After a trip, the question is always 'what happened first?'. The answer is spread over several devices, each with its own clock, time zone and file format. If one relay's clock is 300 ms behind or the SCADA list is in local time, the reconstructed sequence is wrong — a breaker that seems to open before the protection tripped, a GOOSE that seems to arrive before it was sent. Merging the sources and checking cause against effect finds the clock problems and gives one reliable sequence.
Standards followed
IEC 61850-7-2 (TimeStamp with TimeQuality: ClockNotSynchronized, ClockFailure, accuracy)IEC 61850-5 (time performance classes; event time-stamping)IEC 60870-5-104 (CP56Time2a time tags)RFC 3164 / RFC 5424 (syslog)
What it can do
- Reads CSV event lists (a time column plus device, signal, value, description, time quality and received time, found from the headings), syslog (RFC 3164 and 5424), Windows event CSV exports, and pcap captures (GOOSE state changes, IEC 104 spontaneous time-tagged events).
- Per source: time quality not synchronised, coarse resolution, duplicates, chattering signals, events received before they happened.
- Across sources: sources whole hours apart (local time instead of UTC), an event recorded as received from device X before X sent it (clock behind), trip-to-breaker-open times outside 20–100 ms; suggested corrections that can be applied in one click.
- One merged time line, relative to the first protection trip, filtered to a window around it; CSV export.
Example problem
A line fault on Q01, recorded by P132_Q01, P87T_T1, the SCADA event list, switch SW1's syslog and a GOOSE capture.
- The SCADA list is 4 h ahead (local time) and contains a duplicate breaker event.
- P87T_T1's events are flagged not synchronised, and it records the intertrip from P132_Q01 307 ms before P132_Q01 sent it; it also has a chattering fan alarm.
- After the suggested corrections: start −19 ms, trip and GOOSE at 0, intertrip received at +4 ms, breaker open at +50 ms, port link down at +67 ms.
One time line of the disturbance, with each clock problem named.
Set each source's time zone if the file is in local time, or apply the suggestions. Corrections are estimates from cause and effect (about 4 ms GOOSE transfer time is assumed); confirm with the device's time-sync status. Files are read in your browser.