Home

PACiS SYSTEM - Schneider Electric

1. Master clock GPS radio 1 0 CT VT Legacy bus i 4 IED s Functional Description PACIS EN FT C80 PACIS System Page 33 38 4 PACIS ETHERNET NETWORK ARCHITECTURES SYMBOLIC USED TO THE FOLLOWING SHEMES Optical Ethernet Link 100 Mbs Electric Ethernet Link 10 or 100 Mbs Double Electric Ethernet Link 10 or 100 Mbs double Link for other network from Ethernet S0413ENa 4 1 Simple star network Ethernet convertor Electrical optical Optical fibre C264 with SWU200 IED1 S0414ENa PACIS EN FT C80 Page 34 38 4 2 Redundant optical ring network Redundant Rail DIN Switch MiCOM H35 Redundant Rail DIN Switch MiCOM H35 Redundant Rail DIN Switch MiCOM H35 Functional Description PACIS System S0415ENa Functional Description PACIS System Use of double ring PACIS EN FT C80 Page 35 38 In order to optimise the data flow on the network this one is split in more than one ring The link between the rings is made by two switches Redundant Rail DIN Switch MiCOM H35 Redundant Rail DIN Switch MiCOM H35 Redundant Rail DIN Switch MiCOM H35 Redundant C264 switch SW R200 Redundant Rail DIN Switch MiCOM H35 S0416ENa PACIS EN FT C80 Functional Description Page 36 38 PACIS System 4 3 Dual Homing network S0417ENa The Dual Homing architecture can also be used with a ring architecture with additional electrical optical Et
2. O1 O1 dl O1 a O1 di PACIS EN IT C80 Introduction Page 2 6 PACIS SYSTEM BLANK PAGE Introduction PACIS EN IT C80 PACIS SYSTEM Page 3 6 1 INTRODUCTION 1 1 Scope of the document This version of the PACIS documentation refers to version PACIS V4 8 This document is a chapter of PACIS System documentation binders It introduces the user to the PACIS system and its elements documentation 1 2 Introduction to PACIS PACIS offers a flexible answer to electrical substation Protection Automation Control and Monitoring requirements PACIS is designed for new and retrofit application cases with dedicated features enabling an easy system extension and a minimization of outage time during retrofit PACIS is based on a unique configurable architecture in term of functions performances and physical distribution within one or several substations The PACiS System architecture is always based on a Station Bus IEC61850 to which is connected equipment used for the customer solution Vi Maintenance Specialist WEB access Il SCADA Infertoca DMP3 IEC 808705 Lasa Es Oster Equipmen ii Ran 50620ENa This equipment includes e the Operator Workstation s Local HMI of the site PACIS Ol e the Computers MiCOM C264 or C264P with feeder protection the SCADA gateway PACiS GTW based on the MiCOM A300 PC e the Ethernet switches MiCOM H The Station Bus is based on the IEC61850 protocol over an Ethernet TCP
3. DPS 1 Jammed and DPSP 1 Open items gt In the DATA BASIS or GRAVITY BASIS only the first state is visible as an OPC item According to the example you will see only the DPS 1 Open item Connection between ALERT and PACIS alarms This phase occurs at run time when both the PACIS Ol server and ALERT have been launched NOTE ALERT may be started automatically by the way of Windows Start Program Startup The main activity consists in setting in ALERT the list of PACIS alarms to be notified Here the name described in 7 2 is used ALERT allows to enter Tags refer to tte ALERT user manual for detailed information on how to configure it In our case they correspond to the PACIS alarms PACIS EN IN C80 Installation Page 28 40 PACIS SYSTEM For all Tags add a tag x ODE OPC External C Other Server USE Dpc5Server DE Topic Item Site 1 Subst 1 LocRemSubstation il OR Cancel select OPC computer name of computer which supports the Ol server server always S2K OpcServer item 2 ways are possible to enter the item name 1 using the created ASCII file see 9 1 add MainAlarmState at the end of each OPC variable in the ASCII file then copy each line in the Item box 2 using the ALERT browser Architecture E LacRemSubstation 1 l Closed Open name Fath StateMessage Severity Security Areal ame Type ame LastAlarmState
4. For details refer for example to http www laboratoire microsoft org articles win tse2003 8 2 3 2 Users properties Select the server icon Right click Manage a console shows m Computer Management 4 Oj x m File Action wiew Window Help ENEE Computer Management Local Full Name Description El ji System Tools 7 Administrator Built in account for administering tr E a Event Viewer BE Guest Built in account for guest access to go Shared Folders BE suPPORT_38 CN Microsoft Corporation This is a vendor s account For the H Ea Local Users and Groups Device Manager a Performance Logs and Alert Storage Removable Storage A Disk Defragmenter 4 Disk Management a Services and Applications To display the users list click Local Users and Groups Users Installation PACIS EN IN C80 PACiS SYSTEM Page 39 40 Select a user To display the user s properties right click Properties Fill in the tabs that follow Administrator Properties EIES Administrator Properties 1x General Member Of Profile Environment Sessions Remote control Terminal Services Profile Dial in Remote control Terminal Services Profle Dian General MemberOf Profile Environment Sessions Use this tab to configure Terminal Services remote control settings Use this tab to configure the Terminal Services startup environment These settings override client specified settings To remotely contr
5. 3 6 Windows Components Ca NetMeeting Internet Explorer 3 Application Compatibility Event Viewer J Internet Information Ser CA Security Center 3 Task Scheduler Y Terminal Services J Windows Explorer J Windows Installer 3 windows Messenger Ex windows Media Digital Ric J windows Movie Maker J Windows Update J Windows Media Player CA System H Network QQ Printers E KR User Configuration CA Software Settings C Windows Settings I Remote Installation Services Settin Client Server data redirection Encryption and Security Licensing Temporary folders client session Directory sessions Eu Keep Alive Connections En Automatic reconnection Es Restrict Terminal Services users to a single remote session force Removal of Remote Desktop Wallpaper Sl Deny log off of an administrator logged in to the console session Eu Limit number of connections El Limit maximum color depth Eu Allow users to connect remotely using Terminal Services El Do not allow local administrators to customize permissions Sl Remove Windows Security item from Start menu oe Remove Disconnect option From Shut Down dialog El Always show desktop on connection El Set path for TS Roaming Profiles En Use the specified Terminal Server license servers Eu Set the Terminal Server licensing mode El Show Tooltips for Licensing problems on Terminal Server El TS User Home Directory a i A
6. 5 5 2 Settings as a service 6 NETWORKS INSTALLATION 6 1 Legacy Bus installation 6 2 Station Bus installation 6 3 Telecontrol Bus installation PACIS EN IN C80 Page 1 40 o O1 JJ JO O O oo 0 10 11 11 12 12 13 13 13 14 17 17 17 18 19 20 21 24 24 24 24 PACIS EN IN C80 Page 2 40 7 NON PACIS DEVICES INSTALLATION 7 1 PACIS OI printer 7 2 MiCOM C264 printer 7 3 PACiS System Master clock 8 NON PACIS APPLICATIONS INSTALLATION 8 1 ALERT Software 8 1 1 Identification of the PACIS alarms to be notified 8 1 2 Connection between ALERT and PACIS alarms 8 1 3 ALERT configuration for SMS 8 2 Setting up a remote terminal Windows Terminal Service 8 2 1 Architectures 8 2 2 WTS Server installation Windows Server 2003 8 2 3 Terminal Server services configuration Windows Server 2003 8 2 4 Users statement in Active Directory 8 2 5 Connection to the Domain Controller in Administrator mode Installation PACIS SYSTEM 25 25 25 25 26 26 26 27 28 33 33 33 34 36 38 Installation PACIS EN IN C80 PACIS SYSTEM Page 3 40 1 INTRODUCTION 1 1 Scope of the document This document is a chapter of the PACIS System documentation It describes the global system installation with reference to each IN installation chapter of the system devices These references are described in the chapter PACIS System IT Introduction Reference of non PACIS equipment is made he
7. CURRENT for the two databases e Status of each configured board MISSING PRESENT CONFIGURED NOT CONFIGURED FAULTY OK o Address of each board e Status ON OFF of the inputs of the configured BIU DIU and CCU boards e Status OPEN CLOSE of the outputs of the configured BIU DOU and CCU boards Number of operating hours C264 synchronisation status and IRIG B status e List of all IED configured with IED address and the legacy bus status CONNECTED DISCONNECTED Status of the binary inputs e Value and status of the measurements e Status of the counters Status of the TPI PACIS EN FT C80 Functional Description Page 28 38 PACIS System 2 12 PACiS Watch 2 12 1 Role 2 12 2 2 12 2 1 The function of PACIS Watch client is to launch and to watch the OI Client The function of PACIS Watch server is to launch and to watch the following tools the system tools that are the main components of PACIS Ol server agency Ol Server SMT_kernel and few other processes to be defined by the user and considered as essential the secondary tools additional processes with less importance than the previous ones that the user wants to be started also at each time his application starts or at each PC boot In event of crash of a system tool PACIS Watch restarts it automatically But the event of more than a predefined number of crashes by default 3 inside a predefined duration by default 1 ho
8. PACIS EN LX C80 Lexical Page 2 1 4 PACIS SYSTEM BLANK PAGE Lexical PACIS EN LX C80 PACIS SYSTEM Page 3 14 1 SCOPE OF THE DOCUMENT This document is the last chapter of each PACIS documentation It is the lexical PACiS EN LX C80 Lexical Page 4 1 4 PACIS SYSTEM 2 LEXICAL gt O Alternating Current Accl ACSI Accumulator Input Abstract Communication Service Interface Mapping from the standard IEC61850 abstract specification of communication service to a concrete communication infrastructure based on CORBA specific Analog Digital A gt U O Analogue to Digital Converter AE qualifier Application Entity qualifier Used internally by IEC61850 to identify a server Application gt Analogue Input Measurement Value including state attribute Commonly Voltage or current DC signals delivered by transducers and representing an external value refer to CT VT for AC AIS Air Insulated Substation AIU Analogue Input Unit Computer C264 Board name for DC Analogue Input Alarm An alarm is any event tagged as an alarm during configuration phase gt O Analogue Output Value corresponding to a desired output current applied to a DAC gt O P Analogue Output Unit computer C264 board name for Analogue Output gt Application Programming Interfaces Auto Reclose gt I ep I gt ep mM Auto Recloser E ASCII ASDU Application Specific Data Unit
9. suppressed SBO Select Before Operate A control made in two steps selection and execution Selection phase give a feedback It can be used to prepare reserve during time configure circuit before execution Controls are done into a protocol or physical DO select with DI Select then DO execute S BUS Station Bus federal network between PACIS devices SCADA Supervisory Control And Data Acquisition Equivalent to RCC CD Description file extension SCE CE System Configuration Editor ep il CL substation automation System Configuration Language IEC 61850 6 SCP Substation Control Point Name given to the device or part used to control locally several bays or sub station Usually associated with Remote Local sub station control It is commonly PACIS Operator Interface SCS Substation Control System SCSM Specific Communication Service Mapping SCT Single Counter SER Sequence of Event Recorder Combines SOE with accurate Time synchronization and Maintenance facilities over Ethernet communication Server Define in IEC61850 as entity that provides services to clients or issues unsolicited messages PACIS EN LX C80 Page 12 14 Setpoints analogue Setpoints digital SICU 4 Lexical PACIS SYSTEM Analogue setpoints are analogue outputs delivered as current loops Analogue setpoints are used to send instruction values to the process or auxiliary device Digital values sent on multiple para
10. Funch ame Lower UserName DE EnshlaRE E Full name fs ite 1 Subst 1 LocHemSubstation Closed ManslarmS tate OK Cancel E En En En En En En En E En En fal 8 1 3 ALERT configuration for SMS Here is described the case of SMS sent through e mail using SMSToB service in France www smstob com A lot of services are available depending on the country in which PACIS is used Installation PACIS SYSTEM 8 1 3 1 Driver configuration select the configuration communication menu select drivers click on Add Communication Ports Dialing Drivers free Generic Ermes UCP Remove DK Cancel Apply Help select country and driver type generic email driver Add drivers Generic Email Driver Generic Beep PACIS EN IN C80 Page 29 40 Generic Tap Winpopup Alert Direct ry Alert Modem Poe Alert Socket France ll Printer Tatoo numeric France Rin Fl Fran si T with GSM modem select created driver et click on Properties Generic Email Driver Driver Parameters SMTP server Add Remove Version 2 1 9 1 Installed drivers Generic Email Driver Global Full name 6 eher Email river H Trace Short name E eneri Eannecheh ee Call attempt number f Automatic call acknoledoment fi 0 default Alert value Format Service message subject Alarm subject Fi
11. Name given in OSI protocol for applicative data T103 T101 American Standard Code for Information Interchange Applied System Engineering ATCC Automatic Tap Change Control Automation in charge of secondary voltage regulation more specific than AVR AVR Automatic Voltage Regulator Automatism used to regulate secondary voltage by automatic tap changer control see ATCC Set of features can be added see chapter C264 FT Bay Set of LV MV or HV plants switchgears and transformers and devices Protective Measurement usually around a Circuit Breaker and controlled by a bay computer BCD Binary Coded Decimal One C264 supported coding on a set of Digital Inputs that determine a Digital Measurement then Measurement value with specific invalid code when coding is not valid Each decimal digit is coded by 4 binary digits BCP Bay Control Point Name given to the device or part used to control a bay It can be Mosaic Panel C264 LCD Usually associate with Remote Local control BCU Bay Control Unit Name given to the C264 in charge of a bay Usually in contrast with Standalone Lexical PACIS EN LX C80 PACIS SYSTEM Page 5 14 Binary Input or Information Name given into Computer C264 of information already filtered before it becomes an SPS DPS with time tag and quality attributes BIU Basic Interface Unit C264 Board for auxiliary power supply watchdog relay redundancy I O BNC A connector for coaxial cabl
12. Options de red marage de l ordinateur OK Annuler Appliquer No setting in the Dependencies tab 3 Start the PacisSrv service from the services list Note For automatic running of the application please consult the file sample Demarrage bat 5 4 Launch the application Launch the WTS client Start menu Programs Accessories Communications Remote Desktop Connection Enter the WTS server domain name or IP address Remote Desktop Connection VPN 1 SecuRemote Authentication Secured by Please authenticate yourselfto site VPN 1 SecuRemote NG Firewall Pacis User name pacis Password IKE password CHECK POINT Software Technologies Lid www checkpoint com coca tn Installation PACIS EN IN C8O PACIS SYSTEM Page 19 40 Enter the name and the password specific to the VPN site called Firewall Pacis in the example shown and validate The usual login window is displayed on the WTS client PC iz station15_1 EB Ms A on at Es max srv telesur2 D MicClient SEC Login Terminal Server Utilisateur ES MiManager nd MiManager S Station e 5 5 PACIS Watch in service mode Note There is no need to install PACIS Watch in service mode if Windows Server 2003 itself has been installed in this mode A dialog box proposes the installation as a service PACIS Watch installation Answering Yes copies the ini file to the C WI
13. system maintenance functions databases disturbance files upload monitoring analysing functions Supervision functions access authorisation topological view of single line diagram full graphic representation of switching devices full graphic representation of analogue values full graphic representation of additional process information display of automations state display and modification of counters display of alarms in list form display of events display of states viewing of curves for archived or real time analogue and digital data forcing substitution suppression of datapoints memo function discordance management hypertext online help reports creation hardcopy tooltips NOTE Depending on the different types of PACIS architectures the system can exist in a configuration without any Ol but with SCADA interface Bay Control Points BCP At bay level the control can be done via a LCD Panel integrated to the MICOM C264 which allows Displays of bay panels events measurements alarms Control of devices alarm acknowledgement push buttons or remote contacts electrically wired which allows mainly to display and control the switchgear and transformers PACIS EN FT C80 Functional Description Page 6 38 PACIS System 2 2 Plant data interface 2 2 1 Digital inputs Digital inputs DI are binary information related to the presence or to the absence of an external signal delivered by a vo
14. Disagree causes the program to close 5 3 Banner The banner is an easy to read message that plainly identifies the device where the user is connected working to prevent him her from mistaking it for another one It is stored in C264 or the connected PC The banner is fixed whatever language is selected it is configurable in SCE It contains at least 32 characters at most 6 lines and 10 characters by line e lt can be the start and or inactivity screen saver C264 panel to comply with the NERC standard or neither 5 4 Password A password is required to place a command or set a parameter whether from the front panel or via a PC based application For this purpose at some point the user chooses a profile that depends on the intended activity Access without a proper password is denied as soon as the security administrator has defined the passwords 5 4 1 Password strength It is recommended to comply with the NERC standards for this purpose the password must have 8 caracters and in addition contains at least one character from all the categories that follow Upper case characters A Z Lower case characters a z Base 10 digits 0 9 8 Non alphanumeric that is toi J amp 4 Lili lt T gt JO TT 0 Ir Cyber Security PACIS EN CS C80 PACIS SYSTEM Page 9 14 9 4 2 5 4 3 Privileges A profile or role or account is a set of privileges
15. MiCOM C264 e the Telecontrol gateway PACIS GTW the IEDs protective devices disturbance and quality recorder when available on Station Bus e the Ethernet switches _MiCOM Hxxx the MiCOM Px3x amp Px4x protection relays e the MICOM Mx7x measurement units The Station Bus is based on the IEC61850 protocol over an Ethernet TCP IP network Additional busses called legacy busses are also available in the PACIS System architectures The structure of MICOM equipment is rack based for MiCOM C264 rack based for all MiCOM P and M available over Ethernet PC based for PACIS GTW Telecontrol Interface and PACIS OI Operator Workstation MiCOM Hxxx Ethernet switch this equipment is used for Ethernet redundancy Any combination of equipment around the Station Bus is allowed to match with the required application The typical PACIS architecture consists in a series of devices connected over the ETHERNET communication network in order to maximise the functional integration through fast exchanges between devices 10 100 Mbps allow a flexible distribution inside or between substations integrate third party devices within the Digital Control System of the substation PACIS offers connection with legacy communication networks RS232 RS485 optical in order to fully re used past investments with the new generation Configuration SCADA bus SCADA iene Gateway or PSTN amp SF la i
16. abstract of application database or a test database with same hardware configuration and same IP address and device name It is highly recommended to prepare this commissioning database before the end of installation System Commissioning Application requirement Application requirement is out of scope of this document but few requirements are here summarised Process gt Voltage topology with interlock Bay definition with additional I O measurements gt Modules definition Switch transformer motors with its I O control kind and delays Protective function and devices gt Measurement monitoring metering function and devices Control functions and devices uniqueness mode control AR Synchrocheck AVR gt Non electric process I O GIS security supply control e Mapping gt Desired information acquired from IED on Legacy BUS Desired information acquired from IED on Station BUS gt Desired information provided to non PACIS device on Station BUS gt Desired information provided to SCADA for each Tele control BUS Wiring gt Mapping to computer connectors gt lO kind AC DC voltage or current Human Interface I O gt MiCOM C264 configurable LED definition on computer gt MiCOM C264 Bay Panel definition gt PACIS Ol and computer Alarms gt PACIS OI Archiving with viewers gt PACIS OI SOE and log printing with labels gt PACIS Ol Mimic displays and module
