A self-correcting method for acquisition execution unit device

Abstract

The present invention discloses a self-correction method for collecting execution unit devices, wherein the messages sent by the line protection device and the component protection device are respectively input into the first CPU plug-in and the second CPU plug-in; the messages in each plug-in output the messages containing Ethernet CRC via the MAC of Ethernet, and the messages are respectively transmitted to N submodules of FPGA; each submodule first adds the checksum containing Ethernet CRC to the message, performs CRC check on the message, and transmits the message that passes the check to the core corresponding to the MCU; each core performs checksum check and analysis on the message, and then performs startup and exit logic operations to generate startup state and exit state messages respectively; the N-to-two modules respectively obtain the messages output by each core, determine the final startup state and exit state, and respectively control the startup relay of the DI plug-in and the exit relay of the DO plug-in. The present application can avoid unplanned shutdown of power equipment.

Description

Technical Field

[0001] The invention belongs to the technical field of relay protection and relates to a self-correcting method for a collection execution unit device. Background Art

[0002] The collection and execution unit device is a collection and control unit for the interval layer and station control layer equipment of the digital substation. It collects the voltage and current AC signals of the substation transmission line or transformer and converts them into SV messages. It collects the transmission line or transformer remote signal and converts it into GOOSE messages, and transmits these two messages to the protection device through the optical fiber Ethernet. After receiving these real-time message information, the protection device makes a fault judgment. If it is determined that a system fault has occurred, the protection device sends a tripping GOOSE command to the collection and execution unit device through the optical fiber Ethernet. After receiving the tripping GOOSE command, the collection and execution unit device controls the tripping of the circuit breaker in this interval by closing the relay, quickly cutting off the fault point, and isolating the fault point from the power system to avoid affecting the safe operation of the entire power system. The logic diagram of this process is shown in the figure below. Figure 1 shown.

[0003] The correctness of the circuit breaker control by the data acquisition and execution unit is very important. Once it refuses to operate, the accident will be amplified. In serious cases, it will cause the entire substation to lose pressure. Once it malfunctions, it will mistakenly cut off the normally operating equipment. Both of these situations will cause huge economic losses. If the data acquisition and execution unit is abnormal, causing the data acquisition and execution unit to exit operation, all the protection devices of the data acquisition and execution unit will be forced to exit. According to the operating procedures of the power system, once the protection device exits, the protected equipment (transformer or line) needs to be shut down, resulting in unplanned shutdown of the power equipment, which will cause very large economic losses. At the same time, the data acquisition device is not allowed to restart. It takes about 5 to 10 seconds for the current data acquisition and execution unit to restart to receive the GOOSE message. The power equipment loses its protection function within 5 to 10 seconds. Once a fault occurs during this period, it will cause a larger power outage.

[0004] Since the substation data collection and execution unit is configured in intervals, DI plug-ins are generally used to collect telemetering quantities, and DO plug-ins are used to control relay outputs. The internal connection diagram of the data collection and execution unit is as follows: Figure 2 As shown, the internal block diagram of the main CPU plug-in is as follows Figure 3As shown in the figure, its operation logic is: protection device-protection action signal -> optical fiber -> photoelectric converter -> FPGA MAC. FPGA receives the GOOSE message of the protection action and sends it to MCU. MCU parses the GOOSE message. If the GOOSE message is a trip message, it sends a closing start relay command to the DI plug-in through the CAN network to provide 24V to the trip relay coil, and sends a closing trip relay command to the DO plug-in to provide the ground potential to the trip relay. The trip relay node is closed, triggering the circuit breaker to trip.

[0005] The data collection and execution unit has been in operation for 12 years since the State Grid started the intelligent substation transformation in 2010. The following defects exist in the operation process:

[0006] Defect 1: GOOSE messages are received via Ethernet. Since Ethernet messages carry CRC checksum, the checksum is usually performed on the Ethernet MAC. After the checksum passes, the FPGA module reads the GOOSE message from the MAC and transmits it to the MCU, which parses the message. The MCU does not have the conditions to verify the message, and the GOOSE message is easily tampered with during the data transmission process. In addition, the FPGA module program is stored in RAM and will be affected by SEU, causing the FPGA program area to flip and the program to be tampered with. The GOOSE message may also be tampered with. The MCU receives an incorrect GOOSE message, which causes the MCU to misjudge and send an incorrect command to the DO plug-in to trip the circuit breaker.

[0007] Defect 2: Since the MCU program is stored in RAM, it will also be affected by SEU, causing the MCU program area to flip and the program to be tampered with, which will lead to the following abnormal phenomena: (1) Errors in parsing the GOOSE message status may cause the circuit breaker trip command to be mistakenly sent to the DO plug-in, which may cause false operation; (2) Errors in parsing the GOOSE message format may cause the GOOSE message to be directly discarded, resulting in refusal to operate.

