Transformer substation protection and automation device OTA upgrading method and system

Abstract

The invention discloses a transformer substation protection and automation device OTA upgrading method and system, and the method comprises the steps that a master station issues an OTA upgrading package containing a file set required by upgrading and a check code thereof to a protection and automation device through a substation; after the device successfully receives the OTA upgrade package, the master station issues an analysis command to the device through the substation; and the device responds to the command, analyzes and verifies the OTA upgrade package, performs differentiated version upgrade according to the file set after the analysis and verification are successful, and feeds back an upgrade result to the master station through the substation after the upgrade is completed. Software updating can be remotely pushed through the Internet, manual intervention is not needed, and upgrading of functions such as device control logic and protection strategies in the transformer substation is directly completed.

Description

Technical Field

[0001] This invention belongs to the technical field of power system relay protection, and relates to a method and system for over-the-air (OTA) upgrade of substation protection and automation devices. Background Technology

[0002] Smart substations contain various protection and automation devices with different functions. Currently, when these devices require upgrades, professionals must bring the equipment to the site and perform offline upgrades via physical interfaces (such as cables or dedicated ports). This process is complex and can take several days. Because different devices within the substation are from different manufacturers, incompatibility issues exist in the hardware interfaces and communication protocols used for upgrades. This often necessitates not only taking the relevant substation equipment out of service and dispatching maintenance personnel, but also contacting the device manufacturers for on-site operations. This results in a significant investment of manpower and travel expenses, with maintenance costs increasing as the scale of devices within the substation grows. Furthermore, human error during upgrade operations can pose risks, potentially extending the upgrade cycle, delaying power transmission, or even causing malfunctions in substation protection systems, thus affecting the stability of the power grid. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a method and system for over-the-air (OTA) upgrades of substation protection and automation devices.

[0004] The present invention adopts the following technical solution.

[0005] The first aspect of this invention proposes an OTA (Over-The-Air) upgrade method for substation protection and automation devices, comprising:

[0006] The main station will send the OTA upgrade package, which contains the set of files required for the upgrade and their verification codes, to the protection and automation devices via the substation;

[0007] After the master station successfully receives the OTA upgrade package from the device, the substation sends the parsing command to the device.

[0008] The device responds to the command by parsing and verifying the OTA upgrade package. After successful parsing and verification, it performs differentiated version upgrades according to the file set and sends the upgrade results back to the main station via the substation after the upgrade is completed.

[0009] Preferably, the substation uses the IEC61850 file transfer protocol to send the OTA upgrade package to the device. If the device successfully receives the OTA upgrade package, it sends a file reception success signal using the IEC61850 file transfer protocol. If the file transfer fails or times out, it sends a file reception failure signal.

[0010] Preferably, the verification code is used for multiple verifications as follows:

[0011] When the substation sends out the OTA upgrade package, the verification code is used to verify the integrity of the file during transmission;

[0012] Before the device parses the OTA upgrade package, it uses the checksum to perform a consistency check on the received complete upgrade package; when parsing the OTA upgrade package, it uses its corresponding independent checksum to perform a secondary check on each independent file in the file set.

[0013] Preferably, the device model includes an "OTA parsing upgrade package" direct control point, with data type "SPC ordinary direct control", and the model DO name is OtaInfProc, used to receive parsing commands.

[0014] Preferably, the device model includes a "successful OTA upgrade" remote signaling point and a "failed OTA upgrade" remote signaling point, and the remote signaling point is reset to "0" before the device starts parsing the OTA upgrade package;

[0015] After receiving the parsing command, the device parses the OTA upgrade package and uses the checksum within it to verify the file set.

[0016] When the parsing verification fails, the "OTA upgrade failed" remote signaling point is set to "1" and an OTA upgrade failure signal is sent.

[0017] When the parsing verification is successful, the device upgrades sequentially according to the file set in the OTA upgrade package. During the upgrade, the device compares the current version of the file. If the versions match, the file is skipped; otherwise, the file is upgraded.

[0018] After all files have been upgraded, the device will automatically restart. After restarting, the "OTA upgrade successful" remote signaling point will be set to "1" and an OTA upgrade success signal will be sent.

[0019] Preferably, the device backs up the OTA upgrade package during the upgrade process for troubleshooting and analysis when the OTA upgrade process is abnormal, including:

[0020] Based on the current OTA upgrade package, each included program is parsed in turn, and the current program version is checked. If the program file in the OTA upgrade package is inconsistent with the program version currently running on the device, an upgrade is attempted. If the program version is consistent, the upgrade is recorded as successful and the upgrade of this file is skipped.

