Interactive fault diagnosis method and system based on large language model

Abstract

The application provides an interactive fault diagnosis method and system based on a large language model, wherein the method comprises the following steps: obtaining a structured tool call command inversely issued by the large language model due to missing context information; analyzing the structured tool call command, and retrieving historical original logs of a physical device within a time window in a local time series database; performing statistical aggregation processing on the retrieved historical original logs according to a specified time window, and generating a simplified semantic context for identification by the large language model; performing encapsulation processing on the simplified semantic context, and performing desensitization processing in the encapsulation process to obtain a structured execution result, which is returned to the large language model in an encrypted manner; obtaining a diagnosis result formed by the large language model based on the simplified semantic context, and cyclically and iteratively issuing the structured tool call command when the context information is missing. The application greatly reduces bandwidth consumption and transmission delay, and can effectively improve confidentiality through desensitization processing.

Description

Technical Field

[0001] This invention relates to the field of industrial operation and maintenance technology, and in particular to an interactive fault diagnosis method and system based on a large language model. Background Technology

[0002] In industrial operations and maintenance (O&M) scenarios, rapid fault location and troubleshooting are crucial for ensuring production continuity. Typical industrial O&M scenarios include power distribution room leakage monitoring, substation partial discharge detection, and production line equipment status monitoring. These scenarios share the following characteristics:

[0003] (1) Large amount of data: A large number of sensors and monitoring equipment are deployed in industrial sites, continuously generating massive amounts of operation logs.

[0004] (2) Complex data formats: Industrial logs contain a variety of formats, such as hexadecimal protocol messages, binary time-series data, structured alarm information, unstructured text records, etc., which are difficult to effectively parse when directly input into large language models.

[0005] (3) Limited network conditions: Industrial sites are usually located in remote areas with limited and unstable network bandwidth, making it difficult to guarantee the latency and reliability of uploading all data to the cloud.

[0006] (4) High data sensitivity: Industrial operation data involves sensitive information such as production process parameters and equipment operating status. Data leakage may cause commercial losses or security risks.

[0007] (5) High timeliness requirements for troubleshooting: Equipment failures need to be located and responded to within minutes or even seconds. Delayed troubleshooting may lead to production interruption or safety accidents.

[0008] With the rapid development of computer technology, the introduction of large language models to process operation and maintenance data has become one of the effective means to improve the efficiency and accuracy of fault diagnosis. However, how to realize the localized processing of massive log data in industrial sites while utilizing the powerful reasoning and diagnostic capabilities of large language models, and avoid the problems of bandwidth consumption, high latency, data privacy leakage and model token bottleneck caused by uploading all data to the cloud, has become an urgent problem to be solved in the application of this technology. Summary of the Invention

[0009] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide an interactive fault diagnosis method and system based on a large language model, which has the advantages of reducing bandwidth consumption, reducing transmission delay, and improving confidentiality.

[0010] To achieve the above and other related objectives, the present invention provides the following technical solution:

[0011] The first aspect of the present invention discloses an interactive fault diagnosis method based on a large language model, comprising:

[0012] Based on the received troubleshooting requirement information, the corresponding parsing tool is loaded from the pre-built tool library to parse the operation and maintenance intent, and uploaded to the large language model for contextual information diagnosis.

[0013] Obtain the structured tool invocation commands that are reversed from the large language model due to the lack of context information. The tool invocation commands include tool names and parameter key-value pairs.

[0014] The structured tool call command is parsed, and the historical raw logs of the physical device within the time window are retrieved from the local time-series database;

[0015] The retrieved historical raw logs are subjected to statistical aggregation processing according to a specified time window, and a simplified semantic context is generated for recognition by a large language model.

[0016] The simplified semantic context is encapsulated, and desensitization is performed during the encapsulation process to obtain a structured execution result that is encrypted and sent back to the large language model.

[0017] Obtain the diagnostic results generated by the large language model based on the simplified semantic context, and iteratively issue structured tool call commands when context information is missing until the final diagnostic report is generated.

[0018] In one embodiment of the present invention, the troubleshooting requirement information is generated based on the inspection strategy table during regular inspections or triggered by real-time reporting when the equipment status is abnormal.

[0019] In one embodiment of the present invention, when troubleshooting requirement information is generated based on the inspection strategy table for timed inspection, the device data within the inspection time window is retrieved from the local time series database according to the inspection cycle configured in the inspection strategy table, and matched with the abnormal rules defined in the inspection strategy table to determine whether there is an abnormal state. If so, troubleshooting requirement information is generated.

