A communication message capturing method and device, a storage medium and a relay protection device

Abstract

The application belongs to the technical field of power system relay protection communication, and particularly relates to a communication message capturing method and device, a computer readable storage medium and a relay protection device. The method comprises: continuously capturing external communication messages of the relay protection device, and cyclically covering and storing the captured communication message files in the memory of the relay protection device; detecting the external communication state of the relay protection device; and in the case that the external communication state of the relay protection device is abnormal, transferring the communication message files before and after the abnormality from the memory of the relay protection device to the disk of the relay protection device. Through the application, the evolution process of communication from normal to abnormal can be safely traced back only with small memory resources and low disk input / output operation frequency, and the analysis and positioning of abnormal problems by operation and maintenance personnel are more convenient.

Description

Technical Field

[0001] This application belongs to the field of communication technology for power system relay protection, and particularly relates to a communication message capture method, device, computer-readable storage medium, and relay protection equipment. Background Technology

[0002] In the field of power system communication technology, packet capture is often the most effective means for maintenance personnel to locate communication anomalies. By capturing the real-time message exchange process, maintenance personnel can accurately distinguish fault boundaries and find the root cause of communication anomalies.

[0003] However, for substation relay protection equipment, the above-mentioned operation and maintenance methods have several obvious drawbacks: First, the packet capture start time is often a period of time after the abnormal moment, and it is impossible to trace the evolution process of communication from normal to abnormal; second, packet capture operation consumes a lot of memory resources, which is not suitable for embedded relay protection equipment with limited resources; finally, when capturing packets for a long time, file storage will frequently perform disk input / output (I / O) operations, which poses a certain risk of disk failure, thereby affecting the other log records of the relay protection equipment. Summary of the Invention

[0004] In view of this, embodiments of this application provide a communication message capture method, apparatus, computer-readable storage medium, and relay protection device to solve the problems of existing technologies, such as the inability to trace the evolution of communication from normal to abnormal, large memory resource consumption, and certain disk failure risks.

[0005] The first aspect of this application provides a communication message capture method, applied in relay protection equipment of a substation, the communication message capture method including: The external communication messages of the relay protection device are continuously captured, and the captured communication message files are stored in the memory of the relay protection device in a loop, overwriting each other. Detect the external communication status of the relay protection device; If the external communication status of the relay protection device is abnormal, the communication message files before and after the abnormality will be transferred from the memory of the relay protection device to the disk of the relay protection device.

[0006] In one specific implementation of the first aspect, the step of transferring the communication message files before and after the anomaly from the memory of the relay protection device to the disk of the relay protection device may include: The first communication message file, the second communication message file, and the third communication message file are transferred from the memory of the relay protection device to the disk of the relay protection device; The first communication message file is the communication message file captured before the anomaly, the second communication message file is the communication message file captured during the anomaly, and the third communication message file is the communication message file captured after the anomaly.

[0007] In one specific implementation of the first aspect, the step of transferring the first communication message file, the second communication message file, and the third communication message file from the memory of the relay protection device to the disk of the relay protection device may include: Continue the packet capture process for the second communication message file, and after completing the packet capture of the second communication message file, transfer the first communication message file and the second communication message file from the memory of the relay protection device to the disk of the relay protection device; The process of capturing packets of the third communication message file is executed, and after the packet capture of the third communication message file is completed, the third communication message file is transferred from the memory of the relay protection device to the disk of the relay protection device.

[0008] In one specific implementation of the first aspect, before detecting the external communication status of the relay protection device, the following may be included: An external communication anomaly probe is installed for the relay protection device; Accordingly, detecting the external communication status of the relay protection device includes: The external communication status of the relay protection device is detected by the external communication anomaly probe. Specifically, when the external communication status of the relay protection device is abnormal, the external communication abnormality probe is set to a preset first flag bit; when the external communication status of the relay protection device is normal, the external communication abnormality probe is set to a preset second flag bit.

