Precision_k(T) represents the precision of the k-th alarm code under threshold T, Recall_k(T) represents the recall of the k-th alarm code under threshold T, FalseAlarmCost_k(T) represents the false alarm cost of the k-th alarm code under threshold T, MissCost_k(T) represents the false negative cost of the k-th alarm code under threshold T, and a, b, c, and d are non-negative weighting coefficients; The candidate threshold set is generated by one or more of the following methods: sampling at equal intervals with a fixed step size in the [0,1] interval; sampling at quantiles based on the probability distribution of the corresponding alarm codes on the validation set; and using adaptive sampling for high-risk alarm codes. The optimal threshold for the objective function is determined through grid search, Bayesian optimization, or multi-objective search based on the Pareto front.

4. The method according to claim 3, characterized in that, The sorting rules include one or more of the following: Top-K restriction, probability interval restriction, data integrity restriction, and business consistency restriction; The Top-K restriction is as follows: only the top K candidate alarm codes with the highest probability are retained, and K is dynamically determined based on the device type and the total number of alarm codes. ,in, ρ represents the total number of alarm codes that the device can trigger, and ρ is the proportionality coefficient. Set the maximum number of output alarm codes; The probability interval is limited as follows: when the difference Δk = p_(1) - p_(2) between the first candidate probability p_(1) and the second candidate probability p_(2) is less than a preset threshold, the corresponding sample is marked as a boundary sample or a sample to be manually reviewed. The data integrity restriction is as follows: no pseudo-labels are generated when the sample missing rate (miss_rate) is higher than a preset threshold; data quality scoring. ,in, For integrity scoring, For stability scoring, For synchronicity scoring, To score sensor quality, only when False labels are generated when the value exceeds a preset threshold. The business consistency restriction is as follows: consistency verification is performed using the mutual exclusion relationship, implication relationship and prior relationship between alarm codes. If the candidate alarm code set violates the preset prior relationship, the pseudo-label weight is reduced, the output is corrected or it is transferred to manual review.

5. The method according to claim 4, characterized in that, The manually labeled samples are denoted as set D_l, and the samples include feature vector X_i, alarm code multi-label vector Y_i, and alarm level L_i; the unlabeled samples are denoted as set D_u; the teacher model outputs the probability of each alarm code for the unlabeled samples D_u. ; For alarm code k, a dedicated threshold T_k is set. The alarm code is written into the pseudo-label only when P_i,k is greater than T_k and the sample satisfies the sorting rule. The high-confidence pseudo-label samples are denoted as set D_p. The student model is jointly trained using D_l and D_p, and the training objective is split into alarm code multi-label loss L_code and alarm level loss L_level; definition: ; ; Then, the joint loss is expressed as: ; Where i is the sample index, k is the alarm code index, c is the alarm level index, and wᵢ is the sample weight. Let p_i,k represent whether the k-th alarm code of the i-th sample is valid, p_i,k represent the probability of the k-th alarm code output by the student model, l_i represent the true value of the alarm level, q_i,c represent the predicted probability of the alarm level c, 1(·) represent the indicator function, λ represent the alarm level loss coefficient, L_reg represent the regularization term, and μ represent the weight of the regularization term. The training weight w_l of the manually labeled sample is greater than the training weight w_p of the high-confidence pseudo-label sample; The training weights of the high-confidence pseudo-label samples are dynamically determined based on the pseudo-label confidence, data quality score, and business consistency score. ； Where w_p_base is the pseudo-label base weight, conf_i is the pseudo-label confidence, Q_data(i) is the data quality score, and Q_rule(i) is the business consistency score; When a pseudo-labeled sample does not have a reliability level label, the sample only participates in the calculation of L_code and not in the calculation of L_level.

