CN109379255B - Intelligent switch based process layer network flow monitoring and early warning method - Google Patents
Intelligent switch based process layer network flow monitoring and early warning method Download PDFInfo
- Publication number
- CN109379255B CN109379255B CN201811520908.XA CN201811520908A CN109379255B CN 109379255 B CN109379255 B CN 109379255B CN 201811520908 A CN201811520908 A CN 201811520908A CN 109379255 B CN109379255 B CN 109379255B
- Authority
- CN
- China
- Prior art keywords
- flow
- message
- theoretical value
- goose
- switch
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/22—Parsing or analysis of headers
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Environmental & Geological Engineering (AREA)
- Computer Security & Cryptography (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Small-Scale Networks (AREA)
Abstract
The invention discloses a monitoring and early warning method based on intelligent switch process layer network flow, which extracts IED equipment message parameter information; extracting VLAN configuration data of a port of the switch; calculating a theoretical value of the flow sent by the IED equipment; calculating a theoretical value of the flow of the port of the switch; receiving a report control block sent by a switch and recording a real-time value of the input flow size of a port of the switch and a real-time value of the output flow size of the port of the switch; and comparing the alarm information and generating the alarm information. The invention monitors the operation condition of the whole process layer network, gives an alarm to the switch port with the flow exceeding the set error range, finds the potential safety hazard of the process layer network in time and is beneficial to the stable operation of the intelligent substation network.
Description
Technical Field
The invention belongs to the field of intelligent substations, and particularly relates to a process layer network flow monitoring and early warning method based on an intelligent switch.
Background
The process layer network is a core part of the whole intelligent substation network, but the monitoring of the flow information of the switch network is always blank, once the network has problems, the positioning time is long, the problem troubleshooting is difficult, and a lot of troubles are brought to operators and maintainers.
With the application of a new switch in an intelligent substation, monitoring information acquired through an SNMP protocol is obtained by modeling the switch and acquiring the switch information in real time through an MMS network, so that monitoring switch equipment is as convenient as monitoring protection equipment.
The invention provides a method for comparing the theoretical flow of the switch port of the process layer network of the intelligent substation with the actual flow of the switch port obtained by real-time monitoring, which monitors the operation condition of the whole process layer network, gives an alarm to the switch port exceeding the set error, finds the potential safety hazard of the process layer network in time and is beneficial to the stable operation of the intelligent substation network.
Disclosure of Invention
The invention aims to provide a process layer network flow monitoring and early warning method based on an intelligent switch, aiming at the problems in the prior art.
The above object of the present invention is achieved by the following technical solutions:
a monitoring and early warning method based on intelligent switch process layer network flow comprises the following steps:
step 1, analyzing an intelligent substation SCD file, and extracting IED equipment message parameter information, wherein the IED equipment message parameter information comprises:
SV sampling frequency values in the control block information are sent by the SVs of all IED equipment;
the GOOSE of all IED devices sends control block information, which includes: heartbeat message interval time T0, fault message transmission interval time T1, fault message transmission interval time T2 and fault message transmission interval time T3;
step 2, analyzing the SCD file of the intelligent substation, extracting VLAN configuration data of the switch ports, and analyzing VLAN values of all the switch ports according to the VLAN configuration data;
step 3, calculating the SV sending flow theoretical value which is SV message length multiplied by SV sampling frequency value;
calculating a theoretical value of GOOSE sending flow which is 2 multiplied by a theoretical value of GOOSE flow with primary fault, wherein the theoretical value of the GOOSE flow with primary fault is the sending frequency of a GOOSE message in a primary fault period and the length of the GOOSE message;
calculating a theoretical value of the magnitude of the flow sent by the IED equipment, namely SV sending the theoretical value of the magnitude of the flow plus GOOSE sending the theoretical value of the magnitude of the flow;
step 4, calculating the flow size theoretical value of the port of the switch,
the theoretical value of the flow of the switch port comprises a theoretical value of the input flow of the switch port and a theoretical value of the output flow of the switch port.