[0008] Defect 3: Since the FPGA program is also running in RAM, once the FPGA receiving program is affected by the SEU memory flip, the FPGA program will fail, which will also cause the GOOSE message received by Ethernet to be abnormal. When the MCU receives the abnormal GOOSE message, there is a risk of sending an erroneous command to trip the circuit breaker directly to the DO plug-in.

[0009] Defect 4: Since the device uses a single CPU plug-in, once the CPU plug-in hardware is abnormal, it will not be able to receive the protection trip GOOSE message, and all related protections will not be able to be exported. Since most substations are unattended now, it takes several hours or more to maintain the device, which will cause the power equipment to be in an unprotected state for a long time. Once a fault occurs at this time, it will cause a jump trip, resulting in a larger-scale power outage.

[0010] Each of the above defects will result in the inability to reliably execute GOOSE commands for all different protection functions, resulting in abnormal behavior of all protection devices. After years of operation, the existing acquisition and execution unit device has taken different countermeasures for the above defects on the basis of continuous improvement. For defects 1-3, the general practice is to use real-time CRC verification for the program area and important constant setting area, and automatically restart the software once the verification is abnormal. However, since the program RAM area is relatively large, the CRC verification requires MCU resources and time. During the period from the memory flip causing the program to fail to the detection of the CRC error, the acquisition and execution unit device will still output abnormal output. At the same time, it takes 3 to 5 seconds to restart the acquisition and execution unit device to receive the GOOSE tripping message, causing the protected power equipment to lose protection during the restart of the acquisition and execution unit device. Summary of the invention

[0011] In order to solve the deficiencies in the prior art, the present invention provides a self-correcting method for an acquisition execution unit device. FPGA reads the GOOSE message from the MAC, immediately adds a checksum to the GOOSE message (the checksum includes the CRC of Ethernet), and then performs a CRC check on the GOOSE message. If the CRC check of Ethernet is correct, the checksum calculated previously is correct. Since the CRC check takes a lot of MCU time, and the FPGA can quickly perform a CRC check, since the checksum and the CRC check have an intersection, the MCU only needs to check the checksum after receiving the GOOSE message, which saves the time for the MCU to process and check the correctness of the message; the principle of N taking two is adopted to eliminate the wrong tripping message, and even if one core program fails, the correct tripping message can be sent, so as not to lose protection in a short time. At the same time, once a core with a failed program is found, it can be restarted immediately to resume normal operation, and the GOOSE message can be received normally during the restart period; unplanned shutdown of power equipment can be avoided.

[0012] In order to achieve the above object, the present invention adopts the following technical solution:

[0013] A self-correction method for a collection execution unit device, implemented based on a self-correction system, characterized in that:

[0014] The self-correcting method comprises the following steps:

[0015] Step 1, the GOOSE messages sent by the line protection device and the component protection device are respectively input into the first CPU plug-in and the second CPU plug-in, and the first CPU plug-in and the second CPU plug-in run independently;

[0016] Step 2, in each CPU plug-in, the GOOSE message outputs the GOOSE message containing Ethernet CRC via the Ethernet MAC, and the message is transmitted to the N sub-modules of the FPGA through N independent transmission paths;

[0017] Step 3, each submodule of the FPGA first adds a checksum including Ethernet CRC to the GOOSE message, then performs CRC check on the GOOSE message, and transmits the GOOSE message that passes the check to the core of the MCU corresponding to the submodule;

[0018] Step 4, each core of the MCU first performs verification and analysis on the GOOSE message, and then performs startup and exit logic operations, and finally generates startup status and exit status messages respectively;

[0019] Step 5: The N-out-of-two module obtains the startup status and exit status messages of the N core outputs of the MCU respectively, determines the final startup status and exit status according to the N-out-of-two principle, and controls the startup relay of the DI plug-in and the exit relay of the DO plug-in respectively.

[0020] The present invention further includes the following preferred embodiments:

[0021] Preferably, the self-correcting system comprises a first CPU plug-in, a second CPU plug-in, a DI plug-in and a DO plug-in;

[0022] The first CPU plug-in and the second CPU plug-in control the start relay of the DI plug-in and the output relay of the DO plug-in respectively;

[0023] The first CPU plug-in and the second CPU plug-in adopt the same self-error correction structure;

[0024] The self-correcting structure includes an Ethernet port, an FPGA, an MCU and an N-to-two module;

[0025] Among them, the FPGA has N sub-modules, and the MCU has N cores;

[0026] The Ethernet port receives the GOOSE message of the protection device, and its output is respectively input into the N sub-modules of the FPGA, and the outputs of the N sub-modules of the FPGA are respectively input into the N cores of the MCU;

[0027] The outputs of the N cores of the MCU are all input to the N-to-two module, and the outputs of the N-to-two module are respectively input to the DI plug-in and the DO plug-in.

