An alarm data processing method, device and computer equipment

Abstract

The application relates to an alarm data processing method and device and computer equipment. The method comprises the following steps: obtaining alarm data to be processed; searching the pre-constructed power alarm exclusive knowledge base according to the alarm data to be processed to obtain corresponding associated knowledge items; inputting the alarm data to be processed and the associated knowledge items into a pre-trained alarm processing large model, generating an initial alarm level and an alarm processing suggestion under the constraint of the associated knowledge items through the alarm processing large model; and calibrating the initial alarm level according to the influence degree of the alarm data to be processed to obtain a calibrated alarm level. The application can efficiently and accurately complete the processing of the alarm data.

Description

Technical Field

[0001] This application relates to the field of power information system technology, and in particular to an alarm data processing method, apparatus and computer equipment. Background Technology

[0002] As power information systems transform towards digitalization and intelligence, the equipment and components integrated into these systems are becoming increasingly complex. Consequently, the alarm data generated during operation and maintenance is growing exponentially. However, this alarm data contains a large number of invalid and redundant alarms, leading to a situation where low-level alarms frequently flood the screen while high-level alarms are easily buried.

[0003] In related technologies, alarm handling techniques have gone through three stages: manual handling, rule-based handling, and intelligent handling. Manual handling involves operations and maintenance personnel manually reviewing alarm data, determining its level, and processing it. However, this method relies heavily on the experience of operations and maintenance personnel, resulting in low efficiency and large errors. Rule-based handling involves determining and processing the level of alarm data through preset alarm rules. However, this method cannot effectively handle new types of alarms or multiple alarm data with complex relationships. Intelligent handling relies on deep learning and large model technology to automatically determine the level of alarm data and generate processing suggestions. However, large models are prone to generating illusions and overly generalized handling solutions.

[0004] Therefore, how to efficiently and accurately process alarm data has become an urgent technical problem to be solved. Summary of the Invention

[0005] Therefore, it is necessary to provide an alarm data processing method, apparatus, and computer equipment to address the aforementioned technical problems.

[0006] Firstly, this application provides an alarm data processing method applied to a server of a power information system, the method comprising:

[0007] Obtain pending alarm data;

[0008] Based on the alarm data to be processed, the relevant related knowledge entries are retrieved from the pre-built power alarm knowledge base.

[0009] The alarm data to be processed and the associated knowledge items are input together into the pre-trained alarm processing model. Under the constraints of the associated knowledge items, the alarm processing model generates the initial alarm level and alarm processing suggestions.

[0010] The initial alarm level is calibrated based on the impact of the alarm data to be processed, resulting in a calibrated alarm level.

[0011] In one embodiment, the alarm data to be processed is retrieved from a pre-built power alarm-specific knowledge base to obtain corresponding related knowledge entries, including:

[0012] The retrieval module retrieves relevant knowledge entries from a power alarm-specific knowledge base by performing a search in advance. The retrieval module is trained based on pre-acquired retrieval training samples, which consist of training alarm features and corresponding knowledge entries.

[0013] In one embodiment, a pre-established retrieval module searches a power alarm-specific knowledge base to obtain related knowledge entries, including:

[0014] Feature extraction processing is performed on the alarm data to be processed to obtain the features of the alarm data to be processed;

[0015] Calculate the data similarity between the alarm data to be processed and each knowledge entry in the power alarm knowledge base, and calculate the feature similarity between the features of the alarm data to be processed and the features of each knowledge entry in the power alarm knowledge base.

[0016] By combining the data similarity and feature similarity between each knowledge entry and the alarm data to be processed, the associated knowledge entries corresponding to the alarm data to be processed are determined.

[0017] In one embodiment, the steps for constructing a dedicated knowledge base for power alarms include:

[0018] Acquire initial knowledge base data, which includes raw alarm data, alarm processing data, alarm level standard data, and related alarm data;

[0019] The original alarm data is processed by feature extraction to obtain the corresponding alarm feature vector, and the initial knowledge base data is preprocessed to obtain the preprocessing result.

[0020] Knowledge is extracted from the preprocessing results to form a large number of knowledge extraction items;

[0021] A dedicated knowledge base for power alarms is established based on knowledge extraction entries. The dedicated knowledge base for power alarms includes a sub-base of alarm level standards, a sub-base of alarm processing rules, a sub-base of historical alarm data, and a sub-base of alarm association knowledge. The data in each sub-base is cross-referenced with the corresponding data in other sub-bases through index keys.

[0022] In one embodiment, the alarm data to be processed and the associated knowledge entries are jointly input into a pre-trained alarm processing model. Under the constraints of the associated knowledge entries, the alarm processing model generates an initial alarm level and alarm processing suggestions, including:

[0023] The alarm data to be processed and the associated knowledge entries are input into a pre-trained alarm processing model to obtain the initial alarm level and processing suggestions. The alarm processing model is trained based on a sample pair consisting of a first data set and a second data set. The first data set includes training alarm features and corresponding knowledge entries, and the second data set includes alarm levels and processing suggestions corresponding to the training alarm features.

[0024] In one embodiment, the initial alarm level is calibrated based on the impact of the alarm data to be processed to obtain a calibrated alarm level, including:

[0025] Obtain the initial alarm level and alarm level standard data from the power alarm knowledge base;

[0026] The impact of alarm data on the alarm level is quantitatively scored based on preset key indicators of alarm level.

[0027] The initial alarm level is updated based on the quantification results and alarm level standard data to obtain the updated alarm level.

[0028] In one embodiment, the method further includes:

[0029] When generating corresponding alarm handling suggestions based on related knowledge entries, the alarm characteristics and alarm handling suggestions of the alarm data to be processed are sent to the preset association identification module. The association identification module retrieves related alarm entries related to the alarm characteristics from the preset related power alarm exclusive knowledge base. The root cause alarm is identified based on the related alarm entries. Based on the alarm level of the root cause alarm and the related alarm entries, a collaborative processing scheme is determined.

