Weeks 1–3New material: derive, calculate, build the campus increment
Week 4Produce the module artifact and verify it independently
Week 5Consolidate: Attack the Design, Formal Review, Feynman checkpoint, error-log re-tests
Three gates on every major artifact
Independent Verification
Re-derive one key result by a different method or a ±20 % sensitivity on the dominant input.
Done · Results agree within a stated tolerance, or the difference is explained.
Attack the Design
List at least five realistic contingencies: what happens, is it acceptable, what would you change.
Done · Every contingency has a consequence and a decision.
Formal Review
After 48 hours, write at least eight senior-reviewer comments (Major / Minor / Clarification), then respond and revise.
Done · All Major comments closed; open items listed as limitations.
Year 1 · Modules 01–07
01
Foundations & measurement
P&C · W1–5Know what the relay sees.
Stage 1 · one 13.8 kV feeder, one unit substation, one data hall.
- Week 1Draw the stage-1 one-line from a written description. Mark zones, CT locations, polarity and overlap. Closed-book baseline test.
- Week 2Derive CT and VT conversions; distinguish phase, residual (3I0) and a separate neutral CT. Ten conversions, each checked a second way.
- Week 3Trace source → element → supervision → output → trip coil → breaker → interruption, as a diagram and as a numbered list.
- Week 4Artifact: measurement and source-to-trip note plus phase and residual overcurrent test specification. Recompute every secondary value by hand.
- Week 5Attack the Design: reversed polarity, open CT secondary, wrong ratio, VT fuse failure, residual vs neutral confusion. Formal Review. Feynman checkpoint.
Make it tangible · Labelled one-line rev A, conversion sheet, source-to-trip diagram and test specification.
Done when · Given a new CT ratio cold, predict metering within 1 % and explain what a pickup test leaves unproven.
02
Transformer protection · GE T60, SEL-487E/787, SIPROTEC 7UT
P&C · W6–10Stable for everything outside the zone, on three platforms. Derive the physics once, then set it on each relay.
Stage 2 · T1 115/13.8 kV, 30/40 MVA, Dyn1, Z ≈ 10 %, 400 A NGR (fictional). Platform settings work replaces the campus build in weeks 2–4.
- Week 1Physics first, closed-book: full-load currents and CT secondaries, Dyn1 phase shift, zero-sequence removal as a compensation matrix. Hand-check that a 3-phase 8 kA external 13.8 kV fault (960 A on the 115 kV side) cancels; separately, a 13.8 kV ground fault limited by the 400 A NGR, where the delta-side currents are not 960 A.
- Week 2Ratio and vector compensation, two platforms in depth and the third as a mapping row. GE: sources, winding connection and angle; 1 pu = Unit CT (here the 2000 A LV CT). SEL-787: CTR1/2, TAP1/2, W1CTC/W2CTC, auto TAP only if TAPmax/TAPmin ≤ 7.5. SEL-487E: per-terminal CT, tap and compensation settings with ICOM, TAPMAX/TAPMIN ≤ 35. Siemens: object data and vector group, I/IrObj. The same through-fault is 4.78 × TAP, 4.78 I/IrObj and 4.0 pu on GE; explain why.
- Week 3Operate/restraint: GE minimum pickup, Slope 1, Break 1, Break 2, Slope 2. SEL-787 O87P, SLP1, IRS1, SLP2, U87P. SEL-487E adaptive slope: SLP2 applies only when an external fault is detected, with no IRS1. Siemens thresholds and slopes in SIPROTEC 4 and SIPROTEC 5 naming. Plot the same campus faults on each. Harmonic blocking (SEL-787 HBLK) vs restraint (HRSTR), crossblocking, REF vs 87T coverage.
- Week 4Artifact: side-by-side settings basis for T1 on two or three platforms, including the manual revision used. Slope test points for an injection set in each relay’s per-unit base, converted to secondary amps per winding; on the 487E, simulate an external fault to test SLP2. Hand-check two points per platform; ±10 % tap sensitivity.
- Week 5Attack the Design, with vendor-specific failures: wrong compensation matrix, wrong vector group or winding angle, a 487E test that ignores adaptive slope, CT saturation, extreme tap, inrush from a weak source, CT-ratio change with 87 settings unchanged. Formal Review. Feynman checkpoint.