[0028] Preferably, the first CPU plug-in and the second CPU plug-in receive GOOSE messages sent by the line protection device and the component protection device respectively;

[0029] The first CPU card and the second CPU card control the start relay of the DI card and the output relay of the DO card respectively through the internal CAN network;

[0030] Each core of the MCU uses two different modules, startup and exit, to parse the GOOSE message, perform their own startup and exit logic operations, and output startup status and exit status messages;

[0031] The N-to-two module is an N-to-two module of a CPLD;

[0032] N is an integer greater than or equal to 3.

[0033] Preferably, each submodule of the FPGA uses the same logic and program, but different submodules are distributed in different address areas;

[0034] Each core of the MCU uses the same logic and program, but different cores are distributed in different address areas.

[0035] Preferably, in step 4, the process of checking and parsing the GOOSE message by the MCU includes:

[0036] Step 4.1: Check the checksum of the GOOSE message. If it passes, go to step 4.2, otherwise discard it;

[0037] Step 4.2: The startup module and the exit module of the MCU core parse the GOOSE message respectively at the same time;

[0038] Among them, the start module combines the start real-time database to perform logic judgment on the start relay. If it is judged that the state of the start relay has changed, the CAN network message of the start relay is organized and the start CAN network message is sent to the N-to-two module. Otherwise, the parsing process is re-executed after the next GOOSE message arrives.

[0039] Among them, the export module combines the export real-time database to perform export relay logic judgment. If it is determined that the state of the export relay has changed, the CAN network message of the export relay is organized and the export CAN network message is sent to the N-to-two module. Otherwise, wait for the next GOOSE message to arrive and re-execute the verification and parsing process.

[0040] Preferably, each core of the MCU has program self-checking, fixed value and constant area self-checking, and hardware self-checking functions. Once the self-check is abnormal, the core is restarted, and if the logical state of any core is inconsistent with the state of other cores, the inconsistent core is restarted.

[0041] Preferably, in step 5, the N-to-two module first determines whether the message CRC check is correct, and discards it if it is incorrect, and screens valid and latest messages if it is correct;

[0042] Take the startup status and exit status messages of the latest valid message of each core and compare them respectively. If the status of two or more cores are consistent, if it is a startup status message, send a 24V power supply status message of the control relay coil to DI. If it is an exit status message, DO sends a ground power supply status message of the control relay coil.

[0043] Preferably, in the N-out-of-two module, the survival time of each received message frame is counted independently. Once the survival time exceeds the set time, the message is set as an invalid message and no longer participates in the N-out-of-two logic judgment of the control relay.

[0044] Preferably, in the N-to-two module, if the number of message frames received from the same core controlling the same relay reaches 2 or more within a set time, the previous messages are discarded and the latest message is taken.

[0045] Preferably, in step 5, the DI plug-in and the DO plug-in adopt an OR logic mode, that is, if any one of the DI plug-in and the DO plug-in is logically 1, the export relay node is closed, and when both are 0, the export relay node is retracted to realize the export relay control.

[0046] The beneficial effects of the present invention are as follows:

[0047] (1) The received GOOSE message is divided into three independent transmission paths from the Ethernet MAC output and sent to three cores for separate processing;

[0048] Since the FPGA program runs in RAM, SEU memory flip causes FPGA program failure. However, the address is random. After being output from Ethernet MAC, it is input into three independent FPGA sub-modules. The logic and program of the three sub-modules are exactly the same, but they are distributed in different address areas. When the FPGA program fails, it is impossible for an error to occur at the same logical position in three different areas. The results processed by the three sub-modules are respectively given to the three MCU cores for GOOSE message parsing. Similarly, the MCU program and real-time data are also in RAM. There is also the problem of SEU memory flip causing MCU program and data failure. It is impossible for the three cores to have the same failure problem. Using (1) can effectively prevent the possibility of program failure due to SEU memory flip, which may cause the output to fail or malfunction.

[0049] (2) When the FPGA submodule reads the message output by the MAC, the message contains the Ethernet's own CRC. The FPGA first calculates the checksum of the entire frame message including the CRC, and then performs a CRC check on the entire frame message. If it is correct, the entire frame message is sent to each core;

[0050] Since it takes a lot of time to calculate CRC using C language, each core only performs checksum judgment. Since the checksum and CRC check have intersections, if an error occurs before the FPGA's CRC check, it will be detected by the FPGA. If an error occurs before the FPGA's CRC check and before the core performs the checksum before decryption, it will be detected by the core. This method does not have a dead zone for detecting the correctness of the message.

