The protection relay offers a large set of event-logging functions. Critical system and protection relay security-related events are logged to a separate nonvolatile audit trail for the administrator.
Audit trail is a chronological record of system activities that allows the reconstruction and examination of the sequence of system and security-related events and changes in the protection relay. Both audit trail events and process related events can be examined and analyzed in a consistent method with the help of Event List in LHMI and WHMI and Event Viewer in PCM600.
The protection relay stores 2048 audit trail events to the nonvolatile audit trail. Additionally, 1024 process events are stored in a nonvolatile event list. Both the audit trail and event list work according to the FIFO principle. Nonvolatile memory is based on a memory type which does not need battery backup nor regular component change to maintain the memory storage.
Audit trail events related to user authorization (login, logout, violation remote and violation local) are defined according to the selected set of requirements from IEEE 1686. The logging is based on predefined user names or user categories. The user audit trail events are accessible with IEC 61850-8-1, PCM600, LHMI and WHMI.
| Audit trail event | Description |
|---|---|
| Configuration change | Configuration files changed |
| Firmware change | Firmware changed |
| Firmware change fail | Firmware change failed |
| Setting group remote | User changed setting group remotely |
| Setting group local | User changed setting group locally |
| Control remote | DPC object control remote |
| Control local | DPC object control local |
| Test on | Test mode on |
| Test off | Test mode off |
| Reset trips | Reset latched trips (TRPPTRC*) |
| Setting commit | Settings have been changed |
| Time change | Time changed directly by the user. Note that this is not used when the protection relay is synchronised properly by the appropriate protocol (SNTP, IRIG-B, IEEE 1588 v2). |
| View audit log | Administrator accessed audit trail |
| Login | Successful login from IEC 61850-8-1 (MMS), WHMI, FTP or LHMI. |
| Logout | Successful logout from IEC 61850-8-1 (MMS), WHMI, FTP or LHMI. |
| Password change | Password changed |
| Firmware reset | Reset issued by user or tool |
| Audit overflow | Too many audit events in the time period |
| Violation remote | Unsuccessful login attempt from IEC 61850-8-1 (MMS), WHMI, FTP or LHMI. |
| Violation local | Unsuccessful login attempt from IEC 61850-8-1 (MMS), WHMI, FTP or LHMI. |
PCM600 Event Viewer can be used to view the audit trail events and process related events. Audit trail events are visible through dedicated Security events view. Since only the administrator has the right to read audit trail, authorization must be used in PCM600. The audit trail cannot be reset, but PCM600 Event Viewer can filter data. Audit trail events can be configured to be visible also in LHMI/WHMI Event list together with process related events.
| Audit trail event | Authority logging level | |||||
|---|---|---|---|---|---|---|
| None | Configuration change | Setting group | Setting group, control | Settings edit | All | |
| Configuration change | ● | ● | ● | ● | ● | |
| Firmware change | ● | ● | ● | ● | ● | |
| Firmware change fail | ● | ● | ● | ● | ● | |
| Setting group remote | ● | ● | ● | ● | ||
| Setting group local | ● | ● | ● | ● | ||
| Control remote | ● | ● | ● | |||
| Control local | ● | ● | ● | |||
| Test on | ● | ● | ● | |||
| Test off | ● | ● | ● | |||
| Reset trips | ● | ● | ● | |||
| Setting commit | ● | ● | ||||
| Time change | ● | |||||
| View audit log | ● | |||||
| Login | ● | |||||
| Logout | ● | |||||
| Password change | ● | |||||
| Firmware reset | ● | |||||
| Violation local | ● | |||||
| Violation remote | ● | |||||