Industrial communication message analysis and diagnosis method, device, equipment, medium and product

Abstract

The application discloses an industrial communication message analysis and diagnosis method, device, equipment, medium and product, comprising: obtaining process data configuration and memory mapping configuration of the industrial communication message, constructing joint mapping results of object identification and logical address based on the process data configuration and the memory mapping configuration; the process data configuration is used for periodically exchanging real-time data between master and slave stations, and the memory mapping configuration is used for mapping the logical address to the physical object space of the slave station; in a communication running period, matching the logical read-write request frame and the logical read-write response frame of the industrial communication message, obtaining the pairing result of the logical read-write request frame and the logical read-write response frame, and performing a re-pairing operation when the pairing is abnormal, and updating the pairing result; based on the joint mapping result and the pairing result, a target frame-level evidence chain is generated according to a target object timeline. The application realizes accurate reconstruction and timing stable recovery of object-level semantics, and improves the traceability and audit efficiency of diagnosis evidence.

Description

Technical Field

[0001] This application relates to the field of automated communication and intelligent diagnostic technology, specifically to a method, apparatus, equipment, medium, and product for parsing and diagnosing industrial communication messages. Background Technology

[0002] In the field of industrial automation control, message analysis of the real-time industrial Ethernet communication protocol (Ethernet for Control Automation Technology, or EtherCAT) is a key step in system debugging, fault diagnosis, and performance optimization. Existing message analysis solutions usually rely on direct parsing of the underlying data frames or simple field display.

[0003] However, in practical engineering applications, most tools can only restore the underlying data to the logical address segment or byte block level, resulting in the inability to uniformly interpret key control objects; secondly, during the communication operation phase, the requests and responses of EtherCAT logical read and write commands (LRW) are prone to mismatch, which leads to data distortion in the object timeline; in addition, the diagnostic conclusions generated are not conducive to anomaly review and quality accountability. Summary of the Invention

[0004] In view of the aforementioned defects or deficiencies in the prior art, it is desirable to provide a method, apparatus, device, medium, and product for parsing and diagnosing industrial communication messages. This method restores the underlying logical address to object semantics through a joint mapping mechanism, and reduces the temporal distortion of object values ​​by combining pairing and anomaly re-pairing mechanisms within the communication cycle. Simultaneously, it generates a frame-level evidence chain containing multi-dimensional correlation information, improving the auditability of anomaly location and conclusion verification. In a first aspect, this invention provides a method for parsing and diagnosing industrial communication messages, the method comprising: The process data configuration and memory mapping configuration of industrial communication messages are obtained, and a joint mapping result of object identifier and logical address is constructed based on the process data configuration and memory mapping configuration. Among them, the process data configuration is used to periodically exchange real-time data between master and slave stations, and the memory mapping configuration is used to map the logical address to the physical object space of the slave station. During the communication cycle, the logical read / write request frames and logical read / write response frames of industrial communication messages are matched to obtain the pairing results of the logical read / write request frames and logical read / write response frames. If the pairing is abnormal, a re-pairing operation is performed to update the pairing results. Based on the joint mapping results and pairing results, a target frame-level evidence chain is generated according to the target object timeline. The target object timeline is used to characterize the temporal record of the decoded values ​​of the same object arranged in chronological order. The target frame-level evidence chain corresponds to the relationship between the frame identifier, logical address, object identifier, and object data content.

[0005] In one possible implementation, matching the logical read / write request frame and the logical read / write response frame of the industrial communication message includes: In response to the master station sending a target logical read / write request frame to the slave station, a pairing window is set as a time constraint interval using a preset parsing engine, and based on the pairing window, the first frame sequence number of the target logical read / write request frame and the second frame sequence number of the target logical read / write response frame returned by the slave station to the master station are obtained respectively. If the value of the second frame sequence number is the value of the first frame sequence number plus 1, then the target logical read / write request frame is determined to match the target logical read / write response frame; wherein, the master station assigns a continuously increasing frame sequence number to each logical read / write request frame according to the sending order.

[0006] In one possible implementation, if the value of the second frame sequence number is not the value of the first frame sequence number plus 1, or if the target logical read / write response frame is not received within the pairing window, then a pairing anomaly is determined to exist.

[0007] In one possible implementation, when there is abnormal input in the process data configuration of the acquired industrial communication message, the method further includes: Determine if there are any missing configurations in the process data configuration. If so, load the external configuration data and re-acquire the process data configuration.

[0008] In one possible implementation, the process of generating the timeline of the target object includes: According to the preset mapping window, the original data fields of each object are selected from the payload of the logical read and write response frame corresponding to the pairing result, and the original data fields are converted into byte order to match the local byte order of the main station. The decoding rules corresponding to each object identifier are invoked to decode the original data fields after byte order conversion, and the decoded data is bound to the timestamp of the current running cycle to generate the target object timeline.

