Processing method and system for real-time sensing of network exception message of power switch

Abstract

The invention discloses a processing method and system for real-time sensing of a network anomaly message of a power switch. The method comprises the steps that a CPU configures an APPID needing to be recognized by an FPGA to the FPGA; the FPGA receives the message of each port of the switch, forwards the message to the switch chip, and forwards the message sent by the switch chip to each port at the same time; caching and analyzing the message received by each port by using a message caching branch and a message analysis branch; and sending the message with the abnormal information to the CPU, and sending a cache message corresponding to the abnormal information in the DDR to the CPU for storage and alarm. According to the method, the panorama of the fault message can be recorded in a targeted manner, the abnormal message brief report is clear and visual, the fault message record is comprehensive and detailed, and accident analysis can be greatly facilitated.

Description

Technical Field

[0001] The present invention belongs to the technical field of network message processing, and relates to a method and system for processing real-time perception of abnormal messages in a power switch network. Background Art

[0002] Digitalization in the power sector is advancing at a rapid pace, with Ethernet and switch technology at the core. Messages transmitted over the network are affected by various factors, leading to abnormalities such as frame loss and misordering. For example, unreasonable network planning; abnormal physical connections such as optical fibers and network cables; abnormal SFP optical transceivers; external interference or power failure on network equipment, etc.

[0003] The functions of various terminals such as protection automation are affected by these fault messages, which will produce various unexpected behaviors and may lead to serious accidents. Therefore, it is particularly important to improve the reliability of network transmission, improve the real-time monitoring, abnormal perception, and abnormal recording capabilities, and carry out effective accident countermeasures. Summary of the invention

[0004] In order to solve the deficiencies in the prior art, the present invention provides a method and system for real-time perception of abnormal messages in a power switch network. Based on the existing hardware conditions, real-time message analysis, monitoring and storage are completed through the cooperation of FPGA and CPU, and dynamic analysis and data storage of high-flow message anomalies are realized. By recording and analyzing abnormal messages and tracing back faults, the real-time situation of the network can be perceived, accident experience can be summarized, countermeasures can be added, and the recurrence of accidents can be avoided.

[0005] The present invention adopts the following technical solution.

[0006] A first aspect of the present invention provides a method for processing real-time perception of abnormal messages in a power switch network, comprising:

[0007] The CPU configures the APPID that the FPGA needs to identify to the FPGA;

[0008] After the FPGA aggregates the messages received by each port of the switch, it processes the messages in the following three branches:

[0009] The message forwarding branch uses the service message direct mode to verify the message and then forward it to the switching chip for processing and output. At the same time, it forwards the message sent by the switching chip to each port.

[0010] The message cache branch timestamps each message frame on a port basis, and then caches the timestamp, address, and message content together into the DDR.

[0011] The message analysis branch extracts message information through the DFED module, serializes the extracted information, and caches it according to the message timestamp and port number. The cached queue exit compares each newly cached message information with the APPID configured by the CPU, reads the information of the previous message cache of this APPID according to the matching entry number, and compares it with the newly cached message information to identify abnormal information;

[0012] The FPGA sends the abnormal information to the CPU, and at the same time sends the cache message corresponding to the abnormal information in the DDR to the CPU for storage and alarm.

[0013] Preferably, the CPU also configures the message information and abnormal message storage address that the FPGA needs to identify to the FPGA.

[0014] Preferably, the message forwarding branch performs CRC check on the message, first separates the data segment and the CRC check code from the received message, uses long division to check the data segment, compares the check result with the separated check code, and if the check passes, directly forwards it to the switching chip for processing and outputs the message, otherwise the message is discarded.

[0015] Preferably, for process layer messages, the DFED module identifies main features according to the 61850 protocol, extracts APPID and sampling value information for SV messages, and extracts APPID, status number and sequence number information for GOOSE messages.

[0016] Preferably, the identification abnormal information includes:

[0017] For SV messages, determine whether the sampling values ​​are continuous and whether the time difference exceeds the limit; for GOOSE messages, determine whether the status number and sequence number are reasonable and continuous, and whether the link is broken due to timeout; after judgment, use the newly cached message information to replace the information cached in the previous message, and send the abnormal information upward at the same time.