[0051] (3) Each core is divided into two different program modules, startup and exit, to parse the GOOSE message, perform logical operations respectively, and output the startup status and exit status messages according to their respective logical structures to control the startup relay and exit relay respectively;

[0052] Since two different MCU function plug-ins are used to control the ground and power supply 24V of the output relay coil voltage respectively, after each core receives the GOOSE message, it is divided into two different program areas to complete their respective functions;

[0053] The startup program completes parsing of the GOOSE message, starts the logic, organizes the control of the start relay CAN network message to send the control start relay message to the N-to-two module of the CPLD; the action program completes parsing of the GOOSE message, exits the logic, organizes the control of the action relay CAN network message to send the control corresponding action relay message to the N-to-two module of the CPLD;

[0054] Although the functions completed are similar and a common subroutine can be used, in order to prevent the same problem from occurring due to failure of the common subroutine, which would result in simultaneous activation of startup and exit, this application uses completely independent program segments so that the two functional program segments have no intersection.

[0055] (4) The N-out-of-two module of the CPLD obtains the startup status and exit status messages of the three cores, and adopts the N-out-of-two principle to control the startup relay and the exit relay respectively;

[0056] The contact of the start relay controls the 24V power supply of the output relay. Since the source of GOOSE reception is Ethernet, which is the same, the FPGA processing speed is very fast. The three cores obtain the GOOSE messages to be processed almost at the same time. In order to ensure the correctness and speed of the CPLD N-to-two logic, the following measures are taken:

[0057] 1) Each message contains a CRC check. The CPLD first determines whether the CRC check is correct. If it is not correct, it will be discarded;

[0058] In order to ensure the timeliness of each core, the reception of GOOSE messages, processing of GOOSE messages, startup logic, and export logic are all processed in the 500us interrupt. The three cores are independent of each other. The earliest and latest difference between the actions of the three cores sensed by the CPLD will not exceed the set time of 3ms. The CPLD has an independent survival time count for each frame of action message. Once the survival time exceeds 3ms, the message is set to an invalid message and no longer participates in the control relay N-to-two logic judgment;

[0059] 2) If two or more messages from the same core controlling the same relay are received within 3ms, the previous messages are discarded and the latest message is used;

[0060] 3) Take the export status of the latest valid message of each core for comparison. If the status of two or more cores is consistent, send the control relay coil 24V power supply status message to DI, or send the control relay coil power supply ground status message to DO;

[0061] 4) Since there are three cores running the same logical function, this device adopts the N-out-of-two solution. The restart or abnormality of any core will not affect the action logic of the entire device. Each core of this device has program self-check, fixed value and constant area self-check, and hardware self-check functions. Once the self-check is abnormal, the core will automatically restart. If the logical state of any core is inconsistent with the state of other cores, try to restart the core first;

[0062] Although the prior art takes measures to prevent the failure of the program due to memory flipping, it generally detects whether the checksum of the program area and the important data area is correct, and restarts if it is not correct. After the above-mentioned N-to-two scheme is adopted, the present application enables the device to start from reading the GOOSE message from the Ethernet port, and monitor the whole process. If any of the three sets of processes is abnormal, it can realize the abnormal local automatic restart, and the normal export logic of the device is not affected during the restart process. If it is restored, it will run normally. If it is not restored, it can alarm and notify the on-site operation personnel to come for maintenance.

[0063] (5) A dual CPU plug-in is used to receive the GOOSE messages of busbar protection and interval protection and connect them to their respective CPU plug-ins. The two plug-ins are independent of each other and can control the start relay of the DI plug-in and the output relay of the DO plug-in separately through the internal CAN network. The output relay control is realized by adopting the OR logic mode of the DI plug-in and the DO plug-in (when any one of the two plug-ins is logically 1, the relay node is closed, and when both are 0, the relay node is retracted). Once any CPU plug-in is abnormal (the plug-in can be locked through the N-to-two logic), the other CPU plug-in can operate normally. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1A process logic diagram for isolating fault points for acquisition execution unit devices;

[0065] Figure 2 To collect the internal connection diagram of the execution unit device;

[0066] Figure 3 It is an internal block diagram of the main CPU plug-in of the acquisition execution unit device;

[0067] Figure 4 It is a principle diagram of the self-correction system for the acquisition execution unit device of the present invention;

[0068] Figure 5 The present invention is a process in which the MCU checks and analyzes the GOOSE message. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the scope of protection of the present invention.

