Switch it off. See what the plant really does.

What scenario testing is

Your canvas is already a single-line diagram: assets joined by operational connections, each connection carrying power from its from end to its to end. Scenario testing uses that drawing as a switching model. You tell Dirac that a source is lost, a breaker trips or an operator switches, and the engine works out — from the connections alone — what goes dark, what the automatic scheme would close to bring it back, in what order and after how long, whether generators have to start and how many, and whether two sources ever end up on one bus.

It answers the questions a sequence of operation (SOO) is written to answer: what happens when this incomer is lost? which breaker closes? how long is the outage? does the ring recover from the far end? do the generators start, and how many? how do we get back to normal? Because the answer is computed from your drawing, it is only as good as the drawing — this manual therefore starts with what the project needs before the first scenario.

The vocabulary

Scenario mode — test without signing anything off

Switching tests used to need the plant marked Available and signed off to its final stage, because the model only treats an asset as present once it is. That made a test on a plant that is still being designed or built impossible without first pretending it was commissioned, and the test then changed the project. Scenario mode removes both problems: it runs every command in this manual on a private copy of the project held in memory.

Preparing a project

Canvas

1234

Setting the normal state

Every script starts from the normal state and every group of tests ends in it. The normal state is: every normally closed breaker closed, every preferred open point open, all utility-fed assets on mains, generators off. Five commands put a copy there whatever the previous test left behind:

Running a loss

simulate loss of Utility-A (also turn off mains in Utility-A; several sources: simulate loss of Utility-A and Utility-B; with a stated load: … with 20 MW load). The source disappears with the automatic scheme armed. The answer has a fixed shape:

• Forced off / Affected — the lost source and everything that went dark with it.
• Opened by the transfer — the incomers the scheme opened before closing anything (break before make): the dead incomer of each restored bus.
• Transfers — the standby feeds it closed to bring loads back.
• Backup generators started — which sets, and how the start was sized (see Generators).
• Auto-restored and Restoration paths — each load and the source it is now fed from.
• Available for MANUAL transfer — standby feeds in Manual whose source is live and whose load is still dark: the operator's decision.
• Still without mains — loads with no path at all.
• Paralleled or looped feeds — the check after restoration.
• Timeline and Outages — when timers or generators took part: one line per instant (lost, confirmed, opened, closed, generator started / ready, back, not restored), then how many assets were dark for how long and the longest outage.
• Model — the one-line pointer to the assumptions ("switching model" prints them).

Reading a timeline

Take a dual-fed board whose preferred incomer is lost, with a 0.5 s confirmation on the source and a 2 s transfer delay on the alternate, and a ring behind it whose open point has a 1 s delay:

Read it as the relays would act: each scheme runs on its own timer from the confirmed loss. Here the ring relays were faster than the board's transfer, so the ring units came back from the far side a second before the board itself — a coordination fact worth checking against the design: is that intended, or should the ring timer be longer than the main transfer? Because the incomers on the dead side were opened at 1.5 s, the board coming back on its alternate at 2.5 s does not parallel through the ring. The clock shows the delays you entered and nothing else — breaker operating times and protection timing are not in it.

Manual mode and the operator

Tick manual transfer on a standby feed (asset panel → Feeds list, or the connection panel) to put its relay in Manual. A loss then leaves that bus dark and lists the feed under Available for MANUAL transfer; everything else the scheme can do, it still does. Generators are the last source: no set starts for a bus the operator could restore by closing such a manual feed from a live utility. And a generator is the only source the scheme can start — a utility feed that is off is lost until turn on mains in Utility-A. When it comes back it is live on every breaker that was never opened: the units that waited in the dark come back with it, through the closed links, without anyone closing anything.

The operator's commands are open feed from Utility-A to Switchgear-A, close feed from Utility-B to Switchgear-A and switch Switchgear-A to Utility-B. They are preferences: the model never remembers them and "return to normal" never undoes them. Opening a breaker by hand is a loss of voltage for everything behind it, and the relays downstream cannot tell an operator's open from a trip: with the relays in Automatic the scheme answers exactly as after a trip — the alternate closes after its delay, the answer carries the restoration and the timeline, the opened breaker stays open. So "open first, then close" by hand only works as a two-step sequence when the relay that would answer is in Manual; otherwise the scheme makes the close for you and your close reports "already closed". Put the relay in Manual first to switch by hand, exactly as on site. A feed opened by hand or by a trip is marked "opened by hand or trip" (its normal state is closed); a transfer that closes it again restores the normal state and remembers nothing. When your by-hand sequence ends with the drawing's own open point open, say so: mark feed from RMU-2 to RMU-3 as normally open — the design statement (the Standby tick as a command), which clears the marker so that the next transfer onto it is remembered and "return to normal" can undo it. A close onto a bus that is already live from another live source is interlocked: Dirac refuses it and names the feed to open first, as the programmed interlock in the switchgear would — unless the feed carries the closed-transition scheme, when the close is accepted as the first step of a closed transition and the answer names the feed to open within the window. switch does both in one step (the new feed primary, the others open) and says which it was: an open transition with the asset and its loads dark for the switching instant, or a closed transition with no outage.

To take the relay back to Automatic, untick manual transfer — the tick is shown on the feed whether it is open or closed, so this can be done before the retransfer.

Trips and lockouts

The difference between a trip and open feed: the trip is an event the scheme responds to; the open is an operator action that only cascades. The difference between a trip and simulate loss of X: the trip removes one feed, the loss removes a source with every feed it has.

Generators

Generators are the last source. They start only when a dead load has no utility path left — not even a manual one — and, with the playbook rule Cerberus on (the default), only when every board the generator bus serves is dark with no other way back (see The Switching Playbook). A set the operator holds with Hades (hold start of GEN-1) is never selected. When they do start, the set is sized in one of three ways, and the answer says which:

• Stated load — … with 20 MW load: as many sets as cover the stated MW, plus one spare.
• From the assets' ratings — the sum of Load (MW) over the de-energised assets, plus one spare.
• All sets — no load known at all: every available generator starts.

A dark generator bus with nothing behind it is not a reason to start sets — a lockout of one set's breaker on an idle generator bus starts nothing; the same lockout with a board on that bus starts the others for the board. The number running is always N+1. On the clock, the sets are started at the confirmed loss and are ready after their start → ready; the generator bus takes load only when the whole set is ready, and every further set that becomes ready parallels onto the running bus. A shortfall ("short by n MW") and a missing spare ("N+1 not met") are reported, never hidden. Several sets on one generator bus are shown as information, not as paralleling.

The Switching Playbook

The scheme rules the engine applies are written down in one place: the Switching Playbook. Each rule has a name, is stored with the project, and can be switched off for a site whose scheme differs. They are ON by default, because the default is what the official sequences of operation of a 2N site require. show playbook lists them with their state; in the exported simulator they are the ticks in the header.

Commands: turn cerberus off / turn cerberus on (the same for prometheus and theseus), set playbook to full (every rule on) / set playbook to generic (every rule off), show playbook. The older set official soo rules to legacy | official still works and means the generic / full preset. Only the rules that are OFF are stored, so a project with nothing stored runs the full playbook.

Rings

A ring is a chain of units between two boards with one link marked standby — the preferred open point. On loss of one board, the ring relays open the units' incomers on the dead side and close the open point, and power runs through the ring against the drawn direction to the units that lost their feed. When the lost board returns it meets open incomers, so nothing parallels; "return to normal" opens the ring point again and re-closes the incomers (the units are dark for the switching instant).

Moving the open point by hand, break before make: open feed from RMU-1 to RMU-2 (the unit beyond the new point is dark for a moment), then close feed from RMU-2 to RMU-3. "open points" then shows the new point and no memory, because an operator's open is a choice of the normal state. Closing the old point first would parallel the two boards through the ring — the interlock refuses it and tells you which link to open first.

Return to normal

return to normal undoes the automatic transfers in effect, feed by feed per its transfer scheme. Under an open transition (the default) it is two steps: step 1 re-opens every transfer feed whose loads will be live again once their incomers are back (generator-fed ties first; the running generator sets are then stopped together and their breakers re-opened once nothing depends on them — see Generators), step 2 re-closes every incomer a transfer had opened whose source is live and whose bus has no other live feed at that moment. Under a closed transition the order is reversed for that feed — the incomer re-closes onto the live bus first, the transfer feed opens after — and nothing goes dark. It reports both lists, how many assets were without power for the switching instant, that everything is back on afterwards, and whatever it had to leave alone:

• Left closed — a transfer feed whose load would stay dark (its incomer's source is still off): close the missing source first, then say it again.
• Left open — an incomer whose source is still off, or whose bus is still fed through a transfer feed that had to stay closed (closing would parallel the two).

It never touches what an operator did by hand, and it never closes two sources onto one bus outside a closed-transition scheme. With an automatic retransfer in the scheme you do not say it at all: when the source comes back (turn on mains in Utility-A), the feeds that carry the setting return to normal by themselves after their delay, and the answer reports "Automatic retransfer".

Returning only some assets to normal

A bare return to normal is project-wide, which is what you want while testing. To bring only some assets back and leave the rest of the setup as it is, use return selected to normal: on the canvas, Ctrl/Cmd+click the assets one by one — they need not be next to each other — or hold Shift and drag a box around them (a plain drag on empty canvas pans), then say it in Dirac. You can also name them: return Switchgear-A and Switchgear-B to normal or return to normal for Switchgear-A, Switchgear-B. Only the transfers that feed those assets are undone (and the incomers they had displaced are re-closed). Selecting a source such as a utility covers the boards it normally feeds. Generator sets are stopped only if they are in the selection too; otherwise they keep running and the answer says so. In the standalone simulator the named form works (return BUS to normal).

Transfer schemes

The relay's programme is data on the drawing, not an assumption of the model. One rule stands above every scheme: a loss of a source is always break before make. The loss may be a false signal — a VT fuse, a stuck contact — while the bus is in fact live, so the incomer that lost the voltage opens before the alternate closes, whatever the scheme says. The scheme governs the transfers made while both sources are live: the retransfer when the preferred source has returned, an operator's switch, a close feed onto a live bus.

A feed's own setting wins over the project default; nothing set anywhere means open transition and manual retransfer — how every project behaved before the scheme existed. switching model prints the scheme the project actually uses — the default and every feed with its own — ahead of the legend, so the legend never pretends a scheme the drawing does not carry; the Feeds list tags a feed's own scheme; open points states the default.

Testing a closed transition. With both sources live and the transfer in effect (after a loss and the source's return), return to normal on a closed-transition feed reports Closed transition — preferred incomer re-closed first, then re-opened within the window … no outage, and the count of assets without power is zero. To watch the window itself, do it by hand: close feed from Utility-A to Switchgear-A is accepted (ℹ️ closed transition in progress — open Utility-B → Switchgear-A within N s), parallel feeds shows the permitted parallel, open feed from Utility-B to Switchgear-A completes it. On a feed without the scheme the same close is refused — that is the interlock, and the test passes when it is.

Fail to open and fail to close (FTO / FTC)

A breaker that does not do what the relay told it to is a test input, set on the breaker and shown the next time the model operates it. It follows the sequences of operation of the project's three transfer schemes (RMU loop, generator/transformer pair, utility A / utility B pair). On a board with no tie breaker the two incomers are the pair: fail to open on the dead incomer, fail to close on the one that should close.

Also settable per breaker in the connection panel (Fail to open / close (test)); the Feeds list and open points tag the breakers that carry one, and switching model lists them. A preferred-source change or switch while both sources are live makes one attempt with no backup path: a fail to open stops it and nothing moves.

Breaker failure is something else. In this manual "breaker failure" (BFP) means protection: a fault, the protection trips the breaker and the breaker does not open, so the whole bus behind it is cleared (every breaker that can feed it) and every return path is locked out. FTO / FTC are commands that do not work, set by the operator or the scheme. Breaker failure protection is not modelled in the app yet; the standalone simulator has it (breaker failure on feed from A to B).