[0030] The correlation identification module outputs a list of related alarms, root cause alarms, and collaborative processing solutions.

[0031] In one embodiment, the method further includes:

[0032] When the alarm handling model is found to meet the preset update conditions, new alarm data, corresponding new handling experience, level standard update data, and evaluation of alarm handling suggestions are collected.

[0033] New knowledge entries are extracted based on newly added alarm data, new processing experience, updated grading standards, and alarm processing suggestions. The power alarm-specific knowledge base is then updated using these new knowledge entries.

[0034] Based on the updated power alarm-specific knowledge base and the evaluation of alarm handling suggestions, the alarm handling model is incrementally fine-tuned to obtain the updated alarm handling model.

[0035] Secondly, this application also provides an alarm data processing apparatus, comprising:

[0036] The acquisition module is used to acquire alarm data to be processed.

[0037] The retrieval module is used to search the pre-built power alarm knowledge base based on the alarm data to be processed and obtain the corresponding related knowledge entries.

[0038] The generation module is used to input the alarm data to be processed and the associated knowledge items into the pre-trained alarm processing model. Under the constraints of the associated knowledge items, the alarm processing model generates the initial alarm level and alarm processing suggestions.

[0039] The optimization module is used to calibrate the initial alarm level based on the impact of the alarm data to be processed, and obtain the calibrated alarm level.

[0040] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0041] Obtain pending alarm data;

[0042] Based on the alarm data to be processed, the relevant related knowledge entries are retrieved from the pre-built power alarm knowledge base.

[0043] The alarm data to be processed and the associated knowledge items are input together into the pre-trained alarm processing model. Under the constraints of the associated knowledge items, the alarm processing model generates the initial alarm level and alarm processing suggestions.

[0044] The initial alarm level is calibrated based on the impact of the alarm data to be processed, resulting in a calibrated alarm level.

[0045] The aforementioned alarm data processing method, apparatus, and computer equipment acquire alarm data to be processed; retrieve relevant related knowledge entries from a pre-built power alarm-specific knowledge base based on the alarm data; input the alarm data and related knowledge entries into a pre-trained alarm processing model; and generate an initial alarm level and alarm processing suggestions through the alarm processing model under the constraints of the related knowledge entries; calibrate the initial alarm level based on the impact of the alarm data to be processed to obtain a calibrated alarm level. Through this embodiment, the power alarm-specific knowledge base is combined with the large model, and the initial alarm level is corrected after being output by the large model, achieving accurate alarm level determination and effectively avoiding the problems of ignoring high-level alarms and over-handling low-level alarms. Furthermore, the deep integration of the power alarm-specific knowledge base and the large model allows the large model to generate processing suggestions based on the accurately retrieved related knowledge entries, avoiding misleading content that is out of sync with the actual alarm scenario and preventing the generation of overly generalized processing suggestions. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is an application environment diagram of an alarm data processing method in one embodiment;

[0048] Figure 2 This is a flowchart illustrating an alarm data processing method in one embodiment;

[0049] Figure 3 This is a flowchart illustrating the process of determining associated knowledge entries in one embodiment;

[0050] Figure 4 This is a flowchart illustrating the process of building a dedicated knowledge base for power alarms in one embodiment;

[0051] Figure 5 This is a flowchart illustrating the process of calibrating alarm levels in one embodiment;

[0052] Figure 6 This is a flowchart illustrating the process of updating the alarm processing model in one embodiment;

[0053] Figure 7 This is a structural block diagram of an alarm data processing device in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] The technical background of this application will be explained below.

[0056] This application focuses on alarm handling and severity level determination scenarios in power information systems, applicable to alarm management scenarios in various power information systems such as power dispatching information systems, distribution automation information systems, and power marketing information systems. As power information systems transform towards digitalization and intelligence, the integrated equipment and components are becoming increasingly complex, encompassing multiple categories including middleware, databases, microservices, network devices, and terminal devices. The alarm data generated during operation and maintenance is growing exponentially, with daily alarm volumes reaching tens of thousands or even hundreds of thousands. This alarm data not only includes a large number of invalid and redundant alarms, but also suffers from diverse alarm types, complex fault correlations, and ambiguous severity level classifications—low-level alarms frequently flood the screen, while high-level alarms are easily buried. Furthermore, the matching degree between alarms and handling solutions is low, requiring maintenance personnel to spend a significant amount of time filtering valid alarms, determining alarm levels, and finding handling methods, severely impacting the timeliness and accuracy of alarm handling.

[0057] In terms of related technological development, alarm handling technology has gone through three stages: manual handling, rule-based handling, and intelligent handling. Manual handling relies on the experience of operation and maintenance personnel, which is inefficient and prone to errors. Rule-based handling achieves level determination and simple handling through preset alarm rules, but has poor adaptability and cannot cope with new alarms and complex related alarms. Intelligent handling relies on deep learning and large model technology to attempt to achieve automatic alarm level determination and handling suggestion generation. However, traditional large models have defects such as "knowledge lag", "easily generate illusions" and "generalization of handling solutions", which cannot accurately match the professional and timeliness requirements of power information system alarms.

[0058] Currently, similar technologies in the industry mainly include alarm level determination tools based on rule matching, text question-and-answer tools based on general RAG (Retrieval-Augmented Generation), and basic alarm handling systems for the power industry. These technologies all have obvious shortcomings: rule matching tools can only determine alarm levels through preset keywords, which cannot handle new alarms and complex related alarms, have poor adaptability, and the handling solutions are fixed and cannot be flexibly adjusted; general RAG text question-and-answer tools are not adapted to alarm terminology and level classification standards in the power information field, the knowledge base does not cover professional knowledge of power alarms, the retrieval accuracy is low, the generated handling suggestions lack professionalism, and are prone to misalignment; basic power alarm handling systems are mostly based on manual level determination and manual matching of handling solutions, with low automation, unable to handle massive alarm data, and without combining RAG technology, they cannot solve the problems of large model illusion and knowledge lag. None of these technologies can meet the high-precision and high-efficiency requirements of alarm handling and level determination in power information systems.