[0009] In one possible implementation, the method further includes: Perform semantic recognition on the timeline of the target object to obtain the semantic tags and physical unit information corresponding to the timeline of the target object. Based on preset change characteristics, the timelines of each target object are filtered, and objects whose preset change characteristics meet preset drawing conditions are identified as key objects, and a drawing task list is generated. Diagnostic charts are output in batches according to the drawing task list; among them, the preset change characteristics correspond to the quantitative indicators of the data fluctuation degree in the timeline of the target object, and the diagnostic charts represent the trend of the decoded values ​​of each key object over time in multiple continuous communication operation cycles.

[0010] Secondly, an industrial communication message parsing and diagnostic device is provided, the device comprising: The mapping module is used to acquire the process data configuration and memory mapping configuration of industrial communication messages, and to construct a joint mapping result between object identifiers and logical addresses based on the process data configuration and memory mapping configuration. The process data configuration is used to periodically exchange real-time data between master and slave stations, and the memory mapping configuration is used to map logical addresses to the physical object space of slave stations. The pairing module is used to match the logical read / write request frames and logical read / write response frames of industrial communication messages during the communication cycle, obtain the pairing results of the logical read / write request frames and logical read / write response frames, and perform a re-pairing operation and update the pairing results when the pairing is abnormal. The generation module is used to generate a target frame-level evidence chain based on the joint mapping results and pairing results, according to a preset object timeline; wherein, the target frame-level evidence chain corresponds to the association relationship between frame identifier, logical address, object identifier, and object data content.

[0011] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements the method of any one of the first aspects above.

[0012] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the method of any one of the first aspects above.

[0013] Fifthly, a computer program product is provided, which includes instructions that, when executed, perform any of the methods described in the first aspect above.

[0014] The industrial communication message parsing and diagnosis method, apparatus, device, medium, and product provided in this application have several advantages. Firstly, by jointly mapping process data configuration and memory mapping configuration, a bidirectional anchoring from logical address to object identifier is established, enabling EtherCAT messages to be stably restored to object-level semantics. This improves the accuracy and consistency of object-level semantic reconstruction and solves the problem of insufficient mapping granularity. Secondly, by performing dynamic matching and abnormal re-pairing of logical read / write request frames and response frames within the communication cycle, the pairing relationship can be automatically corrected in abnormal scenarios such as time-series offsets or packet loss, thereby improving the reliability of object value recovery in the read / write direction and effectively eliminating the interference of time-series distortion on the diagnostic results. Furthermore, by structurally binding discrete object timelines to original message frames through a target frame-level evidence chain, any abnormal object value can be reverse-located to the specific communication interaction process, significantly improving the auditability and review efficiency of diagnostic conclusions. Attached Figure Description

[0015] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a schematic diagram of the system architecture provided in the embodiments of this application; Figure 2 This is a flowchart illustrating the method for parsing and diagnosing industrial communication messages provided in an embodiment of this application; Figure 3 This is a flowchart illustrating the matching of industrial communication messages provided in an embodiment of this application; Figure 4 This is a schematic diagram of the process for generating joint mapping results provided in an embodiment of this application; Figure 5 This is a schematic diagram of the process for generating a timeline of the target object provided in an embodiment of this application; Figure 6 This is a flowchart illustrating the automatic generation of drawing tasks provided in an embodiment of this application; Figure 7 This is a schematic diagram of the structure of the target frame-level evidence chain provided in the embodiments of this application; Figure 8 This is a block diagram of the industrial communication message parsing and diagnostic device 800 provided in an embodiment of this application; Figure 9 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0016] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0017] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The present application will now be described in detail with reference to the accompanying drawings and embodiments. Furthermore, the term "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The terms "first" and "second," etc., in the specification and claims of the embodiments of this application are used to distinguish different objects, not to describe a specific order of objects.

[0018] Existing EtherCAT message analysis solutions generally suffer from insufficient mapping granularity, unstable periodic pairing, high reliance on manual intervention, and weak traceability. Specifically, insufficient mapping granularity means that most tools remain at the logical address segment or byte block level, making it difficult to reconstruct semantics at the object index / sub-index level, resulting in inconsistent interpretation of key objects such as control words, status words, and location feedback. Unstable periodic pairing means that during communication operation, LRW requests and responses often exhibit timing offsets or confounding, and existing solutions lack stable pairing mechanisms, easily leading to mismatches in object timelines. High reliance on manual intervention means that common processes require engineers to manually filter the vertical data classification columns in comma-separated values ​​(CSV) files, manually configure plotting coordinates, and interpret each plot individually, resulting in low analysis efficiency and poor repeatability. Weak traceability means that diagnostic conclusions are not sufficiently correlated with underlying frame information, making it difficult to form closed-loop evidence of "object value - frame number - logical address - window byte," which is detrimental to anomaly review and quality accountability.

[0019] To address the aforementioned issues, this application provides a method for parsing and diagnosing EtherCAT messages. This method is automated, reproducible, and traceable, specifically enabling configuration-driven parsing, object-level process data reconstruction, automatic visualization output, and evidence chain generation.

