A power grid fault tracing method based on a knowledge graph, an electronic device, and a storage medium

Abstract

The application discloses a power grid fault tracing method based on a knowledge graph, an electronic device and a storage medium, and relates to the technical field of intelligent processing of power system operation data. The method comprises the following steps: constructing a power grid fault tracing knowledge graph, recording the setting delay time, the inherent action time of the protection device node, and the breaking time of the circuit breaker node; matching the alarm message to the corresponding signal node to obtain an alarm event; defining the fault window according to the station time scale and determining the fault domain, and obtaining the topology before the fault by reversing the switch position in the fault window, and taking the live equipment under the topology as the candidate equipment; querying the theoretical response time delay of each alarm event for each candidate equipment; taking the fault occurrence time as an unknown quantity, constructing the residual error from the station time scale and the theoretical response time delay, solving the estimated value that makes the overall residual error minimum, and calculating the score; and determining the root cause equipment according to the optimal score. The application is not dependent on the alarm arrival sequence and is robust to false positives and false negatives.

Description

Technical Field

[0001] This application relates to the field of intelligent processing technology for power system operation data, and in particular to a knowledge graph-based method for tracing power grid faults, electronic equipment, and storage medium. Background Technology

[0002] When a power grid fault occurs, the dispatching master station will receive alarms from multiple substations within a short period of time, including activation, operation, and reset signals of protection devices, circuit breaker position change signals, and voltage and load over-limit alarms. Fault tracing involves identifying the root cause equipment, fault type, and fault evolution process from these alarms to provide a basis for handling and restoring power supply.

[0003] There are currently three main types of fault diagnosis methods. The first type is based on expert rules or knowledge graph pattern matching. This involves pre-organizing typical fault alarm combinations into rules or patterns in a knowledge graph, and then comparing the received alarm set with the preset patterns online. If a match is found, the corresponding fault conclusion is output. However, this method is susceptible to problems. When there are missed or false alarms, the comparison conditions are disrupted, leading to matching failures or incorrect hits. Furthermore, if the order in which alarms arrive at the master station differs from the actual order of occurrence, the conclusion may be contrary to reality. After grid maintenance or switching operations, the original patterns no longer correspond to the actual wiring, requiring continuous manual maintenance. Finally, it lacks the ability to output results for fault types that are not preset.

[0004] The second type is the analytical model-based optimization diagnostic method, which establishes a desired model of whether the protection and circuit breaker operate, and searches for the solution that best matches the actual operation from the set of assumed fault locations. This method only uses the switching information of whether the operation is active or not, and often provides multiple or incorrect solutions when adjacent equipment fails; it also requires manual setting of cost parameters for different signals, which are difficult to tune; and the number of assumed combinations increases dramatically when there are multiple faults, making the online solution time uncontrollable.

[0005] The third category is the data-driven approach, including neural networks and Bayesian networks, which uses historical fault samples to train a mapping model from alarms to fault conclusions. In this approach, samples of major power grid faults are scarce, resulting in insufficient training samples; after adjustments to power grid wiring methods or protection settings, the trained model becomes inapplicable, requiring retraining with collected samples; the model's output lacks a verifiable reasoning process, making it difficult for dispatchers to issue control instructions; missed or false alarms also affect its output.

[0006] Furthermore, all of the above methods rely on the alarm timestamps sent by the plant / station. In actual operation, the timestamps of some plants / stations contain deviations of hundreds of milliseconds or even seconds. None of these methods have a way to handle this, and the only option is to discard the alarms from the affected plants / stations entirely. Summary of the Invention

[0007] The purpose of this application is to provide a knowledge graph-based method, electronic device, and storage medium for tracing power grid faults, addressing the challenges of quickly and accurately identifying the root cause device and verifying the determination process under conditions such as unreliable alarm arrival order, substation-level timescale deviations, missed and false alarms, and changes in power grid wiring depending on operating mode and fault process. The specific technical solution is as follows: In a first aspect, embodiments of this application provide a power grid fault tracing method based on knowledge graphs, the method comprising: A knowledge graph for tracing the source of power grid faults is constructed, wherein protection device nodes point to primary equipment nodes within their protection range via coverage edges, the coverage edges record setting delays, the protection device nodes record inherent operating times, the circuit breaker nodes record opening times, and signal nodes are associated with the protection device nodes or the circuit breaker nodes that issue corresponding signals. The alarm message sent by the power plant is received, and each alarm message is matched to the corresponding signal node in the power grid fault tracing knowledge graph to obtain an alarm event. The alarm event records at least the corresponding signal node, the station time stamp and the power plant to which it belongs. Based on the station time stamp of each alarm event, the fault window is defined, and the fault domain containing the primary equipment corresponding to each alarm event is determined on the power grid fault tracing knowledge graph; the switch changes that occur in the fault window are cancelled from the current switch state in reverse order of occurrence to obtain the pre-fault topology; the primary equipment energized in the fault domain under the pre-fault topology is selected as candidate equipment. For each candidate device, assuming it is a fault source, the theoretical response delay of each alarm event is queried according to the power grid fault source knowledge graph. The theoretical response delay is the time difference between the fault occurrence time and the corresponding signal issuance time, which is obtained by accumulating at least the items corresponding to the signal in the setting delay, the inherent action time, and the tripping time. Using the fault occurrence time as an unknown quantity, for each alarm event with the theoretical response delay, construct a residual from its station timescale and the corresponding theoretical response delay, solve for the fault occurrence time estimate that minimizes all residuals, and calculate the score of the candidate device based at least on the solved residuals. The candidate device with the best score is identified as the root cause device, and the source tracing result is output. The source tracing result includes the root cause device and the estimated time of the failure.

[0008] In one possible implementation, the coverage edge also records the segment, the setting delay of the main protection segment is zero, and the setting delay of the backup protection segment is the setting value recorded in the setting sheet; the protection device node also records the return time, and the signal node also records the additional delay corresponding to its signal type. The process of querying the theoretical response delay for each alarm event includes: for protection action signals, the theoretical response delay is obtained by adding the setting delay and the inherent action time; for circuit breaker position change signals, the opening time of the corresponding circuit breaker is also added; for protection start signals, the additional delay is also added; for protection reset signals, the theoretical response delay is obtained by adding the theoretical tripping time and the return time of the candidate device, wherein the theoretical tripping time is the maximum value among the theoretical response delays of the position changes of each power supply side circuit breaker of the candidate device.

[0009] In one possible implementation, the method further includes: classifying the plant into trusted and untrusted stations based on the plant's time synchronization status and / or the difference between the station's internal timestamp of its alarm events and the time received by the master station; The construction of residuals includes: for alarm events of the trusted station, constructing an absolute residual with the fault occurrence time as an unknown quantity by using its internal timescale and the corresponding theoretical response delay; for alarm events of the untrusted station, selecting an alarm event within the same plant as a benchmark, and constructing a differential residual by subtracting the difference in theoretical response delay between the difference between the internal timescales of the remaining alarm events and the benchmark, so that the timescale deviations of the plant cancel each other out in the difference operation; Furthermore, based on the station-specific timestamps of each alarm event of the untrusted station, the corresponding theoretical response delays, and the estimated fault occurrence time obtained from the solution, the timestamp deviation of each untrusted station is estimated, and the tracing result also includes the timestamp deviation.

[0010] In one possible implementation, the method further includes: setting basic weights for each alarm event to participate in residual construction and solution, wherein the basic weights are taken from the confidence level recorded by the signal node of the alarm event, and each signal node records its confidence level, wherein the confidence level is obtained by statistically analyzing the number of times the signal node is judged as a match and the number of times it is judged as an outlier in historical cases, wherein the outlier refers to an alarm event in which the residual exceeds a preset range. The method of finding the fault occurrence time estimate that minimizes the overall residuals includes: using each basic weight as the initial weight, iteratively executing the following steps: updating the fault occurrence time estimate under the current weights, and updating each residual; for alarm events whose residuals exceed a robustness threshold, reducing the weight of the alarm event according to the degree to which its residuals exceed the robustness threshold; until the fault occurrence time estimate converges or the iteration reaches a preset number of rounds; the score is calculated at least based on the weighted residuals.

[0011] In one possible implementation, the calculation of the candidate device score includes: weighting the weighted residual level, the weighted proportion of unexplainable alarm events, and the necessary signal missing rate by a preset coefficient to obtain the score of the candidate device. Wherein, the weighted residual level is the value obtained by accumulating each residual according to its weight and normalizing it; an alarm event that has neither the theoretical response delay nor meets the preset graph correlation conditions is denoted as unexplainable for the candidate device, and the weighted proportion of the unexplainable alarm event is the proportion of the sum of the basic weights of each alarm event that is unexplainable for the candidate device to the sum of the basic weights of all alarm events in the fault domain; The necessary signal missing rate is determined based on the proportion of signals in the necessary signal set for which no corresponding alarm event has been observed. The necessary signal set includes at least the main protection action signal expected to act first when the candidate device fails and the corresponding circuit breaker position signal. Signals outside the necessary signal set that have coverage association with the candidate device are not counted as missing if no corresponding alarm event has been observed.

[0012] In one possible implementation, the method further includes: after identifying the root cause device, adding alarm events whose residuals are within the interpretation window, and alarm events that, although they do not have the theoretical response delay, satisfy the preset graph association condition with the root cause device, to the interpretation set of the root cause device, and removing the alarm events in the interpretation set from the alarm events participating in the tracing, wherein the interpretation window is a residual range determined by a preset multiple of the robustness threshold; When the accumulated support of the remaining alarm events according to their respective basic weights reaches the support threshold and the stripping rounds have not reached the preset upper limit, the fault domain and candidate devices are re-determined based on the remaining alarm events. The query of theoretical response delay, the construction and solution of residuals, and the determination of the root cause device are repeated to obtain the next root cause device. Otherwise, the stripping is terminated. Alarm events that are not included in the explanation set of any root cause device at the time of termination are included in the suspected false alarm list. The tracing result also includes the suspected false alarm list.

[0013] In one possible implementation, the power grid fault tracing knowledge graph further includes fault mode nodes, which record the applicable equipment categories and characteristic signal sets. The method further includes: comparing the signal composition of each alarm event in the interpretation set of the root cause device with the characterization signal set recorded by each fault mode node applicable to the device category of the root cause device, and determining the fault mode with the highest conformity as the fault type; sorting each alarm event in the interpretation set according to the theoretical time to generate a fault evolution chain, wherein the theoretical time is the sum of the estimated value of the fault occurrence time and the corresponding theoretical response delay, and the fault evolution chain records the theoretical time, station time scale and residual of each alarm event; the tracing result also includes the fault type and the fault evolution chain.

[0014] In one possible implementation, the method further includes: after the source tracing result is confirmed, selecting alarm events whose confidence level of the signal node is not lower than a preset screening threshold from the interpretation set of the root cause device, and determining the measured response delay based on the difference between the station timescale of the alarm event and the estimated value of the fault occurrence time. For the same signal node, when the cumulative number of confirmed cases reaches the preset number of cases, and the difference between the measured response delay and the corresponding delay value recorded in the power grid fault tracing knowledge graph does not exceed the preset update threshold, the delay value is corrected to the measured response delay according to the smoothing coefficient; based on the results of each alarm event being judged as a match or an outlier in this tracing, the match count and outlier count of the corresponding signal node are updated, and the credibility is refreshed; the corrected delay value and the refreshed credibility are used for subsequent tracing.

[0015] Secondly, embodiments of this application provide an electronic device, including: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the knowledge graph-based power grid fault tracing method described in the first aspect.

[0016] Thirdly, embodiments of this application provide a computer-readable storage medium storing computer instructions, which, when executed by a processor, implement the knowledge graph-based power grid fault tracing method described in the first aspect.

[0017] Fourthly, embodiments of this application also provide a computer program product containing instructions that, when run on a computer, cause the computer to execute the knowledge graph-based power grid fault tracing method described in the first aspect.