- GE T60 · compensation from source, winding connection and grounding inputs · 1 pu = Unit CT primary · dual slope with breakpoints, restraint = max · 2nd-harmonic inrush and 5th-harmonic overexcitation inhibit, restricted ground fault (mode and element names: verify in manual).
- SEL-787 · CTR1/2, TAP1/2, W1CTC/W2CTC · O87P, SLP1, IRS1, SLP2, U87P · PCT2/PCT4/PCT5 with HBLK or HRSTR.
- SEL-487E · per-terminal CT, tap and compensation settings with ICOM (verify names against your revision) · O87P, SLP1, SLP2 adaptive, U87P, no IRS1 · harmonic and REF setting names: verify in manual.
- SIPROTEC 7UT · SIPROTEC 5: I-DIFF: Threshold, Slope 1/2 with Intersection 1/2 Irest, I-DIFF fast: Threshold, Crossblock. time 2nd har., Blocking with 3rd/5th harm. · SIPROTEC 4 equivalents I-DIFF>, base points, I-DIFF>> (verify in manual).
Make it tangible · Portfolio P1 · application note, per-platform source map and test matrix, side-by-side settings basis table (logic, naming, per-unit base, compensation, harmonic method, REF, test approach, differences, manual revision), vendor-specific Attack the Design, review record.
Done when · Given a new transformer cold, set compensation and compute a slope-1 test point on any of the three platforms, and explain on each how a CT-ratio change can alter differential behaviour with the 87 fields unchanged.
03
Fault analysis & sequence networks
Power systems · W11–15Fault physics to relay quantities.
Stage 3 · second 115 kV source and T2; 13.8 kV main-tie-main; max/min source impedance.
- Week 1Derive per-unit bases and base change; Thevenin equivalents of each source at max and min.
- Week 2Symmetrical components by hand, phase → sequence → phase, sketched as phasors.
- Week 3Sequence networks for 3φ, SLG, LL and LLG; vary grounding and tie open/closed.
- Week 4Artifact: fault-study memo with a case table. Verify against a small software or scripted model; explain any difference above 5 %.
- Week 5Attack the Design: missing zero-sequence source, wrong transformer connection, unknown X/R, motor contribution, generator in service. Formal Review. Feynman checkpoint.
Make it tangible · Fault-study memo and the assumptions register reused through Year 2.
Done when · Distinguish total bus fault current from the current through a particular relay, for three cases cold.
04
Digital substations & automation · IEC 61850
Automation / OT · W17–21Trace every signal from source to screen to trip coil.
Stage 4 · station bus on the stage-3 assets: T1/T2 bays, Main 1, tie, Main 2, unit-substation feeder.
- Week 1Draw the station network from a written description. VLANs, multicast, PRP/HSR. Data model with functional constraints; map T1 functions to PDIF, PTOC, PTRC, XCBR, XSWI, CSWI and CILO.
- Week 2Points list for the stage-3 assets (LN path with FC or DNP3 index, scaling, quality, report control block, destination) and the EPMS signal map.
- Week 3GOOSE/dataset map for differential trip, lockout and the main-tie-main interlock: GoCB fields, LGOS supervision, test vs simulation vs q.test. SCL roles by tool. Time sync: SNTP, IRIG-B, PTP and time-quality bits.
- Week 4Artifact: points list, EPMS map, GOOSE/dataset map and cyber boundary v1 with zones, conduits and target security levels. Trace three signals end to end.
- Week 5Attack the Design: lost GOOSE, wrong confRev, test bit left set, loss of time sync, flat network, utility link compromise. Formal Review. Feynman checkpoint.
Make it tangible · Portfolio P2 · automation and cyber boundary package v1, extended in Modules 05, 07, 09 and 11.
Done when · Trace a new signal cold and distinguish connectivity, mapping, timestamp and application-logic failures.
05
Overcurrent & coordination · SEL-751, GE F60/850, SIPROTEC 7SJ
P&C · W23–27Coordination in every operating mode, set on three feeder platforms.
Stage 5 · four 13.8 kV feeders, 2N A/B distribution, UPS and standby generators at 480 V, one 13.8 kV ungrounded double-wye capacitor bank on Main 2 (fictional). Platform settings work replaces part of the campus build in weeks 2–4.
- Week 1Physics first, closed-book: pickup constraints from maximum load (including N+1 transfer load) vs minimum fault, using Module 03 values; residual (3I0) vs neutral CT pickup; cold-load inrush.
