A power system fault analysis method, device, equipment and storage medium

Abstract

The application discloses a kind of power system fault analysis method, device, equipment and storage medium, applied to electric power system technical field, method includes: respectively extracting the operating state data and protection action data of target electric power system in selected time period;From operating state data, extract the abnormal data corresponding to different electric power attribute index;At least based on abnormal data, the abnormal event set of target electric power system is constructed;Get the first association result between each abnormal event;Based on the cause-effect relationship of each protection action event and each abnormal event in protection action data, obtain second association result;At least based on the fault correlation event determined, obtain the fault analysis result of target electric power system.The electric power system fault analysis method, device, equipment and storage medium provided by the application can analyze the internal cause in depth according to the fault appearance, effectively improve the safety and reliability of electric power system operation.

Description

Technical Field

[0001] This invention relates to the field of power system technology, and in particular to a power system fault analysis method, apparatus, equipment and storage medium. Background Technology

[0002] Timely fault analysis of the power system after a failure can accurately pinpoint the cause and location of the failure, effectively prevent similar failures from recurring, and significantly improve the safety and reliability of the power grid. It is an important technical support for ensuring the stable operation and continuous improvement of the power system.

[0003] Existing fault analysis methods rely on simplistic attribution based on the symptoms of a fault. For example, when a power outage occurs, maintenance personnel often attribute the fault directly to the power source itself based solely on the tripping of the power switch. However, this analytical approach over-relies on appearances and experiential intuition, neglecting the underlying causes of the power outage. This leads to the inability to identify the true root cause of the fault, resulting in frequent fault occurrences and ultimately affecting the safety and reliability of the power system. Summary of the Invention

[0004] This invention provides a power system fault analysis method, apparatus, equipment, and storage medium to address the technical problem of existing technologies that rely excessively on appearances and experiential intuition, failing to delve into the root causes of fault phenomena, leading to frequent faults, thereby improving the safety and reliability of power system operation.

[0005] To address the aforementioned technical problems, this invention provides a power system fault analysis method, apparatus, device, and storage medium, the method comprising: Extract the operating status data and protection action data of the target power system within a selected time period, wherein the selected time period is determined by the fault time of the target power system; Abnormal data corresponding to different power attribute indicators are extracted from the operating status data; Based at least on the abnormal data, construct a set of abnormal events for the target power system; Based on the temporal sequence of each abnormal event in the abnormal event set, a first correlation result between each abnormal event is obtained; Based on the causal relationship between each protection action event and each abnormal event in the protection action data, a second correlation result is obtained; Based on the first association result, the second association result, and the current fault information of the target power system, fault association events are determined; Based at least on the fault-related events, the fault analysis results of the target power system are obtained.

[0006] Preferably, the selected time period is determined by the fault time of the target power system, including: In response to a fault signal from the target power system, the fault time is determined; Extract fault waveform data for a preset time period prior to the fault time; Based on the mutation detection technology, the fault waveform data is analyzed to obtain a fault frequency score. The fault frequency score is processed to determine the selected time period.

[0007] Preferably, the step of extracting abnormal data corresponding to different power attribute indicators from the operating status data includes: The operating status data is processed based on the power attribute indicators to determine the first power characteristic; The operating status data is processed using wavelet transform technology to obtain the second power characteristic; The operational status data is input into a pre-built fault model for processing to obtain the third power characteristic; The abnormal data is determined based on the first power characteristic, the second power characteristic, and the third power characteristic.

[0008] Preferably, the method for analyzing power system faults further includes, at least based on the abnormal data, constructing an abnormal event set for the target power system. Extract fault alarm signals of the target power system within the selected time period; The fault alarm signal is processed to determine the alarm abnormal event; Based on the abnormal data, the abnormal event is obtained; Based on the alarm exception events and the exception events, the exception event set is obtained.

[0009] Preferably, obtaining the first correlation result between the various abnormal events based on the temporal sequence of each abnormal event in the abnormal event set includes: Arrange the various abnormal events in chronological order to obtain an abnormal event sequence; Based on a preset time window, pairing analysis is performed on each of the abnormal events in the abnormal event sequence to determine time-adjacent event pairs; Analyze the statistical characteristics of the time-proximity event pairs in the sequence of anomalous events to obtain the correlation strength within the time-proximity event pairs; Based on the correlation strength, the first correlation result is generated.

[0010] Preferably, the step of obtaining the second correlation result based on the causal relationship between each protection action event and each abnormal event in the protection action data includes: The protection action events are time-aligned with the abnormal event sequence to obtain individual abnormal protection event pairs; Based on the power system protection logic rules, the causal logic relationship of each abnormal protection event pair is analyzed, and the causal mapping relationship between each abnormal event and the protection action event is constructed based on the analysis results. Integrate all the aforementioned causal mapping relationships to generate the second association result.

[0011] Preferably, obtaining the fault analysis results of the target power system based at least on the fault-related events includes: Identify the associated devices corresponding to the fault-related events; Based on the topology of the target power system, analyze the impact of the associated equipment on the faulty equipment, and determine the faulty associated equipment; The fault-related devices are analyzed to determine the fault condition; Based on the aforementioned fault conditions, an optimized solution is obtained; The fault analysis results are obtained based on the fault-related devices, the fault-related events, and the optimization scheme.

[0012] The present invention also provides a power system fault analysis device, comprising: The extraction module is used to extract the operating status data and protection action data of the target power system within a selected time period, wherein the selected time period is determined by the fault time of the target power system. An anomaly module is used to extract anomaly data corresponding to different power attribute indicators from the operating status data; The event module is used to construct a set of abnormal events for the target power system based at least on the abnormal data. The first module is used to obtain a first correlation result between the various abnormal events based on the temporal sequence of each abnormal event in the abnormal event set. The second module is used to obtain a second correlation result based on the causal relationship between each protection action event and each abnormal event in the protection action data; The fault module is used to determine fault-related events based on the first association result, the second association result, and the current fault information of the target power system; The results module is used to obtain fault analysis results of the target power system based at least on the fault-related events.

[0013] The present invention also provides a power system fault analysis device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the power system fault analysis method as described above.

[0014] The present invention further provides a computer-readable storage medium storing a computer program, wherein when the device containing the computer-readable storage medium executes the computer program, it implements the power system fault analysis method as described above.

[0015] Compared with the prior art, the beneficial effects of the present invention are at least one of the following: This invention extracts operational status data and protection action data of the target power system within a selected time period, and further extracts abnormal data corresponding to different power attribute indicators from the operational status data to construct an abnormal event set, thus moving beyond simple attribution based solely on fault symptoms. Based on this, a first correlation result is obtained from the temporal sequence of each abnormal event in the abnormal event set, and a second correlation result is obtained from the causal relationship between protection action events and abnormal events. Combining the first and second correlation results with current fault information, fault-related events are determined, ultimately yielding the fault analysis result. This overcomes the limitations of traditional methods that directly attribute faults to the power source based solely on symptoms such as tripping. It systematically uncovers the temporal correlations and causal chains between different abnormal events behind the fault, accurately locating the true root cause of the fault, thereby effectively reducing the recurrence of similar faults and significantly improving the safety and reliability of power system operation. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating a power system fault analysis method in one embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a power system fault analysis device in one embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a power system fault analysis device in one embodiment of the present invention; Figure label: Among them, 11. Extraction module; 12. Exception module; 13. Event module; 14. First module; 15. Second module; 16. Fault module; 17. Result module; 21. Processor; 22. Memory. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0018] In the description of this invention, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined with "first," "second," "third," etc., may explicitly or implicitly include one or more of that feature. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0019] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items. Those skilled in the art will understand the specific meaning of these terms in this invention based on the specific circumstances.