The paralleling check

parallel feeds lists every bus with two or more live, carrying feeds and traces each to its root sources. Different roots → parallel, a fault. The same root arriving twice → loop (a ring closed with no open point, or two boards both on the same utility feeding one cubicle). All roots generators → generator paralleling, information. One of the feeds carrying the closed-transition scheme → closed transition in progress, information, with the window. Outside that scheme neither an operator command nor the model itself can create a parallel — the close is interlocked, a loss is break before make — so what the check finds is either in the drawing (two NC incomers by design) or the product of a timing race the scenario revealed. Every restoration, switch and trip ends with the same check.

Writing a test script

A good script is a spreadsheet, one command per row, run top to bottom, with the expected result written before the run and the actual result beside it:

What the switching model assumes — and what it does not pretend to know

Sending the simulator to someone else

The same switching model can leave Massive Dynamic as one .html file that opens in any browser, with no server and no login. Two commands in Dirac (both are in the command list under Switching):

Simulator (export simulator). The same switching engine and the same screen as here: the whole single line on a map, click an asset or a line and use its buttons (every click is one command, printed in the log), the Scheme and Breaker failure settings, Return to normal, Run all commands and Download log. It contains the single-line diagram of this project and the switching settings only (names, positions, ports, ratings, delays, feed flags): no users, documents, schedule or stage sign-offs, and the page makes no network calls. Without a recipient it is a file for your own use: no watermark, no expiry.

To share it, say who it is for: export simulator for <recipient>. The file then carries four protections: the name in the header and repeated as a faint watermark across the page, a confidentiality line under the title, obfuscated code, and it stops opening after 30 days. Add expires in 14 days or never expires to change the expiry (it reads the recipient's own clock, so it is a deterrent, not a lock), anonymised to replace the asset names (UTILITY-1, GEN-2, SWGR-7 …) and the project name, and with manual to add this manual as a second tab.

Replay (export replay). The scenarios are run here and the results are recorded; the file only plays them back, step by step, on the diagram. There is no engine inside, so the recipient cannot type new commands and there is nothing in the file to copy but pictures and text. This is the safe version to send to anybody.

The file always reflects the project as it is when you export. After you change the drawing, the switching flags or the timers, export again.

Asking Dirac what is going on

Three read-only questions in the Dirac chat answer from the live project and the real engine rather than from fixed text. what is going on gives the picture: assets with and without mains, the utilities and generators, the transfers in effect, breaker failures, what return to normal would do right now (a dry run, nothing changes) and what is selected. why is Switchgear-A off lists that asset's feeds, which carry and which do not, and where the chain upstream ends; why are the generators still running gives the engine's reason for every feed it would hold back. why alone explains the last command Dirac ran: what it did, what it held back and why, and which assets ended up dark. These questions exist in Dirac inside Massive Dynamic only.

Run all commands. run all commands (or the Run all chip in the Dirac panel) runs every switching command the project supports through the real router on a throw-away copy, each from the project as it is now, and downloads one text log with, per step, how Dirac read the command, its answer and the state afterwards. Refusals are marked X and counted. Nothing in the live project changes. The exported simulator has the same thing as a button.

Command reference

Every command that changes the project shows what it will do and waits for your confirmation first.

Operating by hand (scheme selector in Manual)

On site the transfer scheme can be switched off and the operator does everything. The scheme selector does that for the whole project: set scheme to manual. A loss of the utility then leaves the loads dark; no generator set starts, no standby feed closes, nothing retransfers, and an operator open feed is not answered by the scheme. Use set scheme to automatic to give the schemes back.

The by-hand sequence after a loss of the utility: start GEN-1, GEN-2; close feed from GEN-1 to GEN-BUS (and the other breakers out of the sets, then the tie onto the bus); the loads come back as each closed path reaches them. A close onto a live bus is still interlocked. The way back: turn on mains in UTILITY (the utility returns, the generators stay running); close feed / open feed to move the load back; stop GEN-1, GEN-2 once nothing depends on them (a stop that would drop a load is refused and lists the breakers to open first); or return to normal to do the whole way back in one go.

To make only some breakers manual and leave the scheme armed for the rest, use the Manual tick on those breakers (tick manual transfer on feed from A to B) instead of the selector. Ask what is going on at any point; it says when the selector is in Manual. Generator cool-down after a stop is not modelled: a stop is immediate.

Questions that come up