[0059] In summary, the most significant technical problem addressed by this application is the low efficiency and poor accuracy in processing alarm data.

[0060] Based on this, this application proposes an alarm data processing method applied to a server of a power information system, comprising: acquiring alarm data to be processed; retrieving relevant related knowledge entries from a pre-built power alarm-specific knowledge base based on the alarm data to be processed; inputting the alarm data to be processed and the relevant knowledge entries into a pre-trained alarm processing model, and generating an initial alarm level and alarm processing suggestions through the alarm processing model under the constraints of the relevant knowledge entries; calibrating the initial alarm level according to the impact of the alarm data to be processed, and obtaining a calibrated alarm level. The embodiments of this application can achieve high-precision and efficient processing of alarm data. Specific embodiments are described below.

[0061] The alarm data processing method provided in this application embodiment can be applied to, for example... Figure 1In the application environment shown, the data acquisition terminal 102 communicates with the server 104 via a network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated onto the server 104, or it can be placed on the cloud or other network servers. The process involves: acquiring alarm data to be processed; retrieving relevant related knowledge entries from a pre-built power alarm-specific knowledge base based on the alarm data; inputting the alarm data and related knowledge entries into a pre-trained alarm processing model; generating an initial alarm level and alarm processing suggestions through the alarm processing model under the constraints of the related knowledge entries; calibrating the initial alarm level based on the impact of the alarm data to be processed, resulting in a calibrated alarm level. The data acquisition terminal 102 can be, but is not limited to, various computers, data acquisition sensors, smartphones, etc. The server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0062] In one exemplary embodiment, such as Figure 2 As shown, an alarm data processing method is provided, which can be applied to... Figure 1 Taking the server in the example of this, the explanation includes:

[0063] S210, Obtain alarm data to be processed.

[0064] Among them, the alarm data to be processed is the original alarm data collected through the data acquisition terminal, including but not limited to alarm ID, alarm text, alarm time, alarm device, technology stack, fault phenomenon, scope of impact, etc., that is, all the data that can be collected through the data acquisition terminal to characterize the fault.

[0065] S220: Based on the alarm data to be processed, search the pre-built power alarm-specific knowledge base to obtain the corresponding related knowledge entries.

[0066] The power alarm-specific knowledge base is a pre-built knowledge base module that stores professional knowledge related to power information system alarms. In one embodiment, this knowledge base includes the following four types of sub-bases: alarm level standard sub-base, alarm handling rule sub-base, historical case sub-base, and alarm association knowledge sub-base. The alarm level standard sub-base stores alarm level standards for the power industry and within the enterprise, including judgment indicators (impact range, fault severity, handling time limit), quantitative thresholds, and level descriptions for each alarm level. It uses structured tables for easy querying and level determination. The alarm handling rule sub-base includes standard handling rules and operations for various alarms, categorized by alarm type and technology stack. The system includes procedures and precautions, covering different types of alarm handling specifications such as middleware alarms, database alarms, and network alarms. These are stored in structured documents and support precise keyword retrieval. The historical case library stores historical alarm handling cases, including alarm information, severity assessment results, handling steps, handling effects, and experience summaries. It uses unstructured text with structured tags, including alarm type, technology stack, severity level, and handling personnel, facilitating case retrieval and large-scale model learning. The alarm association knowledge library stores the relationships between alarms and faults, and between alarms themselves. It constructs an alarm knowledge graph, marking the propagation paths and association weights of root alarms and related alarms for related alarm identification and collaborative handling.

[0067] In this embodiment of the application, the above-mentioned alarm data to be processed is searched in the above-mentioned knowledge base to obtain multiple related knowledge entries with the highest matching degree (or similarity) with the alarm data to be processed.

[0068] S230: Input the alarm data to be processed and the associated knowledge items into the pre-trained alarm processing model. Under the constraints of the associated knowledge items, the alarm processing model generates the initial alarm level and alarm processing suggestions.

[0069] The alarm handling model generally uses a 32B or larger model commonly used in this field as its base (such as Qwen3-32B or Llama3-34B model). This model is pre-tuned and has been imported with core knowledge and historical handling cases from the power alarm knowledge base during the training phase. The model is then fine-tuned to familiarize it with the power alarm level standards and handling logic, thus avoiding the output of generalized or misaligned content.

[0070] The initial alarm level mentioned above is the level result of the large model output for the alarm data to be processed. The level of the alarm data is used to characterize the severity of the alarm data to be processed. The smaller the level number, the more serious the fault represented by the alarm data is, and the more timely it needs to be handled. In one embodiment, the alarm level can be determined by preset judgment indicators, including but not limited to: fault impact range, fault severity, processing time limit, and number of associated alarms.

[0071] In this embodiment of the application, the alarm data to be processed and the corresponding related knowledge entries are input into the alarm processing big model. The alarm processing big model will output the initial alarm level and alarm processing suggestions for the alarm data to be processed.

[0072] S240, calibrate the initial alarm level according to the impact of the alarm data to be processed, and obtain the calibrated alarm level.

[0073] In this embodiment, after receiving the initial alarm level, the initial alarm level is calibrated to achieve accurate determination of the alarm level, thereby clarifying the priority of alarm handling. In one embodiment, the alarm levels include emergency alarm (level 1), important alarm (level 2), general alarm (level 3), and alert alarm (level 4), with the severity decreasing in that order.

