Machine learning-based power distribution network abnormal event propagation chain diagnosis method and system

Abstract

The application relates to the field of power distribution network intelligent operation and maintenance, and specifically discloses a power distribution network abnormal event propagation chain diagnosis method and system based on machine learning, which comprises the following steps: collecting operation and maintenance work orders and operation track logs of each business system of a power distribution network through RPA, extracting event semantic vectors, and generating causal semantic-behavior fingerprint fusion feature vectors; decoupling and mapping the fusion feature vectors into node dynamic propagation attributes, determining the implicit causal propagation direction, verifying the operation behavior track and the equipment topology, constructing and optimizing an abnormal event propagation chain topology graph; locating a root cause work order node, generating a cross-system collaborative disposal instruction and issuing the same, capturing an execution feedback log to update a non-successful operation retry track mode library; and the system comprises three functionally matched modules. The application solves the problems of incomplete abnormal propagation path analysis, non-depth fusion of multi-source data and disconnection between diagnosis and disposal, and is suitable for complex power distribution network abnormal event diagnosis scenarios of high-penetration distributed energy access.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology for distribution networks, specifically to a method and system for diagnosing the propagation chain of abnormal events in distribution networks based on machine learning. Background Technology

[0002] With the large-scale integration of distributed energy resources and the dynamic reconfiguration of distribution network topology, distribution network anomalies exhibit characteristics of multi-source triggering, cascading propagation, and hidden paths. Traditional diagnostic methods are insufficient to meet the needs of anomaly tracing in complex scenarios. Existing diagnostic technologies mainly suffer from the following deep-seated shortcomings: Existing methods primarily focus on single-point anomaly detection and localization, relying on SCADA measurement data and static physical and electrical topology for propagation analysis, completely ignoring the operation trajectory logs recorded by RPA during cross-system operations. These logs contain retry trajectories of unsuccessful operations and field mapping friction records, which truly reflect fragile connections between systems. These fragile connections often constitute implicit transmission channels for anomaly propagation. Existing technologies fail to incorporate these into diagnostic inputs, leading to the omission of crucial bypass evidence at the information system level during propagation chain inference.

[0003] Distribution network operation data is highly heterogeneous, and maintenance work order text data and information system operation logs have long been isolated. Existing technologies for processing maintenance work orders are limited to simple text content extraction, failing to utilize features such as field completeness and format regularity obtained through RPA format analysis, and also failing to achieve spatiotemporal alignment and deep fusion of maintenance text and operation behavior logs through power domain semantic encoding. This results in the loss of early abnormal semantic signals and the inability to establish causal relationships between work orders.

[0004] Current propagation chain analysis stops at topological inference and root cause localization. Diagnostic results cannot be automatically converted into cross-system executable instructions, requiring manual login to production management systems, geographic information systems, and scheduling automation systems for repeated operations, resulting in a disconnect between diagnosis and handling. Operation trajectory templates from historical successful RPA handling cases cannot be reused, failing to form a closed-loop automated process from anomaly identification and propagation chain inference to collaborative handling. Anomaly response is sluggish, and the model lacks an evolutionary mechanism.

[0005] Therefore, there is an urgent need for a method to diagnose the propagation chain of abnormal events in power distribution networks that can integrate multi-source heterogeneous data, identify hidden transmission paths, and achieve an automatic closed loop from diagnosis to handling. Summary of the Invention

[0006] The present invention aims to solve the technical problems in the prior art of abnormal propagation chain diagnosis, which ignores evidence of information system vulnerability behavior due to reliance on electrical measurements alone, lack of deep integration between unstructured operation and maintenance work orders and information system operation logs, and disconnect between diagnostic results and cross-system collaborative handling.

[0007] The technical solution of this invention to solve the above-mentioned technical problems is as follows: A machine learning-based method for diagnosing the propagation chain of abnormal events in a power distribution network, specifically including the following steps: S1. Automatically collect operation and maintenance work order texts and operation trajectory logs from power distribution network production management system, geographic information system and dispatch automation system through non-intrusive RPA process. After semantic encoding in the power field and spatiotemporal alignment, generate a causal semantic-behavioral fingerprint fusion feature vector that integrates work order semantic information and system operation behavior patterns. S2. Decouple the fused feature vectors and map them to node dynamic propagation attributes. Determine the implicit causal propagation direction based on semantic implication relationships. Verify the operation behavior trajectory time sequence and device topology to construct and optimize the abnormal event propagation chain topology. S3. Based on the optimized propagation chain topology, reverse confidence propagation is used to locate the root cause work order node, historical successful handling cases are reused to generate cross-system collaborative handling instructions, and execution feedback logs are captured to update the retry trajectory pattern library for unsuccessful operations.

[0008] Based on the above technical solution, the present invention can be further improved as follows.

[0009] Furthermore, in S1, the process of logging into various business systems of the distribution network via RPA to collect operation and maintenance work orders and operation trajectory logs specifically includes: S111. By simulating manual operation through RPA robots, automatically logs into the power distribution network production management system, geographic information system and dispatch automation system according to a preset cycle, and keeps the sessions of each system continuously effective; S112. Traverse the work order list interface of each system, and collect multi-format operation and maintenance work order text data through interface element parsing and OCR recognition. The multi-format includes PDF, Word, Excel and image scans. S113. Record RPA operation trajectory logs in real time during cross-system operations. The operation trajectory logs include query jump sequences between systems, timestamps, response delays of data synchronization requests, mapping friction records of the same device or fault field between different systems, and retry behavior records after operation execution failure.

[0010] Furthermore, in S1, the text content of each maintenance work order is semantically encoded to extract event semantic vectors, specifically including: S121. Clean the text content of the maintenance work order, remove irrelevant characters and format marks, use an adaptive word segmentation tool in the power field for word segmentation, and use a named entity recognition model to identify the equipment name, fault phenomenon description, equipment status change description and time statement from the text. S122. Input the preprocessed text content into a pre-trained semantic coding model for the power sector. The semantic coding model adopts a pre-trained language model fine-tuned based on a power operation and maintenance corpus and outputs the context semantic coding vector of each work order. S123. From the context semantic encoding vector, extract the first semantic sub-vector corresponding to the fault phenomenon description and the second semantic sub-vector corresponding to the equipment state change description, and weight and concatenate the first semantic sub-vector and the second semantic sub-vector to generate the event semantic vector of each work order.

[0011] Furthermore, in step S1, the operation trajectory log and the event semantic vector are spatiotemporally aligned and jointly encoded to generate a causal semantic-behavioral fingerprint fusion feature vector, specifically including: S131. Obtain the occurrence time of each work order as the reference timestamp, and align each operation record in the operation trajectory log with the reference timestamp of each work order according to the operation timestamp. When the operation timestamp of an operation record falls within a preset time window before and after the reference timestamp of a certain work order, mark the operation record as associated with the work order. S132. For each work order, extract behavioral feature sub-vectors from all operation trajectory records associated with the work order. The behavioral feature sub-vectors include data synchronization delay statistics, field mapping friction event counts, number of retry times for unsuccessful operations, retry interval sequence statistics, and cross-system query jump frequency. S133. Concatenate the event semantic vector of each work order with the corresponding behavioral feature sub-vector to generate the causal semantic-behavioral fingerprint fusion feature vector of each work order.

[0012] Furthermore, in step S2, the causal semantic-behavioral fingerprint fusion feature vector is decoupled into event semantic vectors and behavioral feature sub-vectors for each work order. The decoupled vectors are mapped to node dynamic propagation attributes. The implicit causal propagation direction is determined based on the semantic implication relationship between the event semantic vectors. Specifically, this includes: S211. Using the distribution network physical topology as a static skeleton, the causal semantic-behavioral fingerprint fusion feature vector of each work order is decoupled into an event semantic vector and a behavioral feature sub-vector. Combined with the equipment topology information, the decoupled vectors are mapped to the dynamic propagation attributes of the nodes corresponding to each work order. The dynamic propagation attributes include node anomaly severity, node operation resistance index, and node influence range coefficient. The node anomaly severity, node operation resistance index, and node influence range coefficient are determined based on the deviation between the event semantic vector and the normal operating condition reference vector, the data synchronization delay and field mapping friction event count in the behavioral feature sub-vector, and the connection degree of the equipment involved in the work order in the distribution network physical topology. S212. Obtain the event semantic vector of the first work order and the event semantic vector of the second work order, concatenate the two event semantic vectors and input them into the pre-trained semantic implication discrimination model, and output the semantic implication score; S213. When the semantic implication score exceeds a preset threshold, it is determined that the event state described by the first work order constitutes the cause or premise of the event state described by the second work order in terms of semantics, and a candidate implicit causal propagation direction from the first work order to the second work order is established.