17. click on the line Allow log on through Terminal Services Allow log on through Terminal Services Properties security Policy Setting Explain This Setting 44 Allow log on through Terminal Services M Define these policy settings Remote Desktop Users Add Uzer or Group Remove e This setting ts not compatible with computers running windows A 2000 Service Pack 1 or earlier Apply Group Policy objects containing this setting only to computers running a later version of the operating system carcel a Installation PACIS EN IN C80 PACIS SYSTEM Page 39 40 This permits connections By default the members of the groups Users and Power Users are allowed to log onto the server locally To remove these groups from those entitled double click on the line Allow log on locally and choose Remove It is indispensable to modify the session opening time For this open an Active Directory console expand User Configuration and Administration templates navigate to Terminal Server Services and select Sessions ii Console1 Console Root Local Computer Policy User Configuration Administrative Templates Windows Components Terminal services 5 ess on Hina File Action View Favorites Window Help m B e m CA Console Root E 3 Local Computer Policy Computer Configuration E User Configuration CI Software Settings J Windows Settings Administrative Templates a Windows Components NetMeet
18. control gt PACIS Ol and Computer Right definition PACIS EN IN C80 Installation Page 8 40 PACIS SYSTEM 4 4 1 4 2 PACIS DEVICES INSTALLATION PACIS devices installation is lead by an administrator user with e Hardware device with its OS for PC applications o System Release notes Software packages o Each device installation manual Installation of application software on PC request administrator password A few devices specific recommendation are summarised below but only each device installation manual gives the correct procedure PACIS SCE installation PACIS SCE can be installed on any PC respecting its requirement PACIS SCE IN chapter Installation describes fully its requirements and install procedure PACIS SCE MF chapter Maintenance describes common trouble shooting PACIS SCE must not run on the same PC and at the same time than PACIS Ol server Briefly a SCE software installation is as follows 1 If a previous version of SCE application is installed uninstall it 2 Launch the SCE installer program and follow instructions 3 If a previous version of the PACIS XML parser application is installed uninstall it 4 Launch the XML Parser installer program and follow instructions IMPORTANT the sce lax file available in the installation folder must be modified to update the lax nl java option java heap size max attribute depending on the memory size of your PC to 400 Mb if the memory s
19. have the same configuration and support the same functions Functional Description PACIS EN FT C80 PACIS System Page 25 38 2 10 3 2 10 3 1 2 10 3 2 2 10 3 3 2 10 3 4 Local remote control operating modes Substation Local Remote mode A substation can be in remote control mode or local control mode The Remote mode indicates that the substation is controlled from RCP via a gateway No control can be sent from SCP level except if the concerned bay is in SBMC mode see below The Local mode indicates that the substation is controlled from PACiS Ol The controls issued from RCP are not taken into account by the system they are refused Some controls defined during the configuration phase can be independent of the substation control mode it means they can be issued from SCP or RCP whatever was the current control mode Controls from configurable automation ISAGRAF are accepted whatever was the mode Bay Local Remote mode Each bay can be independently in Remote or Local mode The Remote mode indicates that the bay is controlled from the upper level RCP or SCP depending on the current substation control mode No control can be sent from BCP level The Local mode indicates that the bay is controlled from BCP The controls issued from upper level are not taken into account by the bay Some controls defined during the configuration phase can be independent of the bay control mode it means they can be issued from any c
20. in communications and computer devices Don t Believe It Term used for undefined state of a double point when input are not complementary DBIOO is state motion or jammed DBI11 is undefined DBID Databases Identity Brick Direct Current DC DPC Double Point Control Two digit and or relays outputs used for device control with complementary meaning OPEN CLOSE External master clock and protocol transmission LF transmitter located at Mainflingen Germany about 25 km south east of Frankfurt Main broadcasting legal time on a 77 5 kHz standard frequency Double Control Output Device Control Point Located at device level electric device or IED It should have its own Remote Local switch DCO DCS Digital Control System Generic name of system based on numeric communication and devices to be opposed to traditional electrically wired control Double CounTer Counter based on 2 DI with complementary states counting switchgear manoeuvre for example Direct Execute DELTA Phase to phase delta values Device Term used for one of the following unit Protective relays metering units IED switchgear switching device such as CB disconnector or earthing switch disturbance or quality recorders DHMI C264 Display HMI Digital Input Binary information related to the presence or to the absence of an external signal delivered by a voltage source DIN Deutsche Institut f r Normung The German standardisation body DIU DC Inpu
21. in the Safety Section of the PACIS System documentation is intended to ensure that products are properly installed and handled in order to maintain them in a safe condition It is assumed that everyone who will be associated with the PACIS System equipments will be familiar with the contents of the different PACIS System Safety Sections and all Safety documents related to the PC and Communication networks Explanation of symbols and labels The meaning of symbols and labels may be used on the PACIS System equipments or in the PACIS System product documentation is given below Installing Commissioning and Servicing Equipment operating conditions The PACiS System equipments should be operated within the specified electrical and environmental limits Fibre optic communication Optical LED transceivers used in Switch boards are classified as IEC 825 1 Accessible Emission Limit AEL Class 1 and consequently considered eye safe Optical power meters should be used to determine the operation or signal level of the device Decommissioning and Disposal Disposal It is recommended to avoid incineration and disposal of the PACiS System elements hardware and software supports The PACIS System elements should be disposed of in a safe manner Safety Handling PACIS EN SA C80 PACiS SYSTEM Page 5 8 3 GUARANTIES The media on which you received Schneider Electric software are guaranteed not to fail executing programming instructions du
22. or NAND combination of binary inputs described above or other groups A group is processed as a SP and so can take the following states Set Reset Invalid Suppressed A group can be manually or automatically suppressed forced or substituted A group is time stamped with the date time of the last datapoint which has modified the group status PACIS EN FT C80 Functional Description Page 10 38 PACIS System 2 3 1 9 2 3 2 2 3 2 1 Binary inputs transmission The Binary Inputs are transmitted on a client server basis on the Station Bus IEC61850 A Bl can be transmitted using two modes Report based mode a BI can be configured to be transmitted in Report mode In this mode a confirmed change of status is spontaneously transmitted to the subscribers with the time stamping and the reason for change GOOSE based mode in this mode the change of status is transmitted in multicast to the configured receivers Only the BI unfiltered states with their time stamping are transmitted the reason for change is not Basically the Report mode is used to transmit filtered data for displaying printing and archiving The GOOSE mode is used to transmit data as soon as possible after their acquisition and as quickly as possible for automation purpose During a loss of communication between a client and a server the different information are buffered at MiCOM C264 using the standard IEC61850 concept and after the communication reconn
23. risk of harm to property or persons including the risk of bodily injuries and death should not be reliant solely upon one form of electronic system due to the risk of system failure to avoid damage injury or death the user or application designer must take reasonably steps to protect against system failure including but not limited to back up or shut down mechanisms not because end user system is customised and differs from Schneider Electric testing platforms but also a user or application designer may use Schneider Electric products in combination with other products These actions cannot be evaluated or contemplated by Schneider Electric Thus the user or application designer is ultimately responsible for verifying and validating the suitability of Schneider Electric products whenever they are incorporated in a system or application even without limitation of the appropriate design process and safety levels of such system or application PACIS EN SA C80 Safety amp Handling Page 8 8 PACiS SYSTEM BLANK PAGE Introduction PACIS EN IT C80 PACIS SYSTEM INTRODUCTION Introduction PACIS SYSTEM CONTENTS 1 INTRODUCTION 1 1 Scope of the document 1 2 Introduction to PACIS 2 DOCUMENTATION 2 1 Chapter descriptions 2 1 1 Safety and Handling SA Chapter 2 1 2 Introduction IT Chapter 2 1 3 Functional Description FT Chapter 2 1 4 Installation IN Chapter 2 1 5 Lexicon LX Chapter PACIS EN IT C80 Page 1 6
24. running under carrying energy e g circuit breaker is in Close state and the current is unequal 0 A Operation hours OSI Open System Interconnection Split and define communication in 7 layers physical link network transport session presentation application WS Operator WorkStation PACIS Ol PACIS Protection Automation and Control Integrated Solutions PLC Programmable Logic Control Chart Includes PSL and ISaGRAF Within the PLC programs are defined the configurable control sequences or automations taken into account by the MICOM Systems POW Point On Wave Point on wave switching is the process to control the three poles of an HV circuit breaker in a way to minimise the effects of switching PSL Programmable Scheme Logic PSTN Public Switched Telephone Network RCC Remote Control Centre Is a computer or system that is not part of PACIS MICOM system RCC communicates with and supervises PACIS MiCOM system using a protocol RCP Remote Control Point Name given to the device or part used to control remotely several bay or sub station Usually associated with Remote Local sub station control It is a SCADA interface managed by the MiCOM system through Telecontrol BUS Several RCPs can be managed with different protocols Remote Control When set for a control point it means that the commands are issued from Mode an upper level and are not allowed from this point Remote HMI Remote HMI is a client of the substation HMI se
25. shutdown Then the PC reboots automatically In this case the PACIS Watch shortcut is activated like the other shortcuts present in the start up folder In the next session of PACIS Watch the crashes count is re initialised e 1 the following Message box proposes to the user to shutdown and reboot the station More than 3 Crashes in 1 hours Do you want to Reboot now If ou choose No PacisWatech will stop To restart it use its shortcut in the startup folder PACIS EN FT C80 Functional Description Page 30 38 PACIS System Yes PACIS Watch stops the processes of the lists of the ini file that are still running and then shutdowns after 30 second of timeout Then the PC reboots automatically No for instance by instance in integration phase PACIS Watch stops all the watched processes and stops itself Beware that in this case only a manual action can restart the application If the crash over the limit N_crashes inH occurs later than the time interval H_hours started when the first crash occurred no shutdown is triggered Instead a new watch interval is started with this last crash considered as the first one CRASH 1 of the period 2 12 2 3 Quitting by a user Different behaviours are possible when the user has manually stopped OdcLoading or SMT_kernel using the Exit command available by right click on the icon of either tool in the system tray It is possible to configure PACIS Watch so that it restar
26. soon as Windows starts If applicable remove the shortcut to PACIS Ol in the Start Programs menu Installation PACIS EN IN C8O PACIS SYSTEM Page 23 40 paciswatch Properties Local Computer BeSume In manual mode PACiS Watch must be started and stopped via the Windows services manager PACIS EN IN C80 Installation Page 24 40 PACIS SYSTEM 6 1 6 2 6 3 NETWORKS INSTALLATION Systems are based on networks Practice shows that lot of troubles even after some time come from incorrect installation of the networks Here are referenced some installation practices in three sub chapters for each kind of functional network e L BUS Legacy Bus between Computer and IED on field bus S BUS Station Bus between PACIS devices and other IED based on Ethernet with IEC 61850 protocol e T BUS Telecontrol BUS between system and Remote Control Point or SCADA Legacy Bus installation Installation of Legacy Bus or field Bus is described in computer IN chapter Cable definition and maximum length is defined in chapter CO Connection Two kinds of cable can be used with copper and optical Installation common problem are slightly different Copper cables are installed in daisy chain with computer usually in one extremity For RS422 and RS485 links terminal resistor 150 ohms has to be installed at both ends When LBUS is connected on computer BIU a jumper on the board can put a calibrated resistor for LBUS end A
27. triggered by operator request by events digital or analogue input state changes other automation request PACIS embeds the ISAGRAF tool provided by ICS Triplex company to perform the PLC 2 6 3 Fast configurable automation PSL Due to the range of PLC cycle time no less than 50 ms another type of fast automation is provided in PACIS the Programmable Scheme Logic automations These automations are event driven they are calculated each time an input changes i e there is no cycle time Inputs can be BI and measurements PSL are logical equations that use the following functions e AND OR XOR NOT NAND NOR operators bistable function pickup and drop off timers from 10 ms to 60 seconds by step of 10 ms e Bl setting the system Bl is SET if the PSL is TRUE RESET if the PSL is FALSE INVALID if the PSL is INVALID e Digital Output setting the DO is closed if the PSL is TRUE opened if the PSL is FALSE or INVALID only in case of permanent DO PACIS EN FT C80 Functional Description Page 20 38 PACIS System 2 6 4 2 6 4 1 2 6 4 2 2 6 4 3 2 6 4 4 2 6 4 5 Built in automatic functions PACIS performs a wide range of automatic functions for the substation control activity These functions can be activated by passed deactivated and re activated by authorised operators The Automatic Voltage Regulation The Automatic Voltage Regulation AVR function is
28. used to automatically maintain the correct voltage at the lower voltage of transformers Secondary voltage is changed by controlling the tap changer of transformers Synchrocheck The PACIS synchrocheck function is designed to measure two voltages with respect to phase angle frequency and magnitude to safeguard against the interconnection of two unsynchronised systems The voltage measures come from VT s Up to two circuit breakers can be managed with the same computer synchrocheck Phase to phase Synchrocheck with the TMU210 Phase to phase synchrocheck allows you to configure a synchrocheck function with a delta wiring Do this configuration at the TMU210 level and use the attributes type of connection and reference phase Auto Recloser PACIS provides a built in auto recloser function for transient or permanent fault elimination Auto reclosing cycles and temporisation cycles can be defined during configuration process Pole discrepancy protection PACIS provides a built in pole discrepancy protection to allow circuit breaker trip in case of pole discrepancy Trip Circuit Supervision The Trip Circuit Supervision function allows to raise an alarm into PACIS if a circuit breaker is still closed after a relay trip order The MICOM C264 are able to support the 2 diagrams used in Trip Circuit Supervision Trip Circuit Supervision with one Digital Input external resistor Trip Circuit Supervision with two Digital Inputs wi
29. 1 3 3 Tag properties For each tag cf 9 2 you have to define the properties xl Ferlodic Request I Transitory ST Reactivable Schedule F On Group Alarm Alarm enabled Alarm masked by i Priority 1 E A an f Normal Alarm Processing Reset Processing Acknowledgment Processing Actions Action _ Label Notice Add Edit Delete lel o Numeric Code fio I Vocal Message Associated Text File instructions event Type Alarm not enabled DDE OPC polling Advise Condition should be defined depending on what the user wants The values of the alarm tag are NO_SIGNIFICANT DISABLED INACTIVE INACTIVE_ACK ACTIVE_ACK INACTIVE_UNACKI INACTIVE_UNACKA ACTIVE_UNACK If the user wants to receive a SMS each time an alarm becomes active unacknowledged the condition will be EQUAL 40 Alarm processing click on add The action can be call user or call group depending on the user definition Message the button Format allows to define the SMS message Installation PACIS EN IN C80 PACIS SYSTEM Page 33 40 8 2 Setting up a remote terminal Windows Terminal Service 8 2 1 Architectures Basic Local application Firewall Remote Desktop WTS SERVER Windows 2003 Server WTS CLIENT Windows XP SP3 S0623ENa With a Domain Controller Local application Firewall Remote Desktop WTS CLIENT Windows 2003 Windows XP SP3 Ser
30. 10 files can be stored on a per device basis the oldest is automatically removed when a new one is uploaded e this principle defines a storage area per system database version o global disk space of storage area is defined in local setting Reporting PACIS provide a mechanism for creating reports showing e real time information information collected by central archiving function Functional Description PACIS EN FT C80 PACIS System Page 17 38 2 5 Control sequences 2 5 1 Control sequence behaviour The control sequences can be initiated from any control point RCP SCP BCP and DCP By configuration a control may be executed to one of the following modes Select Before Operate once mode SBO once usually for circuits breakers and disconnect switches The device must be selected before allowing the execution In that case the device is managed in two phases selection and execution Device unselection is done automatically by the computer Select Before Operate many mode SBO many usually for tap positioning of transformers The device must be selected before executing one or more controls before reaching the expected position low raise In that case the device is managed in two phases selection and execution The execution phase is repeated for every new control The deselection of the device must be done by the initiator of the request Direct Execute mode usually for ancillary devices a control may be performed di
31. 2011 Schneider Electric All rights reserved
32. 64 Legacy Gateway function and IED on field bus Networks are based on RS232 422 485 Protocols are IEC 60850 5 103 T103 or VDEW Modbus Schneider Electric or MODICON Liquid Crystal Display or Local Control Display on C264 Ladder Diagram one of the IEC1131 3 programming languages language used to define configurable automation Light Emitting Diode Low Frequency Local Operator Console Dedicated to maintenance operation L R Local Remote Local Remote When set to local for a given control point it means that the commands Control Mode can be issued from this point else in remote control are issue for upper om devices MDIO Management Data Input Output A standard driven dedicated bus approach that is specified in IEEE802 3 Measurements Values issued from digital inputs or analogue inputs with value state time tag Metering Values computed depending on the values of digital or analogue inputs non tariff during variable periods of time time integration Metering Values computed depending on the values of digital or analogue inputs tariff during variable periods and dedicated to the energy tariff These values are provided by dedicated tariff computer which are external to the MiCOM Systems MIDOS Schneider Electric Connector Used for CT VT acquisition Medium Modular Computer Manufacturing Message Specification ISO 9506 Communication protocol used on secondary networks with IE
33. CADA or switch gears Aim is to validate customer Application needs into a FAT Schneider Electric VAR Factory Acceptance Test before final delivery Site installation is the final Application installation with all defined system interfaces fully wired and operational The SAT Site Acceptance Tests ends fully this installation Requirements constraints and commissioning tests are different for each installation and specific for final site installation power up The devices and configuration is specific to a given business and associate manual are defined in DCS business This chapter defines minimal requirements for installation procedure without particular implementation The CM Commissioning chapter of each device defines how to check that PACIS device are operational and correctly installed Tests lead to check that system behaves correctly for a given application with specific functions are part of the business plan and out of scope of standard PACiS documentation Customer found FAT and SAT validation test into their specific business plan PACIS EN IN C80 Installation Page 6 40 PACiS SYSTEM 3 1 3 2 REQUIREMENTS System is complex Even if its manufacturing can been done by steps several requirements are needed before General PACIS system requirement Before any installation a versioned plan or array is needed where are defined the network parameters It is an output of business and technical staff e SBUS d