The theoretical value of the flow size input by the switch port is the sum of the theoretical value of the SV sending flow size and the theoretical value of the GOOSE sending flow size corresponding to each IED device and the VLAN value;
the theoretical value of the output flow of the switch port is the sum of the theoretical value of the SV receiving flow and the theoretical value of the GOOSE receiving flow corresponding to the VLAN value of each IED device;
step 5, setting a transmission cycle of a statistical report control block in the switch, sending a statistical message to the outside by the switch according to the statistical report control block, wherein the statistical message comprises a switch port input flow real-time value and a switch port output flow real-time value, receiving the statistical message periodically and recording the switch port input flow real-time value and the switch port output flow real-time value;
step 6, comparing the acquired real-time value of the input flow of the switch port with the calculated theoretical value of the input flow of the switch port, and if the difference value exceeds a set error range, giving alarm information and generating the alarm information; and simultaneously, comparing the obtained real-time value of the output flow of the switch port with the calculated theoretical value of the output flow of the switch port, and giving alarm information and generating the alarm information if the difference value exceeds a set error range.
Compared with the prior art, the invention has the following beneficial effects:
1) calculating a theoretical value of the input flow of the switch port and a theoretical value of the output flow of the switch port, comparing the theoretical values with a real-time value of the input flow of the switch port and a real-time value of the output flow of the switch port obtained by real-time monitoring, and monitoring the operation condition of the whole process layer network;
2) the operation condition of the whole process layer network is monitored, the switch port exceeding the set error range is given an alarm, the potential safety hazard of the process layer network is found in time, and the stable operation of the intelligent substation network is facilitated.
Drawings
FIG. 1 is a distribution diagram of the heartbeat packet interval time T0, the failure packet transmission interval time T1, the failure packet transmission interval time T2, and the failure packet transmission interval time T3 of the GOOSE in the failure state
Detailed Description
The present invention will be described in further detail with reference to examples for the purpose of facilitating understanding and practice of the invention by those of ordinary skill in the art, and it is to be understood that the present invention has been described in the illustrative embodiments and is not to be construed as limited thereto.
As shown in fig. 1, a method for monitoring and early warning network traffic of an intelligent substation includes the following steps:
step 1, analyzing an intelligent substation SCD file, and extracting IED equipment message parameter information, wherein the IED equipment message parameter information comprises:
SV sampling frequency values in the control block information are sent by the SVs of all IED equipment;
the GOOSE of all IED devices sends control block information, which includes: heartbeat message interval time T0, fault message transmission interval time T1, fault message transmission interval time T2 and fault message transmission interval time T3.
The heartbeat message interval time T0 is obtained by a parameter of 'MaxTime' of a GOOSE report control block in an SCD file of the intelligent substation; the fault message transmission interval time T1 is obtained by the MinTime parameter of the GOOSE report control block in the SCD; the value of the fault messaging interval time T2 is 2 times the fault messaging interval time T1; the value of the fault messaging interval time T3 is 4 times the fault messaging interval time T1;
and 2, analyzing the SCD file of the intelligent substation, extracting VLAN configuration data of the switch port, analyzing VLAN values of all the switch ports according to the VLAN configuration data, and generating a mapping information table of the switch ports and the VLAN values.
Step 3, calculating the theoretical value of the flow sent by the IED equipment,
and after the SV message and the GOOSE message are received by the switch, the VLAN values in the SV message and the GOOSE message are analyzed, and the VLAN values are forwarded to the corresponding switch port according to the VLAN values.
Sending a theoretical value of flow size by the IED equipment, namely SV sending the theoretical value of flow size + GOOSE sending the theoretical value of flow size,
the SV sending flow theoretical value is equal to the product of the SV message length and the SV sampling frequency value. The SV message comprises an Ethernet message header, a PDU (protocol data Unit) identifier and an APDU (protocol data Unit), and the length of the Ethernet message header, the length of the PDU identifier and the length of the APDU are added to form the SV message length.