[0020] When an abnormal device status is reported in real time, triggering a troubleshooting requirement, the parsing tool is invoked based on the abnormal event parameters to perform related data retrieval and analysis, and the troubleshooting requirement is generated based on the analysis results.

[0021] In one embodiment of the present invention, when obtaining the structured tool call command sent back by the large language model due to the lack of context information, the large language model assesses whether there is sufficient context information based on the received operation and maintenance intention for diagnosis. If not, it generates a structured tool call command according to the tool description defined in the context information and sends it back.

[0022] In one embodiment of the present invention, when parsing the structured tool call command, the tool name corresponding to the structured tool call command is obtained, so as to find the corresponding execution script in the local preset execution script library, and the tool call parameters are passed to the execution script to perform the retrieval operation.

[0023] In one embodiment of the present invention, the statistical aggregation process specifically includes: mean statistics, extreme value statistics, standard deviation statistics, and frequency statistics.

[0024] In one embodiment of the present invention, the desensitization process during packaging specifically includes: replacing the device identifier with an anonymous number, removing or replacing the network address with a virtual address, retaining the trend characteristics of the process parameters and offsetting the absolute value, replacing the location information with the region number, and releasing only the desensitized aggregate summary and statistical features of the aggregated statistical results.

[0025] In one embodiment of the present invention, during the desensitization process, the information is released progressively according to the control information of the current iteration round: the initial round releases a coarse-grained aggregated summary, and when the large language model requests finer-grained data, the information release granularity is increased round by round to medium-grained segmented statistics or fine-grained desensitization trend.

[0026] In one embodiment of the present invention, during the iterative process when context information is missing, the retrieval parameters are adjusted according to the newly generated structured tool call command to perform incremental data retrieval and progressive feature refinement.

[0027] A second aspect of the present invention discloses an interactive fault diagnosis system based on a large language model, comprising:

[0028] The loading and parsing module is used to load the corresponding parsing tool from the pre-built tool library based on the received troubleshooting requirement information to parse the operation and maintenance intent, and upload it to the large language model for context information diagnosis.

[0029] The command acquisition module is used to acquire the structured tool call commands that are sent back by the large language model due to the lack of context information. The tool call commands include tool names and parameter key-value pairs.

[0030] The parsing and retrieval module is used to parse the structured tool call commands and retrieve the historical raw logs of the physical device within the time window from the local time series database;

[0031] The feature aggregation module is used to perform statistical aggregation processing on the retrieved historical raw logs according to a specified time window, and generate a simplified semantic context for recognition by a large language model.

[0032] The encapsulation and desensitization module is used to encapsulate the simplified semantic context and perform desensitization during the encapsulation process to obtain a structured execution result that is encrypted and sent back to the large language model.

[0033] The diagnostic output module is used to obtain the diagnostic results formed by the large language model based on the simplified semantic context, and to iteratively issue structured tool call commands when context information is missing until the final diagnostic report is generated.

[0034] As described above, the present invention has the following beneficial effects:

[0035] This invention discloses an interactive fault diagnosis method and system based on a large language model. The method includes: loading a corresponding parsing tool from a pre-built tool library based on received troubleshooting request information to parse the maintenance intent, and uploading it to the large language model for context information diagnosis; obtaining a structured tool call command sent back by the large language model due to missing context information, the tool call command including a tool name and parameter key-value pairs; parsing the structured tool call command and retrieving historical raw logs of physical devices within the specified time window from a local time-series database; performing statistical aggregation processing on the retrieved historical raw logs according to a specified time window and generating a simplified semantic context for the large language model to recognize; encapsulating the simplified semantic context and performing desensitization processing during the encapsulation process to obtain a structured execution result encrypted and sent back to the large language model; obtaining a diagnostic result formed by the large language model based on the simplified semantic context, and iteratively sending structured tool call commands when context information is missing until a final diagnostic report is generated. By generating a simplified semantic context through statistical aggregation, and then encapsulating and anonymizing it before sending it back to the large language model, the amount of data uploaded to the cloud is compressed by orders of magnitude, significantly reducing bandwidth consumption and transmission latency. The anonymization process also effectively improves confidentiality. At the same time, the corresponding historical raw logs are obtained by calling commands based on structured tools, and the number of calls is much smaller than the full log. This ensures the diagnostic relevance of the information obtained, improves the diagnostic accuracy, and breaks through the token limit bottleneck of the large language model. Troubleshooting is then carried out through iterative processes until the final diagnostic report is generated, improving the comprehensiveness and accuracy of the diagnostic results. Attached Figure Description