[0070] like Figure 4 As shown, embodiment 1 of the present invention provides a self-correction method for a collection execution unit device, which is implemented based on a self-correction system. In a preferred but non-limiting embodiment of the present invention, the self-correction system includes a first CPU plug-in, a second CPU plug-in, a DI plug-in, and a DO plug-in;

[0071] The first CPU plug-in and the second CPU plug-in control the start relay of the DI plug-in and the output relay of the DO plug-in respectively;

[0072] The first CPU plug-in and the second CPU plug-in adopt the same self-error correction structure;

[0073] Further preferably, the first CPU plug-in and the second CPU plug-in receive GOOSE messages sent by the line protection device and the component protection device respectively;

[0074] The first CPU card and the second CPU card control the start relay of the DI card and the output relay of the DO card respectively through the internal CAN network;

[0075] The self-correcting structure includes an Ethernet port, an FPGA, an MCU and an N-to-two module;

[0076] Among them, the FPGA has N sub-modules, and the MCU has N cores;

[0077] The Ethernet port receives the GOOSE message of the protection device, and its output is respectively input into the N sub-modules of the FPGA, and the outputs of the N sub-modules of the FPGA are respectively input into the N cores of the MCU;

[0078] The outputs of the N cores of the MCU are all input to the N-to-two module, and the outputs of the N-to-two module are respectively input to the DI plug-in and the DO plug-in.

[0079] Further preferably, each core of the MCU adopts two different modules, startup and export, to parse the GOOSE message respectively, perform respective startup and export logic operations, and output startup status and export status messages;

[0080] N is an integer greater than or equal to 3;

[0081] The N-to-2 module is an N-to-2 module of CPLD.

[0082] like Figure 5 As shown, a self-correction method for a collection execution unit device specifically includes the following steps 1-5:

[0083] Step 1, the GOOSE messages sent by the line protection device and the component protection device are respectively input into the first CPU plug-in and the second CPU plug-in, and the first CPU plug-in and the second CPU plug-in run independently;

[0084] Step 2, in each CPU plug-in, the GOOSE message outputs the GOOSE message containing Ethernet CRC via the Ethernet MAC, and the message is transmitted to the N sub-modules of the FPGA through N independent transmission paths;

[0085] Step 3, each submodule of the FPGA first adds a checksum including Ethernet CRC to the GOOSE message, then performs CRC check on the GOOSE message, and transmits the GOOSE message that passes the check to the core of the MCU corresponding to the submodule;

[0086] The specific verification process is: starting from the first byte of the message to the end of the message (excluding the CRC code value), the CRC code value is calculated through the CRC verification formula, and compared with the CRC code value in the message (generally placed in the last 2 bytes of the message). If they are equal, it means that there is no bit error in the transmission process of the message, indicating that the verification has passed.

[0087] Further preferably, each submodule of the FPGA uses the same logic and program, but different submodules are distributed in different address areas;

[0088] Step 4, each core of the MCU first performs verification and analysis on the GOOSE message, and then performs startup and exit logic operations, and finally generates startup status and exit status messages respectively;

[0089] Further preferably, each core of the MCU adopts the same logic and program, but different cores are distributed in different address areas.

[0090] like Figure 5 As shown in the figure, the process of MCU checking and parsing the GOOSE message includes:

[0091] Step 4.1: Check the checksum of the GOOSE message. If it passes, go to step 4.2. Otherwise, discard it. If 10 frames are discarded continuously, it means that there is a problem with the hardware, and an alarm is issued at this time.

[0092] The verification process is as follows: starting from the first byte of the message to the end of the message (excluding the checksum code value), the cumulative code value is calculated through the cumulative checksum calculation formula, and compared with the checksum code value in the message (generally placed in the last 2 bytes of the message). If they are equal, it means that no bit errors occurred during the transmission of the message, indicating that the verification has passed.

[0093] Step 4.2: The startup module and the exit module of the MCU core parse the GOOSE message respectively at the same time;

[0094] Among them, the start module combines the start real-time database to perform logic judgment on the start relay. If it is judged that the state of the start relay has changed, the CAN network message of the start relay is organized and the start CAN network message is sent to the N-to-two module. Otherwise, the parsing process is re-executed after the next GOOSE message arrives.

[0095] Among them, the export module combines the export real-time database to perform export relay logic judgment. If it is determined that the state of the export relay has changed, the CAN network message of the export relay is organized and the export CAN network message is sent to the N-to-two module. Otherwise, wait for the next GOOSE message to arrive and re-execute the verification and parsing process.