[0021] If an error occurs during the program file upgrade process, the upgrade will be stopped, the program file upgrade failure will be recorded, and the returned error message will be recorded together with the current OTA upgrade package for troubleshooting and analysis.

[0022] If an error occurs during the upgrade process, the program will be rolled back using the previous OTA upgrade package, restoring the current program files to the version used by the current device.

[0023] If all program files in the OTA upgrade package are upgraded successfully, the current OTA upgrade package is recorded as successfully upgraded. The current OTA upgrade package replaces the previous historical OTA upgrade package and is used for rollback in subsequent OTA upgrade processes.

[0024] Preferably, the data type of the "OTA upgrade successful" remote signaling point is "SPS single point alarm", the model DO name is OtaProcSuc, and it is placed in the dataset dsFileState;

[0025] The data type of the "OTA upgrade failure" remote signaling point is "SPS single point alarm", the model DO name is OtaProcFal, and it is placed in the dataset dsFileState.

[0026] Preferably, the following pre-evaluation is performed before the differentiated version upgrade:

[0027] The device is equipped with a version relationship database to record the historical version numbers of each program file within the device, as well as a list of verified device functions under different version combinations;

[0028] After successful parsing and verification, the device compares the file set version in the OTA upgrade package with the version relationship database to pre-evaluate the new version combination that will be formed after this upgrade, whether there is a verified record in the database that matches the combination, and if not, list the key protection function items that may be affected.

[0029] The device feeds back the pre-evaluation results to the master station via the substation. After the master station sends a confirmation upgrade command to the device, the device performs the actual upgrade operation on the file set.

[0030] Preferably, the OTA upgrade package further includes an upgrade execution constraint file, which includes: the upgrade order of each program file in the file set; the device state conditions that each file needs to meet before upgrading; the corresponding rollback operation instructions and target version number when each file fails to upgrade or fails to perform a self-check after upgrading; the key nodes of the entire upgrade process, and the device internal state identifiers that should be updated after the nodes are completed;

[0031] The device operates according to the upgrade execution constraint file during the upgrade process and compares the execution result of each step with the expected state in the upgrade execution constraint file.

[0032] The second aspect of this invention provides an OTA upgrade system for substation protection and automation devices, including a master station, a substation, and protection and automation devices;

[0033] The master station is used to send the OTA upgrade package, which contains the set of files required for the upgrade and their verification codes, to the protection and automation devices via the substation; after the device successfully receives the OTA upgrade package, the substation sends the parsing command to the device.

[0034] The device is used to respond to the command, parse and verify the OTA upgrade package, perform differentiated version upgrades according to the file set after successful parsing and verification, and send the upgrade results back to the main station via the substation after the upgrade is completed.

[0035] Compared with the prior art, the beneficial effects of the present invention include at least the following:

[0036] This invention utilizes OTA (Over-The-Air) technology for remote upgrades of substation protection and automation devices. It enables remote software updates via the internet, allowing for upgrades to substation control logic and protection strategies without manual intervention. The upgrade process is based on a digital communication network and uses the IEC 61850 protocol, unifying upgrade interfaces and protocols between different manufacturers. Upgrades do not require on-site personnel, reducing labor costs and alleviating the manufacturer's after-sales maintenance burden, thereby lowering the overall lifecycle maintenance costs of various devices within the substation. The standardized, automated, and unmanned upgrade process is simple and quick, significantly reducing downtime for upgraded devices and avoiding the risks of human error, thus improving the overall stability and reliability of the substation.

[0037] This invention, through a multi-verification mechanism based on checksums and an upgrade execution constraint file, can promptly detect tampering of upgrade packages during transmission, storage, and parsing. It ensures that the order and conditions of upgrade operations comply with preset security constraints, thereby improving the controllability and debuggability of the upgrade process and reducing the risk of system instability.

[0038] This invention performs a pre-evaluation based on a version relationship database before the upgrade is executed. It can intelligently assess the impact of new version combinations on device functions and provide decision-making basis to the main station, thereby improving the security of the upgrade. Attached Figure Description

[0039] Figure 1 This is a flowchart of an OTA upgrade method for substation protection and automation devices according to the present invention.

[0040] Figure 2 This is a structural diagram of an OTA upgrade system for substation protection and automation devices according to the present invention. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The embodiments described in this application are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of this invention.

