No. 201 - April 2002 ELECTRAWO R K I N G G R O U P2123052305ACCEPTANCE TESTINGof Digital Control Systems forHV SubstationsWORKI NGGROUP23. 051.IntroductionThe first industrial applications ofDigital Control Systems (DCS) in HV sub-stations go back to the eighties. Since then,the number of DCS in service grows eachyear.On the one hand the functions imple-mented up to now in these new control sys-tems differ little from conventional systems,and on the other hand, the processing andthe exchange of data within the DCS totallydiffer from conventional systems : each pro-cessor in a DCS does the job of several inde-pendent and dedicated units in a conven-tional system, serial links replace classicwiring, signals from the switchyard areacquired once and put at the disposal of thedifferent processors via serial links insteadof being acquired in each of the dedicatedunits. The difference also applies to the waythe systems are tested both during factorytests and on-site.Due to the integration of functions inthe DCS, the issue of availability of the DCSis of a particular importance. As an exam-ple, we can consider switchyard control. Weusually distinguish three command levels:bay level, substation level and remote con-trol centre level. In a conventional system,these three levels are independent. In aDCS, depending on the selected architec-ture for the DCS, the same equipment han-dles the substation level and the interfacefor the remote control centre.This means that the loss of one equip-ment could result in the loss of these twolevels. This issue has to be studied dur-ing engineering and, to confirm systemintegrity, a number of tests have to be car-ried out.The integration of functions in theDCS could give rise to test problems at thetime of later adaptations particularly whenthe operating constraints require all or apart of the installation to be kept in ser-vice during changes.TheseobservationsinducedStudyCommittee 23 Substationsto request theWG to study acceptance tests of DCS ingreater detail.The paper addresses the tests at themanufacturers plant factory acceptancetests as well as the tests on site.2.Functionsimple-mented in the controlsystemFunctions included in the DCS dif-fer little from the conventional systems atthe exception of self checking functionsand automatic switching sequences thatare particular to DCS.3.Comparisonbet-ween ConventionalControl and DigitalControl SystemIt is fundamental to know the internalworkings of the DCS in order to be able tolay down test procedures applicable to thedifferent cases described below. Today, weoftenfindinHVsubstationsadecen-tralised architecture including, at bay level,an acquisition unit and protective relaysconnected with the acquisition unit via aserial link and, at the substation level, acentral unit. The central unit is connectedto all bay units via a serial link. We findin the central unit all functions related tothe substation level, the MMI, the interfaceto the upper level and, in the bay units,all functions particular to the bay.The main feature of conventional sys-tems is the physical independence of thefunctions and the exchanges of informa-tion between the different units via point-to-point electrical links, each link corre-sponding to an information. Conversely,with DCS, we have an integration of func-tions at bay level as well as at substationlevel, plus sharing of the same serial linksbetween the different functions.4. Conventional Con-trol System - Test Pro-cedureIn the tests of conventional controlsystems there is a clear separation betweensubstation control and remote control,usually materialised by a marshalling unit.Tests are based on specifications, requiredfunctionality and drawings. Factory acceptance testsIndividual acceptance tests are per-formed on each unit. This will hardly giverise to problems because each unit per-forms a clearly defined function.L. UYTTERSPROT(Belgium)L. GRAINE(France)W. DIETERLE(Germany)H. NOGUCHI(Japan)R. JEANNOT(France)H. TIMMERMAN(The Netherlands)G. SCANU(Italy)No. 201 - April 2002 ELECTRAWO R K I N G G R O U P 2305232305C O N T I N U E DThe required test means vary fromunit to unit, e.g. for control and protec-tion cubicles, a bay simulator and a testset for analogue signals. The otherunits mimic board, remote control cubicle,etc. requireelementarytestmeanscapable to read or impose the exchangedinformation. Of course, the link betweenthe remote control cubicle and the dis-patchingcentrerequiresothertestmeans. Site acceptance testsSite tests start again with all or a partof the acceptance tests, but this time thecomplete installation from HV appara-tus up to the remote control centre will bechecked. Site tests are aimed basically atchecking the coherence between primaryandsecondaryequipmentaswellasbetweenthedifferentunitsof thesec-ondary installation (already tested duringfactory acceptance tests).5. DigitalControlSystem - Test Proce-dure5.1 General