KR20200072168A - Method for diagnosis of rtu operation state and rtu monitoring and diagnosing device using the same - Google Patents

Abstract

The present invention relates to a method for diagnosing an RTU operation state and a device for monitoring and diagnosing an RTU using the same. According to an embodiment of the present invention, the method for diagnosing an RTU operation state comprises the steps of: performing an access authentication process for an administrator; collecting and storing DNP packet data in real time based on TAP monitoring by each system section implemented through multiple interface environments if access is authorized to the administrator; and performing protocol analysis for the DNP packet data to provide a result of the protocol analysis to the administrator.

Description

METHOD FOR DIAGNOSIS OF RTU OPERATION STATE AND RTU MONITORING AND DIAGNOSING DEVICE USING THE SAME}

The present invention relates to an RTU operating state diagnosis method and an RTU monitoring and diagnosis apparatus using the same, and more specifically, by implementing a multi-interface environment connecting RTU internal devices, a centralized monitoring control panel, and a higher SCADA, TAP (Test Access Port) ) It is related to RTU operation status diagnosis method and RTU monitoring and diagnosis device using the monitoring method based on real-time protocol analysis of DNP (Distributed Network Protocol) packet data to quickly identify the cause of failure and data loss.

The SCADA system (Supervosory Control and Data Acquisition, SCADA) collects the status information data of a remote device into a remote terminal unit (RTU) (hereinafter referred to as'RTU') using analog or digital signals on a communication path. It refers to a system where the integrated operation center monitors and controls remote devices by receiving, recording, and displaying data.

These SCADA systems are widely used to centrally monitor various types of remote facilities such as water and sewage, transmission and distribution facilities, petrochemical plants, steel plant facilities, and factory automation facilities.

In general, RTU connects a laptop in the field to check the module status and perform DB modification. At this time, when the RTU failure occurs, the administrator accesses the console mode for each device, checks the log, and analyzes the event.

However, in the past, the administrator can not only access the RTU without a separate authentication procedure with a laptop, but also does not manage the change history when changing the RTU DB or setting values.

That is, considering that the notebook is not currently being handled for entry and exit, and data can be leaked when the notebook is lost, and there is no RTU access control, security enhancement measures for security weaknesses of the RTU and console are prepared. Needs to be.

In addition, in the past, real-time monitoring diagnosis for operation management of the SCADA system has not been made. That is, it is difficult to analyze when data transmitted/received between the host and the RTU is missing or abnormal data occurs, and it is difficult to identify the cause when the same fault is reproduced because the RTU communication protocol DNP (Distributed Network Protocol) communication history is not stored. Therefore, a separate protocol analysis device for DNP communication analysis in real time is required for the operation management of the SCADA system.

And, in the case of RTU hardware failure, it does not provide quick failure information.

In other words, the existing RTU internal devices (MPD (Main Processing Device), FPD (Field Processing Device), and IAPD (Intelligent Analog Processing Device)) devices do not provide real-time information on the operation status or failure. Conventionally, it is difficult for the administrator to check the failure event and log by connecting a laptop to the console port for each device of the internal devices of the RTU, and to diagnose failures for the switch hub for lower communication and the boundary clock (BC) for time synchronization.

Therefore, there is a need to prepare a security measure for RTU security vulnerabilities in the past, and there is a need to provide a method to provide real-time monitoring and diagnosis for the management of the SCADA system and to provide quick failure information in case of RTU hardware failure.

Korean Registered Patent Publication No. 10-1741755 (Registration on May 24, 2017)

The object of the present invention is real-time protocol analysis for distributed network protocol (DNP) packet data based on TAP (Test Access Port) monitoring method by implementing a multi-interface environment that connects RTU's internal devices, centralized monitoring control panel, and upper SCADA. It is to provide an RTU operation status diagnosis method and an RTU monitoring and diagnosis device using the same, to quickly identify the cause of a failure or data loss through.

RTU operating state diagnostic method according to an embodiment of the present invention, performing an access authentication process for the administrator; Collecting and storing DNP packet data based on TAP monitoring for each system section implemented in a multi-interface environment in real time when access is granted to the administrator; And performing a protocol analysis on the DNP packet data and providing the result to the administrator.