[0013] Furthermore, in step S2, the joint verification of the operational behavior trajectory in the behavioral feature sub-vector and the device topology specifically includes: S221. Extract the timestamp sequence of unsuccessful operation retry trajectory from the operation trajectory log associated with the first work order, and extract the timestamp sequence of unsuccessful operation retry trajectory from the operation trajectory log associated with the second work order. Estimate the probability density distribution of the two retry timestamp sequences respectively, and determine the time interval where the probability density peak is located as the concentrated time window of the retry trajectory of each work order. When the concentrated time window of the first work order is earlier than the concentrated time window of the second work order, verify the retry trajectory time sequence. S222. Query the topology association relationship of the distribution network equipment based on the equipment names corresponding to the first work order and the second work order. When there is an electrical connection relationship or a topological adjacency relationship between the equipment corresponding to the two work orders, verify the equipment topology constraint.

[0014] Furthermore, in S2, constructing and optimizing the abnormal event propagation chain topology graph specifically includes: S231. When a candidate implicit causal propagation direction passes both the retry trajectory timing verification and the device topology constraint verification, the candidate implicit causal propagation direction is confirmed as a valid implicit causal propagation relationship. An initial abnormal event propagation chain topology graph is constructed with each work order as a node and all valid implicit causal propagation relationships as directed edges. S232. Calculate the propagation weight for each directed edge in the initial abnormal event propagation chain topology graph. The propagation weight is determined based on the semantic implication score, the pass strength of the retry trajectory timing verification, and the device topology adjacency distance. S233. Remove redundant directed edges whose propagation weights are lower than a preset threshold, and merge branches in the topology graph with multiple propagation branches and the difference in propagation weights of the branch paths is less than a preset tolerance. Merge branch paths that share the same upstream node to obtain the optimized abnormal event propagation chain topology graph.

[0015] Furthermore, in step S3, the root cause work order node is located by reverse confidence propagation based on the abnormal event propagation chain topology graph, specifically including: S311. Taking each work order node in the abnormal event propagation chain topology as a propagation unit, set the initial confidence of each terminal node as the node abnormality severity in its node dynamic propagation attribute. S312. Propagate the confidence scores from all end nodes with zero out-degree to upstream nodes in the reverse direction of the directed edges. The confidence score of a downstream node is multiplied by the propagation weight of the directed edge between it and the upstream node and then passed to the upstream node. Each upstream node calculates the weighted sum of the confidence scores propagated from all downstream nodes and its own node anomaly severity to obtain the root cause confidence score of that node. S313. Traverse all work order nodes in the abnormal event propagation chain topology graph and locate the work order node with the highest root cause confidence as the root cause work order node; when multiple work order nodes have the same root cause confidence, select the node with the highest abnormality severity as the root cause work order node; if the abnormality severity of the nodes is still the same, select the work order with the earliest occurrence time as the root cause work order node.

[0016] Furthermore, in S3, cross-system collaborative handling instructions are generated and issued based on historical handling cases, and the execution feedback log is captured to update the retry trajectory pattern library for unsuccessful operations. Specifically, this includes: S321. Using the anomaly type of the root cause work node and the topological structure features of the anomaly event propagation chain topology as search keys, a similarity search is performed in the historical successful handling case database. The topological structure features include propagation chain depth, number of branches, and number of convergence nodes. S322. Select the historical successful handling case with the highest similarity, extract the operation sequence, operation parameters and operation timing of each system recorded in the case, and instantiate and adapt it by combining the equipment information and fault parameters of the current root cause work order node to generate an RPA operation trajectory template. S323. The RPA operation trajectory template is parsed into work order status update instructions for the power distribution network production management system, equipment positioning and isolation instructions for the geographic information system, and protection setting adjustment and switch opening and closing instructions for the dispatch automation system, and is issued and executed sequentially according to the time sequence recorded in the operation trajectory template; S324. Monitor and capture the actual execution results of cross-system collaborative processing instructions, record the operation steps that fail to execute and the corresponding retry behavior, and update the operation steps that fail to execute and the corresponding retry behavior to the unsuccessful operation retry trajectory pattern library.

[0017] A machine learning-based distribution network anomaly event propagation chain diagnosis system is implemented to diagnose distribution network anomaly event propagation chains based on machine learning, including: The data fusion module is used to log in to various business systems of the power distribution network via RPA to collect operation and maintenance work orders and operation trajectory logs, perform event semantic encoding on the text content of each operation and maintenance work order, extract event semantic vectors, and perform spatiotemporal alignment and joint encoding of the operation trajectory logs and event semantic vectors to generate causal semantic-behavioral fingerprint fusion feature vectors. The propagation chain inference module is used to decouple the causal semantic-behavioral fingerprint fusion feature vector into event semantic vectors and behavioral feature sub-vectors for each work order, map the decoupled vectors to node dynamic propagation attributes, determine the implicit causal propagation direction based on the semantic implication relationship between the event semantic vectors, and construct and optimize the abnormal event propagation chain topology graph through joint verification of the operation behavior trajectory in the behavioral feature sub-vectors and the device topology. The collaborative handling module is used to locate the root cause work order node by reverse confidence propagation based on the topology of the abnormal event propagation chain, generate and issue cross-system collaborative handling instructions based on historical handling cases, and capture execution feedback logs to update the retry trajectory pattern library for unsuccessful operations.

[0018] The beneficial effects of this invention are: 1. By introducing unsuccessful retries and field mapping friction features from RPA operation trajectory logs, the vulnerability of information systems is quantified as an anomaly propagation resistance index. This solves the problem of early anomaly signal loss caused by traditional methods relying solely on electrical measurements, and improves the completeness of multi-source heterogeneous data fusion and the sensitivity of anomaly propagation perception.

[0019] 2. By employing a dual verification mechanism of semantic implication discrimination and operational behavior trajectory timing, it overcomes the limitations of traditional methods that rely solely on physical electrical connections, effectively filtering out false causal relationships in unrelated work orders across spaces, and improving the accuracy and completeness of anomaly propagation chain topology inference.

[0020] 3. By reusing RPA operation trajectory templates from historical successful handling cases, a non-intrusive automatic closed loop from diagnostic results to cross-system collaborative handling is achieved, shortening the response time for abnormal events; at the same time, the execution feedback log is used to continuously update the retry trajectory pattern library for unsuccessful operations, realizing online evolution and adaptive optimization of the diagnostic model. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating the method described in Embodiments 1-4 of the present invention; Figure 2 This is a framework diagram of the system described in Embodiment 5 of the present invention; Figure 3 This is a schematic diagram of the electronic device in this invention. Detailed Implementation

[0022] The principles and features of the present invention are described below. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0023] Example 1 like Figure 1 As shown, this invention provides a machine learning-based method for diagnosing the propagation chain of abnormal events in a power distribution network, specifically including the following steps: S1. Log in to various business systems of the power distribution network through RPA, collect operation and maintenance work orders and operation trajectory logs, perform event semantic encoding on the text content of each operation and maintenance work order, extract event semantic vectors, and perform spatiotemporal alignment and joint encoding of operation trajectory logs and event semantic vectors to generate causal semantic-behavioral fingerprint fusion feature vectors. S2. Decouple the causal semantic-behavioral fingerprint fusion feature vector into event semantic vectors and behavioral feature sub-vectors for each work order. Map the decoupled vectors to node dynamic propagation attributes. Determine the implicit causal propagation direction based on the semantic implication relationship between event semantic vectors. Build and optimize the abnormal event propagation chain topology by jointly verifying the operation behavior trajectory in the behavioral feature sub-vectors with the device topology. S3. Based on the abnormal event propagation chain topology, reverse confidence propagation is used to locate the root cause work order node. Based on historical handling cases, cross-system collaborative handling instructions are generated and issued. Execution feedback logs are captured and the retry trajectory pattern library for unsuccessful operations is updated.