[0018] Preferably, the uploaded abnormal information includes the real-time detection results of frame loss of GOOSE and SV messages. The CPU sends the alarm to the network management system through the manufacturing message specification MMS, the substation secondary system communication message specification CMS, and the simple network management protocol SNMP. The alarm information includes GOOSE, SV frame loss time, port, direction, APPID, destination MAC, source MAC, and VLAN event information.

[0019] Preferably, the message cache branch uses 256 messages as a basic unit, and caches 4 basic units as one event cache space, wherein one event cache space is called one storage event.

[0020] The message cache branch caches SV messages and non-SV messages separately into the DDR.

[0021] Preferably, the event storage space address, storage event sequence number and event storage space basic unit sequence number are defined in advance in the DDR according to the port sequence number;

[0022] The message cache branch writes the timestamp, address and message content of the port input message into a corresponding event storage space in the DDR according to the port sequence number and its corresponding event storage space address. Once an exception occurs, the current basic unit sequence number is recorded, and the timestamp, address and message content of subsequent messages are continued to be written into this event storage space until the next basic unit is full or times out. The event sequence number + port sequence number + start time stamp + start address in the event are recorded and stored, and the Lock flag of this storage event is set;

[0023] The timestamp, address and message content of the newly input message are cyclically written into the next non-Lock event storage space until the exception is triggered again and the above operation is repeated.

[0024] Preferably, the message cache branch of the FPGA forwards the record information of the event storage space with the Lock mark to the DDR of the CPU until all the event storage spaces with the Lock mark are released. Each time the record information of an event storage space is forwarded, the corresponding Lock mark is cleared so that the corresponding event storage space can be used for subsequent message caching.

[0025] A second aspect of the present invention provides a processing system for real-time perception of abnormal messages in a power switch network, including a CPU and an FPGA;

[0026] The CPU is used to configure the APPID that the FPGA needs to identify to the FPGA;

[0027] The FPGA includes a message forwarding branch, a message buffering branch and a message analyzing branch;

[0028] The message forwarding branch is used to receive messages from each port of the switch and then directly forward them to the switching chip, while forwarding the messages sent by the switching chip to each port;

[0029] The message cache branch is used to timestamp each frame of the message received by each port, taking the port as the basic unit, and then cache the timestamp, address and message content into the DDR;

[0030] The message analysis branch is used to extract message information from messages received at each port through the DFED module, serialize the extracted information, and cache it according to the message timestamp and port number. The cached queue exit compares each newly cached message information with the APPID configured by the CPU, reads the message cache information of the previous APPID according to the matching entry number, and compares it with the newly cached message information to determine whether there is an abnormality;

[0031] The FPGA sends the abnormal information to the CPU, and at the same time sends the cache message corresponding to the abnormal information in the DDR to the CPU for storage and alarm.

[0032] Compared with the prior art, the beneficial effects of the present invention include at least:

[0033] The message cache branch and message analysis branch of the present invention realize the real-time recording and characteristic analysis of power system network messages, and fully consider the characteristics of digital substations, such as the sending characteristics of GOOSE that sends heartbeats regularly and sends position change information in bursts; the characteristics of SV messages that are sent regularly but with small sending intervals and large message volumes; and the characteristics of MMS messages that have ARP learning and point-to-point communication. Through the analysis of these characteristics, message analysis and abnormal message backtracking are directly realized through FPGA, replacing the wave recording device, simplifying the processing strategy compared to the traditional solution, saving the cost of using substation devices, and through the anticipation of long-term technological development, flexible adaptation to long-term technological development is considered from the architecture.

[0034] The message cache branch of the present invention stores abnormal data for a certain time window length. Through fault message backtracing, network abnormalities can be better studied and analyzed, and the goal of whole-station abnormality backtracing can be achieved. It also helps to discover network defects and processing hidden dangers of terminal equipment, thereby facilitating on-site problem location, greatly reducing labor input, and significantly improving economic benefits.

