WORKING GROUP

23•05

ACCEPTANCE TESTING
of Digital Control Systems for
HV Substations

1.Introduction
The first industrial applications of
Digital Control Systems (DCS) in HV substations go back to the eighties. Since then,
the number of DCS in service grows each
year.
On the one hand the functions implemented up to now in these new control systems differ little from conventional systems,
and on the other hand, the processing and
the exchange of data within the DCS totally
differ from conventional systems : each processor in a DCS does the job of several independent and dedicated units in a conventional system, serial links replace classic
wiring, signals from the switchyard are
acquired once and put at the disposal of the
different processors via serial links instead
of being acquired in each of the dedicated
units. The difference also applies to the way
the systems are tested both during factory
tests and on-site.
Due to the integration of functions in
the DCS, the issue of availability of the DCS
is of a particular importance. As an example, we can consider switchyard control. We
usually distinguish three command levels:
bay level, substation level and remote control centre level. In a conventional system,
these three levels are independent. In a
DCS, depending on the selected architecture for the DCS, the same equipment handles the substation level and the interface
for the remote control centre.
This means that the loss of one equipment could result in the loss of these two
levels. This issue has to be studied during engineering and, to confirm system

integrity, a number of tests have to be carried out.
The integration of functions in the
DCS could give rise to test problems at the
time of later adaptations particularly when
the operating constraints require all or a
part of the installation to be kept in service during changes.
These observations induced Study
Committee 23 “Substations” to request the
WG to study acceptance tests of DCS in
greater detail.
The paper addresses the tests at the
manufacturer’s plant – factory acceptance
tests – as well as the tests on site.

2. Functions implemented in the control
system
Functions included in the DCS differ little from the conventional systems at
the exception of self checking functions
and automatic switching sequences that
are particular to DCS.

3. Comparison between “Conventional
Control” and “Digital
Control System”
It is fundamental to know the internal
workings of the DCS in order to be able to
lay down test procedures applicable to the
different cases described below. Today, we

23 • 05

WORKING GROUP 23.05

L. UYTTERSPROT (Belgium)
L. GRAINE (France)
W. DIETERLE (Germany)
H. NOGUCHI (Japan)
R. JEANNOT (France)
H. TIMMERMAN (The Netherlands)
G. SCANU (Italy)

often find in HV substations a decentralised architecture including, at bay level,
an acquisition unit and protective relays
connected with the acquisition unit via a
serial link and, at the substation level, a
central unit. The central unit is connected
to all bay units via a serial link. We find
in the central unit all functions related to
the substation level, the MMI, the interface
to the upper level and, in the bay units,
all functions particular to the bay.
The main feature of conventional systems is the physical independence of the
functions and the exchanges of information between the different units via pointto-point electrical links, each link corresponding to an information. Conversely,
with DCS, we have an integration of functions at bay level as well as at substation
level, plus sharing of the same serial links
between the different functions.

4. Conventional Control System - Test Procedure
In the tests of conventional control
systems there is a clear separation between
substation control and remote control,
usually materialised by a marshalling unit.
Tests are based on specifications, required
functionality and drawings.
➤ Factory acceptance tests
Individual acceptance tests are performed on each unit. This will hardly give
rise to problems because each unit performs a clearly defined function.