34. Computer or eee ner A Lo On i General Connexion R cup ration D pendances General Log On Recovery Dependencies Ouvrir une session en tant que Log on as Compte syst me local Local System account IV Autoriser le service interagir avec le Bureau C Ce compte Parcourir fe This account Administrator Browse Mot de passe Password e ACACACACACACACACACACACACACACA Confirmer le mot de passe Confirm password Vous pouvez activer ou d sactiver ce service pour les profils mat riels list s ci dessous You can enable or disable this service for the hardware profiles listed below Profil mat riel Service Hardware Profile Service Profil 1 Activ Profile 1 Enabled D sactiver Annuler Appliquer PACIS EN IN C8O Installation Page 18 40 PACIS SYSTEM Setthe parameters in the Recovery tab Propri t s de PacisSry Orc G n ral Connexion R cup ration D pendances S lectionnez la r ponse de l ordinateur en cas de d faillance de ce service Premi re d faillance Red marrer le service Deuxi me d faillance Red marrer le service nd D faillances suivantes Red marrer le service R initialiser le compteur de d faillances apr s o jours fh Red marrer le service apr s minutes Ex cuter un fichier Fichier _a PEG ER ER Ho ee Ei Ajout du compteur de d faillances la fin de la ligne de commande rfal 1
35. D or with SCADA RCP 2 versions exist with standard MODICON or Schneider Electric one JE ModBus Module Word reserved in PACIS SCE for all electric HV devices It groups all switch gears transformer motors generators capacitors MOTION Transient state of a Double Point Occurs when the two associated digital inputs are momentarily in state 0 e g position indication when an electrical device is switching The NEL of momentarily depends on a user selectable delay dI PACIS EN LX C80 Lexical Page 10 14 PACiS SYSTEM Normally Closed for a relay Normally Open for a relay OBS One Box Solution Computer that provides protection and control functions with local HMI The prime application of this device is intended for use in substations up to distribution voltage levels although it may also be used as backup protection in transmission substations Likewise the OBS may be applied to the MV part of a HV substation that is being controlled by the same substation control system oa Operator Interface OLE Object Linking and Embedding OLE is a Microsoft specification and defines standards for interfacing objects OLTC On Line Tap Changing OMM Operating Mode Management OPC OLE for process control OPC is a registered trademark of Microsoft and is designed to be a method to allow business management access to plant floor datain a consistent manner Sum of time periods a primary device is
36. E Generic Substation Status Event Hand Dressing Facility for an operator to set manually the position of a device acquired by other means from the HMI at SCP level e g from OPEN to CLOSE without any impact on the physical position of the electrical switching device Horizontal Measurement Graphical Area HMI Human Machine Interface Can be PACIS Ol a Interface or C264 LCD Local Control Display or Leds mosaic High Speed auto Recloser first cycles of AR HTML Hyper Text Mark up Language Used as standard for formatting web display High Voltage for example 30KV to 150kV IED Capability Description International Electro technical Commission Intelligent Electronic Device General expression for a whole range of microprocessor based products for data collection and information processing Internet Protocol IRIG B Inter Range Instrumentation Group standard format B This is an international standard for time synchronisation based on analogue signal JAMMED Invalid state of a Double Point Occurs when the 2 associated digital inputs are still in state O after an user selectable delay i e when the transient state motion is considered as ended Kbus Term used for the protocol Courier on K Bus network kind of RS422 Kobus Courier PLAN o Local Area Network Lexical PACIS EN LX C80 PACIS SYSTEM Page 9 14 L BUS Legacy Bus Generic name of Legacy or field networks and protocols used to communicate between C2
37. ED TOGGLING TOGGLE FILTERING TOGGLING TOGGLING TOGGLING SELF CHECK SELFCHECK SELFCHECK FAULTY SELFCHECK FAULTY FAILURE FAULTY LOSS OF UNKNOWN UNKNOWN UNKNOWN COMMUNICATION SUPPRESSED BY SUPPRESSED SUPPRESSED SUPPRESSED OPERATOR SUBSTITUTED BY SUBSTITUTED SUBSTITUTED JAMMED SUBSTITUTED STATE OPERATOR RESET SUBSTITUTED OPEN SUBSTITUTED SUBSTITUTED CLOSED SET FORCED BY FORCED RESET FORCED JAMMED FORCED STATE 1 to 32 OPERATOR AUTOMATICALLY 2 3 1 2 2 3 1 3 2 3 1 4 FORCED SET FORCED OPEN FORCED CLOSED System Inputs Sl System inputs are binary information related to e an equipment or system internal state such as hardware faults or system faults configurable or built in automation status of the automation binary input created by the automation electrical process information which have no acquisition possibilities i e no acquisition through DI or through serial communication but which must be managed by the MiCOM C264 the status of these information are saved in non volatile memory A SI is of SP DP or MP type and can belong to any type of group The processing of a SI is the same as the SP DP MP but there is no motion filtering nor MP filtering on SI IED Inputs These inputs are acquired from IEDs or protective relays via the station bus or legacy bus An IED input is of SP DP or MP type and is processed as described above Groups A group is a logical OR or AND or NOR
38. Folders History 25 Di x 2 Er Address E C Documents and Settings All Users Start Menu Programs Pacis PacisWatch Go Folders Documents and Settings 3 Administrator 3 2 All Users 4 Application Data C Desktop 4 Documents DRM Favorites a Start Menu 3 Programs Accessories amp Administrative Tools 3 83 Pacis PACIS OI 3 PacisWatch m A Smt gt 11 object s Disk free space 3 62 GB 741bytes my Computer At its launch PACiS Watch triggers the start of the Pacis Ol Server and potentially SMT_kernel and the potential other processes stated in the PacisWatch ini file The state of processes and the crashes are logged in the PacisWatch txt file which is created in the directory where PACIS Watch is installed If this file size is more than 250 Kbytes at the beginning of a session PACIS Watch copies this file as PacisWatch_Old txt and create a new PacisWatch txt file 2 12 2 2 Number of crashes over the limit If more crashes than the maximum number have occurred there are several cases 1 If the last one occurs inside the predefined time interval H_hours what happens depends on the value of the ConfirmBeforeReboot parameter o 0 there is no confirmation message box PACIS Watch stops the remaining watched processes and the PC shutdowns directly after a short apparition of a system information window indicating 30 seconds remain to possibly save files before the
39. HMI session the timeout is configured using SCE Two time values are set to rule the automatic disconnection of graphics Inactivity time inactivity time before auto logoff occurs in minutes Warning time visual notification before auto logoff in seconds As long as the inactivity time has not elapsed you can run another command This delay is re armed at each button press The panel saver is configurable Cyber Security PACIS EN CS C80 PACIS SYSTEM Page 11 14 Attributes of Graphic General Gravity colors warning time short name raphic long name Maximal delay for time consolidation 2 D memolcon size spare No Logoff mode inactivity time For SMT session the timeout is set by default to 10 minutes and can be configured for SMT Kernel via set password HMI 5 6 Device hardening and EWF The Enhanced Write Filter or EWF is a component of Windows XP Embedded which filters writes to another medium instead of being physically written to the volume itself EWF allows the writes to be discarded or committed to the physical volume Best practices are indicated by Schneider Electric Platform Microsoft Windows XP hardening recommendations These recommendations give a brief description of standards tools provided with Windows OS XP sp3 to help to secure a PC through physical and software hardening and with account policies enforcement 5 7 Security logs The applications record actions rela
40. IP network Additional busses called legacy buses are also available in the PACIS System architectures PACIS EN IT C80 Introduction Page 4 6 PACiS SYSTEM The typical PACIS architecture based on MiCOM elements ensures maximise the functional integration through fast exchanges between devices 10 100 Mbps e allow a flexible distribution inside or between substations integrate third party devices within the Digital Control System of the substation PACIS offers connection with legacy communication networks RS232 RS485 optical in order to fully re used past investments with the new generation Introduction PACIS EN IT C80 PACiS SYSTEM Page 5 6 2 1 2 1 1 DOCUMENTATION The guides provide a functional and technical description of the PACIS elements and a comprehensive set of instructions for the PACIS elements s use and application A System Guide is provided at system level it contains chapters listed and described below More detailed guides Operation Guide Technical Guide Getting Started Guide are provided at equipment level Due to the specific construction and application of each PACIS element the content of each PACIS element is adapted and some chapters do not exist in the relevant documents Chapter descriptions Safety and Handling SA Chapter This chapter contains the safety instructions handling and reception of electronic equipment packing and unpacking parts Copyrights and Trademarks Introd
41. N PACIS APPLICATIONS INSTALLATION 8 1 ALERT Software The ALERT software is used for alarm notification into PACIS MICROMEDIA International produces the ALERT software Telephone network PACIS OI server PACIS System S0418ENa ALERT supervises and manages a list of application variables on the PACIS Ol Server The variables declared in this list are Object Linking and Embedding OLE for Process Control OPC variables ALERT polls their current state 8 1 1 Identification of the PACIS alarms to be notified Use the SCE to retrieve the name of the OPC variable that corresponds with the alarm to be notified During this phase you will manually collect the list of the alarms to be notified and write them in an ASCII file for example This can be useful as we will see later Bo SCE PACIS Configurator D Databases Conf Conf_C264_01 mpc File Edit Display User Graphic Workbenches Tools Window Help TA ECA IAEA Templates list Contents of Comp swit pos xi Main database a Name Type Description has for profile DPS profile gt relation 008 selected datapoint C Templates EA Substation E Voltage level 3 Feeder E circuit breaker external line Order running Objects entry Comp swit pos Comp swit pos closed wired on DI channel open wired on DI channel controls on state change DPC datapoint controls on state change SPC
42. NNT system32 folder because in service mode PACIS Watch searches for the ini file in this folder instead of the current one and creates there its log file paciswatch txt x AN FACIS Watch has been installed as Service In this mode PACIS Watch uses the Ini and Log files located in WINNTsystem32 The next step will display the DCOMCNFS window and a messagebox giving the configuration indications The default paciswatch ini file has no more SMT_kernel in its system tools list because the use of SMT_kernel is not possible with WTS The user can of course add it back if he she wants to use PACIS Watch as a standard executable not as service PACIS EN IN C80 Installation Page 20 40 PACIS SYSTEM 5 5 1 Setttings At the end of the installation of PACIS Watch as a Service the setup launches automatically the deomenfg command and guides the user In this DCOMENEG window select successively the 3 components S2K OpcSeryer SCADA 2000 CS2kKAlarmServer and SCADA 2000 Server exe and for each updatefn Properties gt Identity the User with the same name and password than for the service logon After this operation open the Services manager in Administrative Tools and update the logon tab with the adequate user name and password Then FACIS Watch is ready to be Started as Service Distributed COM Configuration Properties Applications Default Properties Default Security Default Protocols Applications recPr
43. OWS serial port and the printer driver is installed from printer manufacturer or e network browse then OWS neighbouring to found network printer Printer name should match the associated attribute name in database and it has to be defined as default printer Network printer can be a printer managed by and other PC If the network PC is not Microsoft Windows 2003 or XP PC installation of printer on network PC suppose to install printer as local on LPT then to add a second local port on network PC for the remote access When printer is defined it needs to be configured Select the printer right click on property and select the thumb Ports Chose in the list the selected port and double click Define local port and enter its network alias name then tick the printer in list and leave Port menu by Ok 7 2 MiCOM C264 printer Printer directly on MiCOM C264 computer has its installation fully described in computer IN chapter Printer is a serial 7 bit printer RS232C for listing It can be installed later on one free port among four of the computer Data printed are defined in database It is important to notice in this installation that a file has to be copied into the computer defining used port and communication speed 7 3 PACiS System Master clock The external master clock receives absolute time synchronisation In PACiS case the standard means is to receive the absolute time synchronisation from GPS Global Positioning Satellite sy
44. PACIS SYSTEM PACiS EN TG C80 System Guide Schneider System Guide PACIS EN TG C80 PACIS System Page 1 2 PACIS SYSTEM CONTENT Safety amp Handling PACIS EN SA C80 Introduction PACIS EN IT C80 Installation PACIS EN IN C80 Functional Description PACIS EN FT C80 Lexical PACIS EN LX C80 Cyber Security PACiS EN CS C80 PACIS EN TG C80 System Guide Page 2 2 PACIS System BLANK PAGE Safety Handling PACIS EN SA C80 PACIS SYSTEM SAFETY amp HANDLING Safety Handling PACIS SYSTEM CONTENTS 1 INTRODUCTION 2 SAFETY 2 1 Health and Safety 2 2 Explanation of symbols and labels 2 3 Installing Commissioning and Servicing 2 4 Decommissioning and Disposal 3 GUARANTIES 4 COPYRIGHTS 8 TRADEMARKS 4 1 Copyrights 4 2 Trademarks 5 WARNINGS REGARDING USE OF SCHNEIDER ELECTRIC PRODUCTS PACIS EN SA C80 Page 1 8 bo A A A A O1 O PACIS EN SA C80 Safety amp Handling Page 2 8 PACIS SYSTEM BLANK PAGE Safety Handling PACIS EN SA C80 PACIS SYSTEM Page 3 8 1 INTRODUCTION The present document is a chapter of PACIS SYSTEM documentation binders It describes the safety handling packing and unpacking procedures applicable to PACIS SYSTEM elements PACIS EN SA C80 Safety Handling Page 4 8 PACIS SYSTEM 2 1 2 2 gt gt SAFETY WARNING THIS SAFETY SECTION SHOULD BE READ BEFORE COMMENCING ANY WORK ON THE EQUIPMENT Health and Safety The information
45. RIPTION Functional Description PACIS System CONTENTS 1 SCOPE OF THE DOCUMENT 2 FUNCTIONAL DESCRIPTION 2 1 Control points 2 1 1 Remote control points RCP 2 1 2 Substation Control Points SCP 2 1 3 Bay Control Points BCP 2 2 Plant data interface 2 2 1 Digital inputs 2 2 2 Digital measurements 2 2 3 Counters 2 2 4 Analogue inputs 2 2 5 Conventional Measurement CT VT inputs 2 2 6 Conventional Protection CT VT inputs 2 2 7 Digital outputs 2 2 8 Digital setpoints 2 2 9 IED Interface 2 3 Process and apparatus data management 2 3 1 Binary inputs BI 2 3 2 Measurement 2 3 3 Tap position indication processing 2 3 4 Metering 2 3 9 Energy counting 2 4 Data logging and archiving 2 4 1 Data logging 2 4 2 Data archiving 2 4 3 Reporting 2 5 Control sequences 2 5 1 Control sequence behaviour 2 5 2 Control sequence of switching devices 2 5 3 Close control of synchronised circuit breakers 2 5 4 Control sequence of transformers 2 5 5 Control of secondary devices 2 6 Automatic control functions 2 6 1 Interlocking 2 6 2 Configurable automations PLC 2 6 3 Fast configurable automation PSL 2 6 4 Built in automatic functions PACIS EN FT C80 Page 1 38 CON N NN N ODO DO Om oa 9 NA KR A A NS cei Si ei A Li e ar he da Mel L di da i e dk OO O O CO D O N N NOORA A 0 N N OW PACIS EN FT C80 Page 2 38 2 7 Alarms management 2 7 1 Types and definition 2 7 2 Alarm display 2 7 3 Alar
46. Server exe Root S2KRootContainer 1 Application PACIS Server1 Ol _PERF1 Server2 Ol_PERF2 PrsShare PersistancePACIS LocateTime 20000 WaitAloneTime 20000 StartMode WARM 3 2 2 If the hot Redundancy architecture is used InstalPacisSrv_WS2003 bat has been setup with Ol Server main and Server backup Ol_ PERF1 stands for the main Ol server OI_PERF2 for the back up WinPcap settings The use of OI Server as service with Windows Server 2003 involves the installation of WinPcap 3 0 in place of a newest version If WinPcap installed version is not the version 3 0 e g 4 0 1 you have first to uninstall it from Windows Get the setup of WinPcap in version 3 0 from http www winpcap org archive PACIS EN IN C80 Installation Page 14 40 PACIS SYSTEM 5 2 3 DCOM settings 1 Copy InstalPacisSrv_WS2003 bat to the Pacis setup folder The default location is C Program Files USDATA S2K Bin 2 Open the Component Services window from Control Panel Administrative Tools or running dcomcnig l Component Services ie File Action View Window Help E Console Root ET Td Component Services Stop MS DTC Computers tear E f LE My Computer Refresh all components Ea Active Directory Users and Computers FAA 3 Event Viewer Local view H Services Local Properties 3 Click on the icon in the toolbar Select the Default Properties tab of the displayed dialog Verify that the following default properties
47. Window Help SH HER X 9 LIFE Templates list Contents of DPS profile Name Description Main database Object view C Templates E Site A El Substation A El Voltage level 2 Feeder A El circuit breaker Comp swit pos external line Order running E A Scs lt Il Es S Ethernet network Attributes of DPS profile ig E 3 Datapoint profiles D DPS profile E O Graphic Alarm on Jammed profile linked to ae due to control delay s 0 the datapoint rg audible No alarmed state Manual name def Spurious T4 masking due to control delay s Objects entry DPS profile D DPS profile has alarm events logged on Printer has events logged on Printer General State labels State treatment Interlocking Alarms generation condition Appearance via gravity Objects entry DPS profile Templates entry DPS profile i audible Traces PS profile defined attribute S0494ENa The OPC name of an alarm is lt datapoint SCE name gt lt alarmed state name gt In our example it is Site 1 Subst 1 VoltLevel 1 Feeder 1 XCBR 1 ComputedSwitchPos_DPS 1 Open It relates to the PACIS Ol alarm on the opened state of the datapoint NOTE you must be aware on how alarms are managed gt Inthe STATE BASIS mode all the defined alarms are visible as different items as presented above According to the example you will see the
48. are checked and selected This should be like this by default Enable Distributed COM on this computer should be CHECKED Default Authentication level should be Connect Default Impersonation level should be Identify My Computer El Default Protocols MSDTE COMSecuity General Options Default Properties M Enable Distributed COM on this computer e e n Enable COM Internet Services on this computer Default Distributed COM Communication Properties The Authentication Level species security at the packet level Default Authentication Level Connect The impersonation level sp cifi es whether applications can determine who ts calling them and whether the application can do operations using the client s identity Default Impersonation Level Identity Z Security for reference tracking can be provided if authentication i used and that the default impersonation level is not anonymous Provide additional security for reference tracking Installation PACIS EN IN C80 PACIS SYSTEM Page 15 40 4 Select the COM Security tab and verify the Edit Limits for Access permissions and for Launch and Activation Permissions These settings control security permissions concerning objects accessed or launched locally or remotely by PROGRAMS My Computer Properties General Options i Default Properties Default Protoco s MSOTC COM Security r Access Permizzione Y
49. ath SYSTEMROOT system32 2 Copy IntallPacisSrv bat to Pacis setup folder Default folder is C Program Files USDATA S2K Bin 3 Copy PacisSrvkeys reg dans to Pacis setup folder Default folder is C Program Files USDATA S2K Bin 5 3 2 Settings 1 Run the command file IntallPacisSrv bat 2 Open the Service management console Select PacisSrv Access to properties via menu Set the parameters in the General tab Propri t s de PacisSry Ordinateur local RIS paciswatch Properties Local Computer xl General Connexion R cup ration D pendances General Log On Recovery Dependencies x Service name aciswatch Nom du service PacisSrv p Nom affich Display name pociewatch Description PO Description PACIS Ol Server Watchdog Chemin d acc s des fichiers ex cutables Path to executable C WINNT system32 S RVANY EXE C Program Files Pacis PacisWatch paciswatch exe Type de d marrage Manuel Startup type Automatic Statut du service Demarre Service status Stopped D marrer Arr ter Suspendre Reprendre Start stap Vous pouvez sp cifier les param tres qui s appliquent pour le d marrage du as can specify the start parameters that apply when you start the service from service ere Parametres de d marage Start parameters Annuler Appliquer Set the parameters in the Log on tab Propri t s de PacisSry Ordinateur local 21 1 paciswatch Properties Local