[0036] Figure 1 The diagram shown is a flowchart of an interactive fault diagnosis method based on a large language model, as described in an embodiment of the present invention. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] Please see Figure 1 The first aspect of this invention provides an interactive fault diagnosis method based on a large language model, comprising:

[0039] S100: Based on the received troubleshooting requirement information, load the corresponding parsing tool from the pre-built tool library to parse the operation and maintenance intent, and upload it to the large language model for context information diagnosis.

[0040] Specifically, troubleshooting request information can be obtained by maintenance personnel through a general instant messaging APP, which can be uploaded in natural language. This general instant messaging APP can be installed on mobile phones, tablets, computers, or other wearable smart devices. As the entry point for user interaction with the system, the general instant messaging APP receives and uploads the troubleshooting request information described by maintenance personnel in natural language, and pushes the final diagnostic report back to the maintenance personnel. For example, the troubleshooting request information can be described as "There has been a water leakage alarm in area 3 of the power distribution room in the last 2 hours. Please help analyze the cause." In some embodiments, the troubleshooting request information can also be generated based on the inspection strategy table during regular inspections or triggered by real-time reporting when the equipment status is abnormal.

[0041] Specifically, when troubleshooting requirement information is generated based on the inspection strategy table for scheduled inspections, the device data within the inspection time window is retrieved from the local time series database according to the inspection cycle configured in the inspection strategy table, and matched with the abnormal rules defined in the inspection strategy table to determine whether there is an abnormal state. If so, troubleshooting requirement information is generated.

[0042] In a specific instance, the inspection strategy table can be set as follows:

[0043] parameter illustrate Example value Inspection cycle Time interval between two inspections 30min / 1h / 6h Target equipment group Equipment coverage during inspection "All sensors in the power distribution room" / "Substation GIS monitoring team" Key Indicators Data dimensions to be checked Extreme temperature, average humidity, alarm frequency Anomaly detection rules Threshold conditions for determining anomalies Humidity exceeds limit or alarm frequency exceeds limit Inspection time window Data range for each inspection backtracking The most recent cycle

[0044] By configuring scheduled inspections to complete proactive inspection and diagnosis, an autonomous "proactive early warning" diagnostic process can be initiated, enabling unattended anomaly detection and early warning capabilities.

[0045] When an abnormal device status is reported in real time, triggering a troubleshooting requirement, the parsing tool is invoked based on the abnormal event parameters to perform related data retrieval and analysis, and the troubleshooting requirement is generated based on the analysis results.

[0046] Abnormal equipment status includes, but is not limited to: sudden changes in sensor readings, such as a large temperature change in a short period of time; alarm signal triggering, such as smoke alarms and water immersion alarms; abnormal changes in equipment status registers, such as circuit breaker tripping or pump start / stop abnormalities; communication interruptions or data acquisition abnormalities. Abnormal event parameters can include, for example, the type and severity of the abnormal event. Based on these parameters, the range of data to be retrieved can be determined, such as tracing back the time window before and after the abnormality occurred, identifying related equipment groups, etc. Then, appropriate analysis tools are invoked to perform retrieval and analysis operations on the related data, forming a passive interactive diagnostic process.

[0047] The large language model used in this application can employ a general-purpose large language model. The cloud-based large language model is deployed with an inference layer, possessing capabilities for natural language understanding, inference analysis, function calling, and diagnostic report generation, without requiring specific adaptation or fine-tuning for industrial operation and maintenance scenarios. When receiving a request for information reporting, the large language model dynamically perceives available log operation tools on the edge side based on the skill description context attached to the request. When contextual information is insufficient, it generates structured tool calling commands and sends them back.

[0048] The pre-built tool library is a complete set of skills built in at the factory, covering all supported tools for log retrieval, statistical analysis, feature extraction, etc. Each tool is a self-contained skill package, encapsulating a SKILL.md skill description file and a tools directory. The SKILL.md skill description file is used for large model context injection, and the tools directory encapsulates execution scripts and other tool files, responsible for the local execution of agent-distributed tasks. The SKILL.md skill description file is included in the active skill set, which dynamically matches and loads skill sets from the pre-built tool library based on the actual connected devices and data sources. It only contains skill descriptions corresponding to currently online devices, and is automatically loaded when the device comes online and automatically deregistered when the device goes offline.