[0018] The embodiments of this application have at least the following beneficial effects: This application stores parameters such as protection setting level difference, inherent device operating time, and circuit breaker tripping time into a knowledge graph, along with their coverage relationships and response delay attributes. It transforms fault tracing into a time delay inversion process with the fault occurrence time as the unknown variable. Specifically, it calculates the theoretical response delay for each alarm event for each candidate device, uses the residual between this delay and the actual station timescale to measure the degree of agreement with the assumptions, and selects the device with the best overall score as the root cause device. Its advantages include: tracing only uses the numerical difference between timescales without considering their arrival order, thus mitigating the impact of channel delays. Out-of-order alarms no longer cause misjudgments; missed alarms are simply missing a residual, while false alarms fall into unexplainable categories because they do not match any candidate devices. Neither of these issues hinders tracing, and the judgment is robust to incomplete alarm sets. Over-tripping caused by main protection failure or circuit breaker malfunction manifests as backup protection signals appearing according to their set delays, and inversion based on backup delays also matches, eliminating the need for separate modeling for this scenario. Furthermore, the required set delays, inherent action times, and tripping times are all existing data recorded in the setting sheets and ledgers, requiring no additional measuring devices. In addition, protection start-up and protection reset signals are associated with candidate devices according to the start-up coverage edge, and over-limit alarm signals are associated with the measurement edge. The beneficial effect is that various alarms other than action-related signals can also be converted into comparable timing items or explanatory items, thereby increasing the judgment information available for a single case.

[0019] This application uses the equipment corresponding to the alarm event as the seed equipment to induce the fault domain, and cancels the switch changes in the fault window in reverse order to obtain the pre-fault topology. Under this topology, candidate equipment is enumerated and the theoretical response delay is calculated. Its advantages are: candidate enumeration and delay calculation can be performed on the actual energized wiring before the fault; changes in operating modes such as switching and maintenance do not require manual maintenance matching mode; and the maintenance shutdown state before the fault window will not be mistakenly restored to operation; the amount of calculation per round is proportional to the number of equipment and alarms in the fault domain and is independent of the overall network scale; and unconnected fault domains can be grouped and executed in parallel. Among them, the coverage of the bus differential protection for each bay under the double bus connection is instantiated according to the pre-fault topology; the change signal of the shared circuit breaker under the 3 / 2 circuit breaker connection can calculate the theoretical response delay for the components on both sides; and the set of circuit breakers on the power supply side is determined by graph search. Its advantage is that various main wirings can share the same set of query and calculation logic, without the need to set rules separately for different wiring forms.

[0020] This application classifies power plants into trusted and untrusted stations based on their time synchronization status and the difference between the station's internal timescale and the time received by the master station. For alarms from untrusted stations, differential residuals are constructed by subtracting from the same station. The beneficial effects are: the timescale deviations at the power plant level cancel each other out during the subtraction process, so such alarms neither pollute the inversion nor need to be discarded entirely; the judgment results under second-level clock deviations are consistent with those without clock deviations; the inversion can also provide timescale deviation estimates for each untrusted station, providing clues for the repair of time synchronization defects.

[0021] This application uses the confidence level of each signal node as the basic weight, and iteratively weights the results based on the residual size during the solution process. The advantages are: the granularity of confidence is down to the specific signal point rather than the signal type; the weight of a single large-deviation alarm is automatically reduced; random deviations such as operational mechanism jamming and outliers caused by repeated false alarms no longer skew the estimated value at the time of fault occurrence; and the score difference between correct and incorrect candidates is maintained. This application further constructs the candidate device score into three parts: weighted residual level, weighted proportion of unexplained alarms, and necessary signal missing rate. It also eliminates candidates with insufficient interpretable timing support and outputs the confidence margin of the judgment result. The advantages are: incorrect candidates with few explanations but coincidentally matching results are not ranked before correct candidates, and the reliability of the judgment result can be quantitatively represented.

[0022] After identifying a root cause device, this application extracts its interpretation set, continues to trace the source using the remaining alarms, and uses the support level of the signal point confidence weighted cumulatively as the termination criterion for extraction. Its beneficial effects are: multiple faults in the recent time period can be detected one by one, while scattered false alarms with low confidence cannot fill the threshold and will not be pieced together into a false root cause; alarms that have never been interpreted are output as a list of suspected false alarms, which can be transferred to the equipment maintenance process for verification.

[0023] This application compares the signal composition of the interpretation set with the characterization signal set of the fault mode node to determine the fault type, and sorts each alarm event according to the theoretical time to generate a fault evolution chain. Its beneficial effects are: the tracing results provide the fault type and fault evolution process in addition to the root cause equipment, the report lists the theoretical time, actual time scale, residual and interpretation attribution of each alarm, the judgment process can be verified, and it can directly support the issuance of handling instructions.

[0024] After the case is confirmed, this application rewrites the delay value recorded in the knowledge graph according to the measured response delay and refreshes the credibility of the signal point according to the judgment results of the match and outlier. Its beneficial effects are: the result of correction and refresh serves as the input for subsequent inversion. Inversion, confirmation and rewriting form a closed loop. The accuracy of the match and the quality of the weights improve with the accumulation of cases. Situations such as asynchronous adjustment of the setting order, device aging and drift, and new defects in the signal point can be gradually absorbed without the need for offline retraining.

[0025] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0027] Figure 1 A flowchart illustrating a knowledge graph-based power grid fault tracing method provided in this application embodiment; Figure 2 A schematic diagram of a power grid fault tracing knowledge graph provided in an embodiment of this application; Figure 3 A schematic diagram illustrating fault domain induction and pre-fault topology rollback provided in an embodiment of this application; Figure 4 A schematic diagram of time delay inversion provided for an embodiment of this application; Figure 5 A schematic diagram of the decision-making and source-by-source stripping process provided for embodiments of this application; Figure 6 A schematic diagram illustrating the case verification and write-back calibration provided for embodiments of this application; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0028] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0029] The key terms used in this application will be explained below.

[0030] Alarm message: The original alarm data sent from the plant to the dispatch master station. Fields include plant name, device name, signal name text, station timestamp, and master station reception time.

[0031] Alarm Event: A structured record formed after an alarm message is parsed and matched with a signal node, and its number is denoted as [number]. Its internal time marker is The time of reception by the main station is recorded as The station time stamp is the time when the signal is generated by the plant-side device, and the master station reception time is the time when the dispatch master station receives the message. The difference between the two is normally the channel forwarding delay.

[0032] Coverage: The relationship between a protection device and the primary equipment within its protection range is represented by coverage edges in the knowledge graph. Which primary equipment is covered by each protection segment of a protection device is determined by the protection setting sheet.

[0033] Candidate equipment: Primary equipment assumed to be the source of failure in this round of inversion, denoted as... Root cause device: The device identified as the one that triggered this fault process; it is the output object for tracing the source.

[0034] Response delay: The time difference from the moment a fault occurs to the moment a certain signal is emitted. Theoretical response delay: This time difference calculated based on the parameters recorded in the knowledge graph, denoted as... ,in This is the alarm event number. Candidate device.

[0035] Fault occurrence time: The starting time of the root cause equipment failure, denoted as... , is the unknown quantity in the inversion solution, and its estimated value is denoted as . .

[0036] Time scale deviation: The systematic offset of the plant's internal clock relative to the standard time. This offset causes the internal time scales of all alarm events in the plant to shift by the same amount and direction. The timescale deviation is denoted as .

[0037] Reliability: The reliability of alarms from a signal node, calculated based on historical cases, is denoted as . The value ranges from 0 to 1. This is the identifier for the signal node; a larger value indicates that the signal node has historically experienced fewer false alarms.

[0038] Outlier: An alarm event where the residual exceeds the preset range. The determination method is described in subsequent embodiments.

[0039] To identify the root cause device under conditions such as unreliable alarm arrival sequence, timescale containing plant-level deviations, the existence of missed and false alarms, and changes in grid wiring with operating modes and fault processes, this application provides a knowledge graph-based grid fault tracing method. The implementation environment and data sources of this method are described below.

[0040] The knowledge graph-based power grid fault tracing method provided in this application can be applied to electronic devices, such as a data processing service deployed as a power grid dispatch terminal, running on a server in the analysis application area within the security protection framework of a power monitoring system. The data processed by this method consists entirely of power grid operation data and equipment parameter data, and does not involve personal information. Specifically, the power grid model and switch status are obtained from the network model file and remote signaling data of the dispatch automation system, acquired through unidirectional transmission via isolation devices between security zones; alarm messages are obtained from event messages of the protection and fault recording information system; equipment ledgers and protection setting orders are obtained from the production management system; and the operating status of the substation time synchronization device is obtained from the time synchronization status remote signaling sent by the substation. All of the above data is stored and processed within the power grid enterprise's intranet, accessed with minimal privileges. It is understood that the time delay parameters such as setting delay, inherent action time, and tripping time relied upon by this method are all existing recorded data in the protection setting orders and equipment ledgers, and no additional measuring devices are required.

[0041] The relay protection of the power grid operates according to the principle of the main protection acting fastest and the backup protection acting with a sequential delay according to the setting level difference. The protection level difference is usually on the order of 300 milliseconds or more, while the substation's internal timescale accuracy under normal time synchronization is on the order of milliseconds, and the dispersion of the protection device's operating time is on the order of tens of milliseconds. Therefore, once a primary device fails at a certain moment, the offset of the time when each signal issued by all protection devices and circuit breakers in the entire network is a definite quantity that is predetermined by the protection configuration and can be calculated line by line, and this time delay structure has sufficient distinguishing margin between different fault locations. The embodiments of this application store this predetermined time relationship in a knowledge graph and transform fault tracing into an inverse problem: given the actual timestamps of each alarm event, reverse the calculation to determine which device and at what time the fault occurred so that the theoretical occurrence time of each alarm event matches the actual timestamp as a whole. The degree of matching is measured by the residual, and the hypothesis with the best comprehensive score is the root cause.

[0042] In existing technologies, causality is typically inferred based on the arrival order of alarms, or the received alarm set is compared with a preset pattern. In this approach, varying transmission speeds can cause the arrival order to differ from the actual occurrence order, potentially leading to conclusions contrary to reality. Missed or false alarms can disrupt comparison conditions, resulting in matching failures or incorrect hits. After grid maintenance or switching operations, the original pattern no longer corresponds to the actual wiring, requiring continuous manual maintenance. However, in this embodiment, the inversion only uses the numerical difference between timescales, without considering the arrival order; out-of-order alarms do not affect the judgment result. Missing individual alarms only result in one missing residual, while the remaining items participate in the calculation as usual, and the judgment is not interrupted by incomplete alarms. False alarms do not match the assumptions of any candidate devices and will naturally reveal this in the residuals and interpretation attribution, eliminating the need to pre-set cost parameters for various signals. In addition, the over-tripping caused by the failure of the main protection to operate or the failure of the circuit breaker is manifested by the absence of the main protection signal and the appearance of the backup protection signal according to its setting delay. The inversion according to the backup time delay can also match, so there is no need to model this scenario separately.

[0043] In one embodiment, see Figure 1 The knowledge graph-based power grid fault tracing method provided in this application includes the following steps: S101: Construct a knowledge graph for tracing the source of power grid faults.

[0044] S102: Initialize the credibility of each signal node in the knowledge graph.

[0045] S103: Receive alarm messages sent by power plants and substations, match each alarm message to the corresponding signal node in the power grid fault tracing knowledge graph, and obtain alarm events.

[0046] S104: Define the fault window based on the station time stamp of each alarm event, determine the fault domain containing the primary equipment corresponding to each alarm event on the power grid fault tracing knowledge graph; cancel the switch changes that occur in the fault window from the current switch state in reverse order of occurrence to obtain the pre-fault topology; and select the primary equipment energized in the fault domain under the pre-fault topology as candidate equipment.

[0047] S105: For each candidate device, assume it is the source of the fault, and query the theoretical response delay of each alarm event based on the power grid fault tracing knowledge graph.

[0048] S106: Using the fault occurrence time as an unknown quantity, construct residuals from the station's internal timestamps of each alarm event and the corresponding theoretical response delays, solve for the estimated fault occurrence time that minimizes the overall residuals, and calculate the score of each candidate device based on at least the solved residuals.

[0049] S107: The candidate device with the best score is identified as the root cause device.

[0050] S108: Output the source tracing results, which include the root cause device and the estimated time of the failure.

[0051] S109: After the source tracing results are confirmed, the measured response delay and reliability statistics will be written back into the power grid fault source tracing knowledge graph for subsequent source tracing.

[0052] S101 and S102 are executed offline and can be incrementally maintained as the power grid model changes; S103 to S108 are executed online; S109 is executed after each case is resolved. Each step is explained below.

[0053] In S101 above, the power grid fault tracing knowledge graph (hereinafter referred to as the knowledge graph) refers to a graph data structure that uses objects in the power grid as nodes, relationships between objects as edges, and records attributes on the nodes and edges. Its pattern is described in [reference needed]. Figure 2 The inputs used to construct this knowledge graph are power grid model files, equipment ledgers, protection setting sheets, and protection information point tables.