The theoretical value of GOOSE transmission flow is divided into 2 cases of the theoretical value of GOOSE transmission flow in a stable state and the theoretical value of GOOSE transmission flow in a fault state,
the theoretical value of the GOOSE sending flow under the stable state is equal to the product of the GOOSE message length and the heartbeat message interval time T0;
the GOOSE sending flow theoretical value in the fault state is relatively complex, and the sending interval of the first frame GOOSE message and the second frame GOOSE message is fault message transmission interval time T1 in the fault state; the sending interval time of the second frame GOOSE message and the third frame GOOSE message and the sending interval time of the third frame GOOSE message and the fourth frame GOOSE message are the same, and are the fault message transmission interval time T2; the sending interval of the GOOSE message of the third frame and the GOOSE message of the fourth frame is the fault message transmission interval time T3; the GOOSE message interval after the fourth frame GOOSE message is heartbeat message interval time T0.
According to the heartbeat message interval time T0, the fault message transmission interval time T1, the fault message transmission interval time T2 and the fault message transmission interval time T3, the message transmission time interval can calculate the primary fault cycle GOOSE message transmission frequency, and the theoretical value of the primary fault GOOSE traffic is the product of the primary fault cycle GOOSE message transmission frequency and the GOOSE message length (in the process layer, the length of the GOOSE message length is fixed).
When continuous faults occur, the GOOSE message transmission intervals are continuous, and the minimum interval is the minimum value of the inter-frame interval (for a transmission rate of 100M, the minimum value of the inter-frame interval is 96 bits), so that the traffic volume can reach the linear speed.
The sending characteristics of the steady state and the fault state of the GOOSE message are considered comprehensively, a certain margin is considered when the theoretical value of GOOSE sending flow is calculated, and the theoretical value of GOOSE sending flow is set to be 2 multiplied by the theoretical value of GOOSE sending flow with one fault.
And obtaining the theoretical value of the sending flow of the IED equipment of all the IED equipment through calculation.
Step 4, calculating the flow size theoretical value of the port of the switch,
the theoretical value of the flow of the switch port comprises a theoretical value of the input flow of the switch port and a theoretical value of the output flow of the switch port.
The theoretical value of the flow size input by the switch port is the sum of the theoretical value of the SV sending flow size and the theoretical value of the GOOSE sending flow size corresponding to each IED device and the VLAN value;
the theoretical value of the output flow of the switch port is the sum of the theoretical value of the SV receiving flow and the theoretical value of the GOOSE receiving flow corresponding to the VLAN value of each IED device;
therefore, the theoretical value of the input flow of all the ports of the switch and the theoretical value of the output flow of the ports of the switch can be conveniently calculated through the VLAN values of the ports of the switch.
Step 5, acquiring a real-time value of the input flow size of the switch port and a real-time value of the output flow size of the switch port in real time,
and setting a transmission cycle of a statistical report control block in the switch, wherein the switch sends a statistical message outwards according to the statistical report control block, and the statistical message comprises a switch port input flow magnitude real-time value and a switch port output flow magnitude real-time value, so that the statistical message comprising the switch port input flow magnitude real-time value and the switch port output flow magnitude real-time value is sent outwards according to the transmission cycle.
And receiving the statistical message periodically and recording a real-time value of the input flow size of the switch port and a real-time value of the output flow size of the switch port.
Step 6, comparing the real-time values of the flows of the ports of the switch and automatically alarming,
all recorded switch port input flow size real-time values and switch port output flow size real-time values are presented in the form of tables and curves,
comparing the acquired real-time value of the input flow of the switch port with the calculated theoretical value of the input flow of the switch port, and if the difference value exceeds a set error range, giving alarm information and generating the alarm information; and simultaneously, comparing the obtained real-time value of the output flow of the switch port with the calculated theoretical value of the output flow of the switch port, and giving alarm information and generating the alarm information if the difference value exceeds a set error range.
The specific embodiments described herein are merely illustrative of the spirit of the invention. Various modifications or additions may be made to the described embodiments or alternatives may be employed by those skilled in the art without departing from the spirit or ambit of the invention as defined in the appended claims.