[0074] In this embodiment, the core indicators (impact range, fault severity, handling priority, and number of associated alarms) of the alarm data to be processed are quantitatively scored to obtain a comprehensive score for the alarm data. Finally, the comprehensive score is compared with the pre-set branch standards of four alarm levels to calibrate the initial alarm level. Understandably, if a large deviation is detected between the calibrated level and the original level output by the large model (e.g., a level deviation greater than or equal to 2), feedback is sent to the large model to adjust its output logic.

[0075] In summary, in this embodiment of the application, an accurate alarm level and alarm handling suggestions corresponding to the alarm data to be processed will be obtained. Furthermore, the comprehensive score obtained after quantification can also be output synchronously. Furthermore, the large model can also output its thinking process, and the basis for determining the alarm level by the large model can be extracted through this thinking process.

[0076] This application's embodiments combine a power alarm-specific knowledge base with a large-scale model, and then correct the initial alarm level output by the large-scale model, achieving accurate alarm level determination and effectively avoiding the problems of ignoring high-level alarms and over-handling low-level alarms. Furthermore, the deep integration of the power alarm-specific knowledge base with the large-scale model allows the model to generate processing suggestions based on precisely relevant retrieved knowledge entries, avoiding misleading content that is out of touch with the actual alarm scenario and preventing the generation of overly generalized processing suggestions.

[0077] In an exemplary embodiment, the alarm data to be processed is retrieved from a pre-built power alarm-specific knowledge base to obtain corresponding related knowledge entries, including:

[0078] The retrieval module retrieves relevant knowledge entries from a power alarm-specific knowledge base by performing a search in advance. The retrieval module is trained based on pre-acquired retrieval training samples, which consist of training alarm features and corresponding knowledge entries.

[0079] The retrieval module is generally a retrieval module based on RAG technology. The module structure includes an input layer, a feature matching layer, a retrieval ranking layer, and an output layer.

[0080] In this embodiment, the retrieval module searches a dedicated knowledge base for power alarms to obtain multiple related knowledge entries corresponding to the alarm data to be processed. During the training phase of the retrieval module, its training samples include a large number of retrieval training sample pairs, which include training alarm features and corresponding multiple knowledge entries.

[0081] Specifically, during the training phase of the retrieval module, the similarity calculation logic of the vector retrieval algorithm can be optimized, the weight allocation of keyword retrieval can be adjusted (the weight of professional term keywords is higher than that of ordinary keywords), and the gradient descent algorithm can be used to train the retrieval model to improve retrieval accuracy. Furthermore, the retrieval model can be validated using a test dataset. For samples with retrieval errors or low matching degree, the reasons for the errors can be analyzed, and the retrieval algorithm parameters and matching thresholds can be adjusted to ensure that the retrieval accuracy reaches more than 95%.

[0082] In one exemplary embodiment, such as Figure 3 As shown, by using a pre-established retrieval module to search the dedicated knowledge base for power alarms, relevant knowledge entries are obtained, including:

[0083] S310 performs feature extraction processing on the alarm data to be processed to obtain the features of the alarm data to be processed.

[0084] In this embodiment of the application, feature extraction processing is performed on the alarm data to be processed to obtain the corresponding alarm data features to be processed.

[0085] S320, calculate the data similarity between the alarm data to be processed and each knowledge entry in the power alarm dedicated knowledge base, and calculate the feature similarity between the features of the alarm data to be processed and the features of each knowledge entry in the power alarm dedicated knowledge base.

[0086] In this embodiment of the application, the input layer of the retrieval module receives the above-mentioned alarm data to be processed and the corresponding alarm data features to be processed, and can also receive auxiliary retrieval conditions input by the user, such as technology stack category and alarm time range.

[0087] Through the feature matching layer of the retrieval module, the similarity between the feature vectors of the corresponding alarm data to be processed and the feature vectors of the knowledge entries in the knowledge base is calculated using a vector retrieval algorithm. In addition, the core keywords of the alarm data to be processed are extracted using a keyword retrieval algorithm and matched with the knowledge entries in the knowledge base. This yields the feature similarity between the features of the alarm data to be processed and the features of each knowledge entry in the knowledge base, as well as the similarity between the alarm data to be processed and each knowledge entry in the power alarm-specific knowledge base.

[0088] S330, combine the data similarity and feature similarity between each knowledge entry and the alarm data to be processed to determine the associated knowledge entry corresponding to the alarm data to be processed.

[0089] In this embodiment, based on the aforementioned data similarity and feature similarity, a comprehensive matching score is calculated for each knowledge item. The items are then sorted from highest to lowest score, and the top ten most matching knowledge items are selected as the associated knowledge items. These associated knowledge items cover knowledge such as grading standards, handling rules, and historical cases. Finally, the sorted associated knowledge items are output through the output layer of the retrieval module in the order of "grading standards → handling rules → historical cases." This provides accurate knowledge support for subsequent grading determination and processing suggestion generation for large models.

[0090] In one exemplary embodiment, such as Figure 4 As shown, the steps for building a dedicated knowledge base for power alarms include:

[0091] S410, Obtain initial knowledge base data, which includes original alarm data, alarm processing data, alarm level standard data, and related alarm data.

[0092] The initial knowledge base data includes four core categories: raw power alarm data, alarm handling data, alarm level standard data, and related alarm data. Raw power alarm data includes alarm data from various power information systems, including alarm ID, alarm text, alarm time, alarm device, associated technology stack, fault phenomenon, and impact range. It is collected categorized by alarm type (equipment alarm, network alarm, software alarm, etc.) and used for knowledge base construction, model training, and retrieval matching. Alarm handling data includes historical handling data corresponding to various alarms, including handling ID, handling steps, and processing details. The system stores alarm information categorized by alarm level and type, including personnel, handling results, and handling priorities. This information is used to build the handling rule base and historical case base of the knowledge base. Alarm level standard data includes relevant standards for alarm levels in the power industry and internal alarm level specifications for enterprises, including the judgment conditions, handling time limits, and scope of impact for each alarm level. This data is used to build the alarm level judgment system and the level standard base of the knowledge base. Related alarm data includes alarm combination data with relationships, including root alarms, related alarms, and alarm propagation paths. This data is used to train the related alarm identification module and to uncover the relationship logic between alarms.