[0054] The nodes of this knowledge graph include plant nodes, primary equipment nodes, circuit breaker nodes, protection device nodes, signal nodes, and fault mode nodes. The substation nodes record the name, alias, voltage level, and time synchronization device point number; the primary equipment nodes record the category, voltage level, assigned bay, operating status, and power supply marking. Categories include lines, busbars, main transformers, etc. For double busbar connections, primary equipment nodes are established separately for each busbar segment. The power supply marking indicates that the primary equipment is a generator or an equivalent injection point from the external power grid; the circuit breaker nodes record the number, assigned bay, corresponding primary equipment, opening time, and closing time. The opening time refers to the time required for the circuit breaker to complete opening and issue a change signal after receiving a trip command, and the closing time refers to the time required for the circuit breaker to complete closing and issue a change signal after receiving a closing command, used for calculating the theoretical response delay of the reclosing change signal in scenarios involving reclosing; the protection device nodes record the model, assigned bay, inherent operating time, return time, and assigned substation. The inherent operating time refers to the time required for the protection device to complete its operation from the satisfaction of its protection criteria to its operating output, and the return time refers to the automatic status return of the protection device after the fault is cleared and the fault quantity disappears. The device time required to issue a reset signal is recorded. The signal node records the signal type, corresponding protection section, associated interval, additional delay, reliability count, and current reliability. The signal types include main protection action type, backup protection action type, circuit breaker change type, circuit breaker body type, protection start type, protection reset type, general accident type, ordinary remote signaling change type, and over-limit alarm type. The main protection action type and backup protection action type are collectively referred to as protection action type. The circuit breaker body type refers to signals that reflect the circuit breaker's own state rather than its open / closed position, such as spring not being energized or low gas pressure blocking. The corresponding protection section is recorded according to the protection information point table, which refers to the protection section corresponding to the signal. The signal node of the protection action type signal records this attribute for S105 to select the coverage edge. The signal nodes of other signal types do not record this attribute. The additional delay is the extra delay corresponding to the signal type. For example, the additional delay of the protection start type signal is the judgment time of the device start criterion, and the additional delay of the protection action type signal is zero. The fault mode node records the applicable equipment category, characteristic signal set, and type name. All of the above-mentioned time delay attributes are obtained from equipment ledgers, protection setting sheets, or device manuals. A bay refers to a group of equipment within a substation, centered around a circuit breaker and including primary equipment directly connected to it and corresponding protection devices. Bays are not set up with separate nodes, but are recorded as attributes of the aforementioned nodes. Primary equipment such as lines that cross substations are recorded as belonging to bays on each substation side.

[0055] The edges of this knowledge graph include connection edges, belonging edges, protection edges, coverage edges, issuing edges, linkage edges, measurement edges, exit edges, and representation edges. Connection edges connect two primary equipment nodes and record the circuit breaker or disconnector numbers traversed. Belonging edges indicate the affiliation of primary equipment, circuit breakers, and protection devices to the substation, with no nodes specified at intervals but node attributes recorded. Protection edges point from the protected device node to the protected primary equipment node and record the main protection or backup marking. Coverage edges point from the protected device node to each primary equipment node within its protection range, recording the section number, setting delay, and level. Issuing edges point from the protected device node to its signal nodes. Linkage edges point from the circuit breaker node to the signal nodes of that circuit breaker. This includes displacement signal nodes and body signal nodes such as spring unstored energy; the measurement side points from the primary equipment node to the over-limit alarm signal node that measures the primary equipment; the output side points from the protection device node to the circuit breaker node that tripped at its operation output, and is recorded according to the output configuration of the protection setting sheet; the characterization side points from the fault mode node to the signal node that serves as the characterization signal, and records the role of the signal in the fault mode and necessary or typical markings on the side. The role is defined by the signal type of the signal node and its position relative to the root source equipment, such as the operation of the main protection on both sides or the start of the protection of adjacent equipment.

[0056] The protection segment is defined according to the specific protection segment corresponding to the coverage edge recorded in the protection setting sheet, such as longitudinal differential protection, distance segment II, and distance segment III. This distinguishes between the main protection segment and the backup protection segment, and its value is consistent with the corresponding protection segment recorded in the signal node. The setting delay refers to the action delay set for this protection segment in the protection setting sheet; that is, the delay time required after the protection criteria for this segment are met. The setting delay for the main protection segment is zero, and the setting delay for the backup protection segment is the setting value recorded in the protection setting sheet. The level indicates whether the protection segment corresponding to the coverage edge is the expected first disconnect path when the covered equipment fails. If yes, it is marked as the main level; otherwise, it is marked as the auxiliary level. It is understandable that protection initiation, protection action, and protection reset signal nodes are associated with the protection device node that issues the corresponding signal via the issuing edge. Circuit breaker position change and circuit breaker body signal nodes are associated with the circuit breaker node that issues the corresponding signal via the linkage edge. Therefore, the device that issues the signal can be traced back along the issuing or linkage edge, and then the related primary equipment node can be traced back along the coverage edge. The question of "how many milliseconds after a fault occurs when a certain device fails" is thus transformed into a single lookup along the graph. Over-limit alarm signal nodes are associated with the primary equipment node of the measured object via the measurement edge, and the primary equipment of the measured object can be traced back along the measurement edge. Therefore, except for over-limit alarms and other signal nodes generated by measuring over-limits, every signal node is associated with the protection device node or circuit breaker node that issues the corresponding signal.

[0057] In one embodiment, the knowledge graph is constructed as follows: First, the power grid model file is parsed to generate substation nodes, primary equipment nodes, circuit breaker nodes, and connecting edges and belonging edges; Second, the protection setting order is parsed to establish protection device nodes for each set of protection, and coverage edges are established for each device according to its protection range. The setting delay of the main protection section is recorded as zero, and the backup protection section is recorded as the setting value. The hierarchical attribute is marked as the main layer or auxiliary layer according to whether the section is the expected first cut-off path when the device fails; Third, the protection information point table is parsed to establish signal nodes, as well as sending edges, linkage edges, and measurement edges, and output edges are established according to the output configuration of the protection setting order; Fourth, for protection start-up signals and protection reset-up signals, start-up coverage edges are established according to the sensitivity range of the protection device start-up element, that is, the shortest graph distance from the protection device node to the primary equipment it protects along the connecting edge does not exceed the number of start-up coverage jumps. Each primary equipment node, In this embodiment, option 2 is selected. In other implementations, options 1 to 3 can be selected. Here, metering along the connecting edge means that the path only passes through the connecting edge, and one hop is counted for each connecting edge passed. The same applies below. Alternatively, the activation sensitivity range can be established for each device according to the protection setting sheet or device manual. The setting delay of the activation coverage edge is set to zero. Fifth, the fault mode nodes and characteristic edges are organized according to the scheduling procedure and historical cases. Sixth, a dictionary and alias table are generated for the names of all nodes for online matching by S103.

[0058] In one embodiment, complex main wiring is modeled as follows: for double busbar wiring, primary equipment nodes are established for each busbar segment, and the coverage edge of the bus differential protection is built to the busbar segment node, which is called structural coverage; the current affiliation of each bay of the busbar segment is not written into the static attributes of the knowledge graph, but is obtained online by the connection edge of the busbar disconnector of the bay and its closed state. The analysis result is called instantiation coverage, and the analysis timing is shown in S104. Under the 3 / 2 circuit breaker wiring, each circuit element is connected to two busbars through the two connection edges of the side circuit breaker and the intermediate circuit breaker, which is a normal graph structure and does not require special rules; the intermediate circuit breaker is shared by the two circuit elements, and the protection devices of the two circuit elements are all pointed to the intermediate circuit breaker through the output edge. Therefore, the change signal of the circuit breaker can be used to calculate the theoretical response delay of the two circuit elements according to formula (2). In this way, the difference in the main wiring form is reduced to the difference in graph structure, and all types of wiring can share the same set of subsequent query and calculation logic.

[0059] In this embodiment, a graph database is used to store the knowledge graph. Graph databases are well-known technologies and will not be described in detail here. As other implementation methods, implementers may also use other storage forms such as memory graph structures. This embodiment does not impose any special restrictions on this.

[0060] In S102 above, each signal node records its reliability count, including the number of matches. Number of wild values The "match count" refers to the cumulative number of times an alarm event of this signal node has been judged as a match in historical cases. The "outlier count" refers to the cumulative number of times it has been judged as an outlier. The determination method for matches and outliers is described in S109. Signal Node The credibility is calculated according to formula (1).

[0061] ; in, Indicates signal node Credibility; , This represents the a priori pseudo-count of the signal type to which the signal node belongs. This is equivalent to a pre-assigned number of virtual matches. This is equivalent to the number of virtual wild values ​​assigned in advance; , This represents the cumulative number of coincidences and outliers for the signal node. It is understandable that when there are no actual cases, the confidence level calculated by formula (1) is equal to the prior value; as the number of coincidences and outliers in actual cases accumulates, the confidence level gradually converges to the actual reliability of the signal node.

[0062] In this embodiment, the total strength of the prior pseudo-count Setting the initial confidence level to 10 means the confidence level is derived from 10 historical observations. A significant change in confidence level requires a similar number of new cases. As another implementation method, the implementer can set the initial confidence level within the range of 5 to 30 based on the quality of the on-site signals. The prior pseudo-counts for each signal type are set as follows: Main protection action signals are set to (9.5, 0.5), corresponding to an initial confidence level of 0.95; backup protection action signals and circuit breaker position change signals are set to (9, 1), corresponding to 0.90; protection start-up and protection reset signals are set to (8.5, 1.5), corresponding to 0.85; general accident signals are set to (8, 2), corresponding to 0.80; circuit breaker body signals and ordinary remote signaling position change signals are set to (6, 4), corresponding to 0.60; and over-limit alarm signals are set to (5, 5), corresponding to 0.50. It can be seen that the clearer the action logic and the lower the probability of false triggering on-site, the higher the initial confidence level of the signal type, and the greater its weight in subsequent solutions. For ease of reference, the signal types are listed below. The initial credibility is denoted as That is, calculated according to formula (1), where the prior pseudo-count is the value set for the signal type, and the number of matches and the number of outliers are both zero; alarm events The type of signal to which it belongs is denoted as signal node The type of signal to which it belongs is denoted as .

[0063] In one embodiment, when historical cases are available, at least 50 definitively identified historical fault cases are selected, and steps S103 to S108 are executed sequentially according to their occurrence. After manual verification of the root cause, the data is written back according to step S109. Using this method, the reliability and delay attributes are already close to the actual field conditions before deployment, which can shorten the convergence process after deployment. When there are no historical cases, the aforementioned prior values ​​can be used directly for deployment. It should be noted that the preheating function mainly refreshes the reliability of each signal node; one case can count one match or outlier for each signal node in its explanation set. The correction of delay values ​​must be triggered only after the preset number of cases for the same signal node is accumulated according to step S109. Therefore, the preheating cases should cover all voltage levels and all major main wiring configurations, and cases that repeatedly occur in the same interval should be prioritized. For signal nodes that have not reached the preset number of cases, their delay values ​​remain as recorded in the ledger and do not affect the normal execution of the method.

[0064] In S103 above, the matching process is as follows: five fields—plant name, voltage level, interval, device, and signal phrase—are parsed from the message text using a regular expression template. Regular expression parsing is a well-known technique and will not be elaborated upon here. Based on the dictionary and alias table generated in S101, candidate signal nodes are filtered sequentially according to plant / station consistency, voltage level consistency, and interval context consistency. The interval context is checked against the interval attribute recorded by each node; a unique match completes the matching of the message to the signal node. Each alarm event obtained after matching records at least the corresponding signal node, station timestamp, master station reception time, and the plant / station to which it belongs. Alternatively, approximate text matching based on word segmentation or edit distance can be used, or direct mapping can be performed according to the point number in the protection information point table. Any matching method that can map an alarm message to a unique signal node can be used as the method described in this application for matching alarm messages to signal nodes.

[0065] Messages that fail to uniquely match are placed in a manual pending queue. They are not involved in the construction and solution of residuals, nor in the calculation of scores and support levels. In the source tracing results, they are listed separately as a list of unmatched messages by plant / station for manual verification. In this embodiment, each message in this list is marked with a reference confidence level of 0.30. 0.30 is lower than the minimum initial confidence level of 0.50 for each signal type. In other implementations, the implementer can set this level within the range of 0.1 to 0.5. Thus, unmatched messages will not interfere with the solution due to their participation in timing calculations, while their existence itself can still be verified by on-duty personnel.