The step of performing the authentication may be to grant access to an administrator who has completed fingerprint registration through a biometric fingerprint reader, or to grant access to an administrator whose employee ID is authenticated through an employee ID reader.

The system section may be at least one of an upper SCADA and MPD section, a centralized monitoring control panel and MPD section, an FPD and MPD section, and an IAPD and MPD section.

In the system section, an interface for connecting the FPD, the IAPD with the MPD through an OPTICAL TAP, and an interface for connecting the centralized monitoring control panel with the MPD, and the upper SCADA through the UTP TAP with the MPD It may be to configure an interface for connection.

The OPTICAL TAP and the UTP TAP may be capable of adjusting the TAP splitting rate for collecting DNP packet data.

Each of the OPTICAL TAP and the UTP TAP may be configured with a redundant circuit.

The providing step may be to use a protocol analysis tool based on WinPcap when performing protocol analysis of the DNP packet data.

The providing step may be to provide at least one of real-time DNP analysis or past DNP analysis results, real-time event inquiry or past event inquiry results, analog trend editing and inquiry results, and hardware operation status.

An RTU monitoring and diagnostic apparatus according to an embodiment of the present invention, comprising: at least one processor; And a memory for storing computer readable instructions, wherein the instructions, when executed by the at least one processor, cause the RTU monitoring and diagnostic device to perform an access authentication process for an administrator, and the administrator. When access authority is granted, the DNP packet data based on TAP monitoring for each system section implemented through a multi-interface environment is collected and stored in real time, and protocol analysis of the DNP packet data is performed to obtain the result. It may be to provide it to the manager.

According to an embodiment, the administrator further includes an administrator authentication unit for enhancing access security through authorization of the administrator, wherein the administrator authentication unit registers a fingerprint through a biometric fingerprint reader when performing an access authentication process for the administrator. It may be to grant access to the completed manager, or to grant access to the authorized employee through the employee ID reader.

According to an embodiment, the MPD, the FPD, the IAPD, the centralized monitoring control panel, and the upper SCADA to implement a multi-interface environment, and OPTICAL TAP and UTP TAP communication port further comprises; The system section configures an interface for connecting the FPD and the IAPD to the MPD through the OPTICAL TAP, and an interface for connecting the centralized monitoring control panel to the MPD, and the upper SCADA through the UTP TAP to the MPD It may be to configure the interface for the connection.

When the instructions are executed by the at least one processor, the RTU monitoring and diagnosis device may use a WinPcap-based protocol analysis tool when performing protocol analysis of the DNP packet data.

When the instructions are executed by the at least one processor, when the RTU monitoring and diagnosis device provides the protocol analysis result, real-time DNP analysis or past DNP analysis results, real-time event inquiry or past event inquiry results, analog As a result of trend editing and inquiry, it may be to provide at least one of the hardware operation status.

The present invention is implemented by real-time protocol analysis of distributed network protocol (DNP) packet data based on TAP (Test Access Port) monitoring method by implementing a multi-interface environment that connects RTU's internal devices, centralized monitoring control panel, and upper SCADA. It is possible to quickly identify the cause of failure and data loss.

In addition, the present invention not only provides a security measure for RTU security vulnerabilities, but can also monitor and diagnose in real time for the operation management of the SCADA system.

In addition, the present invention may be provided with a method for providing quick failure information in case of RTU hardware failure.

1 is a view showing a system network according to an embodiment of the present invention,
Figure 2 is a view showing the RTU monitoring and diagnosis device of Figure 1,
3 is a view for explaining the communication port of FIG. 2,
FIG. 4 is a view for explaining a main circuit connection state of RTU internal devices through the communication port of FIG. 3;
5 is a view for explaining the connection state of the centralized monitoring control panel through the communication port of Figure 3,
6 is a view for explaining the connection state of the upper SCADA through the communication port of FIG. 3,
7 is a diagram for a method of diagnosing an RTU operating state according to an embodiment of the present invention;
8 is a diagram showing a DNP analysis result screen,
9 is a view showing an event search result screen,
10 is a view showing an analog trend editing screen (a) and an analog trend inquiry screen (b),
11 is a view showing the current state of hardware operation,
12 is a view for explaining the interworking of the RTU simulator,
13 is a view for explaining the operation of the RTU DB.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in the following description and accompanying drawings, detailed descriptions of well-known functions or configurations that may obscure the subject matter of the present invention are omitted. In addition, it should be noted that the same components throughout the drawings are denoted by the same reference numerals as much as possible.