[0020] In one embodiment of this application, an industrial communication message parsing and diagnosis system is provided to implement a method for parsing and diagnosing industrial communication messages.

[0021] In one possible implementation, Figure 1 This is a schematic diagram of the system architecture provided in the embodiments of this application, such as... Figure 1As shown, the system includes a data acquisition module 1, a configuration extraction module 2, an object mapping module 3, a periodic pairing module 4, a visualization module 5, an evidence output module 6, a storage module 7, and a display terminal 8.

[0022] For example, the data acquisition module 1 is connected to the configuration extraction module 2 to acquire raw packet capture data; the object mapping module 3 receives the output of the configuration extraction module 2; the periodic pairing module 4 receives the output of the object mapping module 3; the visualization module 5 and the evidence output module 6 process the output of the periodic pairing module 4 in parallel; the storage module 7 is connected to the object mapping module 3, the periodic pairing module 4, the visualization module 5, and the evidence output module 6 respectively, and is used to store intermediate data and final results (e.g., the object timeline output by the periodic pairing module 4 and the mapping table output by the object mapping module 3); the display terminal 8 is read and displayed by the visualization module 5, the evidence output module 6, and the storage module 7 respectively.

[0023] Correspondingly, Figure 2 This is a flowchart illustrating the method for parsing and diagnosing industrial communication messages provided in this application embodiment, as shown below. Figure 2 As shown, the method includes the following steps: Step S201: Obtain the process data configuration and memory mapping configuration of the industrial communication message, and construct a joint mapping result of object identifier and logical address based on the process data configuration and memory mapping configuration; wherein, the process data configuration is used to periodically exchange real-time data between master and slave stations, and the memory mapping configuration is used to map the logical address to the physical object space of the slave station.

[0024] In one possible implementation, when the system starts up or loads the packet capture file, the data acquisition module 1 can first acquire industrial communication message data containing the initialization phase and the running phase, and then the configuration extraction module 2 can parse two types of key configuration information from the message; among them, the two types of key configuration information include process data configuration and memory mapping configuration.

[0025] For example, process data configuration is used to define the real-time data structure exchanged between the master station and the slave station in periodic communication. For instance, in the EtherCAT protocol, it corresponds to the Process Data Object (PDO) configuration, and in other fieldbus protocols, it may correspond to the input / output mapping table or the IO configuration section in the GSD file.

[0026] For example, memory mapping configuration is used to define the correspondence between logical address space and physical object storage space inside the slave. For instance, in the EtherCAT protocol, it corresponds to the Fieldbus Memory Management Unit (FMMU) configuration, while in other protocols it may correspond to an address translation table or pointer mapping area.

[0027] In one possible implementation, the object mapping module 3 can jointly model the abstract data structure defined in the process data configuration and the physical addressing information defined in the memory mapping configuration based on the complementary characteristics of the two types of configurations mentioned above, thereby constructing a joint mapping result between object identifier and logical address.

[0028] For example, an object identifier may be an object index, sub-index, or variable name, and a logical address may be a byte offset or bit offset.

[0029] The joint mapping mechanism provided in this embodiment can determine the semantic meaning of the data at the precise location on the bus, thereby overcoming the problem of insufficient mapping granularity caused by traditional solutions that rely on only a single configuration, and achieving accurate restoration from the underlying bit stream to the upper-layer business object.

[0030] Step S202: During the communication operation cycle, match the logical read / write request frame and logical read / write response frame of the industrial communication message to obtain the pairing result of the logical read / write request frame and logical read / write response frame, and perform a re-pairing operation to update the pairing result when the pairing is abnormal.

[0031] In one possible implementation, when the system enters the data analysis phase of communication operation, the periodic pairing module 4 can perform time-series alignment on massive communication messages.

[0032] For example, the pairing result of logical read / write request frames and logical read / write response frames can be obtained by matching the frame sequence numbers of logical read / write request frames and logical read / write response frames.

[0033] For example, when a pairing anomaly is detected (e.g., no response received after timeout, discontinuous frame sequence numbers, or verification failure), a re-pairing operation is triggered to update the pairing results; for example, by expanding the search window, tracing back historical frames, or predicting based on the protocol state machine, the matching relationship is re-established.

[0034] This embodiment ensures the continuity of the object timeline under non-ideal communication conditions through the above-mentioned dynamic correction mechanism, and avoids misalignment of all subsequent data parsing due to a single pairing failure, thereby significantly improving the reliability of bidirectional object value recovery.

[0035] Step S203: Based on the joint mapping result and the pairing result, generate a target frame-level evidence chain according to the target object timeline; wherein, the target object timeline is used to characterize the temporal record of the decoded values ​​of the same object arranged in chronological order, and the target frame-level evidence chain corresponds to the relationship between frame identifier, logical address, object identifier and object data content.

[0036] In one possible implementation, after obtaining the above joint mapping results and pairing results, the evidence output module 6 can be used to generate traceable diagnostic evidence.