[0035] The message cache branch and the message analysis branch of the present invention realize abnormal message monitoring and recording under the high traffic and small cache conditions of the switch. They can cope with the high traffic operation conditions of the switch under the cost-controllable conditions of a small increase in the CPU processing load and limited requirements for FPGA logic storage resources, and realize efficient and low-cost real-time perception of network anomalies and rapid message transfer functions, thereby improving the ability to analyze network abnormal events. In addition, key information can be adapted to various application scenarios such as new energy by modifying the configuration file.

[0036] The message cache branch and message analysis branch of the present invention can realize real-time analysis of data flow and trigger abnormal message recording, realize real-time storage of abnormal messages of all ports under limited hardware resources, and completely solve the problem of offline fault backtracking analysis. The solution of the present invention greatly reduces the difficulty of locating problems during the operation and maintenance of power switches, and facilitates fault location and problem backtracking.

[0037] The present invention can realize pipeline synchronous processing of real-time perception of network abnormal messages, fully utilize the strong real-time processing characteristics of FPGA, use DFED with DDR multi-level cache to realize real-time analysis of abnormal message bypass, and synchronously record the real-time messages input by each port, and trigger message transfer in real time through the abnormality identified by DFED, thus realizing the real-time recording function of abnormal messages in situ. The present invention can record and trace abnormal messages of SV / GOOSE of power switch in a targeted manner, the abnormal message brief is clear and intuitive, and the fault message record is comprehensive and detailed, which can greatly facilitate accident analysis.

[0038] The message forwarding branch of the present invention performs CRC check on the message, firstly separates the data segment and the CRC check code from the received message, checks the data segment using long division, compares the check result with the received check code, and directly forwards it to the switching chip for processing and outputs the message if the check passes, otherwise the message is discarded. In this parallel monitoring process, all Layer 2 protocol error messages, such as overlong / undershort frames and CRC error frames, are identified and reported. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 The overall architecture diagram of the pipeline synchronous processing method for real-time perception of network abnormal messages;

[0040] Figure 2 This is the FPGA message processing block diagram;

[0041] Figure 3 This is the schematic diagram of DFED data fault detection;

[0042] Figure 4 This is the DFED data fault detection flow chart. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only embodiments of a part of the present invention, rather than all embodiments. Based on the spirit of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the protection scope of the present invention.

[0044] Embodiment 1 of the present invention provides a method for processing abnormal messages in a power switch network in real time perception. The power switch includes a CPU processor and an FPGA. The method combines the existing hardware solution with software innovation, and adopts the architecture of FPGA and CPU processor plus storage chip to solve the problem of monitoring and storing abnormal messages in the substation network message transmission process. The messages received by the switch port are converged to the FPGA and then enter three branches. Branch one verifies the message and then transfers it to the switching chip. Branch two is the message cache branch, which writes all messages to the DDR cache. Branch three is the message analysis branch, which identifies abnormal messages in the link and caches them. Figure 1 As shown, the specific steps include:

[0045] Step 1: The CPU processor is responsible for configuring the APPID that the FPGA needs to identify to the FPGA;

[0046] Further preferably, the CPU is responsible for unified configuration management, configuring the key information and abnormal message storage address that the FPGA needs to identify to the FPGA to meet the flexibility requirements; it is also responsible for receiving the abnormal message information identified by the FPGA, and obtaining the message information from the DDR and then transferring it. Among them, the abnormal message storage address is used for the FPGA to identify the abnormal message and needs to store it according to the abnormal message storage address configured by the CPU.

[0047] Step 2: The FPGA converges the messages received by each port of the switch (substation network station control layer, process layer switch) and performs three branch processing;

[0048] In the FPGA, the specific implementation process is as follows Figure 2 As shown, the service messages entering the power switch are mainly processed in parallel by FPGA into three branches: message forwarding, message storage and message analysis.

[0049] (1) The message forwarding branch adopts the service message direct pass mode. The FPGA receives messages from each port of the switch, performs only a preliminary check on the messages entering the switch, and then directly forwards them to the switching chip for processing. It is also responsible for sending messages forwarded by the switching chip to each port.