No. 201 - April 2002 ELECTRA 21

are related to site tests. the checking method. information flow.3. on the other hand functional and performance tests of the whole system. HV apparatus. remote control cubicle. etc.2 Different cases Factory and site tests will differ according to the circumstances and the need to minimise operating constraints : ➤ New control system 5.1 General issues We distinguish between Functional test and Performance tests (control of time delay for handling information.April 2002 ELECTRA 23 .New control system 5. UNIX. e. Of course. 201 . covering of self checking). Digital Control System . but this time the complete installation from HV apparatus up to the remote control centre will be checked. the link between the remote control cubicle and the dispatching centre requires other test means. This means that except the combination test with site equipment all the test items shall be executed at factory.3. 5. the scope of acceptance test at factory shall cover all the test items except the limited ones that can be executed at site only. Factory acceptance test . See table 1 which gives a list of test items. ➤ Software evolution ● general purpose software (e.g. ➤ Modification. for control and protection cubicles. protection relays. etc. telecontrol and local control come first. Individual functional and performance tests are related to factory acceptance tests.2 Test specification and environment ➤ Preparing test specification ● It is essential for both user and manufacturer to jointly thoroughly check test items and test procedures in order to avoid omissions and to clear misunderstandings. and are followed by supporting systems. analysis of interference on serial links. © Alstom (France) The required test means vary from unit to unit. analysis of the loss of a module. remote control. ● Each test item shall be documented with its purpose. addition of a function 5. Site tests are aimed basically at checking the coherence between primary and secondary equipment as well as between the different units of the secondary installation (already tested during factory acceptance tests). Testing of the DCS requires on one hand individual functional and performance tests for DCS.Test Procedure ➤ Addition of a bay (spare bay or newly added bay) ➤ Modification. For the DCS itself they are mainly software tests. for example. design. Concerning priority of test items.g. a bay simulator and a test set for analogue signals. Windows) ● firmware (programming functions implemented by the Manufacturer ) ● application software (programming functions implemented by the Manufacturer or the User).3. characteristic data collection under different application modes and status of operation.1 Test items In order to reduce site test items.g.C O N T I N U E D W O R K I N G G R O U P 23•05 23 • 05 ➤ Site acceptance tests Site tests start again with all or a part of the acceptance tests. No. The other units – mimic board. basic functions shall be confirmed first. hardware. ● Test specification shall be checked before issue by the different engineering teams : software. Checking of the co-ordination with HV apparatus and other existing equipment. ● Test items shall be determined so as to cover entirely the engineering specifications. addition of a data (database/ wiring) 5. the assessment criteria and the density of recursiveness. – require elementary test means capable to read or impose the exchanged information. 5. if any. e.

