CN101621430A - Portable electric power communication protocol detector and detection method thereof - Google Patents

Abstract

The invention relates to a portable power communication protocol detector and a detection method of the detector, belonging to the technical field of power system communication detection. The detector includes an acquisition device containing a message interceptor and a parallel-to-serial processor arranged in a portable case, and an analysis device containing a CPU, an analysis system, an input device and a display respectively connected to the CPU; message interception The input terminal of the device is connected to the power communication link, and its output terminal is connected in parallel to the input terminal of the parallel-to-serial processor; the output terminal of the parallel-to-serial processor is serially connected to the CPU, the message listener and the parallel-to-serial processor The control terminals of the controllers are respectively connected to the CPU. The detection method initializes the analysis system after configuring the parameters and system files of the detector, and then obtains and displays the analysis results after real-time network analysis and protocol analysis of the intercepted messages of the power communication link. The invention can prevent message loss when detecting electric power communication, so as to realize real and effective detection for electric power communication.

Description

Portable Power Communication Protocol Detector and Its Detecting Method

technical field

The invention relates to an instrument for real-time detection of power system communication and its process, as well as a detection method of the detector, belonging to the technical field of power system communication detection.

Background technique

The current power system has generally adopted automation systems for monitoring, control and scheduling, such as energy management system EMS, substation integrated automation system SCADA, etc. The information source and control of these systems all rely on network communication, and with the implementation and large-scale promotion of digital substations based on the IEC61850 communication system, the traditional control connection of measuring, controlling, measuring current and voltage, circuit breakers and isolating switches through cable connections Blocking, relay protection tripping and closing, starting, blocking and other signals have also been changed to realize through network communication. Therefore, the correct transmission of the network communication of the power automation system is particularly important.

Through the statistical analysis of the operation defects of the power automation system in recent years, it is found that the abnormal operation of the power automation system due to network communication defects is on the rise. This is because: at present, each subsystem in the power automation system often uses different products from multiple manufacturers, and the understanding of the communication protocol by each manufacturer is inconsistent, and the phenomenon of modifying and expanding the protocol for certain purposes is also very common; The ability of each manufacturer to realize the communication protocol is uneven, which leads to the relatively ordinary phenomenon of modifying the program on the project site, and makes the product lack a sufficiently strict testing process to ensure the reliability of communication. As far as the inventor knows, KEMA Consulting Company in the Netherlands is an international authority on standard conformance testing, but it is a laboratory test, which cannot be tested on the engineering site, nor does it have system robustness testing. At the same time, its test cases and engineering The site is not completely consistent, and the product may be modified at the engineering site. Therefore, the test results of KEMA are not enough to guarantee the reliability of communication.

There are many communication failures in the actual operation of the existing power automation system. These communication failures are mainly reflected in the following aspects: the action event record is incomplete during the background monitoring accident, the protection measurement and control device is self-resetting due to communication problems, the communication unit or the background The monitoring function is abnormal or crashes, the data (messages) received by the automation system of the dispatching and unattended centralized control center are incomplete or even lost, the telemetry data changes abnormally, the remote signaling data changes abnormally, and the interlocking failure of the measurement and control device prevents misoperation And the computer network is attacked by viruses and so on. Due to the lack of effective technical means, maintenance personnel can only conduct qualitative analysis on these communication faults, which is not conducive to the safe operation of the integrated automation system.

After searching, it is found that the Chinese patent "Communication Protocol Record Analysis Device and Its Analysis Method" with application number 200610098252.8 discloses a split type communication protocol record analysis device. The communication recorder of the node is composed of an analysis management machine, and a separate Ethernet connection is used between the communication recorder and the analysis management machine; in the protocol recorder, the serial port access module, the Ethernet access module, and the CAN network access module The output terminals of the LONWORK module and the GPS module are respectively connected to the input terminals of the CPU module, the output terminal of the CPU module is connected to the abnormal output module of the device, the input terminal of the large-capacity storage module, and the keyboard display module is connected to the CPU module; The output end is connected to the input end of the protocol analysis device, and the recorded content is analyzed by the protocol analysis management machine. The main steps of the analysis method of the device are: 1) the communication recording module of the communication recorder captures the message of each communication port that needs to be recorded according to the communication configuration file, and saves the original communication message of a communication port every 10 minutes, Produce a recording file; 2) the communication recording module of the communication recorder notifies the uplink communication module after every producing a record file, the uplink communication module will actively communicate with the downlink communication module of the analysis management machine, and upload the record file to the analysis management machine; 3) The downlink communication module of the analysis management machine classifies and stores the record files according to the communication configuration file after receiving a record file completely, and does not analyze the record files at this time, but waits for the user's selection to analyze; 4) when When the user chooses to analyze the communication messages of a certain time period of a certain communication port, the analysis management machine uses the communication configuration file to obtain the corresponding communication parameter information and protocol information when analyzing the message, and automatically calls the corresponding protocol analysis module to analyze Record files, generate analysis results, and format and display the analysis results; 5) The analysis method of the protocol analysis module is to read the original message from the record file according to the format of the message in the protocol, and then analyze the original message according to the protocol. Analyze according to the sequence of bytes and byte combinations, and then analyze the relationship between the message and the message according to the protocol.

The above-mentioned communication protocol record analysis device and analysis method have the following problems:

1) The access modules and memory described in the recorder of the device are connected to the CPU module in parallel. As we all know, the CPU works in serial mode. When multiple access modules transmit messages to the CPU module at high speed at the same time, it will cause message lost. At the same time, the CPU module transmits the messages sent by multiple access modules to the memory for message storage, but the data throughput of the memory is much lower than the rate of the access modules, which will cause message loss during storage. Once the message is lost, the recorded and stored messages will be incomplete, and errors will occur when these incomplete messages are retrieved for analysis after a fault occurs, and the cause of the fault in the message cannot be found at all, so further searches cannot be made And eliminate the corresponding power grid faults, and then cause larger accidents.