[0024] During the system initialization phase, the historical successful handling case library and the unsuccessful operation retry trajectory pattern library are constructed by manually entering typical historical operation and maintenance cases and RPA operation logs; or they are automatically collected and marked by RPA in the early stage of system operation, and the automatic diagnosis function is enabled after the sample size reaches the preset threshold; the preset threshold ranges from 50 to 200, with a classic value of 100.

[0025] Example 2 Preferably, in Embodiment 1, step S1 is specifically implemented through the following steps: S11. Automatic collection of cross-system RPA operation and maintenance work orders and operation trajectory logs, specifically: The S111.RPA robot initiates a cross-system login process according to a preset cycle. First, it reads the pre-configured login parameters for each business system, including the system access address, login account, authentication password, and security token information. The preset cycle ranges from 1 minute to 30 minutes, with a classic value of 10 minutes. The RPA robot simulates human keyboard input and mouse clicks to sequentially access the login pages of the power distribution network production management system, geographic information system, and dispatch automation system. It automatically fills in the username and password in the login form and completes the verification code recognition or digital certificate authentication process.

[0026] After successful login, the RPA robot maintains the continuous validity of each system session by periodically sending heartbeat requests or keeping the page active. The timed sending ranges from 1 minute to 15 minutes, with a classic value of 5 minutes. When a session is detected to be interrupted due to timeout or network fluctuations, a re-login mechanism is automatically triggered to restore the session according to the preset retry interval and maximum number of retries. This ensures the continuity and stability of the cross-system data collection process and avoids data collection interruptions due to session failure. The preset retry interval ranges from 10 seconds to 120 seconds, with a classic value of 30 seconds, and the maximum number of retries ranges from 3 to 10 times, with a classic value of 5 times.

[0027] After logging into various business systems, the S112.RPA robot automatically traverses the work order list interface of each system. It uses interface element parsing technology to locate the target area where the work order data is located. Interface element parsing includes identifying the position and structural relationships of table containers, pagination controls, and data row elements. For maintenance work order text data stored or exported in PDF, Word, or Excel formats, the RPA robot extracts the structured text content by calling the corresponding document parsing interface. For maintenance work orders existing as scanned images, the RPA robot converts the text information in the image into editable text using OCR recognition. The OCR recognition process includes image preprocessing, layout analysis, text region detection, and character recognition steps.

[0028] After data collection, the RPA robot converts the multi-format maintenance work order text data into a standardized text format and stores it in a structured manner according to the work order number, occurrence time, equipment name, and fault description fields, providing a standardized input data source for subsequent event semantic encoding.

[0029] During cross-system operations, the S113.RPA robot uses its built-in trajectory recording engine to capture and record operation trajectory logs in real time. This engine comprises a data acquisition and monitoring layer, an operation parsing layer, a friction detection layer, and a structured storage layer. The data acquisition and monitoring layer uses a hook mechanism to monitor every interface operation and network request behavior of the RPA robot, triggering a recording event when page navigation, button clicks, or data queries are detected. The operation parsing layer parses the collected raw operation flow, identifies the query jump sequences between systems, adds a precise timestamp to each operation record, and calculates the response latency of data synchronization requests—the time elapsed from the request being sent to the data return. The friction detection layer compares field names and data formats when the RPA robot queries the same device or fault information across different systems, recording a field mapping friction event when inconsistencies are found. The structured storage layer categorizes and stores the parsed operation trajectory data according to query jump sequences, timestamps, response latency, field mapping friction events, and retry behaviors for unsuccessful operations.

[0030] Furthermore, when an operation fails, the trajectory recording engine records the retry behavior of the unsuccessful operation, including the reason for the failure, the number of retries, and the time interval between each retry. The trajectory recording engine records the absolute timestamp of each unsuccessful operation retry behavior, forming a retry trajectory timestamp sequence arranged in chronological order. This sequence is stored independently as a component of the original operation trajectory log and is used for subsequent probability density distribution estimation.

[0031] S12. Operation and maintenance work order text event semantic encoding and event semantic vector generation, specifically: S121. The maintenance work order text first enters the text cleaning stage. This process removes irrelevant characters and formatting marks from the text. Irrelevant characters include special symbols, garbled characters, and repeated spaces. Formatting marks include font style tags, table border symbols, and line break characters. The cleaned text then enters the word segmentation stage, using an adaptive word segmentation tool for the power industry. This tool has a built-in power industry terminology dictionary covering power maintenance-specific vocabulary such as transformers, circuit breakers, feeders, grounding faults, and overloads, ensuring that equipment names and fault descriptions are completely segmented into independent words.

[0032] The word segmentation results are input into the named entity recognition model, which includes an input embedding layer, a bidirectional encoding layer, and a conditional random field (CRF) annotation layer. The input embedding layer converts the word sequence into a low-dimensional dense vector composed of character-level embeddings and word-level embeddings. The bidirectional encoding layer is composed of forward long short-term memory (LSTM) units and backward long short-term memory (LSTM) units connected in series. The forward unit processes the text sequence from left to right, and the backward unit processes the text sequence from right to left. The hidden states in both directions are concatenated at each word position to generate an encoded representation that incorporates the context. The CRF annotation layer models the dependency relationship between adjacent annotation labels through a state transition matrix, outputs the probability distribution of device name, fault phenomenon description, device state change description, time statement, or irrelevant words corresponding to each word position, and solves the globally optimal annotation sequence based on the Viterbi decoding algorithm. The recognition results are output in a structured form, providing standardized text input for subsequent semantic encoding.

[0033] The named entity recognition model is trained using power operation and maintenance work order samples labeled with equipment names, fault phenomenon descriptions, equipment status change descriptions, and time statements. The loss function is the log-likelihood loss of conditional random fields.

[0034] S122. The preprocessed text content is input into a pre-trained semantic coding model for the power sector. The semantic coding model adopts a pre-trained language model fine-tuned based on a power operation and maintenance corpus. Its structure includes an input embedding layer, a multi-layer Transformer encoder layer, and an output pooling layer. The input embedding layer converts text words into low-dimensional dense vector representations. These vector representations integrate word embeddings, positional embeddings, and paragraph embeddings, enabling the model to perceive word order and text paragraph structure.

[0035] The multi-layer Transformer encoder layer consists of multiple identical encoder blocks stacked together. Each encoder block includes a multi-head self-attention sublayer, a feedforward neural network sublayer, and a layer normalization sublayer. The multi-head self-attention sublayer captures long-distance dependencies between words at different positions in the text by calculating the dot product attention between the query vector, key vector, and value vector, thus establishing a semantic association between fault description words and device name words. The feedforward neural network sublayer performs non-linear transformation on the attention output to enhance the model's feature representation ability. The layer normalization sublayer normalizes the input and output of each layer, stabilizing the training process and accelerating convergence.

[0036] The output pooling layer performs a weighted average of all the word vectors output by the last encoder layer to generate a fixed-dimensional context semantic encoding vector. The vector comprehensively represents the global semantic information and local fault features of the work order text.

[0037] Semantic coding models in the power sector can be pre-trained on a power operation and maintenance corpus using a masked language model task, or fine-tuned under supervision using a power work order classification task.

[0038] S123. Extract the first semantic sub-vector corresponding to the fault phenomenon description and the second semantic sub-vector corresponding to the device state change description from the context semantic encoding vector. The extraction process uses the entity position index marked by the aforementioned named entity recognition model to locate the corresponding dimensional interval of the fault phenomenon description term in the context semantic encoding vector. The vector representations within this interval are then averaged to obtain the first semantic sub-vector. Similarly, the corresponding dimensional interval of the device state change description term is located and averaged to obtain the second semantic sub-vector.