50. ating mode can be changed locally at equipment level or from Operator workstation 2 10 2 Equipment redundancy 2 10 2 1 PACIS Ol twin server redundancy More than one PACIS Ol can be present inside the substation allowing operators e to control the substation from some different places to continue to control the substation from SCP level if a single failure occurs involving one PACIS Ol Two types of redundancy are available server redundancy the Ol servers are redundant allowing redundancy of alarms events and historian functions An Ol client will switch from a server to the other one after a delayed failure detection e client redundancy up to eight OI clients can be configured allowing multiple points of control for the operator NOTE Printers attached to PACIS Ol can be redundant 2 10 2 2 Station Bus redundancy The station bus can be redundant within PACIS The switchover from a network to the other one is handled automatically by the system and is transparent for all PACIS equipment The maximum switching time is 4 ms It can be used DIN rail mounted switches or internal switches 2 10 2 3 PACIS GTW redundancy The transmission link of a gateway can be redundant to allow RCP to continue to control the substation in case of port single failure 2 10 2 4 MiCOM C264 redundancy At substation level and or at bay level an optional second computer can be used to avoid the loss of functions at these levels The two computers
51. c PACIS Gateway device on industrial PC gt PACIS IEC 61850 Agency for communication on the SBUS gt PACIS Gateways Applications for protocol communication on TBUS 3a Station BUS network based on Ethernet network optical copper switch repeater Installation PACIS EN IN C80 PACIS SYSTEM Page 5 40 2 1 2 2 Installation ordering System installation ordering follows usually the number indicated Maintenance PC is needed at any step even network installation to check via ping the correct wiring Operator workstation gateway and computer with their cubicle are installation tasks that can be lead in parallel Kind of PACIS system Installation Installation is a step between engineering studies and commissioning The main goal of installation is to do it in an electric plant Further the word Application is reserved for this target Into the standard system manufacturing process three levels of installation are done e Experimental set up that uses a reduced set of devices with the aim to validate special features and or configuration of a set of PACIS devices missing system devices are replaced by PACIS ES for example Set up is used to validate SCADA mapping and communication SOE or alarm labels automation communication to IED Factory set up that integrates usually all system devices not necessary mounted into cubicles and uses some of system external devices like IED or simulates them like S
52. cations out of cyber security Scope 5 CYBERSECURITY POLICY 5 1 Applicability 5 2 Disclaimer 5 3 Banner 5 4 Password 5 4 1 Password strength 5 4 2 Privileges 5 4 3 Profile lockout 5 4 4 Default password 5 5 Log off after x minutes of inactivity 5 6 Device hardening and EWF 5 7 Security logs 5 8 Antivirus 6 APPENDIX 6 1 Port reservation PACIS EN CS C80 Page 1 14 9 O o o OO oo O 000 0 0 0 N N mh s 1 N gt Sk wo PACIS EN CS C80 Cyber Security Page 2 1 4 PACIS SYSTEM BLANK PAGE Cyber Security PACIS EN CS C80 PACIS SYSTEM Page 3 14 1 SCOPE OF THE DOCUMENT This document describes the measures taken and tools to decrease the risk of attacks and ensure Confidentiality Integrity Availability Authentication and Non Repudiation For more detail on implementation of the principles for the various components refer to CAT and the C264 cyber security SMT EN IN chapter OI EN IN chapter GTW EN IN chapter PACIS EN CS C80 Cyber Security Page 4 1 4 PACIS SYSTEM 2 GLOSSARY AND DEFINITIONS Authentification Information security it is necessary to ensure that the data transactions communications or documents electronic or physical are genuine It is also important for authenticity to validate that both parties involved are who they claim they are Availability For any information system to serve its purpose the information must be available when it is nee
53. ch as circuit breaker disconnector or earth switch They are managed in Direct execute or SBO once mode The allowed controls are open and close commands Moreover the close open control the device may have by configuration a selection output control In this case the device is managed in SBO once mode The device is selected in the selection phase PACIS EN FT C80 Functional Description Page 18 38 PACIS System 2 5 3 2 9 4 2 9 9 Close control of synchronised circuit breakers Synchronised circuit breakers may have specific features These features ere user selectable and are taken in account by the control sequence upon a close request the device is controlled by an external synchrocheck module or internal automatic function the synchrocheck module internal or external is setting on off manually or automatically Moreover during waiting the closing of the device by the synchrocheck module the initiator of the request may cancel the request close the device by forcing request Control sequence of transformers PACIS control transformers by dealing with associated tap changer positions The allowed controls are raise command current tap position 1 and lower command current tap position 1 Additionally of the common checks of control sequence the computer proceeds to the following verifications only raise command is allowed if the tap position value is the
54. clic Redundancy Check Coding result send with packet of transmitted data to guarantee their integrity Usually result of a division of transmitted data by polynomial O CSV Character Separate Values ASCII values separated by predefined character or string like in Excel or ASCII Comtrade Current Transformer Basically the electric device connected to process and extracting a current measurement By extension part of a device C264 that receives AC values and convert itto numerical measurement value CT VT Current and Voltage transformers Conventional By extension it is the C264 TMU board CT PACIS EN LX C80 Lexical Page 6 14 PACiS SYSTEM CT VT Current and Voltage transformers Non New generation of captor based for example on light diffraction under Conventional or electric field without transformer that gives directly numerical intelligent measurement of voltage and current like communicating IED Character Separate Values Asci values separated by predefined character or string like in Excel or ASCII Comtrade Data Acquisition component of the GPT Digital to Analogue Converter Used to generate analogue signals usually DC from a digital value DataBase Tool or set of data that define all configuration of a system or specific device like computer Opposed to setting or parameter DB has a structure that can not be modified on line DB are always versioned A 9 pin family of plugs and sockets widely used
55. datapoint has closed state given by SPS Electrical datapoint has open state given by SPS Electrical datapoint has for IEC address DPCXST has for IEC address DPSxST has for IED address DPS address on IED has for ind AckClear right AI ack right has for SCADA address DPS address on SCADA has state displayed on Led is transmitted on IEC 61850 SCADA network 61850 pr lt i gt Objects entry Comp swit Templates entry Comp swit A Scs Ethernet network E 3 Datapoint profiles D DPS profile O Graphic lt Attributes of Comp swit pos General short name Comp swit pos long name Computed switchgear position meaning Computed 3 phases position stable state time reference Start motion v spare No Delays complementarity delay jammed complementarity delay undefin open confirmation delay x 100 closed confirmation delay x 1 0 Forcing and suppression A forcing management Not automatic Graphical representation computer state panel assignment Yes omp swit pos Computed switchgear position Site 1 Subst 1 VoltLevel 1 Feeder 1 XCBR 1 ComputedSwitchPos_DPS 1 of type Com RW Objects k ae datapoint SCE name S0493ENa Installation PACIS EN IN C80 PACIS SYSTEM Page 27 40 sCE PACIS Configurator D Databases Conf Conf_C264_01 mpc BG File Edit Display User Graphic Workbenches Tools
56. de The domain controller has Active Directory installed It is indispensable to add the Remote desktop users group in the domain controller security policy Open an Active Directory console as previously described In the Default Domain Controllers Policy console expand Computer Configuration navigate to Windows Settings then to Local Policies and select User Rights Assignment ii Default Domain Controller Security Settings File Action View Help cs Amx Eee P Security Settings 3 Account Policies 8 Access this computer From the network Everyone Administrators Authenticated Users ENTERPR Local Policies ie Act as part of the operating system e Audit Policy R Add workstations to domain Authenticated Users se User Rights SENDEN R Adjust memory quotas for a process LOCAL SERVICE NETWORK SERVICE TESTISQLServer2 8 Security Options RZ Allow log on locally Administrators Backup Operators Account Operators Se ed Event Log 9 Restricted Groups G System Services 3 Registry 9 File System Allow log on through Terminal Services Remote Desktop Users 88 Back up files and directories Administrators Backup Operators Server Operators its Bypass traverse checking Everyone TESTISQLServer2005DTSUser OI_PERF2 TES 2 Change the system time LOCAL SERVICE Administrators Server Operators H E Wireless Network IEEE 802 11 Policies 32 Create a pagefile Adm
57. ded Banner Configurable indication which allows the user to identify the device BCU Bay Control Unit CAT Computer Administration Tools Cyber security Security standards which enable organizations to practice safe security techniques to minimize the number of successful cyber securtity attacks Cyber security It is assumed that security perimeter is the cubicle scope perimeter Device DHMI Disclaimer EWF ICD IED Integrity Login password MS1 Can be gateway or C264 C264 Display HMI Legal text of about 100 characters available in English only This text is displayed at each start up of the application and allows the application to run only if the text is acknowledged by a manual operation The disclaimer is a message shown to the user to transfer the usage responsibility to the user Misuse unauthorized use It is a contract that user must accept before accessing to temporary application The Enhanced Write Filter or EWF is a component of Windows XP Embedded which filters writes to another medium instead of being physically written to the volume itself Data integrity is composed of four essential qualities or core attributes completeness currency timeliness accuracy correctness and validity authorization IED Capability Description Intelligent Electronic Device In information security integrity means that data cannot be modified undetectably Way to identify a user Login password is associa
58. e Not configured Not configured Not configured Not configured Not configured Not configured Not configured Not configured Not configured Not configured Not configured Not configured Not configured Not configured Not configured Not configured e Not configured MAA Pi Scripts Logon Logoff gt Extended Standard 8 2 4 Users statement in Active Directory The server runs Terminal Services To activate the remote desktop select Control panel System Remote and tick the box Allow users to connect remotely to your computer System Properties H i General Advanced ce Computer Name Automatic Updates 2 x Hardware Remote This computer has been configured to run Terminal Server Det The Terminal Server component allows multiple users to connect remotely using client software and run programs on the server Cr ROHR x Turn on Remote Assistance and allow invitations to be sent from this computer Learn more about Remote Assistance Remote Desktop Advanced e Allow users to connect remotely to your computer Note to further configure this terminal server use Group Policy or the Terminal Services Configuration tool For more information about deploying configuring and administering this terminal server see Terminal Server Help caca m Installation PACIS EN IN C80 PACiS SYSTEM Page 37 40 The users of the remote des
59. e B Watch Monitoring and control device for GIS substation CAD Computer Aided Design Computer application dedicated to design like wiring protective setting CAS CASe Computer C264 rack CB Circuit Breaker Specific dipole switch with capability to make line current and break fault current Some have isolation capability nominal earth at each side CBC Compact Bay Controller Small capacity bay computer for Medium Voltage applications typically C264C CC Complemented Contact CCU Circuit breaker Control Unit Computer C264 Board dedicated to switch control with 8DI 4 DO CDM Conceptual Data Modelling Is the modelling of system devices data using a hierarchy of structured data called object of class with their attributes method or properties and the relations between themselves It maps common data to devices or components of devices with guaranty of interoperability Define in IEC61850 as description of a set of objects that share the same attributes services relationships and semantics Client Define in IEC61850 as entity that requests a service from a server and that receives unsolicited messages from a server ou CMT Computer Maintenance Tool Command logic information Output Functional Component Contact Open Class COMTRADE Common Format For Transient Data Exchange international standard IEC 60255 24 PU Central Processing Unit Computer C264 main Board based on PowerPC CRC Cy
60. e different equipment master clock equipment Station Bus equipment legacy equipment is signalled printed archived alarmed PACIS EN FT C80 Functional Description Page 24 38 PACiS System 2 10 System monitoring 2 10 1 Equipment operating modes PACIS system equipments MiICOM C264 PACIS GTW PACIS Ol server may work in one of the following operating modes Operational the equipment is working correctly all the functions are executed e Test all functions are executed except activation of the relays of local output controls The equipment simulates a positive acknowledgement for control sequences simulation Note the output controls continue to be sends to the IEDs or to other computers o Maintenance the equipment is working but only some functions are executed generally the supervision functions download and display data base information communications state This mode is requested by the operator or reached automatically in case of data base incoherence o Faulty only for MICOM C264 the equipment is working but only some functions are executed generally the supervision functions functions not involved in the management of the electrical process This mode is a consequence of a failure detected on the equipment e Initialisation boot transitory mode between equipment power up and Operational Maintenance or Faulty mode o Halt the equipment is out of service due to detection of fatal error The Oper
61. e in Dial Number part line 1 Identification OF x Mame BOISSET Cancel First Name ly earn Marie Language French France Hep Virtual user IE 1002 Code Class System T Off duty substituted by Messages Console Advanced Dial Numbers Type Number Active Relief 1 tree mfpt597 0678928132 s w C 2 4 A 3 Dial Number Programmation Operating Manual Automatic Edit type select the driver you have created number lt password gt lt phone number gt smstob com you can define several user if several people have to receive a SMS when an alarm occurs if the same action i e send the same SMS must be performed when an alarm occurs the users can be attached to a group add a group x io _ Cancel Relief group Cancel none Help Advanced Alarm Tone Sound File Erase Lister Call cycle teams of the graup tt Default 1 Call one user for each alarm with turnover Call all active users of the team with Call relief if not one of users is advised C Call relief for each unadvised user Team changeover management D Team changeover mandatory Magmumn delay for teamchangeover mir fo define the group name select call all active users of the team drag and drop users to the group PACIS EN IN C80 Installation Page 32 40 PACIS SYSTEM 8
62. e to defects in materials and workmanship for a period of 90 days from date of shipment as evidenced by receipts or other documentation Schneider Electric will at its option repair or replace software media that do not execute programming instructions if Schneider Electric receives notice of such defects during the guaranty period Schneider Electric does not guaranty that the operation of the software shall be uninterrupted or error free A Return Material Authorisation RMA number must be obtained from the factory and clearly marked on the package before any equipment acceptance for guaranty work Schneider Electric will pay the shipping costs of returning to the owner parts which are covered by warranty Schneider Electric believes that the information in this document is accurate The document has been carefully reviewed for technical accuracy In the event that technical or typographical errors exist Schneider Electric reserves the right to make changes to subsequent editions of this document without prior notice to holders of this edition The reader should consult Schneider Electric if errors are suspected In no event shall Schneider Electric be liable for any damages arising out of or related to this document or the information contained in it Expect as specified herein Schneider Electric makes no guaranties express or implied and specifically disclaims and guaranties of merchantability or fitness for a particular purpose Custom
63. ection they are transfert to the different clients to update their repective functions Measurement A measurement can be acquired by using an analogue input a digital measurement a serial communication link with an IED e a CT VT input Measurement processing Configuration process allows the user to define for each measurement a scaling law linear quadratic and up to 6 thresholds for which the detection caused by a measurement variation can create an event and alarm Moreover for 4 20 mA transducers a special feature is implemented to avoid fleeting values around 4 mA Measurements can be manually suppressed they are not processed until unsupression or substituted by another value When a measurement becomes invalid the operator can force it by a valid value The measurement is automatically unforced when it becomes valid again The configuration allows also to the user to define automatic forcing when a measurement becomes invalid Measurement resulting states sae Comment O SSS S O UNKNOWN Functional Description PACIS EN FT C80 PACIS System Page 11 38 2 3 2 2 2 3 2 3 Measurements Transmission The measurements are transmitted on a client server basis on the Station Bus network by using two modes Report based mode the measurement is transmitted to the subscribers with its value its status its time stamping and the reason for change GOOSE based mode the measurement is transmitted in mu
64. elds ET 01 EM BR amp 0 amp P 6 5 68 TERI ti AG M Stacha AF file Browse FO Put the instruction fle as amattachment PACIS EN IN C80 Installation Page 30 40 PACIS SYSTEM click on Add In Global part click on Connection Connection parameters IN x Connection name OF Connection type Cancel f Local network Login Password Remote access Modem Help SMTP server address POPS server address o our email address Mail user name Mail password Incoming mail Alarm subject 17 Recewe incoming mail Report subject POPS server connection period in mini 0 e define all parameters attached to your Internet access warning the e mail address must be the same than the address used to have an account on SMSToB service in Format part alarm subject remove all fields 8 1 3 2 User definition e add a user User record Identification M sis Cancel First Mame Language English United States Help T Yirtual user ID 1002 Code Class Operation hi T Off duty substituted by Messages TM Console E Advanced Dial Numbers Type Number Active Relief 1 ee Dial Number Programmation Operating Manual Automatic Edit type the name the first name the language the class Installation PACIS EN IN C80 PACIS SYSTEM Page 31 40
65. er s rights to recover damages caused by fault or negligence on the part Schneider Electric shall be limited to the amount therefore paid by the customer Schneider Electric will not be liable for damages resulting from loss of data profits use of products or incidental or consequential damages even if advised of the possibility thereof This limitation of the liability of Schneider Electric will apply regardless of the form of action whether in contract or tort including negligence Any action against Schneider Electric must be brought within one year after the cause of action accrues Schneider Electric shall not be liable for any delay in performance due to causes beyond its reasonable control The warranty provided herein dues net cover damages defects malfunctions or service failures caused by owner s failure to follow the Schneider Electric installation operation or maintenance instructions owner s modification of the product owner s abuse misuse or negligent acts and power failure or surges fire flood accident actions of third parties or other events outside reasonable control PACIS EN SA C80 Safety amp Handling Page 6 8 PACIS SYSTEM 4 COPYRIGHTS amp TRADEMARKS 4 1 Copyrights Under the copyright laws this publication may not be reproduced or transmitted in any form electronic or mechanical including photocopying recording storing in an information retrieval system or translating in whole or in part without t
66. evices list to install or to simulate with gt Naming correct alias name on Ethernet is mandatory gt IP address is mandatory on Ethernet address of IED on Legacy BUS is mandatory gt Hardware version and its hardware configuration boards voltage Software and database version can be useful but subject to modification during commissioning e Networks scheme is mandatory with gt Networks topology drawing ring star with devices reference length between connections additional switch repeater Physical link to use RS232 RS422 RS485 10T 100T 100F Protocol IEC61850 MODBUS SCHNEIDER ELECTRIC IEC 60870 5 103 IEC 60870 5 101 DNP3 0 IEC 60870 5 104 OPC CDC Type 2 Gl74 HNZ etc Network name and IP address are needed before any PACIS system device installation The network name and IP address must be identical to those configured in the PACIS SCE database Change remains possible as described in maintenance manuals but is time consuming operation If address is changed all devices communicating with this past address should be reconfigured with the new address Clear definition of the network avoids also changing later on the communication means physical link speed additional repeater usually integrated into any Ethernet device Basic requirement Even if it is trivial in engineering before installation several checks have to be done The above list is also a way to control that system d