[0096] Further preferably, each core of the MCU has program self-checking, fixed value and constant area self-checking, and hardware self-checking functions. Once the self-checking is abnormal, the core is restarted, and if the logical state of any core is inconsistent with the state of other cores, the inconsistent core is restarted.

[0097] Step 5, the N-take-two module obtains the startup status and exit status messages of the N core outputs of the MCU respectively, adopts the N-take-two principle to determine the final startup status and exit status, and controls the startup relay of the DI plug-in and the exit relay of the DO plug-in respectively, among which the DI plug-in directly controls the startup relay, and the startup relay controls the 24V of the exit relay coil of the DO plug-in.

[0098] Further preferably, the N-to-two module first determines whether the message CRC check is correct. If not, it is discarded. If correct, the following valid and latest message screening is performed: Step 3 is the verification of the external Ethernet message received by the FPGA, and Step 5 is the internal MCU of the device generating a startup or tripping message. Therefore, the N-to-two module needs to perform verification to prevent bit errors during transmission.

[0099] The survival time of each received message frame is counted independently. Once the survival time exceeds the set time, the message is set as an invalid message and no longer participates in the control relay N-to-two logic judgment;

[0100] If the number of message frames received from the same core controlling the same relay reaches 2 or more within the set time, the previous messages will be discarded and the latest message will be taken;

[0101] Take the startup status and exit status messages of the latest valid message of each core and compare them respectively. If the status of two or more cores are consistent, if it is a startup status message, send a 24V power supply status message of the control relay coil to DI. If it is an exit status message, DO sends a ground power supply status message of the control relay coil.

[0102] When the DI plug-in receives a startup status of 1 from any one of the two CPU plug-ins, and the DO plug-in receives an exit status of 1 from any one of the two CPU plug-ins, the exit relay is closed to implement exit relay control.

[0103] The beneficial effects of the present invention are as follows:

[0104] (1) The received GOOSE message is divided into three independent transmission paths from the Ethernet MAC output and sent to three cores for separate processing;

[0105] Since the FPGA program runs in RAM, SEU memory flip causes FPGA program failure. However, the address is random. After being output from Ethernet MAC, it is input into three independent FPGA sub-modules. The logic and program of the three sub-modules are exactly the same, but they are distributed in different address areas. When the FPGA program fails, it is impossible for an error to occur at the same logical position in three different areas. The results processed by the three sub-modules are respectively given to the three MCU cores for GOOSE message parsing. Similarly, the MCU program and real-time data are also in RAM. There is also the problem of SEU memory flip causing MCU program and data failure. It is impossible for the three cores to have the same failure problem. Using (1) can effectively prevent the possibility of program failure due to SEU memory flip, which may cause the output to fail or malfunction.

[0106] (2) When the FPGA submodule reads the message output by the MAC, the message contains the Ethernet's own CRC. The FPGA first calculates the checksum of the entire frame message including the CRC, and then performs a CRC check on the entire frame message. If it is correct, the entire frame message is sent to each core;

[0107] Since it takes a lot of time to calculate CRC using C language, each core only performs checksum judgment. Since the checksum and CRC check have intersections, if an error occurs before the FPGA's CRC check, it will be detected by the FPGA. If an error occurs before the FPGA's CRC check and before the core performs the checksum before decryption, it will be detected by the core. This method does not have a dead zone for detecting the correctness of the message.

[0108] (3) Each core is divided into two different program modules, startup and exit, to parse the GOOSE message, perform logical operations respectively, and output the startup status and exit status messages according to their respective logical structures to control the startup relay and exit relay respectively;

[0109] Since two different MCU function plug-ins are used to control the ground and power supply 24V of the output relay coil voltage respectively, after each core receives the GOOSE message, it is divided into two different program areas to complete their respective functions;

[0110] The startup program completes parsing of the GOOSE message, starts the logic, organizes the control of the start relay CAN network message to send the control start relay message to the N-to-two module of the CPLD; the action program completes parsing of the GOOSE message, exits the logic, organizes the control of the action relay CAN network message to send the control corresponding action relay message to the N-to-two module of the CPLD;

[0111] Although the functions completed are similar and a common subroutine can be used, in order to prevent the same problem from occurring due to failure of the common subroutine, which would result in simultaneous activation of startup and exit, this application uses completely independent program segments so that the two functional program segments have no intersection.

