A Comprehensive Review of Alarm Processing in Power Systems: Addressing Overreliance on Fault Analysis and Projecting Future Directions

Abstract

This paper reviews alarm processing methods in electrical power systems, focusing on evolving strategies beyond traditional fault analysis to accommodate modern grid complexities. Historically, alarm processing has predominantly aimed at fault analysis, increasingly merging with technological advances in communication and computing. However, it still needs to fully meet the challenges posed by the dynamic characteristics of modern power systems. This review points out certain inadequacies in current practices, notably their limited adaptation to new grid conditions. The authors propose a novel generation of alarm processing methodologies designed for future grids, emphasizing managing rare events and enhancing operator decision-making through advanced anomaly detection and explainable artificial intelligence. This synthesis presents a prospective direction for future research and applications in alarm processing, advocating for methodologies better suited to supporting system operators amidst technological advancements.

1. Introduction

The power system is crucial for delivering electrical energy from generation facilities to customers in real time. The rapid growth in demand for electricity has led to the expansion of both generation and transmission/distribution facilities, making the power system more complex [1]. Moreover, due to the synchronized nature of the power system, a sudden change in some small local area can ripple through and impact the entire power system [2]. For example, a decrease in output from a generating facility or a disruption in a transmission line can lead to localized power outages and broader system stability issues due to fluctuations of the synchronous frequency. Without prompt and effective intervention, such problems can collapse system-wide, causing large-scale blackouts and significant social and economic losses [3,4].

In response to these challenges, system developers have introduced operational aids like advanced monitoring systems to enhance the effective management of grids. However, this has led to an increase in the information the system operators must handle. Combined with the growing complexity of modern power systems [5,6], it has significantly heightened the stress on operators. Specifically, the burden on operators to manage the vast amount of data directly results from an environment that supports diverse system data acquisition and large-scale data processing [7]. To address these issues, developing sophisticated alarm processing techniques has become essential. These techniques help operators maintain situational awareness during alarm floods, that is, large-scale alarm events.

The primary purpose of alarm processing is to support system operators. There have been many research studies on alarm processing in which, in the narrowest sense, alarm processing methods focus on supporting the operators by removing, cleaning, transforming, or visualizing the alarm data rather than deriving new insights from said data. However, more comprehensively, alarm processing involves inferring meaningful information from the data, such as finding the location and the cause of a fault or identifying malfunctions in system devices, information which is then delivered to the system operator. Thus, the outcomes of alarm processing can vary significantly depending on the designer’s preferences and objectives, the types of data utilized, and the methodologies applied.

Among the various methods to assist system operators, most alarm processing research predominantly focuses on fault analysis, wherein the fault causes and locations are determined based on the behavioral states of numerous protective devices and fault indicators in power systems. Fault analysis involves constructing an alarm scenario that anticipates the system’s response to a specific fault and then comparing the actual alarm occurrences against the scenario to extract meaningful information. Knowledge-based and data-based models have been employed to create scenarios. The effectiveness of these models is assessed based on their ability to identify the causes of failures accurately.

It is contended that the prevalent bias toward fault analysis in alarm processing research results from adherence to historical methodologies despite significant changes in system environments and technological advancements. Information once crucial for assisting operators in relatively simple system environments has become less relevant in today’s complex operational settings. For example, in modern power systems equipped with various automation technologies, information about situations that can be resolved automatically without operator intervention is no longer necessary. Given these changes, reassessing the operator’s role in future system environments is essential, as is making adjustments in the direction of alarm processing research.

This paper analyzes existing alarm processing methods, outlines their limitations, and proposes a new direction. As automation technology advances, the role of the system operator is expected to diminish, while systems’ complexity will likely increase. Consequently, current methodologies will become less effective for alarm processing. Additionally, this paper examines the type of information that should be provided by effective alarm processing in the evolving grid environment, with a particular focus on the potential advantages of AI-based methodologies.

The aim of this review paper is to address the following objectives:

• Overview of Methods: Present an overview of alarm processing methods that utilize monitoring information from power systems, based on an analysis of previously published related papers.
• Analysis of Limitations: Analyze related papers to identify the problems and limitations of existing alarm processing definitions, with particular attention to issues of the potential for objective bias.
• Future Research Directions: Outline the research directions in which existing alarm processing methodologies should be directed to adapt to future changes in the power system.

The articles referenced in this paper were selected using a structured research methodology. The purpose of this process was to ensure a comprehensive and rigorous review of the literature. A comprehensive search was conducted using specific criteria in major academic databases, including Scopus and Web of Science. In Scopus, articles were identified through a search of the database using the terms “power”, “system”, “alarm”, and “processing” within the titles and abstracts. The search was conducted to identify articles within categories related to energy and engineering. Similarly, the search on Web of Science included these terms with the additional filtering of articles under the engineering, electrical, and electronic categories. This process yielded 469 articles, which were subsequently subjected to a rigorous screening process based on the four established criteria below. This process was undertaken to ensure the review’s relevance and rigor.

• Only papers related to alarm systems applied to power grid systems were included.
• Literature about the communication aspects of alarm systems was excluded.
• Literature about the hardware design of alarm systems was excluded.
• Duplicates were removed from the collection.

This paper is organized as follows: Section 2 describes the characteristics of typical alarms in industry. Section 3 discusses alarm processing in power systems, including the system information commonly utilized in this process. Section 4 classifies and analyzes existing research in the field of alarm processing. Section 5 examines the evolution of alarm processing methods, noting the current focus on fault analysis, and suggests future directions for changing grid environments. Finally, Section 6 provides a summary of the findings and conclusions of this thesis.