[0039] The first and second semantic sub-vectors are weighted and concatenated. This weighted concatenation involves multiplying each sub-vector by its corresponding preset weight coefficient and then concatenating them along the vector dimension to generate the event semantic vector for each work order. The event semantic vector simultaneously encodes both fault phenomenon semantic information and equipment state evolution semantic information, providing a unified semantic representation basis for subsequent determination of the implicit causal propagation direction. The preset weight coefficients include a first weight coefficient and a second weight coefficient, corresponding to the fault phenomenon description and equipment state change description, respectively. The first weight coefficient ranges from 0.5 to 0.8, and the second weight coefficient is determined by subtracting the first weight coefficient from 1, with a corresponding range of 0.2 to 0.5. A classic value is 0.6 for the first weight coefficient and 0.4 for the second weight coefficient.

[0040] S13. Spatiotemporal alignment and joint encoding of operation trajectory logs and event semantic vectors, specifically: S131. Obtain the occurrence time of each work order as the baseline timestamp. The occurrence time is extracted from the time description identified in the work order text or determined by the work order creation time recorded by the system. Traverse all operation records in the RPA operation trajectory log and read the timestamp attached to each operation record. Compare the timestamp of each operation record with the baseline timestamp of each work order. When the timestamp of an operation record falls within a preset time window before or after a certain work order's baseline timestamp, mark the operation record as associated with that work order. The preset time window ranges from 5 minutes to 120 minutes, with a classic value of 30 minutes. Through this time alignment mechanism, ensure that the system query behavior, data synchronization behavior, and retry behavior in the operation trajectory log are accurately correlated with the abnormal events of the corresponding work orders. When the timestamp of an operation record falls into the intersection of multiple work order baseline time windows, calculate the absolute time difference between the operation record and each work order's baseline timestamp and associate it with the single work order with the smallest time difference.

[0041] S132. For each work order after spatiotemporal alignment, extract behavioral feature sub-vectors from all operation trajectory records associated with that work order: Data synchronization latency statistical features are obtained by calculating the mean, maximum, and standard deviation of the response latency for all data synchronization requests in the associated operation records; field mapping friction event count features are obtained by accumulating the number of mapping friction events occurring between the same device or fault field in different systems in the associated operation records; the number of retry attempts for unsuccessful operations is obtained by counting the total number of retries after operation failure in the associated operation records; the retry interval sequence statistical features are obtained by calculating the mean and variance of the time interval between each retry behavior in the associated operation records; and the cross-system query jump frequency features are obtained by counting the number of jumps in the cross-system query jump sequence in the associated operation records. Arrange and combine the above five types of features in a fixed order to form the behavioral feature sub-vectors for each work order. These behavioral feature sub-vectors quantify the propagation resistance and behavioral patterns of abnormal events at the information system level. Simultaneously, independently extract the original timestamp sequence of unsuccessful operation retry trajectories from the operation trajectory log associated with that work order, as the behavioral temporal association data for that work order. When the number of retries for unsuccessful operations is 0, the mean and variance in the retry interval sequence statistical features are both set to zero; when the number of retries for unsuccessful operations is 1, the variance is set to zero, and the mean is set to the single retry interval value.

[0042] S133. Concatenate the event semantic vector of each work order with the corresponding behavioral feature sub-vector to generate a causal semantic-behavioral fingerprint fusion feature vector: The vector concatenation adopts a first-to-last sequential connection method, combining all dimensions of the event semantic vector with all dimensions of the behavioral feature sub-vector in sequence to form a higher-dimensional fusion feature vector; This fusion feature vector simultaneously encodes the semantic content information of the abnormal event and the behavioral pattern information of cross-system operations, enabling the subsequent propagation chain inference module to jointly analyze the abnormal propagation path based on semantic association and behavioral trajectory.

[0043] Each work order generates a causal semantic-behavioral fingerprint fusion feature vector, which serves as a multidimensional representation of the work order in the distribution network abnormal event propagation chain, providing a unified feature input basis for the mapping calculation of node dynamic propagation attributes and the determination of implicit causal propagation direction.

[0044] Example 3 Preferably, in Embodiment 1, step S2 is specifically implemented through the following steps: S21. The fusion of feature vector decoupling mapping and implicit causal propagation direction determination is as follows: S211. Using the distribution network physical topology as a static skeleton, the construction process of the static skeleton includes collecting all bus nodes, feeder segment nodes, transformer nodes, circuit breaker nodes, and distributed energy access points in the distribution network as graph nodes, and collecting the overhead line connection relationships, cable connection relationships, and switch states between each node as undirected edges, forming a basic topology graph reflecting the actual electrical connection structure of the power grid. The causal semantic-behavioral fingerprint fusion feature vectors of each work order are decoupled, separating the event semantic vector and the behavioral feature sub-vector. The connection degree of the equipment involved in the work order in the distribution network physical topology is queried. The decoupled event semantic vector, behavioral feature sub-vector, and connection degree are jointly mapped to the dynamic propagation attributes of the nodes corresponding to each work order. The calculation process for node anomaly severity is as follows: the event semantic vector is compared with the pre-established normal working condition baseline vector, and the deviation between the two is calculated. The deviation is measured by cosine similarity by default. When the ratio of the magnitudes of the two vectors exceeds a preset multiple or is lower than the reciprocal of the preset multiple, Euclidean distance is used. The preset multiple ranges from 1.5 to 3.0, with a classic value of 2.0. Regardless of whether cosine similarity or Euclidean distance is used, the calculation results are normalized to the [0,1] interval through Min-Max and used as a unified node anomaly severity. The larger the deviation value, the more significant the difference between the abnormal state described by the work order and the normal working condition. The node operation resistance index is calculated as follows: Data synchronization delay statistics, field mapping friction event counts, and unsuccessful operation retry counts are extracted from the behavioral feature sub-vectors. The weighted sum of the mean data synchronization delay, field mapping friction event counts, and unsuccessful operation retry counts is used as the node operation resistance index. The sum of the weight coefficients of these three factors is 1. Under the constraint that the sum is 1, the weight coefficient for the mean data synchronization delay ranges from 0.3 to 0.5, the weight coefficient for the field mapping friction event count ranges from 0.2 to 0.4, and the weight coefficient for the unsuccessful operation retry count ranges from 0.2 to 0.4. The classic values ​​are 0.4, 0.3, and 0.3, respectively. The node influence range coefficient is calculated based on the connection degree of the equipment involved in the work order in the distribution network physical topology. The connection degree is the number of directly connected adjacent nodes of the equipment node in the static skeleton. The node influence range coefficient is equal to the connection degree of the equipment node divided by the maximum connection degree in the distribution network topology, mapped to the [0,1] interval. Through the above mapping, each work order node obtains a dynamic propagation attribute determined by both semantic and behavioral information, providing a quantitative basis for determining the direction of subsequent implicit causal propagation.

[0045] S212. Obtain the event semantic vector of the first work order and the event semantic vector of the second work order, concatenate the two event semantic vectors end to end to form a joint input vector, so that the semantic information of the two work orders is presented side by side in the same vector space; input the joint input vector into a pre-trained semantic entailment discrimination model, which includes a bidirectional semantic interaction coding layer, a multi-head cross-attention layer, a semantic difference aggregation layer, and an entailment probability output layer: The bidirectional semantic interaction coding layer consists of two structurally identical and parameter-shared coding branches. Each coding branch includes two fully connected layers and one activation layer, which perform nonlinear transformations on the event semantic vectors of the first and second work orders, respectively, to extract deep semantic feature representations of each work order. These deep semantic feature representations capture the abstract semantic patterns of fault phenomena and equipment status in the work order text. The multi-head cross-attention layer receives the deep semantic feature representations output from the two coding branches. By calculating the dot product attention between the query vector and the key vector, it captures the multi-dimensional interaction relationship between the semantic features of the first and second work orders, enabling the fault phenomenon description terms and equipment status change terms to establish a cross-work order semantic association, and outputs weighted interaction features. These weighted interaction features reflect the strength of the mutual dependence between the two work orders in the semantic space. The semantic difference aggregation layer concatenates and fuses the weighted interaction features output from the multi-head cross-attention layer with the deep semantic features output from the two coding branches. It then aggregates semantic difference information and interaction association information through a fully connected layer to generate implied discriminative features. These implied discriminative features comprehensively characterize the similarity, difference, and causal relationship of the semantic content of the two work orders. The implied probability output layer maps the implied discriminative features to a single real value, which is then converted into a semantic implied score between 0 and 1 through the sigmoid activation function. The semantic implied score quantifies the probability that the event state described by the first work order semantically constitutes the cause or premise of the event state described by the second work order.