[0050] Further preferably, all messages input from the network ports are sent to the switching chip via the FPGA, and the FPGA adopts a direct forwarding mode without any active processing to avoid introducing human errors, and the introduced delay can be ignored.

[0051] After receiving the messages from each port of the switch, the FPGA also performs a preliminary check (CRC check). First, the data segment and CRC check code are separated from the received message, and the data segment is checked using long division. The check result is compared with the received check code. If the check passes, it is directly forwarded to the switch chip for processing and output. Otherwise, the message is discarded. In this parallel monitoring process, all Layer 2 protocol error messages, such as overlong / undershort frames and CRC error frames, will be identified and reported.

[0052] At the same time, the FPGA also draws out the following two branches for caching and analyzing the messages received from each port (referring to the network messages of all ports of the switch gathered to the FPGA for analysis and processing), realizing business message storage and analysis;

[0053] (2) The message cache branch stores incoming messages according to agreed rules:

[0054] The message cache uses the network port as the basic unit, timestamping each message frame, and then storing the timestamp, address, and message content in the DDR;

[0055] Further preferably, when writing DDR storage in the form of address, time stamp and network port number, in order to better study and analyze network anomalies and achieve the goal of whole-station anomaly backtracking, it is necessary to store the abnormal data for a certain time window length. By tracing back the fault message, it is also helpful to discover network defects of terminal equipment and deal with hidden dangers.

[0056] The basic unit of the message cache branch is 256 longest Ethernet messages, that is, 384k bytes, called a unit. Four basic units (i.e., 1024 messages, 1.5M bytes) are used as one event cache space, called a storage event. The four basic units can prevent the event from being lost or overwritten by messages, leaving a margin.

[0057] SV messages may affect the records of other message types, so the message cache branch stores SV messages and non-SV messages separately in DDR.

[0058] In DDR, according to the network port number, the address space, event and unit number are defined in advance. The network port input message is written into an event storage space in a loop. Once an exception occurs, the current unit number is recorded, and subsequent messages are written into this event space until the next unit is full or timeout occurs. The event number + network port + start time stamp (message sending and receiving time stamp, specifically, the first byte of the message received records the current time) + start address in the event is recorded, and the event is set to the "Lock" flag.

[0059] The new input message starts to be written into the next non-Lock event space allocated by the system in a loop until the exception is triggered again and the above operation is repeated. That is, repeat the above recording of the current basic unit number, continue to write the timestamp, address and message content of the subsequent message into this event storage space, until the next basic unit is full or timed out, record the storage event number + port number + start time stamp + start address in the event, and set the Lock flag of this storage event. The Lock event triggers the recording operation, and the FPGA forwards the recorded information of the Lock event space to the DDR of the CPU (the DDR independent partitions used by the message cache branches of the CPU and FPGA) until all Lock spaces are released. Each time an event space is read empty, the Lock flag of the event is cleared, and this event space can be used for subsequent message caches.

[0060] (3) The message analysis branch identifies the message characteristics entering the switch, obtains message type identification, port, time stamp, APPID and other information, analyzes and processes the collected data to identify and classify various abnormal behaviors. Once an abnormal message is found, it can be located, and the network port, original address, message type, time and other information can be sent to the substation maintenance background, and the information of each switch can be uniformly compared to locate the source of the problem and distinguish whether it is a simple transmission failure or a data source device failure.

[0061] In the FPGA parallel message analysis branch, the DFED (Data Flow Error Detection) module is used to extract key message information such as APPID, sampling value SmpCnt, status number StNum and sequence number SqNum, and then the extracted information is serialized and cached according to the message timestamp and network port number; for process layer messages, the DFED module will identify the main features according to the 61850 protocol, extract APPID and sampling value information for SV messages, and extract APPID, status number and sequence number information for GOOSE messages.

[0062] More preferably, specifically Figure 3 As shown, by identifying the message types of each network port, the key information of the SV / GOOSE message is extracted and it is determined whether the message is abnormal.

