6.9 SCADA, Substation Automation, Functional Test Plans, and P&C Troubleshooting

SCADA, Substation Automation, Functional Test Plans, and P&C Troubleshooting

Quick Answer: The 2026 Level III outline adds three tasks under 3.7 Protection, Control, and Automation: 3.7.3 "Identify SCADA and automation system components and approaches," 3.7.5 "Develop and execute functional test plans of electrical systems," and 3.7.6 "Troubleshoot Protection & Control (P&C) Systems." The central idea: testing each device individually does not prove the scheme works. Only a functional test does.

---

1. SCADA architecture

SCADA — Supervisory Control and Data Acquisition — is the layered system that monitors and controls the substation remotely.

Key components to recognize by name:

• RTU (Remote Terminal Unit): gathers status and analogue points and reports them upstream; executes control commands.
• IED: a microprocessor device that combines protection, metering, control, and communications — a modern protective relay is an IED.
• HMI: the operator interface presenting one-lines, alarms, and controls.
• Gateway / data concentrator: converts between station and enterprise protocols.
• GPS clock / time source: provides the time reference — IRIG-B or PTP (IEEE 1588) — that makes sequence-of-events records comparable across devices. Without a common time reference, an SOE record from three relays cannot be sequenced, and sequencing is exactly what fault analysis needs.

Protocols to recognize: DNP3 and Modbus for SCADA telemetry; IEC 61850 for substation automation, including MMS for client-server, GOOSE for fast peer-to-peer status and trip messaging, and Sampled Values for digitized CT and VT data.

2. Device testing versus functional testing

This distinction is the heart of the section.

• Device testing proves one component meets its specification: the relay picks up at its setting and times correctly, the CT ratio is right, the trip coil operates.
• Functional testing proves the scheme performs its intended function end to end: apply a simulated fault at the CT input, and verify that the correct relay element asserts, the correct output contact closes, the correct breaker trips, the correct lockout operates, the correct alarms annunciate locally and at the control centre, and — critically — that nothing else operates.

Every device in a scheme can pass its individual test while the scheme fails, because the failure lives between devices: a wire landed on the wrong terminal, a relay output mapped to the wrong contact, a GOOSE subscription pointed at the wrong publisher, a lockout relay whose contact is in the wrong circuit, an interposing relay with reversed contacts.

Point-to-point wiring checks. Level III task 3.1d.3 requires "perform point-to-point wiring checks of all control circuits in new installation." Each conductor is verified from origin to destination against the schematic, before energization. This catches transposed wires and mislanded terminations that a functional test would find later and more expensively. Point-to-point checks and functional tests are complementary — the first proves the wiring matches the drawing, the second proves the drawing achieves the intent.

3. Building a functional test plan

Level III must develop the plan, not merely execute someone else's.

1. Define the scheme boundaries. What is in scope: which relays, which breakers, which lockouts, which annunciation.
2. Enumerate every intended function from the protection and control drawings, the relay setting sheets, and the sequence of operations. Each becomes a numbered test.
3. For each function, state: the stimulus (what is injected and where), the expected response (which contacts, which breakers, which alarms), and the expected non-response (what must not operate).
4. Define the test configuration: which test switches are open, which links are lifted, which circuits are isolated. Record it, because a scheme tested with a link lifted has not been fully tested.
5. Sequence the tests so each builds on verified ground and the highest-risk items are proven before energization.
6. Record results as-found and as-left, with the initials of the person performing each step.
7. Define restoration: every test switch closed, every link restored, every lifted lead landed, verified by a second person. The restoration checklist is part of the plan, not an afterthought — the most common cause of a protection scheme failing in service after maintenance is a test switch left open.

4. IEC 61850 and what it changes for the technician

In a conventional substation, a trip signal is a wire. You can ring it out, jumper it, and see the voltage on it.

In an IEC 61850 station, that trip signal may be a GOOSE message on an Ethernet network. There is no wire to ring out. What this changes:

• Verification shifts from continuity to configuration. You verify that the subscribing device is configured to receive the correct publisher's dataset, and that the mapping from the received bit to the internal logic is correct. The tools are the relay configuration files (SCL/CID) and a GOOSE-capable test set or network analyser.
• Supervision replaces inspection. GOOSE messages are re-transmitted continuously with a state number and a sequence number; a subscriber detects loss of the publisher within milliseconds and raises an alarm. That built-in supervision is stronger than a wire, which fails silently — but only if the alarm is mapped and monitored.
• Test sets must speak the protocol. A conventional secondary-injection set can inject current but cannot verify a GOOSE trip; the set needs to subscribe to and publish GOOSE.
• Time synchronization becomes critical, particularly where Sampled Values carry digitized CT data. Loss of the time source can disable protection rather than merely degrade record-keeping.

End-to-end testing applies where a scheme spans two substations — line differential, permissive overreaching transfer trip, direct transfer trip. Two test sets, synchronized to GPS, inject at each terminal simultaneously to prove the communication-assisted logic and measure the true total scheme operating time including channel delay. Testing each end independently cannot prove the channel.

5. Troubleshooting protection and control systems

A structured method, because P&C faults are usually intermittent and rarely where the symptom points.

1. Gather the evidence before touching anything. Retrieve relay event records, oscillography, and the sequence-of-events log. Modern relays record the analogue waveforms and the digital element states at the moment of operation — the answer is very often already in the record.
2. Establish the timeline using the synchronized SOE. Which element asserted first? Did the trip output assert before or after the breaker opened? A breaker that opened without a trip assert points to a mechanical or control failure, not a relay.
3. Separate "should not have tripped" from "should have tripped and did not." These have different fault trees. The first is usually a setting, a wiring cross, or an unexpected system condition; the second is usually a broken chain — open trip circuit, blown control fuse, failed trip coil, lifted test link.
4. Verify the basics before the sophisticated: control power present, control fuses intact, trip circuit continuity (many relays monitor it — check the trip circuit supervision alarm), test switches closed, links landed.
5. Check what changed. The great majority of P&C failures follow a recent change: a setting change, a firmware upgrade, maintenance work, a configuration download, a temporary jumper.
6. Reproduce it. An intermittent that cannot be reproduced is not fixed. Where reproduction is impossible, add monitoring and wait.
7. Prove the fix with a functional test, not a device test.

Exam trap: A scheme is commissioned in which every relay passed its individual pickup and timing tests, yet a bus fault trips the wrong breaker. The individual device tests were valid; the defect is in the scheme — a mis-landed wire, a wrongly mapped output, or an incorrect GOOSE subscription — and only a functional test that verifies both the intended operation and the intended non-operation would have caught it.