The terms or words used in the present specification and claims described below should not be interpreted as being limited to ordinary or lexical meanings, and the inventor appropriately defines terms as terms for explaining his or her invention in the best way. Based on the principle that it can be done, it should be interpreted as a meaning and a concept consistent with the technical idea of the present invention.

Therefore, the configuration shown in the embodiments and drawings described in this specification is only one of the most preferred embodiments of the present invention, and does not represent all of the technical spirit of the present invention, and can replace them at the time of this application. It should be understood that there may be equivalents and variations.

In the accompanying drawings, some components are exaggerated, omitted, or schematically illustrated, and the size of each component does not entirely reflect the actual size. The present invention is not limited by the relative size or spacing drawn in the accompanying drawings.

When a part of the specification "includes" a certain component, this means that other components may be further included instead of excluding other components, unless specifically stated to the contrary. Also, when a part is said to be "connected" to another part, this includes not only "directly connected" but also "electrically connected" with other elements in between.

Singular expressions include plural expressions unless the context clearly indicates otherwise. The terms "include" or "have" are intended to indicate the presence of features, numbers, steps, actions, components, parts or combinations thereof described in the specification, one or more other features or numbers or steps. It should be understood that it does not preclude the existence or addition possibility of the operation, components, parts or combinations thereof.

Also, the term "unit" used in the specification means a hardware component such as software, FPGA, or ASIC, and "unit" performs certain roles. However, "part" is not meant to be limited to software or hardware. The "unit" may be configured to be in an addressable storage medium or may be configured to reproduce one or more processors. Thus, as an example, "part" refers to components such as software components, object-oriented software components, class components and task components, processes, functions, attributes, procedures, Includes subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, database, data structures, tables, arrays and variables. The functionality provided within components and "parts" may be combined into a smaller number of components and "parts" or further separated into additional components and "parts".

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art to which the present invention pertains may easily practice. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. In addition, in order to clearly describe the present invention in the drawings, parts irrelevant to the description are omitted, and like reference numerals are assigned to similar parts throughout the specification.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

FIG. 1 is a diagram illustrating a SCADA system network according to an embodiment of the present invention, and FIG. 2 is a diagram showing an RTU monitoring and diagnosis apparatus of FIG. 1.

1 and 2, the RTU monitoring and diagnosis apparatus 100 according to an embodiment of the present invention includes internal devices [Main Processing Device (MPD) 11 of the Remote Terminal Unit (RTU) 10] , Field Processing Device (FPD) (12), Intelligent Analog Processing Device (IAPD) (13), Centralized Monitoring Control Panel (20), and realizing multiple interface environments linking the upper SCADA (30), TAP (Test Access Port) ) Through real-time protocol analysis of DNP (Distributed Network Protocol) packet data based on the monitoring method, it is possible to quickly identify causes of failures and data omissions.

Here, the RTU (10) performs remote monitoring, measurement and control of the power system operating facilities, and the MPD (11), which plays a pivotal role of the RTU (10), real-time acquisition of field information, control, and communication with external devices The FPD 12 and the IAPD 13 to be performed are included therein.

To this end, the RTU monitoring and diagnosis apparatus 100 includes at least one processor 110 and a memory 120 for storing computer readable instructions, but is stored in the memory 120 by at least one processor 110. When the instructions are executed, the method of diagnosing the RTU operating state according to an embodiment of the present invention is performed.

In addition, the RTU monitoring and diagnosis apparatus 100 is connected to the MPD 11, the FPD 12, the IAPD 13, which are internal devices of the RTU 10, and the centralized monitoring and control panel 20, and the upper SCADA 30. Communication port 130 for implementing the interface unit environment, administrator authentication unit 140 for enhancing access security through administrator authorization, monitor 150 for displaying processing results according to the RTU operation status diagnosis process, administrator It further includes a keyboard 160 for input. The RTU monitoring and diagnosis device 100 can be mounted on the panel of the existing RTU 10.

3 is a view for explaining the communication port of FIG. 2.

