Intelligent detection and analysis apparatus and method based on network message

Abstract

This invention discloses an intelligent detection and analysis device based on network packets, comprising a network data acquisition unit and a data analysis unit. The data acquisition unit is embedded in a communication network and is used to continuously and cyclically store the raw data of the communication network. The data analysis unit is communicatively connected to the data acquisition unit, processes the packet data uploaded by the data acquisition unit, and performs real-time monitoring and analysis of intelligent IED devices in the automation system. The advantages of this invention compared to existing technologies are: it provides a convenient, effective, and collaborative intelligent detection and analysis device and method based on network packets for network packet detection and analysis in intelligent substation automation systems.

Description

Technical Field

[0001] This invention relates to the field of early warning and analysis technology for intelligent substations, specifically to an intelligent detection and analysis device and method based on network packets. Background Technology

[0002] The existing detection and analysis equipment in the substation monitors voltage and current based on the voltage transformers (PT) and current transformers (CT) on the secondary side. Specifically, voltage sensors are connected in parallel to the secondary voltage transformers, or current clamps are used to clamp the analog quantities onto the secondary cables of the current transformers. After sampling, the sampling results are converted by analog-to-digital converters (AD) and then subjected to digital-to-analytic transformation (DFT) calculation and analysis to obtain the data waveforms and sampled data values. The data after AD conversion is then statistically summarized to identify the effective value, maximum value, waveform, odd / even harmonic components, input and output power of the transformer primary and secondary sides, power factor, and other information of the measured items.

[0003] However, existing testing methods have significant shortcomings: First, they require manual review of secondary cable diagrams to complete the wiring of current clamps and voltage clamps, resulting in high labor costs and low efficiency; second, they only target analog quantities such as bus voltage, bus current, and feeder current in the power supply system, and cannot detect and analyze intelligent devices and network communication in the automation system; third, equipment waveform analysis and data analysis rely on third-party tools, requiring testers to repeatedly organize data files, which is cumbersome and prone to errors.

[0004] To address the aforementioned issues, this invention proposes a detection and analysis scheme embedded in the communication network of an intelligent substation automation system. By monitoring network communication data packets and reconstructing measurement data, it enables comprehensive detection and analysis of the entire automation system, overcoming the shortcomings of existing technologies. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to overcome the above-mentioned technical defects and provide a network packet-based intelligent detection and analysis device and method that is easy to use, has good detection and analysis effect, and can collaboratively realize network packet detection and analysis of intelligent substation automation system.

[0006] To solve the above-mentioned technical problems, the technical solution provided by the present invention is: an intelligent detection and analysis device based on network packets, comprising a network data acquisition unit and a data analysis unit; The data acquisition unit is embedded in the communication network and is used to continuously and cyclically store the raw data of the communication network. The data analysis unit is communicatively connected to the data acquisition unit, processes the message data uploaded by the data acquisition unit, and performs real-time monitoring and analysis of the intelligent IED devices in the automation system.

[0007] Preferably, the communication network is an IEC61850 communication network and an IEC60870 communication network; The data analysis unit performs online analysis of GOOSE and SMV communications.

[0008] Preferably, the raw data is network communication messages with absolute timestamps throughout the entire communication process, including TCP network packets, ARP data packets, and UDP packets.

[0009] Preferably, the data analysis unit includes an analysis interaction module, a model parser, and a message analyzer; in: The analysis and interaction module displays IED device status and network topology information in the form of tree diagrams and network topology, and displays event warning briefings in tabular form. The model parser loads and parses the SCD model file, decomposing the CID model of the IED device; The message analysis module performs real-time monitoring and in-depth analysis of GOOSE, SMV, and MMS messages.

[0010] Preferably, the message analysis module further includes calculating the amplitude, harmonic distortion rate and frequency of the power waveform within the automation system, and analyzing the dispersion and synchronization / loss-of-synchronization states of the voltage and current curves.

[0011] Preferably, the network data acquisition unit includes a CID model parsing module, a database recording module, and a time stamp processor; The circular storage capacity of the database recording module is greater than the storage requirements for two months of raw data collection.

[0012] Another aspect of this invention discloses an intelligent detection and analysis method based on network packets, comprising the following steps: S1: Network data acquisition, which continuously and cyclically stores raw network message data through a data acquisition unit embedded in the communication network; S2: Parse and analyze real-time uploaded Fast Ethernet packets online, and simultaneously perform offline analysis on the collected packets; S3: Based on the SCD model analysis results, the network topology model of intelligent IED devices in the automation system is displayed in the form of tree diagram and list. Real-time alarms are given for abnormal voltage and current conditions according to preset thresholds. Short-circuit current thresholds are set for real-time sampled values ​​to complete short-circuit test verification.