[0037] For example, the target object timeline is a continuous sequence formed by sorting discrete object values ​​according to communication cycle timestamps, in order to reflect the dynamic change trend of the controlled object during operation.

[0038] Based on this, the target frame-level evidence chain generated above is not a simple list of fields, but can characterize the relationship between frame identifier (used to uniquely determine the source of the message, such as frame number), logical address (used to determine the location of the data in the bus space), object identifier (used to determine the business semantics of the data) and object data content (specific decoded values, such as object value).

[0039] Correspondingly, the above-mentioned correlation can be used to construct a complete closed-loop path from macroscopic diagnostic conclusions back to microscopic underlying data sources; for example, when the macroscopic diagnostic conclusion is that the motor speed is abnormal at a certain moment, its microscopic underlying data source can be traced back to the original byte Y at logical address X in the Nth frame.

[0040] Optionally, in practical applications, the target frame-level evidence chain can further include auxiliary fields such as time base, block information, and verification status to enhance the integrity and tamper resistance of the evidence.

[0041] The method for parsing and diagnosing industrial communication messages provided in this application addresses several issues. First, it addresses the problem of coarse mapping granularity by using joint modeling of process data configuration and memory mapping configuration. This ensures the accuracy of object-level semantic reconstruction in principle, enabling key objects such as control words and status words to be interpreted uniformly and accurately, rather than remaining at the level of ambiguous byte blocks. Second, it addresses the problem of timing distortion by using dynamic pairing and abnormal re-pairing mechanisms for runtime cycles. This goes beyond static offline viewing and effectively avoids interference caused by network jitter and transmission anomalies, reducing timing distortion of object values. Third, it addresses the problem of difficult traceability by generating a target frame-level evidence chain containing multi-dimensional correlation information. This goes beyond single-point result output, making any abnormal diagnosis conclusion verifiable and verifiable, greatly improving the operation and maintenance efficiency and quality control level of industrial automation systems.

[0042] In another embodiment of this application, a specific matching method for logical read / write request frames and logical read / write response frames is also provided.

[0043] In one possible implementation, the process of matching the logical read / write request frame and the logical read / write response frame of the industrial communication message specifically includes: in response to the master station sending the target logical read / write request frame to the slave station, using a preset parsing engine to set a pairing window as a time constraint interval, and based on the pairing window, obtaining the first frame sequence number of the target logical read / write request frame and the second frame sequence number of the target logical read / write response frame returned by the slave station to the master station respectively; if the value of the second frame sequence number is the value of the first frame sequence number plus 1, then it is determined that the target logical read / write request frame and the target logical read / write response frame match.

[0044] In this process, the master station assigns a continuously increasing frame sequence number to each logical read / write request frame according to the sending order.

[0045] For example, Figure 3 This is a schematic diagram of the process for matching industrial communication messages provided in the embodiments of this application, such as... Figure 3 As shown, during the communication cycle, the master station sends a logical read / write request frame 301 (e.g., Frame N) to the slave station, and the slave station returns the corresponding logical read / write response frame 302 (e.g., Frame N+1) after processing.

[0046] For example, refer to Figure 3 A pairing window 303 can be set by the periodic pairing module 4 through a preset parsing engine. The pairing window 303 is a dynamic or static time constraint interval, specifically used to limit the effective time range that the response frame must reach.

[0047] Correspondingly, within the pairing window 303, the system extracts the first frame sequence number (e.g., N) of the request frame and the second frame sequence number (e.g., N+1) of the response frame, and performs a continuity check.

[0048] Specifically, when the sequence number of the second frame is exactly equal to the sequence number of the first frame plus 1, that is, when the relationship Seqresp = Seqreq + 1 is satisfied, the two are considered to be successfully matched.

[0049] Compared to matching based on timestamps, this embodiment uses the matching mechanism based on the above-mentioned continuously increasing frame sequence number rule. Based on the characteristic that the master station usually allocates frame numbers sequentially in industrial communication protocols, it provides a mathematical criterion for the correspondence between request frames and response frames, so as to effectively resist the risk of mismatch caused by clock asynchrony or transmission delay fluctuations.

[0050] In one possible implementation, if the value of the second frame sequence number is not the value of the first frame sequence number plus 1, or if the target logical read / write response frame is not received within the pairing window, then a pairing anomaly is determined to exist.

[0051] The first pairing anomaly corresponds to discontinuous sequence numbers, that is, a response frame is received within the pairing window 303, but its sequence number is not equal to the request frame sequence number plus 1 (for example, Frame N+2 is received instead of Frame N+1), which indicates that there is packet loss or out-of-order delivery in the middle; the second pairing anomaly corresponds to timeout without response, that is, no corresponding response frame is captured when the pairing window 303 is closed, which may be due to slave processing timeout, link interruption or severe congestion.

[0052] Correspondingly, refer to Figure 3 If a pairing anomaly is detected, the abnormal repairing branch 304 is immediately triggered.