issuesWe distinguish between Functionaltest and Performance tests (control of timedelay for handling information, informa-tion flow, analysis of interference on seriallinks, analysis of the loss of a module, cov-ering of self checking).Testing of the DCS requires on onehand individual functional and perfor-mance tests for DCS, HV apparatus, pro-tection relays, remote control, on the otherhand functional and performance tests ofthe whole system.Individualfunctionalandperfor-mance tests are related to factory accep-tance tests. For the DCS itself they aremainly software tests.Checking of the co-ordination withHV apparatus and other existing equip-ment, if any, are related to site tests.5.2 Different casesFactory and site tests will differ accord-ing to the circumstances and the need tominimise operating constraints : New control system Additionof abay(sparebayornewly added bay) Modification, addition of a func-tion Software evolution general purpose software (e.g.UNIX, Windows) firmware (programming func-tions implemented by the Manu-facturer ) application software (program-ming functions implemented bythe Manufacturer or the User). Modification, addition of a data(database/ wiring)5.3. Factoryacceptancetest - New control system5.3.1Test itemsIn order to reduce site test items, thescope of acceptance test at factory shallcover all the test items except the lim-ited ones that can be executed at siteonly. This means that exceptthe com-bination test with site equipment all thetest items shall be executed at factory.Concerning priority of test items, basicfunctions shall be confirmed first, forexample, telecontrol and local controlcomefirst, andarefollowedbysup-porting systems. See table 1 which givesa list of test items.5.3.2 Testspecificationandenvi-ronment Preparing test specification It is essential for both user andmanufacturer to jointly thoroughlycheck test items and test proceduresin order to avoid omissions and toclear misunderstandings. Test items shall be determined soas to cover entirely the engineeringspecifications. Each test item shall be docu-mented with its purpose, the chec-king method, the assessment crite-ria and the density of recursiveness,e.g. characteristic data collectionunder different application modesand status of operation. Test specification shall be chec-ked before issue by the differentengineering teams : software, hard-ware, design, etc. Alstom (France)No. 201 - April 2002 ELECTRAWO R K I N G G R O U P 2305252305C O N T I N U E D Provision for progress manage-ment, remedymanagementandversion management shall be madein the test specification. Initial state of the DCS shall bestated for each test item. Environmental requirementsforthe tests. Spot tests and new or existingtype-tests. Test environmentTo create a test environment for theDCS as close as possible to the real sub-station, it is preferable to assemble opera-tor console, mimic board and telecontrolequipment at the factory even if they areunder separate contracts. If this is not pos-sible, for the telecontrol equipment forexample, we recommend to use a simu-lator instead.System configuration, equipment andtools which will be used for the acceptancetest are specified.5.3.3.OrganisationTest execution and test managementorganisations are described in a documentmentioning the distribution of the workbetween user and manufacturer, the per-sonwhoisresponsibleforthefactoryacceptance tests and the person from theusers side who has authority for approval.5.3.4 Schedule It is necessary to consider the follow-ing critical periods in the schedule : Possible periods for data amend-ments and software changes that may berequested by the user. Possibleperiodsforsoftwareimprovements following faults detectedduring the tests.Periods for analysisand assessmentof the acceptance tests.5.3.5Test process and reviewTests shall be executed by using ade-quate tools to verify elementary and com-poundfunctionsinshortperiodeffi-ciently. Continuousworkingtests,combined tests and tests outside normalconditionsshallbeexecutedtoobtainhigher quality assurance and reliability.These tests shall be carried out in accor-dance with test specifications. If any testitem differs from the test specifications,the situation shall be documented.The method for processing problemsor questions relating to a test item shall bementioned in the test specification. If soft-ware changes or modifications are neces-sary, the issue shall be clearly understoodby the test team and the related design filesshall be checked by designated people. Thetests after software changes or modifica-tions shall cover all items related with themodified item. Analysis of the results shallinclude measured degree of performance,the decision whether accepted or not, andwill mention tester name, approver nameand date. It is recommended for future sys-tem development to record for each itemthetestprocessdetailssuchasperiod,work-days, problems