This test team may if needed be strengthened with experts from the manufacturer. it is preferable to assemble operator console.e. the organisation of the test team. combined tests and tests outside normal conditions shall be executed to obtain higher quality assurance and reliability. It also addresses the problems of questionable specifications or changes of specifications which arise during tests. No.2 Test procedure and environment The tests are executed on site. total system tests and user’s witness tests. i. depending on the test team’s expertise and on the results of factory acceptance test.4 Schedule It is necessary to consider the following critical periods in the schedule : ➤ Possible periods for data amendments and software changes that may be requested by the user.6 Management The management plan concerns safety during factory acceptance tests. It is recommended for future system development to record for each item the test process details such as period. Progress management monitors and controls actual progress compared to planned. The test team includes experts in DCS. protective relays. In case of a replacement of an existing control system. The test team execute the tests according to the test document.1 Organisation The responsibility of the project leader concerns the test document.3. if applicable. mimic board and telecontrol equipment at the factory even if they are under separate contracts. If any test item differs from the test specifications. i. software modification.e. System environmental management deals with history of change for hardware and software platform. System configuration. the person who is responsible for the factory acceptance tests and the person from the user’s side who has authority for approval. If this is not possible. i. in the substation. Analysis of the results shall include measured degree of performance. 5. etc.e. Similarly.C O N T I N U E D ➤ Test environment To create a test environment for the DCS as close as possible to the real substation. At this stage software is considered as a black box. ➤ Possible periods for software improvements following faults detected during the tests. If software changes or modifications are necessary.3. The tests after software changes or modifications shall cover all items related with the modified item. Continuous working tests. in protections.Organisation Test execution and test management organisations are described in a document mentioning the distribution of the work between user and manufacturer. Test review will take place at the end of each phase. the decision whether accepted or not. These tests shall be carried out in accordance with test specifications. we recommend to use a simulator instead. not on software design or manufacturing. work-days. W O R K I N G G R O U P 23•05 5. test progress. the execution of the tests and the transfer of the tested system to the user.4 Site acceptance test New control system The purpose of the site test is not to repeat factory acceptance test but to control the operation of the DCS in reality. The test procedure depends on the status of the substation. connected to all equipment such as primary equipment. The test review will be part of the acceptance test report. ● Initial state of the DCS shall be stated for each test item. etc. 5. swap file area and process priority. This test review will be placed under the responsibility of the nominated person. system configuration.4. telecontrol.3. 201 . ➤ Periods for analysis and assessment of the acceptance tests. 5. problems encountered. in telecontrol. Safety management covers safety at the factory related to the use of temporary equipment. Problem management determines the methods for problem documenting and processing. facility data. the switching of the primary equipment will be subject to authorisation by the grid operator.5 Test process and review Tests shall be executed by using adequate tools to verify elementary and compound functions in short period efficiently. problem processing and system environment. 5. precautions must be taken when executing tests involving telecontrol. The test items shall be focused on power system operation and application. It will also organise the meetings during test periods.April 2002 ELECTRA 25 . ● Spot tests and new or existing type-tests.4. The method for processing problems or questions relating to a test item shall be mentioned in the test specification. the issue shall be clearly understood by the test team and the related design files shall be checked by designated people. internal data version. and will mention tester name.3. ● Environmental requirements for the tests. Another possibility is to call the manufacturer for particular tests. 5. the situation shall be documented. for the telecontrol equipment for example. in primary equipment.3. equipment and tools which will be used for the acceptance test are specified. after combined tests. It is important to have a test document specifying the following items: ➤ organisation ➤ test procedure and environment ➤ test items and schedule 23 • 05 ● Provision for progress management. 5. remedy management and version management shall be made in the test specification. approver name and date. Software platform covers application program.

e. Conversely.5 Addition of a bay 5. maximum number of bays. all equipment is installed and all tests have been done. This is obviously impossible with the existing DCS and the only option left is that of performing factory acceptance tests on a reference DCS. 5. The problem is different if the addition is made by the user. If the database alone has been modified.6 Modification. and tests results are recorded in a test file.5. For substationrelated functions the test system consists of a central unit and a number of bay units.3 Test items and schedule The test document contains a list of test items. Faults have to be repaired as soon as possible and the items tested again. i. However. connected to the H. 5. no equipment. this means same hardware and same software. and ascertain the coherence between primary installation. in case of software adaptations. 23 • 05 The team executes the tests according to the test document. no test. telecontrol. Furthermore. … The second objective of the site tests is to control the coherence between primary and secondary systems and telecontrol. he must use his own reference DCS. As factory acceptance tests have already been performed it is not necessary to repeat all those tests on site. For bay-related functions the test system is composed of a bay unit and a central unit.are still met when the new bay is added.4. the spare bay and the related functions and data were deactivated from DCS and will now have to be activated.5.April 2002 ELECTRA 27 . During site tests.5. factory acceptance tests for the spare bay are not required and one can proceed directly with the site test. The addition of a bay requires additional hardware. This test system must be identical to the existing DCS. MMI.3 Newly added bay In this case nothing has been foreseen for the additional bay in the DCS – no engineering. tests have to be carried out on a test system. site tests are sufficient because the existing bays remain unchanged. data . When all items are successfully tested.V.g. Random tests are sufficient. new function or activation of an existing function in the software library. DCS and telecontrol. we suppose that the engineering for the (spare) bay has already been completed. or in the other case the building of a new bay is decided.e. Another aspect requires close attention : it is necessary to verify that the design constraints of the DCS . As all tests for the spare bay have already been carried out during the factory acceptance tests of the existing DCS. The addition of functions will be studied further.g. W O R K I N G G R O U P 23•05 5. This requires that the user should have the complete hardware and software description of the DCS in order to evaluate the consequences of the addition of the bay.g. After these tests. Which tests should be done ? The answer to this question depends on the consequences for the DCS of the addition of the new bay. the user will take over the new installation and put it in service. In the first case. 201 . telecontrol interface – and even on bay level functions of existing bays – e. that bay being an already installed spare one. Even in case of a spare bay some reengineering of the DCS may be necessary due to evolution or modification of the specifications. it is very important to perform all test items related to the working of the DCS in its real environment. As already mentioned in the case of a new DCS. 5.2 Spare bay In this case. substation interlocking for which additional information has to be exchanged between bays. adaptation of the existing software and extension of the database. the entire DCS should be tested.5. addition of a function Different cases arise : bay-related function or substation-related function. the new functions can be implemented in the real © BEL Engineering (Belgium) C O N T I N U E D No. the site tests are aimed at two objectives : control the working of the part of the DCS relating to the new bay in its real environment. In case of an entirely new function. The methods of testing will depend on the actual case. This last step concludes the work of the test team. this addition has also repercussions on substation level components and functions of the DCS – e. the existing DCS already includes this bay. equipment.1 Overview Two cases arise : an additional bay has already been planned for in the DCS. In this case.