[0053] Specifically, in the abnormal re-pairing branch 304, the periodic pairing module 4 executes a recovery strategy, such as expanding the search window to find late responses, backtracking the historical buffer to correct previous erroneous associations, or predicting the content of missing frames based on the protocol state machine and marking the confidence level.

[0054] In another embodiment of this application, a specific method for generating the joint mapping result is also provided.

[0055] In one possible implementation, Figure 4 This is a schematic diagram of the process for generating joint mapping results provided in an embodiment of this application, such as... Figure 4 As shown, the generation process includes the following steps: S401, Import packet capture file.

[0056] S402, Extract PDO Configuration.

[0057] For example, if there is an abnormal input in the PDO configuration obtained through step S402 above, then step S4031 is executed.

[0058] S4031, determine if there are any missing configurations in the PDO configuration.

[0059] For example, if it exists, then proceed to step S404; otherwise, proceed to step S4032.

[0060] For example, by real-time detection of PDO configuration integrity, if incomplete packet capture during the initialization phase, failure to parse critical registers, or absence of necessary configuration frames in the message are detected, it is determined that the configuration is missing, i.e., an abnormal input state.

[0061] S4032, extract FMMU configuration.

[0062] S404, load external configuration data and re-acquire PDO configuration.

[0063] S405, construct the joint mapping result of PDO configuration and FMMU configuration; S406, outputs an object-level logical mapping table.

[0064] In another embodiment of this application, a specific method for generating the timeline of the target object is also provided.

[0065] In one possible implementation, the process of generating the target object timeline includes: according to a preset mapping window, filtering out the original data fields of each object from the payload of the logical read / write response frame corresponding to the pairing result, and converting the original data fields into byte order to match the local byte order of the main station; calling the decoding rules corresponding to each object identifier to decode the original data fields after byte order conversion, and binding the decoded data with the timestamp of the current running cycle to generate the target object timeline.

[0066] For example, the target object timeline mentioned above can be generated by the object mapping module 3 or a specific decoding unit to transform the underlying communication data into upper-layer business semantics.

[0067] Specifically, Figure 5 This is a schematic diagram of the process for generating a timeline of the target object provided in an embodiment of this application, such as... Figure 5 As shown, the generation process includes the following steps: S501, filter payloads according to the preset mapping window.

[0068] For example, the preset mapping window corresponds to the mapping window determined by the above joint mapping result, so as to accurately extract the original data fields from the payload of the paired logical read and write response frames.

[0069] S502 performs byte order conversion on the filtered raw data fields.

[0070] S503 calls the decoding rules corresponding to each object identifier for parsing.

[0071] S504 binds the decoded data with the timestamp of the current running cycle to generate the target object timeline.

[0072] For example, the timestamps mentioned above typically correspond to the capture time of a logical read / write response frame or the synchronization clock reference when the master station sends a request.

[0073] This embodiment binds a unified time base, which organizes the originally discrete object values ​​into a sequence arranged in chronological order, so as to obtain the dynamic change trend of object values ​​over time, or to align and compare multiple related objects (such as instruction speed and feedback speed) on the same time axis.

[0074] S505, outputs object timeline files.

[0075] In one possible implementation, a validity verification mechanism can be introduced during the decoding process in step S503 above.

[0076] For example, when an anomaly such as insufficient length of the original data field, byte order conversion overflow, or decoding rule mismatch is detected, the system will not force the output of the error value, but will switch to the exception handling branch to record the anomaly object identifier, associated frame number and error type, and mark the object value of that period as invalid or missing.

[0077] In another embodiment of this application, a specific method for generating drawing tasks is also provided.

[0078] In one possible implementation, semantic recognition can be performed on the timeline of the target object to obtain the semantic tags and physical unit information corresponding to the timeline of the target object.

[0079] For example, Figure 6 This is a flowchart illustrating the automatic generation of drawing tasks provided in an embodiment of this application, such as... Figure 6 As shown, the generation process includes the following steps: S601, Read the timeline of the target object.

[0080] S602, Perform object semantic recognition.

[0081] For example, based on the metadata information contained in the joint mapping results, the generated target object timeline is automatically semantically parsed.

[0082] Correspondingly, by querying process data configuration or externally loaded description files, abstract object identifiers are mapped to readable semantic tags (e.g., "0x6040:00" is identified as "Controlword"), and their corresponding physical unit information (e.g., "rpm", "mm / s" or "bitmask") is associated at the same time.

[0083] In another possible implementation, the timelines of each target object can be filtered based on preset change characteristics, and objects whose preset change characteristics meet preset drawing conditions can be identified as key objects, and a drawing task list can be generated.

[0084] For example, see Figure 6 In step S603, drawing objects are selected according to preset change characteristics.

[0085] Specifically, the preset change feature corresponds to a quantitative indicator of the degree of data fluctuation in the timeline of the target object. For example, it can be the standard deviation, peak-to-peak value, variance, rate of change, or energy value of a specific frequency band of the timeline data.

