Product Overview

The portable network packet capture and analysis instrument is used for comparative analysis of the characteristics of digital and analog signals in smart substations. It enables effective monitoring, recording, and diagnosis of network packets, allowing early identification of weak links and faulty equipment in the communication network and helping to prevent power system incidents. When a power system fault occurs, it is necessary not only to record raw network packets but also to parse them, reconstructing records of primary‑equipment fault waveforms and secondary‑equipment operating behaviors, thereby facilitating post‑incident analysis and rapid fault‑cause localization.

- The portable network packet capture and analysis instrument employs an embedded real-time operating system, is equipped with at least 1 TB of storage, and interfaces with SV messages transmitted by MUs. It enables analysis of MU amplitude‑frequency and phase‑frequency characteristics, as well as detection of message anomalies—including deviations in sampling counts, transmission frequency jitter, transmission delay discrepancies, and mismatches in ConfRev/DataSet/SVID/MAC entry counts—along with timeout, packet loss, out-of-order delivery, and duplicate frames. It also supports harmonic analysis. Furthermore, it can be directly connected to the substation’s process‑level network and/or station‑control network, receiving all messages from these networks. Process‑level messages primarily include SMV, GOOSE, GMRP, PTP, etc., while station‑control messages encompass MMS, TCP/IP, UDP/IP, NTP/SNTP, FTP, ARP, ICMP, IGMP, and others. The device performs real-time decoding, analysis, and storage of these messages, identifying and flagging various abnormal conditions during real-time decoding—such as frame loss, out-of-order delivery, synchronization drift, timeouts, interruptions, invalid encoding, and sudden traffic spikes—and issuing immediate alerts for detected anomalies. Raw message data can be retrieved and analyzed at any time via the management interface, filtered by event tags.

。

■ Product Features

1. MU Testing

• Hybrid access of digital messages and analog signals

Support Digital messages specified in IEC 60044‑8 or DL/T 860‑9‑2 standards, It supports connectivity and simultaneously performs data acquisition, analysis, and waveform recording, with analog signal sampling at a rate of 500 kHz.

• Voltage and Current Waveform Analysis

It is capable of real-time monitoring of power system data, including RMS values, phase angles, frequency, active power, reactive power, power factor, and the current status of discrete inputs, while also supporting historical data retrieval and query functions.

It enables simultaneous display of both analog and digital signals on the same interface, allows waveform translation or superimposed viewing for analysis, accurately distinguishes subtle differences between the two, and can generate SV deviation analysis reports.

2. Network Status Diagnosis

• Network Port Communication Timeout (Interruption) Alarm

When a traffic‑enabled network port on the collection unit fails to receive any traffic within a specified time period, a network‑port communication timeout (interruption) alarm is triggered.

• Network traffic statistics and traffic anomaly alerts

It can perform traffic statistics on network ports and classify traffic by packet type. When the traffic of a specific type of constant‑rate packets (such as sampled values) deviates by a certain threshold—either increasing or decreasing—the system generates an alert indicating a sudden surge or drop in that traffic category.

• Network Traffic Classification

Substation network messages are primarily categorized into three types: sampled value messages, GOOSE messages, and MMS messages. The transient fault recording and analysis device performs traffic statistics separately for each message category.

3. Network Packet Recording

• It can record all raw messages flowing through the network ports of the recording unit and perform real-time decoding and diagnostics on specific messages with logical relationships, such as sampled-value messages, GOOSE messages, and IEEE 1588 messages.
• Sequence Recording of GOOSE Messages

Each time a GOOSE message is transmitted, its sequence number increments by one; at this point, the GOOSE messages are recorded in sequential order according to their transmission sequence numbers.

• Sampled Value Message Sequence Recording

When transmitting sampled-value messages, each frame carries a sequence number, and the data is recorded in sequential order according to the frame sequence numbers of the sampled-value messages.

• Abnormal Event Sequence Recording

Abnormal messages, such as those with incorrect GOOSE message or sampled value message frame formats, are recorded in event order.

• Exception Message Extraction

For abnormal messages, an anomaly type tag is applied at the time of storage to facilitate rapid retrieval and extraction.

Anomalous messages are logged and tagged with their respective anomaly types, such as frame errors, out-of-order messages, duplicate messages, and timeout errors. During retrieval, queries can be performed quickly by anomaly type.