[0093] S420 performs feature extraction on the original alarm data to obtain the corresponding alarm feature vector, and preprocesses the initial knowledge base data to obtain the preprocessing result.

[0094] The data preprocessing includes, but is not limited to, data cleaning and data standardization. Data cleaning includes at least removing invalid data (such as data with ambiguous alarm text, missing equipment information, or incomplete handling steps), handling missing values ​​(filling in missing fault phenomena using the same type of alarm association method, and filling in missing alarm levels using the standardized value method), and removing duplicate data (such as repeatedly reported identical alarm data). Data standardization includes at least encoding data categorized by alarm type, technology stack category, alarm level, and handling effect (e.g., Emergency = 1, Important = 2, General = 3, Alert = 4), converting alarm time to timestamp format, and performing word segmentation, stop word removal, and normalization on text data such as alarm text, fault phenomena, and handling steps, and standardizing the expression of professional terminology (e.g., "downtime" is standardized as "system interruption").

[0095] In this embodiment, feature extraction processing is performed on the original alarm data. This includes using the BERT (Bidirectional Encoder Representations from Transformers) feature extraction algorithm to extract the core semantic features of the alarm text. Combined with information such as alarm device, impact range, and occurrence time, common and specific features of the alarms are extracted to construct an alarm feature vector (256-512 dimensions, dynamically adjusted according to the data scale). This vector is used for RAG retrieval matching and alarm level determination, ultimately forming a standardized dataset for use by other modules.

[0096] S430 extracts knowledge from the preprocessing results to form a large number of knowledge extraction items.

[0097] In this embodiment, Natural Language Processing (NLP) technology can be used to extract knowledge from the preprocessed and feature-extracted initial knowledge base data. The extracted knowledge is then classified and labeled. Structured knowledge (such as grading standards and disposal rules) is converted into tables and JSON formats, while unstructured knowledge (such as historical cases) is segmented and labeled. An association index between knowledge is established to form a large number of knowledge extraction entries.

[0098] S440, a power alarm-specific knowledge base is established based on knowledge extraction items. The power alarm-specific knowledge base includes an alarm level standard sub-base, an alarm processing rule sub-base, a historical alarm data sub-base, and an alarm association knowledge sub-base. The data in each sub-base is cross-referenced with the corresponding data in other sub-bases through index keys.

[0099] In this embodiment, a hybrid structured and unstructured storage model is adopted to obtain the aforementioned power alarm-specific knowledge base. This knowledge base includes an alarm level standard sub-base, an alarm handling rule sub-base, a historical alarm data sub-base, and an alarm association knowledge sub-base. The alarm level standard sub-base stores alarm level standards for the power industry and within the enterprise, including judgment indicators (impact range, fault severity, handling time limit), quantification thresholds, and level descriptions for each alarm level. This is stored in structured tables for easy retrieval and level determination. The alarm handling rule sub-base stores standard handling rules, operating procedures, and precautions for various alarms according to alarm type and technology stack category, including... The system includes handling specifications for different types of alarms, such as middleware alarms, database alarms, and network alarms, stored in structured documents and supporting precise keyword retrieval. A historical alarm data sub-database stores historical alarm handling cases, including alarm information, severity level determination results, handling steps, handling effects, and experience summaries. This data is stored using unstructured text with structured tags, including alarm type, technology stack, severity level, and handling personnel, facilitating case retrieval and large-scale model learning. An alarm association knowledge sub-database stores the relationships between alarms and faults, and between different alarms, constructing an alarm knowledge graph that marks the propagation paths and association weights of root cause alarms and related alarms for related alarm identification and collaborative handling.

[0100] Furthermore, after storing the aforementioned structured and unstructured knowledge in their respective sub-databases, the courseware features a global search index that supports multi-dimensional searches by alarm text, alarm type, level, technology stack, etc., ensuring a search response speed of ≤100ms.

[0101] Furthermore, power operation and maintenance experts can be organized to verify the knowledge entered into the database, correct errors, and supplement missing knowledge to ensure the professionalism and accuracy of the knowledge base content. The verification pass rate should reach more than 98%.

[0102] In an exemplary embodiment, the alarm data to be processed and the associated knowledge entries are jointly input into a pre-trained alarm processing model. Under the constraints of the associated knowledge entries, the alarm processing model generates an initial alarm level and alarm processing suggestions, including:

[0103] The alarm data to be processed and the associated knowledge entries are input into a pre-trained alarm processing model to obtain the initial alarm level and processing suggestions. The alarm processing model is trained based on a sample pair consisting of a first data set and a second data set. The first data set includes training alarm features and corresponding knowledge entries, and the second data set includes alarm levels and processing suggestions corresponding to the training alarm features.

