GEGenerator Protection System Generator Protection, Control and Asset Management

and reliable and one that will not overreach.

Processing of AC Current Inputs

The DC Decaying Removal Filter is a short window digital filter, which removes the DC 

decaying component from the asymmetrical current present at the moment a fault occurs. 

This is done for all current signals used for overcurrent protection; voltage signals use the 

same DC Decaying Removal Filter. This filter ensures no overreach of the overcurrent 

protection.

The Discrete Fourier Transform (DFT) uses exactly one cycle of samples to calculate a 

phasor quantity which represents the signal at the fundamental frequency; all harmonic 

components are removed. All subsequent calculations (e.g. power, etc.) are based upon the 

current and voltage phasors, such that the resulting values have no harmonic 

components. RMS (root mean square) values are calculated from one cycle of samples 

prior to filtering.

Protection Elements

All voltage, current and frequency protection elements are processed eight times every 

cycle to determine if a pickup has occurred or a timer has expired. The voltage and current 

protection elements use RMS current/voltage, or the magnitude of the phasor.

Security Overview

The following security features are available:

BASIC SECURITY

The basic security feature is present in the default offering of the 889 relay. The 

889 introduces the notion of roles for different levels of authority. Roles are used as login 

names with associated passwords stored on the device. The following roles are available 

at present: Administrator, Operator, Factory and Observer, with a fixed permission 

structure for each one. Note that the Factory role is not available for users, but strictly used 

in the manufacturing process.

The 889 can still use the Setpoint access switch feature, but enabling the feature can be 

done only by an Administrator. Setpoint access is controlled by a keyed switch to offer 

some minimal notion of security.

CYBERSENTRY

The CyberSentry Embedded Security feature is a software option that provides advanced 

security services. When the software option is purchased, the Basic Security is 

automatically disabled.

CyberSentry provides security through the following features:

• An Authentication, Authorization, Accounting (AAA) Remote Authentication Dial-In 

User Service (RADIUS) client that is centrally managed, enables user attribution, and 

uses secure standards based strong cryptography for authentication and credential 

protection.

• A Role-Based Access Control (RBAC) system that provides a permission model that 

allows access to 889 device operations and configurations based on specific roles 

and individual user accounts configured on the AAA server. At present the defined 

roles are: Administrator, Operator and Observer.

• Strong encryption of all access and configuration network messages between the 

EnerVista software and 889 devices using the Secure Shell (SSH) protocol, the 

Advanced Encryption Standard (AES), and 128-bit keys in Galois Counter Mode (GCM) 

as specified in the U.S. National Security Agency Suite B extension for SSH and 

approved by the National Institute of Standards and Technology (NIST) FIPS-140-2 

standards for cryptographic systems.

• Security event reporting through the Syslog protocol for supporting Security 

Information Event Management (SIEM) systems for centralized cyber security 

monitoring.

There are two types of authentication supported by CyberSentry that can be used to 

access the 889 device: 

• Device Authentication – in which case the authentication is performed on the 

889 device itself, using the predefined roles as users (No RADIUS involvement).

– 889 authentication using local roles may be done either from the front panel or 

through EnerVista.

• Server Authentication - in which case the authentication is done on a RADIUS server, 

using individual user accounts defined on the server. When the user accounts are 

created, they are assigned to one of the predefined roles recognized by the 889

– 889 authentication using RADIUS server may be done only through EnerVista.

FASTPATH: WiFi and USB do not currently support CyberSentry security. For this reason WiFi is 

disabled by default if the CyberSentry option is purchased. WiFi can be enabled, but be 

aware that doing so violates the security and compliance model that CyberSentry is 

supposed to provide.

Enervista Viewpoint Monitor does not currently support CyberSentry security.

FASTPATH: With the CyberSentry security option, many communication settings cannot be changed 

remotely. All communication settings can still be changed through the relay front panel.

When both 889 device and server authentication are enabled, the 889 automatically 

directs authentication requests to the 889 device or the respective RADIUS server, based 

on user names. If the user ID credential does not match one of the device local accounts, 

the 889 automatically forwards the request to a RADIUS server when one is provided. If a