67. evices ordered match installation constraints o PACIS system components should be present and in their ship box Non PACIS components should have been correctly installed and operational For example an other PC than the recommended one should have the needed operating software special peripheral like printers or modems should have appropriate drivers to the PACIS OS Power Supply source is available with compatible voltage power capability stability power source protected and well defined power wiring e Location for set up has to be compatible with human security and device utilisation mechanical support including chairs temperature humidity electromagnetic field radiation local emergency stop o Correct and operational network connection to non PACIS equipment LBUS or SBUS link to non PACIS IED TBUS link like PSTN to SCADA o Normalised and operational wiring to electric devices scheme wiring cable shield earthing Qualified personnel Certified test material and tools Installation PACIS EN IN C80 PACIS SYSTEM Page 7 40 3 3 3 4 Installation end requirement Any installation process ends with a commissioning part to verify that devices operate PACIS devices are operational with databases Also it is not possible to check installation in a commissioning part without downloading database into devices and check that through networks they can communicate Commissioning database can be an
68. failed login attempts result in temporary lockout of login CAT counts the number of consecutive login failures 1 The first invalid login sets this counter to 1 and starts a timer 2 Further invalid writes for the same profile increment the counter at timer expiration or if the correct password is entered the counter is reset to 0 3 Once the counter value reaches the configured maximum the password entry is locked out A blocking timer is started and any attempt to enter the password result in an error response irrespective of whether it is a correct password or not This does not restart the blocking timer Once the blocking timer has expired the password entry is unblocked Max invalid login attempt numbers Counter reset time Lockout time S0633ENa In event of reboot the counters are reset The Security administrator is entitled to unlock a profile before the lockout duration expires C264 DHMI any attempt to write to the password entry whilst it is blocked results in a configurable blocking message being shown for 2 seconds such as NOT ACCEPTED ENTRY IS BLOCKED This is true as long as the time has not elapsed 5 4 4 Default password o SMT network name of machine C264 AAAAAAAA 8 x A CAT AAAAAAAA 8 x A o Switch manager AAAAAAAA 8 x A 5 5 Log off after x minutes of inactivity Automatic logoff after a set time is an option For CAT or MiCOM S1 session the timeout is set using CAT For D
69. g Slow Waveform recording allows to store measurements on a long period Waveform records are stored using COMTRADE 2001 binary format PACIS EN FT C80 Functional Description Page 16 38 PACIS System 2 4 2 2 2 4 3 Central archiving Events central archiving PACIS allows to have central archives on the hard disk of the Operator Workstation using a SQL Server database Measurements central archiving The measures and associated mean values are archived in the central SQL server database as the events in the following tables Daily table for the mean values of the day These tables are stored during 35 days Monthly table for the minimum maximum mean values computed at a reference time configurable of a day Monthly tables are stored during 15 months Yearly table for the minimum maximum mean values computed at a reference time configurable of a month Yearly tables are stored during 5 years Backup central archiving A backup of the central archive i e of the SQL database is allowed at a configured date time Waveform and Disturbance Files These files generated at a local level can be automatically uploaded from a device Only one central file archiving is defined in the system The automatic upload could be activated de activated by the operator The disturbance files are stored in COMTRADE 2001 binary format A storage policy is defined to avoid filling up the hard disk a maximum of
70. he prior written consent of Schneider Electric 4 2 Trademarks PACiS PACiS SCE PACiS ES PACiS SMT PACiS Ol PACiS MiCOM are trademarks of Schneider Electric Product and company names mentioned herein are trademarks or trade names of their respective companies Safety Handling PACIS EN SA C80 PACIS SYSTEM Page 7 8 5 WARNINGS REGARDING USE OF SCHNEIDER ELECTRIC PRODUCTS Schneider Electric products are not designed with components and testing for a level of reliability suitable for use in or in connection with surgical implants or as critical components in any life support systems whose failure to perform can reasonably be expected to cause significant injuries to a human In any application including the above reliability of operation of the software products can be impaired by adverse factors including but not limited to fluctuations in electrical power supply MiCOM C264 hardware malfunctions MiCOM C264 operating system software fitness fitness of compilers and development software used to develop an application installation errors software and hardware compatibility problems malfunctions or failures of electronic monitoring or control devices transient failures of electronic systems hardware and or software unanticipated uses or misuses or errors from the user or applications designer adverse factors such as these are collectively termed System failures Any application where a system failure would create a
71. he security log A PC hosting NON time critical applications can be permanently scanned by an antivirus The PCs hosting time critical applications such as PACIS OI and GTW can NOT be permanently scanned therefore the user must closely monitor any data intake through drives A PC Guard serves as a check up hub to any movable media before data transfer The PACIS CYBER tool for software updating and PC scanning is supported Please refer to PACIS Cyber Tools recommendations in order to e Install and update antivirus on PC Guard Check media on PC Guard PC Guard PACIS Ol USB Media S0634ENa FIGURE 1 THE WHOLE PROCESS AT A GLANCE Cyber Security PACIS EN CS C80 PACIS SYSTEM Page 13 14 6 APPENDIX 6 1 Port reservation PACIS Applications ports reservation SMT RMI 3000 Broadcast 10000 AGENCY 102 103 GATEWAY DNP3 20000 T104 2404 MODBUS TCP IP 502 Security layer used by CAT 9999 9997 C264 T104 DNP3 Telnet IEC 61850 RPC for tunneling Web server Security layer used by C264 9999 9997 MICOM S1 Security layer used by MS1 9999 9997 PACIS EN CS C80 Cyber Security Page 14 14 PACiS SYSTEM BLANK PAGE Customer Care Centre http www schneider electric com CCC Schneider Electric 35 rue Joseph Monier 92506 Rueil Malmaison FRANCE Phone 33 0 1 41 29 70 00 Fax 33 0 1 41 29 71 00 www schneider electric com Publication PACiS EN TG C80 Publishing Schneider Electric 10 2011
72. hernet converters 4 4 Virtual LAN PACIS V4 8 offers the capability to send information on Physical VLAN according to the recommendations in Annex C of IEC61850 8 1 The default virtual LAN IDs and priorities are described below Service Default VLAN Default VLAN VID Priority CAT o Please refer on SCE Chapter AP for setting Functional Description PACIS EN FT C80 PACIS System Page 37 38 9 MULTI LINGUAL SUPPORT 5 1 Italian Language These sub systems support the Italian language SCE only the menus and the capability to configure the Italian language The data model is not translated CMT SMT PACIS S1 Ol the default reports do not support the Italian language These components do not support the Italian language e The C264 local HMI e The user documentation e The program installation set up files and displays 5 2 Greek Language These sub systems support the Greek language e The Ol is translated in Greek including the pre defined reports The SCE allows you to select the Greek language and to create Greek datapoint labels The system data model of the SCE is not translated into Greek Note All of the other PACIS sub systems are not translated into Greek PACIS EN FT C80 Functional Description Page 38 38 PACIS System BLANK PAGE Lexical PACIS EN LX C8O PACIS SYSTEM LEXICAL Lexical PACIS SYSTEM CONTENT 1 SCOPE OF THE DOCUMENT 2 LEXICAL PACIS EN LX C80 Page 1 14
73. ically when it becomes inactive and is acknowledged PACIS EN FT C80 Page 22 38 2 8 IED management Functional Description PACIS System A wide range of IED can be fully integrated into PACIS via connection to different types of legacy busses or IEC61850 protocol Implemented protocols These protocols are fully implemented in PACIS IEC61850 IEC 60870 5 101 IEC 60870 5 103 Modbus DNP 3 0 level 2 on station bus on legacy bus on legacy bus on legacy bus on legacy bus Third party protocols will be implemented using external converter over legacy bus protocols or station bus protocol Functional Description PACIS EN FT C80 PACIS System Page 23 38 2 9 Time management PACIS system provides a time synchronisation mechanism which allows the connected devices to have the same date time This synchronisation allows particularly the time tagging of events the synchronising of the reports and programmed actions at source In a PACIS system the external clock is connected to one MICOM C264 or two in case of computer redundancy which is the System Master Clock The System Master Clock equipment is considered as the unique date time reference for the whole system lt is connected on the Station Bus and it re distributes the date time reference to the other PACIS components MiCOM C264 IEDs The equipments connected on the Station Bus can communicate with IEDs connected on Legacy Bus In this ca
74. ics described here above apply on Digital Setpoints Digital Setpoints can be encoded with BCD Binary Gray Decimal 1 among N codes Moreover a supplementary binary output can be used for the sign bit and a dedicated binary output can be used to enable or not the reading of the value by the external device IED Interface The IED Interface is used for a line to line or multipoint interconnection between the different system devices The data transfer takes place with different specific serial protocols The provided interfaces are EIA RS 232 transmission EIA RS 485 transmission Fibre optic transmission PACIS EN FT C80 Functional Description Page 8 38 PACIS System 2 3 2 3 1 2 3 1 1 Process and apparatus data management Binary inputs BI PACIS system manages five types of binary inputs o Single Point SP derived from one Digital input Double Point DP derived from two Digital inputs o Multiple Point MP derived from N Digital inputs up to 16 in case of states up to 64 for TPI e System Input SI information related to the system to configurable and built in automations or to electrical process but without acquisition possibilities e Group logical combination of Bl SP DP and MP are acquired via digital input boards or via IEDs connected by a serial link SI and Groups are generated by the computer application layer Single double and multiply points processing The following table shows filterings a
75. ies CAUTION IN WINDOWS XP SP3 WHEN YOU HAVE TWO IP ADDRESSES ON THE SAME NETWORK BOARD AND A DISCONNECT FROM THE ETHERNET NETWORK OCCURS THE PRIMARY IP ADDRESS RESETS TO 0 0 0 0 WHEN YOU RECONNECT THE ETHERNET NETWORK CABLE WINDOWS XP SP3 DOES NOT RESTORE THE PRIMARY IP ADDRESSE Microsoft provides a hotfix at http support microsoft com kb 896062 en us PACIS Gateway installation PACIS gateway installation is described in its IN chapter Kind and number of SCADA communication T BUS impact the hardware and it is important to check clearly this definition before installation Briefly a Gateway software installation is as follows 1 If a previous version of gateway application is installed uninstall it 2 Launch the Gateway installer and follow instructions 3 Station Bus agency is installed with the Gateway Nevertheless it could be necessary to install an other version of the agency regarding the PACIS version coherency table given in each system release note Installation PACIS EN IN C80 PACIS SYSTEM Page 11 40 4 6 4 7 MiCOM C264 installation Installation is described in IN and MF name and IP modification chapters Computer is received with default IP address that need to be changed as defined into MF chapter This installation contains additional parts on networks referenced also later in this document Briefly a Computer software installation is as follows 1 If a previous version of compute
76. ilure of DCT non complementarity of the two contacts OVERRANGE when the maximum value is reached Counters Transmission The counters are transmitted on a client server basis on the Station Bus network using the same mechanisms than the measurements Energy counting The energy counting function aims to calculate exported and imported active energy in kWh and exported and imported reactive energy in kVarh from active and reactive power issued from CT VT calculation The energy values are transmitted on a client server basis on the Station Bus using same mechanisms than the counters PACIS EN FT C80 Functional Description Page 14 38 PACIS System 2 4 2 4 1 2 4 1 1 Data logging and archiving Data logging The Data Logging function is the logging of PACIS information on printers Three types of printers are available the SOE printers Sequence Of Event the LB printers Log Book e the HC printers Hard Copy PACIS manages e a maximum of 2 redundant SOE printers i e 4 SOE printers and 2 redundant LB printers i e 4 LB printers at a system level managed by the OI These printers can be serial or network ones e a maximum of 1 LB printer at a computer level serial printer Sequence Of Event SOE printer SOE printer is a dedicated printer for printing only SP DP and MP events attached to the primary process only The 7 following BI properties can be printed The position of each property in the
77. ing HC Internet Explorer CA Application Compatibility CA Attachment Manager 9 Windows Explorer Microsoft Management Console CA Task Scheduler Terminal Services client Sessions Select an item to view its description Settin State Ed Set time limit for disconnected sessions Not configured En Sets a time limit For active Terminal Services sessions Not configured En Sets a time limit for active but idle Terminal Services sessions Not configured En Allow reconnection from original client only Not configured El Terminate session when time limits are reached Not configured Windows Installer CA windows Messenger CA windows Update CA Windows Movie Maker H E Windows Media Player Start Menu and Taskbar G Desktop J E Control Panel Shared Folders CA Network System Extended A Standard Double click the line Set time limit for disconnected sessions and modify the setting Set time limit for disconnected sessions Properties Setting Explain Sal Set time limit for disconnected sessions Hot Configured Enabled Disabled End a disconnected session Supported on At least Microsoft Windows sP Terminal Services Previous Setting Nest Setting coca om PACIS EN IN C80 Installation Page 40 40 PACiS SYSTEM BLANK PAGE Functional Description PACIS EN FT C80 PACIS System FUNCTIONAL DESC
78. inistrators Public Key Policies amp 2 Create a token object C3 Software Restriction Policies 82 Create global objects Not Defined IP Security Policies on Active Directory test com 8 Create permanent shared objects 8 Debug programs Administrators FF R Deny access to this computer from the network TESTISUPPORT_388945a0 28 Deny log on as a batch job 22 Deny log on as a service Re Deny log on locally TESTISUPPORT_388945a0 Rs Deny log on through Terminal Services Not Defined Rg Enable computer and user accounts to be trusted for delegation Administrators RE Force shutdown from a remote system Administrators Server Operators Re Generate security audits LOCAL SERVICE NETWORK SERVICE R Impersonate a client after authentication Not Defined 82 Increase scheduling priority Administrators f Load and unload device drivers Administrators Print Operators g Lock pages in memory RS Log on as a batch job LOCAL SERVICE TESTISUPPORT_388945a0 TEST SQLSe R Log on as a service NETWORK SERVICE TESTISOLServer2005DTSUser OI_ 22 Manage auditing and security log Administrators Rg Modify firmware environment values Administrators 38 Perform volume maintenance tasks Not Defined ita Profile single process Administrators 83 Profile system performance Administrators Remove computer from dockina station Administrators A To modify the default settings Administrators Remote Desktop users double
79. ion is not recommended The PACIS CYBER tool for software updating and PC scanning is recommended 4 3 Additional Recommendation Gateway Operator has the responsibility to define firewall entering flow and segregation of the traffic Cyber security recommendations are involved by good practices of windows Operating System installation best practices are indicated by Schneider Electric Platform Microsoft Windows XP hardening recommendations 4 4 C264 computer No recommendation because the C264 computer is running on a specific hardware and base on non Windows OS 4 5 Additional Recommendation Switchs Switch Manager recommendation to install it on Windows machine secure o Operator has the whole responsibility to define the cyber security policy 4 6 Applications out of cyber security scope Applications PACiS Ol and PACIS SCE are out of scope of cyber security Cyber Security PACIS EN CS C80 PACIS SYSTEM Page 7 14 5 1 CYBERSECURITY POLICY The minimum Cyber Security policy includes e Disclaimer and banner Password use with different profiles or roles e Device hardening unused ports and EWF Security logs Antivirus Applicability The synthetic requirements for each application inside the cyber security scope are described on this table below The presentation of requirements is described on next sections Permanent PC On demand PC Embedded based application based application application Require
80. ital acquisition or a saturation an open circuit or an out of range value for an analogue acquisition OVERSHOOTT1 3 there exist 3 Overshoot states one for each upper threshold violation Only one could be set at one time UNDERSHOOTT1 3 there exist 3 Undershoot states one for each lower threshold violation Only one could be set at one time TPI transmission The TPI are transmitted on a client server basis on the Station Bus network using the same mechanisms than the measurements They are transmitted as soon as a value change or a status change is detected Metering Metering values non tariff metering are issued from single and double counters They represent the number of pulses taken into account 32 bit values Digital counter acquisition is stored to accumulators in non volatile memory The accumulator is incremented at each valid counter pulse IEDs Counters transmitted cyclically are stored to the periodic register and FIFO memory An operator can force the metering values The modification could be a reset of the counter Functional Description PACIS EN FT C80 PACIS System Page 13 38 2 3 4 1 2 3 4 2 2 3 9 Counter resulting states after processing VALID not in one of the below states SELFCHECK FAULTY Due to the SELFCHECK FAULTY ofthe DI UNKNOWN If the counter is acquired via a transmission link the information is unknown when the link is disconnected UNDEFINED Due to a counting fa
81. ith a 0 5 precision Reactive power Q Vars total and on a per phase basis Apparent power S VA total and on a per phase basis Power factor pf total and on a per phase basis pf P S Sequence components ld gt l1 li gt 12 Vd gt V1 Vi gt V2 match Px40 or pos neg to match Px30 Phase angles with a 1 precision Total Harmonic Distortion THD amp Total Demand Distortion TDD Harmonics are evaluated up to the 15 order Magnitudes Synchrocheck information AF AV Ag PACIS EN FT C80 Functional Description Page 12 38 PACIS System 2 3 3 2 3 9 1 2 3 3 2 2 3 4 Tap position indication processing The tap position indication TPI can be acquired on digital input boards It could be a multiple point MP a digital measurement Decimal Gray BCD o analogue inputs by measuring a current a minimum value Imin mA corresponds to the lowest position 1 of the tap and a maximum value Imax corresponds to the highest one e TPI can be suppressed substituted and forced like digital inputs and measurements TPI resulting states after processing VALID Not in one of the below states SELFCHECK FAULTY Due to an Al board fault or a DI board fault FORCED By an operator SUPPRESSED By an operator automatically UNKNOWN If the tap position is acquired via a transmission link the information is unknown when the link is disconnected UNDEFINED Due to a wrong encoding for a dig
82. ize is 1Gb o Check the dates of the msxml dll files located in C WINDOWS system32 folder if they are different from those provided in Tools msxml_dlls zip file on PACIS CD replace them and do not install any third party applications after PACIS Station Bus Agency installation PACiS Station Bus Agency is composed of a set of softwares to be installed on any PC supporting an Ethernet IEC61850 connection For other devices such as MICOM C264 Station Bus agency is part of the product and does not require any specific installation PACIS Station Bus IN chapter describes fully the install procedure Briefly the agency software installation is as follows 1 If a previous version of the agency is installed uninstall it 2 Launch the Station Bus agency installer program and follow instructions Three components are available the Station Bus agency gt the OdFoundry component which should be installed only on the PC which supports the Equipment Simulator the IED tunelling component which should be installed if an IED setting software is used in tunelling mode Installation PACIS EN IN C80 PACIS SYSTEM Page 9 40 4 3 IMPORTANT If the PC on which the agency is installed has two Ethernet ports a configuration file has to be modified as follows to indicate that the agency has to use the chosen port open the lean ctg file located in the exe binder of the agency installation binder add Begin_Remo
83. k are the members of a Security Group in the Active Directory of the DNS Access this group using the MMC console e Click on Start click on Run and in the text box type mmc s e Add the component Active Directory Users and Computers G File Action View Window Help e Om ie SOBRES E 3 Active Directory Users and Computer Users 6 objects GHG Saved Queries 3 9 fudgeco com arial Ph User P A ADMIN f Erin Detyers User ji a f Justin Case User T iii Kent Belevit User H Domain Controllers H ForeignSecurityPrincipals T PMGMaindeskUsers Security Group Global 2 3 PMG Ti PMGUsers Security Group Global H Admins E 3 Computers 3 Servers a 3 4 8 Arial Photo H E Erin Detyers f Justin Case Kent Belevit E PMGMaindeskUsers PMGUsers 7 2 RAD Users Select among the Security Groups the line named Remote Desktop Users in the Builtin directory e Right click on Properties This displays the group members Remote Desktop Users Properties Fx General Members Member or Managed By Members Active Directory Folder E jayasank ar test com Users E shyam test com Users Cancel 45 Click on Add to add members entitled to remotely access the desktop This is not valid if the server is a domain controller PACIS EN IN C80 Installation Page 38 40 PACIS SYSTEM 8 2 5 Connection to the Domain Controller in Administrator mo
84. laxon Control the substation room lights Functional Description PACIS EN FT C80 PACIS System Page 19 38 2 6 Automatic control functions 2 6 1 Interlocking Interlocking function provides authorisation to control a HV or MV switching device circuit breaker disconnector earthing switch protective devices and auxiliary equipment from any control point RCP SCP BCP DCP automation Interlocking equations are written using logical equations of all process information The interlocking equation does not only use the value of the information but also the validity of the information The configuration process allows the user to define or not for each transition open close an interlocking equation Each MiCOM C264 manages the interlocking equations of its own switching devices 2 6 2 Configurable automations PLC PACIS allows the user to configure specific control sequences or automations for example switching sequences busbar transfer load shedding GlS pressure etc during the configuration phase The language used PLC program takes into account the IEC 61131 3 standard The execution of the automation sequences is cyclic nevertheless a dedicated mechanism is provided to avoid data lost Maximum number of cyclic PLC programs is 32 Each PLC program runs on one computer which means a PLC program cannot be distributed within the system However it is possible to use information obtained by other computers Automations can be
85. le Only the data based alarm processing is managed by the MiCOM C264 2 7 2 Alarm display SCP level the alarms are displayed via the HMI at SCP level using o dedicated windows displaying the chronologically sorted list of the alarms with additional sorting criteria as geographic or functional the last N alarms N being user selectable during configuration phase with different colours for each line of the previous lists depending on the alarm state graphic pictures defined during configuration phase displayed in the different views which can be associated to the presence and the states of alarms for a device for a bay for a voltage area for the whole substation etc BCP level the alarms are displayed in the form of one list in the panel This list is a circular queue and is displayed in a scrollable view 2 7 3 Alarm aknowledgement and clearing An alarm can be acknowledged by an operator to signify that it has been taken into account Acknowledgement can be done by the operator at SCP or BCP level An acknowledgement done at BCP level has no impact at SCP level and vice versa Independently of the alarm acknowledgement the audible annunciation can be acknowledged by an operator or automatically after a user selectable delay An alarm can be cleared only if the reason of its apparition disappear becomes inactive and was acknowledged by an operator An alarm can also be configured as to be cleared automat
86. llel wired outputs Each wired output represent a bit of the value Digital setpoints are used to send instruction values to the electrical process or to auxiliary devices Sequential Function Chart One of the IEC1131 3 programming languages language used to define configurable automation System Indication Binary information that do not come from external interface lt is related to an internal state of the computer time status hardware faults lt is the result of all inner function AR PSL or ISaGRAF automation Switchgear Intelligent Control Unit Control unit of an intelligent circuit breaker fourth generation Status Input Group SINAD Signal plus Noise plus Distorsion to Noise plus Distorsion ratio in dB Status Input Double Bit SNTP Simple Network Time Protocol SOE Sequence Of Events Other term for the event list SPS SPC STP Substation computer Suppression Automatic Suppression Manual WR WU T101 T103 T104 TBC TBD T BUS TC TCIP Single Point Single Point Status Single Point Control Structured Text An 1EC1131 3 programming language to define configurable automation Shielded Twisted Pair Bay computer used at substation level A binary information belonging to a bay in SBMC mode will be automatically suppressed for the remote control However changes of state will be signalled locally at SCP A binary information can be suppressed by an order issued fro
87. ltage source The input nominal voltage Un can take one of the following DC values according to IEC 38 24 Vdc 48 Vdc 60 Vdc 110 Vdc 125 Vdc 220 Vdc The DI is equal to 1 if the signal is present and is equal to 0 if it is absent The signal polarity can be positive or negative The configuration allows if necessary to invert the DI value by software The acquisition period of digital inputs is fixed and is equal to 1 ms in MiCOM C264 computers range Debouncing and stability filtering is applied in order to confirm the change of state of a digital input Every change of state is time tagged as soon as it has been detected 2 2 2 Digital measurements PACIS computes digital measurements issued from wired inputs up to 64 associated to the following different encodings BCD Binary Gray code 1 among N decimal Digital measurements are read according to a user selectable cycle and are filtered multiple scan process A digital measurement is invalid in case of incoherency between the type of encoding and the number of bits set to 1 exemple more than one bit is set in a 1 among N encoding 2 2 3 Counters The energy metering devices deliver pulses corresponding to a calibrated quantity of energy Each valid pulse increments the value of an accumulator used to compute the quantity of energy delivered during a given period Counters are acquired on the same boards as the digital inputs and may be single one contact or double counter two contact
88. lticast to the configured receivers Measurements can be transmitted cyclically with a short period from 0 to 60 seconds step 0 1 second or a long period from 0 to 60 seconds step 0 5 second Periods are user selectable on variation according to a of the full scale value the value is sent if the acquired value is different of more than the specified delta from the full scale value variation is user selectable according to a of the current value the value is sent if the acquired value is different of more than the specified delta from the previously transmitted value variation is user selectable on Threshold violation if an overshoot or an undershoot occurs the measurement Is transmitted The measurement is also transmitted at the end of an overshoot or at the end of an under shoot for example threshold minus hysteresis thresholds and hysteresis are user selectable upon trigger upon change of state of a SP a DP or a SI one measurement or a group of measurements are transmitted the association Measurements and SP DP SI are user selectable on Change of state measurements are always transmitted when the change state VALID AKNOWN SUBSTITUTED CT VT Calculations The following measurement values are provided using the CT VT inputs acquisition TMU 200 or TMU 220 RMS currents and voltages Frequency with a 0 01 Hz precision Active power P Watts total and on a per phase basis w
89. lts name is referred to as login The privileges cumulate starting from Observer up to System administrator Eligibility System administrator System administrator System engineer System administrator System engineer Observer A fourth profile is the Security administrator who is only in charge of the security policy He she has exclusive capacity to change passwords No other profile than the four mentioned ones can be created The authentication server hosted in C264 has three clients MS1 is MICOM S1 for short CAT Observer System engineer security administrator System administrator S0632ENa For the same login the password is the same on all computers Two profiles sharing the same credentials login password differ in their privileges as the applications are different It is NOT possible to open several sessions at a time In other words if a user is connected to a C264 using one tool another user can NOT be connected to this C264 using another tool even with another account Profile lockout The lockout is the automatic blocking of a session viewing of the current screen is still possible Any new login attempt even with a correct password is rejected The Security administrator defines the profile lockout policy if no lockout is defined for a profile the sessions last as long as the user logs off on his her own PACIS EN CS C80 Cyber Security Page 10 14 PACIS SYSTEM Several consecutive
90. m aknowledgement and clearing 2 8 IED management 2 9 Time management 2 10 System monitoring 2 10 1 Equipment operating modes 2 10 2 Equipment redundancy 2 10 3 Local remote control operating modes 2 11 Engineering tools 2 11 1 System Configuration Editor PACIS SCE 2 11 2 Stand alone Configuration Tool SCT 2 11 3 C264 Maintenance Tool CMT 2 11 4 Embedded Web maintenance server 2 12 PACiS Watch 2 12 1 Role 2 12 2 Use 2 13 Cybersecurity 2 13 1 General 3 PACIS ARCHITECTURES 4 PACIS ETHERNET NETWORK ARCHITECTURES 4 1 Simple star network 4 2 Redundant optical ring network 4 3 Dual Homing network 4 4 Virtual LAN Di MULTI LINGUAL SUPPORT 5 1 Italian Language 5 2 Greek Language Functional Description PACIS System 21 21 21 21 22 23 24 24 24 25 26 26 26 27 27 28 28 28 31 31 32 33 33 34 36 36 37 37 37 Functional Description PACIS EN FT C80 PACIS System Page 3 38 1 SCOPE OF THE DOCUMENT This document is a chapter of the PACIS SYSTEM documentation lt is the functional description of PACIS SYSTEM and an overview of its elements PACIS EN FT C80 Functional Description Page 4 38 PACIS System 2 FUNCTIONAL DESCRIPTION 2 1 Control points 2 1 1 Remote control points RCP PACIS allows you to control a substation from remote control points SCADA generally located some kilometres away from the substation and usually able to control several substations PACIS can com
91. m an operator No subsequent change of state on a suppressed information can trigger any action such as display alarm and transmission Switch Redundant Computer C264 board Ethernet switch with redundant Ethernet Telecontrol Bus generic name of networks and protocols used to communicate between PACIS Gateway or C264 Telecontrol Interface function and the RCP Networks are based on RS232 485 or Ethernet T104 Protocols are IEC 60850 5 101 1101 Modbus MODICON True Contact Tap Changer in Progress Lexical PACIS EN LX C80 PACIS SYSTEM Page 13 14 TCU Transformer Current Unit Computer C264 CT VT Board Current acquisition TDD Total Demand Distorsion similar to the THD but applied to currents and with a rated current l as reference TG THD Total Harmonic Distorsion sum of all voltage harmonics T Tele Interface TM Analogue Measurement TMU Transducerless Measurement Unit Telecontrol Gateway Topological Interlocking algorithm based on evaluation of topological information of interlocking the switchgear arrangement in the HV network the switchgear kind and position 4 defined rules for controlling this kind of switch e g continuity of power supply TPI Tap Position Indication for transformers Frequently acquired via a Digital Measurement Logic position i ep j lt E Transformer Voltage Unit computer C264 CT VT Board Voltage acquisition C O gt Utility Communications A
92. ment SMT CAT MiCOM S1 C264 kernel SMT Client Disclaimer A disclaimer is displayed at launch Banner Before any IED Banner shown on operation invitation to MICOM S1 8 CAT Profiles password read IED banner to 4 Profile lockout X Log off increase awareness SMT client Unused ports Security logs En Antivirus Not recommended Strongly PACiS CYBER Tool recommended recommended X Requirement exis Requirement does not exist PACIS EN CS C80 Cyber Security Page 8 1 4 PACIS SYSTEM 5 2 Disclaimer The disclaimer is a message shown at launch to transfer the usage responsibility to the user To access to the application the user must accept this contract written in the software language Disclaimer Access to this system is limited to specifically authorized users having received all trainings required by applicables laws regulations and by policies and procedures implemented by the legal entity hosting this system Unauthorized users mar face criminal or civil labilities andor penalties The use of this system may be recorded and monitored for system operations security policy and intellectual property compliance related purposes and any information related to the use of this system may further be disclosed to third parties or law enforcement officials as necessary Disconnect now if you are not an authorized user or do not agree with the above terms Press the button Agree to move on Pressing I
93. municate simultaneously with different Remote Control Points RCP using separate communication protocols and separate databases PACIS can manage up to four RCPs and provides several SCADA interfaces corresponding to a wide range of communication protocols International standards IEC60870 5 101 e IEC60870 5 104 DNP 3 0 de facto standards ModBus OPC CDC Type 2 Specific protocol GI74 o CDC Type 2 HNZ 66515 T101 SAS e SAS If needed other specific protocols can be taken into account and implemented Definition of number and types of communication protocols is user selectable using the PACIS System Configuration Editor SCE 2 1 2 Substation Control Points SCP The whole substation can be controlled from one or several Operator Workstations usually situated inside the substation or in a communication room This control is done via several dedicated Operator Interfaces Ol running on PC like computer called the Operator Workstation which provide to the user the following functions Control functions alarms acknowledgement and clearing control of switching devices circuit breaker switch locking of switching devices e control of transformers control of secondary devices o control of internal automation Functional Description PACIS EN FT C80 PACIS System Page 5 38 Maintenance functions full graphic representation of the system modify the settings
94. ne Configuration Tool is based on the same principles than the SCE but is limited to the configuration of one computer Nevertheless some functions cannot be configured using this tool refer to the SCT documentation Functional Description PACIS EN FT C80 PACIS System Page 27 38 2 11 3 2 11 4 C264 Maintenance Tool CMT To simplify and secure the basic maintenance interventions on MiCOM C264s the CMT is a PC based graphical tool It gives access to standard commands avoiding the use of shell The CMT communicates with MICOM C264 on Ethernet in direct addressing mode With CMT the debug serial link is no more needed Two different configurations are available e maintenance visualisation and modification for example Local access for computer maintenance supervision visualisation only for example distance access Embedded Web maintenance server For maintenance purposes a web server is embedded in MiCOM C264 equipped with a CPU270 CPU3 When connected via a web browser to this web server you can get access to this data Computer identification name Ethernet serial number IP address 1 and 2 e Software version Software date Database compatibilty Computer operating mode OPERATIONAL MAINTENANCE TEST Computer redundancy mode ACTIVE STANDBY NOT REDUNDANT Computer date and time e Number of working hours for the MICOM C264 Database information name version and status MAINTENANCE
95. nfiguration on a per data basis The list of event states for BI Tap Position Indication and measurements which will be printed can be defined in configuration A printed information will be also archived Properties printed are the same than SOE printers above Hard copy printer Hard copy printers allow printing hardcopy views of the Operator Workstation and printing of reports Data archiving The Data Archiving function is the historisation of PACIS information at computer level local archiving at Ol level central archiving Local archiving Local archives are implemented at the level of the equipment that acquires or process the information i e the MiCOM C264s Events are stored in non volatile memory The number of events recorded into a local archive depends on the type of equipment The archived events can be viewed on the computer local HMI Events The data archiving of events is configurable on a per event basis The following events can be archived changes of state of binary inputs SP DP MP SI Groups changes of state of measurements changes of state and value of Tap Position Indications e devices Control actions and acknowledgements The archived events can be viewed on the computer local HMI Fast Waveform Recording Fast Waveform recording allows to store samples at the maximum sampling frequency Waveform records are stored using COMTRADE 2001 binary format Slow Waveform Recordin
96. nother common installation problem is that LBUS cable is correctly protected from perturbation not correctly shielded at both end and or installed into cubicle in contact with CT VT or power digital signal Optical connection is done point to point Optional box allows to make kind of Hubb several input output The common trouble is that fiber bending under a 15cm radius raise permanently signal attenuation until glass breaking With time and electromagnetic field the glass attenuation raises a bit then signal level over attenuation leads to perturbation in communication Station Bus installation Installation of Station Bus based on Ethernet is lightly described in all PACIS devices IN chapters and more in detail into IN chapter of MICOM Hxxx range devices The Ethernet network is composed of cables and switches possibly repeaters The network scheme ask as mandatory define cable length physical layer speed The chapter CO of MiCOM Hxxx range devices and MiCOM C264 computer defines cable characteristic example class 5 for 100T PACIS system has defined a range of network switch defined in MiCOM Hxxx range devices and MiCOM C264 documentation chapter HW amp FT with number of connection and power voltage Copper cable installation problems come often from cable quality compared from environment class shielding protection against animal For optical cable the handling during installation is a standard problem to not bend or even b
97. o the appendix Example Ol Server and Ol Client can be installed on the same machine or not Firewall Optional VPN server Internet SUBSTATION S0621ENa Optional VPN server Internet SUBSTATION S0622ENa When the user launches a PACIS application from a WTS client PC it will successfully communicates with the PACiS Ol server only if the latter one has been launched in a Windows service context launched as a Windows service or launched by a Windows service This is due to due to WTS session mechanisms This implies to install the server application as a service Installation PACIS EN IN C80 PACIS SYSTEM Page 13 40 5 2 2 Application on a Windows 2003 server in service mode For this purpose refer to http www laboratoire microsoft org articles win tse2003 Installation 1 Copy InstalPacisSrv_WS2003 bat to the PACIS setup folder The default location is C Program Files USDATA S2K Bin 2 Copy PacisSrvkeys_WS2003 reg to PACiS setup folder The default location is C Program Files USDATA S2K Bin 3 Run the file InstalPacisSrv WS2003 bat Note This batch file will register S2Kserver as service and setup Register Keys 4 Run regedit and check the value of the following key IHKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Services S2KServer Here the entry ImagePath will have full path of S2KServer exe as its value ImagePath D Program Files USDATA S2K Bin S2K
98. of a O V voltage reference An Al is time stamped with the date time of the scanned value Conventional Measurement CT VT inputs Measurement CT s and VT s are available at a 50 Hz or 60 Hz nominal frequency from They are acquired via a dedicated CT VT board TMU 200 or TMU 220 embedded in the MiCOM C264 Conventional Protection CT VT inputs ProtectionCT s and VT s are available at a 50 Hz or 60 Hz nominal frequency from They are acquired via a dedicated CT VT board TMU 210 embedded in the MiCOM C264P Digital outputs Digital outputs are used to apply a switching voltage to an external device in order to execute single or dual transient or permanent commands The applied voltage is fed from an external power supply The external voltage is connected to the controlled device by a relay thus isolating the logic part of the board from the external power supply The relays can be single pole one contact or double pole two contacts N O relays There are also inverter relays N C with one normally open and one normally closed contact which can be used when positive security Is required Digital setpoints A Digital Setpoint is a set of several digital outputs up to 48 each one of them representing a bit of its value Digital Setpoints are used to send instruction values to the process or to auxiliary devices The Digital Setpoints are processed on the same boards as the Digital Outputs The Digital Outputs characterist
99. ogress recProgress4Pl yslbi rssintegrationlan ager 1 sid rvsintegratianKianager 2 rsFrogressDialog rsFrogressDialogA Fl rvsProgressDialog rvsReporterApi ce Qocoenver sek Mediaserver sapgul Automation SCADA 000 CaeKAlarm Server SCADACOOO Serverexe SENS Logon Events SENS Network Events SENS OnNow Events SENS Subscriber for Eventoystem Event bjectChange events setupLogservices Class SetupscriptDebugger Class Sm rcheck SCWBlnst Sound Recorder Froperties In the Properties window Identity tab set the same user account used by the service to open a session for the applications S2K OpcServer SCADA 2000 CS2KAlarmServer and SCADA 2000Server exe Installation PACIS EN IN C80 PACIS SYSTEM Page 21 40 S2K OpcServer Properties 2 x General Security Identity Endpoints Which user account do you wantto use to run this application C The interactive user The launching user This user User Password Confirm Password Che System Secount services only The same account will be chosen for the configuration of PacisWatch in the service manager see next paragraph Type your password twice for each of these executables Note To launch the Services manager manually run dcomcnfg 5 5 2 Settings as a service Open the Control Panel Administration Tools Services this displays Paciswatch in the services list potentially after refreshing the list On the Paciswatch ser
100. ol or observe a user s session select the following check box Starting program To require the user s permission to control or observe the session select Program file name the following check box MT M Require user s permission Start in Level of control I Specify the level of control you want to have over a user s session View the user s session DS Interact with the session r Client devices IV Connect client drives at logon IV Connect client printers at logon M Default to main client printer Cancel Apply Cancel Apply Administrator Properties i 21x Administrator Properties 21x Remote control Terminal Services Profile Diatin General Member Of Profile Environment Sessions General Member Of Profile Environment Sessions Remote control Terminal Services Profile Diakin Use this tab to set Terminal Services timeout and reconnection settings Use this tab to configure the Terminal Services user profile Settings in this profile apply to Terminal Services Terminal Services User Profile Profile Path Active session limit Idle session limit IN ever When a session limit is reached or connection is broken End a disconnected session Terminal Services Home Folder Disconnect from session End session Local path Allow reconnection Connect ne E To From any client From originating clien
101. ontrol points whatever was the current control mode Controls from configurable automation ISAGRAF are accepted in remote mode SBMC mode You can set each bay in Site Based Maintenance Control SBMC mode A bay in SBMC mode does not take into account the commands issued from RCP even if the substation is in remote control mode All the information issued from the bay are sent to the SCP Nevertheless for the RCP PACIS system provides automatic suppression facility by configuration some information of the bay are not sent to the RCP when the bay is in SBMC mode but a pre configured value Local Remote management on IEC IEC Gateway A configuration attribute allows you to define that the IEC61850 IEC61850 gateway must use the Substation Local Remote information The Substation Local Remote xPS comes from the lower IEC61850 network PACIS EN FT C80 Functional Description Page 26 38 PACIS System 2 11 2 11 1 2 11 1 1 2 11 1 2 2 11 2 Engineering tools The engineering tools associated to PACIS are used for configuration at system equipment level Tools are used at different steps of the life cycle of a PACiS system and by different departments The PACIS system configuration is the core of the engineering toolset the aim of this activity is to create and dispatch all the static data objects programmable functions and parameters into the MICOM equipment System Configuration Editor PACIS SCE There are t
102. or insulated RS485 RS422 Transmission protocol dedicated to time synchronisation and standardised by EDF Specification document D 652 90 26c March 1991 EM Electro Magnetic Compatibility Ensemble de Protection Amperem trique de Terre R sistante French Legacy very resistive earth current module LUE An event is a time tagged change of state value acquired or transmitted by a digital control system FAT Factory Acceptance Test Validation procedures execution with the customer at factory i e SAT Functional Block Diagram One of the IEC61131 3 programming languages language used to define ell d a automation COCO I PACIS EN LX C80 Lexical Page 8 14 PACiS SYSTEM Gateway Level 6 session of OSI the gateway is any device transferring data between different networks and or protocol The RTU function of the C264 gives a gateway behaviour to SCADA or RCP level PACIS Gateway is separate PC base device dedicated to this function GHU Graphic Human interface Unit Computer C264 Front Panel digital part LCD buttons Front RS Gas Insulated Substation GLOBE GLOBE Brick Greenwich Mean Time Absolute time reference Global Positioning System Based on triangulation from satellite signal that transmit also absolute GMT time used to synchronise a master clock GOOSE Generic Object Oriented Substation Event Generic Protocol Translator software supplied by ASE Logical combination of BI i e SP DP Sl or other groups GSS
103. ot there 7 Ensure each group has the Local and Remote access permissions PACIS EN IN C8O Installation Page 16 40 PACIS SYSTEM Default Security Add Remove Permissions for Everyone Allow Deny Local Access Remote Access 8 Click on the Edit Limits button in the Launch and Activation Permissions frame Ensure Administrators Distributed COM Users and Everyone are present lf not add these groups 9 Ensure that each group has the following rights Launch Permission Security Limits Group or user names Administrators 0 W 5M11044dministrators Distributed COM Users 0 WSM110 Distributed COM Users en Everyone Remove Permissions for Administrators Deny Local Launch Remote Launch Local Activation Remote Activation 10 Click on the Edit Default button in the Launch and Activation Permissions frame Ensure that Administrators INTERACTIVE and SYSTEM groups are present If not add these groups Ensure that each group has the following rights Default Security Group oruser names Administrators Ol_PERF2 Administrators Everyone ER INTERACTIVE ER SYSTEM Add Remove Permissions for Administrators Allow Deny Local Launch Remote Launch Local Activation Remote Activation Installation PACIS EN IN C80 PACiS SYSTEM Page 17 40 5 3 Application on Windows XP in service mode 9 3 1 Installation 1 Unzip srvany zip from p
104. ou may edit who i allowed default access to applications You may alzo set limits on applications that determine ther own permissions Edit Default r Launch and amp ctwation Permissions ou may edit who i allowed by default to launch applications or activate objects You may also set limits on appications that determine their own permissions Edit Limits Edit Default 5 Click on the Edit Limits button in the Access Permissions frame Ensure ANONYMOUS LOGON Distributed COM Users and Everyone groups are present if not add these groups Ensure each group has the following permissions 211 EJ ES Access Permission 21x Security Limits Security Limits Security Limits Group or user names Group or user names Group or user names ANONYMOUS LOGON ANONYMOUS LOGON 7 Distributed COM Users Ol_PERF2 Distributed COM Users f Distributed COM Users 0WSM110 Distributed COM Users ER Distributed COM Users 0WSM110 Distributed COM Users f Everyone en Everyone g Add Remove Add Remove For eons for ANONYMOUS Permissions for Distributed COM Deny Users Allow Deny Permissions for Everyone Allow Deny Local Access Local Access Local Access Remote Access Remote Access Remote Access Cancel 6 Click on the Edit Default button in the Access Permissions frame Ensure Everyone SELF and SYSTEM groups are present Add these groups if n
105. pplied to digital input according to its type Toggling filtering 1 MP input Persistence filtering 2 Ci nn Motion filtering 3 Undefined state filtering 4 1 Toggling filtering applied in order to eliminate toggling transitions 2 Persistence filtering DI must stay in the same state on a certain period of time T otherwise are not taken into account 3 Motion filtering is applied to double points in order to avoid take into account transient states 00 11 4 Undefined states of Multiple Points are filtered in order to avoid to take into account transient states all DI in the SET state all DI in RESET state or more than one are in the SET state Toggling parameters persistence time motion and MP filtering time are configurable No filtering except persistence one is applied to SI and Groups inputs Binary inputs can be manually suppressed they are not processed until unsuppression or substituted by another state When a binary input becomes invalid the operator can force it by a valid state The binary input is automatically unforced when it becomes valid again The configuration allows also the user to define automatic forcing when a binary input becomes invalid Functional Description PACIS EN FT C80 PACIS System Page 9 38 Binary resulting states after processing Single Point Double Point Multiply Point CONFIRMED STATES RESET OPEN STATE1 to STATE32 w MOTION FILTERING JAMMED UNDEFIN
106. printed line i e position 1 2 3 4 5 6 or 7 is defined in configuration e Chronology e TimeStamp and synchronisation status the synchronised not synchronised e Origin substation name voltage level name bay name module name ObjectName BI name ObjectMessage BI resulting state Origin Category specifies the category of the originator that caused the change of value bay control station control remote control automatic bay automatic station automatic remote maintenance process e Origin Identification name of the originator who caused the change of value NOTE For the following Common Data Classes these two last columns are empty SPS Single Point Status DPS Double Point Status INS Integer Status ACT Protection Activation information BCR Binary Counters MV CMV WYE Measurement values Complex measurements Harmonic values Functional Description PACIS EN FT C80 PACIS System Page 15 38 2 4 1 2 2 4 1 3 2 4 2 2 4 2 1 Log Book LB printer Types of events printed on the LB printer can be e Binary inputs SP DP MP Sl and Groups Tap position indication Measurement e Operator action Log in and log off Devices control Alarm acknowledgement clearing One or several types of events can be printed the choice is made by configuration The selection of the LB printer destination 1 2 or both for printer at system level is made by co
107. r application is installed uninstall it 2 Launch the C264 installer and follow instructions Several components are available gt three versions of C264 computer depending on the available hardware CPU type Be careful in the choice of the version gt an FTP server to allow software download in computer from the PC gt the COMTRADE IED conversion files if needed by third party application These conversion files are already installed with the SMT gt The PACIS CMT Computer Maintenance Tool At least one computer version the FTP server and the CMT must be installed The CMT will be used to set the computer for software installation PACIS Watch installation PACIS Watch installation is described in the Ol IN chapter Briefly a PACIS Watch software installation is as follows 1 If a previous version of PACIS Watch application is installed don t uninstall it This is recommended to keep settings of the previous version 2 Launch the Watch installer and follow instructions 3 If needed modify the PACIS Watch setting to define which applications shoould be supervised PACIS EN IN C8O Installation Page 12 40 PACIS SYSTEM 9 PACIS DEVICES INSTALLATION AS A SERVICE 5 1 Overview WTS Windows Terminal Server allows to connect to a client application remotely using the Remote Desktop Protocol over a WAN using ADSL modem To enhance security over the Internet a VPN can be deployed for more details refer t
108. rchitecture Communication standard mainly US used for PACIS SBUS communication UPI Unit Per Impulse Parameter of counter to convert number of pulse to Measurement value Both data integer and scaled float are in common class UCA2 Accumulator E O Universal Time Co ordinates or Universal Time Code Naming that replace GMT but it is the same VdBS Versioned data Base System databag generated by SCE amp ready to download VDEW Term used for IEC60870 5 103 protocol VMGA Vertical Measurement Graphical Area Voltage level Set of bays whose plants amp devices are dealing with same voltage e g 275kV Voltage Transformer Basically the electric device connected to process and extracting a voltage measurement By extension part of a device C264 that receives this AC value and convert it to numerical measurement value VT are wired in WTS Windows Terminal Server Microsoft s remote desktop connection WYE Three phases neutral Al values PACIS EN LX C80 Lexical Page 14 14 PACiS SYSTEM BLANK PAGE Cyber Security PACIS EN CS C80 PACIS SYSTEM CYBER SECURITY Cyber Security PACIS SYSTEM CONTENTS 1 SCOPE OF THE DOCUMENT 2 GLOSSARY AND DEFINITIONS 3 DOCUMENTATION REFERENCE 4 RESPONSIBILITIES AND RECOMMENDATIONS 4 1 On demand PC based application 4 2 Permanent PC based application 4 3 Additional Recommendation Gateway 4 4 C264 computer 4 5 Additional Recommendation Switchs 4 6 Appli
109. re with their specific and proprietary documentation PACIS EN IN C80 Installation Page 4 40 PACIS SYSTEM 2 SYSTEM INSTALLATION A system installation is defined since at least two of system devices should work together As they work together a third component needs to be checked with the system network The system installation is then composed of several of the following installation 1 Maintenance PC laptop that might include gt PACIS SCE System Configuration Editor to build modify data bases gt PACIS IEC 61850 Agency for communication on the SBUS gt PACIS SMT System Management Tool to download database and manage the system gt PACIS CMT Computer Management Tool to manage the C264 computer range gt PACIS Documentation system version release note and PACIS software components gt Non PACIS Tools ISaGRAF Workbench terminal console Serial communication spies like ASE SCADA simulator XML Spy FTP server o 2a MiCOM C264 installation that may include gt connected IED on Legacy BUS gt Computer RTU communication to SCADA Telecontrol BUS gt Wiring and cubicles o 2b Operator Workstation based on industrial PC that may include gt needed peripherals printers modem gt PACIS IEC 61850 Agency for communication on the SBUS PACIS Operator Interface PACIS System Management Tool Third party applications y Y Y y PACIS Watch to supervise at least the Ol and SMT applications 2
110. reak glass Especially with glass fiber shelding is recommended especially for mice Optical cable has emitter receiver fibers to clearly distinguish before starting the install As remind in SA chapter glance into fiber can damage eye and specific tool is recommended to commission one by one the fiber PACIS provides via specific switch a redundant Ethernet Because it is redundant a single test can hide a wrong installation of master secondary network lt is recommended to make commissioning after each switch installation and not globally Telecontrol Bus installation Two PACIS devices Computer or gateway can have connection to SCADA via S BUS The basic installation is described into their IN chapter In both case TBUS communication might need a modem to get into PSTN or RNIS networks Modems are country dependant and not part of the system Modems should be configurable for all communication parameters Installation PACIS EN IN C80 PACIS SYSTEM Page 25 40 7 NON PACiS DEVICES INSTALLATION 7 1 PACIS Ol printer In standard installation PACIS Ol printers are installed on same OWS that the server part of PACIS Ol Printer has normally to be powered and connected before starting installation to use Plug in and automatic detection during driver installation on PC Using Microsoft Windows 2003 or XP Parameters Printer makes a standard Add Printer to start windows installer assistant Assistant proposes a kind of printer e local
111. rectly without need selection DE Control sequences are executed if the computer is in operational mode However PACiS system allows to perform control sequences in test mode in order to simulate controls for devices In this mode output relays are not activated controls are not sent to IEDs or on station bus and only the control acknowledge is managed Some system outputs controls such as switch database change computer mode are allowed in maintenance mode The following checks user selectable can be performed before the acceptance of the control e the Inter control delay has expired time between two sequence in the same device substation bay and SBMC mode allow the control e interlock equation and topological interlocking allow the control no automation is running for the device e the device is not locked e the current status of the device is on the opposite state e uniqueness control only one control at a time for the device If these checks are configured they are checked by the MiCOM C264 in each phase of the control sequence allowing the switching devices to operate in security An acknowledgement positive or negative can be issued sent to the different control points archived and printed Interlocks can be by passed by the operator depending on its access rights The operator request is also printed and archived 2 5 2 Control sequence of switching devices PACIS control switching devices su
112. rver The client may provide all or part of functions handled by the substation HMI Read Inhibit il This output indicates the availability of an analogue output e g during DAC converting time RJ 45 Registered Jack 45 A 8 pin female connector for 10 100 Base T Ethernet network Lexical PACIS EN LX C80 PACIS SYSTEM Page 11 14 Root Mean Square Rapid ReClosure RSE R gime Sp cial d Exploitation French grid function when works are being done on a HV feeder RSVC Relocatable Static Var Compensator RS 232 Recommended Standard 232 A standard for serial transmission between computers and peripheral devices RS 422 A standard for serial interfaces that extends distances and speeds beyond RS 232 Is intended for use in multipoint lines RS 485 A standard for serial multipoint communication lines RS 485 allows more nodes per line than RS 422 RSVC Relocatabled Static Var Compensator RTC Real Time Clock RTU Remote Terminal Unit Stand alone computer that acquires data and transmit them to RCP or SCADA Typically it is the C964 RTU link is the TBUS SAT Site Acceptance Test Validation procedures executed with the customer on the site SBMC Site Based Maintenance Control mode A bay in SBMC mode does not take into account the commands issued from RCP moreover some of its digital points amp measurements defined during the configuration phase are not sent anymore to the RCP they are automatically
113. s the true contact TC and the complemented contact CC For a single counter SCT the value of the accumulator is incremented after a low to high transition confirmed after a filtering time Up to 24 SCT can be acquired on a per MICOM C264 computer basis For a double counter DCT pulses are detected in the same manner as for SCT on the TC True contact variations The pulse CC the complemented contact must be inverted regarding the TC contact The maximum frequency of the pulse is 20 Hz 2 2 4 Analogue inputs Analogue inputs Al are voltage or current DC signals delivered by transducers and representing an external value Input ranges are For voltage 10 V 5 V 2 5 V 1 25 V 8 For current 0 1 mA 0 5 mA O 10 mA O 20 mA 1mA 2 5 mA 5 mA 10 mA 20 mA 4 20 mA The analogue inputs are acquired on a periodical basis There exist two acquisition cycles o a short cycle N x 100ms Nse configurable from 1 to 10 with a default value of 1 a long cycle Nic x 500ms Nic configurable from 1 to 20 with a default value of 2 Functional Description PACIS EN FT C80 PACIS System Page 7 38 2 2 9 2 2 6 2 2 1 2 2 8 2 2 9 The accuracy of the complete acquisition chain is 0 1 of the full scale for each range at a reference temperature of 25 C The Analogue to Digital Converter has a 16 bit resolution 15 bits sign bit and the zero offset value is computed by the conversion