[0104] The alarm processing model uses a 32B or larger model as its foundation (selecting either Qwen3-32B or Llama3-34B). Based on this foundation, fine-tuning is performed using professional knowledge of power alarms, focusing on optimizing the professionalism of alarm semantic parsing, level determination logic, and handling suggestion generation to avoid generating false alarms. The specific structure includes a base layer, a power alarm-specific fine-tuning layer, and an output layer. The base layer, using a Qwen3-32B or Llama3-34B model as its foundation, is responsible for deep semantic fusion of alarm features and retrieved professional knowledge, uncovering the potential correlation between alarms and level standards and handling rules. Following the output layer of the main model base, a new specialized fine-tuning layer is added to the power alarm-specific knowledge base. This layer imports core knowledge and historical handling cases from the dedicated power alarm knowledge base to fine-tune the model, ensuring it is familiar with the power alarm level standards and handling logic, thus avoiding generalized or misaligned output. The output layer is divided into a level output sub-layer and a handling suggestion output sub-layer. The level output sub-layer combines the retrieved level standards to output the alarm level and its judgment basis. The handling suggestion output sub-layer combines the retrieved handling rules and historical cases to generate targeted handling steps, precautions, and common problem troubleshooting, ensuring that the output content is professional, specific, and actionable.

[0105] In this embodiment of the application, after obtaining the initial alarm processing model, the initial alarm processing model can be fine-tuned. First, a sample pair for fine-tuning is constructed. The sample pair consists of a first data group and a second data group. The first data group includes training alarm features and corresponding knowledge entries, and the second data group includes alarm levels and processing suggestions corresponding to the training alarm features.

[0106] The above sample pairs were input into a large model base, and the cross-entropy loss function was used as the optimization objective. Gradient descent was employed for fine-tuning, focusing on improving the accuracy of grade determination and the specificity of treatment suggestions, while eliminating overly generalized and non-specific statements. Finally, the fine-tuned model was validated using a test dataset. For samples with incorrect grade determinations, misleading or inappropriate treatment suggestions, the fine-tuning parameters were adjusted, and specialized training data was added until the model's output grade accuracy reached over 96% and the professionalism of the treatment suggestions reached over 95%.

[0107] In practical applications, the trained large model can be deployed to a server, establish a data connection with the aforementioned retrieval module and subsequent level correction module, receive retrieval knowledge and alarm features, and complete level determination and alarm handling suggestions generation.

[0108] In this embodiment of the application, relying on retrieval technology and combining the related knowledge entries output by the retrieval module, accurate and professional alarm levels and alarm handling suggestions can be generated through the alarm handling big model.

[0109] In one exemplary embodiment, such as Figure 5 As shown, the initial alarm level is calibrated based on the impact of the alarm data to be processed, resulting in a calibrated alarm level, including:

[0110] S510 retrieves the initial alarm level and alarm level standard data from the dedicated knowledge base for power alarms.

[0111] The alarm level standard data includes four levels, specifically: 1. Emergency Alarm (Level 1): The impact covers the entire power information system or core business module, the fault is serious, the handling time limit is ≤30 minutes, the number of associated alarms is ≥5, and the comprehensive score of the judgment threshold is ≥90 points; 2. Important Alarm (Level 2): ​​The impact covers a single business module, the fault is relatively serious, the handling time limit is ≤1 hour, the number of associated alarms is 3-4, and the comprehensive score of the judgment threshold is 75-89 points; 3. General Alarm (Level 3): The impact covers a single device or local area, the fault is minor, the handling time limit is ≤4 hours, the number of associated alarms is 1-2, and the comprehensive score of the judgment threshold is 60-74 points; 4. Alert Alarm (Level 4): There is no actual fault impact, it is only a status indication, no emergency handling is required, the handling time limit is ≤24 hours, the number of associated alarms is 0, and the comprehensive score of the judgment threshold is <60 points.

[0112] And understandably, this initial alarm level is the output of the aforementioned alarm processing model.

[0113] In the embodiments of this application, S510 to S530 are all implemented by the aforementioned grade correction module.

[0114] The S520 quantifies and scores the impact of alarm data on the alarms to be processed based on preset key indicators of alarm level.

[0115] The key indicators for alarm levels include the scope of impact, the severity of the fault, the priority of handling, and the number of associated alarms. Furthermore, weighted calculations can be performed, such as a weight of 40% for the scope of impact, 30% for the severity of the fault, 20% for the priority of handling, and 10% for the number of associated alarms.

[0116] In this embodiment of the application, the alarm data to be processed can be quantitatively scored using the aforementioned key indicators of alarm level.

[0117] S530 updates the initial alarm level based on the quantification results and alarm level standard data to obtain the updated alarm level.

[0118] In this embodiment of the application, the quantitative scoring result is matched with the score area corresponding to each level in the alarm level standard data mentioned above, so as to complete the update of the initial alarm level, thereby ensuring the accuracy of the level determination and obtaining the updated alarm level.

[0119] In one exemplary embodiment, the method further includes:

[0120] When generating corresponding alarm handling suggestions based on related knowledge entries, the alarm characteristics and alarm handling suggestions of the alarm data to be processed are sent to the preset association identification module. The association identification module retrieves related alarm entries related to the alarm characteristics from the preset related power alarm exclusive knowledge base. The root cause alarm is identified based on the related alarm entries. Based on the alarm level of the root cause alarm and the related alarm entries, a collaborative processing scheme is determined.

[0121] The correlation identification module outputs a list of related alarms, root cause alarms, and collaborative processing solutions.

[0122] In this embodiment, the core function of the association identification module is to identify related alarms in alarm data, uncover root cause alarms, and achieve collaborative handling of related alarms.

[0123] First, the association identification module retrieves related alarm entries from the alarm association knowledge sub-base in the power alarm dedicated knowledge base based on the alarm characteristics of the alarm data to be processed and the updated alarm level mentioned above. At least the ID, type, and occurrence time of the related alarm entries are extracted.

[0124] Then, by combining the alarm knowledge graph, the propagation path and association weight between related alarm items are analyzed to identify the root cause alarm (i.e. the core fault alarm that triggers other related alarms) and determine the level and handling priority of the root cause alarm.

[0125] Finally, based on the severity levels of root cause alarms and related alarms, a processing order is planned (e.g., root cause alarms are processed first, followed by related alarms), processing suggestions for each alarm are integrated, duplicate and conflicting processing steps are eliminated, and the above collaborative processing solution is generated.