[0046] The semantic implication discrimination model uses manually labeled causal work order pairs as training samples. Positive samples are work order pairs with causal implication, while negative samples are randomly selected work order pairs without causal relationship. The loss function is binary cross-entropy loss.

[0047] S213. When the semantic implication score exceeds a preset threshold, determine that the event state described by the first work order is semantically a cause or premise of the event state described by the second work order, and establish a candidate implicit causal propagation direction from the first work order to the second work order; wherein the preset threshold ranges from 0.5 to 0.8, the threshold is set to 0.7 to 0.8 when a higher semantic association certainty is required, the threshold is set to 0.5 to 0.6 when more potential associations need to be retained, and the classic value is 0.65.

[0048] For each work order pair, the semantic implication judgment process described above is executed. When the semantic implication score of the first work order pointing to the second work order exceeds a preset threshold, a directed edge is established from the first work order node to the second work order node, and this direction is marked as a candidate implicit causal propagation direction. A candidate implicit causal propagation direction indicates that, at the semantic level, the event described by the first work order may be the cause or premise of the event described by the second work order, but this direction has not yet been verified by the operation behavior trajectory and device topology, and belongs to the candidate propagation relationship to be verified, which needs to be confirmed in the subsequent double verification stage.

[0049] S22. Dual verification of retry trajectory timing and device topology constraints, specifically: S221. Extract the original timestamp sequence of all unsuccessful operation retry trajectories of the first work order from the operation trajectory log associated with the first work order; similarly, extract the original timestamp sequence of unsuccessful operation retry trajectories of the second work order from the operation trajectory log associated with the second work order.

[0050] The probability density distribution of the retry timestamp sequence for the first work order is estimated. The kernel density estimation method is used to calculate the probability density distribution of the retry behavior on the time axis. A Gaussian kernel function is used, and the bandwidth is adaptively determined using the Silverman rule or cross-validation. The time interval containing the peak of the probability density distribution is defined as the time window for the retry trajectory settling of the first work order. This time interval covers all consecutive moments where the probability density value exceeds half of the global peak. The same probability density distribution estimation is performed on the second work order to determine the time window for the retry trajectory settling of the second work order.

[0051] The retry trajectories of two work orders are compared temporally within their respective time windows. If the end time of the first work order's time window is earlier than the start time of the second work order's time window, the retry behavior of the unsuccessful operation in the first work order is determined to precede that of the second work order in temporal sequence, thus verifying the retry trajectory temporal sequence. This verification mechanism utilizes the operational friction temporal sequence at the information system level as bypass evidence for the direction of anomaly propagation, ensuring that the semantically determined causal direction is consistent with the temporal gradient of system operation obstruction. When the number of unsuccessful operation retries is less than a preset threshold, the earliest retry timestamp is directly used as the center of the retry trajectory time window, skipping the kernel density estimation step. The preset threshold ranges from 3 to 5 times, with a classic value of 3 times.

[0052] S222. Based on the equipment names corresponding to the first and second work orders, query the topological association relationship between the two equipment in the distribution network physical topology database. The topological association relationship includes electrical connection relationship and topological adjacency relationship: electrical connection relationship means that two equipment nodes form a direct electrical path through overhead lines, cables or switching equipment; topological adjacency relationship means that two equipment nodes are directly connected nodes in the distribution network physical topology diagram, that is, there are no intermediate equipment nodes between them.

[0053] When the query results indicate that there is an electrical connection or topological adjacency between the devices corresponding to two work orders, it is determined that the two work orders are directly related in physical space, and the device topology constraint verification is passed. If there is no electrical connection or topological adjacency between the two devices, the device topology constraint verification fails, and the candidate implicit causal propagation direction is filtered out. This verification mechanism ensures that the causal propagation direction determined at the semantic level is consistent with the physical topology of the distribution network, eliminating false causal associations of work orders that are unrelated across spaces.

[0054] S23. Construction of the abnormal event propagation chain topology and optimization of redundant paths, specifically: S231. Traverse all candidate implicit causal propagation directions between work order nodes and perform verification and judgment on each candidate direction one by one. When a candidate implicit causal propagation direction satisfies both the retry trajectory timing verification and the device topology constraint verification, the candidate direction is confirmed as a valid implicit causal propagation relationship; simultaneously satisfying both conditions means that the retry trajectory timing verification determines that the retry trajectory set time window of the first work order is earlier than that of the second work order, and the device topology constraint verification determines that there is an electrical connection relationship or a topological adjacency relationship between the corresponding devices of the two work orders.

[0055] All valid implicit causal propagation relationships are collected and organized into a set of directed edges. Each directed edge points from a work order node that semantically implies a causal event and whose operation trajectory precedes the previous one to a work order node that semantically implies a result event and whose operation trajectory follows the previous one. Using each work order as a graph node and the directed edges corresponding to all valid implicit causal propagation relationships as graph edges, an initial abnormal event propagation chain topology graph is constructed. This initial abnormal event propagation chain topology graph retains all implicit causal propagation paths that have passed double verification, serving as the basic structure for subsequent propagation weight calculation and topology optimization.

[0056] S232. Calculate the propagation weight for each directed edge in the initial anomaly propagation chain topology graph. The calculation of the propagation weight integrates three factors: semantic implication score, the pass strength of the retry trajectory timing verification, and the device topology adjacency distance. The semantic implication score is taken from the output value of the semantic implication discrimination model for the work order pair corresponding to the directed edge; a higher score indicates a stronger semantic causal relationship. The pass strength S of the retry trajectory timing verification... t Through formula S t = 1 - exp(-λ·Δt) is used for calculation, where Δt is the time interval of the time window of the retry trajectory of the two work orders, λ is the attenuation coefficient, which ranges from 0.001 to 0.1, with the classic value being 0.01. The larger the time interval, the clearer the order of operation friction and the higher the intensity of the process. The equipment topology adjacency distance score is the reciprocal of the shortest connection path length of the corresponding equipment of the two work orders in the distribution network physical topology, and is normalized to the [0,1] interval by Min-Max. The shorter the distance, the tighter the physical connection.

[0057] After normalizing the three factors, they are summed using preset weighting coefficients to obtain the propagation weight of the directed edge. The propagation weight quantitatively represents the probability and reliability of anomalies propagating along the directed edge. The preset weighting coefficients sum to 1. Under the constraint that the sum is 1, the semantic implication score weight coefficient ranges from 0.4 to 0.6, with a classic value of 0.5; the retry trajectory time series verification pass intensity weight coefficient ranges from 0.2 to 0.4, with a classic value of 0.3; and the device topology adjacency distance weight coefficient ranges from 0.1 to 0.3, with a classic value of 0.2.

[0058] S233. Traverse all directed edges in the initial anomaly propagation chain topology graph, comparing the propagation weight of each directed edge with a preset threshold. The preset threshold ranges from 0.3 to 0.6, with a classic value of 0.45. When the propagation weight is lower than the preset threshold, the directed edge is determined to be a weakly related edge and is removed from the initial anomaly propagation chain topology graph, resulting in a redundancy-free propagation chain topology graph. Perform branch merging on the redundancy-free propagation chain topology graph, identifying multiple downstream branch paths sharing the same upstream node. When the absolute difference in propagation weights between any two downstream branch paths is less than a preset tolerance, multiple branches are merged into a single convergence path. The propagation weight of the convergence path is the weighted average of the weights of the merged branches. The preset tolerance is measured in absolute difference form, ranging from 0.05 to 0.25, with a classic value of 0.10. By merging branches, the graph structure redundancy caused by the parallel propagation of multiple work orders due to the same anomaly is eliminated, resulting in a simplified and optimized anomaly propagation chain topology graph.

[0059] Example 4 Preferably, in Embodiment 1, step S3 is implemented through the following steps: S31. Reverse confidence root cause localization of the abnormal event propagation chain topology graph, specifically: S311. First, identify all terminal nodes in the abnormal event propagation chain topology graph. Terminal nodes are work order nodes with an out-degree of zero in the topology graph, that is, nodes without directed edges pointing to other work order nodes, representing the terminal affected nodes of the abnormal propagation. Treat each terminal node as a propagation unit and assign it an initial confidence level, which is equal to the node abnormality severity of the work order corresponding to that terminal node.