[0020] In the description of this invention, it should be noted that, unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing specific embodiments only and is not intended to limit the invention. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0021] Timely fault analysis is crucial for the safety and reliability of power systems. Existing methods rely too heavily on appearances and experiential intuition for simplistic attributions, neglecting root causes, leading to frequent faults and impacting the safe and reliable operation of the system.

[0022] Fault phenomena are the directly observable results exhibited by a power system, such as switch tripping, voltage drops, or power outages. The cause of the fault, however, is the root cause triggering these results, such as aging line insulation, internal equipment short circuits, or malfunctioning protection devices. Traditional methods are ineffective because there are often multiple causal chains and time delays between the phenomenon and the cause. A tripping event might be triggered by a current distortion seconds earlier, which in turn stems from an earlier equipment defect. Focusing solely on the phenomenon leads to mistaking the tripping itself for the cause, thus missing the true origin of the fault. The phenomenon is the result, while the cause is the starting point. Without reconstructing the complete chain from the starting point to the result, the root cause cannot be located. This is precisely the fundamental reason why this invention addresses the problem at its source and prevents recurring faults.

[0023] The difference between a fault symptom and its cause can be understood using the example of a car malfunction. A car suddenly stalls while driving, and the engine malfunction light on the dashboard illuminates—this is a symptom. If you immediately conclude that the engine is damaged and require a major overhaul based solely on the malfunction light, it's likely a misdiagnosis. The real cause of the stalling could be a blown fuel pump fuse, a clogged fuel line, excessive carbon buildup on the throttle body, a faulty crankshaft position sensor, or even a loose battery connection. The repair solutions for different causes are completely different: replacing a fuse is simply replacing a small component, cleaning the fuel line requires disassembling the fuel supply system, and a major engine overhaul requires disassembling the entire engine assembly—the workload can range from a few minutes to several days. Simply attributing a cause to the symptom not only wastes a huge amount of time and manpower, but the problem will also quickly reappear because the root cause hasn't been addressed. Traditional electrical fault analysis methods, which directly blame the power supply based on a tripped circuit breaker, are like assuming the engine is broken just because the malfunction light illuminates after the car stalls, without checking the fuel system, electrical circuits, sensors, and other potential causes. This solution extracts operational status data and protection action data, constructs an abnormal event set, and performs time-series and causal correlation analysis. This is equivalent to performing a comprehensive fault code reading, oil pressure detection, circuit measurement, and sensor signal analysis on the car, thereby accurately locating whether it is a blown fuse or an oil circuit blockage, truly achieving targeted repair.

[0024] One embodiment of the present invention provides a power system fault analysis method. For details, please refer to [link to relevant documentation]. Figure 1 , Figure 1 The diagram shown is a flowchart illustrating a power system fault analysis method according to one embodiment of the present invention, including: S1. Extract the operating status data and protection action data of the target power system within the selected time period. The selected time period is determined by the fault time of the target power system. S2. Extract abnormal data corresponding to different power attribute indicators from the operating status data; S3. Construct a set of abnormal events for the target power system, based at least on abnormal data; S4. Based on the temporal sequence of each abnormal event in the abnormal event set, obtain the first correlation result between each abnormal event; S5. Based on the causal relationship between each protection action event and each abnormal event in the protection action data, the second correlation result is obtained; S6. Based on the first correlation result, the second correlation result, and the current fault information of the target power system, determine the fault correlation event; S7. Obtain fault analysis results for the target power system based at least on fault-related events.

[0025] First, operational status data and protection action data of the target power system are extracted within a selected time period, determined by the fault time of the target power system. In response to the fault signal from the target power system, the fault time is determined; fault waveform data for a preset time period prior to the fault time is extracted; the fault waveform data is analyzed using abrupt change detection technology to obtain a fault frequency score; the fault frequency score is then processed to determine the selected time period.

[0026] The target power system refers to the specific power network object for which fault analysis is required. The selected time period refers to a dynamically defined time window for data extraction based on the fault time. Operating status data refers to data recording changes in electrical quantities during power system operation, such as voltage and current. Protection action data refers to data recording the actions of relay protection devices. Fault time refers to the specific moment when a fault occurs in the power system and is detected. Fault signal refers to the trigger signal issued by the power system after detecting an anomaly. The preset time period refers to a fixed time range pre-set before the fault time. Fault waveform data refers to detailed data recording changes in electrical waveforms before and after the fault. Abrupt change detection technology refers to signal processing methods used to identify points of sudden change in a data sequence. The fault frequency score is a quantitative indicator reflecting the probability of a fault, calculated through abrupt change detection.

[0027] First, the system monitors fault signals in the target power system in real time. Once a signal is received, the fault time is immediately determined to the millisecond level. At this point, the system extracts fault waveform data within a relatively long preset time period. This preset time period is an empirical initial search range, such as data from 7 days prior to the fault time. The purpose is to ensure that no historical signs or progressive anomalies that may be related to the current fault are missed, which is equivalent to a coarse sieve.

[0028] Next, the system applies abrupt change detection techniques to the waveform data within this preset time period, such as calculating the rate of change of signal variance, wavelet transform modulus maxima, or cumulative sum of abrupt changes under a sliding window. Through point-by-point or segment-by-segment scanning, the system calculates a fault frequency score, which reflects the probability of an abnormal abrupt change at each time point in the data sequence. A higher score indicates that the moment is more likely to be the start or turning point of the anomaly. Then, the system processes this continuous score curve, for example, by setting a dynamic threshold or finding local peaks in the score. From the long preset time period, it automatically identifies the starting moment when the anomaly begins to rise significantly and the ending moment when the anomaly returns to stability, thereby defining a more compact and relevant selected time period, such as 30 seconds before the fault and 10 seconds after the fault.

[0029] The reason for not directly using a preset time period, but instead using mutation detection to further determine the selected time period, is that while a preset time period ensures completeness, it contains a large amount of normal operation data unrelated to the current fault. Directly using this data for subsequent analysis would introduce noise, increase computational burden, and obscure the temporal boundaries of causal relationships. The selected time period, on the other hand, is a critical window dynamically tailored based on the unique data characteristics of this fault. It precisely encompasses the entire process from the emergence and development of the anomaly to its removal, eliminating irrelevant and redundant information. This provides a cleaner and more focused data foundation for subsequent anomaly extraction, temporal correlation, and causal analysis.

[0030] Secondly, abnormal data corresponding to different power attribute indicators are extracted from the operational status data. Based on the power attribute indicators, the operational status data is processed to determine the first power characteristic; wavelet transform technology is used to process the operational status data to obtain the second power characteristic; the operational status data is input into a pre-constructed fault model for processing to obtain the third power characteristic; based on the first, second, and third power characteristics, abnormal data are identified.

[0031] Power attribute indicators refer to specific physical quantities that measure the operating state of a power system, such as three-phase current, three-phase voltage, frequency, and power. Operating state data refers to the numerical sequence recording the changes of these power attribute indicators over time. The first power characteristic refers to deterministic features directly obtained through conventional calculation methods based on power attribute indicators, such as the effective value of fault current, abrupt changes, or harmonic content. Wavelet transform is a time-frequency analysis method that can decompose signals to different frequency scales, thereby locating abrupt changes and extracting energy in specific frequency bands. The second power characteristic refers to the high-frequency transient component energy or singularity features extracted from operating state data using wavelet transform. A pre-built fault model refers to a deep learning model, such as a one-dimensional convolutional neural network, that has been trained in advance using historical fault data. The third power characteristic refers to the fault type probability vector directly output by the model after inputting operating state data. Abnormal data refers to data points or segments that deviate from the normal operating state, determined by combining the above three power characteristics.

[0032] After acquiring the operational status data, different power attribute indicators are processed separately. Taking current and voltage as an example, three independent feature extraction channels are started in parallel.