[0066] In some embodiments of this application, S103 further includes: classifying the power station into trusted and untrusted stations based on the station's time synchronization status and / or the difference between the station's internal timestamp and the master station's reception time for the alarm event. Specifically, the power station exhibits abnormal time synchronization remote signaling, or the alarm event of the power station satisfies... If more than half of the records are found to be true, the plant / station is classified as an untrusted plant / station; otherwise, it is classified as a trusted plant / station. The time synchronization status refers to the remote signaling of the operating status of the plant / station's time synchronization device; this remote signaling is set when time synchronization is abnormal. This threshold represents the reliability classification threshold for the timescale. Under normal circumstances, the difference between the station's timescale and the master station's received time is only the channel forwarding delay. Exceeding this threshold indicates that the station's timescale contains an abnormal deviation. In this embodiment... The value is 1 second, determined according to the upper limit of the normal forwarding delay of the channel. Alternatively, it can be selected within 0.5 to 5 seconds as another implementation method. Optionally, the division can be based solely on the time synchronization status or solely on the difference between the station's internal timescale and the master station's receiving time. The division result is used to construct the residual in S106. It should be noted that the difference between the station's internal timescale and the master station's receiving time includes both the station's clock offset and the channel forwarding delay, and is only used as a criterion for distinguishing between trusted and untrusted stations; the timescale deviation estimated in S106 is only the station's clock offset, and the two have different calibers.

[0067] In S104 above, the fault window is the time interval processed in this round of tracing. Protection-related alarm events refer to alarm events whose signal type is protection activation, protection action, or protection reset. The fault window is defined as follows: the starting point of the fault window is the station's timestamp shifted backward from the earliest protection-related alarm event. After that, the timer is refreshed whenever a new protection-related alarm event occurs, and the protection-related alarm events remain silent. The fault window is closed off. Among them, The fault window advance value is used to cover the timescale advance or lag caused by channel jitter. In this embodiment, it is set to 10s, but in other implementations, it can be selected within 5 to 60s. The silent closing time of the fault window is set to 5 seconds in this embodiment, but can be selected from 2 to 15 seconds in other implementations. Alternatively, the earliest station timescale among all alarm events can be used as the starting point, shifted forward by a preset amount, and the fault window can be selected for a preset fixed duration. When the station timescale deviation exceeds the fault window span, the alarm events of that station are included in the fault window according to their master station reception time. After inclusion, they are still treated as unreliable stations and solved using differential residuals. For stations with existing historical estimates of timescale deviation, their station timescales can be shifted according to these estimates before being included in the fault window.

[0068] The fault domain is determined as follows: Primary devices obtained through reverse lookup of each alarm event are used as seed devices. Specifically, if a protection device is traced back via the sending edge, the primary device pointed to by the protection device's coverage edge and activation coverage edge is taken; if a circuit breaker is traced back via the linkage edge, the primary device corresponding to the interval to which the circuit breaker belongs is taken; if a measurement object is traced back via the measurement edge, the primary device of the measurement object of the signal node is taken; for signals such as general fault categories that are not associated with any of the above edges to a device or measurement object, the primary device corresponding to the interval to which the signal node belongs is taken. If there is no corresponding primary device in the interval to which the alarm event belongs, no seed device is generated. Then, the connected range containing all seed devices is taken on the knowledge graph and expanded outward along the connecting edges. Jump. Among them, The number of hops for fault domain expansion is set to 1 in this embodiment, but can be 1 to 2 in other implementations. The calculation and expansion of the above-mentioned connectivity range are performed along the connection edge where both switches are in the closed position at the starting time of the fault window. The switch open / closed state at this time is obtained from the current switch state and the change record in the fault window, which is consistent with the topology before the fault described later. The connection edge corresponding to the switch under maintenance and shutdown does not participate in connectivity. When the seed device belongs to multiple unconnected ranges, each range is treated as an independent fault domain and the subsequent steps are executed in parallel. As another implementation, the expansion of the fault domain can also be limited by voltage level or shortest graph distance; any method of defining the candidate range by the neighboring range on the knowledge graph can be used as the method for determining the fault domain described in this application.

[0069] The pre-fault topology represents the energized connection state of the power grid at the start of the fault window. It is obtained by copying the current switch status table and canceling the switch changes (circuit breakers, disconnectors, etc.) occurring within the fault window in reverse order of their occurrence, i.e., canceling the most recent changes first, one by one. Maintenance and shutdown states existing before the fault window are not subject to cancellation and are automatically retained. Furthermore, primary equipment energized within the fault domain under the pre-fault topology is considered as candidate equipment. "Energized" means that the primary equipment is connected to any equipment with a power supply marker via a closed switch in the given topology. Primary equipment nodes whose operating status is maintenance and shutdown are not considered candidate equipment. For the fault domain induction and pre-fault topology rollback process, see [link to relevant documentation]. Figure 3 .

[0070] The reason for this rollback is that the available switch state online is the current switch state after the fault trip, at which point the circuit breakers on both sides of the root cause equipment are often already open. If the current switch state is used to determine energization, the root cause equipment will not be within the energized network, and the correct assumption will be missed in the candidate stage. Furthermore, the theoretical response delay must be calculated along the actual energized wiring before the fault to be valid; the rollback precisely connects these two aspects. Simultaneously, the maintenance and shutdown status before the fault window is automatically retained, preventing the equipment under maintenance from being mistakenly restored to an operating state, and changes in operating modes such as switching and maintenance do not require manual intervention.

[0071] Furthermore, if all primary devices in the entire network are considered as candidate devices, the number of graph queries and residual calculations will increase with the scale of the power grid, making it difficult to meet the time requirements for online handling. By adopting the fault domain pruning method described above, the amount of calculation per round is fixed within the fault domain scale, independent of the overall network scale, which can meet the time requirements for online handling.

[0072] In one embodiment, the pre-fault topology is also used to instantiate the structural coverage in S101: under the double busbar connection, the coverage of the bus differential protection for each bay is expanded into an instantiated coverage according to the closing position of each bus disconnecting switch at the start time of the fault window, for query in S105.

[0073] In S105 above, for each pair of candidate devices With alarm events First, check the alarm events. signal nodes The associated protective device With candidate devices The overlapping edge between them. If there is no overlapping edge, it is recorded as an alarm event. For candidate devices There is no theoretical response delay; if a coverage edge exists, it is calculated according to signal type. For protection start-up signals and protection reset-up signals, the queried coverage edge is the start-up coverage edge of the protection device. For circuit breaker change-up signals, the circuit breaker that issued the signal is first traced back along the linkage edge. protection device Learning from the experience of covering edge coverage candidate equipment And the circuit breaker is pointed to from the outlet side. The protection device; when there are multiple available coverage edges for the same candidate device for the same alarm event, the following order shall be used to uniquely determine the coverage edge: if the signal node records the corresponding protection segment, the coverage edge corresponding to the protection segment shall be taken; if there are still multiple coverage edges located according to the corresponding protection segment, the one with the smallest setting delay shall be taken; if the corresponding protection segment recorded by the signal node does not have a coverage edge on the candidate device, it shall be recorded that the alarm event has no theoretical response delay on the candidate device, and it shall not be backed up to calculate according to other protection segments. If no corresponding protection segment is recorded, the one with the main layer level shall be taken first. If there are multiple coverage edges of the main layer or each edge is an auxiliary layer, the one with the smallest setting delay shall be taken. This selection is based only on the corresponding protection segment, level and setting delay recorded in the knowledge graph, and does not depend on the residual and the estimated value of the fault occurrence time. Therefore, it is determined before the first solution of formula (6), and there is no mutually dependent loop. As another implementation, in each round of the iteration described in S106, the residuals corresponding to each available cover edge can be calculated one by one according to formula (4) based on the current fault occurrence time estimate. The one that minimizes the absolute value of the residual is then selected and updated in the same round as the weight, until the selected cover edge no longer changes and the fault occurrence time estimate converges.

[0074] For protection start-up signals, protection action signals and circuit breaker change signals, the theoretical response delay is calculated according to formula (2).

[0075] (2); in, Indicates an alarm event In candidate devices Theoretical response delay under the assumptions; Indication device Coverage equipment The set delay recorded on the coverage edge is zero for the main protection section; Indication device The inherent motion time; Indicates circuit breaker The time of circuit breaker tripping, The circuit breaker that issued the change signal; Indicates signal node The recorded additional time delay. The values ​​for each item in formula (2) are determined according to the signal type: for protection action signals, and Taking zero, the theoretical response delay is obtained by adding the set delay and the inherent operating time; for circuit breaker displacement signals, Taking zero, the theoretical response delay is calculated by adding the corresponding circuit breaker's opening time to the protection action signal; for protection start-up signals, , and All values ​​are set to zero, and the theoretical response delay consists only of the additional delay, i.e., the discrimination time of the protection device's activation criterion, calculated from the moment the fault occurs. This is consistent with the actual process after a fault: after the fault occurs, the activation element of the protection device sends an activation signal based on the discrimination time of its activation criterion; after the protection criterion is met, the protection first waits for its set delay, and then, through the device's inherent operating time output, the trip command changes position after the circuit breaker's opening time. The delays of each link are sequentially connected in series and added one by one. This does not involve the type of signal from the circuit breaker. The item is set to zero and no circuit breaker is specified. .

[0076] For protected reversion signals, the theoretical response delay is calculated according to formula (3).

[0077] (3); in, Indicates candidate device The theoretical clearing time, i.e., the time elapsed from the moment the fault occurred until the candidate device is completely cleared, is an offset relative to the moment the fault occurred, just like the theoretical response delay. It is denoteed with an uppercase letter to distinguish it from the symbol representing absolute time, and its value is... The maximum value in the theoretical response delay of each power supply side circuit breaker during displacement; Indication device The return time is taken as the maximum value because the protection only starts returning after the fault disappears, and the fault disappears only after the last power supply side circuit breaker trips. Here, the power supply side circuit breaker refers to the device that, in the topology before the fault, is the candidate device. On every path leading to any device marked with a power indicator, at a distance The set of circuit breakers currently in the closed position is obtained by graph search, specifically by depth-first search: starting from the candidate device, search layer by layer along the connection edge. When a circuit breaker in the closed position is encountered, it is recorded and the search is stopped in that direction. When a switch is in the open or under maintenance state, the direction is blocked until all directions have been searched. Depth-first search is a well-known technique and will not be elaborated here. It is understood that the search rule does not change with the main wiring form. Under the 3 / 2 circuit breaker wiring, the set automatically includes the side circuit breaker and the middle circuit breaker. The change signal of the shared circuit breaker can be used to calculate the theoretical response time delay of the components on both sides according to formula (2). The coverage edge level is the main layer. If there is no protection device in each power supply side circuit breaker that covers the candidate device through the coverage edge and points to the circuit breaker through the outlet edge, its displacement theoretical response delay will not be included in the selection of the above maximum value; if there is no such protection device in all power supply side circuit breakers, the protection reset signal of the candidate device will not be calculated with theoretical response delay, and its interpretability will be determined according to the preset diagram correlation conditions.

[0078] For alarm events of the over-limit type, as well as alarm events of the general accident type, ordinary remote signaling change type, and circuit breaker body type, since there is no definite time delay relationship between their issuance time and fault location, the timing item is not calculated. Instead, the impact on candidate equipment is determined only according to the preset on-diagram association conditions. Is this explainable? The preset graph association conditions refer to the primary devices and candidate devices matched by the alarm event. The shortest graph distance measured along the connecting edges on the knowledge graph does not exceed the number of hops associated with the over-limit alarm. In this embodiment Option 2 can be used, and options 1 to 3 can be used in other implementations. The primary device matched by the alarm event is determined according to its signal type: for over-limit alarm signals, the primary device of the measurement object obtained by reverse lookup along the measurement edge is selected; for circuit breaker body signals, the primary device corresponding to the circuit breaker bay obtained by reverse lookup along the linkage edge is selected; for general accident and ordinary remote signaling change signals, the primary device corresponding to the bay to which the signal node belongs is selected. The above reverse lookup path is consistent with the reverse lookup path of the seed device in S104. Any method of reverse lookup from the signal node to the unique primary device node along the edge of the knowledge graph can be used as the method for determining the primary device matched by the alarm event as described in this application. As another implementation, the preset graph association condition can also be set as: the primary device matched by the alarm event and the candidate device. Before the fault, the closed switching devices are connected and have the same voltage level in the topology; any preset condition that characterizes the electrical association between two nodes on the knowledge graph as the degree of proximity between them and the fault can be used as the preset graph association condition described in this application.