2) Some modules described in the device (such as CAN network access module, LONWORK module, etc.) only have general terms, without relevant circuit diagrams and implementation mechanisms, and do not know what the specific structure is, and those skilled in the art cannot rely on the patent file to be produced.

3) The device is a split-type fixed device, and multiple sets need to be arranged in the comprehensive automation system of each transmission and substation, which is costly and inconvenient to move and carry.

4) The device first records and stores each message, and then consults the stored historical message records to analyze the cause of the message failure after a fault occurs. It cannot analyze the message online in real time, and it is difficult to quickly and timely discover the hidden dangers of the accident. Network communication failure and find out the cause of the failure, so in fact, it does nothing to eliminate and avoid the expansion of the real-time power grid failure caused by the hidden network communication failure.

5) The description of the analysis method described by the analysis management machine of the device is vague and unclear. The analysis method "analyzes the message according to the byte and byte combination sequence according to the protocol, and then analyzes the information between the message and the message according to the protocol. It is very incomplete, there is no relationship between bytes and bytes or byte combinations, byte branches, etc.; there is no environmental correlation analysis, protocol compliance analysis, etc. Most of its content is the object to be analyzed and the result of the analysis, and it is difficult for those skilled in the art to effectively analyze the recorded messages according to this analysis method.

Contents of the invention

The technical problem to be solved by the present invention is to propose a portable power communication protocol detector and its detection method that can truly collect and analyze all communication data in the current power automation system; using the detector and its detection method should It can completely collect and analyze all the messages of the power automation system to determine the cause of each message failure and the location of the message failure, so as to facilitate the maintenance personnel to eliminate the grid failure and potential safety hazards corresponding to the message failure in time, thereby improving power automation. The safety and stability of system operation.

In order to solve the above technical problems, one of the technical solutions proposed by the present invention is: a portable power communication protocol detector, including a collection device and an analysis device arranged in a portable case, the collection device contains a message listener and Parallel-to-serial processor, the analysis device contains a CPU, an analysis system, an input device and a display connected to the CPU respectively; the input end of the message listener is connected to the power communication link, and its output end is connected in parallel to the Parallel to the input of the serial processor; the output of the parallel to serial processor is serially connected to the CPU, and the control end of the message listener and the parallel to serial processor are respectively connected to the CPU, the described The analysis system includes an acquisition module for reading the messages of the power communication link from the parallel-to-serial processor, a network analysis module for network analysis of the messages, and a network analysis module for network-analyzed A protocol analysis module for protocol analysis at the application layer of the message, and a scheduling management module for scheduling and managing the modules.

Practice has shown that since the detection of the power communication protocol is to complete the interception of the data of the entire power communication network, the listening network port must work in the promiscuous mode, that is, the listening network port must accept all data streams passing through it, whether it is What format, what address. If the traditional method of directly receiving data by the CPU is used for design, due to the limitation of the CPU on interrupt processing, the system will inevitably lose packets when the amount of network data is large, especially when a large number of small packets are transmitted, and the time stamp of the data packets cannot be accurate. mark. And the detector of the present invention unexpectedly adopts the parallel-to-serial processor to be connected in parallel with the output port of each message listener, so that the message can be buffered before the CPU is input; The traffic is very large, and there is no possibility of loss of each packet before reaching the CPU. At the same time, since the messages of the detector of the present invention are stored after the real-time protocol analysis by the protocol analysis module, even if some messages are lost when the storage rate is slow, the detection and analysis of message faults will not be affected.

In order to solve the above-mentioned technical problems, the second technical solution proposed by the present invention is: a detection method of a portable power communication protocol detector, comprising the following steps:

1) Start the detector, configure the parameters of the power communication link to be detected through the input device and specify in association with a specific protocol and form a system configuration file;

2) The analysis system is initialized, that is, the CPU first loads a scheduling management module, a network analysis module and an acquisition module, and the scheduling management module loads a protocol analysis module according to the system configuration file;

3) The message listener listens to the message of the power communication link, and transmits the message to the parallel-to-serial processor in parallel, and the parallel-to-serial processor receives the message in parallel Add a timestamp, and cache the message after adding the timestamp;

4) the acquisition module reads the cached message from the parallel-to-serial processor, and sends the message to the network analysis module;

5) The network analysis module carries out network syntax and semantic analysis to the message sent into the network analysis module according to the syntax and semantics of each protocol layer of the OSI model until the application layer of the message, and sends the message of the application layer into the protocol analysis module, and send the network syntax and semantic analysis results to the display interface;

6) The protocol analysis module performs protocol syntax and semantic analysis on the message of the application layer according to the protocol syntax and semantics, and sends the protocol syntax and semantic analysis results to the display interface.

The portable power communication protocol detector of the present invention can detect multiple power communication links to be detected online in real time according to the above detection method. When a message fault is found, the cause and location of the communication fault can be found at the first time, in order to eliminate the communication fault in time It provides the possibility to avoid the further expansion of the accident and reduce the impact of communication failure on the normal operation of the power grid.

To sum up, the portable electric power communication protocol detector and its detection method of the present invention not only change the situation of first recording and then analysis adopted by the existing communication protocol recording and analysis device and its analysis method, so that it can perform online real-time analysis of each electric power communication chain. Analyze the messages of the power communication link, and capture the message failure in time; and completely solve the problem of missing messages in the existing communication protocol recording and analysis device, so as to truly realize the complete and effective analysis of the messages of the power communication link.

An improvement of one of the above technical solutions is: the parallel-to-serial processor is an FPGA processor or a plurality of single-chip computers working together.