[0033] Channel 1 is used to determine the first electrical characteristic using a physical rule engine. The system directly calculates the original sampling points: for example, calculating the effective value for each cycle, obtaining the abrupt change through the difference between the current value and the previous cycle value, and calculating the content of each harmonic through Fast Fourier Transform. These characteristics are based on explicit physical formulas and fixed thresholds; for example, an overcurrent is determined when the effective value exceeds 1.2 times the rated current. The results are deterministic and interpretable.

[0034] Channel two is used to obtain the second electrical characteristic using wavelet transform technology. The system selects a suitable wavelet basis function, such as the db4 wavelet, to perform multi-level decomposition of the operating status data. Wavelet transform can separate high-frequency transient components from power frequency components in the signal. For weak faults such as high-resistance grounding, the change in power frequency current may not be obvious, but the high-frequency transient energy will increase significantly. The system extracts the wavelet coefficient energy values ​​or modulus maxima points in specific frequency bands as the second electrical characteristic, specifically used to identify weak faults that are difficult to detect using traditional thresholding methods.

[0035] Channel 3 is used to obtain the third electrical characteristic by inputting operational status data into a pre-built fault model. This model is trained in advance using a large amount of labeled historical waveform data, such as a one-dimensional convolutional neural network. The model input is the original current and voltage sampling sequence, and the output is a probability vector, for example, the probability of phase A grounding is 0.8, the probability of phase B grounding is 0.1, the probability of phase C grounding is 0.05, and the probability of phase-to-phase short circuit is 0.05. This model can automatically learn deep patterns in the waveform, such as waveform distortion characteristics corresponding to different fault types.

[0036] The arbitrator calculates the optimal estimate based on the historical accuracy weights of each channel and the quality score of the current input data. For example, when the waveform is clear and the fault characteristics are obvious, the results from the physical rule engine and wavelet transform have higher confidence; when there is noise interference or weak fault characteristics, the output weights of the deep learning model are increased accordingly. While outputting the primary decision value, the arbitrator also retains alternative values ​​and their confidence levels. For example, the primary decision is a ground fault with a confidence level of 0.92, and the alternative set includes a ground fault with a confidence level of 0.05 for phase B and 0.03 for phase C. Finally, the system outputs the data points or segments that are fused and determined to be abnormal as anomalous data.

[0037] The reason for employing these three methods in parallel processing and then fusing them, rather than using only one, is that each method has its inherent limitations. The physical rule engine relies on manually set fixed thresholds, which are prone to missed or misjudged faults near these thresholds or for novel faults. While wavelet transform can capture transient signals, the choice of wavelet basis functions and the setting of the decomposition level significantly impact the results, requiring human experience. Deep learning models, although powerful, are essentially black boxes and may give incorrect predictions in scenarios with insufficient training data coverage. By computing these three methods in parallel and dynamically fusing them through an arbitrator, the interpretability and determinism of physical rules are preserved, wavelet transform compensates for sensitivity to subtle faults, and deep learning captures complex nonlinear patterns. The three methods mutually verify and complement each other's weaknesses, ultimately resulting in more robust and accurate anomaly detection results.

[0038] Next, based at least on the abnormal data, an abnormal event set of the target power system is constructed. This involves extracting fault alarm signals from the target power system within a selected time period; processing the fault alarm signals to identify alarm abnormal events; obtaining abnormal events based on the abnormal data; and finally, obtaining the abnormal event set based on the alarm abnormal events and the abnormal events themselves.

[0039] An abnormal event set refers to a collection of multiple abnormal events, used to describe all abnormal situations occurring in a target power system within a selected time period. A fault alarm signal refers to an unstructured or semi-structured text message automatically generated by a monitoring system, protection device, or intelligent electronic device during power system operation, used to indicate changes in equipment status or abnormal conditions. An alarm abnormal event refers to an event object obtained after semantic parsing and structuring of a fault alarm signal, containing standardized fields such as equipment identifier, action type, and timestamp. Abnormal data refers to numerical features or data segments extracted from operating status data that deviate from the normal operating range. An abnormal event refers to an event object constructed based on abnormal data, typically including the time of the abnormality, the relevant power attribute indicators, and a specific description of the abnormality. An abnormal event set is the summative collection of the aforementioned alarm abnormal events and abnormal events.

[0040] First, from the station monitoring system or alarm subscription service, filter out all alarm texts generated within the previously determined start and end times of the selected time window. Each alarm signal typically includes fields such as timestamp, device name, alarm description text, and alarm level.

[0041] A language model fine-tuned using a power industry corpus is employed to perform deep semantic analysis on each alarm text. Taking an original alarm, "2025-03-15 14:23:45:220kV line A set of longitudinal differential protection operated, tripped phase A," as an example, the model performs two key tasks: entity extraction identifies the equipment name as "line," the protection device as "A set of longitudinal differential protection," and the action as "tripped phase A"; intent classification categorizes this alarm as an action-type event. After parsing, the unstructured original text is converted into a structured alarm anomaly event object, containing fields such as standardized timestamp, equipment identifier, event type, and action details.

[0042] The previous round extracted abnormal data from the operational status data, such as determining that the current waveform was distorted at a certain moment or that the voltage suddenly dropped at a certain moment by fusing three features. These abnormal data points or data segments are directly encapsulated into abnormal event objects. Each abnormal event includes the time of occurrence, the relevant power attribute indicators such as phase A current, and an abnormal feature description such as the distortion start point.

[0043] The two types of events are placed in the same set to form a complete event list that includes waveform anomalies and alarm anomalies.

[0044] The reason for introducing both alarm anomalies and anomalies extracted from operational status data, rather than using only one type, is that fault alarm signals are proactively reported by protection devices and monitoring systems according to preset logic. They directly reflect the device's actions and have clear semantic meaning, but they are discrete, sparse, and limited by device configuration and communication conditions, potentially leading to missed or delayed reporting. Anomalies extracted from operational status data, on the other hand, come from continuous high-frequency sampling data, capable of capturing subtle transient changes that alarm signals cannot cover, such as the weak distortion of current during high-resistance grounding and the waveform characteristics of inrush current. Combining the two—alarm anomalies providing clear logical action nodes and waveform recording anomalies providing details of continuous physical quantity changes—allows for mutual supplementation and cross-verification, constructing a complete set of anomalies and avoiding the omission of critical information.

[0045] Then, based on the temporal sequence of each abnormal event in the abnormal event set, the first correlation result between each abnormal event is obtained. The abnormal events are arranged chronologically to obtain an abnormal event sequence; pairing analysis is performed on each abnormal event in the abnormal event sequence based on a preset time window to determine time-proximity event pairs; the statistical characteristics of time-proximity event pairs in the abnormal event sequence are analyzed to obtain the correlation strength within time-proximity event pairs; based on the correlation strength, the first correlation result is generated.

[0046] The temporal sequence refers to the chronological order and interval distribution of various anomalous events along the timeline. The first association result refers to the set of association relationships derived from the temporal proximity and co-occurrence statistical characteristics between events. An anomalous event sequence refers to the sequence formed by sorting all anomalous events from earliest to latest occurrence. A preset time window refers to a fixed time length set in advance to determine whether two events are sufficiently close in time. Pair analysis refers to the operation of examining events in pairs within the sequence. A temporally adjacent event pair refers to an event pair consisting of two anomalous events that occur sequentially within the preset time window. Statistical characteristics refer to the frequency, regularity, and distribution characteristics of temporally adjacent event pairs appearing in the entire sequence. Association strength refers to the degree of temporal dependency between two anomalous events, such as the probability that event B will follow event A.

[0047] First, obtain the timestamps of all events in the abnormal event set and sort them in ascending order of time. For example, if event A occurs at 14:23:45.100, event B occurs at 14:23:45.120, event C occurs at 14:23:45.350, and event D occurs at 14:23:46.000, the sorted sequence is [A, B, C, D].