Referring to FIG. 3, the communication port 130 is formed of an OPTICAL TAP 131 and a UTP TAP 132 for analysis of DNP packet data based on TAP (Test Acess Port) monitoring. Here, the OPTICAL TAP (131) is an interface for connecting the FPD (12), IAPD (13) with the MPD (11, see FIG. 4 to be described later), the centralized monitoring control panel 20 for connecting with the MPD (11) An interface (see FIG. 5 to be described later) is provided. In addition, the UTP TAP 132 provides an interface (see FIG. 6 to be described later) for connecting the upper SCADA 30 with the MPD 11.

In addition, the communication port 130 provides a stable operating environment by configuring a network line as a redundant line (i.e., a main line and an auxiliary line), but for convenience of explanation, it is mainly described as the main line. Replace with description.

OPTICAL TAP 131 can be composed of P1~P8 ports, P1~P4 ports are for connecting FPD(12), IAPD(13) to MPD(11), and P5~P8 ports are centralized monitoring control panel (20) is a port for connecting to the MPD (11). In the case of P1 to P4 ports, the P1 and P2 ports are the main lines, and the P3 and P4 ports are the auxiliary lines. For the P5 to P8 ports, the P5 and P6 ports are the main lines, and the P7 and P8 ports are the auxiliary lines. to be.

The UTP TAP 132 may be configured as U1 to U4 ports, and is a port for connecting the upper SCADA 30 with the MPD 11. In addition, U1 and U2 ports are main lines, and U3 and U4 ports are auxiliary lines.

In addition, the communication port 130 may adjust the TAP splitting rate for the collection of DNP packet data. That is, the TAP split ratio may be variously adjusted, for example, 1:99, 30:70, 50:50, etc., and N may range from 0 to 100.

Through this, the processor 110 may perform analysis on DNP packet data based on TAP monitoring. That is, the processor 110 may perform TAP monitoring to collect DNP packet data segmented by the OPTICAL TAP 131 or the UTP TAP 132 in real time.

Here, TAP monitoring does not affect the original network by splitting the light of the optical cable or splitting the signal of the UTP cable, and does not affect the original network even when the TAP power is turned off.

In addition, TAP monitoring has very accurate timing, so there is no packet delay or retransmission, and no addition, omission, or manipulation of packets occurs using the same optical network packet.

And, the TAP monitoring can transmit the abnormal error packet as it is because there is no packet loss, and it can continue to be used without network failure.

FIG. 4 is a diagram illustrating a main line connection state of RTU internal devices through the communication port of FIG. 3.

Referring to FIG. 4, the MPD 11 is connected to the FPD 12 and the IAPD 13 through an optical tap 131 through an optical cable. At this time, the OPTICAL TAP 131 is connected to a switch hub 40 for lower communication.

In this case, the OPTICAL TAP 131 can be applied to the P1 and P2 ports, which are the main lines, and the P1 port is a P1 input port (P1IN) input through the switch hub 40 from the FPD 12 or IAPD 13 ), includes a P1 output port (P1OUT) output to the MPD (11), the P2 port is P2 input port (P2IN) input from the MPD (11), FPD (12) or IAPD (IAPD) through the switch hub 40 13) includes a P2 output port (P2OUT) output.

Accordingly, the P1 port receives DNP packet data destined for the MPD 11 from the FPD 12 or IAPD 13, and the processor 110 receives the DNP packet dividedly received through the P1 port for RTU operation status diagnosis. Analyze the data.

In addition, the P2 port receives and receives DNP packet data destined for the FPD 12 or IAPD 13 from the MPD 11, and the processor 110 receives the DNP packet data dividedly received through the P2 port for RTU operation status diagnosis. Analyzes.

Here, the TAP splitting ratio of the P1 port and the P2 port may be variously adjusted, for example, 1:99, 30:70, 50:50, etc., and N may range from 0 to 100. For example, when the TAP split ratio is 1:99, it means that 1% is collected for DNP packet data analysis, and the remaining 99% is passed through.

5 is a view for explaining a connection state of the centralized monitoring control panel through the communication port of FIG.

Referring to FIG. 5, the MPD 11 is connected to the centralized monitoring control panel 20 through an optical cable through an optical tap 131. At this time, the OPTICAL TAP 131 is connected to the first and second optical conversion converters 51 and 52 for Serial to Fiberoptic.