One of the further improvements of one of the above technical solutions is: the message listener is a switch port image signal message listener, a network signal message listener, a serial port signal message listener and a MODEM carrier signal message listener One of the message listeners, the input end of the message listener is connected to one of the switch communication link, the network communication link, the serial port power communication link and the carrier power communication link.

The further improvement two of one of the above technical solutions is: the message listener is a switch port image signal message listener, a network signal message listener, a serial port signal message listener and a MODEM carrier signal message listener. A text listener, the respective input terminals of the four message listeners are respectively connected to the serial port power communication link, the switch communication link, the network communication link and the carrier power communication link.

A further improvement of one of the above technical solutions is: it also includes a memory, and the analysis system also includes a recording module for transferring the message read by the acquisition module to the memory for storage after being analyzed by the analysis system. In this way, after the message is analyzed by the analysis system, the message is saved, so as to provide valuable on-site operation information in the process of accident recall and inversion, which can play the role of drawing inferences from one instance.

A further improvement of one of the above technical solutions is: the analysis system also includes a statistical analysis module for performing secondary statistical analysis on the analysis results generated by the network analysis module and the protocol analysis module. In this way, the analysis results can be made more intuitive, and it can be observed intuitively that problems can only be discovered after long-term monitoring and formation of value sequences.

A further improvement of one of the above-mentioned technical solutions is: the FPGA processor mainly contains a chip of ALTERA EP3C25Q240, which is connected to the CPU through a Gigabit Ethernet port; the serial port message listener provides RS485, The three-in-one serial port message listener of RS422 and RS232 three kinds of communication interfaces; Described MODEM carrier signal message listener contains the two-way MODEM carrier receiving interface that is used to listen to one modem carrier power communication link, its two The road receiving interface is respectively connected to a pair of receiving and sending lines of the MODEM carrier power communication link; the CPU is an embedded processor whose model is MPC837.

The continuous improvement of one of the above technical solutions is: the input device adopts keyboard, mouse or touch screen input device, the display is a general CRT or liquid crystal display, and the memory is a general SSD hard disk; The total bandwidth of the interface is 400Mbps; the writing speed of the storage is 640Mbps-800Mbps.

One of the improvements of the above-mentioned technical scheme two is:

----Specific protocol association designation in step 1) is to select the grammar model file and semantic model file corresponding to the specific protocol of the power communication link to be detected;

----The protocol analysis module in the 2nd) step is a general module that forms the grammatical and semantic environment of a specific statute through the grammatical model file and the semantic model file and performs grammatical and semantic analysis on the specific statute; loads the statute analysis module It is initialized according to the syntax model file and semantic model file specified in the system configuration file, that is, the protocol layer, syntax analyzer, session channel manager, and semantic analyzer for a specific protocol are generated, and then the protocol layer is organized into a protocol stack, and then Equip each protocol layer with a corresponding syntax analyzer and session channel manager, and then configure a semantic analyzer for each session channel manager;

----The grammatical and semantic analysis of the protocol in the 6th) step is to use a grammatical analyzer to perform grammatical analysis on the message of the application layer in each protocol layer from the bottom layer of the protocol stack upwards, and Pass the obtained syntax analysis tree to the session manager, and the session manager distributes the syntax analysis tree to the semantic analyzers at the receiving and sending ends of the session manager for semantic analysis. The syntax analyzer and the semantic analyzer respectively convert the remaining application layer The message and semantic analysis results are delivered to the upper layer of the protocol stack, and the above process is carried out again by the upper layer until reaching the top of the protocol stack to obtain the analysis result of the application layer message.

The second improvement of the above-mentioned technical scheme two is:

----The association designation in the first step) is to select the protocol analysis module corresponding to the specific protocol of the power communication link to be detected;

----The loading protocol analysis module in the step 2) is based on the protocol analysis module corresponding to the specific protocol specified in the system configuration file; the protocol analysis module forms the syntax and semantic environment of the specific protocol through program design A non-generic module that performs grammatical and semantic analysis of specific protocols;

----The statute syntax and semantic analysis in the step 6) is that the application layer message forms a unit message structure according to the bit of the byte, the bit combination of the byte, the byte or the combination of the byte , then the unit message structure is combined into a compound message structure, and then the relationship between the message structures is parsed to form a parse result, and then the value of the context-related message structure is extracted from the parse result Perform semantic analysis and form a semantic analysis result to obtain the analysis result of the application layer message.

The further improvement of the above-mentioned technical scheme two is:

----The loading network analysis module in the step 2) is to generate protocol layers, syntax analyzers, session channel managers, and semantic analyzers for the OSI model, and then organize the protocol layers according to the OSI seven-layer model into Protocol stack, then equip each protocol layer with a corresponding syntax analyzer and session channel manager, and then configure a semantic analyzer for each session channel manager;

----The network syntax and semantic analysis in the 5th) step is to use a syntax analyzer at each protocol layer from the bottom layer of the protocol stack up to perform syntax analysis on the message sent to the network analysis module, And pass the obtained syntax analysis tree to the session manager, and the session manager distributes the syntax analysis tree to the semantic analyzers at the receiving and sending ends of the session manager for semantic analysis, and the syntax analyzer and the semantic analyzer respectively convert the remaining report The text and semantic analysis results are delivered to the upper layer of the protocol stack, and the above process is carried out again by the upper layer until the application layer of the protocol stack is reached, and the application layer message is sent to the protocol analysis module for protocol analysis, and at the same time Obtain the analysis result of the message sent to the network analysis module.