[0009] In one specific implementation of the first aspect, after transferring the communication message files before and after the anomaly from the memory of the relay protection device to the disk of the relay protection device, it may further include: Clear the communication message file stored in the memory of the relay protection device, and set the external communication anomaly probe to the second flag bit; Continue executing the step of continuously capturing external communication messages of the relay protection device and subsequent steps.

[0010] In one specific implementation of the first aspect, the step of cyclically overwriting and storing the communication message file obtained by packet capture in the memory of the relay protection device may include: The communication packets captured within the preset packet capture period will be generated into a communication packet file; When the number of communication message files stored in the memory of the relay protection device reaches a preset file number threshold, the newly generated communication message file will overwrite the target communication message file; wherein, the target communication message file is the earliest communication message file currently stored in the memory of the relay protection device.

[0011] In one specific implementation of the first aspect, the communication message capture method may further include: When the external communication status of the relay protection device is abnormal, the time of the abnormality, the type of abnormality, and the sequence number of the abnormality are recorded; wherein, the abnormality type includes link abnormality, operating system abnormality, client abnormality, server abnormality, and other abnormalities.

[0012] A second aspect of this application provides a communication message capture device, applied in relay protection equipment of a substation, the communication message capture device may include: The communication packet capture module is used to continuously capture external communication packets of the relay protection device and store the captured communication packet files in the memory of the relay protection device in a loop. A communication status detection module is used to detect the external communication status of the relay protection device; An abnormal file transfer module is used to transfer the communication message files before and after the abnormality from the memory of the relay protection device to the disk of the relay protection device when the external communication status of the relay protection device is abnormal.

[0013] In one specific implementation of the second aspect, the exception file transfer module can be specifically used to: transfer the first communication message file, the second communication message file, and the third communication message file from the memory of the relay protection device to the disk of the relay protection device; wherein, the first communication message file is a communication message file obtained by packet capture before the exception, the second communication message file is a communication message file obtained by packet capture during the exception, and the third communication message file is a communication message file obtained by packet capture after the exception.

[0014] In one specific implementation of the second aspect, the abnormal file transfer module can be specifically used to: continue the packet capture process of the second communication message file, and after completing the packet capture of the second communication message file, transfer the first communication message file and the second communication message file from the memory of the relay protection device to the disk of the relay protection device; execute the packet capture process of the third communication message file, and after completing the packet capture of the third communication message file, transfer the third communication message file from the memory of the relay protection device to the disk of the relay protection device.

[0015] In one specific implementation of the second aspect, the communication message capturing device may further include: A communication anomaly probe setting module is used to set external communication anomaly probes for the relay protection device; Accordingly, the communication status detection module can be specifically used to: detect the external communication status of the relay protection device through the external communication anomaly probe; wherein, when the external communication status of the relay protection device is abnormal, the external communication anomaly probe is set to a preset first flag bit, and when the external communication status of the relay protection device is normal, the external communication anomaly probe is set to a preset second flag bit.

[0016] In one specific implementation of the second aspect, the communication message capturing device may further include: The communication message capture and reset module is used to clear the communication message file stored in the memory of the relay protection device and set the external communication anomaly probe to the second flag bit; and continue to execute the step of continuously capturing the external communication messages of the relay protection device and its subsequent steps.

[0017] In one specific implementation of the second aspect, the communication packet capture module can be specifically used to: generate communication packets captured within a preset capture period into a communication packet file; when the number of communication packet files stored in the memory of the relay protection device reaches a preset file number threshold, overwrite the target communication packet file with the newly generated communication packet file; wherein, the target communication packet file is the earliest communication packet file currently stored in the memory of the relay protection device.

[0018] In one specific implementation of the second aspect, the communication message capturing device may further include: The anomaly recording module is used to record the time of the anomaly, the anomaly type, and the anomaly number when the external communication status of the relay protection device is abnormal; wherein, the anomaly type includes link anomaly, operating system anomaly, client anomaly, server anomaly, and other anomalies.