[0086] For example, see Figure 6 In step S604, it is determined whether the object is a critical object.

[0087] Specifically, the calculated quantitative indicators can be compared with preset plotting conditions (such as thresholds, rankings, or dynamic baselines); when the fluctuation index of an object exceeds the set threshold or ranks in the top N among all objects, the object is automatically identified as a key object.

[0088] Subsequently, in step S6051, a drawing task list is automatically generated for the key objects.

[0089] Specifically, the drawing task list is a structured intermediate data object used to record information such as the identifier of the object to be drawn, the recommended chart type, the time range, and the associated semantic tags.

[0090] For example, see Figure 6 In step S606, the corresponding drawing engine is called to generate diagnostic diagrams in batches.

[0091] Specifically, the diagnostic chart is used to characterize the trend of the decoded values ​​of each key object over time in multiple consecutive communication cycles.

[0092] In one example, visualization module 5 reads the drawing task list and calls the corresponding drawing engine to generate diagnostic charts in batches.

[0093] As an optional implementation, for non-critical objects that are not determined to be critical objects, step S6052 can be executed to implement a downgrade processing strategy.

[0094] For example, data from the aforementioned non-critical objects can be aggregated into statistical summaries (e.g., maximum, minimum, average, and outlier counts), or detailed waveforms can be loaded only when a user actively queries them.

[0095] This embodiment achieves the following technical effects through the above-mentioned automatic visualization mechanism based on semantic recognition and change feature filtering: First, it replaces the inefficient operation mode of traditional analysis tools that relies on manual column-by-column filtering of CSV data and manual configuration of plotting parameters, greatly improving the efficiency of engineering diagnosis; Second, through standardized plotting task lists and batch output capabilities, it ensures that the analysis results of different personnel and at different times on the same dataset have a high degree of consistency and reproducibility, eliminating analysis bias caused by differences in personal operating habits.

[0096] In another embodiment of this application, a representation of the target frame-level evidence chain is also provided.

[0097] In one possible implementation, the target frame-level evidence chain corresponds to the association between frame identifier, logical address, object identifier, and object data content. This association is solidified through a specific field structure and temporal dependency.

[0098] For example, Figure 7 This is a schematic diagram of the structure of the target frame-level evidence chain provided in the embodiments of this application, such as... Figure 7 As shown, the data structure of the target frame-level evidence chain includes at least the frame identifier field 701, the timestamp field 702, the logical address field 703, the object identifier field 704, the object value field 705, the window byte fragment field 706, and the verification status field.

[0099] Among them, the frame identifier field 701 is used to uniquely identify the original communication message that generated the data and is the root index for tracing back to the physical layer data source; the timestamp field 702 is used to record the precise time when the data was captured or decoded, providing a benchmark for multi-object timing alignment; the logical address field 703 is used to specify the addressing location of the data in the bus logical space and is a bridge connecting physical transmission and semantic parsing; the object identifier field 704 is used to characterize the business object attributes corresponding to the data, for example, in the EtherCAT protocol, it can contain a combination of object index and sub-index; the object value field 705 is used to store the decoded engineering value and is the direct object of diagnostic analysis; the window byte fragment field 706 is used to retain the original bit sequence extracted from the original message as the underlying credential for verifying the correctness of decoding; and the verification status field is used to record the data integrity verification results for the aforementioned fields.

[0100] Specifically, the parsing of the object value field 705 depends strictly on the correct identification of the object identifier field 704.

[0101] In another embodiment of this application, an apparatus for parsing and diagnosing industrial communication messages is also provided.

[0102] In one possible implementation, Figure 8 This is a block diagram of the industrial communication message parsing and diagnostic device 800 provided in this application embodiment, as shown below. Figure 8 As shown, the industrial communication message parsing and diagnostic device 800 includes a mapping module 801, a pairing module 802, and a generation module 803.

[0103] For example, the mapping module 801 is used to obtain the process data configuration and memory mapping configuration of industrial communication messages, and construct a joint mapping result of object identifier and logical address based on the process data configuration and memory mapping configuration; wherein, the process data configuration is used to periodically exchange real-time data between master and slave stations, and the memory mapping configuration is used to map the logical address to the physical object space of the slave station.

[0104] The pairing module 802 is used to match the logical read / write request frames and logical read / write response frames of industrial communication messages during the communication operation cycle, obtain the pairing results of the logical read / write request frames and logical read / write response frames, and perform a re-pairing operation to update the pairing results when the pairing is abnormal.

[0105] The generation module 803 is used to generate a target frame-level evidence chain based on the joint mapping result and the pairing result, according to a preset object timeline; wherein, the target frame-level evidence chain corresponds to the association relationship between frame identifier, logical address, object identifier and object data content.

[0106] To further illustrate the deployability and robustness of the technical solution in an industrial environment, the analysis and diagnostic methods of this application are comprehensively described below in conjunction with three engineering application scenarios.