[0048] First, a time window length is set, such as 100 milliseconds or 500 milliseconds. This window length needs to be determined based on the typical timing of power system protection actions, because the coordination time between different protection components and between protection and circuit breakers is usually a known engineering experience value. Then, each event in the sequence is traversed as a preceding event, and events occurring within the preset time window after it are checked. Each pair of preceding and following events is recorded as a time proximity event pair. For example, if the window is set to 100 milliseconds, event A occurs at 100.0 milliseconds, and event B occurs at 120.0 milliseconds. The difference between them is 20 milliseconds, falling within the window, thus forming a proximity pair A→B. Event C occurs at 350.0 milliseconds, which is 250 milliseconds different from A and exceeds the window, so A→C does not constitute a proximity pair. At the same time, B→C is also checked. B occurs at 120.0 milliseconds, and C occurs at 350.0 milliseconds, which is 230 milliseconds different and exceeds the window, so it also does not constitute a proximity pair.

[0049] Analyzing the statistical characteristics of time-proximity event pairs in anomaly event sequences to determine association strength requires statistical analysis based on sufficient historical data or recurring patterns in the current sequence. There are two main statistical methods: one is based on repeated observations within the current single failure sequence. For example, in the same sequence, if event types X and Y appear multiple times with X preceding or succeeding Y, then the proportion of Y following X is calculated. The other, more reliable method, is based on cumulative statistics from a large number of historical failure sequences, constructing an event transition frequency matrix that records the number of times each other event type appears within a time window after each event type. The formula for calculating association strength can be the conditional probability P, which is the probability that event Y will occur within a preset time window after event X occurs, equal to the frequency of X→Y divided by the total frequency of X. A time decay factor can also be introduced, assigning higher weights to pairs with closer time intervals.

[0050] Set a threshold for association strength, such as 0.7. Event pairs with a conditional probability greater than or equal to 0.7 are considered to have a significant temporal association, and the first association result is output. The first association result can be represented as a directed graph or a list of associations. For example, the association strength of A→B is 0.95, and the association strength of B→C is 0.88, indicating that the occurrence of A has a very high probability of leading to the occurrence of B, and the occurrence of B has a very high probability of leading to the occurrence of C.

[0051] The reason for this approach, rather than simply listing all events sequentially or assuming a correlation between adjacent events, is that during a failure, a series of anomalous events occur, but not all sequential events have a true causal relationship. Some events may simply be concurrent phenomena or independent events from different branches. By using a preset time window for filtering, event pairs that are too far apart in time and unlikely to have a direct triggering relationship can be excluded. Analyzing statistical characteristics such as conditional probability can distinguish between accidental co-occurrence and strong dependencies. For example, if event B always follows event A in a large sample, the association is strong; conversely, if B only occasionally appears after A, the association is weak. The resulting first association result provides the degree of temporal dependence between events, offering a quantitative basis for distinguishing between true causal chains and simple concurrent phenomena.

[0052] Furthermore, based on the causal relationships between each protection action event and each abnormal event in the protection action data, a second correlation result is obtained. The protection action events and abnormal event sequences are time-aligned to obtain pairs of abnormal protection events; the causal logic relationships of each pair of abnormal protection events are analyzed based on power system protection logic rules, and the causal mapping relationship between each abnormal event and the protection action event is constructed based on the analysis results; all causal mapping relationships are integrated to generate the second correlation result.

[0053] Protection action data refers to data recording the actions of relay protection devices, such as protection initiation, protection output, and circuit breaker tripping. Protection action events refer to individual action records extracted from protection action data, including action type, occurrence time, and associated equipment. An abnormal event sequence is a sequence formed by sorting all abnormal events by occurrence time. Time alignment refers to matching protection action events and events in the abnormal event sequence along a unified time axis. An abnormal protection event pair is an event pair formed by pairing an abnormal event with a protection action event based on temporal proximity or logical association. Power system protection logic rules refer to engineering knowledge in the power industry regarding how protection devices respond to different types of faults, such as triggering circuit breaker tripping after differential action or activating remote backup protection when the main protection fails to operate. Causal logic relationships refer to the triggering connections between protection action events and abnormal events, indicating cause and effect. Causal mapping relationships refer to the corresponding association tables from abnormal events to protection action events or from protection actions to abnormal events. Secondary association results refer to the set of causal associations between protection action events and abnormal events derived from the analysis of power system protection logic rules.

[0054] The first step is to obtain the timestamp of each abnormal event in the abnormal event sequence and the timestamp of each protection action event in the protection action data. Since different data sources may have clock deviations, time synchronization needs to be performed first using a dynamic time warping algorithm or a simple fixed deviation correction method. Then, a similar time window strategy is adopted: using an abnormal event as a baseline, protection action events are searched within a preset time window before and after it, such as 100 milliseconds, and the abnormal events falling within the window are paired with protection action events. Alternatively, the operation can be reversed, using a protection action event as a baseline to search for nearby abnormal events. Ultimately, multiple pairs of abnormal protection events are obtained; for example, the abnormal event "A-phase current surge" is paired with the protection action event "differential protection start".

[0055] The second step involves analyzing the causal relationships between various abnormal protection event pairs based on power system protection logic rules, and constructing a causal mapping relationship. First, a power system protection logic rule library needs to be compiled and coded beforehand. These rules are derived from power engineering design specifications and relay protection principles. Typical rules include: if an abnormal fault current is detected and exceeds a set value, the protection device should activate; the abnormality is the cause, and the activation of the protection is the result. If the fault still exists after a set delay following activation, the protection should trip; the activation of the protection is the cause, and the tripping signal is the result. If a tripping signal is issued, the circuit breaker should open within tens of milliseconds; the tripping signal is the cause, and the circuit breaker tripping is the result. If the fault current disappears after the circuit breaker trips, the tripping is successful; the circuit breaker tripping is the cause, and the current returning to zero is the result. Each abnormal protection event pair is then matched against the input rule engine to determine which event is the cause and which is the effect, and whether the correct logical timing is followed. For example, if the abnormal event "current over-limit" precedes the protection action event "overcurrent protection activation," the mapping relationship is constructed as: current over-limit leads to overcurrent protection activation. If the timing is reversed, for example, the protective action comes first and the anomaly comes later, it is judged as illogical or needs to be marked as suspicious.

[0056] The third step is to integrate all causal mappings to generate the second association result. All rule-validated causal mappings are summarized to form a causal association table or a causal directed graph. Each mapping can also be accompanied by a confidence score, which depends on whether the time interval is within the typical operating time and the completeness of the rule match. For example, if protection activation is detected 5 milliseconds after a current over-limit, it fully conforms to the logic of fast activation, and the confidence score is set to 0.98; if the time interval exceeds the typical range but is still within the engineering allowable range, the confidence score is appropriately reduced. The final set of causal mappings constitutes the second association result.

[0057] The reason for this approach, rather than simply treating temporally similar anomalies and protection actions as causal, is that temporal proximity does not equate to causal triggering. Two events may simply occur simultaneously without logical connection; for example, an unrelated equipment alarm may occur simultaneously with the current equipment's protection action. Power system protection logic rules are deterministic knowledge validated through long-term engineering practice. They define the standard process and timing range from anomaly occurrence to protection response and circuit breaker fault clearing. Using protection logic rules as the basis for causal determination eliminates spurious associations based on accidental co-occurrence, ensuring that only event pairs conforming to the power system's operating principles are considered causally related. This makes the second association result more reliable and interpretable in engineering. Unlike the first association result, which is based on statistical characteristics, the second association result is a knowledge-driven determination based on domain rules; the two complement each other.

[0058] Preferably, fault-related events are determined based on the first correlation result, the second correlation result, and the current fault information of the target power system.