2. Understanding Alarm Systems in Industrial Settings

2.1. Fundamentals of Alarms in Industry

In the industrial sector, an alarm is typically defined as a visual and audible means of alerting operators to malfunctions, process deviations, and abnormal conditions that require a response [8,9]. Essentially, the primary function of an alarm is to notify operators of discrepancies within the management system. Upon receiving this notification, operators are prompted to assess the system’s current status and take the necessary actions to correct the abnormal condition.

Figure 1 illustrates the critical role of alarms in managing system anomalies. If an alarm is activated correctly, then the system can quickly return to normal through operator intervention. Conversely, the chances of restoring normalcy are significantly reduced if the operator’s response is inadequate or if an alarm is triggered too late—when the system is on the verge of collapse. Thus, effectively configured alarms are essential, as they empower operators to address issues promptly and mitigate the risk of significant damage to property and lives.

The fundamental behavioral condition for triggering an alarm is when a measured value within the system deviates beyond a user-defined threshold. This condition is depicted in Equation (1), assuming the alarm state is represented as ‘1’ when the alarm triggers at a specific time t and ‘0’ otherwise. Moreover, the alarm is activated when the measured value $x\left(t\right)$ exceeds the set point $x_{sp}$ and reverts to ‘0’ when the value is below this threshold. This mechanism provides the operator with intuitive information by directly indicating the anomaly’s location.

$$A\left(t\right)=\left\{\begin{array}{cc}1\hfill & \mathrm{if}x\left(t\right)⩾(⩽)x_{sp}\hfill \\ 0\hfill & \mathrm{if}x\left(t\right)<(>)x_{sp}\hfill \end{array}\right.$$

(1)

2.2. Critical Role of Alarm Systems in Industrial Safety

For systems of modest size, the setpoint setting method generally suffices. Historically, systems were monitored using visual and audible alarms, commonly known as ‘light boxes’ [10]. However, as the size and complexity of management systems increase, so too does the number of measuring devices needed to assess system status, leading to a proportional rise in the number of alarms communicated to the operator. This increase can lead to an alarm flood situation if not properly managed [11,12,13]. Defined as a scenario in which an overwhelming number of alarms inundate the operator during system issues, this can significantly impair decision-making, potentially causing severe system accidents [14,15].

Historical records have documented significant incidents that underscore the importance of effective alarm systems [16,17,18]. One notable example is an incident in which a system exploded after receiving 275 alarms within 11 minutes. Another example is the BP Texas City incident, in which the absence of crucial alarms used to monitor system status led to inadequate operator response, culminating in a fire that caused loss of life. Such events highlight the critical role of alarm systems in operational safety, necessitating the precise identification of core information conveyed by alarms and meticulous recording of alarm changes [8,19]. Ultimately, the primary objective of alarm processing is to efficiently manage a substantial number of alarms and ensure they are communicated to the operator effectively [20,21,22].

2.3. Key Criteria for Efficient Alarm Processing

Then, what criteria should be satisfied by the appropriate alarm processing required to respond to such abnormal system situations? The literature has proposed that the role and characteristics of alarms be communicated from the alarm system to the operator as criteria for appropriate alarm processing [17,23,24]. The alarm processing functions proposed in the literature can be summarized by the four representations in Figure 2 below.

Timeliness is defined as preventing system alarms from being raised prematurely or delayed from the time of a system state change. In some systems, a time log is recorded, and the alarms are raised. If this time log is faulty and the order of the alarms is changed, it can cause significant issues in recognizing system faults. Understandability is the ability of the operator to clearly understand a particular condition from a single piece of alarm information. An example of a violation of this is when specific alarms are toggling. This occurs when the same alarm is repeatedly communicated to the operator, causing multiple alarms to have the same meaning. Focusing provides indirect alarm summary information by prioritizing the alarms raised by the system. Its purpose is to draw the operator’s attention to alarms that are of high importance, for example, highlighting the location of a fault during a fault situation. An advisory alarm should be able to guide the operator’s behavior. For example, an alarm indicating that an oil leak has occurred in a plant can directly guide checking for an oil leak. However, an alarm indicating a temperature rise in a transformer caused by a leak would not directly support action because there could be multiple causes.

In summary of Section 2, an effectively designed alarm system enables low operating costs, high quality, and ultimately safe system operation. Therefore, there is a pressing need for research and development in alarm processing systems, focusing on communicating system status to system operators. In particular, research on alarm processing methods for power systems is of paramount importance, given the significant impact that power systems have on the entire industry and the necessity for high reliability and stability.

3. Background for the Alarm Processing of Power Systems

3.1. The Role of Alarm Processing as a Subsystem in Power System Management

Figure 3 illustrates the configuration of devices in power system management, emphasizing the function of the alarm processing system. Remote terminal units (RTUs) are situated within the local network, where they gather analog measurements from sensors, operational signals from protection devices, and alarms generated by local processes. This information is conveyed to the supervisory control and data acquisition (SCADA) system, which is stored and managed in an internal database.

This information is of critical importance for the execution of system applications such as fault analysis, topology processing, and alarm management. The results generated by these applications are displayed to operators through the human–machine interface (HMI). Operators rely on these insights to make informed control decisions. These decisions encompass a range of actions, including fault response strategies, recovery operations, control of protective devices, and network topology management, as referenced in previous studies [25,26,27,28].

The operator’s commands, informed by the HMI data, are inputted back into the SCADA system. These commands are subsequently relayed to each RTU across the system, which executes the control actions [29,30,31]. This sequence demonstrates how modern power systems leverage synchronized wide-area communication to enable effective management through real-time interaction between substations and various control systems [32]. This structured interoperation ensures that alarms are triggered accurately and that necessary responses are initiated in a timely fashion, maintaining system stability and efficiency.