- Week 2Inverse-time curves from the equation and stated constants, clearing time and a derived coordination margin. Then enter the same feeder curve on each platform: SEL-751 51P1P/51P1C/51P1TD with U1–U5 and C1–C5, GE F60 (IEEE, IEC, IAC, I²t, FlexCurves) and Multilin 850 (adds ANSI and I⁴t; pickup in × CT, TDM), SIPROTEC 7SJ Ip, curve and time dial (IEC vs ANSI multiplier scaling). Show why the same curve needs different TD numbers on IEC and US families, and on IEEE vs ANSI within GE, and compare electromechanical vs instantaneous reset.
- Week 3Directional elements and polarization on each platform (forward definition, polarising quantity, characteristic angle); coordinate three devices on strong source, weak source and generator. Capacitor bank (lighter): ungrounded double-wye protected by 60N neutral-current unbalance from a CT between the two neutrals (59NU on a single ungrounded wye shown for contrast only), inherent-unbalance compensation, alarm and trip stages from element-failure counts.
- Week 4Artifact: coordination study with TCCs per operating mode, settings rationale and a side-by-side feeder settings table on two or three platforms (curve, pickup, TD, reset, directional polarising, cold-load logic, test points in secondary amps). Hand-check two operating times per platform. Extend the P2 maps to four feeders and 2N A/B.
- Week 5Attack the Design: generator-only source, closed-transition paralleling, one 2N side out, cold-load pickup, wrong setting group, IEC TD entered on a US curve or IEEE TD on an ANSI curve, capacitor unbalance setting with no inherent-unbalance compensation. Formal Review. Feynman checkpoint.
- SEL-751/751A · 50P/51P, 50G/51G, 50N/51N · 51P1P, 51P1C (U1–U5, C1–C5), 51P1TD, 51P1RS electromechanical reset Y/N (verify in manual) · directional 67 with ORDER/polarising settings (verify in manual) · cold-load via setting groups or logic.
- GE UR F60 · Phase TOC: curve IEEE, IEC A/B/C/short, IAC, I²t, FlexCurves; no ANSI family · directional characteristic angle and polarising (verify in manual).
- GE Multilin 850 · Phase TOC: PICKUP in × CT (0.050–30.000), CURVE adds ANSI Extremely/Very/Normally/Moderately Inverse and I⁴t, FlexCurve A–D, definite time, TDM 0.05–600.00, RESET Instantaneous/Timed · directional settings (verify in manual).
- SIPROTEC 7SJ (7SJ80/82 SIPROTEC 4–5) · 50/51: I>, I>>, Ip with T Ip / D Ip, IEC or ANSI curve · 67/67N direction with polarising and angle · all names and SIPROTEC 4 vs 5 naming (verify in manual).
- Capacitor bank (lighter) · double-wye, ungrounded: 60N neutral-current unbalance is the primary method; 59NU (single ungrounded wye with neutral VT) for contrast only · inherent-unbalance compensation on SEL-487V (60N nulling), GE C70 and SIPROTEC 7SJ85 (names and ranges: verify in manual). One-row mapping in the P3 table.
Make it tangible · Portfolio P3 · integrated fault and coordination study (Modules 03 + 05, one model, one assumptions register) with side-by-side feeder settings table (logic, naming, curve scaling, reset, directional supervision, test approach, manual revision) and a capacitor-unbalance mapping row.
Done when · Diagnose a seeded miscoordination cold: pickup, timing, curve shape, curve-family scaling or system change, and re-enter the fix on any of the three platforms.
06
Distance protection · SEL-421/311L, GE D60, SIPROTEC 7SA
P&C · W29–33Impedance to reach to test phasors, entered on three platforms.
Stage 6a · 230 kV POI with a short utility line. Platform settings work replaces part of the campus build in weeks 2–4.
- Week 1Physics first, closed-book: primary to secondary ohms (CTR/PTR); R-X zones for the POI line; short-line and SIR challenges; Zone 1 underreach, Zone 2 and Zone 3 or reverse zone purpose.