[0063] First, the CPU configures the APPID (up to 512 entries) that the FPGA needs to identify to the FPGA; in the workflow, each network port identifies its own message type in parallel, specifically:

[0064] For SV messages, FPGA extracts APPID and SmpCnt key information;

[0065] For GOOSE messages, FPGA extracts the key information of APPID, StNum, and SqNum, and enters them into the serial queue to be processed together with the port and receiving time stamp information in chronological order.

[0066] The cached queue exit compares each message information with the configured APPID, reads the key information of the previous message cache of this APPID according to the matching entry number, and compares it with the new message information to see if there is any abnormality;

[0067] Further preferably, the queue exit compares each message information with the APPID configured by the CPU at the same time. According to the matching entry number, the GOOSE message APPID range is 0x0000-0x3fff, and the SV message APPID range is 0x4000-0x7fff. For example, if the matching APPID is 0x001f, the key information of the message cache on the APPID is read and compared with the new message information to determine whether there is an abnormality.

[0068] The SV message determines whether SmpCnt is continuous and whether the time difference exceeds the limit (configurable);

[0069] The GOOSE message determines whether StNum and SqNum are reasonably continuous and whether the link is disconnected due to timeout;

[0070] After the judgment, the new message information is written into the cache to replace the original information (the new message replaces the old message); at the same time, the abnormal information is sent to the CPU for combined processing. The APPID comparison plus the message information comparison only takes less than 5 clocks and will not cause serial queue blocking.

[0071] Step 3: The FPGA synchronously sends the message with the abnormal information to the CPU, and at the same time sends the cache message corresponding to the abnormal information in the DDR to the CPU for storage.

[0072] Further preferably, the information sent by DFED includes the real-time detection results of frame loss of GOOSE and SV messages, and is sent to the network management system in the form of an alarm through MMS (Manufacture Message Specification), CMS (communication message specification) and SNMP (Simple Network Management Protocol). The alarm information includes GOOSE and SV frame loss alarm information, and the content should include key information such as time, port, direction, APPID, destination MAC, source MAC, VLAN, and events.

[0073] In summary, the specific logic implementation of the DFED module is as follows: Figure 4 As shown:

[0074] First, the input message is judged. If it is abnormal, it is directly discarded. If the message is normal, the message type is identified.

[0075] Then determine whether it is a SV (0x88BA) or GOOSE (0x88B8) message. If not, discard it. If it is a SV message, enter the SV message processing branch, extract the message port, time stamp, APPID and SmpCnt, and then serialize the extracted information in order;

[0076] Then it is compared with the configured APPID. If they do not match, it is discarded. Otherwise, it is compared with the previous frame message SmpCnt;

[0077] Determine whether SmpCnt is continuous and timed out. If there is no abnormality, discard it. Otherwise, output an abnormal alarm.

[0078] If it is detected that the message type is a GOOSE message, the GOOSE message processing branch is entered to extract the port, time stamp, APPID, ST (StNum) and SQ (SqNum) of the message, and the extracted information is serialized in sequence;

[0079] Then it is compared with the configured APPID. If they do not match, it is discarded. Otherwise, ST and SQ are compared with the previous frame message.

[0080] Then, it is judged whether the ST and SQ of the GOOSE message are reasonably continuous and whether the link is broken due to timeout. If there is no abnormality, it is discarded, otherwise an abnormal alarm is output.

[0081] Embodiment 2 of the present invention provides a processing system for real-time perception of abnormal messages in a power switch network, including a CPU and an FPGA;

[0082] The CPU is used to configure the APPID that the FPGA needs to identify to the FPGA;

[0083] The FPGA includes a message forwarding branch, a message buffering branch and a message analyzing branch;

[0084] The message forwarding branch is used to receive messages from each port of the switch and then directly forward them to the switching chip, while forwarding the messages sent by the switching chip to each port;

[0085] The message cache branch is used to timestamp each frame of the message received by each port, taking the port as the basic unit, and then cache the timestamp, address and message content into the DDR;

[0086] The message analysis branch is used to extract message information from messages received at each port through the DFED module, serialize the extracted information, and cache it according to the message timestamp and port number. The cached queue exit compares each newly cached message information with the APPID configured by the CPU, reads the message cache information of the previous APPID according to the matching entry number, and compares it with the newly cached message information to determine whether there is an abnormality;

[0087] The FPGA sends the message with abnormal information determined by the message analysis branch to the CPU, and at the same time sends the cache message corresponding to the abnormal information in the DDR to the CPU for storage and alarm.

