# Clustering Analysis of Wind Turbine Alarm Sequences Based on Domain Knowledge-Fused Word2 vec
## 1 Introduction
### Fault Diagnosis Using Alarm Data  
Refs. [15; 16] respectively employed an artificial neural network and Apriori algorithms for mining alarm patterns. The research represents initial attempts, although the results are not very satisfactory. In [17], the Dempster-Shafer evidence theory was employed for analyzing wind turbine' alarms, aiming to achieve better performance in fault diagnosis. It relies on high-quality maintenance records. However, ensuring high-quality maintenance records in wind farms is challenging due to manual entry, which introduces significant uncertainties. The application of similarity analysis to compare alarm sequences has achieved relatively successful results, primarily due to the method's ease of understanding, implementation, and independence from data labels. The underlying concept of this method is that alarm sequences triggered by the same fault event in wind turbines exhibit a higher degree of similarity under different operational conditions. In [18], a method was proposed to extract feature vectors from alarm sequences, which were subjected to agglomerative clustering and density-based spatial clustering to group similar alarm sequences. The authors of Ref. [19] presented a wind turbine fault diagnosis method that employed the weighted Hamming distance to calculate the similarity of alarm lists. In [20], a Siamese convolutional neural network was designed to extract discriminative features of alarm sequences, and fault diagnosis was conducted based on the similarity scores derived from these features. When a fault occurs, multiple alarms are triggered within a short time. These alarms triggered by a fault event are usually referred to as an alarm sequence. When comparing these alarm sequences using similarity analysis methods for diagnosing wind turbine faults, the first issue to address is how to represent these individual alarms numerically. A common approach is to use binary vectors, as described in references [18; 19]. However, this method only considers whether alarms occur or not. In natural language processing, Word2 vec serves as a word embedding method to transform plain text words into real-valued vector representations, considering sequential and frequency relationships among words in sentences. Due to its numerical transformation and similarity relationship mining capabilities, Word2 vec has been applied for the analysis of alarms. In [21], Word2 vec was used for learning vector representations of alarms, followed by a long short-term memory used to predict potential alarms. Word2 vec was used to map alarms to corresponding vectors of real numbers, enabling representation of the degree of correlation between alarms in [22]. Based on the vector representations of individual alarms, the second issue to address lies in evaluating the distance between alarm sequences. Unsupervised clustering, as a mature data mining tool, has been widely applied in the research of comparing alarm sequences' similarity [18; 22]. It groups similar alarm patterns in alarm sequences into one cluster. The type of similarity used, also known as distance measure, is a crucial factor in clustering algorithms. When using binary vector representation for alarms, the distance of alarm sequences can be computed using either Euclidean distance or Hamming distance. When employing multi-dimensional vector representation for alarms using Word2 vec, the alarm sequence consists of multiple vectors forming a vector sequence. A commonly used approach involves computing the average of all alarm vectors in a sequence, followed by calculating the Euclidean distance between these average values. For the first issue, the application of Word2 vec in handling alarm data involves the process of simulating the semantic information presented in the context of the learning documents. While this approach effectively enhances the capability of mining similarity relationships among individual alarms, it fails to fuse the actual abnormal information represented by the alarm data during modeling.