[0060] The calculation process for node anomaly severity is as follows: a normal operating condition baseline vector is pre-established, and the semantic vectors of all work order events that have been manually confirmed to be without anomalies during the historical normal operating period are selected. Their arithmetic mean is calculated as the normal operating condition baseline vector; or the K-Means algorithm is used for clustering, and the largest cluster center is taken as the normal operating condition baseline vector, where the value of K ranges from 2 to 5, with a classic value of 3; when there are multiple typical operating modes in the normal operation of the distribution network, the K-Means algorithm clusters the normal operating condition samples into K typical patterns, and takes the cluster center with the largest sample size as the baseline vector; when the normal operating condition is singular, the arithmetic mean is directly calculated as the normal operating condition baseline vector. The deviation between the event semantic vector of the current end node and the baseline vector of normal operating conditions is calculated. The deviation is measured by cosine similarity by default. When the ratio of the magnitudes of the two vectors exceeds a preset multiple or is less than the reciprocal of the preset multiple, Euclidean distance is used. The preset multiple ranges from 1.5 to 3.0, with a classic value of 2.0. A larger deviation value indicates a more significant difference between the abnormal state described by the current work order and the normal operating conditions, and a correspondingly higher severity of the node's anomaly. Through this mechanism, each end node obtains an initial confidence score matching its anomaly severity, providing a starting score for reverse confidence propagation.

[0061] S312. Following the reverse direction of the directed edges in the anomaly propagation chain topology, starting from the terminal node with all out-degrees of zero, propagate the confidence score upstream level by level. During propagation, the confidence score of the downstream node is multiplied by the propagation weight of the directed edge between it and the upstream node to obtain the contribution confidence score transmitted to that upstream node; the propagation weight is taken from the propagation weight of each directed edge calculated in the aforementioned topology optimization process, representing the probability and reliability of the anomaly propagating along that edge.

[0062] Each upstream node receives confidence scores from all downstream neighbor nodes via backpropagation. It accumulates the contribution confidence scores from each downstream node and then performs a weighted sum with its own node anomaly severity to obtain the root cause confidence score. The weighted sum is a linear combination of the accumulated downstream contribution confidence scores and its own node anomaly severity scores according to a preset weighting ratio. This preset weighting ratio includes the weights of the downstream contribution confidence scores and the node's own node anomaly severity scores, with a sum of 1. The downstream contribution confidence score weight ranges from 0.5 to 0.8, and the node's own node anomaly severity weight is determined by subtracting the downstream contribution confidence score weight from 1, with a corresponding range of 0.2 to 0.5. A classic value is a downstream contribution confidence score of 0.6 and a node's own node anomaly severity weight of 0.4. Through layer-by-layer backpropagation, the confidence score accumulates progressively from the end nodes towards the root cause. Nodes in the root cause direction gain higher root cause confidence scores due to the convergence of confidence scores from multiple downstream paths.

[0063] S313. Traverse all work order nodes in the anomaly propagation chain topology graph, and read the root cause confidence value of each node one by one. Compare the root cause confidence values ​​of all work order nodes and select the work order node with the highest root cause confidence value; locate this work order node as the root cause work order node, that is, determine it as the source node of the anomaly propagation chain. The root cause work order node semantically contains the causal event, precedes other nodes in the operation trajectory sequence, is located upstream in the anomaly propagation in the physical topology, and obtains the highest cumulative confidence value through the reverse confidence propagation mechanism, thus being identified as the root cause of the anomaly propagation chain. When multiple work order nodes have the same root cause confidence value, select the node with the highest anomaly severity as the root cause work order node; if the anomaly severity of nodes is still the same, select the work order with the earliest occurrence time as the root cause work order node.

[0064] S32. Historical case processing RPA trajectory reuse and collaborative processing closed loop, specifically: S321. First, read the anomaly type of the located root cause work order node. The anomaly type is obtained from the fault phenomenon description classification extracted from the event semantic vector of the work order. At the same time, read the topological structure features of the optimized anomaly event propagation chain topology graph. The topological structure features include propagation chain depth, number of branches, and number of convergence nodes: propagation chain depth refers to the number of directed edges from the root cause work order node to the farthest end node; number of branches refers to the number of independent downstream paths starting from the root cause work order node in the topology graph; and number of convergence nodes refers to the number of nodes in the topology graph that receive directed edges from multiple upstream nodes.

[0065] Anomaly types and topological features are combined to form search keys, and similarity searches are performed in a historical successful case database. Similarity calculation uses a weighted feature matching method, comparing the semantic consistency of anomaly types and the numerical similarity of topological features separately. The matching scores of the two types of features are then merged into a comprehensive similarity score according to preset weights. The preset weights are such that the sum of the two weights is 1. Under the constraint of a sum of 1, the weight for anomaly types ranges from 0.6 to 0.8, and the weight for topological features ranges from 0.2 to 0.4. The classic value is anomaly type weight of 0.7 and topological feature weight of 0.3. Historical successful cases are sorted from highest to lowest based on the comprehensive similarity score, and the historical successful case with the highest similarity score is selected as the target case for subsequent trajectory reuse.

[0066] S322. Retrieve the recorded system operation sequences from the historical successful handling cases with the highest similarity. These sequences include the interface operation steps executed sequentially in the production management system, geographic information system, and dispatch automation system. Simultaneously, retrieve the recorded operation parameters from the case, including equipment number, isolation range, protection setting adjustment, and switch on / off status. Then, retrieve the recorded operation timing from the case, including the waiting intervals and execution order between each step. Integrate the above operation sequences, operation parameters, and operation timing into an original RPA operation trajectory template.

[0067] Instantiated adaptation is performed based on the equipment information and fault parameters of the current root cause work order node. For the protection setting adjustment amount, a mapping relationship between the fault severity level and the proportional coefficient is established in advance. The fault severity is divided into four levels: minor, moderate, severe, and critical, with corresponding proportional coefficients of 0.5, 1.0, 1.5, and 2.0, respectively. The current fault severity is determined by the node anomaly severity of the root cause work order node. The preset intervals are as follows: the node anomaly severity interval for the minor level is [0, 0.3), for the moderate level it is [0.3, 0.6), for the severe level it is [0.6, 0.85), and for the critical level it is [0.85, 1.0]. Boundary values ​​are assigned to the higher level on the right. The level is determined according to the preset interval into which the node anomaly severity falls. The protection setting adjustment amounts in the historical successful handling case library are all stored in a standardized manner according to the moderate severity level (proportional coefficient 1.0). The standardized protection setting adjustment amount is multiplied by the proportional coefficient corresponding to the current level to obtain the current actual protection setting adjustment amount. For the isolation range, the current influence range is determined by comprehensively considering the node influence range coefficient and propagation chain depth of the current abnormal event propagation chain topology. The calculation method for the current influence range is: Current influence range = Node influence range coefficient × Propagation chain depth × Preset proportional coefficient, where the preset proportional coefficient ranges from 0.5 to 2.0, with a classic value of 1.0. The ratio of the current influence range to the isolation range of historical cases is calculated as the boundary correction coefficient. Using the coordinate position of the root cause device in the geographic information system as the scaling center point, the isolation range boundary in the historical cases is scaled proportionally according to this boundary correction coefficient. If the current influence range is larger than the isolation range of historical cases, the isolation boundary is expanded; if the current influence range is smaller than the isolation range of historical cases, the isolation boundary is reduced to obtain the current actual isolation range. The adapted protection setting adjustment amount, isolation range, and current device identifier are replaced in the original RPA operation trajectory template to generate an RPA operation trajectory template for the current abnormal event.

[0068] S323. Input the generated RPA operation trajectory template into the instruction parsing engine, and parse the instructions according to the type of the target system. For the distribution network production management system, parse and generate work order status update instructions, which include marking the root cause work order node status as "in urgent handling", marking the status of related downstream work orders as "pending confirmation", and updating the work order processing progress timestamp. For the geographic information system, parse and generate equipment location and isolation instructions, which include highlighting the root cause equipment location on the electronic map, delineating the boundary of the fault-affected area, and generating equipment isolation operation tickets. For the dispatch automation system, parse and generate protection setting adjustment and switch opening and closing instructions, which include issuing protection device setting modification instructions, generating remote control switch opening or closing sequences, and verifying switch status feedback signals.