[0126] In this embodiment, the list of associated alarm entries, the root cause alarm identification results, and the collaborative processing scheme can be output simultaneously, thereby assisting operation and maintenance personnel in solving alarm problems from the root cause.

[0127] In one exemplary embodiment, such as Figure 6 As shown, the method also includes:

[0128] S610, when the alarm handling model is detected to meet the preset update conditions, collects new alarm data and corresponding new handling experience, level standard update data, and evaluation of alarm handling suggestions.

[0129] The update conditions can be preset trigger conditions for model updates, including but not limited to, when the model running time is detected to be greater than a preset time threshold, when the scores of relevant users on the alarm level and handling suggestions of the model output are less than a preset score threshold, etc.

[0130] In this embodiment of the application, external evaluation information on alarm levels and handling suggestions is collected, as well as newly added alarm data (such as new alarms, new device alarms), newly added handling experience, and newly added industry alarm level standard information (i.e., level standard update data).

[0131] S620 extracts new knowledge entries based on newly added alarm data, new processing experience, updated grade standard data, and alarm processing suggestions, and updates the power alarm-specific knowledge base through these new knowledge entries.

[0132] In this embodiment, newly added alarm data, handling experience, and standard update information are extracted into knowledge entries, verified by experts, and then added to the corresponding sub-database of the knowledge base to update the knowledge index. At the same time, outdated and incorrect knowledge entries are deleted to ensure the timeliness and accuracy of the knowledge base content.

[0133] S630 performs incremental fine-tuning on the alarm handling model based on the updated power alarm-specific knowledge base and the evaluation of alarm handling suggestions, resulting in an updated alarm handling model.

[0134] In this embodiment, based on the updated power alarm-specific knowledge base, newly added knowledge entries, and evaluation feedback, the above alarm processing model is incrementally fine-tuned, the level determination logic and the handling suggestion generation logic are adjusted, the retrieval algorithm of the RAG retrieval module is optimized, and the model performance is improved.

[0135] In practical applications, the updated knowledge base and model can also be tested to verify the retrieval accuracy, the accuracy of the level determination, and the professionalism of the handling suggestions. If the expected results are not achieved, the above steps can be repeated until the actual needs are met.

[0136] In this embodiment, the application scenarios of the alarm data processing method are as follows:

[0137] 1. Power Dispatch Information System Alarm Handling: Applied to power dispatch information systems, this system accurately determines alarm levels and generates professional handling suggestions for various alarms, such as network alarms, database alarms, and middleware alarms, through RAG retrieval and large model calculations. In particular, for complex and related alarms, it achieves root cause handling through correlation identification, ensuring the stable and efficient operation of power dispatching.

[0138] 2. Alarm Handling for Distribution Automation Information Systems: Applicable to distribution automation information systems, handling alarms from distribution terminals, communication equipment, and back-end systems. It uses a four-level urgency assessment to differentiate alarms, prioritizing the handling of high-level alarms, thereby improving the operational efficiency of distribution automation systems and ensuring their reliable operation.

[0139] 3. Power Marketing Information System Alarm Handling: Applied to power marketing information systems, this feature uses RAG technology to match professional handling knowledge with software alarms, terminal alarms, and data alarms, generating accurate handling suggestions to reduce the impact of alarm handling on power marketing work and improve user experience.

[0140] 4. Power Information System Alarm Management Platform: As the core technology of the alarm management platform, it integrates alarm data from various power information systems to achieve unified alarm collection, level determination, handling suggestion generation, and correlation identification. It provides maintenance personnel with an integrated alarm management tool to improve overall maintenance efficiency.

[0141] In summary, this application enables accurate identification and collaborative handling of complex related alarms. Specifically, through the related alarm identification module and alarm knowledge graph, it can quickly identify root cause alarms and related alarms, plan the collaborative handling sequence, solve the problem of recurring alarms from the root, and improve the handling efficiency of complex related alarms by more than 70%.

[0142] Furthermore, it can also improve alarm handling efficiency and reduce operation and maintenance costs. It realizes full-process automation of alarm collection, preprocessing, level determination, handling suggestion generation, and correlation identification without much manual intervention, significantly reducing the workload and professional threshold of operation and maintenance personnel, improving alarm handling response speed by more than 65%, reducing operation and maintenance costs by more than 40%, and adapting to the needs of massive alarm handling.

[0143] Furthermore, this application is highly adaptable and can flexibly respond to new alarm scenarios. Through the dynamic update module, the knowledge base and model can be continuously iterated, enabling rapid adaptation to alarm types caused by newly added equipment and new faults in the power information system. At the same time, it can adapt to updates to industry alarm level standards without requiring large-scale modifications to the overall solution, demonstrating strong adaptability and scalability.

[0144] Finally, the alarm data processing method presented in this application is widely applicable and adaptable to various power information systems. The solution can be flexibly adapted to various power information systems such as power dispatching, distribution automation, and power marketing, supporting the handling and severity determination of alarms from different technology stacks. The knowledge base content and severity determination thresholds can be adjusted according to the alarm characteristics of the actual system, demonstrating broad applicability.

[0145] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0146] Based on the same inventive concept, this application also provides an alarm data processing apparatus for implementing the alarm data processing method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more of the alarm data processing apparatus embodiments provided below can be found in the limitations of the alarm data processing method described above, and will not be repeated here.

[0147] In one exemplary embodiment, such as Figure 7 As shown, an alarm data processing device is provided, comprising:

[0148] Module 71 is used to acquire alarm data to be processed;

[0149] The retrieval module 72 is used to retrieve relevant knowledge entries from a pre-built power alarm knowledge base based on the alarm data to be processed.