In this case, the OPTICAL TAP 131 can be applied to the main circuit P5 port and P6 port, and the P1 port is a P5 input port (P5IN) input from the centralized monitoring control panel 20 through the first optical conversion converter 51. ), includes a P5 output port (P5OUT) output to the MPD (11) through the second photo-conversion converter 52, P6 port is P6 input from the MPD (11) through the second photo-conversion converter (52) It includes an input port (P6IN), a P6 output port (P6OUT) output to the centralized monitoring control panel 20 through the first optical conversion converter 51.

Accordingly, the P5 port receives and receives DNP packet data destined for the MPD 11 from the centralized control panel 20, and the processor 110 analyzes the DNP packet data that has been dividedly received through the P5 port for RTU operation status diagnosis. do.

In addition, the P6 port receives and receives DNP packet data from the MPD 11 toward the centralized monitoring control panel 20, and the processor 110 analyzes the DNP packet data that has been partially received through the P6 port for RTU operation status diagnosis. .

Similarly, the P5 port and the P6 port have a TAP split ratio of 1:99, but are not limited thereto and can be adjusted at various ratios.

6 is a view for explaining the connection state of the upper SCADA through the communication port of FIG.

Referring to FIG. 6, the MPD 11 is connected to the upper SCADA 30 through the UTP TAP 132 with a UTP cable.

In this case, the UTP TAP 132 may apply the main line U1 port and the U2 port, and the U1 port is a U1 input port (U1IN) input from the upper SCADA 30 and a U1 output output to the MPD 11 A port U1OUT is included, and the U2 port includes a U2 input port U2IN input from the MPD 11 and a U2 output port U2OUT output to the upper SCADA 30.

Accordingly, the U1 port receives and receives DNP packet data destined for the MPD 11 from the upper SCADA 30, and the processor 110 analyzes the DNP packet data received and received through the U1 port for RTU operation status diagnosis. .

In addition, the U2 port receives and receives DNP packet data destined to the upper SCADA 30 from the MPD 11, and the processor 110 analyzes the DNP packet data received and received through the U2 port for RTU operation status diagnosis.

Similarly, the U1 port and the U2 port have a TAP split ratio of 1:99, but are not limited thereto and can be adjusted at various ratios.

7 is a diagram for a method of diagnosing an RTU operation state according to an embodiment of the present invention.

As described above, when the commands stored in the memory 120 are executed by the at least one processor 110, the RTU monitoring and diagnosis apparatus 100 performs a method of diagnosing an RTU operating state according to an embodiment of the present invention.

First, the RTU monitoring and diagnosis device 100 can be mounted in a free space of the RTU 10 to diagnose the operating state of the RTU 10, and it is preferable to control access by unauthorized persons other than an administrator with access authority.

Accordingly, the RTU monitoring and diagnosis device 100 performs an access authentication process for the administrator before performing RTU operation status diagnosis (S201). At this time, the RTU monitoring and diagnosis device 100 grants access only to an administrator who has completed fingerprint registration through a biometric fingerprint reader interworking with the administrator authentication unit 140, or through an employee ID reader interlocked with the administrator authentication unit 140. Access can be granted only to the administrator whose employee ID is authenticated.

Thereafter, the RTU monitoring and diagnosis apparatus 100 collects or stores DNP packet data based on TAP monitoring for each system section implemented through a multi-interface environment in real time (S202), and real-time for each system section implemented through a multi-interface environment, or Protocol analysis of previously collected DNP packet data is performed (S203).

At this time, the RTU monitoring and diagnosis device 100 is a protocol analysis for the MPD (11), FPD (12), and IAPD (13), MPD (11) control information transmission analysis, FPD (12) and IAPD (13) monitoring information Real-time protocol analysis between reception analysis, MPD (11), FPD (12), and IAPD (13) is performed.

And, the RTU monitoring and diagnosis device 100 is a protocol analysis for the centralized monitoring control panel 20, RTU (10) control information transmission analysis, RTU (10) monitoring information reception analysis, RTU (10) and centralized monitoring control panel (20) ) To perform real-time protocol analysis.

In addition, the RTU monitoring and diagnosis device 100 is a protocol analysis for the upper SCADA 30, RTU (10) control information transmission analysis, RTU (10) monitoring information reception analysis, between the RTU (10) and the upper SCADA (30) Perform real-time protocol analysis.