[0049] When uploading troubleshooting requirements, the skill description context (SKILL.md) of the active skill set is uploaded simultaneously. The skills in this active skill set are dynamically matched and loaded from the pre-built skill library. Based on the actual connected device and data source type, the corresponding execution script and skill description are loaded from the pre-built tool library.

[0050] The active skillset defines the set of tools currently available to the edge agent. In some embodiments, its example structure is as follows:

[0051] # log_query

[0052] ## Function Description

[0053] Retrieve log data for a specified device and time range from the local time-series database;

[0054] ## Parameter Definition

[0055] - device_id: String, Description: Target device ID;

[0056] - start_time: String, Description: Start time (ISO 8601 format);

[0057] - end_time: String, Description: End time (ISO 8601 format);

[0058] - fields: Array of strings, description: List of fields to be returned;

[0059] ## Return Value

[0060] - data: Array, Description: List of retrieved data points (automatically downsampled to a maximum of 1000 points);

[0061] - total_count: Integer, Description: Total number of original data points.

[0062] # log_aggregate

[0063] ## Function Description

[0064] Perform statistical aggregation on log data for a specified device and time range;

[0065] ## Parameter Definition

[0066] - device_id: String, Description: Target device ID;

[0067] - start_time: String, description: start time;

[0068] - end_time: String, Description: End time;

[0069] - window: string, description: aggregated time window (e.g., "5min", "1h");

[0070] - statistics: String array, description: statistical type (mean / max / min / std / count);

[0071] ## Return Value

[0072] - aggregated: Array, Description: Statistical results for each time window;

[0073] - global_stats: Object, Description: Global statistics summary.

[0074] # log_search

[0075] ## Function Description

[0076] Search the log file for content that matches the specified pattern;

[0077] ## Parameter Definition

[0078] - pattern: string, description: search pattern (supports regular expressions);

[0079] - source: string, description: log source (device_id or log file path);

[0080] - start_time: String, description: start time;

[0081] - end_time: String, Description: End time;

[0082] - max_lines: Integer, Description: Maximum number of lines to return (default 100);

[0083] ## Return Value

[0084] - matches: array, description: matching log lines (automatically de-identified);

[0085] - match_count: Integer, meaning: the total number of matches.

[0086] # log_anomaly

[0087] ## Function Description

[0088] Detect abnormal data segments within a specified device and time range;

[0089] ## Parameter Definition

[0090] - device_id: String, Description: Target device ID;

[0091] - start_time: String, description: start time;

[0092] - end_time: String, Description: End time;

[0093] - method: String, value range ["threshold","zscore","iqr"], description: anomaly detection method;

[0094] - sensitivity: Floating-point number, ranging from 0.1 to 10.0, meaning: detection sensitivity;

[0095] ## Return Value

[0096] - anomaly_segments: Array, description: the time period of the detected anomaly and its description;

[0097] - normal_stats: Object, Description: Statistical baseline for the normal data segment.

[0098] S200. Obtain the structured tool call command that is sent back by the large language model due to the lack of context information. The tool call command includes the tool name and parameter key-value pairs.

[0099] Specifically, when obtaining the structured tool call command sent back by the large language model due to missing context information, the large language model assesses whether there is sufficient context information based on the received operation and maintenance intent for diagnosis. If not, it generates a structured tool call command based on the tool description defined in the context information and sends it back.

[0100] When the large language model receives a request for information reporting, it dynamically senses the log operation tools available on the edge side through the skill description context attached to the request. When the context information is insufficient, it generates a structured tool call command and sends it back. The tool call command is usually in JSON format, containing the tool name and parameter key-value pairs, which strictly correspond to the tool description defined in the skill description context SKILL.md.

[0101] S300. Parse the structured tool call command and retrieve the historical raw logs of the physical device within the time window from the local time series database.

[0102] Specifically, when parsing the structured tool call command, the tool name corresponding to the structured tool call command is obtained to find the corresponding execution script in the local pre-built execution script library, and the tool call parameters are passed to the execution script to perform the retrieval operation. For example, the log retrieval script (log_query.py) performs a retrieval in the local time-series database based on device_id and time_window, using time partition index and device tag index to accelerate the query; the statistical aggregation script (log_aggregate.py) performs statistical aggregation on the retrieved raw data according to a specified time window; the log search script (log_search.py) performs pattern matching search in log files or time-series databases, supporting regular expressions; the anomaly detection script (log_anomaly.py) detects abnormal data segments based on statistical thresholds, Z-Score, or IQR methods. All of the above execution scripts come from the pre-built tool library and are dynamically loaded when the device goes online.