The further improvement of the above-mentioned technical solution two is: when the analysis system in the 2nd step is initialized, the statistical analysis module is also loaded; the 7th) step is also included, and the network analysis module and the protocol analysis module will analyze the results Send it to the statistical analysis module for statistical analysis. The statistical analysis is to extract the values of part of the message structure in the analysis results to form a chart. After at least two frames of messages, the extracted values are calculated and compared to form a statistical result , and send the statistical results to the display interface. In this way, the user can intuitively observe that it takes a long time to monitor and form a sequence of values before discovering that there is a problem.

The further improvement of the second technical solution is: the syntax analysis model file and the semantic analysis model file are preset or imported into the protocol analysis module through an input device on site.

The further improvement of the above-mentioned technical solution two is: when the analysis system is initialized in the 2nd step, the recording module is also loaded; in the step 4), the recording module analyzes the message read by the acquisition module After system analysis, it is transferred to the memory for storage.

The improvement of the second technical solution is: the scheduling management module sets the working parameters of the message listener and the parallel-to-serial processor according to the system configuration file.

Description of drawings

The portable power communication protocol detector of the present invention will be further described below in conjunction with the accompanying drawings.

Fig. 1 is a structural block diagram of a portable power communication protocol detector according to an embodiment of the present invention.

Fig. 2 is a structural block diagram of the control system in Fig. 1 .

FIG. 3 is one of circuit schematic diagrams of the FPGA processor in FIG. 1 .

FIG. 4 is the second circuit schematic diagram of the FPGA processor in FIG. 1 .

FIG. 5 is a schematic circuit diagram of a mirroring signal packet listener at a switch port in FIG. 1 .

FIG. 6 is a schematic circuit diagram of the network signal packet listener in FIG. 1 .

Fig. 7 is a schematic circuit diagram of the serial port signal message listener in Fig. 1 .

FIG. 8 is one of the schematic circuit diagrams of the MODEM carrier signal message listener in FIG. 1 .

FIG. 9 is the second schematic diagram of the circuit of the MODEM carrier signal message listener in FIG. 1 .

Fig. 10 is a flow chart of the detection method of the portable power communication protocol detector according to the embodiment of the present invention.

Detailed ways

Embodiment one

As shown in Figure 1 and Figure 2, the portable power communication protocol detector of this embodiment includes a collection device 1 and an analysis device 2 arranged in a hand-held case. Acquisition device 1 contains message listener and parallel-to-serial processor; Listener 6 and MODEM carrier signal message listener 7 are composed of four message listeners, and the parallel-to-serial processor is composed of FPGA processor 3. Analysis device contains CPU8, analysis system 11, input device 9 and display 10 connected with CPU8 respectively; Wherein, CPU8 adopts embedded processor (model is MPC8377), input device 9 adopts keyboard, mouse or touch screen input device etc., display 10 adopt general CRT or liquid crystal display. The respective input terminals of the above four message listeners are respectively connected to the exchange communication link 13, the network communication link 14, the serial port power communication link 15 and the carrier power communication link 16, the four message listeners The respective output ends are connected to the input ends of the FPGA processor 3 in parallel. The output end of the FPGA processor 3 is serially connected to the CPU 8 through the gigabit network port, and the respective control ends of the above four message listeners and the FPGA processor 3 are connected to the CPU 8 respectively.

Because the output ends of the above-mentioned four message listeners are respectively connected in parallel to the input ends of the FPGA processor 3, the output rates of the four message listeners are generally ten megabytes or hundreds of megabytes, and the Gigabit network of the FPGA processor 3 The output rate of the port is much higher than the input rate from the four message listeners, and the messages transmitted by the four message listeners are output after being buffered by the FPGA processor, so the four message listeners can be guaranteed All the collected messages can be completely transmitted to the CPU 8 without being lost.

As shown in Figure 2, the analysis system 11 contains: a collection module 17 for reading the message of the power communication link from the FPGA processor 3, a network analysis module 18 for network analysis of the collected message, and a network analysis module 18 for A protocol analysis module 19 that performs protocol analysis on the application layer of the message after network analysis, and a scheduling management module 20 that is responsible for the scheduling and management among the modules.

The portable power communication protocol detector of the present embodiment also includes a memory 21 connected to the CPU 8, and the memory 21 adopts an SSD hard disk (solid state disk). The analysis system 11 also includes a record module 22 for analyzing the messages read by the acquisition module 17 and then transferring them to the memory for storage, and a statistics tool for performing statistical analysis on the analysis results of the network analysis module 18 and the protocol analysis module 19. Analysis module 23.

As shown in Figure 3 and Figure 4, FPGA processor 3 mainly contains the chip U1 that model is ALTERAEP3C25Q240, in this chip U1, switch port image signal message listener 4, network signal message listener 5, serial port signal report After the data collected by text listener 6 and MODEM carrier signal message listener 7 four message listeners is processed inside it, it is transmitted to CPU8 through Gigabit Ethernet port, wherein the Gigabit port of chip U1 The network port is a Gigabit MAC soft core formed internally. The Gigabit MAC soft core is first connected to the Gigabit PHY of the chip U6 (model VSC8601) through its RGMII interface (93 pins to 120 pins), and the conversion of the Ethernet physical layer is realized on the PHY, and then through the first network The isolation transformer T1 and the A port of the first double-connected RJ45 interface J1 (as shown in FIG. 5 ) are connected to the CPU 8 to realize the connection on the physical link.

Switch port image signal message listener 4 as shown in Figure 5, the mirror port (switch communication link 14) of external switch is connected to chip U5 through the second network isolation transformer T2 through the B port of the first double-connected RJ45 socket J1 (Model KS8721BL) on the 100MPHY, after the Ethernet physical layer conversion is realized on the chip U5, the received data is transmitted to the FPGA processor 3 through the standard RMII port for processing. The FPGA processor 3 implements a 100M MAC on its internal BANK3, and then interfaces with the PHY of the chip U5 (as shown in Figure 5) through the RMII port (63-80 pins of the chip U1).