encountered, soft-ware modification, etc.Test review will take place at the endof each phase, i.e. after combined tests,total system tests and users witness tests,if applicable. This test review will be placedunder the responsibility of the nominatedperson. The test review will be part of theacceptance test report.5.3.6ManagementThe management plan concerns safetyduringfactoryacceptancetests, testprogress, problem processing and systemenvironment. Itwillalsoorganisethemeetings during test periods. Safety man-agement covers safety at the factory relatedtotheuseof temporaryequipment.Progress management monitors and con-trols actual progress compared to planned.Problemmanagementdeterminesthemethods for problem documenting andprocessing.It also addresses the problems of ques-tionable specifications or changes of spec-ifications which arise during tests.System environmental managementdeals with history of change for hardwareand software platform. Software platformcovers application program, facility data,internal data version, system configura-tion, swap file area and process priority,etc.5.4 Site acceptance test -New control systemThe purpose of the site test is not torepeat factory acceptance test but to con-trol the operation of the DCS in reality, i.e.connected to all equipment such as pri-mary equipment, protective relays, tele-control.Thetestitemsshallbefocusedonpower system operation and application,not on software design or manufacturing.At this stage software is considered as ablack box.It is important to have a test documentspecifying the following items: organisation test procedure and environment test items and schedule5.4.1OrganisationThe responsibility of the project leaderconcerns the test document, the organisa-tion of the test team, the execution of thetests and the transfer of the tested systemto the user. The test team includes expertsin DCS, in protections, in primary equip-ment, in telecontrol. This test team may ifneeded be strengthened with experts fromthe manufacturer, depending on the testteams expertise and on the results of fac-tory acceptance test. Another possibility isto call the manufacturer for particulartests. Thetestteamexecutethetestsaccording to the test document.5.4.2Test procedure and environ-mentThe tests are executed on site, i.e. inthe substation. The test procedure dependson the status of the substation. In case ofa replacement of an existing control sys-tem, the switching of the primary equip-ment will be subject to authorisation bythe grid operator. Similarly, precautionsmust be taken when executing tests involv-ing telecontrol.No. 201 - April 2002 ELECTRAWO R K I N G G R O U P 2305272305C O N T I N U E DThe team executes the tests accord-ing to the test document, and tests resultsare recorded in a test file. Faults have to berepaired as soon as possible and the itemstested again.When all items are successfully tested,the user will take over the new installationand put it in service. This last step con-cludes the work of the test team.5.4.3Test items and scheduleThe test document contains a list oftest items. As factory acceptance tests havealready been performed it is not necessaryto repeat all those tests on site. Randomtestsaresufficient. However, itisveryimportant to perform all test items relatedto the working of the DCS in its real envi-ronment, i.e. connected to the H.V. equip-ment, telecontrol, The second objectiveof the site tests is to control the coherencebetween primary and secondary systemsand telecontrol.5.5Addition of a bay5.5.1OverviewTwo cases arise : an additional bay hasalready been planned for in the DCS, thatbay being an already installed spare one,or in the other case the building of a newbay is decided. In the first case, we supposethat the engineering for the (spare) bay hasalready been completed, all equipment isinstalled and all tests have been done.5.5.2Spare bayIn this case, the existing DCS alreadyincludes this bay. During site tests, thespare bay and the related functions anddata were deactivated from DCS and willnow have to be activated. As all tests for thespare bay have already been carried outduring the factory acceptance tests of theexisting DCS, factory acceptance tests forthe spare bay are not required and one canproceeddirectlywiththesitetest. Asalready mentioned in the case of a newDCS, the site tests are aimed at two objec-tives : control the working of the part ofthe DCS relating to the new bay in its realenvironment, and ascertain the coherencebetween primary installation, DCS andtelecontrol.Even in case of a spare bay some re-engineering of the DCS may be necessarydue to evolution or modification of thespecifications.5.5.3Newly added bayIn this case nothing has been foreseenfor the additional bay in the DCS noengineering, no equipment, no test. Theaddition of a bay requires additional hard-ware, adaptation of the existing softwareand extension of the database.Furthermore, this