[0079] For alarm events classified as protection initiation, protection action, protection reset, and circuit breaker displacement, their issuance is predicated on the coverage relationship between the protection device and the candidate device. Therefore, if there is no corresponding coverage edge, i.e., no coverage edge for the candidate device... When there is no theoretical response delay, it is considered that the preset graphical correlation conditions are not met, and it is recorded as uninterpretable for the candidate device. This is consistent with the selectivity of protection: when a candidate device fails, the protection not covering that device should not operate, and its start, operation, and reset signals, as well as the circuit breaker change signals caused by its output, cannot be interpreted by the failure of the candidate device. Accordingly, each alarm event in the fault domain is uniquely classified into one of the following three categories for each candidate device: alarm event with theoretical response delay, alarm event without theoretical response delay but meeting the preset graphical correlation conditions, and alarm event uninterpretable for the candidate device.

[0080] In some embodiments of this application, S105 further includes: for each candidate device Determine the necessary signal set. The necessary signal set includes at least the hypothetical candidate devices. The expected first action signal of the main protection system and the corresponding circuit breaker position signal during a fault, i.e. The main protection action signals and output circuit breaker position change signals corresponding to each main layer coverage edge, wherein the output circuit breaker refers to the circuit breaker that the protection device corresponding to the main layer coverage edge points to through the output edge; in addition to the necessary signal set, and candidate devices The remaining signals with coverage association are non-essential signals. If a non-essential signal is predicted to exist but no corresponding alarm event is observed, it is not counted as missing. If it is observed, it participates in the interpretation normally according to formulas (2) and (3). Using this method, the over-trip scenario caused by the main protection failure to operate or the circuit breaker failure does not need to be modeled separately: the missing necessary signals are included in the necessary signal missing rate in S106, and the backup protection action signal participates in the matching according to its set delay. As another implementation method, the necessary signal set may also include the protection start signal of the protection device corresponding to each main layer coverage edge of the candidate equipment, the total accident signal of the plant, or the signal list pre-set for each equipment category according to the scheduling procedure.

[0081] In S106 above, for each alarm event with a theoretical response delay... Using the time of the fault occurrence as the unknown, the residual is constructed according to formula (4). The time delay inversion process is described in [reference needed]. Figure 4 .

[0082] (4); in, Indicates an alarm event In candidate devices Residuals under assumptions; This indicates the site's internal timestamp for the alarm event; This indicates the time when the fault occurred, and is an unknown quantity to be determined. Indicates the theoretical response delay. and The sum of these values ​​represents the theoretical occurrence time of the signal under this assumption. It is understandable that if the candidate device... If the fault is indeed the source and the time stamp is correct, the residual calculated by formula (4) for each alarm event should be close to zero within the range of device action dispersion.

[0083] In actual operation, some power plants have systemic deviations in their time signatures due to abnormal timing devices or large channel delays. These deviations can reach hundreds of milliseconds or more, which is comparable to the protection level difference. If such time signatures are directly entered into the residuals according to formula (4), the residuals of each candidate device will be raised as a whole and the candidate ranking will be distorted. If the alarms of the power plant are abandoned as a whole, all the timing evidence will be lost.

[0084] Therefore, in some embodiments of this application, based on the trusted and untrusted stations divided in S103, the residuals are constructed as follows: For alarm events of trusted stations, the residuals are constructed according to formula (4), and the resulting residuals are called absolute residuals; for alarm events of untrusted stations, their absolute timestamps are not used, but an alarm event within the same plant is selected as a benchmark, and the difference between the in-station timestamps of the remaining alarm events of the plant and the benchmark event, minus the difference between their theoretical response delays, is used to construct differential residuals according to formula (5). In this embodiment, the interpretable alarm event with the highest weight and theoretical response delay of the plant is selected as the benchmark event. When there are multiple events with the highest weight, the one with the earliest timescale within the station is selected; when the timescales within the station are also the same, the one with the smallest alarm event number is selected. The absolute residual term constructed according to formula (4) and the difference residual term constructed according to formula (5) are collectively referred to as the time series term. As another implementation method, the alarm event with the earliest timescale within the plant and station and with the theoretical response delay can also be selected as the reference event; the plant and station level timescale deviation occurs equally for each alarm event in the same station, and the selection of different reference events does not affect the effect of the deviation canceling out in the difference.

[0085] (5); in, Indicates an alarm event Relative benchmark event In candidate devices Difference residuals under the assumptions; , Representing the baseline event The station's internal timescale and theoretical response delay. Because all alarms in the same substation share the same clock and channel, their internal timescales contain the same timescale deviation. When the difference is calculated, the deviation appears simultaneously in both the minuend and the subtrahend and cancels each other out. Therefore, the difference residual only retains the relative timing information related to the fault location; and formula (5) does not contain The differential residuals are independent of the fault occurrence time. Using this method, alarms from untrusted stations neither pollute the solution nor need to be discarded entirely; their timing information continues to participate in the determination in the form of differentials. Baseline Event It does not constitute a time series term on its own, and its interpretation is determined as follows: when all differential residual terms of the plant are within the interpretation window, the reference event and the other alarm events of the plant are included in the interpretation set of the root cause equipment; when there are differential residual terms outside the interpretation window of the plant, the time scale deviation estimated in accordance with S106 is deducted. The subsequent equivalent residual Determine the interpretation and attribution of the baseline event, as well as its consistency and outliers. If there is only one alarm event with theoretical response delay in an untrusted station, and that station has no timing item, the interpretation and attribution of this event are also determined according to the equivalent residuals described above.

[0086] Then, the estimated time of failure that minimizes all residuals is obtained. Since formula (4) has... To achieve linearity, minimize the weighted sum of the squared residuals. The problem has a closed-form solution, and the estimated value of the time of failure is calculated according to formula (6).

[0087] ; in, This represents the estimated time of the fault occurrence. Indicates an alarm event The current weights; summation iterates through the alarm events with theoretical response delays in trusted stations; if trusted and untrusted stations are not distinguished, all alarm events with theoretical response delays are traversed. Formula (6) is the weighted least squares objective pair. The analytical solution obtained by setting the derivative to zero is essentially a weighted average of the fault times derived from each alarm event. When all alarm events are equally weighted, take... That's it. Difference residuals and It is irrelevant and does not participate in the calculation of formula (6), but only participates in the residual evaluation and subsequent scoring. When there is no trusted station, the plant where the alarm event with the highest weight among the non-trusted stations is located is temporarily treated as a trusted station. When there are multiple ones with the highest weight, the one with the earliest time scale in the station is taken. When the time scales in the station are also the same, the one with the smallest alarm event number is taken and participates in the solution of formula (6). The estimated value of the fault occurrence time is combined with the time scale deviation of the plant. At this time, the estimated value of the fault occurrence time is marked as a relative value, and the determination of the root cause equipment is not affected. Alternatively, in this case, only the differential residual of each candidate equipment, the weighted proportion of unexplainable alarm events and the necessary signal missing rate are calculated, and the estimated value of the fault occurrence time is not output.

[0088] When all alarm events are equally weighted, the following situations also exist: In addition to the random deviations caused by the dispersion of circuit breaker operating mechanisms and the fluctuation of protection device action time, there may also be outliers caused by repeated false triggering of individual signal points due to secondary circuit defects. The square operation in least squares will amplify the influence of outliers. A single large deviation alarm can deviate the estimated value of the fault occurrence time and compress the score gap between correct and incorrect candidates.

[0089] Therefore, in some embodiments of this application, a basic weight is set for each alarm event to participate in the residual construction and solution. The basic weight is taken from the confidence level recorded by the signal node of the alarm event, i.e. The solution is obtained iteratively using the following process: Taking each basic weight as the initial weight, i.e., let... Update the estimated time of failure occurrence according to formula (6) under the current weight. and will Substitute into formulas (4) and (5) to update the residuals; then update the weights of each alarm event according to formula (7); repeat the above process until... The change is less than the convergence threshold or the iteration reaches the preset number of rounds. In this embodiment, the convergence threshold is 1ms, but in other implementations it can be selected from 0.5 to 5ms; the preset number of rounds is 10 rounds, but in other implementations it can be selected from 5 to 20 rounds.

[0090] (7); in, Indicates an alarm event In candidate devices Assuming the absolute value of the current residual, the difference residual term is... Substitute; This represents the robustness threshold. It can be seen that the residual does not exceed... The alarm events retain their basic weights, and the greater the residual is... The lower the weight of the warning signal, the less effective it is at skewing the estimated value of a single large deviation alarm. In this embodiment... The timescale accuracy within the station and the dispersion of device actions are taken as the sum of 30ms. For other implementation methods, the timescale accuracy can be selected within the range of 10 to 60ms.

[0091] It is understandable that the weights in the above iteration process are bounded and non-negative. Formulas (6) and (7) constitute an iterative weighted least squares process, which is equivalent to alternating minimization of the Huber-type robust objective function. The objective function value is monotonically non-increasing in each round, and the estimated value sequence converges accordingly. At the same time, the upper limit of the number of rounds ensures that the solution will terminate within the online time limit. The estimated value, each residual, and each weight in each round can be output and checked item by item, and there are no unexplainable intermediate links. Any solution method that minimizes the overall level of each residual under a given weight can be used as the method described in this application for finding the estimated value of the fault occurrence time that minimizes the overall residual. Among them, iterative weighted least squares is a well-known technique and will not be described in detail here.

[0092] In one embodiment, before calculating the score, the sum of the weights of the interpretable time series items is first set to be lower than the minimum time series support. Candidate devices were eliminated, among which... This represents the minimum timing support of a candidate device, i.e., the lower bound of the sum of the weights of its explainable timing items, and the weight of a single alarm event. Different calibers. In this embodiment... A value of 1.5 is chosen, slightly lower than the sum of the weights of the two protection activation signals (1.70). As another implementation method, a value between 1 and 3 can be selected. Thus, candidate devices supported only by sporadic low-quality alarms are no longer included in subsequent calculations.

[0093] Furthermore, the scores of each candidate device are calculated based on at least the residuals obtained after solving. In this embodiment, it is agreed that the smaller the score value, the more consistent the hypothesis is, and the optimal score is the smallest score. In one embodiment, the weighted residual level is directly used as the score, and the weighted residual level is calculated according to formula (8). As another implementation, the score can also be defined as the form in which the larger the value, the more consistent the hypothesis is, in which case the optimal score is the largest score, and the two conventions are essentially the same.

[0094] ; in, Indicates candidate device The weighted residual level; This represents the Huber loss function. hour , hour That is, residuals exceeding the robustness threshold are accounted for linearly rather than squared, thereby suppressing the amplification of large deviation terms by squaring operations; where, As formal variables, when substituting, take the absolute residual term as... Take the difference residual term Summation iterates through all time series terms of the candidate device, including absolute residuals and difference residuals; the denominator contains... The square of makes Become a dimensionless quantity. Approximately equal to 1 corresponds to residuals generally reaching the threshold level. Using the aforementioned basic weights and iterative solutions, the score is calculated based on the weighted residuals. In formulas (7) and (8), the difference residual term is... Substitution Normalization can also be achieved by dividing by the number of time series items. Methods such as the product of squares; any processing that makes the weighted residual level a dimensionless quantity that can be compared among candidate devices can be used as the normalization described in this application. The Huber loss function is a well-known technique and will not be elaborated upon here.

[0095] When using only the weighted residual level as the score, the following situation may occur: if a candidate device with a fault can only explain a few alarms, and the timestamps of these alarms happen to match its theoretical response delay, then the weighted residual level of the candidate device is actually very small, and it may be ranked ahead of the correct candidate.

[0096] Therefore, in some embodiments of this application, the weighted residual level is... Weighted proportion of unexplained alarm events and the necessary signal missing rate The candidate device scores are obtained by weighting and summing the results according to preset coefficients. Among them, alarm events that have neither theoretical response delay nor meet the preset graph association conditions described in S105 are recorded as unexplainable for the candidate device. , With rating Calculate according to formulas (9) to (11) in sequence.