As shown in Figure 6 of the network message listener, the A and B ports of the second double-connected RJ45 socket J2 are respectively used as the input and output ports of the external network (network communication link 15) signal, and the A and B two ports are implemented internally. The physical direct connection can ensure that the normal communication of the external network will not be damaged when listening. The two signals of sending and receiving of the external network are respectively transmitted to the 100M PHY of two chips U3 and U4 (model KS8721BL) through the third and fourth network isolation transformers T3 and T4, and the Ethernet physical layer is realized on the two chips U3 and U4 After the conversion, it is transmitted to the FPGA processor 3 through the RMII port for processing. FPGA processor 3 implements two 100M MACs on its internal BANK1 and BANK2, and communicates with two PHY chips U3 and U4 (as shown in Figure 6) through RMII ports (chip U1 gets 4-22 pins and 38-57 pins) respectively. ) to achieve docking.

As shown in Figure 7, the serial port message listener 6 is a three-in-one serial port message listener, which provides three kinds of communication interfaces of RS485, RS422 and RS232 respectively, and its main function is to realize the voltage level between several serial digital interfaces. Convert and drive, and convert the signal received from the serial port power communication link 13 into a UART signal of uniform TTL level and send it to the FPGA processor 3 for processing. When the serial power communication link 13 that needs to be monitored is the RS485 communication mode, A (RX+) and B (RX-) of the RS485 interface of the external serial device are connected to the chip U8, U9, U10 or U14 (model ADM485AR) respectively. 6, 7 two pins. Chip U8, U9, U10 or U14 outputs the received data to the serial port data receiving end of FPGA processor 3 through its upper pin 1 after completing the RS485 level to TTL level conversion (145, 139, 214, 145, 139, 214, 226 pins); in the RS485 listening mode, the serial port message listener 6 can listen to 4 RS485 serial ports at the same time. When the serial port power communication link 13 to be monitored is in the RS422 communication mode, use two RS485 ports to monitor one external target RS422 link. One RS485 is connected to the two lines Y (TX+) and Z (TX-) of the external target RS422 sending link, and the other RS485 is connected to the two lines A (RX+) and B (RX-) of the RS422 receiving link superior. When the serial port power communication link 13 that needs to be intercepted is in the RS232 communication mode, the serial port message listener 6 uses two RS232 receivers to monitor the two wires for sending and receiving of an external target RS232 link. The receiving end or sending end of the external target RS232 link is connected to the 16-pin of the chip U11 or U12, U13, U15 (model SP3223EEY), after the chip U11 or U12, U13, U15 completes the RS232 level to TTL level conversion , output the received data to the serial port data receiving end of the FPGA processor 3 (on the 144, 142, 216, 230 pins of the chip U1) through the 15 pins on it.

MODEM carrier signal message listener 7 as shown in Figure 8 and Figure 9, MODEM carrier signal message listener 7 provides two-way MODEM carrier receiving interface, can be used for listening to the target link (carrier power communication) of one modem communication link 16). The two receiving interfaces of the MODEM carrier signal message listener 7 are respectively connected to a pair of receiving and sending lines of the target link. Carrier analog signals are coupled and output to modem chips U16 and U17 (model MC145503) through the fifth and sixth isolation transformers T5 and BT5 for demodulation, and then serial-to-parallel conversion is performed through chips U18 and U19 (model 74HC299). The data is then sent to the single-chip microcomputers U20 and U21 (model STC89c51Rc) for decoding, and the decoded data is sent to the FPGA processor 3 for data processing through the respective 11 pins on the single-chip microcomputers U20 and U21 in the form of TTL level serial signals.

The portable power communication protocol detector of this embodiment adopts the FPGA processor 3 to directly realize data recording and buffering at the MAC layer, and exchange data with the CPU 8 through the network cable. There are three important bandwidth indicators, one is the total bandwidth of the listening interface , the second is the writing speed of the hard disk, and the third is the bandwidth of the network cable. To achieve complete and effective detection, the total bandwidth of the listening interface should be smaller than the writing speed of the hard disk, and the bandwidth of the network cable should be greater than the sum of the total bandwidth of the listening network port and the writing speed of the hard disk, with a margin. The bandwidth indicator that present embodiment detector design is: the interface bandwidth of each message listener is 100Mbps (in the time of network storm), then the total interface bandwidth=4*100Mbps=400Mbps of four message listeners; The write speed of the SSD hard disk is 80MB/s-100MB/s, that is, 640Mbps-800Mbps; the network cable bandwidth is Gigabit bandwidth. It can be seen that the designed bandwidth of the detector in this embodiment can meet the requirement of not losing data during detection.

Obviously, the above-mentioned portable power communication protocol detector of this embodiment can be simplified and changed: 1) switch port image signal message listener 4, network signal message listener 5, serial port signal message listener 6 and MODEM carrier signal message listener 7 four message listeners also can only keep one of them, two or three, or increase the message listener of other communication modes; 2) FPGA processor 3 and the concrete circuit configuration of four message listeners are not limited to the circuit structure of the present embodiment; 3) the output end of FPGA processor 3 can also be serially connected with CPU8 by PCI bus or other connection modes; 4) memory 21 And the recording module 22 can also be omitted, and the detector of the present embodiment only performs real-time detection and analysis without recording; 5) the FPGA processor 3 can also be replaced by a plurality of cooperative single-chip microcomputers or other parallel-to-serial processors.