[0042] Embodiment 1 of this invention provides an OTA upgrade method for substation protection and automation devices, which can solve the problem of difficult maintenance and upgrades of smart substations, requiring manual on-site operation. Figure 1 As shown, the method includes the following steps:

[0043] Step 1: The main station sends the OTA upgrade package, which contains the set of files required for the upgrade and their verification codes, to the protection and automation devices via the substation;

[0044] More preferably, the main station sends the OTA upgrade package for updating to the device via the sub-station, as follows:

[0045] The OTA upgrade package issued by the main site includes a set of files required for device upgrade and an MD5 checksum, packaged as update.tar. The MD5 checksum is the checksum of the set of files.

[0046] The OTA upgrade package is distributed using the IEC61850 file transfer protocol.

[0047] When the device successfully receives the OTA upgrade package, it sends a file reception success signal to the master station using the IEC61850 file transfer protocol. If the file transfer fails or times out, it sends a file reception failure signal to the master station.

[0048] More preferably, the verification code is used for multiple verifications as follows:

[0049] When the substation sends out the OTA upgrade package, the verification code is used to verify the integrity of the file during transmission;

[0050] Before the device parses the OTA upgrade package, it uses the checksum to perform a consistency check on the received complete upgrade package; when parsing the OTA upgrade package, it uses its corresponding independent checksum to perform a secondary check on each independent file in the file set.

[0051] Step 2: After the master station successfully receives the OTA upgrade package from the device, it sends the parsing command to the device via the substation.

[0052] More preferably, the master station issues an "OTA parsing upgrade package" command, which is then distributed to the device via the substation, as follows:

[0053] A direct control point for "OTA parsing upgrade package" is added to the device model. The data type is "SPC ordinary direct control" and the model DO name is OtaInfProc. It is used by the master station to send the "OTA parsing upgrade package" command to the device.

[0054] When the master station receives a file reception success signal for the device's OTA upgrade package, it issues the "OTA parse upgrade package" command. If it receives a file reception failure signal or does not receive a file reception success signal, it does not issue the "OTA parse upgrade package" command.

[0055] The "OTA parsing upgrade package" command issued by the master station should also be subject to maintenance status control. The command will not be issued if the maintenance conditions are not met. That is, the operation is carried out under the premise of maintenance status, and the command is rejected when the device is not in maintenance status.

[0056] Step 3: The device responds to the command, parses and verifies the OTA upgrade package. After successful parsing and verification, it performs differentiated version upgrades according to the file set, and after the upgrade is completed, it sends the upgrade results back to the main station via the substation.

[0057] More preferably, the device parses the upgrade package and begins the upgrade. After completion, the upgrade result is fed back to the main station via the substation, as follows:

[0058] Add an "OTA upgrade successful" remote signaling point to the device model. The data type is "SPS single point alarm". The model DO name is OtaProcSuc. It is placed in the dataset dsFileState. It is used by the device to send the OTA upgrade successful signal to the master station. The device resets the signal to "0" before it starts parsing the OTA upgrade package. When the OTA upgrade is successful, the signal is set to "1".

[0059] Add an "OTA upgrade failure" remote signaling point to the device model. The data type is "SPS single point alarm". The model DO name is OtaProcFal. It is placed in the dataset dsFileState. It is used by the device to send an OTA upgrade failure signal to the master station. The device resets the signal to "0" before it starts parsing the OTA upgrade package. When the OTA upgrade fails to parse the upgrade package, the signal is set to "1".

[0060] When the device receives the "OTA parse upgrade package" command, it parses the OTA upgrade package and uses the MD5 checksum to verify the file set. If the parsing verification fails, the "OTA upgrade failed" remote signaling point is set to "1" and an OTA upgrade failure signal is sent to the master station.

[0061] The device is upgraded sequentially according to the file set in the OTA upgrade package. During the upgrade, the current version of the file used by the device is compared. If the versions are the same, the file is skipped; otherwise, the file is upgraded.

[0062] After the device completes the upgrade of the entire file set, it will automatically restart. After restarting, the "OTA upgrade successful" remote signaling point will be set to "1" and an OTA upgrade success signal will be sent to the master station.

[0063] The device upgrade process will back up the OTA upgrade package for troubleshooting and analysis should the OTA upgrade process fail. The steps are as follows:

[0064] (1) The device parses each program contained in the current OTA upgrade package in turn and checks the current program version. If the program file in the OTA upgrade package is inconsistent with the program version currently running on the device, it attempts to upgrade. If the program version is consistent, it directly records the upgrade as successful and skips the upgrade of this file.

[0065] (2) If an error occurs during the program file upgrade process, the upgrade will be stopped, the program file upgrade failure will be recorded, and the returned error message will be recorded together with the current OTA upgrade package for troubleshooting and analysis.

[0066] (3) If an error occurs during the upgrade process, the previous historical OTA upgrade package will be used to roll back the program and restore the current program file to the version used by the current device.