[0107] In one example, in an application scenario where only packet capture is performed, this application demonstrates the actual operation process of an external configuration compensation mechanism to address the situation where only data from the device's operational phase can be obtained during on-site debugging, but initialization configuration is missing.

[0108] Specifically, when a user imports a packet capture file containing only runtime data (e.g., 222.ecat_half2.pcap), the system automatically detects the completeness of the process data configuration through the configuration extraction module 2. If the configuration is found to be missing, the system triggers the external configuration loading process. The user can specify a reference packet capture file containing the complete initialization phase (e.g., 222.ecat_half1.pcap) through parameters, or point to a historical analysis directory that pre-stores standardized configurations, or directly load an explicit CSV configuration file.

[0109] Correspondingly, after successfully loading the external configuration, the system uses the configuration to replace the local extraction results, reconstructs the joint mapping result of object identifier and logical address, and continues to execute the subsequent periodic pairing, object timeline generation and evidence chain output steps.

[0110] In this scenario, the system can stably output object timeline files and evidence chain reports that are consistent with the complete packet capture analysis. After comparison and verification, the parsed servo object values ​​are completely consistent with the analysis results of the complete dataset.

[0111] In another example, in low-memory streaming parsing application scenarios, this application provides a resource-adaptive processing mode to address the problem that analyzing extremely large packet capture files (such as those in the GB range) on ordinary industrial control computers can easily lead to memory overflow.

[0112] Specifically, when starting an analysis task, users can enable the low memory mode parameter (low_memory_mode=on). In this mode, the system switches the datagram source to streaming (op_datagram_source=stream), allowing the periodic pairing module 4 and the object mapping module 3 to process the data in a pipeline manner, rather than loading the entire file into memory.

[0113] At the same time, the system automatically reduces the number of concurrent decoding threads (servo_workers) and disables unnecessary intermediate data export functions (such as export_op_configured_csv), thereby significantly reducing peak memory usage while ensuring the integrity of the core parsing logic.

[0114] It should be noted that, despite the resource constraints mentioned above, this mode still strictly retains the complete output of core fields such as frame identifier, timestamp, logical address, object identifier, object value, window byte fragment, and verification status in the target frame-level evidence chain, ensuring that the traceability of the diagnostic results is not affected.

[0115] In another example, in the application scenario of parallel diagnostics for multiple slave stations, this application demonstrates directional analysis capabilities based on logical address space partitioning for complex industrial Ethernet systems containing dozens or even hundreds of slave stations.

[0116] Specifically, during the object mapping stage, the system automatically divides the entire logical address space into multiple independent sub-regions based on the slave alias or site address recorded in the memory mapping configuration. Users can specify a specific slave number for targeted analysis or perform batch processing on all slaves.

[0117] For each slave station, the system independently generates corresponding object timeline files and column definition files, and supports parallel comparison of key object trends by slave station dimension in display terminal 8.

[0118] Correspondingly, based on the above implementation method, this application conducted actual tests on a standard test dataset. Specifically, under the condition of a complete packet capture dataset including the initialization phase (222.ecat.pcapng, file size 874MB), the total time for the system to complete the entire process of analysis and evidence output was 1561.393 seconds; under the condition of only running the segment packet capture dataset (222.ecat_half2.pcap, file size 435MB) in conjunction with external configuration (222.ecat_half1.pcap, file size 439MB), the total time for the system to complete the analysis with the same precision was 1000.037 seconds.

[0119] In other words, regarding the consistency dimension of object reconstruction, the servo object parsing verification results in both scenarios achieved a 9 / 9 pass rate, meaning a consistency of 100.00%. This means that the above test data demonstrates that, regardless of whether the data is complete or partially missing, or whether resources are abundant or limited, the technical solution provided in this application can stably, accurately, and efficiently output traceable diagnostic results, fully meeting the stringent requirements of the industrial automation field for message parsing tools in terms of accuracy, reliability, and engineering adaptability.

[0120] The following is for reference. Figure 9 , Figure 9 A schematic diagram of a communication device suitable for implementing embodiments of this application is shown, such as... Figure 9 As shown, the computer device 900 includes a central processing unit (CPU) 901, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 902 or programs loaded from storage section 908 into random access memory (RAM) 903. The RAM 903 also stores various programs and data required for the system's operating instructions. The CPU 901, ROM 902, and RAM 903 are interconnected via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0121] The following components are connected to the input / output (I / O) interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0122] It should be noted that the computer-readable medium shown in this application may be a computer-readable signal medium or a computer-readable storage medium or any combination thereof.

[0123] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operational instructions of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two connected blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified functions or operational instructions, or using a combination of dedicated hardware and computer instructions.

[0124] The units or modules described in the embodiments of this application can be implemented in software or hardware. The described units or modules can also be located in a processor; for example, a processor can be described as including a mapping module 801, a pairing module 802, and a generation module 803. The names of these units or modules do not necessarily constitute a limitation on the unit or module itself.