auxiliaries) No. system software and application software versions. at least that the manufacturer has completely tested the function on a similar DCS. energy monitoring. new DCS or modification of an existing DCS – we can now analyse the required test equipment. The problems related to configuration of the simulator to make it consistent with the H. The following questions will help us to select the most appropriate test equipment for each application. It results that complete tests on a reference DCS are no longer necessary and the new function can be directly implemented in the real DCS. Technically. interlocking… Finally. including firmware ➤ application software ➤ database. Some answers depend on the experience of the user with DCS. for example interlocking. 5. Question no. Question n° 4 : What do we test? (See figure 1) ➤ DCS only ➤ DCS and remote control ➤ all secondary equipment in the substation (except protection relay. The system software is the core of the hardware (computer systems and peripheral equipment). Software updates apply to the system software as well as to application software. 23 • 05 DCS. The basic functionality of the DCS is roughly dictated by the hardware and the system software (real-time processing. completed by a software test or a site test if the data is used for a function. Implications on test equipment Having seen what tests to do in different cases – factory and site acceptance tests. it follows that a new release affects the whole DCS. automatism… Also. some control tests can be repeated. the cost. simulation of abnormalities Question n° 3 : Necessity of sophisticated tests like measurement of response time of the DCS.7 Software update There are three kinds of software in a DCS : ➤ system software. keyboarding should be checked. I/O processing). 201 .C O N T I N U E D 5. What about tests ? From the definition of system software and application software. software and database. depending on the local possibilities. The application software is an extra shell around the core. the complexity of connecting the simulator increases proportionally to the number of Inputs/Outputs.8 Modification. 6. addition of a data (database/wiring) Problems encountered with modification/addition of a data are generally related to the wiring. This entails that new tests have to be carried out on a test system identical to the existing DCS. we can start from the hypothesis that the function has already been tested during the factory acceptance tests or. the database is the result of the configuration of the DCS for a specific substation. …? This choice may influence the technology used to build the simulator : it is easier to generate an avalanche test with a digital simulator than with a relay based simulator. The simulation of the primary equipment requires functionality such as switch on and switch off with corresponding feedback signals and realistic response time. logic such as automatic switching sequences. When only the database is changed. A new release of system software of application software must be compatible with the existing hardware. This application software mostly contains user-friendly language allowing the user to develop specific functions. tests at the substation level are better than tests at the bay level because the DCS will be tested in working conditions similar to the reality. When the wiring is changed a test has to be performed to check the modification from one point before it to one point after it. This is particularly important for avalanche testing (representing enormous status changes) and for testing functions common to several bays. simulation of a high quantity of events. In the second case . for which only some control tests are needed. where. The same reasoning applies to the modification of the configuration of an existing function.V. It is the manufacturer’s responsibility to manage the various hardware.there is no functionality in the simulator. installation must not be overlooked. In case of activation of an existing function from the software library. These different drawbacks have resulted in substation simulators not being used much in the case of conventional control systems. 1 : Test at substation level or at bay level? This choice determines the size of the simulator because the number of Inputs/Outputs of the simulator is proportional to the number of bays.reading and imposing inputs/outputs . This software allows the DCS to execute the functions described in item 2. others on the terms of the contract between the user and the Manufacturer. It contains a library of functions which can be configured for each specific application. the size.April 2002 ELECTRA 29 . database management. W O R K I N G G R O U P 23•05 Question n° 2 : Simulation of the primary equipment or only reading and imposing inputs/outputs? This choice determines the functionality included in the simulator.

