COMTRADE Forensics & NERC Audit Defense

In earlier modules you designed protection. This module is about what happens after something goes wrong. A transmission fault occurs, a solar or battery plant drops 150 MW, and within days the Transmission Operator, Reliability Coordinator or NERC wants answers: what tripped, why, and was the plant allowed to?

For inverter-based resources (IBRs), the answer is rarely a simple relay trip. The usual culprits are firmware, control loops, counters, and measurement windows hidden inside the inverters and plant controller. The only way to prove what happened is time-synchronized disturbance data, analysed carefully against the ride-through requirements. That skill separates a protection engineer from a subject-matter expert.

The regulatory framework you are defending against has several parts:

• IEEE 2800-2022: the technical performance standard for transmission-connected IBRs. It covers ride-through (Clause 7), current injection during faults, and measurement and data recording (Clause 11).
• NERC PRC-029-1: the mandatory frequency and voltage ride-through requirements for IBRs, including the documentation of any ride-through exemption.
• NERC PRC-028-1: the disturbance monitoring and recording requirements for IBRs. It defines what data must exist, how it is time-synchronized, and how long it is kept.
• NERC PRC-030-1: unexpected IBR event mitigation. It holds the obligation to analyse an unexpected output reduction and to build and complete a Corrective Action Plan: the loop practised here.
• NERC PRC-002 (disturbance monitoring on the BES) and PRC-004 (misoperation analysis, where the plant's protection system is BES) can also apply to the same event. When a plant protective relay operates, as in Cases C and D, the operation has to be screened under PRC-004 as well as judged against ride-through.

IEEE C37.111 (COMTRADE) is the common file format for relays, DFRs, and the simulation tools used for playback testing. An event is a small set of files:

IEEE C37.111-2013 (dual-logo with IEC 60255-24) kept these files and added a single-file .cff format, binary32 (float) data, and time-code and time-quality fields in the .cfg. This module exports the 1999 ASCII form, which every playback tool reads.

Each stored analog value is an integer. Convert it to engineering units with the scaling from the .cfg:

A numerical relay measures phasors, not raw samples. The forensic viewer does the same: at cursor 1 it runs a full-cycle DFT over the last $N$ samples (N = samples per cycle):

The reference rotates at exactly 60 Hz, so the angle of a steady 60 Hz signal stays fixed from one cycle to the next. From the three phase phasors, the Fortescue transform gives the sequence quantities from Module 1.1:

Frequency is the rate at which the $\bar V_1$ angle drifts. Over a window of $W$ cycles:

That formula explains Case C. A sudden phase step Δθ looks like a burst of off-nominal frequency lasting about one window. The shorter the window, the bigger the spike.

A note on measurement points. The case files record at the plant's point of interconnection (POI), which is where the POI relay and DFR sit. IEEE 2800 states its performance requirements at the reference point of applicability (RPA), which is often, but not always, the POI. Where they differ, the quantity that decides compliance (V₂ for an exception, the I₂ angle, the voltage a deviation is counted against) must be measured or derived at the RPA, and your evidence should say which point each quantity came from.

The viewer below loads four synthetic records modelled on real failure patterns. For each one, put the cursors on the key moments, read the sequence quantities, check the digital channels, and then commit to a root cause and a compliance verdict. You can also export each record as a COMTRADE file and open it in your own playback or analysis software.

Transmission faults rarely come one at a time. Auto-reclosing, sequential clearing at the two line ends, and evolving faults can all hit a plant with several dips in a few seconds. IEEE 2800-2022 Clause 7.2.2.4 requires plants to ride through multiple deviations, and allows tripping only under specific cumulative conditions. As summarised in this course's research, tripping is allowed only when there are:

• more than 4 deviations in any 10 s window, more than 6 in 120 s, or more than 10 in 30 minutes;
• a deviation that follows the previous one by less than 20 cycles; or
• sags below 50 % occurring more than 2 times in 10 s or more than 3 times in 120 s.

The words more than matter. Case B's inverter counter tripped on the 4th deviation, which is one too early. Work through it in the counter below, then try the other scenarios.

These counts have not been checked here against the purchased standard text, and industry groups have asked for Clause 7.2.2.4 to be clarified. PRC-029-1 also has its own multiple-excursion provisions, and they may not match IEEE 2800 exactly. PRC-029-1 is the mandatory requirement. IEEE 2800 applies to the extent your TO has adopted it in its interconnection requirements. In an investigation, quote and apply whichever text governs your plant, and say which one you used.

When a large generator trips, a line switches, or a fault clears, the voltage phase at the POI can step by tens of degrees in a fraction of a cycle. Real system frequency changes slowly because of system inertia. A frequency estimator with a short window can't tell the two apart. This course's research cites a 25° phase jump that plants must ride through, plus a 5 Hz/s RoCoF, and recommends a 3–6 cycle frequency measurement window so that jumps don't corrupt 81O/81U. Treat these as figures to verify against PRC-029-1 and IEEE 2800, not as quoted requirements. Use the lab to find the shortest window and smallest delay that ride through a 25° jump with a 61.8 Hz pickup.

Two cautions about the lab. First, its estimator is a simplification: it differences the angles of one-cycle DFT phasors taken W cycles apart. Real relays and inverters use zero-crossing, PLL or filtered phasor-rotation methods with their own windows and filters, so on a real device the spike's size and duration will be different. Check each device's documented method before choosing a window. Second, the 61.8 Hz pickup and its 58.2 Hz mirror are representative values. Real 81O/81U settings must sit outside the frequency no-trip boundaries for your interconnection. For every plant in this module (all IBRs) that means the PRC-029-1 frequency ride-through table: the frequency bands and minimum ride-through times it requires, and any exemptions documented under it. Verify the bands and times against the current PRC-029-1 text and your TO's requirements before choosing a pickup or delay; an instantaneous element close to 60 Hz may not be acceptable even when its measurement window is right. PRC-024-4 sets the equivalent no-trip boundaries for synchronous units only. Take the boundaries from the current standard.

An investigation is only as strong as the evidence behind it. Whether you are answering a TO data request, a Regional Entity inquiry, a PRC-030-1 analysis of an unexpected IBR event, or a PRC-004 review of a relay operation, the package should let an independent reviewer reach your conclusion on their own. That means complete, time-aligned, unaltered records, the settings and firmware actually in service, and a clear chain from evidence to root cause to corrective action.