The detection method of the portable power communication protocol detector of this embodiment, as shown in Figure 10, includes the following steps:

1) Start the tester, configure the parameters of the power communication link to be tested through the input device 9 and associate and designate specific protocols to form a system configuration file,

---- Specific association designation is to select the syntax model file and semantic model file corresponding to the specific protocol of the power communication link to be tested,

----Syntactic analysis model files and semantic analysis model files are imported into the tester through preset or on-site input device 9,

----Scheduling management module 20 according to the system configuration file to switch port image signal message listener 4, network signal message listener 5, serial port signal message listener 6 and MODEM carrier signal message listener 7. The operating parameters of four message listeners and the FPGA processor 3 are set;

2) The analysis system is initialized, that is, the CPU 8 first loads the scheduling management module 20, the network analysis module 18 and the acquisition module 17, the recording module 22 and the statistical analysis module 23, and the scheduling management module 20 loads the protocol analysis module 19 according to the system configuration file,

----The specification analysis module 19 is a general module that forms the grammatical and semantic environment of a specific statute through the grammatical model file and the semantic model file and performs grammatical and semantic analysis on the specific statute, that is, there is only one statute analysis module inside the analysis system, different The specification is identified by a syntax model file and a semantic model file,

----loading the network analysis module 18 is to generate protocol layers, syntax analyzers, session channel managers, and semantic analyzers for the OSI (Open System Interconnection) model, and then the protocol layers are organized into protocol stacks, followed by Each protocol layer is equipped with a corresponding syntax analyzer and a session channel manager, and then a semantic analyzer is configured for each session channel manager

---- Loading the protocol analysis module 19 is to initialize according to the syntax model file and semantic model file specified in the system configuration file, that is, to generate the protocol layer, syntax analyzer, session channel manager, and semantic analyzer for the specific protocol, and then Organize the protocol layers into a protocol stack, then equip each protocol layer with a corresponding syntax analyzer and a session channel manager, and then configure a semantic analyzer for each session channel manager;

3) switch port image signal message listener 4, network signal message listener 5, serial port signal message listener 6 and MODEM carrier signal message listener 7 four message listeners communicate through power The link listens to the message of the power communication link, wherein the serial port signal message listener 6 and the MODEM carrier signal message listener 7 (non-Ethernet power communication link message listener) first generate a frame of ether network UDP message, and then use the intercepted message as the application layer of the UDP message, and then the next four message listeners transmit the Ethernet message directly monitored to the FPGA processor 3 in parallel, and the FPGA processor 3 Add time stamps to the messages received in parallel, and cache the messages after adding the time stamps, and cache the messages transmitted by the four message listeners respectively;

4) collection module 17 reads the message of cache from FPGA processor 3, and this message is sent into network analysis module 18, and collection module 17 sends this message into recording module 22 after this message finishes analyzing, records The module 22 transmits the message to the memory 21 for storage;

5) The network analysis module 18 performs network syntax and semantic analysis on the message sent into the network analysis module according to the syntax and semantics of each protocol layer of the OSI model until the application layer of the message, and sends the message of the application layer into the protocol analysis module ,

----Network syntax and semantic analysis is to use a syntax analyzer at each protocol layer to perform syntax analysis on the message sent to the network analysis module 18 from the bottom layer of the protocol stack upwards, and pass the obtained syntax analysis tree to Session manager, the session manager distributes the syntax analysis tree to the semantic analyzer at the receiving and sending ends of the session manager for semantic analysis, and the syntax analyzer and semantic analyzer respectively send the remaining application layer messages and semantic analysis results to The upper layer of the stack is delivered, and the above process is carried out again by the upper layer until the application layer of the protocol stack, the top of the protocol stack or the end of the message) is obtained to the network analysis result of the message sent into the network analysis module 18,

---- Send the application layer message into the protocol analysis module 19 for protocol analysis, and send the network analysis results into the statistical analysis module 23 for statistics and display;

6) The protocol analysis module 19 analyzes the syntax and semantics of the protocol on the message of the application layer according to the syntax and semantics of the protocol,

----The syntax and semantic analysis of the protocol is to use the syntax analyzer to perform syntax analysis on the message of the application layer in each protocol layer from the bottom layer of the protocol stack upwards, and pass the obtained syntax analysis tree to the session manager. The syntax analysis tree is distributed by the session manager to the semantic analyzers at the receiving and sending ends of the session manager for semantic analysis, and the syntax analyzer and the semantic analyzer send the messages and semantic analysis results of the remaining application layers to the protocol stack The upper layer transmits the above process again until it reaches the top of the protocol stack or the end of the message, obtains the protocol analysis result of the application layer message, and sends the protocol analysis result to the statistical analysis module for statistics and display ,

7) The network analysis module 18 and the protocol analysis module 19 send their respective analysis results to the statistical analysis module 23 for statistical analysis, that is, to extract the value of some message structures in the analysis results and make a chart, after at least two frames of messages Calculate and compare the extracted values to form statistical results, and then send the statistical results to the display interface.

Embodiment two

The portable power communication protocol detector of this embodiment is basically the same as that of Embodiment 1, the difference is that the FPGA processor 3 is replaced by a plurality of single-chip microcomputers working together.

The detection method of the present embodiment is slightly different from the first embodiment, and the difference except the same steps is:

1. The specific association designation in step 1) is to select the protocol analysis module 19 corresponding to the specific protocol of the power communication link to be detected;

2. The protocol analysis module 19 in step 2 is a non-universal module that forms the grammatical and semantic environment of a specific statute through program design and performs grammatical and semantic analysis on a specific statute, that is, there are multiple statute analysis modules inside the analysis system, different The specifications of are identified by different specification analysis modules,

3. The loading protocol analysis module 19 in the second) step is based on the protocol analysis module specified in the system configuration file corresponding to the specific protocol;

4. The syntax and semantic analysis of the protocol in step 6) is that the message of the application layer forms a unit message structure according to the bit of the byte, the combination of the bit of the byte, the byte or the combination of the byte, and then the unit message The structure is combined into a compound message structure, and then the relationship between each message structure is grammatically analyzed to form a grammatical analysis result, and then the value of the message structure related to the context is extracted from the grammatical analysis result for semantic analysis and forms a semantic analysis As a result, an analysis result of the application layer packet is obtained.