3.2. Uniquely Emphasized Information in Power System Alarm Processing

3.2.1. Protective Device Operation

A protective device is a device that reacts immediately to a power system fault and physically isolates the system. A fuse is a protective device to prevent damage caused by overcurrent. It is a breaker based on the principle of physical melting in response to the heat generated by overcurrent. Fuses can be designed for different threshold current levels and automatically break the line when a defined threshold current value is exceeded, thus interrupting the fault current’s propagation path at an early stage. Fuses are disposable because they cannot be reused once they operate and must be replaced with a new fuse after the line is blown. However, due to their low costs and simple operating principles, they are widely used in many systems as a fast and efficient means of initial fault response.

Relay and CB protect the system through the operational linkage shown in the grey box on the left of the protection system in Figure 4a. The relay detects abnormal conditions by measuring current and voltage and sends a trip signal to the CB, which detects the signal from the relay and directly disconnects the grid [33,34]. The protection method that combines relays and CBs has the advantage of reconnecting the grid after the fault situation is resolved, as it uses a switching mechanism rather than a physical characteristic like a fuse.

The operational linkage of the recloser and sectionalizer is shown in Figure 4b. A recloser differs from a one-time grid isolator, such as a CB, in that it repeats a certain number of opening and closing operations. Reclosers are characterized by initially disconnecting the grid upon detecting a fault current and then reconnecting the grid after some time. This feature is designed to assume a temporary fault. Once the fault is resolved during the opening and closing operation, the recloser reconnects the grid without further opening and closing to restore the original operating state. On the other hand, if a fault is detected even after multiple opening and closing operations, the recloser will open the grid permanently to isolate the faulted section from the system and prevent the fault from spreading. The sectionalizer counts the number of open and close operations of the recloser and opens the line if it detects more than a set number of operations. Sectionalizers do not directly block faults, but their simple operation and low cost make them effective in conjunction with reclosers to minimize fault propagation [35].

Although protection device behavior information does not provide direct information about the fault, it is indirectly used to infer the fault location. To illustrate, consider a fault occurring at points 1, 2, and 3, as shown in Figure 5. In the event of a fault at point 1, a line break is typically accompanied by an overcurrent from the substation to the fault point. The system, designed to minimize grid damage through the cooperative protection of multiple devices, allows for the inference that a fault at point 1 has occurred when the CB disconnects the grid. Consequently, a fault at point 2 triggers the operation of the recloser, while a fault at point 3 triggers the operation of the sectionalizer. In this way, since the protector operates by detecting the failure of the measuring point, it is possible to identify the failure of the measuring point through the behavior information of the protector.

3.2.2. Fault Indicator

Fault indicators (FIs) are essential tools in power distribution systems and are designed to effectively and economically detect disruptions such as short circuits and ground faults [36,37,38]. These devices function by monitoring sudden increases in current flow that result from such faults, which alter the indicators’ internal magnetic fields. This change in magnetic flux is promptly detected by the FIs, triggering an alert mechanism that may display a mechanical flag or send an electronic signal to system operators. This rapid detection enables FIs to identify and accurately locate faults quickly, minimizing system downtime and enhancing overall reliability. While FIs are beneficial for their rapid detection capabilities and ease of integration, they provide only primary fault occurrence data and lack detailed diagnostics.

Given these limitations, alternative methods using FIs have been developed to improve fault location accuracy. One such method is illustrated in Figure 6, which demonstrates how FIs at multiple points within a network can infer the direction and location of a fault more precisely. Figure 6 depicts an FI at points A and B configured to detect downstream fault currents. In the event of a fault between points B and C, the FI at A and B will infer that the fault is in the downstream direction of point B. Conversely, if the fault occurs between points A and B, then the FI at B will not operate, indicating that the fault is in the upstream direction of point B.

More recently, bidirectional FIs have been used instead of traditional unidirectional FIs due to distributed power sources. This is illustrated by the grey circular dotted line in the figure. A fault between B and C will also generate a fault current from the power source to the fault point in a few situations. If the FI at point C cannot detect the downstream fault current, then the candidate fault location will be inferred to be between B and C or between C and the power source. However, if the FI at point C can detect the bidirectional fault current, then the fault location can be confirmed to be between B and C.

4. Current State of Power System Alarm Processing

This chapter reviews the power system alarm processing studies published to date according to three main classification criteria, as shown in Figure 7. The first classification is the type of input data used in alarm processing. This classification includes magnitudes of analog measurements, such as voltage and current; fault events that directly indicate the presence of a fault, such as fault indicators; and operational events in which a protective device, such as a relay or breaker, has been tripped. The second classification pertains to the purpose of alarm processing and is intended to identify the kind of information provided to the operator. The third classification is alarm processing modeling, which discusses the methodology used to process alarms.

4.1. Data Type for Alarm Processing

4.1.1. Analog Measurement

Analog measurements in a system include electrical information such as voltage, current, frequency, etc. These measurements can be utilized in various applications. For instance, voltage measurements at various points within a managed system can be used to assess the system’s overall state [39]. Additionally, three-phase voltage and current information can be employed to analyze system faults [40]. Furthermore, operational data from generators installed in the system can be used to model frequencies and transient frequency data for fault detection [41,42].

4.1.2. Fault Information

Fault information refers to any alarm event that directly indicates a fault. As described in Section 3.2.2, FI is effectively utilized for fault location estimation in distribution systems with radial topology because it detects fault currents in a set direction. However, recently, research has been conducted on fault location estimation using FI, which can detect bidirectional fault currents due to the distributed power sources installed in the distribution system [43,44]. In addition to FI, some studies have employed general fault information, which directly indicates the location of the fault on a specific line and substation, as exemplified by [45].