[0097] (9); (10); (11); in, This represents the sum of the base weights of all alarm events that are inexplicable for this candidate device, as a percentage of the sum of the base weights of all alarm events within the fault domain. This indicates the proportion of signals in the essential signal set for which no corresponding alarm event was observed. Non-essential signals outside the essential signal set that have coverage association with the candidate device are not counted as missing if no corresponding alarm event was observed. The coefficient of the uninterpretable term is represented. The coefficients represent missing terms. The tuning rule for both is to ensure that the penalty for a high-weight, unexplainable alarm is equivalent to the penalty when the residual reaches the robustness threshold, thus making the three components comparable on the same dimensional scale. In this embodiment... Take 4. Option 2 is chosen as another implementation method. You can choose from 2 to 8. The selection can be from 1 to 4. Using this method, if a candidate device cannot interpret many alarms, or if a large number of necessary signals that should appear are missing, it is unlikely to be ranked highly, even if its residual is small. Among these, Indicates the candidate device A collection of unexplained alarm events. Represents the set of all alarm events within the fault domain; Indicates candidate device The necessary set of signals, This represents the subset of signals in the necessary signal set for which no corresponding alarm event has been observed; For signal nodes The initial confidence level of the signal type is a fixed value taken from the signal type, and is the same as the basic weight used in formula (9). It is taken from the signal node and varies depending on the case refresh.

[0098] In some embodiments of this application, S106 further includes: estimating the timescale deviation of each untrusted station based on the station's internal timestamp of each alarm event, the corresponding theoretical response delay, and the estimated fault occurrence time obtained from the solution. Specifically, Take-off station Alarm events with theoretical response delays The median, which is the common offset of the fault time derived from each alarm at the plant relative to the estimated value, is used to suppress the influence of individual large deviations. This timescale deviation is output along with the source tracing results, providing clues for the repair of time-related defects. As another implementation method, the average or truncated average of the above values ​​can also be used, and the median method is more robust to individual large deviations.

[0099] In S107 above, a score is taken. The smallest candidate device is the root cause device in this round, and the confidence margin is output. The confidence margin is the difference between the second-best score and the best score, which is used to characterize the reliability of the judgment result.

[0100] The above judgment is based on the assumption that there is only one root cause device in a single fault process. However, under conditions such as thunderstorms and icing, the power grid may experience two or more independent faults in a short period of time, with two batches of alarms being sent up in a mixed manner. In this case, the single root cause assumption may either cause the residual error to remain high or only output one fault while missing the other.

[0101] Therefore, in some embodiments of this application, after identifying the root cause device, the following steps are taken: Figure 5 The process shown is source-by-source stripping: alarm events whose residuals are within the interpretation window, as well as alarm events that, although they have no theoretical response delay, meet the preset graph correlation conditions with the root cause device, are included in the interpretation set of the root cause device. The interpretation window is set according to a robust threshold. The residual range is determined by a preset multiple. In this embodiment, the preset multiple is 3. In other implementations, it can be selected from 2 to 5, meaning the absolute value of the residual satisfies... The scope; remove alarm events from the explanation set from the alarm events participating in the tracing, and the remaining alarm events constitute the residual set; when the support of the residual set accumulated according to their respective basic weights reaches the support threshold. If the number of stripping rounds has not reached the preset upper limit, the remaining alarm events are used to return to S104 to re-induce the fault domain and re-select candidate devices. In this round and subsequent rounds, the fault window defined in the first round and the pre-fault topology obtained in the first round are used. The fault window is not redefined and the rollback is not repeated. The theoretical response delay query in S105, the residual construction and solution in S106, and the judgment in this step are repeated to obtain the next root source device. Otherwise, the stripping is terminated. When the stripping is terminated, alarm events that are still not included in the interpretation set of any root source device are included in the suspected false alarm list.

[0102] In this embodiment A value of 1.6 is chosen, slightly lower than the sum of the weights of the two protection activation signals (1.70). For other implementation methods, a value between 1.2 and 2.5 can be selected. The maximum number of stripping rounds is set to 3, determined by the online processing time limit. For other implementation methods, a value between 2 and 5 rounds can be selected. Here, the support level is weighted and accumulated based on the credibility of the signal nodes. Scattered alarms with low credibility will not have their weights summed to reach the threshold, and therefore will not be pieced together as a false second source. Furthermore, after each round of removing explained alarms, the fault domain shrinks as the remaining alarms decrease, and the computational load of subsequent rounds also decreases accordingly.

[0103] In S108 above, the tracing results include the root cause device and the estimated time of failure. The results are pushed to the dispatch and handling interface; when time-stamped reliability classification is adopted, the source tracing results also include time-stamped deviation estimates for each untrusted station; when source-by-source stripping is performed, the source tracing results also include a list of suspected false alarms, which is pushed to the maintenance work order system.

[0104] In some embodiments of this application, the power grid fault tracing knowledge graph also includes fault mode nodes. S108 further includes: comparing the signal composition of each alarm event in the interpretation set of the root source device with the characterization signal set recorded by each fault mode node applicable to the device category of the root source device, and determining the fault mode with the highest conformity as the fault type. The characterization edge points to the signal node that serves as the characterization signal. The role recorded on the edge is defined by the signal type of the signal node and its position relative to the root source device, and carries necessary or typical markings. For example, in the short-circuit mode within the line area, the main protection operation on both sides and the change of the outlet circuit breaker are necessary roles, and the protection start-up of adjacent equipment is a typical role. During the comparison, the alarm events in the interpretation set are assigned to each role as follows: for alarm events of the protection start-up type, protection operation type, and protection reset type, the role is determined by the relationship between the protection device found by the signal node through the issuing edge, the protected primary equipment pointed to by the protection edge, and the root source device. For protection events pointing to the root cause device itself, they are classified as main protection actions or protection initiation roles of that device. For protection events pointing to primary equipment adjacent to the root cause device, they are classified as protection initiation or reset roles of the adjacent equipment. For alarm events of the circuit breaker displacement type and circuit breaker body type, the relationship between the primary equipment corresponding to the circuit breaker's bay and the root cause device, obtained by looking up along the linkage edge, is classified in the same way. For alarm events of the over-limit type, the relationship between the measured primary equipment and the root cause device is classified in the same way. For alarm events of the general fault type and ordinary remote signaling displacement type, the relationship between the primary equipment corresponding to the signal node's bay and the root cause device is classified in the same way. Multiple event hits for the same role are counted only once. For each applicable fault mode... The compliance degree is calculated according to formula (12).

[0105] (12); in, Indicates the fault mode The degree of conformity; This represents the coefficient of the necessary item, whose value determines the dominant type of the necessary role. In this embodiment, it is set to 0.7, but in other implementations, it can be selected within the range of 0.5 to 0.9. When the mode does not define a typical role, Only necessary items are selected; explanations of signals in the set not covered by the pattern receive no points and no deductions. The highest failure mode is the failure type; the highest conformity is still below the type determination threshold. In this embodiment, only the root cause device is output, and the fault type is marked as pending. A value of 0.5 is used, and in other implementations, it can be selected within the range of 0.3 to 0.7. In other implementations, the conformity can also be calculated as the ratio of the number of matched representation signals to the total number of representation signals in the set; any method that measures the degree of agreement between the signal composition of the interpretation set and the representation signal set can be used as the conformity described in this application. Indicates the fault mode The required role hit rate is the ratio of the sum of the initial credibility of the signal types of the hit required roles to the sum of the initial credibility of the signal types of all required roles. The hit rate of a typical character is represented, and its definition is similar; the initial confidence level of the signal type used. It has the same caliber as formula (10).

[0106] In some embodiments of this application, S108 further includes: sorting each alarm event in the interpretation set according to its theoretical time to generate a fault evolution chain, wherein the theoretical time is the sum of the estimated fault occurrence time and the corresponding theoretical response delay, i.e. The fault evolution chain records the theoretical time, station timescale, and residual for each alarm event. Using this method, the reason why each alarm belongs to a particular root cause and whether its time matches the theoretical time can be verified one by one, providing dispatchers with a basis for issuing handling instructions. At this point, the tracing results also include the fault type and the fault evolution chain.

[0107] In the above S109, after long-term operation, this method will encounter the following situations: the protection setting order adjustment is not synchronized, and the aging of the device causes the action time to drift. Both of these will cause the time delay value recorded in the knowledge graph to deviate from the actual action time of the device, and the matching accuracy of the inversion will decrease accordingly. If the credibility of the signal node always remains at the initial value, the newly appearing defective signal points on site will not be deweighted.

[0108] Therefore, in one embodiment, see Figure 6After the case is manually confirmed or its nature is revised, the calibration is written back as follows: From the explanation set of the root cause device, the confidence level of its signal node is selected. For alarm events that are not lower than a preset screening threshold, the measured response delay is determined based on the difference between the station's internal timestamp of the alarm event and the estimated time of the fault occurrence. The trusted station takes... Untrusted sites That is, after deducting the estimated time scale deviation; for the same signal node, when the cumulative number of confirmed cases reaches the preset number of cases. Furthermore, the difference between the measured response latency and the corresponding latency value recorded in the knowledge graph does not exceed the preset update threshold. When the time delay is corrected to the measured response time delay according to formula (13), the time delay value is corrected.

[0109] (13); in, , These represent the time delay values ​​recorded in the knowledge graph before and after the correction, respectively. This represents the median of the measured response delay for each confirmed case at this signal node; Represents the smoothing coefficient. The larger the threshold, the faster the signal follows the actual measurement, but the worse the resistance to disturbances. In this embodiment, the preset screening threshold is set to 0.8, allowing only observations of high-reliability signal points to participate in parameter correction. In other implementations, the threshold can be selected within the range of 0.7 to 0.95. A value of 0.2 is used; for other implementation methods, a value between 0.05 and 0.5 can be selected. 3 can be selected as an alternative implementation method, ranging from 2 to 10. 100ms is selected, and other implementation methods can be selected within 50 to 300ms. Setting a lower limit for the number of cases and an update threshold is to avoid individual misclassified cases polluting the parameters recorded in the knowledge graph. The corresponding time delay value recorded in the knowledge graph refers to the sum of the items that constitute the theoretical response time delay of the signal according to formula (2) or formula (3). The correction is made in one of the following ways: the comprehensive time delay correction amount is recorded separately for the signal node, and the correction amount is included when querying the theoretical response time delay, and the original parameters remain unchanged. This embodiment adopts this method; or the above difference is included in the device-side parameters such as inherent action time, opening time, return time, and additional time delay. The setting delay is the value specified in the protection setting order. Its original record is not changed due to writing back. When the protection setting order is adjusted, it is updated by incremental maintenance in S101; when the comprehensive time delay correction amount is used, the correction amount does not distinguish the source of each item, and the difference between the actual measurement and the knowledge graph record is uniformly carried by the correction amount.

[0110] Furthermore, based on the results of determining whether each alarm event in this source tracing is a match or an outlier, the match count of the corresponding signal node is updated. Number of wild values Residual satisfaction Alarm events that fall into the interpretation window, and alarm events that, although lacking theoretical response delay, meet preset graph correlation conditions and are included in the interpretation set, are counted as a match at their signal nodes; they are added to the suspected false alarm list, or the residuals meet... An alarm event is counted as an outlier. Among them, alarm events that have neither theoretical response delay nor meet the preset graph association conditions and are included in the suspected false alarm list are considered to have residuals exceeding the preset range. This is the specific method of outlier determination described in S102. After accumulation, the credibility of the signal node is refreshed according to formula (1). Both types of write-back are accompanied by the corresponding attributes of update time and case number written back to the knowledge graph. In this way, the credibility of signals without time sequence items, such as over-limit alarms, also rises and falls with the accumulation of cases.

[0111] Using this method, the corrected latency value serves as the query source for S105, and the refreshed credibility serves as the source of the basic weights in S106 and the support in S107. Inversion, confirmation, and write-back thus form a closed loop. The matching accuracy and weight quality improve with the accumulation of cases, and offline retraining is not required.

[0112] The following example illustrates the execution process of S101 to S109. In this example, the scores of each candidate device are calculated by formula (11) with three decimal places, and the confidence margin of each treatment is calculated by subtracting the scores with three decimal places.