Claims (1)
1. A monitoring and early warning method based on intelligent switch process layer network flow is characterized by comprising the following steps:
step 1, analyzing an intelligent substation SCD file, and extracting IED equipment message parameter information, wherein the IED equipment message parameter information comprises:
SV sampling frequency values in the control block information are sent by the SVs of all IED equipment;
the GOOSE of all IED devices sends control block information, which includes: heartbeat message interval time T0, fault message transmission interval time T1, fault message transmission interval time T2 and fault message transmission interval time T3;
step 2, analyzing the SCD file of the intelligent substation, extracting VLAN configuration data of the switch ports, and analyzing VLAN values of all the switch ports according to the VLAN configuration data;
step 3, calculating the SV sending flow theoretical value which is SV message length multiplied by SV sampling frequency value;
calculating a theoretical value of GOOSE sending flow, namely 2 multiplied by a theoretical value of GOOSE flow of a primary fault, wherein the theoretical value of the GOOSE flow of the primary fault is the product of the GOOSE message sending frequency of a primary fault period and the GOOSE message length;
calculating a theoretical value of the magnitude of the flow sent by the IED equipment, namely SV sending the theoretical value of the magnitude of the flow plus GOOSE sending the theoretical value of the magnitude of the flow;
in a fault state, the sending interval between the GOOSE message of the first frame and the GOOSE message of the second frame is the fault message transmission interval time T1; the sending interval of the second frame GOOSE message and the third frame GOOSE message is fault message transmission interval time T1; the sending interval of the GOOSE message of the third frame and the GOOSE message of the fourth frame is the fault message transmission interval time T2; the sending interval of the fourth frame GOOSE message and the fifth frame GOOSE message is the fault message transmission interval time T3; the GOOSE message interval after the fifth frame GOOSE message is heartbeat message interval time T0,
calculating the GOOSE message sending frequency of a primary fault period according to the heartbeat message interval time T0, the fault message transmission interval time T1, the fault message transmission interval time T2 and the fault message transmission interval time T3;
step 4, calculating the flow size theoretical value of the port of the switch,
the theoretical value of the flow of the switch port comprises a theoretical value of the input flow of the switch port and a theoretical value of the output flow of the switch port;
the theoretical value of the flow size input by the switch port is the sum of the theoretical value of the SV sending flow size and the theoretical value of the GOOSE sending flow size corresponding to each IED device and the VLAN value;
the theoretical value of the output flow of the switch port is the sum of the theoretical value of the SV receiving flow and the theoretical value of the GOOSE receiving flow corresponding to the VLAN value of each IED device;
step 5, setting a transmission cycle of a statistical report control block in the switch, sending a statistical message to the outside by the switch according to the statistical report control block, wherein the statistical message comprises a switch port input flow real-time value and a switch port output flow real-time value, receiving the statistical message periodically and recording the switch port input flow real-time value and the switch port output flow real-time value;
step 6, comparing the acquired real-time value of the input flow of the switch port with the calculated theoretical value of the input flow of the switch port, and if the difference value exceeds a set error range, giving alarm information and generating the alarm information; and simultaneously, comparing the obtained real-time value of the output flow of the switch port with the calculated theoretical value of the output flow of the switch port, and giving alarm information and generating the alarm information if the difference value exceeds a set error range.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811520908.XA CN109379255B (en) | 2018-12-12 | 2018-12-12 | Intelligent switch based process layer network flow monitoring and early warning method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811520908.XA CN109379255B (en) | 2018-12-12 | 2018-12-12 | Intelligent switch based process layer network flow monitoring and early warning method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109379255A CN109379255A (en) | 2019-02-22 |
| CN109379255B true CN109379255B (en) | 2021-10-08 |
Family
ID=65374012
