SELF TESTING & DIAGNOSTICS

The relay includes a number of self-monitoring functions to check the operation of its hardware and software when it is in service. These are included so that if an error or fault occurs within the relay’s hardware or software, the relay is able to detect and report the problem and attempt to resolve it by performing a re-boot. This involves the relay being out of service for a short period of time which is indicated by the ‘Healthy’ LED on the front of the relay being extinguished and the watchdog contact at the rear operating. If the restart fails to resolve the problem, then the relay will take itself permanently out of service. Again this will be indicated by the LED and watchdog contact.

If a problem is detected by the self-monitoring functions, the relay attempts to store a maintenance record in battery backed-up SRAM to allow the nature of the problem to be notified to the user.

The self-monitoring is implemented in two stages: firstly a thorough diagnostic check which is performed when the relay is booted-up, e.g. at power-on, and secondly a continuous self- checking operation which checks the operation of the relay’s critical functions whilst it is in service.

5.1 Start-up self-testing

The self-testing which is carried out when the relay is started takes a few seconds to complete, during which time the relay’s protection is unavailable. This is signalled by the ‘Healthy’ LED on the front of the relay which will illuminate when the relay has passed all of the tests and entered operation. If the testing detects a problem, the relay will remain out of service until it is manually restored to working order.

The operations that are performed at start-up are as follows: 5.1.1 System boot

The integrity of the flash EPROM memory is verified using a checksum before the program code and data stored in it is copied into SRAM to be used for execution by the processor. When the copy has been completed the data then held in SRAM is compared to that in the flash EPROM to ensure that the two are the same and that no errors have occurred in the transfer of data from flash EPROM to SRAM. The entry point of the software code in SRAM is then called which is the relay initialisation code.

5.1.2 Initialisation software

The initialisation process includes the operations of initialising the processor registers and interrupts, starting the watchdog timers (used by the hardware to determine whether the software is still running), starting the real-time operating system and creating and starting the supervisor task. In the course of the initialisation process the relay checks:

• the status of the battery.

• the integrity of the battery backed-up SRAM that is used to store event, fault and disturbance records.

• the voltage level of the field voltage supply which is used to drive the opto-isolated inputs.

• the operation of the LCD controller.

• the watchdog operation.

At the conclusion of the initialisation software the supervisor task begins the process of starting the platform software.

5.1.3 Platform software initialisation & monitoring

In starting the platform software, the relay checks the integrity of the data held in E2PROM with a checksum, the operation of the real-time clock, and the IRIG-B board if fitted. The final test that is made concerns the input and output of data; the presence and healthy condition of the input board is checked and the analogue data acquisition system is checked through sampling the reference voltage.

At the successful conclusion of all of these tests the relay is entered into service and the protection started-up.

5.2 Continuous self-testing

When the relay is in service, it continually checks the operation of the critical parts of its hardware and software. The checking is carried out by the system services software (see section on relay software earlier in this chapter) and the results reported to the platform software. The functions that are checked are as follows:

• the flash EPROM containing all program code and language text is verified by a checksum.

• the code and constant data held in SRAM is checked against the corresponding data in flash EPROM to check for data corruption.

• the SRAM containing all data other than the code and constant data is verified with a checksum.

• the E2PROM containing setting values is verified by a checksum.

• the battery status.

• the level of the field voltage.

• the integrity of the digital signal I/O data from the opto-isolated inputs and the relay contacts is checked by the data acquisition function every time it is executed. The operation of the analogue data acquisition system is continuously checked by the acquisition function every time it is executed, by means of sampling the reference voltages.

• the operation of the IRIG-B board is checked, where it is fitted, by the software that reads the time and date from the board.

In the unlikely event that one of the checks detects an error within the relay’s subsystems, the platform software is notified and it will attempt to log a maintenance record in battery backed-up SRAM. If the problem is with the battery status or the IRIG-B board, the relay will continue in operation. However, for problems detected in any other area the relay will initiate a shutdown and re-boot. This will result in a period of up to 5 seconds when the protection is unavailable, but the complete restart of the relay including all initialisations should clear most problems that could occur. As described above, an integral part of the start-up procedure is a thorough diagnostic self-check. If this detects the same problem that caused the relay to restart, i.e. the restart has not cleared the problem, then the relay will take itself permanently out of service. This is indicated by the ‘Healthy’ LED on the front of the relay, which will extinguish, and the watchdog contact which will operate.