[0103] S400. Perform statistical aggregation processing on the retrieved historical raw logs according to a specified time window, and generate a simplified semantic context for recognition by a large language model. The statistical aggregation processing specifically includes: mean statistics, extreme value statistics, standard deviation statistics, and frequency statistics.

[0104] S500. The simplified semantic context is encapsulated and desensitized during the encapsulation process to obtain a structured execution result that is encrypted and sent back to the large language model.

[0105] Specifically, the desensitization process during packaging includes:

[0106] Device identifier anonymization: Replace the device identifier with an anonymous number, for example, replace the specific device serial number "SN-20240315-001" with "Device A";

[0107] Network address anonymization: Remove or replace network addresses with virtual addresses, for example, replace the network address "192.168.1.100" with "edge node-1";

[0108] Process parameter desensitization: Preserving the trend characteristics of process parameters while shifting their absolute values, for example, applying a random shift to the absolute values;

[0109] Location information anonymization: Replace location information with area code, for example, replace the location information "Power Distribution Room No. 2 Cabinet" with "Area B";

[0110] Aggregated statistical anonymization: Only the anonymized aggregated summary and statistical features of the aggregated statistical results are released, such as only retaining statistical features such as mean / extreme value / rate of change, without sending back the original data points second by second.

[0111] During the desensitization process, the information is released progressively according to the current iteration round: the initial round releases a coarse-grained aggregated summary, and when the large language model requests finer-grained data, the information release granularity is gradually increased to medium-grained segmented statistics or fine-grained desensitization trends.

[0112] The progressive information release control process is as follows: In the initial round of the tool call loop, only coarse-grained aggregated summaries are released, such as the mean, extreme values, and rate of change within the time window; in the intermediate rounds, medium-grained segmented statistics are released according to the requests of the large language model; and in the final round, anonymized fine-grained trend data is released, never containing the original plaintext data. The granularity of information release in each round is controlled by the edge-side anonymization rules. The cloud-based large language model can only request finer-grained data by generating new tool call commands and cannot directly specify the release granularity, thus achieving a balance between privacy protection and diagnostic depth.

[0113] S600: Obtain the diagnostic results generated by the large language model based on the simplified semantic context, and iteratively issue structured tool call commands when context information is missing until the final diagnostic report is generated.

[0114] After receiving the execution result from the parsing tool, the large language model assesses whether sufficient contextual information has been obtained to meet the diagnostic requirements. If the information is insufficient, it continues to generate new structured tool call commands, repeating steps S200~S260 for a new round of iterative processing. During the iterative process due to missing contextual information, the retrieval parameters are adjusted based on the newly generated structured tool call commands to perform incremental data retrieval and progressive feature refinement. Of course, if maintenance personnel follow up through a general instant messaging app, it is equivalent to publishing new troubleshooting requirements, which will also trigger the next round of tool call loop.

[0115] If sufficient contextual information is available, a final diagnostic report is generated. This report typically includes the following: fault phenomenon confirmation, which verifies the fault phenomenon described by the operations and maintenance personnel based on data returned by the tool; root cause analysis, which infers the root cause of the fault based on data trends and anomaly patterns; impact assessment, which evaluates the scope and severity of the fault's impact on equipment and production; and handling recommendations, which provide specific troubleshooting operation suggestions and subsequent monitoring plans.

[0116] Through the aforementioned tool call loop mechanism, the big data model obtains precise data fragments on demand instead of the full log. The amount of data returned by a single tool call is usually hundreds to thousands of tokens, which is far less than the hundreds of thousands of tokens of the full log. The total token consumption of multiple iterations is still far lower than the full data cloud solution.

[0117] In addition, the scheduled inspections and equipment status anomaly diagnoses in this application will also trigger a new round of tool call loops. However, the proactive inspection diagnosis (scheduled inspection) and the passive interactive diagnosis (equipment status anomaly reporting) share the same set of skill descriptions, tool execution engines, and context encapsulation and desensitization infrastructure. When maintenance personnel receive a proactive alarm, they can further inquire through a general instant messaging APP. The system recognizes this as an in-depth inquiry into the proactive alarm that has been pushed and automatically enters the interactive troubleshooting mode of the tool call loop. It reuses the data retrieved and aggregated in the proactive inspection phase as the initial context and only performs retrieval operations on the incremental time range or new dimensions involved in the inquiry. The incremental data is merged with the aggregated data and sent to the cloud-based large language model for in-depth diagnosis, realizing collaborative troubleshooting of "proactive discovery → passive in-depth" and avoiding redundant calculations.