The detection methods of the portable power communication protocol detectors in the above embodiments can be applied to both online real-time analysis and offline analysis. When performing online real-time analysis, because the message transmitted from the FPGA processor 3 is directly analyzed, it can be found at the first time and quickly find out the cause and location of the message failure through protocol analysis; The analysis module 19 performs real-time protocol analysis and then stores them. Therefore, even if some messages are lost when the storage rate is slow, it will not affect the discovery and analysis of message failures.

In a word, according to the above-mentioned embodiments, the portable power communication protocol detector and its detection method can detect the messages of various existing power communication links without omission, so that it can truly and effectively detect all possible Message faults and their causes and locations, thereby providing guarantee for timely troubleshooting of power facility faults.

The portable power communication protocol detector and its detection method of the present invention are not limited to the specific technical solutions described in the above embodiments, for example, 1) the protocol syntax and semantic analysis of the protocol analysis module can also combine all possible message combinations of the protocol and All possible contexts are listed, and then the message is compared with the listed message combination and context for syntax and semantic analysis; 2) the message can also be stored and then analyzed; 3) non-Ethernet power The message of communication link message listener (serial port signal message listener 6 and MODEM carrier signal message listener 7) also can not be networked; etc. All technical solutions formed by equivalent replacement are within the scope of protection required by the present invention.

Claims (18)

1. portable electric power communication protocol detector, it is characterized in that: comprise the harvester and the analytical equipment that are placed in the portable cabinet, described harvester contains message detectaphone and the parallel serial processor of changeing, and described analytical equipment contains CPU, analytical system, the loader that is connected with CPU respectively and display; The input of described message detectaphone inserts the power communication link, the parallel input that is connected in parallel commentaries on classics serial processor of its output; The output of described parallel commentaries on classics serial processor is connected in series in CPU, described message detectaphone is connected CPU respectively with the parallel control end that changes serial processor, described analytical system contain be useful on from parallelly change acquisition module that serial processor reads the message of described power communication link, be used for to described message carry out network analysis nework analysis module, be used for the application layer of the message behind network analysis is carried out the protocol analysis module of protocol analysis and is used to dispatch and manage the dispatching management module of described module.

2. according to the described portable electric power communication protocol detector of claim 1, it is characterized in that: the single-chip microcomputer that described parallel commentaries on classics serial processor is FPGA processor or a plurality of collaborative works.

3. according to the described portable electric power communication protocol detector of claim 2, it is characterized in that: described message detectaphone is one of switch ports themselves image signal message detectaphone, network signal message detectaphone, rs 232 serial interface signal message detectaphone and MODEM carrier signal message detectaphone, one of the input access switch communication link of described message detectaphone, network communication link, serial ports power communication link and carrier wave power communication link.

4. according to the described portable electric power communication protocol detector of claim 2, it is characterized in that: described message detectaphone is switch ports themselves image signal message detectaphone, network signal message detectaphone, rs 232 serial interface signal message detectaphone and MODEM carrier signal message detectaphone, and the input separately of these four message detectaphones inserts serial ports power communication link, switch communication link, network communication link and carrier wave power communication link respectively.

5. according to the described portable electric power communication protocol detector of claim 4, it is characterized in that: also comprise memory, described analytical system also contains and is useful on the logging modle that message that acquisition module is read is sent to memory stores by analysis after the network analysis.

6. according to the described portable electric power communication protocol detector of claim 5, it is characterized in that: described analytical system also contains and is useful on the statistical analysis module that analysis result that nework analysis module and protocol analysis module are produced carries out the secondary statistical analysis.

7. according to the described portable electric power communication protocol detector of claim 6, it is characterized in that: described FPGA processor mainly contains the chip that model is ALTERA EP3C25Q240, and this chip connects CPU by the Ethernet interface of gigabit; Described serial ports message detectaphone is the three-in-one serial ports message detectaphone that RS485, RS422 and three kinds of communication interfaces of RS232 are provided respectively; Described MODEM carrier signal message detectaphone contains and is useful on two road MODEM carrier wave receiving interfaces of intercepting one road MODEM carrier wave power communication link, and its two road receiving interface respectively and receive on a pair of sending and receiving line of MODEM carrier wave power communication link; Described CPU is that model is the flush bonding processor of MPC837.

8. according to the described portable electric power communication protocol detector of claim 7, it is characterized in that: described loader adopts keyboard, mouse or touch screen loader, and described display is general CRT or LCD, and described memory is general SSD hard disk; The interface total bandwidth of described message detectaphone is 400Mbps; The dish speed of writing of described memory is 640Mbps-800Mbps.

9. detection method according to the described portable electric power communication protocol detector of claim 1 is characterized in that: may further comprise the steps:

1) starts described detector, dispose the related appointment of parameter of power communication link to be detected by described loader and form CONFIG.SYS with specific stipulations;

2) described analytical system is carried out initialization, and promptly described CPU at first loads dispatching management module, nework analysis module and acquisition module, and described dispatching management module reloads the protocol analysis module according to described CONFIG.SYS;

3) described message detectaphone is by intercepting the message of power communication link, and this message is passed in parallel to the parallel serial processor of changeing, described parallel commentaries on classics serial processor was stabbed the message joining day that parallel receive comes, and the message after will stabbing the joining day carries out buffer memory;

4) described acquisition module changes the message that serial processor reads buffer memory from parallel, and this message is sent into nework analysis module;

5) described nework analysis module carries out net grammar and the semantic analysis application layer until this message according to osi model protocal layers syntax and semantics to the message of sending into nework analysis module, and the message of application layer sent into the protocol analysis module, and net grammar and semantic analysis result are sent to display interface;

6) described protocol analysis module is carried out the analysis of stipulations syntax and semantics according to the syntax and semantics of stipulations to the message of described application layer, and stipulations syntax and semantics analysis result is sent to display interface.