[0069] Following the operation sequence recorded in the RPA operation trajectory template, the RPA robot sequentially issues and executes the aforementioned instructions to each relevant system. The RPA robot simulates human login to each system interface, automatically fills in the instruction parameters, and submits for execution. After completing each step, it waits for system response confirmation before proceeding to the next step, ensuring the correct timing and completeness of instructions in cross-system collaborative processing. When a step fails, the RPA robot automatically retryes according to a preset retry strategy. If the retry is successful, it continues to execute subsequent steps; if the number of retries exceeds the maximum number and still fails, it pauses the issuance of remaining instructions, marks the current execution status as partially failed, and reports it to the dispatch center for manual intervention.

[0070] S324. Throughout the entire process of issuing and executing cross-system collaborative processing instructions, an execution monitoring agent is deployed to track the actual execution status of each instruction in real time. The execution monitoring agent captures the execution result of each instruction by listening to the operation feedback interface of the RPA robot and the response logs of each business system. When a step is executed successfully, the success status code and completion timestamp of that step are recorded. When a step fails, the reason for the failure, the time of failure, and the retry behavior automatically triggered by the RPA robot are recorded. The retry behavior includes the number of retries, the time interval between each retry, and the final execution status. The failure reasons are categorized as system response timeout, target interface element changes, insufficient operation permissions, data verification failure, network connection abnormalities, and digital certificate authentication failure.

[0071] All failed operation steps and their corresponding retry behaviors are compiled into structured records. These records include the failed step number, target system type, operation type, failure cause classification, and retry trajectory timestamp sequence. These structured records are then written into a non-successful operation retry trajectory pattern library for probability density distribution estimation in subsequent retry trajectory time-series verification, enabling anomaly propagation chain inference to adaptively learn the latest system vulnerability behavior patterns.

[0072] Example 5 like Figure 2 As shown, a machine learning-based distribution network anomaly event propagation chain diagnosis system is used to implement a machine learning-based distribution network anomaly event propagation chain diagnosis method, including: The data fusion module, deployed at the edge acquisition node, logs into the power distribution network production management system, geographic information system, and dispatch automation system at preset intervals via RPA robots to collect operation and maintenance work order texts and operation trajectory logs. After text cleaning, power field named entity recognition, and semantic encoding, the operation trajectory logs and event semantic vectors are aligned and concatenated according to time windows to generate a causal semantic-behavioral fingerprint fusion feature vector, which is pushed to the propagation chain inference module in JSON format via the message bus. The propagation chain inference module, deployed on a cloud-based analysis node, receives the fused feature vector and decouples it into an event semantic vector and a behavior feature sub-vector, which are then mapped to the node's dynamic propagation attributes. The module determines the implicit causal propagation direction through a semantic implication discrimination model, and confirms the effective propagation relationship through retry trajectory timing verification and device topology constraint verification. It calculates the propagation weight, removes redundant edges, and constructs an optimized abnormal event propagation chain topology graph. The collaborative handling module is deployed on the scheduling execution node. Based on the propagation chain topology graph, it performs reverse confidence propagation to locate the root cause work order node. It retrieves similar cases from the historical successful handling case library and instantiates and adapts them into RPA operation trajectory templates. It parses them into cross-system collaborative handling instructions and issues them in sequence. It monitors execution feedback and updates the retry trajectory pattern library for unsuccessful operations.

[0073] In some embodiments, the machine learning-based distribution network anomaly propagation chain diagnosis system of the present invention can be implemented in a combination of hardware and software. As an example, the machine learning-based distribution network anomaly propagation chain diagnosis system of the present invention can be a processor in the form of a hardware decoding processor, which is programmed to execute the machine learning-based distribution network anomaly propagation chain diagnosis method of the present invention. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0074] The modules described in the embodiments of the present invention can be implemented in software or hardware. The names of the modules are not, in some cases, intended to limit the functionality of the module itself.

[0075] An electronic device according to an embodiment of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned machine learning-based distribution network anomaly event propagation chain diagnosis methods. That is, an electronic device according to an embodiment of the present invention may include, but is not limited to: a processor and a memory; the memory is used to store the computer program; the processor is used to execute the machine learning-based distribution network anomaly event propagation chain diagnosis method shown in any embodiment of the present invention by calling the computer program.

[0076] In one alternative embodiment, an electronic device is provided, such as Figure 3 As shown, Figure 3 The illustrated electronic device 4000 includes a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, for example, via a bus 4002. Optionally, the electronic device 4000 may further include a transceiver 4004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 4004 is not limited to one type, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of the present invention.

[0077] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. Processor 4001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0078] Bus 4002 may include a path for transmitting information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 4002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 3 The bus 4002 is represented by only one thick line, but this does not mean that there is only one bus or one type of bus.

[0079] The memory 4003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0080] The memory 4003 stores application code (computer program) for executing the present invention, and its execution is controlled by the processor 4001. The processor 4001 executes the application code stored in the memory 4003 to implement the content shown in the foregoing method embodiments.

[0081] Among them, electronic devices can also be terminal devices, which can be any device that can install applications, including at least one of smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, smart TVs, and smart in-vehicle devices.

[0082] It should be noted that, Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.

[0083] An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-mentioned machine learning-based methods for diagnosing the propagation chain of abnormal events in a power distribution network.

[0084] Alternatively, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device, etc.

[0085] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned machine learning-based distribution network anomaly event propagation chain diagnosis method and system.

[0086] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0087] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation that may be implemented in the methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0088] The computer-readable storage medium provided in this invention can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EEPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0089] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0090] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0091] It should be noted that the terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and represent a limitation on a specific order or sequence. Where appropriate, the order of use for similar objects can be interchanged so that the embodiments of this application described herein can be implemented in an order other than that shown or described.

[0092] Those skilled in the art will recognize that this invention can be implemented as a system, method, or computer program product. Therefore, this invention can be specifically implemented in the following forms: it can be entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this invention can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0093] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A machine learning-based method for diagnosing the propagation chain of abnormal events in a power distribution network, characterized in that, include: RPA logs into various business systems, collects operation and maintenance work orders and operation trajectory logs, and extracts event semantic vectors; The operation trajectory log and the event semantic vector are spatiotemporally aligned and jointly encoded to generate a causal semantic-behavioral fingerprint fusion feature vector; The causal semantic-behavioral fingerprint fusion feature vector is decoupled and mapped to node dynamic propagation attributes, and the implicit causal propagation direction is determined based on the semantic implication relationship between event semantic vectors; Through joint verification of operational behavior trajectories and equipment topology, an abnormal event propagation chain topology diagram was constructed and optimized. Based on the abnormal event propagation chain topology, the root cause node is located by reverse confidence propagation. Generate and issue cross-system collaborative handling instructions based on historical handling cases, and capture execution feedback logs to update the retry trajectory pattern library for unsuccessful operations.

2. The method for diagnosing the propagation chain of abnormal events in a power distribution network based on machine learning according to claim 1, characterized in that, The RPA logs into various business systems and collects operation and maintenance work orders and operation logs, specifically including: The RPA robot simulates human operation and automatically logs into the power distribution network production management system, geographic information system and dispatch automation system according to a preset cycle, keeping the sessions of each system continuously effective. Iterate through the work order list interfaces of each system and collect multi-format operation and maintenance work order text data through interface element parsing and OCR recognition. During cross-system operations, RPA operation trajectory logs are recorded in real time. These logs include query jump sequences between systems, timestamps, response delays for data synchronization requests, mapping friction records of the same device or fault field between different systems, and retry behavior records after operation execution failures.