[0019] A third aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the above-described communication message capture methods.

[0020] A fourth aspect of this application provides a relay protection device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any of the above-described communication message capture methods.

[0021] The fifth aspect of this application provides a computer program product that, when run on a relay protection device, causes the relay protection device to execute the steps of any of the above-described communication message capture methods.

[0022] The beneficial effects of this application embodiment compared with the prior art are as follows: This application embodiment continuously captures external communication messages of the relay protection device and stores the captured communication message files in the memory of the relay protection device in a cyclical manner; it detects the external communication status of the relay protection device; and when the external communication status of the relay protection device is abnormal, it transfers the communication message files before and after the abnormality from the memory of the relay protection device to the disk of the relay protection device. Through this application embodiment, the evolution process of communication from normal to abnormal can be safely traced with only small memory resources and low disk input / output (I / O) operation frequency, making it easier for operation and maintenance personnel to analyze and locate abnormal problems. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart of one embodiment of a communication message capture method in this application. Figure 2 This is an example diagram showing how to transfer communication message files before and after an anomaly from the memory of the relay protection device to the disk. Figure 3 This is a structural diagram of one embodiment of a communication message capturing device according to the present application. Figure 4 This is a schematic block diagram of a relay protection device in an embodiment of this application. Detailed Implementation

[0025] To make the inventive objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] It should be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0027] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0028] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0029] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [the described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [the described condition or event] is detected," or "in response to detection of [the described condition or event]."

[0030] Furthermore, in the description of this application, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0031] In the field of power system communication technology, packet capture is often the most effective means for maintenance personnel to locate communication anomalies. By capturing the real-time message exchange process, maintenance personnel can accurately distinguish fault boundaries and find the root cause of communication anomalies.

[0032] However, for substation relay protection equipment, the above-mentioned operation and maintenance methods have several obvious drawbacks: First, the packet capture start time is often a period of time after the abnormal moment, and it is impossible to trace the evolution process of communication from normal to abnormal; second, packet capture operation consumes a lot of memory resources, which is not suitable for embedded relay protection equipment with limited resources; finally, when capturing packets for a long time, file storage will frequently perform disk input / output (I / O) operations, which poses a certain risk of disk failure, thereby affecting the other log records of the relay protection equipment.

[0033] In view of this, embodiments of this application provide a communication message capture method, apparatus, computer-readable storage medium, and relay protection device to solve the problems of existing technologies, such as the inability to trace the evolution of communication from normal to abnormal, high memory resource consumption, and certain disk failure risks. In embodiments of this application, the evolution of communication from normal to abnormal can be safely traced using only smaller memory resources and lower disk input / output (I / O) operation frequency, making it easier for maintenance personnel to analyze and locate abnormal problems.

[0034] In this application embodiment, the execution entity of a communication message capture method can be a substation relay protection device. Please refer to... Figure 1 One embodiment of a communication message capture method in this application may include: Step S101: Continuously capture the external communication messages of the relay protection device and store the captured communication message files in the memory of the relay protection device in a loop.

[0035] In one specific implementation of this application, the external communication messages of the relay protection device can be continuously captured by a preset packet capture tool. The specific packet capture tool used can be flexibly set according to the actual situation, including but not limited to tcpdump packet capture tool and other packet capture tools. This application does not specifically limit this.

[0036] During the continuous packet capture of external communication messages of relay protection equipment, the communication messages captured within a preset capture period can be generated into a communication message file. The specific value of the capture period can be flexibly set according to actual conditions, and this embodiment does not impose a specific limitation on it. As an example, the capture period can be set to 1 minute, so the communication messages captured every 1 minute can be generated into a communication message file. The filename can adopt the format capture_yyyymmdd_hhmmss.pcap, where yyyy, mm, dd, hh, mm, and ss represent the year, month, day, hour, minute, and second of the capture, respectively. For example, capture_20260606_115200.pcap represents the communication message file captured at 11:52:00 on June 6, 2026.