Here, the RTU monitoring and diagnosis device 100 may apply a WinPcap-based protocol analysis tool (WireShark) configuring an API for capturing network traffic in the network management field. Through this, the RTU monitoring and diagnosis apparatus 100 can extract data packets floating on the network.

Then, the RTU monitoring and diagnosis device 100 provides the protocol analysis result in a state that can be confirmed by the administrator (S204).

At this time, the RTU monitoring and diagnosis device 100 may provide real-time DNP analysis or past DNP analysis results (see FIG. 8). 8 is a view showing a DNP analysis result screen.

That is, in providing real-time DNP analysis or past DNP analysis results, the RTU monitoring and diagnosis device 100 divides four screens and provides a one-to-one matching analysis result for DNP packets between systems. On the four screens, upper SCADA (30) and MPD (11) section analysis, centralized monitoring control panel (20) and MPD (11) section analysis, FPD (12) and MPD (11) section analysis, IAPD (13) and MPD ( 11) Displayed for interval analysis. The RTU monitoring and diagnosis device 100 may be set in units of 5 minutes, 10 minutes, 20 minutes, and 30 minutes when querying or analyzing past DNP analysis results.

In addition, the RTU monitoring and diagnosis device 100 may provide real-time event inquiry or past event inquiry results (see FIG. 9). 9 is a diagram showing an event inquiry result screen.

That is, the RTU monitoring and diagnosis device 100 generates an event when real-time event search or past event search results are different, or when a real-time or past data for each section is different or a mismatch (missing) occurs, and clicks the corresponding event. When it does, it shows the comparison result for the DNP packet of the corresponding section. The event inquiry includes the upper SCADA (30) and MPD (11) sections, the centralized monitoring control panel (20) and MPD (11) sections, the FPD (12) and MPD (11) sections, the IAPD (13) and MPD (11) sections. Shows.

In addition, the RTU monitoring and diagnosis device 100 may provide analog trend editing and inquiry results (see FIGS. 10A and 10B ). FIG. 10(a) is a diagram showing an analog trend editing screen, and FIG. 10(b) is a diagram showing an analog trend inquiry screen.

That is, the RTU monitoring and diagnosis apparatus 100 may set the sampling period for each type of analog trend, or adjust the size of the range of analog values, and designate each group and display it in a statistical record form.

Then, the RTU monitoring and diagnosis device 100 may provide a hardware operation status (see FIG. 11). 11 is a view showing the current state of hardware operation.

That is, the RTU monitoring and diagnosis device 100 configures a GUI screen for a separate hardware device, generates an alarm when the device fails, and displays a blink on the screen. For example, the RTU monitoring and diagnosis device 100 is normal through real-time diagnosis of MPD hardware (power supply, CPU, SIO module), FPD/IAPD hardware (CPU, input/output module), switch hub, and time synchronization device. Indicates whether it works.

Meanwhile, the RTU monitoring and diagnosis device 100 may define analog/digital I/O points in conjunction with the RTU simulator, and perform a virtual I/O test for each point (see FIG. 12). 12 is a view for explaining the interworking of the RTU simulator.

At this time, the RTU monitoring and diagnosis device 100 can store and inquire data about RTU analog inputs and digital input/output points, and store and inquire about various RTU events and alarm information, as the RTU DB is integrated and managed (FIG. 13). 13 is a view for explaining the operation of the RTU DB.

The method according to some embodiments is implemented in the form of program instructions that can be executed through various computer means and can be recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present invention, or may be known and usable by those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CDROMs, DVDs, and magneto-opticals such as floptical disks. And hardware devices specifically configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, etc., as well as machine language codes produced by a compiler.

Although the above description has been described with a focus on the novel features of the present invention applied to various embodiments, a person skilled in the art may have the apparatus and method described above without departing from the scope of the present invention. It will be understood that various deletions, substitutions, and modifications are possible in the form and details of the. Accordingly, the scope of the present invention is defined by the appended claims rather than in the above description. All modifications within the equivalent scope of the claims are covered by the scope of the present invention.