10. according to the detection method of the described portable electric power communication protocol detector of claim 9, it is characterized in that:

----the described the 1st) the related appointment of the specific stipulations in the step is the corresponding syntactic model file of specific stipulations and the semantic model file of selection and power communication link to be detected;

----the described the 2nd) the protocol analysis module in the step is to form the syntax and semantics environment of specific stipulations and these specific stipulations are carried out the general module that syntax and semantics is analyzed by syntactic model file and semantic model file; The syntactic model file and the semantic model file that load the protocol analysis module and be according to appointment in the CONFIG.SYS carry out initialization, promptly generate protocol layer, syntax analyzer, session channel manager, semantic analyzer at specific stipulations, subsequently protocol layer is organized as protocol stack,, be each session channel manager configuration semantic analyzer then then for each protocol layer is equipped with corresponding syntax analyzer and session channel manager;

----the described the 6th) the stipulations syntax and semantics analysis in the step is, upwards use syntax analyzer to carry out syntactic analysis at each protocol layer to the message of described application layer successively from the bottom of described protocol stack, and the parse tree that obtains passed to session manager, by session manager the semantic analyzer that parse tree is distributed to session manager reception and transmission two ends is carried out semantic analysis, syntax analyzer and semantic analyzer will remain the last layer transmission to described protocol stack of the message of application layer and semantic analysis result respectively, carry out said process once more by last layer, when top that arrives protocol stack or end of message, obtain the analysis result of described application layer message.

11. the detection method according to the described portable electric power communication protocol detector of claim 9 is characterized in that:

----the described the 1st) appointment of the association in the step is the corresponding protocol analysis module of specific stipulations of selection and power communication link to be detected;

----the described the 2nd) step in loading protocol analysis module be according to appointment in the CONFIG.SYS with the corresponding protocol analysis module of specific stipulations; Described protocol analysis module is to form the syntax and semantics environment of specific stipulations and the non-general module that specific stipulations is carried out grammer and semantic analysis by programming;

----the described the 6th) the stipulations syntax and semantics analysis in the step is, described application layer message forms the unit message structure according to the bit position of byte, bit bit combination, byte or the combination of bytes of byte, the unit message structure is combined into compound message structure again then, again the relation between the described message structure is carried out syntactic analysis and formed the syntactic analysis result, from the syntactic analysis result, extract with the value of context environmental association message structure then and carry out semantic analysis and form semantic analysis result, obtain the analysis result of described application layer message.

12. the detection method according to claim 10 or 11 described portable electric power communication protocol detectors is characterized in that:

----the described the 2nd) the load networks analysis module in the step is, generation is at protocol layer, syntax analyzer, session channel manager, the semantic analyzer of osi model, subsequently protocol layer is organized as protocol stack according to the OSI seven layer model,, be each session channel manager configuration semantic analyzer then then for each protocol layer is equipped with corresponding syntax analyzer and session channel manager;

----the described the 5th) net grammar and the semantic analysis in the step is, upwards use syntax analyzer that the message of sending into nework analysis module is carried out syntactic analysis at each protocol layer successively from the bottom of described protocol stack, and the parse tree that obtains passed to session manager, by session manager the semantic analyzer that parse tree is distributed to session manager reception and transmission two ends is carried out semantic analysis, syntax analyzer and semantic analyzer are respectively with the last layer transmission to described protocol stack of remaining message and semantic analysis result, carry out said process once more by last layer, up to the application layer that arrives protocol stack, when the top of protocol stack or end of message, the application layer message is sent into described protocol analysis module carry out protocol analysis, obtain analysis result simultaneously the message of sending into nework analysis module.

13. the detection method according to the described portable electric power communication protocol detector of claim 12 is characterized in that: when the described the 2nd) analytical system is carried out initialization in the step, also load statistical analysis module; Also include the 7th) step, described nework analysis module and protocol analysis module are given statistical analysis module with analysis result and are carried out statistical analysis, described statistical analysis is that the value with the part message structure in the analysis result extracts the formation chart, the value that will extract behind at least two frame messages is carried out computing and relatively and form statistics, and statistics is sent to display interface.

14. the detection method according to the described portable electric power communication protocol detector of claim 13 is characterized in that: described syntactic analysis model file and semantic analysis model file are pre-if the scene imports in the described protocol analysis module by loader.

15. the detection method according to the described portable electric power communication protocol detector of claim 14 is characterized in that: when the described the 2nd) analytical system is carried out initialization in the step, also load logging modle; In the described step 4), described logging modle is sent to memory stores after the network analysis by analysis with the message that acquisition module reads.

16. the detection method according to the described portable electric power communication protocol detector of claim 15 is characterized in that: described dispatching management module is provided with message detectaphone and the parallel running parameter that changes serial processor according to described CONFIG.SYS.

17. detection method according to the described portable electric power communication protocol detector of claim 10, it is characterized in that: described general module is that described analytical system inside has only a protocol analysis module, and different stipulations identify by syntactic model file and semantic model file.

18 detection methods according to the described portable electric power communication protocol detector of claim 11 is characterized in that: described non-general module is that described analytical system inside has a plurality of protocol analysis modules, and different stipulations are identified by different protocol analysis modules.

19. detection method according to the described portable electric power communication protocol detector of claim 16, it is characterized in that: when described message detectaphone is non-Ethernet power communication link packet detectaphone, at first produce a frame Ethernet UDP message, then with the message of intercepting application layer as the UDP message.

Images