addition has alsorepercussions on substation level compo-nents and functions of the DCS e.g. MMI,telecontrol interface and even on bay levelfunctions of existing bays e.g. substationinterlocking for which additional infor-mation has to be exchanged between bays.The addition of functions will be studiedfurther. Which tests should be done ? Theanswer to this question depends on the con-sequences for the DCS of the addition ofthe new bay. If the database alone has beenmodified, site tests are sufficient becausethe existing bays remain unchanged. Con-versely, in case of software adaptations, theentire DCS should be tested. This is obvi-ously impossible with the existing DCS andthe only option left is that of performingfactory acceptance tests on a reference DCS.The problem is different if the addition ismade by the user. This requires that the usershould have the complete hardware andsoftware description of the DCS in order toevaluate the consequences of the additionof the bay. In this case, he must use his ownreference DCS.Another aspect requires close atten-tion : it is necessary to verify that the designconstraints of the DCS - e.g. maximumnumber of bays, data - are still met whenthe new bay is added.5.6Modification, additionof a functionDifferent cases arise : bay-related func-tion or substation-related function, newfunction or activation of an existing func-tion in the software library. The methodsof testing will depend on the actual case.In case of an entirely new function,tests have to be carried out on a test sys-tem. This test system must be identical tothe existing DCS, this means same hard-ware and same software. For bay-relatedfunctions the test system is composed of abay unit and a central unit. For substation-related functions the test system consistsof acentralunitandanumberof bayunits. After these tests, the new functionscanbeimplementedinthereal BEL Engineering (Belgium)No. 201 - April 2002 ELECTRAWO R K I N G G R O U P 2305292305C O N T I N U E DDCS, where, depending on the local pos-sibilities, somecontroltestscanberepeated.In case of activation of an existingfunction from the software library, we canstart from the hypothesis that the functionhas already been tested during the factoryacceptance tests or, at least that the man-ufacturer has completely tested the func-tion on a similar DCS. It results that com-pletetestsonareferenceDCSarenolonger necessary and the new function canbe directly implemented in the real DCS,forwhichonlysomecontroltestsareneeded. The same reasoning applies to themodification of the configuration of anexisting function.5.7Software updateThere are three kinds of software in aDCS : system software, including firm-ware application software database.The system software is the core of thehardware (computer systems and periph-eral equipment). The basic functionalityof the DCS is roughly dictated by the hard-ware and the system software (real-timeprocessing, database management, I/Oprocessing).The application software is an extrashell around the core. This software allowsthe DCS to execute the functions describedin item 2. It contains a library of functionswhich can be configured for each specificapplication. Thisapplicationsoftwaremostly contains user-friendly languageallowing the user to develop specific func-tions, logic such as automatic switchingsequences, interlockingFinally, the database is the result of theconfiguration of the DCS for a specificsubstation.Software updates apply to the systemsoftware as well as to application software.A new release of system software of appli-cation software must be compatible withtheexistinghardware, softwareanddatabase. It is the manufacturers respon-sibility to manage the various hardware,system software and application softwareversions.What about tests ? From the definitionof system software and application soft-ware, it follows that a new release affectsthe whole DCS. This entails that new testshave to be carried out on a test systemidentical to the existing DCS.5.8Modification, additionof a data(database/wiring)Problems encountered with modifi-cation/addition of a data are generallyrelated to the wiring.When the wiring is changed a test hasto be performed to check the modificationfrom one point before it to one point afterit.When only the database is changed,keyboardingshouldbechecked, com-pleted by a software test or a site test if thedata is used fora function.6. Implications on testequipmentHaving seen what tests to do in dif-ferent cases factory and site acceptancetests, new DCS or modification of an exist-ing DCS we can now analyse the requiredtest equipment.The following questions will help usto select the most appropriate test equip-ment for each application.Some answers depend on the experi-ence of the user with DCS, others on theterms of the contract between the user andthe Manufacturer.Question no. 1 :Test at substation level or at bay level?This