[0013] Preferably, step S2 includes analyzing the variation patterns of StNum and SqNum in GOOSE messages, analyzing the sampling point intervals in SMV messages, and counting the number and proportion of SMV messages with time deviations within one second that conform to ±10us, ±50us, ±100us, and >100us.

[0014] Preferably, step S3 includes setting the feeder current threshold under transient conditions through a visual interface, restoring the short-circuit current waveform in the acquisition message, and determining the threshold.

[0015] The advantages of this invention compared to existing technologies are as follows: By cooperating with a network data acquisition unit and a data analysis unit, the network message detection and analysis of the intelligent substation automation system can be completed. In particular, by embedding the communication network of the intelligent substation automation system, listening to network layer communication data packets and reconstructing measurement data, it can not only complete the detection of traditional analog quantities (voltage, current, etc.), but also comprehensively detect and analyze the operating conditions of intelligent IED devices, network communication (such as GOOSE, SMV, MMS messages), and system network topology, achieving coverage of the entire automation system. It can realize the comprehensive detection and verification of the communication behavior of intelligent IED devices, filling the gap in the field of intelligent network detection in existing technologies. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the hierarchical structure of the present invention.

[0017] Figure 2 This is a schematic diagram of the test environment for this invention.

[0018] Figure 3 This is a schematic diagram of an existing equipment testing scenario.

[0019] Figure 4 This is a schematic diagram of the intelligent detection function. Detailed Implementation

[0020] The present invention will now be described in further detail with reference to the accompanying drawings.

[0021] Combined with appendix Figure 1-4 As shown, the device consists of two parts.

[0022] The first part is the network data acquisition unit. This unit primarily performs continuous cyclic storage of raw communication network data in the substation environment. It can acquire complete network communication messages with absolute timestamps, including TCP network packets and ARP network packets, throughout the entire communication process based on IEC61850 and IEC60870 communication networks, even when the maximum storage capacity is reached. It can guarantee the storage of two months' worth of raw communication messages. The maximum continuous storage time varies depending on network traffic. When the acquisition unit records communication messages, it does not affect the existing communication network or generate any additional messages. It can accurately reproduce the actual operating data of analog and automated systems.

[0023] The second part is the data analysis unit (including data display). Based on the data from the acquisition unit, the analysis system processes the message information uploaded by the acquisition client, parses the real-time uploaded Fast Ethernet packets, performs statistical analysis on the raw data, generates secondary reference theoretical data, and performs real-time online analysis of GOOSE and SMV (IEC 61850-9-2) communication. The main functions are listed below: The system displays the SMV, GOOSE, and IP information of intelligent IED devices in the automation system, as well as the system's network topology model, in the form of a tree and its list.

[0024] Displays the network traffic (network occupancy) curve and current frame rate of the monitored system network, and refreshes information such as status, flow rate, and frame rate in real time.

[0025] The voltage and current curves of an automation system can be displayed hierarchically using node network data. Simultaneously, the discreteness and synchronization / loss-of-synchronization states of each node are also displayed. Displays real-time power waveform curves for all configuration models within the automation system, and calculates amplitude, harmonic distortion rate, and frequency.

[0026] Ø Visually displays the dispersion of a specified SMV acquisition node, and counts the number and proportion of frames with deviations within one second that conform to the following four types: ±10us, ±50us, ±100us, and >100us.

[0027] Event alerts are displayed in tabular form, showing the time, event, device, network, node, and detailed information in chronological order.

[0028] Ø Real-time monitoring and in-depth analysis of sampled values, GOOSE messages, and MMS messages, including content, change patterns, data structure, sampling point intervals, and communication faults.

[0029] Based on preset thresholds and performance information, it provides real-time alarms for abnormal conditions such as voltage and current.

[0030] Ø Perform offline analysis on the messages from the acquisition unit, supporting logical channel analysis, detailed message analysis, etc.

[0031] Ø Fault location and application function location: It can intuitively display the operation process in the automation system and has system-level fault location and application function location and search functions.

[0032] It can set thresholds for real-time sampled values ​​by analyzing network data, and complete on-site short-circuit test verification.