[0059] The first correlation result refers to the set of correlation relationships derived from the temporal proximity and statistical co-occurrence characteristics between abnormal events, reflecting the degree of dependence between events in the time dimension. The second correlation result refers to the set of causal mapping relationships between protection action events and abnormal events derived from power system protection logic rule analysis. The target power system refers to the specific power network object currently undergoing fault analysis. Current fault information refers to the basic known information about this fault, such as the fault occurrence time, faulty equipment name, trip switch number, and other directly obtainable information. Fault-related events refer to one or more key events directly related to this fault, ultimately determined after integrating the first correlation result, the second correlation result, and the current fault information. These typically include the initial abnormal event that triggered the fault and the core links in the subsequent causal chain.

[0060] The first association result is a directed graph or association list that records the temporal dependency strength between abnormal events. For example, the probability of event B occurring within a short period of time after event A occurs is 0.95. The second association result is a set of causal mapping relationships that records the causal triggering relationship between abnormal events and protection action events. For example, an abnormal current leads to protection activation, protection activation leads to protection output, and protection output leads to circuit breaker tripping. Current fault information consists of clearly known basic facts, such as "circuit breakers on both sides of a 220kV line tripped, fault recording device activated, and the dispatching terminal received a protection action message."

[0061] The first correlation result provides temporal dependency edges between events of the same type, i.e., abnormal events, while the second correlation result provides causal edges between cross-type events, i.e., abnormal events and protection action events. Combining these two results forms a comprehensive relationship network containing abnormal event nodes and protection action event nodes. For example, the first correlation result gives the temporal correlation of a sudden change in phase A current → a sudden drop in phase A voltage, while the second correlation result gives the causal mapping of a sudden change in phase A current leading to differential protection activation, and differential protection activation leading to circuit breaker tripping. After merging, a complete chain is formed: sudden change in phase A current → sudden drop in phase A voltage → differential protection activation → circuit breaker tripping.

[0062] Known facts in the current fault information, such as "circuit breakers tripping on both sides," can serve as deterministic anchor points. This allows for locating the event node within the relationship network. Then, the causal relationships are traced back to its upstream events, while simultaneously tracing deeper causes along temporal sequences. Furthermore, constraints such as equipment scope and fault time within the current fault information are used to eliminate branch events unrelated to the current fault. For example, if the current fault information explicitly identifies a specific line as the faulty line, then event nodes on other lines in the relationship network, as well as events with no topological connection to that line, are all excluded.

[0063] In the pruned relational network, identify the event node at the very top of the causal chain—that is, the event not pointed to by any other event, which should also be the earliest occurring and form a closed logical loop with the known facts in the current fault information. This top-level event is the initial trigger event. Simultaneously, traversing the causal chain downwards, mark all verified events along the entire chain as fault-related events. Finally, output a list of fault-related events, arranged chronologically, representing the complete sequence from the initial anomaly to the protection action and then to fault clearing.

[0064] The reason for this approach, rather than drawing conclusions directly from current fault information or a single correlation result, is as follows: First, correlation results, based on statistical characteristics, can identify frequent co-occurrence patterns between events, but they cannot distinguish between genuine causal relationships and mere statistical coincidences. For example, two events may frequently occur simultaneously simply because they are both driven by the same third-party factor. Second, correlation results, based on protection logic rules, provide deterministic guidance on causal direction, but they mainly cover a narrow chain related to the response of protection devices, and are insufficiently covered for non-protection-related anomalies such as the gradual aging of the equipment itself and environmental factors. Current fault information provides specific factual anchors for this fault, but these are only a few isolated observation points and cannot reconstruct the complete evolutionary process. Only by combining all three—using statistical correlation to discover candidate event pairs, using causal rules to verify directionality, and using current information to anchor factual boundaries—can we filter out the key events that truly constitute the causal chain of this fault from numerous events, avoiding misjudging accompanying phenomena as causes and mistakenly taking results as starting points, thereby achieving accurate fault correlation event localization.

[0065] Finally, based at least on fault-related events, the fault analysis results of the target power system are obtained. This involves identifying the associated devices corresponding to the fault-related events; analyzing the impact of the associated devices on the faulty devices based on the topology of the target power system to determine the fault-related devices; analyzing the fault-related devices to determine the fault conditions; obtaining optimization schemes based on the fault conditions; and obtaining the fault analysis results based on the fault-related devices, fault-related events, and optimization schemes.

[0066] A fault-related event refers to one or more key events directly related to the current fault, determined after integrating the first and second correlation results and the current fault information. Associated equipment refers to the electrical equipment involved in the fault-related event, such as lines experiencing sudden current changes, activated protection devices, or tripped circuit breakers. A topology diagram is a network structure diagram describing the electrical connections between various electrical devices in the target power system, including device nodes and connection edges. The degree of influence of associated equipment on the faulty equipment refers to the electrical distance between an associated device and the faulty equipment in the topology diagram, and the strength of the effect of changes in the state of the associated device on the operating status of the faulty equipment. Fault-related equipment refers to equipment substantially related to the current fault, selected after influence analysis, including the fault source equipment, affected equipment, and activated protection devices. Fault condition refers to the state and changes of the fault-related equipment during the fault process, such as whether the equipment is damaged, whether the protection operates correctly, and whether the circuit breaker successfully trips. An optimization plan refers to improvement measures or rectification suggestions proposed based on the fault condition to prevent the recurrence of similar faults. Fault analysis results refer to the final output formed by integrating fault-related equipment, fault-related events, and optimization solutions. They typically include fault cause location, fault process description, and subsequent handling suggestions.

[0067] Iterate through the list of identified fault-related events. Each event contains a device identifier field. For example, the device associated with the "A-phase current surge" event is "Line L1", the device associated with the "differential protection start" event is "Protection device P1", and the device associated with the "circuit breaker trip" event is "Circuit breaker QF1". Extract all devices involved in the fault-related events, remove duplicates, and obtain the set of associated devices, such as {Line L1, Protection device P1, Circuit breaker QF1, Bus B1}.

[0068] First, obtain the primary wiring topology diagram of the target power system. This diagram uses equipment as nodes and electrical connections as edges, including the connection relationships of components such as lines, transformers, busbars, circuit breakers, and disconnectors. Then, identify the faulty equipment. The faulty equipment can be directly obtained from the current fault information; for example, if the dispatch report clearly states "a fault has occurred on a certain 220kV line," then that line is the faulty equipment. Next, analyze the topological relationship between each associated equipment and the faulty equipment, specifically including: electrical distance, i.e., the number of circuit breakers or node jumps along the path from the associated equipment to the faulty equipment; connection path, i.e., whether there is a direct electrical connection between the two; and functional relationship, such as whether a protection device is configured to protect the faulty equipment, and whether a circuit breaker is directly connected to the end of the faulty equipment. Based on the above analysis results, quantify and score the impact degree of the associated equipment. For example, a circuit breaker directly connected to the faulty equipment scores 1.0, a protection device configured to protect the faulty equipment scores 1.0, other lines on adjacent busbars score 0.3, and equipment without a direct electrical connection to the faulty equipment scores 0. A threshold is set, for example, 0.5. Devices with scores higher than the threshold are identified as fault-related devices, and devices that are related to the fault in time but are not related to the faulty device in electrical topology are filtered out.

[0069] For each identified fault-related device, analyze its specific performance during the fault process. For lines, analyze whether a short circuit occurred, what the short circuit type was, the distance measurement result, and whether the fault was permanent. For protection devices, analyze whether they started correctly, whether the operating time met the set value, whether they tripped, and whether there was any failure to operate or erroneous operation. For circuit breakers, analyze whether a trip command was received, whether the tripping was successful, whether the tripping time was normal, and whether there was any failure to trip or erroneous tripping. These analysis results can be directly extracted from previous event primitives; for example, the abnormal event set already contains fault type determination and distance measurement results, and the protection action data already contains action time records.