[0088] Compared with the prior art, the beneficial effects of the present invention include at least:

[0089] The message cache branch and message analysis branch of the present invention realize the real-time recording and characteristic analysis of power system network messages, and fully consider the characteristics of digital substations, such as the sending characteristics of GOOSE that sends heartbeats regularly and sends position change information in bursts; the characteristics of SV messages that are sent regularly but with small sending intervals and large message volumes; and the characteristics of MMS messages that have ARP learning and point-to-point communication. Through the analysis of these characteristics, message analysis and abnormal message backtracking are directly realized through FPGA, replacing the wave recording device, simplifying the processing strategy compared to the traditional solution, saving the cost of using substation devices, and through the anticipation of long-term technological development, flexible adaptation to long-term technological development is considered from the architecture.

[0090] The message cache branch of the present invention stores abnormal data for a certain time window length. Through fault message backtracing, network abnormalities can be better studied and analyzed, and the goal of whole-station abnormality backtracing can be achieved. It also helps to discover network defects and processing hidden dangers of terminal equipment, thereby facilitating on-site problem location, greatly reducing labor input, and significantly improving economic benefits.

[0091] The message cache branch and the message analysis branch of the present invention realize abnormal message monitoring and recording under the high traffic and small cache conditions of the switch. They can cope with the high traffic operation conditions of the switch under the cost-controllable conditions of a small increase in the CPU processing load and limited requirements for FPGA logic storage resources, and realize efficient and low-cost real-time perception of network anomalies and rapid message transfer functions, thereby improving the ability to analyze network abnormal events. In addition, key information can be adapted to various application scenarios such as new energy by modifying the configuration file.

[0092] The message cache branch and message analysis branch of the present invention can realize real-time analysis of data flow and trigger abnormal message recording, realize real-time storage of abnormal messages of all ports under limited hardware resources, and completely solve the problem of offline fault backtracking analysis. The solution of the present invention greatly reduces the difficulty of locating problems during the operation and maintenance of power switches, and facilitates fault location and problem backtracking.

[0093] The present invention can realize pipeline synchronous processing of real-time perception of network abnormal messages, fully utilize the strong real-time processing characteristics of FPGA, use DFED with DDR multi-level cache to realize real-time analysis of abnormal message bypass, and synchronously record the real-time messages input by each port, and trigger message transfer in real time through the abnormality identified by DFED, thus realizing the real-time recording function of abnormal messages in situ. The present invention can record and trace abnormal messages of SV / GOOSE of power switch in a targeted manner, the abnormal message brief is clear and intuitive, and the fault message record is comprehensive and detailed, which can greatly facilitate accident analysis.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for real-time perception of abnormal messages in a power switch network, characterized in that: The method comprises: The CPU configures the APPID that the FPGA needs to identify to the FPGA; After the FPGA aggregates the messages received by each port of the switch, it processes the messages in the following three branches: The message forwarding branch uses the service message direct mode to verify the message and then forward it to the switching chip for processing and output. At the same time, it forwards the message sent by the switching chip to each port. The message cache branch timestamps each message frame on a port basis, and then caches the timestamp, address, and message content together into the DDR. The message analysis branch extracts message information through the DFED module, serializes the extracted information, and caches it according to the message timestamp and port number. The cached queue exit compares each newly cached message information with the APPID configured by the CPU, reads the information of the previous message cache of this APPID according to the matching entry number, and compares it with the newly cached message information to identify abnormal information; The FPGA sends the abnormal information to the CPU, and at the same time sends the cache message corresponding to the abnormal information in the DDR to the CPU for storage and alarm.

2. A method for processing real-time perception of abnormal messages in a power switch network according to claim 1, characterized in that: The CPU also configures the message information and abnormal message storage address that the FPGA needs to identify to the FPGA.