6. The method according to claim 5, characterized in that, The student model includes a shared feature layer, an alarm code output header, and an alarm level output header; The shared feature layer is represented as: Where Encoder is the encoder function and X_t is the input sample feature; The alarm code output header indicates that... Where W_code is the alarm code output header weight matrix, and b_code is the alarm code output header bias vector; The alarm level output header is represented as ; where W_level is the alarm level output header weight matrix, b_level is the alarm level output header bias vector, G_code is the auxiliary representation obtained from the intermediate representation of the alarm code or the probability aggregation of the alarm code, and [;] represents the vector concatenation operation; The shared feature layer consists of 2 to 4 layers of LSTM, TCN, or Transformer blocks; when using Transformer, the number of attention heads is 2 to 8, and the hidden dimension is 64 to 256. The input to the alarm level output header depends on one or more of the output of the shared feature layer and the intermediate representation of the alarm code.

7. The method according to claim 6, characterized in that, The inference input for the alarm level also includes one or more of the following: duration of continuous over-limit, integral of over-limit amplitude, frequency of historical anomalies, device importance, degree of phase imbalance, and alarm combination mode; The alarm level output undergoes one or more post-processing steps, including level smoothing, minimum hold duration control, and device importance adjustment. The level smoothing adopts a majority voting smoothing, exponential smoothing, or minimum hold time strategy. When the manual correction results are fed back, the system performs a credibility assessment on the manually fed-back data. The credibility assessment includes one or more of the following: consistency judgment of multiple annotations, consistency judgment with the original state of the equipment and the work order results, judgment of the experience level of the annotator, and judgment of time sequence and business consistency rules. The retraining adopts a strategy combining incremental learning and periodic full retraining: incremental updates are performed first during the high-frequency retraining phase, followed by periodic full retraining; to prevent catastrophic forgetting, old sample replay, representative historical sample retention, old model distillation, or stability regularization are used. Before a new model goes live, it undergoes offline evaluation. Once the evaluation is passed, it enters a phased rollout. During the phased rollout, the new model gradually increases the proportion of traffic it processes according to a preset ratio. If the false alarm rate, false negative rate, or work order validity rate exceeds the preset warning line during the phased rollout, it will automatically roll back to the old model.

8. The method according to claim 7, characterized in that, In the cold start phase where there is a lack of validation sets or labeled samples, the threshold for each alarm code is set based on expert experience or on the quantile of the probability distribution of unlabeled data. As manual annotation and work order feedback samples accumulate, it gradually transitions to dynamic threshold optimization based on validation sets and cost functions. The sample structure of the device status time-series data includes device identity field, status time-series field, event context field, work order feedback field, and environment and business field; The device identity field includes one or more of the following: device identifier, device type, location identifier, circuit identifier, rated current, and installation time. The status timing field includes one or more of the following: A-phase current, B-phase current, C-phase current, A-phase voltage, B-phase voltage, C-phase voltage, power, temperature, leakage current, switch status, and communication status. The event context field includes one or more of the following: original alarm code, alarm time, recovery time, action status, and manual confirmation flag; The work order feedback fields include one or more of the following: work order identifier, work order type, processing result, false alarm flag, missed alarm flag, and confirmation level; The environment and business fields include one or more of the following: building type, floor identifier, load category, equipment importance, and maintenance shift.

9. A joint reasoning system for multiple alarm codes and alarm levels based on device status time-series data, characterized in that, include: The device status acquisition module is used to collect the status time-series data of the monitored device; The temporal alignment and sample construction module is used to construct sample sequences based on device identifiers and time alignment. A multi-time-window feature construction module is used to construct device status features of the sample sequence based on multiple review time windows; The teacher model training and inference module is used to train the teacher model based on manually labeled samples, and the teacher model outputs the probability of each alarm code for unlabeled samples. The pseudo-label filtering module is used to filter high-confidence pseudo-labels from the unlabeled samples based on alarm code thresholds and sorting rules; The student model training module is used to jointly train the student model by combining the manually labeled samples and the high-confidence pseudo-label samples with different weights. The alarm code and level joint output module is used to output the alarm code set and the corresponding alarm level from the student model; The retraining module is used to recycle the manual correction results and work order processing results to update the training samples, pseudo-label screening conditions and the alarm code threshold. Each module is used to perform the method described in any one of claims 1 to 8.

10. An electronic device comprising a processor and a memory, the memory storing a computer program that, when executed by the processor, implements the method of any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method of any one of claims 1 to 8.

Images