- Week 2Phase and ground loops; derive k0 = (Z0 − Z1)/(3Z1) from line data, then convert it into each vendor’s convention: SEL-421 k0M1/k0A1 (Zone 1) and k0M/k0A, GE D60 Z0/Z1 magnitude and angle, SIPROTEC 7SA RE/RL and XE/XL or K0 and angle. Define each form: k0 = (Z0 − Z1)/(3Z1) is complex (SEL, Siemens K0); RE/RL = (R0 − R1)/(3R1) and XE/XL = (X0 − X1)/(3X1) are separate scalar ratios, not |k0|; GE enters the ratio Z0/Z1 = 1 + 3k0, not k0. All are dimensionless, so CTR/PTR does not change them. Worked check: Z1 = 2 + j20 Ω, Z0 = 7 + j60 Ω gives k0 = 0.669∠−1.41°, RE/RL = 0.833, XE/XL = 0.667, Z0/Z1 = 3.005∠−0.94°, and the SLG loop Z1(1 + k0) = 33.53 Ω∠83.72° on every form. Enter the same line on two platforms in depth, the third as a mapping row.
- Week 3Mho vs quadrilateral on each platform (resistive reach, tilt or directional supervision), fault resistance, load encroachment, BESS infeed (what-if, stage 7 preview), loss-of-potential supervision; why short lines favour pilot or line differential.
- Week 4Artifact: reach calculations, R-X plot, side-by-side distance settings table on two or three platforms and at least six boundary tests per platform in that relay’s own units. Verify two apparent impedances by hand from sequence quantities; ±10 % k0 sensitivity.
- Week 5Attack the Design: high SIR, wrong k0 convention (|k0| 0.669 entered as RE/RL 0.833, or GE Z0/Z1 3.005 entered as SEL k0), CVT transients, generation infeed (what-if), loss of VT with LOP blocking disabled, test set using a different k0 form than the relay. Formal Review. Feynman checkpoint.
- SEL-421 / SEL-311L · Z1MAG/Z1ANG, Z0MAG/Z0ANG line data · mho Z1P–Z5P, quadrilateral XG/RG · k0M1/k0A1 Zone 1, k0M/k0A other zones; SEL-311L: same names, k0M/k0A appear only with EADVS = Y · XG/RG quadrilateral reach · LOP and load encroachment (ZLF/ZLR: verify in manual).
- GE D60 (and L90 backup distance) · positive and zero-sequence line impedance · Z0/Z1 magnitude and angle per zone (= 1 + 3k0; names verify in manual) · mho or quad shape, directional angle and comparator limit · VT fuse failure and load encroachment (names: verify in manual).
- SIPROTEC 7SA (7SA6 / 7SA8x) · RE/RL and XE/XL or K0 and angle(K0) by parameter choice (strings: verify in manual) · polygon (quad) and mho zones Z1–Z5 · fuse-failure monitor and load encroachment · SIPROTEC 4 vs 5 naming (verify in manual).
- Test approach · confirm which k0 form the injection set uses and convert before testing; check reach on phase and ground loops at line angle and at load angle on each platform.
Make it tangible · Reach calculation set, R-X plot, side-by-side distance settings table (logic, naming, residual compensation form, supervision, test approach, manual revision) and boundary test list, feeding P4.
Done when · Convert, plot and justify reach for a new line cold, express the same k0 in all three vendor forms, and say why distance alone may be inadequate here.
07
Pilot, line differential, bus & breaker failure · SEL-411L/487B/451, GE L90/B30/C60, SIPROTEC 7SD/7SS
P&C · W34–38Across terminals, across the bus and through the breaker, on three platforms.
Stage 6b · both POI line terminals; 230 kV POI bus; two 230/34.5 kV transformers. Platform settings work replaces part of the campus build in weeks 2–4.
- Week 1POTT, PUTT, DCB, DCUB and line differential compared for the POI line (DTT is transfer trip for breaker failure and remote trip, not a pilot comparison); choose and justify. Line differential on each platform: SEL-311L/411L alpha plane (87LR radius, 87LANG blocking angle), GE L90 adaptive per-phase restraint, SIPROTEC 7SD threshold with charging-current compensation. Pickups (87LPP, 87L2P, 87LGP) must sit above line charging current. Channel asymmetry: a ping-pong delay estimate assumes equal go and return paths; Δ = 1 ms is about 21.6° at 60 Hz.
- Week 2Truth tables: permissive receipt, channel loss, weak infeed/echo, current reversal, and a DCUB row for loss of guard plus permissive (unblock window typically about 150 ms: verify in manual). Map the chosen scheme onto each platform’s logic (SELOGIC control equations, GE FlexLogic, Siemens CFC) and name where each vendor’s built-in scheme replaces custom logic.
- Week 3Breaker failure and bus differential, two platforms in depth and the third as a mapping row. BF: current detector pickup below minimum fault; delay ≥ breaker interrupt time (about 2–3 cycles at 230 kV) + current-detector dropout + margin, roughly 6–9 cycles; retrip and backup timers; no-current logic (SEL ENCBF1) for low-current faults. Bus: low-impedance 87B on the 230 kV POI bus (mixed CT ratios, zone selection from disconnector status; high impedance needs matched CTs and has no zone selection): check zone, slopes, CT saturation handling. Add BF GOOSE to the Module 04 dataset map.
- Week 4Artifact: logic diagrams, trip matrix and side-by-side tables (two platforms in depth, third as a mapping row) for line differential, BF and 87B on two or three platforms (logic, naming, supervision, timers, slopes and saturation method, test approach, manual revision). Verify the clearing-time budget against Module 03 fault levels; hand-check one bus slope point and one BF timing chain per platform: relay + BF delay + backup breaker + DTT channel against the Module 03 clearing-time budget. Reclosing and sync-check philosophy (moved from week 3).
- Week 5Attack the Design: channel failure during fault, failed campus breaker, BF current detector above minimum fault, retrip disabled, CT saturation on an external bus fault, disconnector status wrong in zone selection, weak BESS infeed (what-if), wrong DTT routing, time-reference error. Formal Review. Feynman checkpoint.
- Line differential · SEL-311L: 87LPP, 87L2P, 87LGP, 87LR, 87LANG, pickups above charging current · SEL-411L: same names (verify in manual) · GE L90 per-phase adaptive restraint, GPS channel option (verify in manual) · SIPROTEC 7SD I-DIFF threshold, charging-current compensation (verify in manual).
- Breaker failure · SEL 400 series, per breaker (suffix 1, 2 for BK2): 50FP1, BFPU1, RTPU1, BFI3P1/BFIDO1/BFISP1, ENCBF1 no-current logic, EBFL1 enable (SEL-421 manual; SEL-451 from a secondary source; SEL-487E: verify in manual) · GE C60/D60: current supervision, timers 1–3, retrip (verify in manual) · SIPROTEC 7SS52: I> BF; 7SJ/7SA: 50BF threshold, T1 local retrip, T2 backup trip (parameter strings: verify in manual).
- Bus differential · SEL-487B: CTnnBZx terminal-to-zone assignment, TAPnn = CTRMAX·INOM/CTRnn (up to 10:1 ratio mismatch), O87P (verify range), SLP1/SLP2 with external-fault detection (CON1) switching to SLP2, directional supervision, sensitive 87ST/E87SSUP · GE B30: biased dual slope, saturation detector, directional supervision (verify in manual) · SIPROTEC 7SS52: STAB FAC:BZ/CZ (k), Id> BZ/CZ, k = 0.6 when CT burden factor Kb < 2, otherwise calculate · 7SS85: characteristic slope and threshold (verify in manual).
- Test approach · line differential with a GPS-synchronised or loop-back test; BF by timing from initiate to retrip and backup trip with current removed and held; 87B slope points with a simulated external fault on each platform.
Make it tangible · Logic diagrams, trip matrix and side-by-side line differential, breaker-failure and bus-differential tables, feeding P4.
Done when · Produce a correct trip matrix cold for healthy and failed channels and a failed breaker, set a BF timing chain and one 87B slope point on any of the three platforms, and explain how each vendor keeps 87B stable for CT saturation.
Year-1 integration · W39–44
Portfolio P4: one protection and automation philosophy for the path 230 kV POI → 230/34.5 kV transformers → 34.5 kV ring → 34.5/13.8 kV unit transformers → 13.8 kV halls, including retirement of the 115 kV legacy supply, the updated P2 maps and a draft standards compliance matrix. Closes with a 15-minute recorded defence of five decisions.
Years 2–3 · Modules 08–12
08
Power-system studies · PSS/E
Power systems · Year 2Load flow and contingency, then short circuit → coordination → IEEE 1584 arc flash on one model.
Stage 7 · BESS and generation intertie, all operating modes.
Make it tangible · Portfolio P5 · integrated studies package with arc-flash sensitivity and a mitigation comparison.
09
Protection design & documentation
Design · Year 2Bay design, AC/DC schematics, CT allocation vs Sampled Values, DC duty and transfer schemes.
Stage 7 · BESS bays join the station bus; Sampled Values on one bay.
Make it tangible · Portfolio P6 · bay design package, FAT/SAT outline and compliance matrix.
10
Event analysis & troubleshooting
P&C · Year 2COMTRADE, GOOSE/SV/SOE timelines, competing hypotheses, inverter-source fault behaviour.
Stage 7 · synthetic events on the full Year-2 campus.
Make it tangible · Portfolio P7 · two synthetic event investigations separating evidence, inference and unknowns.
11
Practical OT cybersecurity
OT security · Year 3Zones and conduits across the full campus, engineering access, baseline and restore, logging.
Stage 8 · the Module 04 boundary extended to BESS, generation and the 230 kV yard.
Make it tangible · Portfolio P8 · extended boundary drawing, risk register and a demonstrated restore record.
12
Integration & technical leadership
Integration · Year 3Full-campus protection and automation philosophy and its trade-offs.
Stage 9 · the full campus.
Make it tangible · Portfolio P9 · capstone package, review record and a 15-minute defence of five decisions.
Spaced review · Year 1
| Module | Taught | Review 1 | Review 2 |
|---|
| 01 Foundations & measurement | W1–5 | W8 | W12 |
| 02 Transformer protection | W6–10 | W14 | W17 |
| 03 Fault analysis | W11–15 | W18 | W21 |
| 04 Digital substations & automation | W17–21 | W24 | W27 |
| 05 Overcurrent & coordination | W23–27 | W30 | W33 |
| 06 Distance protection | W29–33 | W35 | W40 |
| 07 Pilot schemes & breaker failure | W34–38 | W41 | W46 |
- W1–48 scheduled: 35 module weeks + 3 gap weeks (W16, W22, W28) = W1–38, integration package W39–44, buffer W45–48. W49–52 are leave and holidays, not scheduled.
- Quarterly cumulative exams: W13, W26, W45 and W48. Buffer weeks hold the W45 exam, the W46 review and the W48 exam.
- At most one scheduled review or exam in any week. Reviews use the 1-hour mixed-set block; no extra hours.
The living system · Northfield Data Campus (fictional)
- Stage 1 · 01One 13.8 kV utility feeder, one 13.8 kV/480 V unit substation, CTs/VTs, one data hall.
- Stage 2 · 02T1: 115/13.8 kV, 30/40 MVA, Dyn1, Z ≈ 10 %, 400 A NGR, CTs 300:5 and 2000:5.
- Stage 3 · 03Second 115 kV source feeding T2 (identical to T1). Main-tie-main: Main 1 from T1, Main 2 from T2, normally-open tie.
- Stage 4 · 04IEC 61850 station bus on the stage-3 assets, GOOSE trips and interlocks, EPMS meters, DNP3 gateway, cyber boundary v1.
- Stage 5 · 05Four 13.8 kV feeders, 2N A/B distribution, UPS and standby generators at 480 V, one 13.8 kV capacitor bank on Main 2.
- Stage 6 · 06–07230 kV POI line and bus, two 230/34.5 kV transformers, 34.5 kV ring, 34.5/13.8 kV unit transformers T3/T4. The 115 kV supply, T1 and T2 retire in the integration package.
- Stage 7 · 08–1034.5 kV BESS and generation intertie, N+1 capacity, transfer schemes, Sampled Values on one bay.
- Stage 8 · 11Full OT security across every zone: engineering access, baseline and restore, logging.
- Stage 9 · 12Full campus, defended end to end.
Portfolio · nine pieces
More reliable judgement. Stronger technical evidence.
- P1Transformer applicationModule 02
- P2Automation & cyber boundary package v1Module 04
- P3Integrated fault & coordination study, multi-platform feeder tableModules 03 + 05
- P4Year-1 campus protection & automation packageW39–44
- P5Integrated studies package (short circuit, coordination, arc flash)Module 08
- P6Bay design packageModule 09
- P7Event investigationModule 10
- P8OT security package (extends P2)Module 11
- P9Capstone defenceModule 12
Each piece carries an assumptions register, verification, Attack the Design table, review record, standards compliance matrix (applicable editions) and stated limitations. Fictional systems and permitted public data only; every piece is labelled as training work.
Start PSS/E early.Check access in week one and use it for the Module 03 verification; don’t wait until Module 08.
Keep credentials focused.Continue the P.Eng. work separately. Choose one additional exam when it supports a specific role and fits the workload.