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811520908.XA Active CN109379255B (en) | 2018-12-12 | 2018-12-12 | Intelligent switch based process layer network flow monitoring and early warning method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109379255B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111817889A (en) * | 2020-07-02 | 2020-10-23 | 中国南方电网有限责任公司 | Method for positioning connection error of process layer port of intelligent substation |
| CN112073326B (en) * | 2020-07-30 | 2023-05-12 | 许继集团有限公司 | Intelligent substation process layer network data flow control method |
| CN112737859B (en) * | 2021-01-04 | 2023-05-05 | 中车青岛四方车辆研究所有限公司 | Vehicle-mounted flow audit and alarm linkage system and flow abnormality judgment method |
| CN114338096B (en) * | 2021-12-10 | 2023-11-17 | 南京南瑞继保电气有限公司 | Configuration method of process layer isolation device |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101235206B1 (en) * | 2011-01-14 | 2013-02-20 | 정정화 | Apparatus and method for parsing packet |
| CN103378654B (en) * | 2012-04-27 | 2015-06-17 | 南京南瑞继保电气有限公司 | Method for filtering network messages of process level of intelligent substation |
| CN102932167B (en) * | 2012-10-10 | 2015-04-22 | 华南理工大学 | Information stream control method and system for improving relay protection reliability of intelligent substation |
| CN103457791B (en) * | 2013-08-19 | 2016-09-28 | 国家电网公司 | A kind of intelligent substation network samples and the self-diagnosing method of control link |
| CN103595594B (en) * | 2013-12-02 | 2017-04-26 | 中国联合网络通信集团有限公司 | Flow detection method and electronic equipment |
| CN103916292B (en) * | 2014-04-14 | 2017-02-15 | 贵州电力试验研究院 | digital substation switch online monitoring system based on IEC61850 standard |
| CN108494747B (en) * | 2018-03-08 | 2020-11-10 | 上海观安信息技术股份有限公司 | Digital substation flow abnormity detection method, electronic equipment and computer storage medium |
-
2018
- 2018-12-12 CN CN201811520908.XA patent/CN109379255B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN109379255A (en) | 2019-02-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109379255B (en) | Intelligent switch based process layer network flow monitoring and early warning method | |
| CN111143308B (en) | High-low voltage motor data processing method, system and device based on federal learning | |
| CN103457791B (en) | A kind of intelligent substation network samples and the self-diagnosing method of control link | |
| CN108494747B (en) | Digital substation flow abnormity detection method, electronic equipment and computer storage medium | |
| CN104038371B (en) | A kind of electric power communication transmission network adaptive performance acquisition method | |
| CN104779702B (en) | Secondary equipment of intelligent converting station status data alerts methods of exhibiting | |
| CN106953749B (en) | Intelligent substation process level network real-time monitoring method | |
| CN105790990B (en) | A kind of method and its system for supervising adapted telecommunication business | |
| CN103926917A (en) | Intelligent transformer substation master control device testing system and method | |
| CN108092847B (en) | A kind of electric power LTE wireless terminal remote on-line monitoring method | |
| WO2018001326A1 (en) | Method and device for acquiring fault information | |
| CN106533832B (en) | Network flow detection system based on distributed deployment | |
| Das et al. | Process-to-bay level peer-to-peer network delay in IEC 61850 substation communication systems | |
| CN107968486A (en) | A kind of method for scheduling task of intelligent power distribution room monitoring system | |
| CN105629103A (en) | Online monitoring method based on transformer substation operation and maintenance network shutdown | |
| CN105763387A (en) | Network traffic monitoring method and device | |
| CN110289681B (en) | Remote operation modeling and monitoring method and monitoring system for intelligent substation regulation and control | |
| CN103078760A (en) | Online diagnosis method for abnormal network flow | |
| CN102082689A (en) | Method for generating equipment alarm information by adopting asynchronous poling mode | |
| CN107241359A (en) | A kind of software-oriented defines the lightweight network flow abnormal detecting method of network | |
| CN104914328A (en) | Substation online monitoring device fault automatic diagnosis method | |
| CN103326875B (en) | A kind of teleservice performance management method based on thresholding, system and webmaster | |
| CN105388395B (en) | The data transmission method of Traction networks fault localization system based on GOOSE | |
| CN112333163A (en) | Inter-container flow monitoring method and flow monitoring management system | |
| CN105224339A (en) | A kind of multi-threaded pattern alarm window generation method of serving power grid regulation and running |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |