GEGenerator Protection System Generator Protection, Control and Asset Management

RADIUS server is provided, but is unreachable over the network, server authentication 

requests are denied. In this situation, use local 889 device accounts to gain access to the 

889 system.

USER ROLES

User Access Levels are used to grant varying permissions to specific user roles. User roles 

are used by both Basic Security and CyberSentry.

The following user roles are supported:

• Administrator: The Administrator role has complete read and write access to all 

settings and commands. The role does not allow concurrent access. The Administrator 

role also has an operand to indicate when it is logged on.

• Operator: The Operator role is present to facilitate operational actions that may be 

programmed and assigned to buttons on the front panel. The Operator has read/write 

access to all settings under the command menu/section. The Operator can also use 

the Virtual Input command under the control menu/section. The Operator can view 

settings from EnerVista or the front panel but does not have the ability to change any 

settings. This role is not a concurrent role.

• Observer: The Observer role has read-only access to all 889 settings. This role allows 

concurrent access. The Observer is the default role if no authentication has been done 

to the device. This role can download settings files and records from the device.

• Factory: This is an internal non-user accessible role used for manufacturing 

diagnostics. The ability to enable or disable this role is a security setting that the 

Administrator controls.

GENERAL RULES FOR USER ROLES WITH CYBERSENTRY

1. The only concurrent role is Observer. If the user is logged in through serial, front panel, 

or over the network, that counts as the role being logged in for concurrency reasons.

2. Both EnerVista and the front panel provide a one-step logoff. For the front panel, the 

root menu has a logoff command. From EnerVista right-clicking on a device and 

providing a logoff function from the context menu is sufficient.

3. The EnerVista Login Screen has “User Name:” and “Password:” fields for the default 

remote (Radius) authentication, but when a “Local Authentication” checkbox is 

selected the “User Name:” field changes to a drop down menu where the user can 

select one of the predefined roles on the 889

Must-read Information

The following general statements apply and are repeated in the relevant sections of the 

manual.

FASTPATH: • WiFi and USB do not currently support CyberSentry security. For this reason WiFi is 

disabled by default if the CyberSentry option is purchased. WiFi can be enabled, but be 

aware that doing so violates the security and compliance model that CyberSentry is 

supposed to provide.

• Before upgrading firmware, it is very important to save the current 889 settings to a 

file on your PC. After the firmware has been upgraded, it is necessary to load this file 

back into the 889.

• The SNTP, IRIG-B and PTP settings take effect after rebooting the relay.

• Commands may be issued freely through other protocols than Modbus (i.e., DNP, IEC 

104, and, IEC 61850) without user authentication or encryption of data taking place, 

even if the relay has the advanced security feature enabled.

• Note that the factory role password may not be changed.

• In 889 both DNP and IEC104 protocol can work at the same time, but consider that 

there is only one point map. So, both protocols use the same configured points.

• The 52b contact is closed when the breaker is open and open when the breaker is 

closed.

• The Phase Directional element responds to the forward load current. In the case of a 

following reverse fault, the element needs some time – in the order of 8 ms – to 

change the directional signal. Some protection elements such as Instantaneous 

Overcurrent may respond to reverse faults before the directional signal has changed. 

A coordination time of at least 10 ms must therefore be added to all the instantaneous 

protection elements under the supervision of the Phase Directional element. If current 

reversal is a concern, a longer delay – in the order of 20 ms – is needed.

• The same curves used for the time overcurrent elements are used for Neutral 

Displacement. When using the curve to determine the operating time of the Neutral 

Displacement element, substitute the ratio of neutral voltage to Pickup level for the 

current ratio shown on the horizontal axis of the curve plot.

• If the 3-phase VT uses a delta connection and FREQUENCY INPUT is set to J2-3VT, the 

positive sequence voltage is used as the supervision voltage. In such conditions, the 

true supervision level is internally changed to 1/sqrt(3) of the user setting since the 

base of VT here is the phase-phase voltage.

• To monitor the trip coil circuit integrity, use the relay terminals “FA_1 NO” and “FA_1 

COM” to connect the Trip coil, and provide a jumper between terminals “FA_1 COM” 

and “FA_1 OPT/V” voltage monitor).

• The relay is not approved as, or intended to be, a revenue metering instrument. If used