[0033] The data analysis unit not only provides the above functions but also reflects the real-time operating status of the intelligent transformer circuit, providing real-time alarms for voltage and current anomalies. It summarizes alarm information through data reconstruction analysis, classifies alarms by level, and provides early warning prompts. The analysis system can also manually collect and download log files from the unit and perform detailed analysis of the messages from the collected units according to logical channels through the offline analysis module, possessing the ability to analyze messages at various levels. It can intuitively display the operating process of the automation system and also has system-level fault location and application function location and search functions, enabling queries on the system's operating status based on single or combined conditions such as logic and time.

[0034] The device in this invention can meet the technical requirements for analog quantity detection, analysis, and early warning in traditional transformer substations, and also fully meet the data analysis requirements of intelligent transformer substations. In other words, it compensates for the inability of existing testing equipment to detect, analyze, and verify the network data of intelligent IED devices in the operating system. Furthermore, this invention represents a completely new approach to the detection of intelligent IED devices based on traditional testing methods. It better utilizes the IEC61850 communication standard, enabling comprehensive detection, analysis, verification, and early warning of the communication behavior of intelligent IEDs throughout the entire intelligent transformer system. Simultaneously, it reduces the workload of on-site cable connections and shortens testing time.

[0035] This invention adds intelligent detection methods to the operation system, filling the gap in existing detection equipment that cannot detect and analyze the entire intelligent network. The enhanced detection function allows for long-term stability monitoring of the entire automated system. It also enables early warning analysis of steady-state data and full-site analog quantity analysis of short-circuit data. Furthermore, regarding software usability, this invention provides configuration analysis tools, making it easier for users to gain a comprehensive understanding of the entire system.

[0036] like Figure 1As shown, the intelligent detection and analysis device consists of two units: a data acquisition unit and a detection and analysis unit. The detection and analysis unit loads and parses the SCD model using a visualization tool, decomposing it into the CID model file required by the IED. It provides human-computer interaction in the form of a tree diagram and list, assigning a data generator to each model data object to generate an IED device sequence. For each IED device, it displays the status and network topology information of the intelligent device. Simultaneously, this unit collects and aggregates data via an internal bus to reconstruct the operating status data of each IED device and can also perform analog quantity reconstruction. By inputting the detection configuration model, it identifies the detection type, voltage and current within the automated system, and information such as the voltage sampling point and sampling frequency. The data acquisition unit primarily analyzes network data packets using a hardware clock and uses hardware timestamps to organize and store the data packets. The acquired packets are then uploaded to the detection and analysis unit via the internal bus.

[0037] like Figure 2 The diagram illustrates the testing environment and positioning of the intelligent detection and analysis device. This device employs a network-oriented design philosophy, positioning itself above the automation system. It aggregates data from the network to provide data from each or multiple networks within the station. Simultaneously, by connecting to the operating system's communication network, it records and reconstructs all system communication messages, and uses its analysis unit to obtain real-time or historical information about the automation system. The device acquires message recording information, performs communication analysis and prediction functions for the variable automation system, and can perform online monitoring and offline diagnostics of the communication network system as needed. It analyzes communication messages and processes from multiple levels and perspectives, submits analysis reports, and records analog quantity information such as current and voltage of the railway contact network power supply arm.

[0038] like Figure 3 As shown in the diagram, this illustrates the testing environment of traditional conventional inspection equipment. Traditional testing devices are designed for analog quantities such as CTs and PTs in conventional current transformers, limiting their measurement scope to primary equipment. This presents limitations, a lack of unified information and exchange models, and no interaction with intelligent variable automation systems. Information exchange between intelligent IED devices is also unpredictable. Data acquisition and offline analysis of voltage and current are entirely based on analog quantities.

[0039] like Figure 4As shown, the intelligent variable detection and analysis device can detect and analyze variable automation systems from multiple dimensions. Detection Phase 1 involves SCD model consistency testing. The device parses the system model using MSXML2.0 controls and object-oriented technology, encapsulating IEC61850 functions and decomposing multiple IEDs within the SCD model into their respective CID models for use by the analysis unit. The analysis unit displays the parsed model in both a tree diagram structure and a network topology, classifying and displaying model information according to logical node functional constraints to prepare for consistency testing. It then uses the uploaded IED model information, combined with the specific implementation and information of the IEDs, to complete various types of consistency tests on the automation system's SCD model. Detection Phase 2 mainly focuses on online and offline analysis, including: GOOSE message structure analysis, content analysis, GOOSE StNum and GOOSE SqNum change pattern analysis, SMV message structure analysis, SMV continuity analysis, SMV sampling point interval analysis, communication interruption analysis, and network storm analysis. By recording the original network packets (SV packets and GOOSE packets), parsing the network packets, and reconstructing the records of the primary equipment parameter waveforms (SV packets) and secondary equipment action behaviors (GOOSE packets) of the power supply system, the system can be restored.