[0070] The system matches fault conditions with a pre-set optimization rule base. This rule base stores standardized handling suggestions for different fault types. For example, if the fault is caused by lightning, the optimization plan includes "checking the status of surge arresters in the section, statistically analyzing historical lightning strike distribution, and considering adding lightning protection facilities"; if the fault is caused by external damage such as a crane hitting a power line, the optimization plan includes "investigating surrounding construction conditions, strengthening patrols and publicity, and considering installing online monitoring devices to prevent external damage"; if the fault is caused by equipment aging and reduced insulation performance, the optimization plan includes "arranging a power outage test for the equipment, assessing insulation life, and including it in the technical upgrade and replacement plan"; if the protection system fails to operate or malfunctions, the optimization plan includes "verifying protection settings, verifying the function of protection devices, and adjusting coordination time limits." Simultaneously, the system retrieves the most similar historical cases from the fault graph and extracts the actually adopted and verified effective handling measures from those cases as supplementary suggestions.

[0071] The above information is organized into a structured output. Fault analysis results typically include the following core elements: a fault overview, including fault time, faulty equipment, fault type, and distance measurement results; a fault process description, presenting the chronological chain of related events; a protection action evaluation, explaining whether the actions of each protection device and circuit breaker were correct; a fault cause analysis, providing the root cause and its confidence level; and optimization recommendations, outputting the specific details of the optimization plan. Finally, it is presented in the form of a structured report.

[0072] The reason for doing this, rather than directly outputting fault-related events as the final result, is that while fault-related events reveal the event chain in the fault development process, they are still event-level descriptions, not tied to specific physical equipment, and do not provide actionable handling suggestions. Power system maintenance personnel ultimately care about three things: which equipment malfunctioned, why it malfunctioned, and how to prevent it in the future. By identifying the fault-related equipment, the event is attributed to a specific physical entity, making responsibility clear and maintenance objectives well-defined; by analyzing the fault situation, the specific fault mode of the equipment is diagnosed in depth, such as whether the line was struck by lightning or the circuit breaker failed to operate—different modes correspond to completely different handling methods; by generating optimized solutions, the analysis conclusions are transformed into practical and executable maintenance decisions, forming a closed loop from diagnosis to handling. The final fault analysis results directly serve the formulation of fault repair, equipment maintenance, and accident prevention measures, which is the output form that power system maintenance personnel truly need.

[0073] The core problem pointed out in the background technology is that existing fault analysis methods rely too heavily on superficial phenomena such as tripping for simple causal attribution, treating the phenomenon as the cause, resulting in the inability to truly identify the root cause and the recurrence of similar faults. This invention, through extracting operational status data and protection action data of the target power system within a selected time period, extracts abnormal data corresponding to different power attribute indicators from the operational status data and constructs an abnormal event set, fundamentally changing the starting point of analysis that only looks at the surface. Based on this, a first correlation result is obtained based on the temporal sequence between abnormal events to distinguish between the earlier potential causes and the later direct phenomena; a second correlation result is obtained based on the causal relationship between protection action events and abnormal events to distinguish between the key anomalies that truly drive the protection action and the accompanying irrelevant fluctuations. Finally, combined with current fault information, fault-related events are determined, so that the analysis conclusions no longer rely on experience and intuition but are based on the dual verification of temporal and causal logic. This technical approach elevates fault analysis from phenomenon attribution to chain tracing, enabling it to penetrate superficial phenomena such as tripping to identify the initial abnormal source, thereby accurately locating the true root cause of the fault, effectively reducing the recurrence of similar faults, and fundamentally solving the technical problem that existing technologies cannot find the true root cause of faults.

[0074] Another embodiment of the present invention provides a power system fault analysis method based on knowledge graph and multi-algorithm reasoning. This method also follows the technical path from multi-source data extraction, abnormal event construction, correlation analysis to fault root cause location and report generation, but introduces a more systematic knowledge modeling and reasoning mechanism in its specific implementation.

[0075] First, this embodiment of the invention extracts the operating status data and protection action data of the target power system within a selected time period. The operating status data is specifically represented as a fault waveform file, including configuration files, data files, and header files, covering high-frequency analog and switching signals throughout the entire process before and after the fault event. The protection action data originates from alarm message streams and historical trip event records. Alarm messages are pushed to the receiving station system via a dedicated subscription service, and historical trip events are synchronized from the production management system or dispatch automation system. The selected time period is determined by the fault time, and three strategies are used to dynamically define the analysis window: Strategy A is based on adaptive expansion of trigger events, starting from the first abnormal event, tracing back a preset time to capture latent signs, and expanding backward a preset time to cover the disconnection and reclosing process; Strategy B is based on dynamic division of event density, counting the number of events per unit time, and automatically defining a candidate fault window when it exceeds a threshold, suitable for cascading fault scenarios; Strategy C is based on anomaly detection using a sliding window, combining variance or mutation detection functions to calculate anomaly scores, and locking the fault start and end time points when the score exceeds a threshold. The above strategies ensure that the analysis window can fully cover the entire process of fault latency, occurrence, development, and remediation.

[0076] In terms of anomaly data extraction and anomaly event set construction, this embodiment of the invention first extracts anomaly data corresponding to different power attribute indicators from the operating status data. Its core innovation lies in introducing heterogeneous feature extraction and uncertainty modeling. Specifically, multiple independent feature extraction calculation units are launched in parallel: Unit A, the physical rule engine, calculates deterministic features such as the effective value of fault current, mutation amount, and harmonic content based on physical formulas and fixed thresholds; Unit B, the signal processing engine, extracts high-frequency transient energy features of specific frequency bands based on wavelet transform to identify weak faults such as high-resistance grounding; Unit C, the deep learning engine, directly outputs the fault type probability vector based on a pre-trained lightweight one-dimensional convolutional neural network. The outputs of the above units are uniformly sent to an arbitrator for weighted fusion. The optimal estimate is calculated based on the historical accuracy weight of each unit and the quality score of the current input data, while retaining all possible alternative values ​​and their confidence levels, forming a standardized data object with uncertainty annotation.

[0077] Building upon this foundation, this embodiment of the invention further extracts fault alarm signals from the target power system within a selected time period. A language model, fine-tuned with power grid equipment named entities and protection logic rules, is used to perform deep semantic parsing of the alarm messages. Entity extraction identifies equipment names, attributes, and status values. Intent classification categorizes alarms into action-type, alarm-type, or status-type alarms, transforming unstructured alarm text into structured alarm anomaly events. Furthermore, time window binding automatically queries all other event primitives within a preset time window before and after the event, extracting the state transition sequences of relevant equipment as background information and encapsulating them into an object. Finally, based on the anomaly events obtained from waveform analysis and the alarm anomaly events obtained from alarm analysis, an anomaly event set is constructed, outputting a standardized JSON object. Fields include a globally unique identifier, data source type, standardized timestamp, equipment identifier, event category, feature set, and context reference list.

[0078] At the correlation analysis level, this embodiment of the invention introduces a dual-path correlation engine to achieve deeper causal reasoning. Path one is topological correlation, which constructs a directed graph model with equipment as nodes and electrical connections as edges based on the substation primary wiring diagram. When an event primitive is generated, it automatically retrieves directly electrically connected equipment and indirectly related equipment within a limited topological depth in the graph, aggregating event primitives generated by these devices within similar time windows into topological event clusters. Path two is causal correlation, which trains a Bayesian network or causal graph model based on a historical tripping event database, quantifying the conditional probabilities between different event types. For example, the probability of a circuit breaker tripping within 100 milliseconds after line protection is activated is 0.98. When a new event primitive is introduced, the model is used to find other event primitives with high-probability causal relationships, even if they are not directly connected in the topology, it can cover scenarios such as remote protection linkage and false tripping caused by communication channel anomalies. By aligning protection action events with abnormal event sequences in time, each abnormal protection event pair is obtained. The causal logic relationship of each abnormal protection event pair is analyzed based on the power system protection logic rules. The causal mapping relationship between each abnormal event and protection action event is constructed based on the analysis results. All causal mapping relationships are integrated to generate a second correlation result.

[0079] Regarding the construction and interpretability of the evidence chain, this embodiment of the invention introduces an evidence chain anchoring mechanism. The results of dual-path correlation are merged and sorted along a timeline to form a logically coherent fault narrative chain, i.e., the fault evolution process. For each key assertion node in the narrative chain, it is mandatory to link back to one or more underlying event primitives supporting the conclusion, and the type of evidence source must be clearly marked: strong evidence is based on topological correlation, such as directly reading the circuit breaker's tripping message plus the waveform characteristics of the line current returning to zero; speculative evidence is based on causal probability correlation, such as not directly reading the signal but inferring a high probability that it has been activated based on the protection logic. The overall confidence of the sequence is calculated by weighting the confidence of the evidence at each stage, ultimately outputting a structured standard fault event sequence file, including sequence identifiers, a list of involved equipment, a list of time-series events, correlation type annotations, evidence chain mapping relationships, and overall completeness and confidence scores.

[0080] Ultimately, this embodiment of the invention employs a layered, progressive, multi-algorithm fusion intelligent reasoning engine, mimicking the analytical thinking of power experts from phenomena to essence. First, a dynamic time warping algorithm or the longest common subsequence algorithm is used to overcome the time axis scaling problem caused by minor clock deviations between different devices. This ensures high-precision alignment of the fault time (accurate to milliseconds) in the fault recording with the alarm message sequence timestamps on a unified time axis. Furthermore, an association rule mining algorithm automatically discovers event co-occurrence patterns across data sources. Then, the hybrid causal chain reasoning stage begins: the rule engine encodes the power system's protection configuration principles and action logic into production rules, logically verifying the alarm event sequence. For example, the rule base defines that if differential protection operates and no circuit breaker trip is detected within 100 milliseconds, then it is inferred that the circuit breaker failed to operate. Simultaneously, the case reasoning engine performs similarity matching between the current fault event sequence and historical cases in the fault map, using Jaccard similarity coefficients to compare the similarity of event sets and combining sequence matching algorithms to compare the similarity of action timing. Next, we proceed to root cause analysis using multi-feature fusion: This involves integrating electrical features parsed from waveform files, conclusions from causal chain reasoning, and feature vectors from historical similar cases to construct a multi-model collaborative analysis decision-making process. The first layer uses a rule engine to handle scenarios with clear logical relationships. The second layer, for complex scenarios not covered by rules, inputs feature vectors into a lightweight gradient booster or random forest model for classification. The third layer introduces a Bayesian network to probabilistically fuse the Boolean output of the rule engine, the classification probability of the machine learning model, and the similarity score of case reasoning. Finally, it calculates the comprehensive confidence level of various possible root causes and outputs the option with the highest probability. Simultaneously, it interprets the model output to explain the contribution of each feature to the root cause judgment. After identifying fault-related events, we further identify the associated devices corresponding to these events. Based on the topology of the target power system, we analyze the impact of associated devices on the faulty devices to determine the fault-related devices. Finally, we analyze the fault-related devices to determine the fault situation.

[0081] Based on the identified root cause, pre-defined standardized handling suggestions are queried from the knowledge graph. Simultaneously, historical cases most similar to the root cause are retrieved from the fault graph, and their final handling measures are extracted as supplementary suggestions. A reinforcement learning mechanism is introduced: when maintenance personnel adopt and report the effect of a measure, this feedback serves as a reward signal to dynamically adjust the recommendation weight of that countermeasure suggestion in subsequent similar faults. Finally, a controllable generation and structured content assembly method based on a large language model is adopted. A structure-aware generation mechanism automatically determines report chapters and dynamically adjusts content granularity. A reasoning constraint generation mechanism requires that each key conclusion of the model must reference corresponding event primitives or evidence chains and be consistent with the reasoning results. A multi-granularity content assembly mechanism generates conclusion-type content, analysis-type content, and decision-type content in segments and then assembles them uniformly. Simultaneously, visual charts such as key waveform diagrams, action sequence logic diagrams, and fault location diagrams dynamically generated by the system are automatically embedded. Finally, a structured power system fault analysis report is generated, including a fault overview, protection action analysis, root cause analysis, and handling suggestions.

[0082] The various models used in the embodiments of this invention are all publicly available and mature models in the prior art. Among them, wavelet transform is a classic signal processing method, one-dimensional convolutional neural network is a widely used network structure in the field of deep learning, the sequence labeling framework based on bidirectional long short-term memory network and conditional random field is a mature sequence labeling architecture in natural language processing, dynamic time warping algorithm and longest common subsequence algorithm are classic algorithms for time series matching, prior algorithm and frequent pattern growth algorithm are standard algorithms for association rule mining, Jaccard similarity coefficient and Niederman-Onsch algorithm are general methods for similarity calculation and sequence alignment, lightweight gradient boosting machine and random forest are gradient boosting trees and ensemble learning models commonly used in machine learning, Bayesian network is the basic framework of probabilistic graphical model, reinforcement learning is a mature paradigm in the field of intelligent decision-making, and graph neural network is a standard technique for graph data representation learning. This invention does not create new model structures, but rather systematically integrates and collaboratively orchestrates these existing models to construct a multi-algorithm fusion inference framework for power system fault analysis, improving the overall analysis effect through the complementary advantages and cross-validation of each model.

[0083] The main improvement of this invention lies not in the innovation of any single model, but in the construction of a complete power system fault analysis technology system. This system integrates fault waveform data, alarm messages, and historical tripping events under a unified timeline and knowledge framework through unified semantic modeling and fusion processing of multi-source heterogeneous data, fundamentally solving the problem of incomplete analysis caused by data silos in existing technologies. Based on this, this invention designs a dual-path correlation mechanism of temporal correlation and causal correlation, which is verified based on event statistical characteristics and power system protection logic rules, respectively. It also innovatively introduces an evidence chain anchoring mechanism to ensure that each analytical conclusion can be traced back to the original data source, achieving a leap from listing phenomena to causal chain reasoning. Simultaneously, this invention systematically arranges rule-based reasoning, case-based reasoning, machine learning, and probabilistic graphical models through a multi-algorithm fusion inference engine. The algorithms mutually verify and complement each other's weaknesses, rather than relying on the single output of a single algorithm, thereby significantly improving the accuracy and interpretability of the analysis. Ultimately, this embodiment of the invention replaces the traditional fixed template with a reasoning constraint generation method based on a large language model. Through structural constraints, evidence-driven generation, and reasoning consistency verification, it achieves adaptive organization and high-quality generation of report content. The systematic nature, completeness, and collaborative work between modules of the entire technical solution are the core improvements of this invention.

[0084] Another embodiment of the present invention provides a power system fault analysis device; for details, please refer to [link to relevant documentation]. Figure 2 , Figure 2 The diagram shown illustrates the structure of a power system fault analysis device according to one embodiment of the present invention, comprising: Extraction module 11 is used to extract the operating status data and protection action data of the target power system within a selected time period, wherein the selected time period is determined by the fault time of the target power system. Anomaly module 12 is used to extract abnormal data corresponding to different power attribute indicators from the operating status data; Event module 13 is used to construct a set of abnormal events for the target power system based at least on abnormal data; The first module 14 is used to obtain the first correlation result between each abnormal event based on the time sequence of each abnormal event in the abnormal event set; The second module 15 is used to obtain a second correlation result based on the causal relationship between each protection action event and each abnormal event in the protection action data; Fault module 16 is used to determine fault-related events based on the first correlation result, the second correlation result, and the current fault information of the target power system; Results module 17 is used to obtain fault analysis results of the target power system based at least on fault-related events.

[0085] See Figure 3 This is a schematic diagram of the structure of a power system fault analysis device provided in an embodiment of the present invention. The power system fault analysis device provided in this embodiment includes a processor 21, a memory 22, and a computer program stored in the memory 22 and configured to be executed by the processor 21. When the processor 21 executes the computer program, it implements the steps described in the above-described power system fault analysis method embodiment, for example... Figure 1 The steps S1 to S7 described above; or, when the processor 21 executes the computer program, it implements the functions of each module in the above-described device embodiments, such as the extraction module 11 of the power system fault analysis device.

[0086] For example, the computer program can be divided into one or more modules, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the power system fault analysis device. For example, the computer program can be divided into an extraction module 11, an exception module 12, an event module 13, etc., with the specific functions of each module as follows: Extraction module 11 is used to extract the operating status data and protection action data of the target power system within a selected time period, wherein the selected time period is determined by the fault time of the target power system. Anomaly module 12 is used to extract abnormal data corresponding to different power attribute indicators from the operating status data; Event module 13 is used to construct a set of abnormal events for the target power system based at least on abnormal data; The first module 14 is used to obtain the first correlation result between each abnormal event based on the time sequence of each abnormal event in the abnormal event set; The second module 15 is used to obtain a second correlation result based on the causal relationship between each protection action event and each abnormal event in the protection action data; Fault module 16 is used to determine fault-related events based on the first correlation result, the second correlation result, and the current fault information of the target power system; Results module 17 is used to obtain fault analysis results of the target power system based at least on fault-related events.

[0087] The power system fault analysis device may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of a power system fault analysis device and does not constitute a limitation on the device. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the power system fault analysis device may also include input / output devices, network access devices, buses, etc.

[0088] The processor 21 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the power system fault analysis equipment, connecting various parts of the equipment via various interfaces and lines.

[0089] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the power system fault analysis device by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0090] If the modules integrated into the power system fault analysis equipment are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0091] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0092] Accordingly, embodiments of the present invention provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform steps in the power system fault analysis method of the above embodiments, for example... Figure 1 Steps S1 to S7 as described above.

[0093] Traditional power system fault analysis often stops at directly observable phenomena such as tripping or power outages, mistaking the phenomenon itself for the cause of the fault, leading to the long-term obscuring of the root cause and the recurrence of similar faults. This invention, however, takes a systemic perspective, simultaneously extracting changes in operating status and protection device action records during the fault period. It identifies abnormal characteristics of different electrical indicators from the operating data and constructs a complete set of abnormal events, achieving a leap from observing phenomena to examining the chain of events. Based on this, this invention utilizes the sequential relationships between abnormal events to trace the evolution path and establishes causal connections between protection actions and various anomalies, thereby reconstructing the complete fault occurrence process in both time and logic dimensions. Combined with specific information about the current fault, it ultimately identifies the truly triggering event and its root cause. This technical approach fundamentally eliminates reliance on appearances and experiential intuition, elevating fault analysis from attributing phenomena to tracing the chain of causes. This allows each fault to be accurately located to its initial trigger, effectively preventing the recurrence of similar faults and providing a solid technical guarantee for the safe and stable operation of the power system.

[0094] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A power system fault analysis method, characterized in that, include: Extract the operating status data and protection action data of the target power system within a selected time period, wherein the selected time period is determined by the fault time of the target power system; Abnormal data corresponding to different power attribute indicators are extracted from the operating status data; Based at least on the abnormal data, construct a set of abnormal events for the target power system; Based on the temporal sequence of each abnormal event in the abnormal event set, a first correlation result between each abnormal event is obtained; Based on the causal relationship between each protection action event and each abnormal event in the protection action data, a second correlation result is obtained; Based on the first association result, the second association result, and the current fault information of the target power system, fault association events are determined; Based at least on the fault-related events, the fault analysis results of the target power system are obtained.

2. The power system fault analysis method as described in claim 1, characterized in that, The selected time period is determined by the fault time of the target power system, including: In response to a fault signal from the target power system, the fault time is determined; Extract fault waveform data for a preset time period prior to the fault time; Based on the mutation detection technology, the fault waveform data is analyzed to obtain a fault frequency score. The fault frequency score is processed to determine the selected time period.

3. The power system fault analysis method as described in claim 1, characterized in that, The extraction of abnormal data corresponding to different power attribute indicators from the operational status data includes: The operating status data is processed based on the power attribute indicators to determine the first power characteristic; The operating status data is processed using wavelet transform technology to obtain the second power characteristic; The operational status data is input into a pre-built fault model for processing to obtain the third power characteristic; The abnormal data is determined based on the first power characteristic, the second power characteristic, and the third power characteristic.

4. The power system fault analysis method as described in claim 1, characterized in that, The method for analyzing power system faults further includes, at least based on the abnormal data, constructing an abnormal event set for the target power system. Extract fault alarm signals of the target power system within the selected time period; The fault alarm signal is processed to determine the alarm abnormal event; Based on the abnormal data, the abnormal event is obtained; Based on the alarm exception events and the exception events, the exception event set is obtained.

5. The power system fault analysis method as described in claim 1, characterized in that, The first correlation result between the various abnormal events is obtained based on the temporal sequence of each abnormal event in the abnormal event set, including: Arrange the various abnormal events in chronological order to obtain an abnormal event sequence; Based on a preset time window, pairing analysis is performed on each of the abnormal events in the abnormal event sequence to determine time-adjacent event pairs; Analyze the statistical characteristics of the time-proximity event pairs in the sequence of anomalous events to obtain the correlation strength within the time-proximity event pairs; Based on the correlation strength, the first correlation result is generated.

6. The power system fault analysis method as described in claim 5, characterized in that, The second correlation result, obtained based on the causal relationship between each protection action event and each abnormal event in the protection action data, includes: The protection action events are time-aligned with the abnormal event sequence to obtain individual abnormal protection event pairs; Based on the power system protection logic rules, the causal logic relationship of each abnormal protection event pair is analyzed, and the causal mapping relationship between each abnormal event and the protection action event is constructed based on the analysis results. Integrate all the aforementioned causal mapping relationships to generate the second association result.

7. The power system fault analysis method as described in claim 1, characterized in that, The process of obtaining fault analysis results for the target power system based at least on the fault-related events includes: Identify the associated devices corresponding to the fault-related events; Based on the topology of the target power system, analyze the impact of the associated equipment on the faulty equipment, and determine the faulty associated equipment; The fault-related devices are analyzed to determine the fault condition; Based on the aforementioned fault conditions, an optimized solution is obtained; The fault analysis results are obtained based on the fault-related devices, the fault-related events, and the optimization scheme.

8. A power system fault analysis device, characterized in that, include: The extraction module is used to extract the operating status data and protection action data of the target power system within a selected time period, wherein the selected time period is determined by the fault time of the target power system. An anomaly module is used to extract anomaly data corresponding to different power attribute indicators from the operating status data; The event module is used to construct a set of abnormal events for the target power system based at least on the abnormal data. The first module is used to obtain a first correlation result between the various abnormal events based on the temporal sequence of each abnormal event in the abnormal event set. The second module is used to obtain a second correlation result based on the causal relationship between each protection action event and each abnormal event in the protection action data; The fault module is used to determine fault-related events based on the first association result, the second association result, and the current fault information of the target power system; The results module is used to obtain fault analysis results of the target power system based at least on the fault-related events.

9. A power system fault analysis device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the power system fault analysis method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the device containing the computer-readable storage medium executes the computer program, it implements the power system fault analysis method as described in any one of claims 1 to 7.

Images