choice determines the size of thesimulatorbecausethenumberofInputs/Outputs of the simulator is pro-portional to the number of bays. Techni-cally, tests at the substation level are betterthan tests at the bay level because the DCSwill be tested in working conditions simi-lar to the reality. This is particularly impor-tant for avalanche testing (representingenormous status changes) and for testingfunctionscommontoseveralbays, forexample interlocking, automatism Also,the cost, the size, the complexity of con-necting the simulator increases propor-tionally to the number of Inputs/Outputs.The problems related to configuration ofthe simulator to make it consistent with theH.V. installation must not be overlooked.These different drawbacks have resulted insubstation simulators not being used muchin the case of conventional control systems.Question n 2 :Simulation of the primary equipmentor only reading and imposing inputs/out-puts? This choice determines the func-tionality included in the simulator. In thesecondcase-readingandimposinginputs/outputs - there is no functionalityin the simulator. The simulation of the pri-mary equipment requires functionalitysuch as switch on and switch off with cor-responding feedback signals and realisticresponse time, energy monitoring, simu-lation of abnormalities Question n 3 :Necessity of sophisticated tests likemeasurementof responsetimeof theDCS, simulationof ahighquantityofevents, ?This choice may influence the tech-nology used to build the simulator : it iseasier to generate an avalanche test witha digital simulator than with a relay basedsimulator.Question n 4 :What do we test? (See figure 1) DCS only DCS and remote controlall secondary equipment in the sub-station (except protection relay, auxilia-ries)No. 201 - April 2002 ELECTRAWO R K I N G G R O U P 2305312305C O N T I N U E Dall secondary equipment in the sub-station and remotecontrol.The answer hasimplications on thetest equipment?7. ConclusionsWe recommend to analyse carefullythe problem of overall testing of DCS fromthe very start of engineering because it hasimpacts on engineering, on test equip-ment, on project planning, on the termsof the contract between the Manufacturerand the user.It was not possible to advise a univer-sal method for testing DCS. The reasonsare numerous : different DCS architec-tures, differences in scope - how much isdone by the manufacturer and how muchby the user, different cases - new DCS ina new substation, new DCS in an exist-ing substation, extension of existing DCS,softwareevolution, etc. WehopetheReader will find in this paper enough ideasfor his own application.We can emphasise some significantpoints raised:Importance of a test document des-cribing test specifications, test organisa-tion, test procedure, test schedule. Importance testing all functions,including those that will be used only later,all spare bays. This will make easier the testwhen it will be necessary to put in servicea new function or a spare bay.The need in some cases to have a refe-rence DCS same hardware, same softwareas the real DCS for test purpose. Accordingto the case, this reference DCS will be run bythe manufacturer or by the user.8. References[1] P. Assailly, A. La Rocca, H. Adam,Y. Bonnardot : Procedure for the design,manufacture and commissioning of H.V.and E.H.V substation control systems withinEDF (CIGRE 1992 Report 23-201).[2] R. Cornu-Emieux, M. Rolland :Lutilisation des techniques numriquespour le contrle, la protection et la mesuredansunposteHT/MT(CIGRE1988Report 23-16).[3] J.M. Theunissen, R. Niemack, G.C.Oosthuyse, B. Young : Protection and con-trol testing opportunities for modularisedbay secondary equipment in transportablebay kiosks (CIGRE SC34 1995 - Collo-quium Stockholm Report 34-108).[4] C.G.A Koreman, M. Kezunovic, S.Lemmer, A. Newbould : Configuration etintgrationducontrle-commandedespostes (CIGRE 1996 Report 34-106).[5] F.L. Baldinger, N.J.A. Duindam, E.van der Helm, H. Timmerman : Impactof a Substation Automation System (SAS)on engineering, management, maintenanceand required educational level of utility staff(CIGRE SC 34 1993 Colloquium Antwer-pen) ConsequencesWhat do we test ? Place where to connect Functionality to includethesimulator in the simulatorDCS only DCS only via connectors inreplacement ofthelinks with the bay via test cards in the DCSSimulation of primary equipment secondary equipment installedbetween DCS and primary equip-mentOronlyreadingoutputsandimposing inputsDCS and remotecontrolsame as DCS only same as DCS onlySecondary equipment At the interface between primaryand secondary equipmentSimulation of primary equipmentOronlyreadingoutputsandimposing inputsSecondary equipmentand remote controlsame as Secondary equipment same as Secondary equipmentRemote ControlProtectionsOtherfunctionsoutsideDCSBay computerCentral UnitDCSRemote controlcenterSubstation levelBaylevelControl &ProtectionCubicleH.V. switchgearFIGURE 1