[0067] (4) If all program files in the OTA upgrade package are upgraded successfully, then the current OTA upgrade package is recorded as successfully upgraded. This OTA upgrade package replaces the previous historical OTA upgrade package and is used for rollback in subsequent OTA upgrade processes.

[0068] More preferably, the following pre-evaluation is performed before the differentiated version upgrade:

[0069] The device is equipped with a version relationship database to record the historical version numbers of each program file within the device, as well as a list of verified device functions under different version combinations;

[0070] After successful parsing and verification, the device compares the file set version in the OTA upgrade package with the version relationship database to pre-evaluate the new version combination that will be formed after this upgrade, whether there is a verified record in the database that matches the combination, and if not, list the key protection function items that may be affected.

[0071] The device feeds back the pre-evaluation results to the master station via the substation. After the master station sends a confirmation upgrade command to the device, the device performs the actual upgrade operation on the file set.

[0072] More preferably, the OTA upgrade package also includes an upgrade execution constraint file, which includes: the upgrade order of each program file in the file set; the device state conditions that each file needs to meet before upgrading; the corresponding rollback operation instructions and target version number when each file fails to upgrade or fails to self-check after upgrading; the key nodes of the entire upgrade process, and the device internal state identifiers that should be updated after the nodes are completed;

[0073] The device operates according to the upgrade execution constraint file during the upgrade process and compares the execution result of each step with the expected state in the upgrade execution constraint file, thereby improving the controllability and debuggability of the upgrade process.

[0074] Over-the-air (OTA) upgrades can be performed on all types of protection and automation devices within the substation using steps 1-3 described above.

[0075] Embodiment 2 of the present invention provides a substation protection and automation device OTA upgrade system utilizing the substation protection and automation device OTA upgrade method described in Embodiment 1, such as... Figure 2 As shown, the system includes: a remote master station, a substation, and a protection device;

[0076] The remote master station is used to generate OTA upgrade packages, issue "OTA parsing upgrade package" commands, and receive execution results from the protection device.

[0077] The substation is used to transmit OTA upgrade packages and commands;

[0078] The protection device is used to receive and parse the generated OTA upgrade package, execute the instructions issued by the main station, and provide feedback on the response results.

[0079] Compared with the prior art, the beneficial effects of the present invention include at least the following:

[0080] This invention enables remote software updates via the internet, allowing for upgrades to substation control logic, protection strategies, and other functions without manual intervention. The upgrade process is based on a digital communication network and uses the IEC 61850 protocol, unifying upgrade interfaces and protocols between different manufacturers. Upgrades do not require on-site personnel, reducing labor costs and alleviating the manufacturer's after-sales maintenance burden, thereby lowering the overall lifecycle maintenance costs of various devices within the substation. The standardized, automated, and unmanned upgrade process is simple and quick, significantly reducing downtime for upgraded devices and avoiding the risks of human error, thus improving the overall stability and reliability of the substation.

[0081] This invention, through a multi-verification mechanism based on checksums and an upgrade execution constraint file, can promptly detect tampering of upgrade packages during transmission, storage, and parsing. It ensures that the order and conditions of upgrade operations comply with preset security constraints, thereby improving the controllability and debuggability of the upgrade process and reducing the risk of system instability.

[0082] This invention performs a pre-evaluation based on a version relationship database before the upgrade is executed. It can intelligently assess the impact of new version combinations on device functions and provide decision-making basis to the main station, thereby improving the security of the upgrade.

[0083] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0084] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0085] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0086] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0087] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A method for OTA upgrade of substation protection and automation devices, characterized in that, include: The main station will send the OTA upgrade package, which contains the set of files required for the upgrade and their verification codes, to the protection and automation devices via the substation; After the master station successfully receives the OTA upgrade package from the device, the substation sends the parsing command to the device. The device responds to the command by parsing and verifying the OTA upgrade package. After successful parsing and verification, it performs differentiated version upgrades according to the file set and sends the upgrade results back to the main station via the substation after the upgrade is completed.

2. The OTA upgrade method for substation protection and automation devices according to claim 1, characterized in that: The substation uses the IEC61850 file transfer protocol to send the OTA upgrade package to the device. If the device successfully receives the OTA upgrade package, it sends a file reception success signal using the IEC61850 file transfer protocol. If the file transfer fails or times out, it sends a file reception failure signal.

3. The OTA upgrade method for substation protection and automation devices according to claim 1, characterized in that: The check code is used for multiple verifications as follows: When the substation sends out the OTA upgrade package, the verification code is used to verify the integrity of the file during transmission; Before the device parses the OTA upgrade package, it uses the checksum to perform a consistency check on the received complete upgrade package; when parsing the OTA upgrade package, it uses its corresponding independent checksum to perform a secondary check on each independent file in the file set.

