Alstom MiCOM P54 Series, Техническое руководство

Страница: 746 / 1024

P54x/EN FD/La4 Firmware Design
(FD) 9-20
MiCOM P543, P544, P545 & P546
FD
Any of these checks which produces an error results in the co-processor board being left out
of service and the relay relying on the other protection functions which are provided by the
main processor board.
4.1.3 Platform software initialization & monitoring
In starting the platform software, the relay checks the integrity of the data held in non-volatile
memory with a checksum, the operation of the real-time clock, and the IRIG-B board if fitted.
The final test that is made concerns the input and output of data; the presence and healthy
condition of the input board is checked and the analog data acquisition system is checked
through sampling the reference voltage.
At the successful conclusion of all of these tests the relay is entered into service and the
protection started-up.
4.2 Continuous self-testing
When the relay is in service, it continually checks the operation of the critical parts of its
hardware and software. The checking is carried out by the system services software (see
section on relay software earlier in this chapter) and the results reported to the platform
software. The functions that are checked are as follows:

The flash EPROM containing all program code and language text is verified by a
checksum

The code and constant data held in SRAM is checked against the corresponding data in
flash EPROM to check for data corruption

The SRAM containing all data other than the code and constant data is verified with a
checksum

The battery status

The level of the 48 V field voltage

The integrity of the digital signal I/O data from the opto-isolated inputs and the relay
contacts is checked by the data acquisition function every time it is executed. The
operation of the analogue data acquisition system is continuously checked by the
acquisition function every time it is executed, by means of sampling the reference
voltages

The operation of the IRIG-B board is checked, where it is fitted, by the software that
reads the time and date from the board

The operation of the Ethernet board is checked, where it is fitted, by the software on the
main processor card. If the Ethernet board fails to respond an alarm is raised and the
card is reset in an attempt to resolve the problem
In the unlikely event that one of the checks detects an error within the relay’s subsystems,
the platform software is notified and it will attempt to log a maintenance record in battery
backed-up SRAM. If the problem is with the battery status or the IRIG-B board, the relay will
continue in operation. However, for problems detected in any other area the relay will initiate
a shutdown and re-boot. This will result in a period of up to 5 seconds when the protection is
unavailable, but the complete restart of the relay including all initializations should clear most
problems that could occur. As described above, an integral part of the start-up procedure is
a thorough diagnostic self-check. If this detects the same problem that caused the relay to
restart, i.e. the restart has not cleared the problem, then the relay will take itself permanently
out of service. This is indicated by the ‘Healthy’ LED on the front of the relay, which will
extinguish, and the watchdog contact which will operate.