4. Network Packet Inspection

• Process Layer GOOSE Message Abnormality Check

1. Message Sequence Exception Check

GOOSE message timeout: occurs when the duration exceeds twice the GOOSE message heartbeat interval.

GOOSE message frame loss: The continuity of GOOSE message frame sequence numbers can be used to detect frame loss; if frames are lost, the sequence numbers will be discontinuous.

GOOSE message out-of-order: This refers to a situation where, due to network transmission delays, a later‑sent GOOSE message arrives at the device before an earlier‑sent one.

GOOSE message duplication refers to the consecutive transmission of two GOOSE messages with identical sequence numbers.

For the aforementioned abnormalities, the system will issue real-time alarms.

1. Message Content Exception Check

GOOSE message content validation involves verifying that the APDU and ASDU formats of GOOSE messages comply with the relevant standards. Parameters such as confNo, goRef, datSet, and entriesNum in GOOSE messages are defined in the device’s CID file; the values of these parameters in the transmitted GOOSE message must match those specified in the device’s CID configuration file. If they do not match, it indicates that the content of the transmitted GOOSE message is incorrect.

For the aforementioned abnormalities, the system will issue real-time alarms.

• Process-Level Sampled Value Message Abnormality Check

1. Message Sequence Exception Check

The abnormal states detected include timeout, frame loss, out-of-order delivery, duplication, jitter in transmission intervals, and inconsistency between the two AD converters, among others.

1. Message Content Exception Check

The inspection covers whether the APDU and ASDU formats comply with the standards, and whether parameters such as confNo, svID, datSet, and entriesNum match those specified in the configuration file.

• Abnormality Check of MMS Messages at the Station Control Level

An MMS message anomaly in the station control layer network generally refers to whether the MMS message conforms to the message format defined for each service. If it does not comply with the specified format, an alarm is triggered.

5. Fault Waveform Recording

• Voltage and Current Waveform Recording

The sampled-value messages from the process‑level network are parsed to extract the values of instantaneous sampling points, followed by Fourier analysis and fault‑initiation detection. When a fault occurs in the power system and the fault‑triggering criteria are met, the sampled values and digital switch signals at the moment of the fault are stored and recorded, and graphical analysis software is used to display and analyze the system’s fault waveforms.

• Record of Secondary Equipment Operation Behavior

The GOOSE messages on the process‑level network are parsed to extract switch‑state information. When a change in switch state is detected, the associated sampled‑value messages and GOOSE messages are also parsed, and the sampled values and switch states at the time of the fault are recorded. Graphical analysis software is then used to display and analyze the system’s fault waveforms.

• Waveform Analysis Function

The device outputs transient waveform data, which can be analyzed using our company’s CAAP2008 waveform analysis software—protected by copyright—enabling advanced functions such as single-ended fault location, double-ended fault location, harmonic analysis, impedance analysis, power analysis, vector analysis, differential current analysis, transformer over‑excitation analysis, and non‑periodic component analysis. The built-in formula editor in CAAP2008 provides more than 50 commonly used functions, allowing users to implement custom analysis algorithms.

• Exception Alert

Detailed tag‑based alarms are displayed on the HMI main interface, providing real-time alerts such as message‑content errors, message anomalies, and waveform recording initiation.

6. Data Retrieval and Extraction

Retrieve and extract a list of messages based on criteria such as time period, message type, and message attributes (e.g., anomaly flags, APPID), and display the message content in formats including hexadecimal, waveform, and charts.

7. Data Conversion

The raw packet data can be exported in PCAP format for analysis using popular network packet-capture tools such as Ethereal and Wireshark.

1. The sampled-value messages can be directly exported as COMTRADE‑format files for intuitive waveform analysis.
2. The sampled-value messages can be directly exported in CSV format for analysis in Excel spreadsheet software.
3. Transient waveform data is stored in a resynchronizable fault recording file format and can be exported as a CSV file, facilitating analysis and use in Excel spreadsheet software.
4. The device’s waveform analysis software, CAAP2008, can open COMTRADE-format files of various versions.
5. The device’s message analysis software, ZHNPA, can open both our company’s proprietary ZPKT‑format files and the widely used PCAP‑format files.

■ Product Specifications