4.1.3. Protective Device Operation Information

In power systems, relays or circuit breakers are triggered by events such as short circuits and line breaks to protect electrical devices or minimize the impact of incidents. Multiple protective devices may act simultaneously in response to a single incident, and consideration of malfunctions or non-operation of these devices might leave operators with insufficient information for accurate situation assessment based solely on the operational alarms of protective devices. However, activating these protective devices provides direct clues that can be inferred about the incident, which is why most scholarly papers model the protective device operation scheme to construct all possible alarm scenarios for predictable incidents in advance. This approach primarily uses the operational information of protective devices for alarm processing [46,47]. System topology and protective coordination are commonly considered in modeling protective device operation schemes [48,49]. In this context, utilizing the time logs of the protective device operation data allows for verifying the sequence in which the devices were activated [50,51]. An alarm that occurs too late can thus be identified as unrelated to the incident.

4.2. Purpose of Alarm Processing

Alarm processing can be broadly categorized into two types. The first type, represented by arrow A in Figure 7, involves processing collected alarm data to extract, organize, and transform them into information necessary for system operators, a method known as alarm clearing. The second type, represented by arrow B, involves creating an inference model to gain insights into fault situations and perform cause analysis.

4.2.1. Alarm Cleaning

The primary objective of filtering is to reduce the volume of the large amounts of raw alarm data collected. The most straightforward filtering method is to provide the operator with the alarm information after removing specific alarms with a particular frequency [52]. In contrast to this static filtering approach, alarm filtering can also be performed based on simple predetermined rules [52]. For instance, if information indicates that a specific feeder is out of service, then all alarms can be removed [53]. Alternatively, a hierarchical alarm structure can be created in which less-critical child alarms are suppressed if a parent alarm is triggered [54]. In addition, scenario-based filtering using the inference model was also performed. It involved configuring a set of alarms likely to occur for all possible incidents in a given system in advance. Subsequently, alarms not existing in the alarm set were removed by comparing them with real-time alarms [55].

Alarm organization is a method of categorizing a large amount of collected data according to its purpose [56], which is the equivalent of structuring a large amount of raw alarm data from the grid by applying a method to classify it within the system according to the type of data collected. Another organizing method is to classify raw alarm data into sub-events [57]. For example, when system faults occur in succession, the SCADA stores all alarms caused by multiple faults without distinction. Even when the entire alarm data set is divided into time units by introducing a time window, multiple fault information can be included. Therefore, the alarm data are grouped based on specific device operation alarms, such as relay operation, to distinguish alarms corresponding to specific faults.

Alarm converting refers to the preprocessing steps that transform system-generated data into a format suitable for operator use. Typically, this involves handling alarm information presented in text form. Refs. [58,59] introduced a rule-based method for converting alarm messages in various formats into a standard format that can be utilized for processing. The text format collected from the system was converted into time, motion, device, measurement value, and other data types and utilized in specific algorithms. Ref. [45] utilized machine learning to convert critical variables required for alarm procedures from text information into vectors. The converted vectors were later used as input for machine learning and directly used for fault analysis.

The alarm visualization function is a tool that effectively displays alarm information along with the current acquired values. For instance, by displaying not only the measured voltage at a specific point during regular operation but also the average value of the voltage in the surrounding area and then highlighting the alarm information that is out of the limit value during an emergency, it is possible to provide the system status from a macro perspective as well as the grid status at a local location, thus assisting the system operator in making judgments [39]. Furthermore, methods for analyzing the system’s alarms and their causes and for monitoring the causal relationship in real-time have been presented [60,61], and methods for displaying power flow and voltage on a geographical map to assist system operators have been discussed [62,63].

4.2.2. Fault Analysis

Fault analysis is the process of determining the cause of a fault after fault recognition. The system supports system operation by providing this information to the operator. The primary objective of fault recognition is to provide a relatively simple form of fault information. The system information is used to determine whether a fault has occurred or not or to determine the type of fault [42,64,65]. Cause analysis, on the other hand, focuses on analyzing the specific cause of the failure. The general method of analyzing the cause of a fault is to group alarms that may occur in a specific fault in advance and to infer the cause by comparing the alarms that occurred with those that were pre-grouped [50,66]. As previously stated in Section 3.2, since the protection device operation information and FI alarms appear in response to a specific fault location, they can be used to determine the fault location by inferring the alarms that occurred in reverse. For this reason, most alarms employed for fault location determination comprise device behavior information and FI alarms [48,67,68].

Conversely, the operational status of the protective device employed as the foundation for fault analysis is of paramount importance. It is of the utmost significance to ascertain the malfunction of the protective device, as the malfunction can significantly compromise the quality of fault analysis. A malfunction of the protective device denotes that it has operated when it should not. In contrast, a failure of the protective device signifies that it has not operated when it should have. When a protective device fails, a backup protective device is triggered, and it is possible to identify the failed protective device from the protection cooperation information of the system. This is a result of the fault analysis process, and the grouped alarm information for the specific fault mentioned earlier can be used to determine which alarms have been silenced [43,67,69].