[0112] (4) The N-out-of-two module of the CPLD obtains the startup status and exit status messages of the three cores, and adopts the N-out-of-two principle to control the startup relay and the exit relay respectively;

[0113] The contact of the start relay controls the 24V power supply of the output relay. Since the source of GOOSE reception is Ethernet, which is the same, the FPGA processing speed is very fast. The three cores obtain the GOOSE messages to be processed almost at the same time. In order to ensure the correctness and speed of the CPLD N-to-two logic, the following measures are taken:

[0114] 1) Each message contains a CRC check. The CPLD first determines whether the CRC check is correct. If it is not correct, it will be discarded;

[0115] In order to ensure the timeliness of each core, the reception of GOOSE messages, processing of GOOSE messages, startup logic, and export logic are all processed in the 500us interrupt. The three cores are independent of each other. The earliest and latest difference between the actions of the three cores sensed by the CPLD will not exceed the set time of 3ms. The CPLD has an independent survival time count for each frame of action message. Once the survival time exceeds 3ms, the message is set to an invalid message and no longer participates in the control relay N-to-two logic judgment;

[0116] 2) If two or more messages from the same core controlling the same relay are received within 3ms, the previous messages are discarded and the latest message is used;

[0117] 3) Take the export status of the latest valid message of each core for comparison. If the status of two or more cores is consistent, send the control relay coil 24V power supply status message to DI, or send the control relay coil power supply ground status message to DO;

[0118] 4) Since there are three cores running the same logical function, this device adopts the N-out-of-two solution. The restart or abnormality of any core will not affect the action logic of the entire device. Each core of this device has program self-check, fixed value and constant area self-check, and hardware self-check functions. Once the self-check is abnormal, the core will automatically restart. If the logical state of any core is inconsistent with the state of other cores, try to restart the core first;

[0119] Although the prior art takes measures to prevent the failure of the program due to memory flipping, it generally detects whether the checksum of the program area and the important data area is correct, and restarts if it is not correct. After the above-mentioned N-to-two scheme is adopted, the present application enables the device to start from reading the GOOSE message from the Ethernet port, and monitor the whole process. If any of the three sets of processes is abnormal, it can realize the abnormal local automatic restart, and the normal export logic of the device is not affected during the restart process. If it is restored, it will run normally. If it is not restored, it can alarm and notify the on-site operation personnel to come for maintenance.

[0120] (5) A dual CPU plug-in is used to receive the GOOSE messages of busbar protection and interval protection and connect them to their respective CPU plug-ins. The two plug-ins are independent of each other and can control the start relay of the DI plug-in and the output relay of the DO plug-in separately through the internal CAN network. The output relay control is realized by adopting the OR logic mode of the DI plug-in and the DO plug-in (when any one of the two plug-ins is logically 1, the relay node is closed, and when both are 0, the relay node is retracted). Once any CPU plug-in is abnormal (the plug-in can be locked through the N-to-two logic), the other CPU plug-in can operate normally.

[0121] The terms in this application are explained as follows:

[0122] GOOSE message: general object-oriented substation events in accordance with the IEC61850-81 Specific communication service mapping (SCSM) Mappings to MMS and to ISO / IEC 8802-3 specification;

[0123] MCU: Microcontroller Unit (MCU) appropriately reduces the frequency and specifications of the central processing unit (CPU), and integrates peripheral interfaces such as memory, timer, USB, A / D conversion, UART, PLC, DMA, and even LCD driver circuits on a single chip to form a chip-level computer, which can provide different combination controls for different application scenarios.

[0124] SEU (Single Event Upset): Due to the large amount of high-energy particle radiation in the universe, a single high-energy particle enters the sensitive area of ​​the semiconductor device (such as a microprocessor, semiconductor memory or power transistor) and causes a reaction, resulting in a bit flip in the storage unit (that is, the content changes from 0 to 1, or from 1 to 0), which leads to system dysfunction and catastrophic accidents in severe cases. The logical error caused by SEU is not permanent and is also called a soft error.

[0125] CRC check code: Cyclic Redundancy Check (CRC) is the most commonly used error checking code in the field of data communication.

[0126] CPLD: (Complex Programmable Logic Device) is the abbreviation of Complex PLD, a more complex logic element than PLD. CPLD is a digital integrated circuit that users can construct logic functions according to their own needs.