[0118] In a second aspect, this invention provides an interactive fault diagnosis system based on a large language model, comprising: a loading and parsing module, configured to load a corresponding parsing tool from a pre-set tool library based on received troubleshooting requirement information to parse the maintenance intent, and upload it to the large language model for context information diagnosis; a command acquisition module, configured to acquire a structured tool call command sent back by the large language model due to missing context information, the tool call command including a tool name and parameter key-value pairs; a parsing and retrieval module, configured to parse the structured tool call command and retrieve historical raw logs of physical devices within the time window from a local time-series database; a feature aggregation module, configured to perform statistical aggregation processing on the retrieved historical raw logs according to a specified time window, and generate a simplified semantic context for the large language model to recognize; an encapsulation and desensitization module, configured to encapsulate the simplified semantic context and perform desensitization processing during the encapsulation process to obtain a structured execution result encrypted and sent back to the large language model; and a diagnosis output module, configured to acquire a diagnosis result formed by the large language model based on the simplified semantic context, and iteratively send structured tool call commands in a loop until a final diagnosis report is generated when context information is missing.

[0119] This invention generates a simplified semantic context through statistical aggregation, and then encapsulates and anonymizes it before sending it back to a large language model. This enables order-of-magnitude compression of data uploaded to the cloud, significantly reducing bandwidth consumption and transmission latency. The anonymization process effectively improves confidentiality. Simultaneously, it retrieves relevant historical raw logs based on structured tool commands, with a significantly smaller number of calls compared to the full log. This ensures the diagnostic relevance of the retrieved information while improving diagnostic accuracy and overcoming the token limit bottleneck of the large language model. Troubleshooting is then performed iteratively until a final diagnostic report is generated, improving the comprehensiveness and accuracy of the diagnosis.

[0120] The interactive fault diagnosis method of this application will be illustrated below with a specific practical application scenario:

[0121] Example: Troubleshooting a Leak in a Power Distribution Room

[0122] A power distribution room in an industrial park is equipped with numerous IoT devices, including temperature and humidity sensors, water immersion sensors, door magnetic sensors, and smoke sensors, all connected to a local time-series database via an edge gateway. During a routine inspection, maintenance personnel initiated a troubleshooting request via a general instant messaging app, sending the following message: "Water leakage alarms have been continuously triggered in area 3 of the power distribution room recently. Please analyze the cause."

[0123] The interactive fault diagnosis method is specifically as follows:

[0124] S100: Based on the received troubleshooting requirement information, load the corresponding parsing tool from the pre-built tool library to parse the operation and maintenance intent, and upload it to the large language model for context information diagnosis.

[0125] Specifically, after receiving troubleshooting request information from a general instant messaging app, the troubleshooting request information, along with the skill description context from the active skill set, is sent to the large language model. The skills in the active skill set come from a pre-built tool library, and corresponding skills such as log retrieval, statistical aggregation, and anomaly detection are loaded from the pre-built tool library based on the types of sensors deployed in the power distribution room (temperature and humidity, water immersion, smoke detection, etc.).

[0126] The large language model analyzes the semantics of the problem to diagnose contextual information and identify key information: fault type = water leakage, area = area 3, time window = recent. At this point, the large language model determines that it lacks real-time on-site data and cannot directly determine the cause of the water leakage.

[0127] S200. Obtain the structured tool call command that is sent back by the large language model due to the lack of context information. The tool call command includes the tool name and parameter key-value pairs.

[0128] Specifically, the large language model generation structured tool calls the following commands: target device, humidity sensor (sensor_humidity_03), water immersion sensor (sensor_water_03), drainage pump status (pump_status_03), and ambient temperature sensor (sensor_temp_03) in area 3; time window, specified time range; data feature dimensions, humidity extremes and trends, water level values ​​and rates of change, drainage pump start / stop frequency, and ambient temperature anomalies; aggregation strategy, statistically analyzed according to the average of the preset time window, with abnormal segments retaining their original accuracy.