10; RTU 11; MPD
12; FPD 13; IAPD
20; Centralized monitoring control panel 30; SCADA
100; RTU monitoring and diagnosis device 110; Processor
120; Memory 130; Communication port
140; Administrator authentication unit 150; monitor
160; keyboard

Claims (16)

Performing an access authentication process for an administrator;
Collecting and storing DNP packet data based on TAP monitoring for each system section implemented in a multi-interface environment in real time when access is granted to the administrator; And
Performing a protocol analysis on the DNP packet data and providing the result to the manager;
RTU operating status diagnostic method comprising a.
According to claim 1,
The authentication step,
A method of diagnosing the operational status of the RTU, which grants access to an administrator who has completed fingerprint registration through a biometric fingerprint reader, or grants an access to an authorized administrator with an employee ID through an employee ID reader.
According to claim 1,
The system section,
A method of diagnosing the operation status of the RTU, which is at least one of the upper SCADA and MPD sections, the centralized control panel and MPD sections, the FPD and MPD sections, and the IAPD and MPD sections.
The method of claim 3,
The system section,
An interface for connecting the FPD and the IAPD to the MPD through an OPTICAL TAP, and an interface for connecting the centralized monitoring and control panel to the MPD,
A method for diagnosing RTU operation status, which configures an interface for connecting the upper SCADA to the MPD through UTP TAP.
The method of claim 4,
The OPTICAL TAP and the UTP TAP,
A method of diagnosing an RTU operation state in which the TAP splitting rate for collecting DNP packet data is adjustable.
The method of claim 4,
Each of the OPTICAL TAP and the UTP TAP,
A method of diagnosing the operational status of the RTU, which is composed of redundant lines.
According to claim 1,
The providing step,
When performing the protocol analysis of the DNP packet data, RTU operating state diagnosis method using a WinPcap-based protocol analysis tool.
According to claim 1,
The providing step,
A method for diagnosing an RTU operation status that provides at least one of a real-time DNP analysis or a past DNP analysis result, a real-time event inquiry or past event inquiry result, an analog trend editing and inquiry result, and a hardware operation status.
RTU monitoring and diagnostic device,
At least one processor; And
And a memory for storing computer readable instructions.
The instructions, when executed by the at least one processor, cause the RTU monitoring and diagnosis device to:
To perform the access authentication process for the administrator,
When the access authority is granted to the administrator, DNP packet data based on TAP monitoring for each system section implemented through a multi-interface environment is collected and stored in real time,
RTU monitoring and diagnostic device to perform the protocol analysis on the DNP packet data to provide the results to the administrator.
The method of claim 9,
Further comprising an administrator authentication unit for enhancing access security through the authorization of the administrator,
The administrator authentication unit,
When performing the access authentication process for the administrator, the RTU monitoring is to grant access to the administrator who has completed fingerprint registration through the biometric fingerprint reader, or to grant access to the administrator whose employee ID is authenticated through the employee ID reader. Diagnostic device.
The method of claim 9,
The system section,
RTU monitoring and diagnosis device that is at least one of the upper SCADA and MPD sections, the centralized control panel and MPD sections, the FPD and MPD sections, and the IAPD and MPD sections.
The method of claim 11,
The MPD, the FPD, the IAPD, the centralized monitoring control panel, and the upper SCADA to implement a multi-interface interface, a communication port including OPTICAL TAP and UTP TAP;
The system section,
An interface for connecting the FPD and the IAPD with the MPD through the OPTICAL TAP, and an interface for connecting the centralized monitoring and control panel with the MPD,
RTU monitoring and diagnostic device that configures an interface for connecting the upper SCADA to the MPD through the UTP TAP.
The method of claim 12,
The OPTICAL TAP and the UTP TAP,
RTU monitoring and diagnosis device capable of adjusting the TAP splitting rate for collecting DNP packet data.
The method of claim 12,
Each of the OPTICAL TAP and the UTP TAP,
RTU monitoring and diagnosis device consisting of redundant lines.
The method of claim 9,
The instructions, when executed by the at least one processor, cause the RTU monitoring and diagnosis device to:
When performing the protocol analysis of the DNP packet data, the RTU monitoring and diagnosis device that uses a protocol analysis tool based on WinPcap.
The method of claim 9,
The instructions, when executed by the at least one processor, cause the RTU monitoring and diagnosis device to:
When providing the protocol analysis results, the RTU monitoring and diagnosis device provides at least one of real-time DNP analysis or past DNP analysis results, real-time event inquiry or past event inquiry results, analog trend editing and inquiry results, and hardware operation status. .

Images