[0037] Communication message files can be stored in the memory file system of the relay protection device. The specific memory file system used can be flexibly set according to the actual situation, including but not limited to the tmpfs memory file system and other memory file systems. This application embodiment does not make a specific limitation in this regard. The capacity of the memory file system can also be flexibly set according to the actual situation. This application embodiment does not make a specific limitation in this regard. As an example, the capacity of the memory file system can be set to 2MB (megabytes) or other smaller capacities based on the experience value of external communication traffic assessment of the relay protection device, so as to reduce the consumption of memory resources.

[0038] When the number of communication message files stored in the memory of the relay protection device reaches a preset file number threshold, a newly generated communication message file can overwrite the target communication message file. The target communication message file is the oldest communication message file currently stored in the relay protection device's memory. The specific value of the file number threshold can be flexibly set according to actual conditions, and this application embodiment does not impose a specific limitation on it. As an example, the file number threshold can be set to 3, meaning that a maximum of 3 communication message files can be retained in the relay protection device's memory. By cyclically overwriting communication message files in memory, the consumption of memory resources can be effectively reduced.

[0039] Step S102: Detect the external communication status of the relay protection equipment.

[0040] In one specific implementation of this application, external communication anomaly probes can be pre-set for relay protection devices to detect various types of external communication anomalies in a timely manner, including but not limited to link anomalies, operating system anomalies, client anomalies, server anomalies, and other anomalies.

[0041] For each type of anomaly, a corresponding external communication anomaly probe can be added to the relevant source code of the relay protection device. When the external communication status of the relay protection device is abnormal, the external communication anomaly probe is set to a preset first flag (True). When the external communication status of the relay protection device is normal, the external communication anomaly probe is set to a preset second flag (False). In the initial state, the external communication anomaly probe is set to the second flag (False).

[0042] During the continuous packet capture of external communication messages of the relay protection device and the cyclical overwriting of the captured communication message files in the memory of the relay protection device, the external communication status of the relay protection device can be detected in real time using an external communication anomaly probe. If the external communication anomaly probe is detected with the second flag bit (False), it indicates that the corresponding external communication status is normal, and the external communication status of the relay protection device continues to be detected in real time. If the external communication anomaly probe is detected with the first flag bit (True), it indicates that the corresponding external communication status is abnormal. At this time, the corresponding abnormal time, abnormal type, and abnormal sequence number (incrementing from 1) can be recorded, and step S103 can be executed.

[0043] Step S103: When the external communication status of the relay protection device is abnormal, transfer the communication message files before and after the abnormality from the memory of the relay protection device to the disk of the relay protection device.

[0044] In one specific implementation of this application embodiment, the first communication message file, the second communication message file, and the third communication message file can be transferred from the memory of the relay protection device to the disk of the relay protection device.

[0045] The first communication message file is the communication message file captured before the anomaly, the second communication message file is the communication message file captured during the anomaly, and the third communication message file is the communication message file captured after the anomaly.

[0046] Specifically, when an external communication anomaly is detected, the communication message file that has already completed the packet capture process is the first communication message file, and the communication message file currently being captured is the second communication message file. At this point, the packet capture process for the second communication message file can continue. After completing the capture of the second communication message file, the current packet capture process is stopped, and the first and second communication message files are transferred from the relay protection device's memory to the relay protection device's disk.

[0047] Then, the packet capture process after the anomaly can be executed. The communication messages captured within a preset time (such as 4 minutes) are generated into a third communication message file. After the packet capture of the third communication message file is completed, the third communication message file is transferred from the memory of the relay protection device to the disk of the relay protection device, thus forming a complete anomaly analysis message packet.