[0113] The network for this example is as follows: For the 220kV section, bus A (located at station A), line L1, bus B (located at station B), line L2, and bus C (located at station C) are connected sequentially. Station B is connected to a 110kV bus via main transformer T1; this 110kV bus is referred to as the 110kV bus (station B). Line L3 runs from the 110kV bus (station B) to station D. Circuit breaker 1102 on the station D side of L3 has been out of service since the day before the fault. Bus A and bus C each have power supply markings at their system equivalent injection points, which are the power sources for this example. The circuit breaker numbers are: 2201 and 2202 on both sides of L1, 2203 and 2204 on both sides of L2, 2210 on the high-voltage side of T1, and 1101 on the station B side of L3. The parameters recorded in the knowledge graph are as follows: The 220kV line is equipped with longitudinal differential protection on both sides as the main protection, with a coverage edge setting delay of 0 and an inherent operating time of 25ms; the distance protection section II serves as the backup protection section, with a setting delay of 500ms; the start-up criterion time, i.e., the additional delay of the protection start-up signal, is 15ms; the device return time is 30ms; the busbar is equipped with bus differential protection, with an inherent operating time of 20ms; the main transformer is equipped with differential protection as the main protection, with an inherent operating time of 25ms; the circuit breaker tripping time is 45ms. Each bus differential protection points to the outgoing circuit breaker of its respective busbar via its output edge; the main transformer differential protection points to 2210 and 1101 via its output edge; and each line longitudinal differential protection points to the circuit breakers on both sides of the line via its output edge. To facilitate item-by-item verification, this example simplifies the coverage range of each line from distance II to its own line, meaning that the coverage edge of distance II only points to the line where the protection is located. In actual engineering, this section can also point to the opposite busbar and adjacent lines according to its setting range, and the corresponding coverage edge is calculated according to the same rule.

[0114] Accordingly, according to formula (2), the theoretical response time delay of the L1 differential protection action signal on station A side and station B side to candidate L1 is: ms; Circuit breaker 2201 position change signal pair L1 is ms, for bus A The circuit breaker 2202 change signal is 70ms for L1 and 65ms for bus B; the start signal of each side of the line protection is 15ms for the equipment pointed to by its start coverage edge, that is, the equipment within the line and its two electrical trips. According to formula (3), the reset signal of L2 protection on station C side is 70ms for L1. ms, for bus B ms. The operation of the bus differential protection and the position change signals of circuit breakers 2203, 2204, 2210, and 1101 are necessary signals for the corresponding bus, line, and main transformer, but none of them were observed in this example.

[0115] The fault is set as follows: at 10:12:30.000, a permanent phase-to-phase short circuit occurs in the middle of L1. All time scales in the following stations are offsets relative to this time. Two disturbances are also set: the time synchronization device at station C is malfunctioning, with a time scale deviation of +2000ms; the 1102 spacer spring at station D is not storing energy and the remote signal is falsely triggered due to a secondary circuit defect. The dispatch master station received a total of 11 alarms. After S103 matching and time-scale reliability classification, the alarm events were as follows: Alarm 1 at station A was the activation of the L1 differential protection on station A side, with a timescale of 16ms and an initial weight of 0.85; Alarm 2 was the operation of the L1 differential protection on station A side, with a timescale of 25ms and an initial weight of 0.95; Alarm 3 was the change of circuit breaker 2201 from closed to open, with a timescale of 72ms and an initial weight of 0.90; Alarms 4, 5, and 6 at station B were the activation of the L1 differential protection on station B side, the operation of the L1 differential protection on station B side, and the change of circuit breaker 2202, with timescales of 15ms and 15ms respectively. Alarms 26ms and 71ms, with initial weight values ​​of 0.85, 0.95, and 0.90 respectively; Alarm 7 is the activation of L2 protection on the B side of station, with a station timescale of 16ms and an initial weight value of 0.85; Alarm 8 is the voltage of bus B exceeding the lower limit, with a station timescale of 1200ms and an initial weight value of 0.50, and is not a time sequence item; Alarm 9 at station C is the activation of L2 protection on the C side of station, with a station timescale of 2016ms; Alarm 10 is the reset of L2 protection on the C side of station, with a station timescale of 2101ms, and both have an initial weight value of 0.85; Alarm 11 at station D is the failure of the spring of circuit breaker 1102 to store energy, with a station timescale of 40ms and an initial weight value of 0.60. Among them, station C is judged as an untrusted station due to the existence of time synchronization anomalies in remote signaling, while the other stations are trusted stations.

[0116] The execution result of S104 is as follows: the fault window covers all 11 alarms; the seed devices, through the sending edge, linkage edge, and measurement edge, retrieve L1, L2, bus B, L3, etc., and the fault domain includes 8 devices: L1, L2, L3, T1, bus A, bus B, bus C, and 110kV bus (station B); after topology rollback cancels the two position changes of circuit breakers 2201 and 2202 within the fault window, L1 is restored to energized under the topology before the fault and enters the candidate device set, while the shutdown of 1102 occurred before the fault window and is automatically retained. As a contrast, if topology rollback is not performed, L1 is not among the candidate devices, the best candidate is bus B with a score of 3.020, the second best candidate T1 has a score of 3.636, the confidence margin is only 0.615, and the output conclusion is incorrect.

[0117] The execution results of S105 and S106 are as follows: L3 and the 110kV bus (station B) have no interpretable timing items, and their timing support is 0, which is lower than... The value 1.5 is discarded; Station C is an untrusted station, and its two alarm events constitute a differential residual term, with the timescale difference within the station being... The difference in theoretical response delay for candidate L1 is ms. The differential residual calculated by formula (5) is 0 ms. The plant-level deviation of +2000ms is completely eliminated in the subtraction, and the time scale deviation of station C is estimated to be approximately +2000.1ms according to the median rule. The results of each candidate device calculated by formula (11) are as follows: the timing support of candidate L1 is 7.10, the weighted residual level is 0.0004, the unexplainable proportion is 0.0663, the necessary signal missing rate is 0, the score is 0.266, and the corresponding estimated fault occurrence time is +0.9ms; the scores of the other candidates are as follows: bus B is 3.020, T1 is 3.636, bus A is 3.668, L2 is 3.901, and bus C is 4.666, all of which are far worse than L1. As the second-best candidate, the components of bus B are as follows: its timing components are the three absolute residuals constructed from the theoretical response delay of 15ms for alarms 1, 4, and 7 based on the start-up coverage edge; and alarm 6 is based on the theoretical response delay of the station B bus differential protection. The time series support is provided by an absolute residual term constructed by ms and a differential residual term constructed by alarm 10 at station C. The corresponding estimated time of failure occurrence is +2.1ms, and the residuals are as follows: ms ms ms ms and ms, weighted residual level is 0.0105; alarms 2 and 5 are action signals of L1 differential protection, alarm 3 is the change signal of circuit breaker 2201. Neither the station B bus differential protection nor the L1 differential protection has a usable coverage edge pointing to bus B. These three alarms, along with alarm 11, are inexplicable for bus B. The sum of the basic weights is The unexplained percentage is The necessary signals for busbar B are the differential protection operation signal of station B and the change signals of circuit breakers 2202, 2203, and 2210. Only the change signal of circuit breaker 2202 was observed, resulting in a necessary signal missing rate of [missing information]. Synthesized according to formula (11) The result is 3.020, rounded to three decimal places. It can be seen that although bus B has four time series terms that match well, its unexplained percentage and the necessary signal missing rate penalty make its score significantly worse than L1.

[0118] In contrast, if station C is treated as a trusted station and its alarm events are solved using absolute residuals, the L1 score increases from 0.266 to 0.877, the weighted residual level increases from 0.0004 to 0.61, the estimated fault occurrence time shifts to +9ms, and the ranking of the second-best candidates also changes. If the deviation of station C is changed to +300ms, which is on the same order of magnitude as the protection level difference, the L1 score is 0.840, indicating a similar level of contamination. However, when treated according to time-scaled trusted classification and intra-station differential processing, the scores calculated under both deviation magnitudes remain completely unchanged. In comparison, a +120ms disturbance caused by the jamming of the operating mechanism was added to the station timescale of alarm 3: when all alarms are equally weighted and the weights are not iteratively reduced, the estimated value of the fault occurrence time shifts to +18ms, the L1 score rises to 1.257, and the confidence margin drops to 1.763; when the weights are increased according to the basic weights and the weights are iteratively reduced according to formula (7), the weight of alarm 3 is automatically reduced by about three-quarters, the estimated value shifts to +5.7ms, the L1 score is 0.533, and the confidence margin remains at 2.487.

[0119] The execution results of S107 and S108 are as follows: The root cause device is determined to be L1, with a confidence margin of 1. Rounded to three decimal places, the value is 2.755; the interpretation set consists of alarms 1 to 10, where the absolute residuals of alarms 1 to 7 and the difference residual of alarm 10 both fall within the interpretation window, i.e., 3 times the value. Within a 90ms range; Alarm 9 is the baseline event for station C, and it does not constitute a timing item itself. Because the station's only differential residual falls into the interpretation window, it is included in the interpretation set along with Alarm 10; Alarm 8 is an out-of-limit alarm event that meets the preset graph correlation conditions; the remaining set contains only Alarm 11, whose support degree of 0.60 is lower than... The value of 1.6 is used to terminate the stripping, and alarm 11 is included in the list of suspected false alarms. In the fault type determination, the line category applies to two fault modes: the necessary roles of the short circuit mode in the line area are the operation of the main protection on both sides and the change of the circuit breaker at both outlets on both sides. The initial confidence of the corresponding signal types are 0.95, 0.95, 0.90, and 0.90 respectively, all of which are hit. The typical roles are the start-up and reset of the adjacent equipment protection and the bus voltage over-limit, which are also all hit. The compliance rate is calculated according to formula (12) as . The necessary roles for the line over-level disconnection mode are backup protection time-delay action and over-level range circuit breaker displacement. None of these were met; the typical roles were met, resulting in a compliance rate of [percentage missing]. Take the highest value that exceeds... A value of 0.5 indicates a short circuit within the line area. The generated fault evolution chain is as follows: L1 phase-to-phase short circuit at 10:12:30.001; 15ms later, protection systems at stations A, B, and C activate (measured at 16ms, 15ms, and 16ms respectively); 25ms later, the differential protection systems on both sides of L1 activate (measured at 25ms and 26ms respectively); 70ms later, circuit breakers 2201 and 2202 trip and the fault is cleared (measured at 72ms and 71ms respectively); 100ms later, the L2 protection system on station C resets; 1.2s later, the voltage of bus B exceeds the lower limit. The source tracing results also indicate that the time scale deviation at station C is approximately +2000.1ms. The suspected false alarm list states that alarm 11 was not explained by any root cause and is transferred to the maintenance process for verification.

[0120] The execution result of S109 is as follows: After this case is confirmed, the cumulative number of confirmed cases for the L1 differential protection action signal point on station B side reaches 3. The median measured response delay is 25.8ms, which is 0.8ms different from the delay value of 25ms recorded in the knowledge graph, and is less than... The value is 100ms, according to formula (13) and... Update from 0.2 ms, that is, about 25.2ms; the signal node of alarm 11 counts an outlier once, and its confidence level drops from 0.60 to about 0.545 according to formula (1). After the signal node is falsely sent 4 more times, that is, after a total of 5 false sends, the confidence level drops to 0.40, and the ability to form a false root cause continues to decay.

[0121] In one embodiment, for scenarios involving reclosing, the setting action time of the reclosing device is recorded at the corresponding protection device node, which, together with the closing time recorded at the circuit breaker node, constitutes the theoretical response delay of the reclosing change signal. The delay of the subsequent acceleration stage is also recorded as a knowledge graph attribute. The second round of alarms that coincide with permanent faults participates in the construction and solution of residuals according to the same mechanism. For distribution network scenarios, the delay of line selection signals in low-current grounding systems is highly dispersed. A lower initial confidence level is used (0.50 for this type of signal in this embodiment; in other implementations, it can be selected within the range of 0.3 to 0.6) and the robustness threshold is relaxed. (This embodiment uses 100ms for this type of signal; other implementations can select a range from 60 to 200ms.) Access is straightforward; the rest of the mechanism remains unchanged. Furthermore, multiple unconnected fault domains naturally form parallel groups, each executing independently without affecting the others, facilitating distributed deployment. This method interfaces with existing dispatch automation systems, protection and fault recording information systems via message subscription, without modifying the plant / station equipment.

[0122] Based on the same inventive concept, this application also provides an electronic device, see [link to relevant documentation]. Figure 7The electronic device includes: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the knowledge graph-based power grid fault tracing method described in any of the above embodiments.