4.3. Inference Model for Alarm Processing

4.3.1. Knowledge-Based Modeling

Rule-based modeling configures alarm scenarios for grid faults as if…then conditions. For example, suppose a specific protective device behavior occurs. In that case, several conditional statements can be configured to diagnose the fault location or cause by stating that a fault has occurred at a certain point. This method has the advantage of being relatively straightforward to model, as it defines the relationship between alarms. Furthermore, it is relatively straightforward to modify when new rules arise or when rules need to be removed, which is an advantage in terms of maintainability [50,70]. Logic-based methods employ operations such as AND, OR, or other operations defined by the system designer to organize the relationship between multiple pieces of information in order to identify the cause or location of the fault [66,71,72]. The network method involves approaches that organize relationships between alarms based on the system developer’s predefined criteria. This method calculates the relationships among occurring alarms, particularly by using protective coordination [73,74,75], which essentially relies on topological knowledge of the system. Additionally, this approach includes considering the alarms’ temporal characteristics in order to enhance the relationship’s definition [51,76,77,78].

4.3.2. Optimization Method

Optimization is the method of finding the optimal solution to a problem with constraints. It solves the problem by finding the value that minimizes or maximizes the objective function without violating the constraints. Optimization for alarm processing typically uses an objective function with the form of Equation (2).

$$min\left|\widehat{A}\left(x\right)-A\right|+\eta$$

(2)

In the first term, $\widehat{A}\left(x\right)$ represents the expected set of alarms due to failure cause x, while A denotes the alarms that occurred. The objective function is the difference between the alarms expected to occur in a particular failure and those that occur. Deriving a solution that minimizes this objective function means identifying a cause that produces alarms similar to the expected alarms. The second term, $\eta$, is introduced to assess the solution’s reliability regarding the number of causes of failure and false alarms. Minimizing $\eta$ signifies the avoidance of deriving an indiscriminate failure cause x or over-assuming the malfunction situation of the system protection device. In other words, the first term can be minimized if the number of failure causes and protection device malfunctions is over-assumed. However, the reliability of the failure cause is reduced, so a term is added to prevent this. Modeling the $\widehat{A}\left(x\right)$ is essential for deriving failure causes using optimization methods. Various methods have been developed to identify the expected alarms by modeling the expected alarm set for the behavior of the protector [43,49,79,80,81] or by setting the expected state of the FI signal according to the fault location [44].

Without constraints, optimization methods based on unconstrained objective functions, such as Equation (2), are predominantly employed in meta-heuristic-based approaches. Given that the failure cause has been defined as a binary solution, optimization methods may utilize genetic algorithms [46,79,82], brainstorm optimization [80], or tabu search [81] to identify a solution.

Conversely, in the case of a constrained optimization method that leaves only $\eta$ in the objective function of expression x and reflects the expected alarm, such as $\widehat{A}\left(x\right)$, as a constraint, the typical method used when setting the alarm behavior according to the behavior of the protective device is expressed as the two inequalities of Equations (3) and (4) [44,48,57,67,83].

$$s+e\ge a$$

(3)

$$f+a\ge e$$

(4)

In this context, s represents a false alarm, e denotes a specific event, a signifies a specific alarm, f represents a non-functional alarm, and Equation (3) symbolizes a constraint stipulating that if a specific alarm occurs, a specific event or false alarm must occur. When a particular alarm occurs, and a becomes 1, the inequality expresses that a particular event must occur or a false alarm must exist. Equation (4) illustrates the relationship between a failure event, a specific alarm, and a false alarm. This relationship holds regardless of whether the specific alarm in question occurs. A similar approach is taken in the example above, where e is set to 1 in order to express that if a particular event occurs, some alarm must occur, or at least one of the alarm behaviors must be equal to 1. The above formula establishes the relationship between alarms and failure causes, reflecting a specific system environment. It defines the $\eta$ value of the objective function in Equation (2) as the number of e, s, and f.

Thus far, the methods can be considered models that only consider a preset sequence of actions when a specific alarm occurs. However, this has limitations in multi-fault situations. When the same alarm occurs coincidentally for different failure scenarios, it becomes impossible to determine the exact failure scenario. To address this, alarm occurrence time can be introduced as an additional approach [84]. When considering the expected alarm set, it is possible to reflect temporal characteristics by adding a constraint expression that considers the alarm as not occurring if the expected occurrence time is exceeded [85] or by introducing a penalty term in the objective function to increase the penalty value if the alarm occurs beyond the expected alarm occurrence time [84].

Conversely, the optimization application utilizing FI information is represented by the following Equation (5):

$$\widehat{F}=F_d^{ext}-F_u^{ext}.$$

(5)

The expected alarm of the specific FI is represented by the symbol F. The increasing introduction of distributed power sources in the distribution system has led to the requirement for bidirectional FIs, which differ from the traditional unidirectional downstream FIs. In a bidirectional FI, the bidirectional alarm is set to three values: 0, 1, and −1. These values represent no FI operation, fault current generation in the downstream direction, and fault generation in the upstream direction, respectively. $F_d^{ext}$ indicates the degree to which a specific FI causes a fault in a specific direction, while $F_u^{ext}$ indicates the degree to which it causes a fault in the opposite direction. Consequently, the calculation of $F_d^{ext}$ and $F_u^{ext}$ using system alarm information represents a pivotal approach to modeling the anticipated direction of FI [43,86]. In the event of a specific FI, a power source in the upstream direction and a fault will result in a heightened probability of the FI occurring in the downstream direction. In contrast, the presence of a power source in the downstream direction and the occurrence of a fault will result in a heightened probability of the FI occurring in the upstream direction.

4.3.3. Petrinet

Petrinet is an appropriate tool for modeling relationships between components that comprise asynchronous and concurrent systems. It has been employed to model power protection systems with multiple interacting components, such as protection relays and protection coordination [87,88,89]. Petrinet is comprised of two fundamental elements: places and transitions. Places represent the state of the system, while transitions represent events that result in changes to the system. The relationship between places and transitions is defined by an arc, which illustrates the transition of tokens (representing resources or activities) from places to transitions.

Figure 8 depicts a partial representation of a petrinet, which describes the simplest example of a petrinet that represents the failure of a particular line based on the behavior of a protective device. As a fundamental example, consider the case where a fault triggers a relay, which in turn triggers a CB. If a token exists at $p_2$, which is a place corresponding to a specific relay, and a failure at a specific location causes a token to be created at $p_1$, then at transition t, a token is created at $p_3$ because tokens exist at both input places. If this $p_3$ is set as a CB triggered by the relay, then the sequence of protector actions due to a fault can be modeled.

One possible application of this petrinet to a fault location method is assigning a fault cause corresponding to the last place in this petrinet. In a situation analogous to the one above, the behavior of a particular relay is set to generate a token in $p_2$, as illustrated in the accompanying figure. Then, a token in $p_1$ is generated when the CB behavior is confirmed. Since both $p_1$ and $p_2$ have a token at the input place, the transition condition is satisfied, and a token is created in $p_3$. By setting this $p_3$ as the fault of a specific location, a petrinet model can be created to diagnose which fault has occurred based on the alarms that occur [90].

The preceding example illustrates the use of deterministic modeling, which may be suitable for representing ideal protector behavior. However, it is not a valid model for abnormal alarms resulting from misoperation. To address the uncertainty associated with power system alarms, a fuzzy petrinet is employed, wherein tokens are assigned values, and transitions are used to derive the probability of failure [89,91,92]. In other words, by incorporating a fuzzy logic approach, the greater the number of alarms that align with the specified scenario, the higher the token value corresponding to the underlying cause of the failure. This allows for the determination of the cause of the failure.

4.3.4. Data-Based Modeling

Data-driven models are employed to train a model that can fulfill a specific function through data or to identify problematic situations in a system through data analysis techniques. Trained models are primarily utilized to represent systems with pronounced nonlinearity [93,94,95]. Given that the model’s internal parameters can reflect nonlinear states, it is possible to create complex models with high flexibility. One common application of this approach to alarm processing is to train a model from a set of inputs and outputs that take as input the alarm pattern that occurs and output the cause or location of the fault [96]. Additionally, Ref. [41] employs the active utilization of analog information from the power system to create a model that can mimic the system dynamics and be used for fault analysis. Conversely, a data analysis technique that only utilizes models employs principal component analysis (PCA) to derive the information necessary for fault recognition [42].

Table 1. Comprehensive classification of alarm processing features.

Method	Ref.	Data Type			Purpose
		Analog Measurement	Protection Operation	Fault Information	Alarm Cleaning	Fault Recognition	Fault Cause	Fail Device Determination
Knowledge	[39]	✔			✔
(Rule)	[40]	✔		✔			✔	✔
	[47,58,68,97,98,99,100,101]		✔				✔
	[50]		✔		✔		✔	✔
	[52]		✔		✔
	[54]	✔			✔
	[53,70]		✔		✔		✔
	[56]	✔	✔	✔	✔
	[102]		✔	✔			✔
	[103]		✔	✔	✔
	[104]		✔				✔	✔
Knowledge	[66]		✔				✔	✔
(Logic)	[71]	✔	✔				✔
	[72]		✔				✔
Knowledge	[51,59,73,74,75,77,78,105,106,107]		✔				✔
(Network)	[61]	✔		✔	✔		✔
	[69]		✔				✔	✔
	[108]	✔			✔		✔
Optimization	[43,44]			✔			✔	✔
	[46,76,79,81,109,110,111]		✔				✔
	[48,49,67,80]		✔				✔	✔
	[82]		✔	✔			✔
Petrinet	[87,88,89,112,113,114]		✔				✔
	[91]	✔	✔	✔			✔
Data	[41,64,65]	✔				✔
based	[42,115,116,117]	✔					✔
	[45]		✔	✔	✔	✔
	[67]		✔				✔	✔
	[75,96,118,119]		✔				✔
	[120]	✔	✔				✔
	[121]		✔	✔			✔
	[122]		✔			✔	✔
	[123]	✔				✔	✔

summarizes the categorization of all the papers referenced in the analysis, including the representative papers described thus far. Additionally,

Table 2. Comparison of alarm processing methods in power systems.

Method	Principles of Operation	Advantages	Limitations
Rule-based	Uses predefined conditional rules to filter and process alarms.	Simple to implement and modify; intuitive logic.	Limited to scenarios that fit defined rules; may not handle complex dependencies well.
Logic-based	Employs logical operations like AND and OR to define relationships between alarms.	More flexible in defining relationships; can handle more complex scenarios.	Requires precise logic definition; can become complex with many inputs.
Network-based	Analyzes network-like connections between alarms based on predefined criteria.	Useful for systems with interconnected alarms; can reveal deeper insights into alarm relationships.	Highly dependent on initial setup and predefined criteria; may miss nuances not directly modeled.
Optimization	Searches for an optimal solution that correlates known alarms to potential causes.	Can effectively reduce false alarms by focusing on the most likely scenarios.	Computationally intensive; requires accurate models and can be slow in large systems.
Petrinet	Models the sequence of events in alarm systems as states and transitions, where tokens move through places based on system events to simulate alarm scenarios.	Provides a structured way to simulate and analyze dynamic behaviors in alarm systems; good for capturing sequential and concurrent events.	Requires precise modeling of system behaviors and may become complex with large-scale systems; understanding and modifying Petrinets can be challenging without specific expertise.
Data-based	Utilizes machine learning and statistical methods to predict and analyze alarms.	Can adapt over time as more data are gathered; potentially very powerful for predictive maintenance.	Requires large data sets for training; effectiveness depends on data quality and may overfit.

comprehensively compares various alarm processing methods used in power systems. This comparison includes each method’s principles of operation, advantages, and limitations, offering a detailed overview of how these methods can be applied to enhance alarm management in complex power systems.

5. Discussion

This chapter examines the limitations of traditional alarm processing and considers future developments. To this end, the first and second generations of alarm processing are defined as past and present methods, respectively. Their characteristics and the reasons for their transitions are described, along with an examination of the future power system environment and the limitations of second-generation alarm processing. Finally, the potential developments in third-generation alarm processing are outlined.

5.1. First-Generation Alarm Processing

The operating environment of earlier power systems was less complex than today, and raw data generated by system events were used to provide organized and timely information [32]. First-generation alarm processing simply aimed to process information without needing complex calculations, and the results could be presented directly to the operator. Most of the methods classified as alarm cleaning in Section 4 fall into this type of alarm processing, which supports operator judgment by filtering, organizing, and transforming.

5.2. Transition to Second-Generation Alarm Processing

This first-generation approach has reached a tipping point with the modernization of power systems. The main changes brought about by modernization include an increase in the size and complexity of the system and a higher volume of information processing. As demand increased, more lines, generators, and power equipment were installed [124], and the introduction of advanced metering, cloud computing, and other computing technologies began to generate vast amounts of data [125]. First-generation alarm processing began to show its limitations in assisting operators under such conditions, and the need for what is known as intelligent alarm processing (IAP) began to emerge [32]. In particular, the large amounts of data typically generated during system failures expanded the scope of alarm processing to include aspects of what is known as fault diagnosis.

As shown in

Table 3. Different characteristics of alarm processing and fault diagnosis.

	Alarm Processing	Fault Diagnosis
Used data	All data from SCADA	Data for fault analysis
Purpose	Show global situation	Find cause of fault
Complexity	Low	High
Speed	Fast	Slow

, alarm processing and fault diagnosis have traditionally been distinguished as processes with different characteristics [126]. Alarm processing is undertaken to present a global situation using SCADA data, while fault diagnosis focuses on identifying the causes of faults using related information. However, the modernization of power systems has blurred the distinctions between the purposes and characteristics of these two processes. Ultimately, second-generation alarm processing has taken over the role of fault analysis by inferring the causes of faults. As evidence, the literature does not distinguish between the definitions of alarm processing and fault diagnosis, as confirmed in

Table 4. Descriptions of alarm processing and fault diagnosis in various papers.

Process	Description	Ref
Alarm Processing	One of the functions of alarm processing is the ability to diagnose the fault situation and give the location of the fault	[103]
	Identification of power system events (black areas, successful protection operation, etc.) from the incoming SCADA system data stream	[72]
	This system would present these results (fault diagnosis) in a manner that is easily and correctly understood by the operators without requiring complex operations	[97]
Fault Diagnosis	Derivation of causal roots (phase/earth faults on feeders, failed protection, etc.) of the events deduced by the alarm processor	[72]
	Fault diagnosis systems can be used to extract information for operators to make decisions in concise and objective way	[127]

.

In [103], alarm processing has been described as part of fault diagnosis in fault situations, identifying the location and cause of faults, and Ref. [127] has described fault diagnosis as one of the primary objectives of alarm processing, showing an apparent lack of distinction between the two functions. Ref. [72] has defined the functions of both processes as fault detection and protection device operation. In particular, Ref. [72] described alarm processing as a preprocessing step in fault diagnosis, positioning it as a dependent process. In contrast, Ref. [97] described it conversely as a process that presents results to the operator through the alarm processing system after fault diagnosis.

5.3. Second-Generation Alarm Processing

Second-generation alarm processing differs from first-generation in two points. The first point is that second-generation processing can internally infer information previously left to the operator in first-generation processing. Second-generation alarm processing has become more advanced by inferring new information about the cause of a fault from the data rather than simply processing it. The other is that second-generation alarm processing uses modeling of the power system situation to infer the causes of faults. This complex process of inferring fault causes models scenarios of power system behavior specific to particular faults, and fault analysis is performed through comparison with actual system alarms.

In summary, Figure 9 illustrates the roles of first-generation and second-generation alarm processing. First-generation alarm processing operated when system complexity was relatively low and the system was managed primarily based on operator judgment. In such an environment, although alarm processing did not require complex reasoning, it played an overall role in assisting the operator. However, with the transition to the second generation, alarm processing began to be used for fault diagnosis, making effective use of the areas that could be modeled within the power system domain.

5.4. Third-Generation Alarm Processing

In the future operating environment of power systems, where third-generation alarm processing will be used, the modeling domain mentioned in the second generation one will be further extended. Future power systems are expected to solve various problems through automated systems [128,129], and achieving such automation requires exact, detailed system modeling. For example, models that address various power system problems will be implemented, ranging from fault cause inference models based on the operational characteristics of specific faults, similar to second-generation alarm processing, to models that control system operations such as switch management and fault recovery. As multi-system models take over the management of many system problems, the scenarios requiring operator judgment are inevitably reduced. For example, if faults can be located and recovered automatically, there will be no need for operator intervention in these processes.

However, while the situations requiring judgment are reduced, operator intervention in unmodeled situations, i.e., rare and poorly understood conditions, remains essential [130]. The impact of power supply problems due to natural conditions in renewable energy sources or operational failures due to automated model errors represents a fundamental risk that automated systems cannot resolve. Therefore, the operator’s role still remains critical in future power systems [131,132,133]. While effective in providing information from modeled situations, second-generation alarm processing is limited in providing valuable information for rare events. Therefore, the next goal of third-generation alarm processing should be to focus on assisting operators with rare events.

Figure 10 illustrates the tasks that third-generation alarm processing should address in the system environment. In the future, the system situation will increase significantly in terms of the number of conditions that can be modeled. In such cases, alarm processing should provide information about the modeled areas and meaningful information to the system operator about situations that have not yet been modeled. Therefore, while focusing on assisting the operator like in the first generation, alarm processing should cover areas related to more infrequent events. Here, focusing on unsupervised machine learning methods such as anomaly detection is crucial.

5.4.1. Unsupervised Learning: Anomaly Detection

Although machine learning has been used in various cases in traditional alarm processing, this approach has its limitations due to the impossibility of modeling rare events [134,135,136]. The rare events that third-generation alarm processing seeks to address are inherently lacking in data, making it impossible to train a data-based model that reflects them.

When there are limitations in collecting data from fault conditions, an alternative is to use data from normal conditions. Anomaly detection in machine learning involves training a model on normal data and then detecting deviations when data that deviate from the typical situation are encountered. Training the model on data from the normal state of the power system and establishing a baseline for the normal state makes it possible to detect deviations when abnormal patterns occur in system failure situations. By continuously monitoring system performance in this way, the model can alert operators to anomalies before actual system failures occur, providing early warning of potential problems. Ultimately, the move away from supervised models that learn correct answers in traditional methods to unsupervised learning models capable of detecting abnormal situations is essential for future alarm processing methods.

When applying anomaly detection, two additional aspects need to be considered. First, the scalability of the model must be adequately addressed. Machine learning methods used in second-generation alarm processing typically set the output dimension to the number of fault causes and train the model based on system data corresponding to each fault cause. If new fault causes need to be included, new data corresponding to these faults must be acquired, and the model must be retrained. This leads to system application limitations when environmental conditions change, and the required output dimensions shift [137]. As the system frequently changes topology and integrates many distributed power sources, the output dimensions of the model must be capable of continuous adaptation. Therefore, models that can take full advantage of scalability, as used in other fields, should be used [138,139,140,141].

Second, machine learning models must be interpretable in order to justify judgments about anomalous situations. While the various parameters and structures of machine learning models are designed to solve non-linear problems effectively, the complexity of these structures can make the decision-making process more transparent. Typically, model effectiveness is verified by checking the appropriateness of the model outputs in test situations. However, this method has limitations, as it fails to ensure the reliability of the results [142,143]. An alarm processing result that cannot be trusted makes it difficult to justify its validity.

Therefore, the development of machine learning models for third-generation alarm processing should consider applying explainable AI (XAI) technologies to enable model interpretation. This allows operators to understand and trust the AI’s decision-making process, supporting more effective decision-making. Alarm processing systems developed with XAI technologies can present the reasoning behind each alarm, enabling operators to diagnose and respond to problems more accurately and quickly. Particularly in the complex fault situations that can occur in power systems, this will help assess the importance and priority of alarms, increase the efficiency of alarm processing, and improve the overall stability and reliability of the system.

5.4.2. Conceptual Framework of Third-Generation Alarm Processing

Figure 11 illustrates an example of the third-generation alarm processing method presented in this paper. It simplifies various measured values in the system into “value 1” and “value 2”, illustrating each corresponding data point in a scatter plot. Typically, the data collected within the system indicate normal conditions and thus comprise the majority of the data set. The data sets plotted in the bottom-left are associated with faults, where each value could potentially be labeled according to the fault location or cause. Conventional supervised modeling of this data set would form a solid black line to distinguish these conditions, and newly entered data depicted in red would be classified under the normal pattern.

However, this method is contingent upon the availability of sufficient fault data to ensure reliability. Without enough data, the data points marked in red may represent faults, which could give rise to significant operational issues. To address this, analyzing such data and their subsequent relabeling to indicate the specific faults allows for training a new model, which would then learn a new dotted boundary line. While this model-learning approach is suitable for the post-processing style of second-generation alarm processing, it carries the risk of misjudgment each time unlearned data occur.

In contrast, third-generation alarm processing exclusively compares newly occurring rare events with data representing normal conditions. To illustrate, consider a scenario in which data depicted in blue emerges. If the data deviate from the normal pattern, they would be recognized as such, and the degree of deviation would be provided to the operator. This redefines the challenge from merely deciding whether the data indicate a fault or normalcy to recognizing deviations from normalcy, thereby reducing the risk associated with judging unknown system states. By employing XAI technologies, this method of alarm processing not only identifies the input pattern as anomalous but also provides operators with insights into the why of this deviation from the normal state pattern and the extent to which specific values contribute to these discrepancies. This offers operators quantitative insights that assist them in making informed decisions.

6. Conclusions

This paper has reviewed alarm processing methods for handling fault alarms in electrical power systems. By analyzing existing research papers on alarm processing, the authors have evaluated the current state of research based on the types of data used, the objectives of alarm processing, and the methodologies employed. The authors also discussed the characteristics of past and modern alarm processing methods by defining three generations of alarm processing based on their objectives. Based on this discussion, the direction of third-generation alarm processing methods suitable for future power system environments has been addressed. While previous approaches have dealt with alarms based on understanding complex system situations, new alarm processing emphasizes providing operators with actionable information for rare events. The authors proposed using anomaly detection based on unsupervised learning to handle rare events. They emphasized the need to use scalable models and apply XAI methods to ensure both the scalability and reliability of the models.