[0125] On the other hand, this application also provides a computer-readable storage medium, which may be included in the communication device described in the above embodiments, or may exist independently and not assembled into the communication device. The aforementioned computer-readable storage medium stores one or more programs that, when used by one or more processors, execute the methods described in this application. For example, it may execute... Figure 2 The steps of the method shown are as follows.

[0126] This application provides a computer program product including instructions that, when executed, cause the method described in this application to be performed. For example, it can execute... Figure 2 The steps of the method shown are as follows.

[0127] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the foregoing disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A method for parsing and diagnosing industrial communication messages, characterized in that, The method includes: The process data configuration and memory mapping configuration of the industrial communication message are obtained, and a joint mapping result of object identifier and logical address is constructed based on the process data configuration and the memory mapping configuration; wherein, the process data configuration is used to periodically exchange real-time data between master and slave stations, and the memory mapping configuration is used to map the logical address to the physical object space of the slave station; During the communication operation cycle, the logical read / write request frame and logical read / write response frame of the industrial communication message are matched to obtain the pairing result of the logical read / write request frame and the logical read / write response frame, and a re-pairing operation is performed to update the pairing result when the pairing is abnormal. Based on the joint mapping result and the pairing result, a target frame-level evidence chain is generated according to the target object timeline; wherein, the target object timeline is used to characterize the temporal record of the decoded values ​​of the same object arranged in chronological order, and the target frame-level evidence chain corresponds to the association relationship of frame identifier, logical address, object identifier, and object data content.

2. The method for parsing and diagnosing industrial communication messages according to claim 1, characterized in that, Matching the logical read / write request frame and logical read / write response frame of the industrial communication message includes: In response to the master station sending a target logical read / write request frame to the slave station, a pairing window is set as a time constraint interval using a preset parsing engine, and based on the pairing window, the first frame sequence number of the target logical read / write request frame and the second frame sequence number of the target logical read / write response frame returned by the slave station to the master station are obtained respectively. If the value of the second frame sequence number is the value of the first frame sequence number plus 1, then it is determined that the target logical read / write request frame matches the target logical read / write response frame; wherein, the master station assigns a continuously increasing frame sequence number to each logical read / write request frame according to the sending order.

3. The method for parsing and diagnosing industrial communication messages according to claim 2, characterized in that, If the value of the second frame sequence number is not the value of the first frame sequence number plus 1, or if the target logical read / write response frame is not received within the pairing window, then a pairing anomaly is determined to exist.

4. The method for parsing and diagnosing industrial communication messages according to claim 1, characterized in that, When the process data configuration of the acquired industrial communication message contains abnormal input, the method further includes: Determine if there are any missing configurations in the process data configuration. If so, load external configuration data and re-acquire the process data configuration.

5. The method for parsing and diagnosing industrial communication messages according to claim 1, characterized in that, The process of generating the timeline of the target object includes: According to the preset mapping window, the original data fields of each object are filtered out from the payload of the logical read / write response frame corresponding to the pairing result, and the original data fields are converted into byte order to match the local byte order of the main station. The decoding rules corresponding to each object identifier are invoked to decode the original data fields after byte order conversion, and the decoded data is bound to the timestamp of the current running cycle to generate the timeline of the target object.

6. The method for parsing and diagnosing industrial communication messages according to claim 1, characterized in that, The method further includes: Perform semantic recognition on the timeline of the target object to obtain the semantic tags and physical unit information corresponding to the timeline of the target object; Based on preset change features, the timelines of each target object are filtered, and objects whose preset change features meet preset drawing conditions are identified as key objects, and a drawing task list is generated. Diagnostic charts are output in batches according to the drawing task list; wherein, the preset change feature corresponds to the quantitative index of the data fluctuation degree in the timeline of the target object, and the diagnostic chart represents the trend of the decoded value of each key object changing over time in multiple continuous communication operation cycles.

7. A device for parsing and diagnosing industrial communication messages, characterized in that, The device includes: The mapping module is used to obtain the process data configuration and memory mapping configuration of the industrial communication message, and construct a joint mapping result of object identifier and logical address based on the process data configuration and the memory mapping configuration; wherein, the process data configuration is used to periodically exchange real-time data between master and slave stations, and the memory mapping configuration is used to map the logical address to the physical object space of the slave station; The pairing module is used to match the logical read / write request frame and the logical read / write response frame of the industrial communication message during the communication operation cycle, obtain the pairing result of the logical read / write request frame and the logical read / write response frame, and perform a re-pairing operation to update the pairing result when the pairing is abnormal. The generation module is used to generate a target frame-level evidence chain based on the joint mapping result and the pairing result, according to a preset object timeline; wherein the target frame-level evidence chain corresponds to the association relationship between frame identifier, logical address, object identifier and object data content.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes instructions that, when executed, cause the method as described in any one of claims 1 to 6 to be implemented.

Images