[0123] The processor can be one or more of a central processing unit (CPU), graphics processing unit (GPU), digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic devices. The memory can include volatile memory, such as random access memory (RAM), or non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), or a combination of the above types of memory. The electronic device can also include a communication interface for receiving alarm messages and distributing tracing results. The processor, memory, and communication interface are connected via a bus. As an example, this electronic device is a server deployed in the scheduling analysis application area. The computational load of a single round of inversion is proportional to the number of devices and alarms in the fault domain, independent of the overall network scale, and can meet the time requirements of online processing.

[0124] The steps implemented by the processor when executing the above instructions are as follows: Constructing a power grid fault tracing knowledge graph, wherein protection device nodes are pointed to primary equipment nodes within their protection range via coverage edges, the coverage edges record setting delays, protection device nodes record inherent operating times, circuit breaker nodes record opening times, and signal nodes are associated with protection device nodes or circuit breaker nodes that issue corresponding signals; receiving alarm messages sent from substations, matching each alarm message to the corresponding signal node in the knowledge graph to obtain alarm events; and determining the substation time scale boundaries for each alarm event. Define the fault window and fault domain. Remove the switch changes occurring within the fault window from the current switch state in reverse order of occurrence to obtain the pre-fault topology. Select the primary equipment energized in the fault domain under the pre-fault topology as candidate devices. For each candidate device, assume it as the fault source and query the theoretical response delay of each alarm event. Construct residuals with the fault occurrence time as the unknown quantity, solve for the estimated fault occurrence time that minimizes all residuals, and calculate a score based on at least the solved residuals. Determine the candidate device with the best score as the root cause device and output the source tracing result.

[0125] Optionally, the processor may also execute program code with the following steps: the coverage edge also records the segment, the setting delay of the main protection segment is set to zero, and the setting value recorded in the setting sheet is taken for the backup protection segment; for protection action signals, circuit breaker change signals, protection start signals and protection reset signals, the theoretical response delay is queried in the manner described in formula (2) and formula (3) respectively.

[0126] Optionally, the processor may also execute program code that performs the following steps: classifying trusted stations and untrusted stations based on the station's time synchronization status and / or the difference between the station's internal timestamp and the master station's receiving time for its alarm events; constructing absolute residuals for alarm events of trusted stations and differential residuals for alarm events of untrusted stations; and estimating the timestamp deviation of each untrusted station and outputting it along with the tracing results.

[0127] Optionally, the processor may also execute program code with the following steps: using the credibility recorded by the signal node as the basic weight of each alarm event, solving the estimated value of the fault occurrence time according to the iterative process composed of formula (6) and formula (7), and the score is calculated at least based on the weighted residuals.

[0128] Optionally, the processor may also execute program code that performs the following steps: summing the weighted residual level, the weighted proportion of unexplainable alarm events, and the necessary signal missing rate by weighting them according to preset coefficients to obtain a score for the candidate device.

[0129] Optionally, the processor may also execute program code that performs the following steps: after identifying the root cause device, add it to the interpretation set and remove it from the alarm events, perform source-by-source stripping according to the support threshold and the upper limit of the stripping round, and output a list of suspected false alarms when terminating.

[0130] Optionally, the processor may also execute program code that performs the following steps: determines the fault type based on the set of characterizing signals recorded in the fault mode node, and generates a fault evolution chain by sorting each alarm event in the interpretation set according to the theoretical time, and outputs it along with the source tracing results.

[0131] Optionally, the processor can also execute program code for the following steps: after the tracing results are confirmed, the time delay value recorded in the knowledge graph is corrected according to the preset screening threshold, preset number of cases, preset update threshold and smoothing coefficient, and the credibility of the signal node is refreshed according to the judgment results of the matching and outlier values ​​for subsequent tracing.

[0132] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium storing computer instructions. When these computer instructions are executed by a processor, they implement the knowledge graph-based power grid fault tracing method described in any of the above embodiments. The storage medium can be a read-only memory, random access memory, flash memory, hard disk, solid-state drive, magnetic disk, or optical disk, etc. Furthermore, the storage medium can also include combinations of the above types of storage media.

[0133] It should be noted that, Figure 1Although the steps in the flowchart are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the exact order indicated by the arrows. Unless otherwise specified herein, there is no strict order requirement for the execution of these steps, and they can be executed in other orders; furthermore, Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, nor are they necessarily executed sequentially. Instead, they may be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0134] The technical features in the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0135] The above description is merely a preferred embodiment of this application and is not intended to limit the application. Those skilled in the art can make various modifications and improvements without departing from the concept of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A knowledge graph-based method for tracing the source of power grid faults, characterized in that, The method includes: A knowledge graph for tracing the source of power grid faults is constructed, wherein protection device nodes point to primary equipment nodes within their protection range via coverage edges, the coverage edges record setting delays, the protection device nodes record inherent operating times, the circuit breaker nodes record opening times, and signal nodes are associated with the protection device nodes or the circuit breaker nodes that issue corresponding signals. The alarm message sent by the power plant is received, and each alarm message is matched to the corresponding signal node in the power grid fault tracing knowledge graph to obtain an alarm event. The alarm event records at least the corresponding signal node, the station time stamp and the power plant to which it belongs. Based on the station time stamp of each alarm event, the fault window is defined, and the fault domain containing the primary equipment corresponding to each alarm event is determined on the power grid fault tracing knowledge graph; the switch changes that occur in the fault window are cancelled from the current switch state in reverse order of occurrence to obtain the pre-fault topology; the primary equipment energized in the fault domain under the pre-fault topology is selected as candidate equipment. For each candidate device, assuming it is a fault source, the theoretical response delay of each alarm event is queried according to the power grid fault source knowledge graph. The theoretical response delay is the time difference between the fault occurrence time and the corresponding signal issuance time, which is obtained by accumulating at least the items corresponding to the signal in the setting delay, the inherent action time, and the tripping time. Using the fault occurrence time as an unknown quantity, for each alarm event with the theoretical response delay, construct a residual from its station timescale and the corresponding theoretical response delay, solve for the fault occurrence time estimate that minimizes all residuals, and calculate the score of the candidate device based at least on the solved residuals. The candidate device with the best score is identified as the root cause device, and the source tracing result is output. The source tracing result includes the root cause device and the estimated time of the failure.

2. The power grid fault tracing method based on knowledge graphs according to claim 1, characterized in that, The coverage edge also records the segment, the setting delay of the main protection segment is zero, and the setting delay of the backup protection segment is the setting value recorded in the setting sheet; the protection device node also records the return time, and the signal node also records the additional delay corresponding to its signal type. The process of querying the theoretical response delay for each alarm event includes: for protection action signals, the theoretical response delay is obtained by adding the setting delay and the inherent action time; for circuit breaker position change signals, the opening time of the corresponding circuit breaker is also added; for protection start signals, the additional delay is also added; for protection reset signals, the theoretical response delay is obtained by adding the theoretical tripping time and the return time of the candidate device, wherein the theoretical tripping time is the maximum value among the theoretical response delays of the position changes of each power supply side circuit breaker of the candidate device.

3. The knowledge graph-based power grid fault tracing method according to claim 1 or 2, characterized in that, The method further includes: classifying the plant into trusted and untrusted stations based on the time synchronization status of the plant and / or the difference between the station's internal timestamp of its alarm events and the time received by the master station; The construction of residuals includes: for alarm events of the trusted station, constructing an absolute residual with the fault occurrence time as an unknown quantity by using its internal timescale and the corresponding theoretical response delay; for alarm events of the untrusted station, selecting an alarm event within the same plant as a benchmark, and constructing a differential residual by subtracting the difference in theoretical response delay between the difference between the internal timescales of the remaining alarm events and the benchmark, so that the timescale deviations of the plant cancel each other out in the difference operation; Furthermore, based on the station-specific timestamps of each alarm event of the untrusted station, the corresponding theoretical response delays, and the estimated fault occurrence time obtained from the solution, the timestamp deviation of each untrusted station is estimated, and the tracing result also includes the timestamp deviation.

4. The knowledge graph-based power grid fault tracing method according to claim 1 or 2, characterized in that, The method further includes: setting basic weights for each alarm event to participate in residual construction and solution. The basic weights are taken from the credibility recorded by the signal node of the alarm event. Each signal node records its credibility. The credibility is obtained by statistically analyzing the number of times the signal node is judged as a match and the number of times it is judged as an outlier in historical cases. The outlier refers to an alarm event in which the residual exceeds a preset range. The method of finding the fault occurrence time estimate that minimizes the overall residuals includes: using each basic weight as the initial weight, iteratively executing the following steps: updating the fault occurrence time estimate under the current weights, and updating each residual; for alarm events whose residuals exceed the robustness threshold, reducing the weight of the alarm event according to the degree to which its residuals exceed the robustness threshold; until the fault occurrence time estimate converges or the iteration reaches a preset number of rounds; The score is calculated based at least on the weighted residuals.

5. The power grid fault tracing method based on knowledge graphs according to claim 4, characterized in that, The calculation of the candidate device score includes: weighting the weighted residual level, the weighted proportion of unexplainable alarm events, and the necessary signal missing rate by a preset coefficient and summing them to obtain the score of the candidate device. Wherein, the weighted residual level is the value obtained by accumulating each residual according to its weight and normalizing it; an alarm event that has neither the theoretical response delay nor meets the preset graph correlation conditions is denoted as unexplainable for the candidate device, and the weighted proportion of the unexplainable alarm event is the proportion of the sum of the basic weights of each alarm event that is unexplainable for the candidate device to the sum of the basic weights of all alarm events in the fault domain; The necessary signal missing rate is determined based on the proportion of signals in the necessary signal set for which no corresponding alarm event has been observed. The necessary signal set includes at least the main protection action signal expected to act first when the candidate device fails and the corresponding circuit breaker position signal. Signals outside the necessary signal set that have coverage association with the candidate device are not counted as missing if no corresponding alarm event has been observed.

6. The power grid fault tracing method based on knowledge graphs according to claim 5, characterized in that, The method further includes: after identifying the root cause device, classifying alarm events whose residuals are within the interpretation window, and alarm events that, although they do not have the theoretical response delay, satisfy the preset graph association condition with the root cause device, into the interpretation set of the root cause device, and removing the alarm events in the interpretation set from the alarm events participating in the tracing, wherein the interpretation window is a residual range determined according to a preset multiple of the robustness threshold; When the support degree accumulated by the remaining alarm events according to their respective basic weights reaches the support degree threshold and the stripping rounds have not reached the preset upper limit, the fault domain and candidate devices are re-determined based on the remaining alarm events, and the query of theoretical response delay, the construction and solution of residuals and the determination of the root cause device are repeated to obtain the next root cause device; otherwise, the stripping is terminated. Alarm events that are not included in the interpretation set of any root cause device at the time of termination are included in the suspected false alarm list, and the tracing results also include the suspected false alarm list.

7. The power grid fault tracing method based on knowledge graphs according to claim 6, characterized in that, The power grid fault tracing knowledge graph also includes fault mode nodes, which record the applicable equipment categories and characteristic signal sets. The method further includes: comparing the signal composition of each alarm event in the interpretation set of the root source device with the characterization signal set recorded by each fault mode node applicable to the device category of the root source device, and determining the fault mode with the highest conformity as the fault type. The alarm events in the explanation set are sorted according to their theoretical time to generate a fault evolution chain. The theoretical time is the sum of the estimated time of the fault occurrence and the corresponding theoretical response delay. The fault evolution chain records the theoretical time, station time scale and residual of each alarm event. The tracing results also include the fault type and the fault evolution chain.

8. The power grid fault tracing method based on knowledge graphs according to claim 6, characterized in that, The method further includes: after the source tracing result is confirmed, selecting alarm events whose confidence level of the signal node is not lower than a preset screening threshold from the interpretation set of the root cause device, and determining the measured response delay based on the difference between the station timescale of the alarm event and the estimated value of the fault occurrence time; For the same signal node, when the cumulative number of confirmed cases reaches the preset number of cases, and the difference between the measured response delay and the corresponding delay value recorded in the power grid fault tracing knowledge graph does not exceed the preset update threshold, the delay value is corrected to the measured response delay according to the smoothing coefficient. Based on the results of determining whether each alarm event is a match or an outlier in this source tracing, the match count and outlier count of the corresponding signal node are updated, and the credibility is refreshed; the corrected delay value and the refreshed credibility are used for subsequent source tracing.

9. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the knowledge graph-based power grid fault tracing method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions, which, when executed by a processor, implement the knowledge graph-based power grid fault tracing method as described in any one of claims 1 to 8.

Images