[0048] In one specific implementation of this application, the filename of the transferred communication message file can be adjusted to include information such as exception type (FltType), exception sequence number (FltNum), and file sequence number (FileNo). For example, the filename of the transferred communication message file can be in the format of capture_FltType_FltNum_FileNo_yyyymmdd_hhmmss.pcap.

[0049] For ease of understanding, Figure 2This diagram illustrates an example of transferring communication message files before and after an anomaly from the relay protection device's memory to disk. As shown, when this external communication anomaly is detected, the relay protection device's memory contains three communication message files: capture_20260606_115200.pcap, capture_20260606_115300.pcap (the first communication message file), and capture_20260606_115400.pcap (the second communication message file). Among these, capture_20260606_115400.pcap is currently in the process of packet capture. At this time, the anomaly time, anomaly type (assumed to be 3, representing a client-side anomaly), and anomaly sequence number (assumed to be 1) can be recorded, and the packet capture process of capture_20260606_115400.pcap can be completed. After packet capture is complete, the first and second communication packet files can be renamed to capture_3_1_1_20260606_115300.pcap and capture_3_1_2_20260606_115400.pcap respectively, and then transferred from the relay protection device's memory to the relay protection device's disk (e.g., in target / CommFlt / Flt0301 / ). Then, a packet capture process following an anomaly can be executed (e.g., after 4 minutes), generating capture_20260606_115500.pcap (the third communication packet file), which overwrites the oldest communication packet file currently stored in memory, capture_20260606_115200.pcap. After capturing the third communication message file, the file can be renamed to capture_3_1_3_20260606_115500.pcap and transferred from the relay protection device's memory to its disk (e.g., in target / CommFlt / Flt0301 / ). The files capture_3_1_1_20260606_115300.pcap, capture_3_1_2_20260606_115400.pcap, and capture_3_1_3_20260606_115500.pcap on the disk together constitute a complete anomaly analysis message packet, which can be used by maintenance personnel to analyze and locate anomalies.

[0050] After transferring the communication message files before and after the anomaly from the relay protection device's memory to the relay protection device's disk, the communication message files stored in the relay protection device's memory can be cleared, the external communication anomaly probe can be set to the second flag bit (False), and the steps of continuously capturing external communication messages of the relay protection device and subsequent steps can be executed to start a new round of communication message capture.

[0051] In summary, this application embodiment continuously captures external communication messages of the relay protection device and stores the captured communication message files in the relay protection device's memory in a loop, overwriting existing messages. It also detects the external communication status of the relay protection device. If the external communication status is abnormal, the communication message files before and after the abnormality are transferred from the relay protection device's memory to its disk. Through this application embodiment, the evolution of communication from normal to abnormal can be safely traced using only relatively small memory resources and a low frequency of disk input / output (I / O) operations, making it easier for maintenance personnel to analyze and locate abnormal problems.

[0052] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0053] Corresponding to the communication message capture method described in the above embodiment, Figure 3 This illustration shows a structural diagram of one embodiment of a communication message capture device provided in this application.

[0054] In this embodiment of the application, the communication message capture device can be applied to the relay protection equipment of a substation, and the communication message capture device may include: The communication packet capture module 301 is used to continuously capture external communication packets of the relay protection device and cyclically overwrite the captured communication packet files in the memory of the relay protection device. Communication status detection module 302 is used to detect the external communication status of the relay protection device; The abnormal file transfer module 303 is used to transfer the communication message files before and after the abnormality from the memory of the relay protection device to the disk of the relay protection device when the external communication status of the relay protection device is abnormal.

[0055] In one specific implementation of this application embodiment, the abnormal file transfer module can be specifically used to: transfer the first communication message file, the second communication message file, and the third communication message file from the memory of the relay protection device to the disk of the relay protection device; wherein, the first communication message file is a communication message file obtained by packet capture before the abnormality, the second communication message file is a communication message file obtained by packet capture during the abnormality, and the third communication message file is a communication message file obtained by packet capture after the abnormality.

