ABB RELION 620 Series Operation Manual page 40

Section 3
620 series overview
32
Audit trail is a chronological record of system activities that allows the reconstruction and
examination of the sequence of system and security-related events and changes in the
protection relay. Both audit trail events and process related events can be examined and
analyzed in a consistent method with the help of Event List in LHMI and WHMI and
Event Viewer in PCM600.
The protection relay stores 2048 audit trail events to the nonvolatile audit trail.
Additionally, 1024 process events are stored in a nonvolatile event list. Both the audit trail
and event list work according to the FIFO principle. Nonvolatile memory is based on a
memory type which does not need battery backup nor regular component change to
maintain the memory storage.
Audit trail events related to user authorization (login, logout, violation remote and
violation local) are defined according to the selected set of requirements from IEEE 1686.
The logging is based on predefined user names or user categories. The user audit trail
events are accessible with IEC 61850-8-1, PCM600, LHMI and WHMI.
Table 14: Audit trail events
Audit trail event
Configuration change
Firmware change
Firmware change fail
Attached to retrofit test case
Removed from retrofit test case
Setting group remote
Setting group local
Control remote
Control local
Test on
Test off
Reset trips
Setting commit
Time change
View audit log
Login
Logout
Password change
Firmware reset
Table continues on next page
Description
Configuration files changed
Firmware changed
Firmware change failed
Unit has been attached to retrofit case
Removed from retrofit test case
User changed setting group remotely
User changed setting group locally
DPC object control remote
DPC object control local
Test mode on
Test mode off
Reset latched trips (TRPPTRC*)
Settings have been changed
Time changed directly by the user. Note that this is not used
when the protection relay is synchronised properly by the
appropriate protocol (SNTP, IRIG-B, IEEE 1588 v2).
Administrator accessed audit trail
Successful login from IEC 61850-8-1 (MMS), WHMI, FTP or
LHMI.
Successful logout from IEC 61850-8-1 (MMS), WHMI, FTP or
LHMI.
Password changed
Reset issued by user or tool
1MAC456939-IB D
620 series ANSI
Operation Manual