4. The OTA upgrade method for substation protection and automation devices according to claim 1, characterized in that: The device model has an "OTA parsing upgrade package" direct control point, the data type is "SPC ordinary direct control", and the model DO name is OtaInfProc, which is used to receive parsing commands.

5. The OTA upgrade method for substation protection and automation devices according to claim 1, characterized in that: The device model is equipped with a "OTA upgrade successful" remote signaling point and an "OTA upgrade failed" remote signaling point. Before the device starts parsing the OTA upgrade package, the remote signaling point is reset to "0". After receiving the parsing command, the device parses the OTA upgrade package and uses the checksum within it to verify the file set. When the parsing verification fails, the "OTA upgrade failed" remote signaling point is set to "1" and an OTA upgrade failure signal is sent. When the parsing verification is successful, the device upgrades sequentially according to the file set in the OTA upgrade package. During the upgrade, the device compares the current version of the file. If the versions match, the file is skipped; otherwise, the file is upgraded. After all files have been upgraded, the device will automatically restart. After restarting, the "OTA upgrade successful" remote signaling point will be set to "1" and an OTA upgrade success signal will be sent.

6. The OTA upgrade method for substation protection and automation devices according to claim 1, characterized in that: The device backs up the OTA upgrade package during the upgrade process for troubleshooting and analysis in case of OTA upgrade process anomalies, including: Based on the current OTA upgrade package, each included program is parsed in turn, and the current program version is checked. If the program file in the OTA upgrade package is inconsistent with the program version currently running on the device, an upgrade is attempted. If the program version is consistent, the upgrade is recorded as successful and the upgrade of this file is skipped. If an error occurs during the program file upgrade process, the upgrade will be stopped, the program file upgrade failure will be recorded, and the returned error message will be recorded together with the current OTA upgrade package for troubleshooting and analysis. If an error occurs during the upgrade process, the program will be rolled back using the previous OTA upgrade package, restoring the current program files to the version used by the current device. If all program files in the OTA upgrade package are upgraded successfully, the current OTA upgrade package is recorded as successfully upgraded. The current OTA upgrade package replaces the previous historical OTA upgrade package and is used for rollback in subsequent OTA upgrade processes.

7. The OTA upgrade method for substation protection and automation devices according to claim 5, characterized in that: The data type of the "OTA upgrade successful" remote signaling point is "SPS single point alarm", the model DO name is OtaProcSuc, and it is placed in the dataset dsFileState; The data type of the "OTA upgrade failure" remote signaling point is "SPS single point alarm", the model DO name is OtaProcFal, and it is placed in the dataset dsFileState.

8. The OTA upgrade method for substation protection and automation devices according to claim 1, characterized in that: The following pre-assessment was conducted prior to the differentiated version upgrade: The device is equipped with a version relationship database to record the historical version numbers of each program file within the device, as well as a list of verified device functions under different version combinations; After successful parsing and verification, the device compares the file set version in the OTA upgrade package with the version relationship database to pre-evaluate the new version combination that will be formed after this upgrade, whether there is a verified record in the database that matches the combination, and if not, list the key protection function items that may be affected. The device feeds back the pre-evaluation results to the master station via the substation. After the master station sends a confirmation upgrade command to the device, the device performs the actual upgrade operation on the file set.

9. The OTA upgrade method for substation protection and automation devices according to claim 1, characterized in that: The OTA upgrade package also includes an upgrade execution constraint file, which includes: the upgrade order of each program file in the file set; the device state conditions that each file needs to meet before upgrading; the corresponding rollback operation instructions and target version number when each file fails to upgrade or fails to self-check after upgrading; the key nodes of the entire upgrade process, and the device internal state identifiers that should be updated after the nodes are completed. The device operates according to the upgrade execution constraint file during the upgrade process and compares the execution result of each step with the expected state in the upgrade execution constraint file.

10. A substation protection and automation device OTA upgrade system, operating the method described in any one of claims 1-9, characterized in that, The system includes a main station, substations, and protection and automation devices; The main station is used to send the OTA upgrade package, which contains the set of files required for the upgrade and their verification codes, to the protection and automation devices via the substation; After the device successfully receives the OTA upgrade package, the substation sends the parsing command to the device. The device is used to respond to the command, parse and verify the OTA upgrade package, perform differentiated version upgrades according to the file set after successful parsing and verification, and send the upgrade results back to the main station via the substation after the upgrade is completed.

Images