[0040] The third detection step involves intelligently calculating and recording data such as the effective value, 99th harmonic, active power, reactive power, and power factor of the message. This primarily focuses on intelligent reconstruction under steady-state operating conditions and when the locomotive passes by.

[0041] a) Restore the primary equipment parameters of the power supply system (SV message) By analyzing network messages, the effective value, maximum value, odd / even harmonic components, primary input and output power of the transformer, power factor, and other information of each measured item can be obtained.

[0042] b) Verify the records of secondary equipment actions (GOOSE messages), parse network messages to obtain the actions of each tested item, and verify the correctness and reliability of the secondary equipment protection.

[0043] Test 4 primarily targets transient detection in variable automation systems. It uses a visual interface to set feeder current thresholds under transient conditions. After an actual short-circuit current is applied to the system, the current is reconstructed from the acquired data, and the current threshold is determined. The current under short-circuit conditions, along with related currents and voltages, is recorded to complete a fault recall analysis of the short-circuit current. This intelligent judgment test is for detecting transient conditions in variable automation systems.

[0044] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. An intelligent detection and analysis device based on network packets, characterized in that: Includes a network data acquisition unit and a data analysis unit; The data acquisition unit is embedded in the communication network and is used to continuously and cyclically store the raw data of the communication network. The data analysis unit is communicatively connected to the data acquisition unit, processes the message data uploaded by the data acquisition unit, and performs real-time monitoring and analysis of the intelligent IED devices in the automation system.

2. The intelligent detection and analysis device based on network packets according to claim 1, characterized in that: The communication network is the IEC61850 communication network and the IEC60870 communication network; The data analysis unit performs online analysis of GOOSE and SMV communications.

3. The intelligent detection and analysis device based on network packets according to claim 2, characterized in that: The raw data consists of network communication messages with absolute timestamps throughout the entire communication process, including TCP network packets, ARP data packets, and UDP packets.

4. The intelligent detection and analysis device based on network packets according to claim 1, characterized in that: The data analysis unit includes an analysis interaction module, a model parser, and a message analyzer; in: The analysis and interaction module displays IED device status and network topology information in the form of tree diagrams and network topology, and displays event warning briefings in tabular form. The model parser loads and parses the SCD model file, decomposing the CID model of the IED device; The message analysis module performs real-time monitoring and in-depth analysis of GOOSE, SMV, and MMS messages.

5. The intelligent detection and analysis device based on network packets according to claim 4, characterized in that: The message analysis module also includes calculating the amplitude, harmonic distortion rate and frequency of the power waveform within the automation system, and analyzing the dispersion and out-of-synchronization state of the voltage and current curves.

6. The intelligent detection and analysis device based on network packets according to claim 1, characterized in that: The network data acquisition unit includes a CID model parsing module, a database recording module, and a time stamp processor; The circular storage capacity of the database recording module is greater than the storage requirements for two months of raw data collection.

7. A network packet-based intelligent detection and analysis method, applied to the intelligent detection and analysis device according to any one of claims 1-6, characterized in that: Includes the following steps: S1: Network data acquisition, which continuously and cyclically stores raw network message data through a data acquisition unit embedded in the communication network; S2: Parse and analyze real-time uploaded Fast Ethernet packets online, and simultaneously perform offline analysis on the collected packets; S3: Based on the SCD model analysis results, the network topology model of intelligent IED devices in the automation system is displayed in the form of tree diagram and list. Real-time alarms are given for abnormal voltage and current conditions according to preset thresholds. Short-circuit current thresholds are set for real-time sampled values ​​to complete short-circuit test verification.

8. The intelligent detection and analysis device based on network packets according to claim 7, characterized in that: S2 includes analyzing the variation patterns of StNum and SqNum in GOOSE messages, analyzing the sampling point interval of SMV messages, and counting the number and proportion of SMV messages with time deviations within one second that conform to ±10us, ±50us, ±100us, and >100us.

9. The intelligent detection and analysis device based on network packets according to claim 8, characterized in that: S3 includes setting the feeder current threshold under transient conditions through a visual interface, restoring the short-circuit current waveform in the acquisition message, and determining the threshold.

Images