[0056] In one specific implementation of this application embodiment, the abnormal file transfer module can be specifically used to: continue the packet capture process of the second communication message file, and after completing the packet capture of the second communication message file, transfer the first communication message file and the second communication message file from the memory of the relay protection device to the disk of the relay protection device; execute the packet capture process of the third communication message file, and after completing the packet capture of the third communication message file, transfer the third communication message file from the memory of the relay protection device to the disk of the relay protection device.

[0057] In one specific implementation of this application embodiment, the communication message capturing device may further include: A communication anomaly probe setting module is used to set external communication anomaly probes for the relay protection device; Accordingly, the communication status detection module can be specifically used to: detect the external communication status of the relay protection device through the external communication anomaly probe; wherein, when the external communication status of the relay protection device is abnormal, the external communication anomaly probe is set to a preset first flag bit, and when the external communication status of the relay protection device is normal, the external communication anomaly probe is set to a preset second flag bit.

[0058] In one specific implementation of this application embodiment, the communication message capturing device may further include: The communication message capture and reset module is used to clear the communication message file stored in the memory of the relay protection device and set the external communication anomaly probe to the second flag bit; and continue to execute the step of continuously capturing the external communication messages of the relay protection device and its subsequent steps.

[0059] In one specific implementation of this application embodiment, the communication packet capture module can be specifically used to: generate communication packets captured within a preset packet capture period into a communication packet file; when the number of communication packet files stored in the memory of the relay protection device reaches a preset file number threshold, overwrite the target communication packet file with the newly generated communication packet file; wherein, the target communication packet file is the earliest communication packet file currently stored in the memory of the relay protection device.

[0060] In one specific implementation of this application embodiment, the communication message capturing device may further include: The anomaly recording module is used to record the time of the anomaly, the anomaly type, and the anomaly number when the external communication status of the relay protection device is abnormal; wherein, the anomaly type includes link anomaly, operating system anomaly, client anomaly, server anomaly, and other anomalies.

[0061] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0062] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0063] Figure 4 A schematic block diagram of a relay protection device provided in an embodiment of this application is shown. For ease of explanation, only the parts related to the embodiment of this application are shown.

[0064] like Figure 4 As shown, the relay protection device 4 in this embodiment includes: a processor 40, a memory 41, and a computer program 42 stored in the memory 41 and executable on the processor 40. When the processor 40 executes the computer program 42, it implements the steps in the various communication message capture method embodiments described above, for example... Figure 1 Steps S101 to S103 are shown. Alternatively, when the processor 40 executes the computer program 42, it implements the functions of each module / unit in the above-described device embodiments, for example... Figure 3 The functions of modules 301 to 303 are shown.

[0065] For example, the computer program 42 may be divided into one or more modules / units, which are stored in the memory 41 and executed by the processor 40 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program 42 in the relay protection device 4.

[0066] Those skilled in the art will understand that Figure 4 This is merely an example of relay protection device 4 and does not constitute a limitation on relay protection device 4. It may include more or fewer components than shown, or combine certain components, or different components. For example, the relay protection device 4 may also include input / output devices, network access devices, buses, etc.

[0067] The processor 40 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0068] The memory 41 can be an internal storage unit of the relay protection device 4, such as a hard disk or memory of the relay protection device 4. The memory 41 can also be an external storage device of the relay protection device 4, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the relay protection device 4. Furthermore, the memory 41 can include both internal storage units and external storage devices of the relay protection device 4. The memory 41 is used to store the computer program and other programs and data required by the relay protection device 4. The memory 41 can also be used to temporarily store data that has been output or will be output.

[0069] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0070] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0071] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0072] In the embodiments provided in this application, it should be understood that the disclosed devices / relay protection equipment and methods can be implemented in other ways. For example, the device / relay protection equipment embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0073] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0074] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0075] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable storage medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc. It should be noted that the content included in the computer-readable storage medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable storage medium does not include electrical carrier signals and telecommunication signals.