[0129] S300. Parse the structured tool call command and retrieve the historical raw logs of the physical device within the time window from the local time series database.

[0130] Specifically, the structured tool call commands are parsed, the command parameters are parsed, and the raw data within a specified time range is retrieved from the data streams of multiple devices.

[0131] Simultaneously, log retrieval was performed: sensor_humidity_03, which retrieved a large number of humidity sampling points; sensor_water_03, which retrieved water level sampling points; pump_status_03, which retrieved status change records; and sensor_temp_03, which retrieved temperature sampling points.

[0132] S400. Perform statistical aggregation processing on the retrieved historical raw logs according to the specified time window, and generate a simplified semantic context for recognition by the large language model.

[0133] Specifically, the statistical aggregation process includes: humidity data, which is aggregated by time window to generate a statistical point sequence, identifying abnormal periods where humidity rises rapidly and exceeds the normal threshold, marking these as abnormal segments while preserving the original sampling accuracy; water level data, which is aggregated by time window to generate a statistical point sequence, identifying continuous rises in water level that reach a peak, marking these as abnormal segments; drainage pump status, counting the number of start-stop cycles—finding that drainage pumps frequently start and stop during abnormal periods, with semantic annotation: "Frequent start-stop cycles of drainage pumps during abnormal periods indicate that the drainage system is working but the drainage efficiency is insufficient"; and temperature data, aggregated by time window, with no abnormalities found, remaining within the normal range.

[0134] The raw data is aggregated to generate a concise semantic context, achieving orders-of-magnitude compression.

[0135] S500. The simplified semantic context is encapsulated and desensitized during the encapsulation process to obtain a structured execution result that is encrypted and sent back to the large language model. Encryption is achieved by sending the execution result back to the cloud-based large language model through an encrypted channel.

[0136] S600: Obtain the diagnostic results generated by the large language model based on the simplified semantic context, and iteratively issue structured tool call commands when context information is missing until the final diagnostic report is generated.

[0137] Specifically, the large model reasoned based on a simplified semantic context: the humidity rose rapidly and coincided with the timeline of the leak; the water level rose slightly earlier than the humidity anomaly, indicating that the leak point spread before the humidity spread; the drainage pump started, indicating that the water immersion sensor automatically triggered drainage after detecting water accumulation; however, the drainage pump repeatedly started and stopped, indicating that the drainage was incomplete and the water volume was large; the temperature was normal, ruling out "false leaks" caused by condensation.

[0138] The large language model returns a diagnostic report based on simplified context, which includes:

[0139] 1) Cause of the malfunction: There is a substantial water leak in area 3 of the power distribution room, and the large volume of water prevents the drainage pump from completely draining it.

[0140] 2) Impact Assessment: Humidity has exceeded the safe operating threshold of the equipment, posing a risk of electrical short circuit. Severity Level: High

[0141] 3) Recommendations: (a) Immediately dispatch personnel to the site to inspect the source of the leak (prioritize checking the roof waterproofing layer and pipe joints); (b) Temporarily activate the backup drainage pump; (c) Conduct insulation checks on electrical equipment in Area 3; (d) Strengthen subsequent humidity monitoring.

[0142] Finally, the diagnostic report can be pushed to maintenance personnel via a general instant messaging app.

[0143] If the maintenance personnel continue to follow up via a general instant messaging app, asking, "Please analyze the data before the leak to see if there were any signs of an impending leak," then a new troubleshooting request is issued. At this point, the troubleshooting request is forwarded to the large language model, which returns a new structured tool call command, extending the time window forward and increasing the sensitivity to minute changes in the feature dimensions.

[0144] Incremental retrieval revealed a slight upward trend in humidity before the leak occurred, and the bottom value of the water immersion sensor showed slight fluctuations. The incremental results were then sent to the large model, which updated its diagnostic conclusion: the leak actually started earlier, with a small initial leakage amount, which was later triggered by reaching the water immersion sensor threshold. It is recommended to investigate whether there was any external construction or pipeline operation before the leak occurred.

[0145] The above embodiments merely illustrate several implementation methods of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be noted that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present invention. These are all equivalent modifications and improvements made to the above embodiments based on the essential technology of the present invention, and all of these fall within the protection scope of the present invention.