new DCS in a new substation. different cases . test schedule. all spare bays. maintenance and required educational level of utility staff (CIGRE SC 34 1993 Colloquium Antwerpen) ■ No. The reasons are numerous : different DCS architectures. E. H. B. same software as the real DCS – for test purpose. Oosthuyse. Lemmer. Y. test organisation. R. la protection et la mesure dans un poste HT/MT (CIGRE 1988 Report 23-16). M. Timmerman : Impact of a Substation Automation System (SAS) on engineering. Baldinger. Theunissen. 201 . switchgear FIGURE 1 [2] R. this reference DCS will be run by the manufacturer or by the user. including those that will be used only later.G. differences in scope . 8. Rolland : L’utilisation des techniques numériques pour le contrôle.V. [5] F. Adam.L. A. N. and E. References [1] P. test procedure. etc. We hope the Reader will find in this paper enough ideas for his own application. Newbould : Configuration et intégration du contrôle-commande des postes (CIGRE 1996 Report 34-106). Kezunovic. Conclusions We recommend to analyse carefully the problem of overall testing of DCS from the very start of engineering because it has impacts on engineering. S. [3] J. software evolution. on test equipment. Young : Protection and control testing opportunities for modularised bay secondary equipment in transportable bay kiosks (CIGRE SC34 1995 . The answer has implications on the test equipment? Consequences Place where to connect Functionality to include the simulator in the simulator What do we test ? DCS only – via connectors in replacement of the links with the bay – via test cards in the DCS Simulation of – primary equipment – secondary equipment installed between DCS and primary equipment Or only reading outputs and imposing inputs DCS and remote control same as “DCS only” same as “DCS only” 7. new DCS in an existing substation. ➤ The need in some cases to have a reference DCS – same hardware. Cornu-Emieux. H. M. on project planning. ➤ Importance testing all functions. La Rocca.Colloquium Stockholm Report 34-108).J. Secondary equipment At the interface between primary and secondary equipment Simulation of primary equipment Or only reading outputs and imposing inputs Secondary equipment same as “Secondary equipment” and remote control same as “Secondary equipment” Remote Control 23 • 05 DCS only Remote control center DCS Central Unit Substation level Protections Bay computer Bay level Other functions outside DCS Control & Protection Cubicle H.A Koreman. manufacture and commissioning of H.V. Duindam. on the terms of the contract between the Manufacturer and the user. van der Helm. A.C.April 2002 ELECTRA 31 . Assailly. This will make easier the test when it will be necessary to put in service a new function or a spare bay. management.how much is done by the manufacturer and how much by the user. Bonnardot : Procedure for the design. We can emphasise some significant points raised: ➤ Importance of a test document describing test specifications.A.M. [4] C.V substation control systems within EDF (CIGRE 1992 Report 23-201). extension of existing DCS.According to the case. It was not possible to advise a universal method for testing DCS.W O R K I N G G R O U P 23•05 C O N T I N U E D ➤ all secondary equipment in the substation and remote control. G. Niemack.H.