[0076] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for capturing communication messages, characterized in that, In relay protection equipment used in substations, the communication message capture method includes: The external communication messages of the relay protection device are continuously captured, and the captured communication message files are stored in the memory of the relay protection device in a loop, overwriting each other. Detect the external communication status of the relay protection device; If the external communication status of the relay protection device is abnormal, the communication message files before and after the abnormality will be transferred from the memory of the relay protection device to the disk of the relay protection device.

2. The communication message capture method according to claim 1, characterized in that, The step of transferring the communication message files before and after the anomaly from the memory of the relay protection device to the disk of the relay protection device includes: The first communication message file, the second communication message file, and the third communication message file are transferred from the memory of the relay protection device to the disk of the relay protection device; The first communication message file is the communication message file captured before the anomaly, the second communication message file is the communication message file captured during the anomaly, and the third communication message file is the communication message file captured after the anomaly.

3. The communication message capture method according to claim 2, characterized in that, The step of transferring the first communication message file, the second communication message file, and the third communication message file from the memory of the relay protection device to the disk of the relay protection device includes: Continue the packet capture process for the second communication message file, and after completing the packet capture of the second communication message file, transfer the first communication message file and the second communication message file from the memory of the relay protection device to the disk of the relay protection device; The process of capturing packets of the third communication message file is executed, and after the packet capture of the third communication message file is completed, the third communication message file is transferred from the memory of the relay protection device to the disk of the relay protection device.

4. The communication message capture method according to claim 1, characterized in that, Before detecting the external communication status of the relay protection device, the following steps are also included: An external communication anomaly probe is installed for the relay protection device; Accordingly, detecting the external communication status of the relay protection device includes: The external communication status of the relay protection device is detected by the external communication anomaly probe. Specifically, when the external communication status of the relay protection device is abnormal, the external communication abnormality probe is set to a preset first flag bit; when the external communication status of the relay protection device is normal, the external communication abnormality probe is set to a preset second flag bit.

5. The communication message capture method according to claim 4, characterized in that, After transferring the communication message files before and after the anomaly from the memory of the relay protection device to the disk of the relay protection device, the process further includes: Clear the communication message file stored in the memory of the relay protection device, and set the external communication anomaly probe to the second flag bit; Continue executing the step of continuously capturing external communication messages of the relay protection device and subsequent steps.

6. The communication message capture method according to claim 1, characterized in that, The step of cyclically overwriting and storing the captured communication message file in the memory of the relay protection device includes: The communication packets captured within the preset packet capture period will be generated into a communication packet file; When the number of communication message files stored in the memory of the relay protection device reaches a preset file number threshold, the newly generated communication message file will overwrite the target communication message file; wherein, the target communication message file is the earliest communication message file currently stored in the memory of the relay protection device.

7. The communication message capture method according to any one of claims 1 to 6, characterized in that, Also includes: When the external communication status of the relay protection device is abnormal, the time of the abnormality, the type of abnormality, and the sequence number of the abnormality are recorded; wherein, the abnormality type includes link abnormality, operating system abnormality, client abnormality, server abnormality, and other abnormalities.

8. A communication message capturing device, characterized in that, The communication message capture device, used in relay protection equipment in substations, includes: The communication packet capture module is used to continuously capture external communication packets of the relay protection device and store the captured communication packet files in the memory of the relay protection device in a loop. A communication status detection module is used to detect the external communication status of the relay protection device; An abnormal file transfer module is used to transfer the communication message files before and after the abnormality from the memory of the relay protection device to the disk of the relay protection device when the external communication status of the relay protection device is abnormal.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the communication message capture method as described in any one of claims 1 to 7.

10. A relay protection device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the communication message capture method as described in any one of claims 1 to 7.

Images