[0150] The generation module 73 is used to input the alarm data to be processed and the associated knowledge items into the pre-trained alarm processing model. Under the constraints of the associated knowledge items, the alarm processing model generates the initial alarm level and alarm processing suggestions.

[0151] The optimization module 74 is used to calibrate the initial alarm level according to the impact of the alarm data to be processed, and obtain the calibrated alarm level.

[0152] Each module in the aforementioned alarm data processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0153] In one exemplary embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement any of the alarm data processing methods described above.

[0154] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements any of the alarm data processing methods described above.

[0155] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements any of the alarm data processing methods described above.

[0156] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0157] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0158] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An alarm data processing method, characterized in that, The method, applied to a server in a power information system, includes: Obtain pending alarm data; The relevant knowledge entries are obtained by searching the pre-built power alarm knowledge base based on the alarm data to be processed. The alarm data to be processed and the associated knowledge entries are input into a pre-trained alarm processing model. Under the constraints of the associated knowledge entries, the alarm processing model generates an initial alarm level and alarm processing suggestions. The initial alarm level is calibrated based on the impact of the alarm data to be processed, resulting in a calibrated alarm level.

2. The method according to claim 1, characterized in that, The step involves retrieving relevant knowledge entries from a pre-built power alarm-specific knowledge base based on the alarm data to be processed, including: The relevant knowledge entries are obtained by searching the power alarm-specific knowledge base through a pre-established retrieval module. The retrieval module is trained based on pre-acquired retrieval training sample pairs, which consist of training alarm features and corresponding knowledge entries.

3. The method according to claim 2, characterized in that, The process involves searching the power alarm-specific knowledge base using a pre-established retrieval module to obtain the associated knowledge entries, including: The alarm data to be processed is subjected to feature extraction processing to obtain the features of the alarm data to be processed; Calculate the data similarity between the alarm data to be processed and each knowledge entry in the power alarm-specific knowledge base, and calculate the feature similarity between the features of the alarm data to be processed and the features of each knowledge entry in the power alarm-specific knowledge base; By combining the data similarity and feature similarity between each knowledge entry and the alarm data to be processed, the associated knowledge entry corresponding to the alarm data to be processed is determined.

4. The method according to claim 2, characterized in that, The steps for constructing the dedicated knowledge base for power alarms include: Acquire initial knowledge base data, which includes original alarm data, alarm processing data, alarm level standard data, and associated alarm data; The original alarm data is subjected to feature extraction processing to obtain the corresponding alarm feature vector, and the initial knowledge base data is preprocessed to obtain the preprocessing result; Knowledge is extracted from the preprocessing results to form a large number of knowledge extraction entries; Based on the knowledge extraction entries, a power alarm-specific knowledge base is established. The power alarm-specific knowledge base includes an alarm level standard sub-base, an alarm processing rule sub-base, a historical alarm data sub-base, and an alarm association knowledge sub-base. The data in each sub-base is cross-referenced with the corresponding data in other sub-bases through an index key.

5. The method according to any one of claims 1 to 4, characterized in that, The process involves inputting the alarm data to be processed and the associated knowledge entries into a pre-trained alarm processing model. Under the constraints of the associated knowledge entries, the alarm processing model generates an initial alarm level and alarm processing suggestions, including: The alarm data to be processed and the associated knowledge entries are input into a pre-trained alarm processing model to obtain the initial alarm level and the processing suggestion; wherein, the alarm processing model is trained based on sample pairs consisting of a first data group and a second data group, wherein the first data group includes training alarm features and corresponding knowledge entries, and the second data group includes alarm levels and processing suggestions corresponding to the training alarm features.

6. The method according to any one of claims 1 to 4, characterized in that, The step of calibrating the initial alarm level based on the impact of the alarm data to be processed to obtain the calibrated alarm level includes: Obtain the initial alarm level and the alarm level standard data from the power alarm-specific knowledge base; The impact of the alarm data to be processed is quantitatively scored based on preset key indicators of alarm level. The initial alarm level is updated based on the quantification results and the alarm level standard data to obtain the updated alarm level.

7. The method according to any one of claims 1 to 4, characterized in that, The method further includes: When generating corresponding alarm handling suggestions based on the associated knowledge entries, the alarm characteristics of the alarm data to be processed and the alarm handling suggestions are sent to a preset association identification module. The association identification module retrieves associated alarm entries related to the alarm characteristics from a preset associated power alarm-specific knowledge base. The root cause alarm is identified based on the associated alarm entries, and a collaborative processing scheme is determined based on the alarm levels of the root cause alarm and the associated alarm entries. The correlation identification module outputs a list of related alarms, the root cause alarms, and the collaborative processing scheme.

8. The method according to any one of claims 1 to 4, characterized in that, The method further includes: When the alarm handling model is found to meet the preset update conditions, new alarm data, corresponding new handling experience, level standard update data, and evaluation of the alarm handling suggestions are collected. New knowledge entries are extracted based on the newly added alarm data, the newly added processing experience, the updated level standard data, and the alarm processing suggestions. The power alarm-specific knowledge base is then updated using these new knowledge entries. Based on the updated power alarm-specific knowledge base and the evaluation of the alarm handling suggestions, the alarm handling model is incrementally fine-tuned to obtain the updated alarm handling model.

9. An alarm data processing device, characterized in that, The device includes: The acquisition module is used to acquire alarm data to be processed. The retrieval module is used to retrieve relevant knowledge entries from a pre-built power alarm knowledge base based on the alarm data to be processed. The generation module is used to input the alarm data to be processed and the associated knowledge entries into a pre-trained alarm processing model. Under the constraints of the associated knowledge entries, the alarm processing model generates an initial alarm level and alarm processing suggestions. An optimization module is used to calibrate the initial alarm level based on the impact of the alarm data to be processed, so as to obtain a calibrated alarm level.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

Images