114. se they synchronise their IEDs through the legacy protocols synchronisation signal External Clock Which synchronises D through SCADA bus System Master Clock D IEC61850 equipment Which synchronises Which synchronises Operator time setting through station bus Which synchronises through legacy bus SO411END In the event that the external clock does not exist or is lost the System Master Clock equipment can be synchronised by a SCADA or by an operator Synchronisation priority of the System Master Clock is in the following order 1 From the external clock if it exists 2 From the SCADA if it exists in case of failure of the External Clock only if the SCADA protocol is managed by the System Master Clock computer 3 From the operator in case of failure of the External Clock and the SCADA Each Station Bus equipment after reception of a synchronisation message performs its local update procedure MiCOM C264 if the delta between the local clock and the synchronisation message is less than 20 ms a smooth increase decrease of the local clock is done Otherwise the local clock is immediately set with the date time of the synchronisation PC local clock is updated using the operating system procedures PACIS system is capable to deal automatically with seasonal time changes by using indications coming from the external clock or using the Time Zone table In case of lost synchronisation to one of th
115. smallest one authorised only lower command is allowed if the tap position value is the higher one authorised Transformers can be managed in the three modes Direct Execute SBO once and SBO many Direct Execute only one control raise or low is performed in the control sequence The initiator of the request must perform many Direct Execute sequences before reach the expected position e SBO once the sequence is similar to the Direct Execute but the execution phase is preceded by a selection phase In this phase are performed all controls checks and the selection of the device if it is configured SBO many after the selection phase many controls raise or low can be performed in the same sequence in order to reach the expected position The sequence ends only after an unselect request from the initiator Control of secondary devices PACIS control secondary devices like protective relays or IED allowing to non exhaustive list o Modify the setting groups parameters used by a protection equipment for example 1 among N command type if N setting groups are available for the protection o Reset some internal indication for example single command type to reset alarm indication on a protective relay Set active or inactive an external equipment or apparatus for example ON OFF or IN OUT single or double command type e Send analogue or digital Setpoints to external apparatus or equipment o De active the alarm k
116. stem This may be done with Hopf radio clock Installation of Hopf device is described in detail in its documentation It is based on the Hopf 6870 GPS radio clock as a separate device that transmits time synchronisation via IRIG B signal The electronic device has link to antenna and maintenance software Antenna should be installed on building top to see maximum of GPS satellites 4 or more Care should be taken during this operation on roof against fall and possible power line neighbouring Special protection against thunder lightning should be taken at antenna neighbouring and limited distance from all electronic devices to common ground usually 10m Link between antenna and Hopf radioclock is made by 25 meter cable 70m can be reach with another special cable after line amplifier should be added Maintenance software helps to commission correct detection of position then time and definition of transmitted synchronisation Hopf 6870 should be powered 18 60V DC Once the hardware is installed and maintenance software has been used to configure synchronisation save the set up and install system synchronisation The time synchronisation scheme is to distribute the IRIG B synchronisation to one MICOM Computer C264 with IRIG B based on BNC cable T and 50ohms impedance termination This computer will then synchronise the other SBUS equipment through the Ethernet network PACIS EN IN C80 Installation Page 26 40 PACiS SYSTEM 8 NO
117. t Unit Computer C264 Board name for Digital Input Lexical PACIS EN LX C80 PACIS SYSTEM Page 7 14 Dynamic Link Library Available on Windows XP A feature that allows executable code modules to be loaded on demand and linked at run time This enables the library code fields to be updated automatically transparent to applications and then unloaded when they are no longer needed DM Digital Measurement Is a measurement value which acquisition is done by DI and a specific coding BCD Gray 1 among N Distributed Network Protocol DNP3 is a set of communication protocols used between components in process automation systems Digital Output Used to apply a voltage to an external device via a relay in order to execute single or dual transient or permanent commands Degree Of Freedom Used for a template attribute that can be modified or not when used An attri bute has a degree of freedom if a user can modify its values on its instances Digital Output Unit Computer C264 Board name for Digital Output Double Point Information control derived from 2 digital inputs output usually used for position indication of switching devices OPEN CLOSE Double Point Control Double Point Status Position indication of switching devices OPEN CLOSE lECDD Coherent Extract of Distributed Data Extended Communication Unit External module connected to the CPU board This module converts non insulated RS232 into optical signal
118. t only Cancel apply Cancel App Make sure the box Deny this user permissions to log on to any Terminal Server is NOT checked Terminal Services Profile tab 8 2 3 3 Policies e Click Start click Run and in the text box type mmc s and then click OK From the Console menu select Add Remove Snap in and click the Add button From the Available Standalone Snap in list select Group Policy and click the Add button In the wizard select the local computer and click Finish e In the list click Close In the Add window click OK PACIS EN IN C80 Page 36 40 Installation PACIS SYSTEM This grants access to the Local Computer Policy that allows to configure all the users interfaces in the Default Domain Controllers Policy console expand Computer Configuration navigate to Administrative Templates Settings then to Windows Components and select Terminal Services i Console1 Console Root Local Computer Policy Computer Configuration Administrative Templates Windows Components Terminal ser ic Mn File Action View Favorites Window Help JJ Console Root E Local Computer Policy Computer Configuration 3 Software Settings J Windows Settings 3 Administrative Templates f Terminal Services Client Server data redirection Description Controls access to data and devices on a client computer in Terminal Services sessions
119. te Common Name locallP AP Title 1 3 9999 23 AE_Qualifier 1 Psel 00 00 00 01 Ssel 00 01 Tsel 00 01 Transport TCP NSAP 49 00 01 53 49 53 43 09 01 01 lp_addr lt IP gt End Remote With lt IP gt the IP address of the port the agency has to connect to PACIS SMT installation PACIS SMT is composed of two applications server and client The station maintenance PC has licence for both applications SMT Server application is normally installed on main OWS that support PACiS Ol server It should be installed after PACIS Ol server even if needed to commission it PACIS SMT IN chapter describes fully the install procedure For commissioning it is reminded that client application should be only started after server application part or kernel When client application is remote communication link via ping function should be tested before commissioning SMT client Briefly a SMT software installation is as follows 1 If a previous version of the SMT is installed uninstall it 2 Launch the SMT installer program and follow instructions Three components are available gt the kernel or server only one kernel could be installed in a PACIS system gt the HMI or client one client can be installed on the PC which supports the kernel Other clients can be installed on other PC gt the HMI set up which allows to install HMI on other PC without using the installation CD ROM The SMT doesn t install the Sta
120. ted to a unique account MiCOM C264 setting tools NERC The North American Electric Reliability Corporation Ol Operator Interface Profile List of functionalities SCE System Configuration Editor SMT System Management Tool User A physical person Cyber Security PACIS EN CS C80 PACIS SYSTEM Page 5 14 3 DOCUMENTATION REFERENCE Not Applicable PACIS EN CS C80 Cyber Security Page 6 1 4 PACIS SYSTEM 4 RESPONSIBILITIES AND RECOMMENDATIONS 4 1 On demand PC based application Definition On demand PC based applications launched from a laptop or not exclusively PACIS applications are considered as Temporary PC based application in PACIS Systems SMT Client MICOM S1 and CAT Unused Ports Operator has the responsibility to close the other ports not used by applications in order to secure access refer on Appendix on section Port reservation Antivirus PACIS applications are authorized to run with the condition an antivirus is installed Operator has the responsibility to realize the PC scanning and antivirus updating 4 2 Permanent PC based application Definition Time critical applications running permanently on a PC like PACIS GTW without HMI PACIS SMT kernel are considered as Permanent PC based application Unused Ports Addressed through good installation practices of windows Operating system is recommended refer on section Device hardening and EWF Antivirus Due to time critical applications antivirus installat
121. ted to cyber security in a circular buffer the size of the file depends on the sub system capabilities It includes the following information e Date and time year month day hour minute second and millisecond e User level that performed the changes Actions Antivirus efficiency Login successful or not or attempt Manual Automatic logoff Port disabled Firmware change resulting in a firmware change Password level change Security log viewing downloading Example SHELL OW TELNET ON ETHERNET 1 FEETHERNEI E SYSTENG LOG IN FL BAD PASSWORD OBSERVER LOG IN FANTI VIRUS OK OBSERVER LOG OFF 43 E 43 E 45 t 45 t 277 C Pe i 37 C PACIS EN CS C80 Cyber Security Page 12 14 PACIS SYSTEM 5 8 Antivirus The Windows based PCs are vulnerable to viruses At application launch the PC does a check for an antivirus presence In case of absence it is up to the user to move on or not as stated CAT Antivirus Warning Antivirus check failed No antivirus found You can either close CAT by clicking on button Cancel or continue working with CAT by clicking on button Continue If you choose to continue you must be aware and understand the risk Continue Cancel At application launch the PC does a check for the virus signatures list date e if the list is up to date the application moves on Otherwise the user is advised to update it The check result is recorded in t
122. thout external resistor Functional Description PACIS EN FT C80 PACIS System Page 21 38 2 7 Alarms management 2 7 1 Types and definition Alarms can be generated by a change of state of a digital point a measurement threshold violation a PACIS internal fault for example loss of communication computer faulty Digital points and measurements involved in alarms management can be issued from wired inputs or from IED or protective relays or from PACIS internal computation for example digital groups Alarms can be defined as immediate or differed with an associated user selectable delay and can have an associated audible alarm The audible alarm can also be immediate or differed Alarms can be associated to each state of event open close jammed or to a measurement threshold in case of violation and may have a different gravity level 0 5 Four types of alarm management are available on PACIS system and are user selectable during configuration process e state basis alarm management one alarm for each state is displayed gravity level basis alarm management only one alarm for each gravity level is displayed The previous one is replaced by the current one with same gravity level e data basis alarm management only the last alarm is displayed The previous one is replaced by the current one Spurious alarms management are defined for events which appear but never disappear control acknowledgement for examp
123. tion Bus agency If it has not been previously done the agency must be installed PACIS EN IN C80 Installation Page 10 40 PACiS SYSTEM 4 4 4 5 PACIS Ol installation PACIS Ol is composed of two applications server and client The Operator Interface package is composed of server part connected on SBUS and client part displaying mimics The PACiS Ol IN chapter described fully installation requirement and procedure Let remind from this documentation that Microsoft Windows 2003 or XP should be correctly installed before with IP and name With remote client applications Microsoft Windows 2003 SERVER should be installed first The client commissioning suppose to check first communication to server application Evolution from local Ol client s to remote Ol client s need to reinstall a Microsoft Windows 2003 with SERVER licence The Station Bus agency installation should be done before PACIS Ol Server application Briefly a complete client and server OI software installation is as follows 1 Check if SQL Server 2000 or 2005 is installed If no install it If yes delete the Historian database 2 If a previous version of Ol application is installed uninstall it and reboot the PC 3 If OI and or SCADA 2000 applications have been uninstalled reboot the PC 4 Launch the Ol installer and follow instructions 5 Reboot the PC If PACIS Ol and PACIS GTW are cohosted enter both IP addresses in Internet Protocol Propert
124. ts automatically this stopped tool after a defined timeout if the user has not yet restarted it This depends on the value of the RestartAfterUserExit flag of the ini file see Settings in Ol ENIN The timeout duration after quitting also be set in the same way By default there is no automatic restart of the two system tools Functional Description PACIS EN FT C80 PACIS System Page 31 38 2 13 Cybersecurity 2 13 1 General There are 4 user profiles The application will have up to 4 profiles protected by password so 4 roles are predefined The login password defines the menu that you can use The password length could be extended to 8 digits Disable the unused application and physical ports You must disable all of the unused physical ports You must disable all of the unused Ethernet ports Profile lockout log off after x minutes of inactivity Store security logs make a record of the date time and log duration Circular buffer size depends of the device Antivirus When you start an application a disclaimer is displayed Make sure that the user always knows where he operates You can show a user banner if necessary PACIS EN FT C80 Functional Description Page 32 38 PACIS System 3 PACIS ARCHITECTURES The PACIS System architecture is always based on a Station Bus to which are connected PACIS amp MiCOM equipments used for the customer solution These equipments are the Operator Workstation PACIS Ol the
125. uction IT Chapter This document contains the description of each document and an outline of the product features Functional Description FT Chapter This chapter contains a description of function supported by the product Installation IN Chapter This chapter contains the installation procedures Lexical LX Chapter This chapter contains lexical description of acronyms and definitions PACIS EN IT C80 Introduction Page 6 6 PACiS SYSTEM BLANK PAGE Installation PACIS EN IN C80 PACIS SYSTEM INSTALLATION Installation PACIS SYSTEM CONTENTS 1 INTRODUCTION 1 1 Scope of the document 2 SYSTEM INSTALLATION 2 1 Installation ordering 2 2 Kind of PACIS system Installation 3 REQUIREMENTS 3 1 General PACIS system requirement 3 2 Basic requirement 3 3 Installation end requirement 3 4 System Commissioning Application requirement 4 PACIS DEVICES INSTALLATION 4 1 PACIS SCE installation 4 2 PACIS Station Bus Agency installation 4 3 PACIS SMT installation 4 4 PACIS Ol installation 4 5 PACIS Gateway installation 4 6 MiCOM C264 installation 4 7 PACiS Watch installation 5 PACIS DEVICES INSTALLATION AS A SERVICE 5 1 Overview 5 2 Application on Windows 2003 server in service mode 5 2 1 Installation 5 2 2 WinPcap settings 5 2 3 DCOM settings 5 3 Application on Windows XP in service mode 5 3 1 Installation 5932 Settings 5 4 Launch the application 5 5 PACiS Watch in service mode 5 5 1 Setttings
126. ur the system tools crashes are considered too repetitive and Pacis Watch reboots the PC as default behaviour As other possibility it can stop itself after stopping all the watched tools if the user prefers this option In event of crashes of the secondary tools PACIS Watch restarts them systematically independently of the number of crashes Their crashes can t lead to the PC reboot Use Start In this mode PacisWatch takes in account the PacisWatch ini file located in C Program Files PACIS PacisWatch directory It is possible to load and switch the BD with SMT There are two ways to launch PACIS Watch o at each PC boot via a PACIS Watch shortcut present in C Documents and Settings All UsersiStart Menu Programs Startup folder as shown below So the final user does not have to launch PW himself herself File Edit View Favorites Tools Help Back cuis Se E en EB LE X_n a EE Folders E Startup a MPACIS O Client 2KB Shortcut 3 UltraEdit PACIS Watch 1KB Shortcut a WebTerm X Power Plugin Eh Service Manager 2KB Shortcut El Functional Description PACIS EN FT C80 PACIS System Page 29 38 by selecting the PACIS Watch item from the Start Program menu in this case the shortcut of the C Documents and Settings All Users Start Menul folder is activated as shown below EN C Documents and Settings All Users Start Menu Programs Fle Edit View Favorites Tools Help l Back w gt Asearch Gi
127. ver S0624ENa Local application Remote Desktop j WTS CLIENT WTS SERVER WPN SERVER WPN CLIENT S0625ENa Two VPN servers Local application Remote Desktop WTS SERVER VPN SERVER VPN SERVER WTS CLIENT S0626ENa 8 2 2 WTS Server installation Windows Server 2003 The server must be installed with the Terminal Server role e either through the link Manage your server in the Start menu select Terminal Server or through the Control Panel Add or remove a component check Terminal Server in the list and complete the installation PACIS EN IN C80 Installation Page 34 40 PACIS SYSTEM 8 2 3 Terminal Server services configuration Windows Server 2003 8 2 3 1 Console operation and group permissions Open the console using Administration tools gt Terminal Server configuration Click RDP Tcp to open the Properties window tscc Terminal Services Configuration server Settings File Action View Help Terminal Services Configuration Attribute Connections fg Delete temporary Folders on exit Yes ni Y Server Settings lag Use temporary Folders per session VES AY Licensing Remote Desktop For Administration RE Active Desktop Enable Rd Permission Compatibility Full Security no Restrict each user to one session No In the Connections node configure the connection operation and the permissions of the group Remote Desktop Users In the Server Settings node various options are available Active desktop
128. vice right click Properties and select the user account used by the service to open a session PACIS EN IN C80 Installation Page 22 40 PACIS SYSTEM paciswatch Properties Local Computer General Log On Recovery Dependencies Log on as Local System account E Allow service to interact with desktop Administrator Browse Password Confirm password You can enable or disable this service for the hardware profiles listed below Hardware Profile Profile 1 Enabled Enable Disable 1 Under Log On tab click on This account then choose the same account with administrative rights than the one configured in paciswatch service properties 2 Using the Browse button click on the domain or the work group of the wished user or group 3 In the list Name click on the user or group account or enter the name of account in the area Name then click on OK 4 In the fields Password and Confirm the password type the password of user account The user account that you select should be created in the local users and local groups of the PC Management tool specifically to log onto the service In the area User properties make sure that the option The password never expires is enabled for the user account and that this account is member of the appropriate groups Select the Automatic option in the Startup type field in the General tab This allows this service to start automatically after a PC reboot as
129. wo kinds of configuration activities e Modelling this activity consists in the creation modification of object classes and corresponds to a development phase of the PACIS system o Manufacturing this activity consists in the instantiation of objects to generate a PACIS system database according to a customer substation The pre configuration is constituted by the set of object models The configuration is constituted by the real objects of a PACIS system database Missions The different missions of the system configuration are create update the objects for system devices according to customer and substation requirements check coherency and consistency between the objects before deployment into the system database versions management with the delta capability o automatic documentation generation Objects Modelling The modelling define several families of objects which are handled by the system configuration o electrotechnical architecture objects which defines the substation topology for example bays switchgears transformers measurands system architecture objects which defines the SCS architecture for example equipment of the system e functions description objects which define the functions accomplished by the SCS for example overcurrent protection function e real time exchanged data which define the communications between equipment and functions Stand alone Configuration Tool SCT The Stand alo

PACiS SYSTEM - Schneider Electric

Contents

Download Pdf Manuals

Related Search

Related Contents