[0127] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0128] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0129] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0130] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0131] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0132] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0133] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0134] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A self-correction method for a collection execution unit device, implemented based on a self-correction system, characterized in that: The self-correcting system includes a first CPU plug-in, a second CPU plug-in, a DI plug-in and a DO plug-in; The first CPU plug-in and the second CPU plug-in control the start relay of the DI plug-in and the output relay of the DO plug-in respectively; The first CPU plug-in and the second CPU plug-in adopt the same self-error correction structure; The self-correcting structure includes an Ethernet port, an FPGA, an MCU and an N-to-two module; Among them, the FPGA has N sub-modules, and the MCU has N cores; The Ethernet port receives the GOOSE message of the protection device, and its output is respectively input into the N sub-modules of the FPGA, and the outputs of the N sub-modules of the FPGA are respectively input into the N cores of the MCU; The outputs of the N cores of the MCU are all input to the N-to-two module, and the outputs of the N-to-two module are input to the DI plug-in and the DO plug-in respectively; The N-to-two module is an N-to-two module of a CPLD; N is an integer greater than or equal to 3; The self-correcting method comprises the following steps: Step 1, the GOOSE messages sent by the line protection device and the component protection device are respectively input into the first CPU plug-in and the second CPU plug-in, and the first CPU plug-in and the second CPU plug-in run independently; Step 2, in each CPU plug-in, the GOOSE message outputs the GOOSE message containing Ethernet CRC via the Ethernet MAC, and the message is transmitted to the N sub-modules of the FPGA through N independent transmission paths; Step 3, each submodule of the FPGA first adds a checksum including Ethernet CRC to the GOOSE message, then performs CRC check on the GOOSE message, and transmits the GOOSE message that passes the check to the core of the MCU corresponding to the submodule; Step 4, each core of the MCU first performs verification and analysis on the GOOSE message, and then performs startup and exit logic operations, and finally generates startup status and exit status messages respectively; Step 5: The N-out-of-two module obtains the startup status and exit status messages of the N core outputs of the MCU respectively, determines the final startup status and exit status according to the N-out-of-two principle, and controls the startup relay of the DI plug-in and the exit relay of the DO plug-in respectively.

2. A self-correcting method for a collection execution unit device according to claim 1, characterized in that: The first CPU plug-in and the second CPU plug-in receive GOOSE messages sent by the line protection device and the component protection device respectively; The first CPU card and the second CPU card control the start relay of the DI card and the output relay of the DO card respectively through the internal CAN network; Each core of the MCU uses two different modules, startup and exit, to parse the GOOSE message, perform their own startup and exit logic operations, and output startup status and exit status messages.

3. A self-correcting method for a collection execution unit device according to claim 1, characterized in that: Each submodule of FPGA uses the same logic and program, but different submodules are distributed in different address areas; Each core of the MCU uses the same logic and program, but different cores are distributed in different address areas.

4. A self-correction method for a collection execution unit device according to claim 1, characterized in that: In step 4, the process of MCU checking and parsing the GOOSE message includes: Step 4.1: Check the checksum of the GOOSE message. If it passes, go to step 4.2, otherwise discard it; Step 4.2: The startup module and the exit module of the MCU core parse the GOOSE message respectively at the same time; Among them, the start module combines the start real-time database to perform logic judgment on the start relay. If it is judged that the state of the start relay has changed, the CAN network message of the start relay is organized and the start CAN network message is sent to the N-to-two module. Otherwise, the parsing process is re-executed after the next GOOSE message arrives. Among them, the export module combines the export real-time database to perform export relay logic judgment. If it is determined that the state of the export relay has changed, the CAN network message of the export relay is organized and the export CAN network message is sent to the N-to-two module. Otherwise, wait for the next GOOSE message to arrive and re-execute the verification and parsing process.

5. The self-correcting method for a collection execution unit device according to claim 1, characterized in that: Each core of the MCU has program self-check, fixed value and constant area self-check, and hardware self-check functions. Once the self-check is abnormal, the core will be restarted. If the logical state of any core is inconsistent with the state of other cores, the inconsistent core will be restarted.

6. A self-correction method for a collection execution unit device according to claim 1, characterized in that: In step 5, the N-to-two module first determines whether the message CRC check is correct. If it is not correct, it is discarded. If it is correct, it screens valid and latest messages; Take the startup status and exit status messages of the latest valid message of each core and compare them respectively. If the status of two or more cores are consistent, if it is a startup status message, send a 24V power supply status message of the control relay coil to DI. If it is an exit status message, DO sends a ground power supply status message of the control relay coil.

7. A self-correction method for a collection execution unit device according to claim 6, characterized in that: In the N-to-two module, the survival time of each received message frame is counted independently. Once the survival time exceeds the set time, the message is set as an invalid message and no longer participates in the control relay N-to-two logic judgment.

8. A self-correction method for a collection execution unit device according to claim 6, characterized in that: In the N-to-two module, if the number of message frames received from the same core controlling the same relay reaches 2 or more within the set time, the previous messages are discarded and the latest message is taken.

9. A self-correction method for a collection execution unit device according to claim 1, characterized in that: In step 5, the DI plug-in and the DO plug-in adopt the OR logic mode, that is, if any one of the DI plug-in and the DO plug-in is logically 1, the output relay node is closed, and when both are 0, the output relay node is retracted to realize the output relay control.

Images