3. A method for processing real-time perception of abnormal messages in a power switch network according to claim 1, characterized in that: The message forwarding branch performs CRC check on the message. First, the data segment and the CRC check code are separated from the received message, the data segment is checked using long division, and the check result is compared with the separated check code. If the check passes, it is directly forwarded to the switching chip for processing and the message is output. Otherwise, the message is discarded.

4. A method for processing real-time perception of abnormal messages in a power switch network according to claim 1, characterized in that: For process layer messages, the DFED module identifies the main features according to the 61850 protocol, extracts APPID and sampling value information for SV messages, and extracts APPID, status number and sequence number information for GOOSE messages.

5. A method for processing real-time perception of abnormal messages in a power switch network according to claim 4, characterized in that: The identified abnormal information includes: For SV messages, determine whether the sampling values ​​are continuous and whether the time difference exceeds the limit; for GOOSE messages, determine whether the status number and sequence number are reasonable and continuous, and whether the link is broken due to timeout; after judgment, use the newly cached message information to replace the information cached in the previous message, and send the abnormal information upward at the same time.

6. A method for processing real-time perception of abnormal messages in a power switch network according to claim 5, characterized in that: The abnormal information sent includes the real-time detection results of frame loss of GOOSE and SV messages. The CPU sends the alarm to the network management system through the manufacturing message specification MMS, the substation secondary system communication message specification CMS, and the simple network management protocol SNMP. The alarm information includes GOOSE, SV frame loss time, port, direction, APPID, destination MAC, source MAC, and VLAN event information.

7. A method for processing real-time perception of abnormal messages in a power switch network according to claim 1, characterized in that: The message cache branch takes 256 messages as a basic unit, and caches 4 basic units as one event cache space, wherein one event cache space is called one storage event. The message cache branch caches SV messages and non-SV messages separately into the DDR.

8. A method for processing real-time perception of abnormal messages in a power switch network according to claim 7, characterized in that: The event storage space address, storage event sequence number and event storage space basic unit sequence number are defined in advance in the DDR according to the port sequence number; The message cache branch writes the timestamp, address and message content of the port input message into a corresponding event storage space in the DDR according to the port sequence number and its corresponding event storage space address. Once an exception occurs, the current basic unit sequence number is recorded, and the timestamp, address and message content of subsequent messages are continued to be written into this event storage space until the next basic unit is full or times out. The event sequence number + port sequence number + start time stamp + start address in the event are recorded and stored, and the Lock flag of this storage event is set; The timestamp, address and message content of the newly input message are cyclically written into the next non-Lock event storage space until the exception is triggered again and the above operation is repeated.

9. A method for processing real-time perception of abnormal messages in a power switch network according to claim 8, characterized in that: The message cache branch of the FPGA forwards the record information of the event storage space with the Lock mark to the DDR of the CPU until all the event storage spaces with the Lock mark are released. Each time the record information of an event storage space is forwarded, the corresponding Lock mark is cleared so that the corresponding event storage space can be used for subsequent message cache.

10. A real-time perception and processing system for abnormal messages in a power switch network, characterized in that: Including CPU and FPGA; The CPU is used to configure the APPID that the FPGA needs to identify to the FPGA; The FPGA includes a message forwarding branch, a message buffering branch and a message analyzing branch; The message forwarding branch is used to receive messages from each port of the switch and then directly forward them to the switching chip, while forwarding the messages sent by the switching chip to each port; The message cache branch is used to timestamp each frame of the message received by each port, taking the port as the basic unit, and then cache the timestamp, address and message content into the DDR; The message analysis branch is used to extract message information from messages received at each port through the DFED module, serialize the extracted information, and cache it according to the message timestamp and port number. The cached queue exit compares each newly cached message information with the APPID configured by the CPU, reads the message cache information of the previous APPID according to the matching entry number, and compares it with the newly cached message information to determine whether there is an abnormality; The FPGA sends the abnormal information to the CPU, and at the same time sends the cache message corresponding to the abnormal information in the DDR to the CPU for storage and alarm.

Images