The substation inventory, built from the documents

A wind plant of about 270 MW in Texas was starting its NERC disturbance-monitoring work with one engineer and a relay-settings database from 2021. Its equipment record had been auto-extracted from the one-line and filled by hand. It looked complete. It was not.

About 100 "panel" records were really relays, breakers, disconnect switches, capacitor banks and instrument transformers filed under the wrong class. Sixteen tags existed on no drawing. One relay had the wrong make and model. There were no bay records and no links from breakers to the panels that protect them. One source document stood behind the whole record.

An inventory an auditor can use lists every relay, breaker, recorder and controller with its make, model, firmware, location and settings, and ties each value to the document and page it came from. It is the foundation under every standard that follows: disturbance monitoring, protection coordination, ride-through, and the CIP-002 list of cyber assets.

We read every document the owner had on file, about 930 indexed and nearly all read in full, and rebuilt the record from them: about 130 pieces of equipment in 11 categories, from the high-side breaker down to the station service transformer. Relay settings were read straight from the relay settings files, about 570 settings, not retyped from PDFs.

Every value points at the document and page it came from: about 4,500 evidence links across about 60 source documents. About 70 bad records were removed with the reason written beside each.

An independent engineer's review of the assessment built on the record found one error.

The corrected record was in the owner's dashboard about six hours after first look, and through its final independent review the same day. The owner's disturbance-monitoring assessment, about 550 checklist items with about 1,100 citations, was answered on top of that record within 23 hours of the first look. A re-check after a correction takes about a minute.

The same record now lists each relay, controller and recorder with its make, model, firmware and location, which is where the CIP-002 cyber-asset determination starts: from a list that is already proven, not from a spreadsheet nobody can trace.