Claims

1. An interactive fault diagnosis method based on a large language model, characterized in that, include: Based on the received troubleshooting requirement information, the corresponding parsing tool is loaded from the pre-built tool library to parse the operation and maintenance intent, and uploaded to the large language model for contextual information diagnosis. Obtain the structured tool invocation commands that are reversed from the large language model due to the lack of context information. The tool invocation commands include tool names and parameter key-value pairs. The structured tool call command is parsed, and the historical raw logs of the physical device within the time window are retrieved from the local time-series database; The retrieved historical raw logs are subjected to statistical aggregation processing according to a specified time window, and a simplified semantic context is generated for recognition by a large language model. The simplified semantic context is encapsulated, and desensitization is performed during the encapsulation process to obtain a structured execution result that is encrypted and sent back to the large language model. Obtain the diagnostic results generated by the large language model based on the simplified semantic context, and iteratively issue structured tool call commands when context information is missing until the final diagnostic report is generated.

2. The interactive fault diagnosis method based on a large language model according to claim 1, characterized in that, The troubleshooting requirement information is generated based on the inspection strategy table during regular inspections or triggered by real-time reporting when the equipment status is abnormal.

3. The interactive fault diagnosis method based on a large language model according to claim 2, characterized in that, When troubleshooting requirements are generated based on the inspection strategy table, the system periodically retrieves device data within the inspection time window from the local time series database according to the inspection cycle configured in the inspection strategy table, and matches it with the abnormal rules defined in the inspection strategy table to determine whether there is an abnormal state. If so, troubleshooting requirements are generated. When an abnormal device status is reported in real time, triggering a troubleshooting requirement, the parsing tool is invoked based on the abnormal event parameters to perform related data retrieval and analysis, and the troubleshooting requirement is generated based on the analysis results.

4. The interactive fault diagnosis method based on a large language model according to claim 1, characterized in that, When obtaining the structured tool call command sent back by the large language model due to missing context information, the large language model assesses whether there is sufficient context information based on the received operation and maintenance intention for diagnosis. If not, it generates a structured tool call command based on the tool description defined in the context information and sends it back.

5. The interactive fault diagnosis method based on a large language model according to claim 1, characterized in that, When parsing the structured tool call command, the tool name corresponding to the structured tool call command is obtained, the corresponding execution script is searched in the local preset execution script library, and the tool call parameters are passed to the execution script to perform the search operation.

6. The interactive fault diagnosis method based on a large language model according to claim 1, characterized in that, The statistical aggregation processing specifically includes: mean statistics, extreme value statistics, standard deviation statistics, and frequency statistics.

7. The interactive fault diagnosis method based on a large language model according to claim 1, characterized in that, The desensitization process during packaging specifically includes: replacing the device identifier with an anonymous number, removing or replacing the network address with a virtual address, retaining the trend characteristics of the process parameters and offsetting the absolute value, replacing the location information with the region number, and releasing only the desensitized aggregate summary and statistical features of the aggregated statistical results.

8. The interactive fault diagnosis method based on a large language model according to claim 7, characterized in that, During the desensitization process, the information is released progressively according to the current iteration round: the initial round releases a coarse-grained aggregated summary, and when the large language model requests finer-grained data, the information release granularity is gradually increased to medium-grained segmented statistics or fine-grained desensitization trends.

9. The interactive fault diagnosis method based on a large language model according to claim 1, characterized in that, During the iterative process when contextual information is missing, the retrieval parameters are adjusted based on the newly generated structured tool call commands to perform incremental data retrieval and progressive feature refinement.

10. An interactive fault diagnosis system based on a large language model, characterized in that, include: The loading and parsing module is used to load the corresponding parsing tool from the pre-built tool library based on the received troubleshooting requirement information to parse the operation and maintenance intent, and upload it to the large language model for context information diagnosis. The command acquisition module is used to acquire the structured tool call commands that are sent back by the large language model due to the lack of context information. The tool call commands include tool names and parameter key-value pairs. The parsing and retrieval module is used to parse the structured tool call commands and retrieve the historical raw logs of the physical device within the time window from the local time series database; The feature aggregation module is used to perform statistical aggregation processing on the retrieved historical raw logs according to a specified time window, and generate a simplified semantic context for recognition by a large language model. The encapsulation and desensitization module is used to encapsulate the simplified semantic context and perform desensitization during the encapsulation process to obtain a structured execution result that is encrypted and sent back to the large language model. The diagnostic output module is used to obtain the diagnostic results formed by the large language model based on the simplified semantic context, and to iteratively issue structured tool call commands when context information is missing until the final diagnostic report is generated.

Images