3. The method for diagnosing the propagation chain of abnormal events in a power distribution network based on machine learning according to claim 1, characterized in that, The extraction of the event semantic vector specifically includes: Text cleaning is performed on the text content of maintenance work orders to remove irrelevant characters and format marks. Adaptive word segmentation tools in the power field are used for word segmentation. The named entity recognition model is used to identify equipment names, fault phenomenon descriptions, equipment status change descriptions and time statements from the text. The preprocessed text content is input into a pre-trained semantic coding model in the power field. The semantic coding model adopts a pre-trained language model fine-tuned based on the power operation and maintenance corpus and outputs the context semantic coding vector of each work order. From the context semantic encoding vector, extract the first semantic sub-vector corresponding to the fault phenomenon description and the second semantic sub-vector corresponding to the equipment state change description, and weight and concatenate the first semantic sub-vector and the second semantic sub-vector to generate the event semantic vector of each work order.

4. The method for diagnosing the propagation chain of abnormal events in a power distribution network based on machine learning according to claim 1, characterized in that, The operation trajectory log and the event semantic vector are spatiotemporally aligned and jointly encoded to generate a causal semantic-behavioral fingerprint fusion feature vector, specifically including: The occurrence time of each work order is obtained as the reference timestamp. Each operation record in the operation trajectory log is time-aligned with the reference timestamp of each work order according to the operation timestamp. When the operation timestamp of an operation record falls within a preset time window before or after the reference timestamp of a certain work order, the operation record is marked as associated with that work order. For each work order, behavioral feature sub-vectors are extracted from all operation trajectory records associated with that work order. The behavioral feature sub-vectors include data synchronization latency statistical features, field mapping friction event count features, unsuccessful operation retry count features, retry interval sequence statistical features, and cross-system query jump frequency features. The event semantic vector of each work order is concatenated with the corresponding behavioral feature sub-vector to generate the causal semantic-behavioral fingerprint fusion feature vector of each work order.

5. The method for diagnosing the propagation chain of abnormal events in a distribution network based on machine learning according to claim 1, characterized in that, The causal semantic-behavioral fingerprint fusion feature vector is decoupled and mapped to node dynamic propagation attributes. The implicit causal propagation direction is determined based on the semantic implication relationship between event semantic vectors. Specifically, this includes: Using the physical topology of the distribution network as a static skeleton, the causal semantic-behavioral fingerprint fusion feature vector of each work order is decoupled into event semantic vector and behavioral feature sub-vector. Combined with the equipment topology information, the decoupled vector is mapped to the dynamic propagation attributes of the nodes corresponding to each work order. The dynamic propagation attributes include node anomaly severity, node operation resistance index and node influence range coefficient. Obtain the event semantic vector of the first work order and the event semantic vector of the second work order. Concatenate the two event semantic vectors and input them into the pre-trained semantic implication discrimination model to output the semantic implication score. When the semantic implication score exceeds a preset threshold, it is determined that the event state described by the first work order constitutes the cause or premise of the event state described by the second work order in terms of semantics, and a candidate implicit causal propagation direction from the first work order to the second work order is established.

6. The method for diagnosing the propagation chain of abnormal events in a power distribution network based on machine learning according to claim 5, characterized in that, The verification, based on the combined analysis of operational behavior trajectories and device topology, specifically includes: Extract the timestamp sequence of unsuccessful operation retry trajectory from the operation trajectory log associated with the first work order, and extract the timestamp sequence of unsuccessful operation retry trajectory from the operation trajectory log associated with the second work order. Estimate the probability density distribution of the two retry timestamp sequences respectively, and determine the time interval where the probability density peak is located as the concentrated time window of the retry trajectory of each work order. When the concentrated time window of the first work order is earlier than the concentrated time window of the second work order, the retry trajectory time sequence is verified. The topological relationships of distribution network equipment are queried based on the equipment names corresponding to the first and second work orders. When there is an electrical connection or topological adjacency relationship between the equipment corresponding to the two work orders, the equipment topology constraints are verified.

7. The method for diagnosing the propagation chain of abnormal events in a power distribution network based on machine learning according to claim 6, characterized in that, The construction and optimization of the abnormal event propagation chain topology specifically includes: When a candidate implicit causal propagation direction passes both the retry trajectory timing verification and the device topology constraint verification, the candidate implicit causal propagation direction is confirmed as a valid implicit causal propagation relationship. An initial abnormal event propagation chain topology graph is constructed with each work order as a node and all valid implicit causal propagation relationships as directed edges. A propagation weight is calculated for each directed edge in the initial abnormal event propagation chain topology graph. The propagation weight is determined based on the semantic implication score, the pass strength of the retry trajectory timing verification, and the device topology adjacency distance. Redundant directed edges with propagation weights below a preset threshold are removed, and branches of the topology with multiple propagation branches and propagation weight differences less than a preset tolerance are merged. Branch paths that share the same upstream node are merged to obtain the optimized abnormal event propagation chain topology.

8. The method for diagnosing the propagation chain of abnormal events in a power distribution network based on machine learning according to claim 1, characterized in that, Based on the aforementioned abnormal event propagation chain topology, the root cause node is located through reverse confidence propagation, specifically including: Using each work order node in the abnormal event propagation chain topology as a propagation unit, the initial confidence of each terminal node is set to the node abnormality severity in its node dynamic propagation attribute. The confidence score is propagated from all end nodes with zero out-degree to upstream nodes in the reverse direction of the directed edges. The confidence score of the downstream node is multiplied by the propagation weight of the directed edge between it and the upstream node and then passed to the upstream node. Each upstream node calculates the weighted sum of the confidence scores propagated from all downstream nodes and its own node anomaly severity to obtain the root cause confidence score of that node. Traverse all work order nodes in the abnormal event propagation chain topology graph and locate the work order node with the highest root cause confidence as the root cause work order node; when multiple work order nodes have the same root cause confidence, select the node with the highest abnormality severity as the root cause work order node; if the abnormality severity of nodes is still the same, select the work order with the earliest occurrence time as the root cause work order node.

9. The method for diagnosing the propagation chain of abnormal events in a power distribution network based on machine learning according to claim 1, characterized in that, The process of generating and issuing cross-system collaborative handling instructions based on historical handling cases, and capturing execution feedback logs to update the retry trajectory pattern library for unsuccessful operations, specifically includes: Using the anomaly type of the root cause work node and the topological structure features of the anomaly event propagation chain topology as search keys, a similarity search is performed in the historical successful handling case database. Select the historical successful handling cases with the highest similarity, extract the operation sequences, operation parameters and operation timing of each system recorded in the cases, and instantiate and adapt them by combining the equipment information and fault parameters of the current root cause work order node to generate RPA operation trajectory templates; The RPA operation trajectory template is parsed into work order status update instructions for the power distribution network production management system, equipment location and isolation instructions for the geographic information system, and protection setting adjustment and switch opening and closing instructions for the dispatch automation system. These instructions are then issued and executed sequentially according to the time sequence recorded in the operation trajectory template. Monitor and capture the actual execution results of cross-system collaborative handling instructions, record the operation steps that fail to execute and the corresponding retry behavior, and update the operation steps that fail to execute and the corresponding retry behavior to the unsuccessful operation retry trajectory pattern library.

10. A machine learning-based diagnostic system for the propagation chain of abnormal events in a power distribution network, characterized in that, The method for diagnosing the propagation chain of abnormal events in a power distribution network based on machine learning, as described in any one of claims 1-9, includes: The data fusion module is used to log in to various business systems of the power distribution network via RPA to collect operation and maintenance work orders and operation trajectory logs, perform event semantic encoding on the text content of each operation and maintenance work order, extract event semantic vectors, and perform spatiotemporal alignment and joint encoding of the operation trajectory logs and event semantic vectors to generate causal semantic-behavioral fingerprint fusion feature vectors. The propagation chain inference module is used to decouple the causal semantic-behavioral fingerprint fusion feature vector into event semantic vectors and behavioral feature sub-vectors for each work order, map the decoupled vectors to node dynamic propagation attributes, determine the implicit causal propagation direction based on the semantic implication relationship between the event semantic vectors, and construct and optimize the abnormal event propagation chain topology graph through joint verification of the operation behavior trajectory in the behavioral feature sub-vectors and the device topology. The collaborative handling module is used to locate the root cause work order node by reverse confidence propagation based on the topology of the abnormal event propagation chain, generate and issue cross-system collaborative handling instructions based on historical handling cases, and capture execution feedback logs to update the retry trajectory pattern library for unsuccessful operations.

Images