How Disruptions in DC Power and Communications Circuits Can Affect Protection Karl Zimmerman and David Costello Schweitzer Engineering Laboratories, Inc. © 2015 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. This paper was presented at the 68th Annual Conference for Protective Relay Engineers and can be accessed at: http://dx.doi.org/10.1109/CPRE.2015.7102189. For the complete history of this paper, refer to the next page. Presented at the 43rd Annual Western Protective Relay Conference Spokane, Washington October 18–20, 2016 Previously presented at the 70th Annual Georgia Tech Protective Relaying Conference, April 2016, PowerTest Conference, March 2016, and 2nd Annual PAC World Americas Conference, September 2015 Originally presented at the 68th Annual Conference for Protective Relay Engineers, March 2015 1 How Disruptions in DC Power and Communications Circuits Can Affect Protection Karl Zimmerman and David Costello, Schweitzer Engineering Laboratories, Inc. Abstract—Modern microprocessor-based relays are designed factors must perform correctly to ensure that the protection to provide robust and reliable protection even with disruptions in scheme correctly restrains for out-of-section faults or when no the dc supply, dc control circuits, or interconnected fault is present. communications system. Noisy battery voltage supplies, interruptions in the dc supply, and communications interference are just a few of the challenges that relays encounter. II. THE EFFECT OF DC AND COMMUNICATIONS DISRUPTIONS This paper provides field cases that investigate protection ON OVERALL RELIABILITY system performance when systems are subjected to unexpected Protection systems must be robust even with transients, switching or interruptions in dc or communications links. The harsh environmental conditions, and disruptions in dc supply, discussion emphasizes the importance of environmental and design type testing, proper dc control circuit design and dc circuits, or interconnected communications. These application, reliable and safe operating and maintenance disruptions include loss of dc power due to failure or human practices with respect to dc control circuits and power supplies, action, noise on the battery voltage, dc grounds, interruptions and considerations for reliable communications design, in dc supply, and subsequent restart or reboot sequences. In installation, and testing. Some practical recommendations are the case of communications, these disruptions include channel made with regard to engineering design and operations interface noise, channel delays, interruptions due to equipment with equipment to improve protection reliability and reduce the possibility of undesired operations. problems or human action, unexpected channel switching, and restart or resynchronization sequences. I. THE ROLE OF DC AND COMMUNICATIONS IN Fault tree analysis has been beneficial in analyzing PROTECTION SYSTEMS protection system reliability, comparing designs, and quantifying the effects of independent factors. For example, Fig. 1 shows a one-line diagram of a typical two-terminal the rate of total observed undesired operations in numerical line protection system using distance relays in a relays is 0.0333 percent per year (a failure rate of 333 • 10–6). communications-assisted pilot scheme. By comparison, the rate of undesired operations in line current Bus S Bus R differential (87L) schemes where disturbance detection is enabled is even lower at 0.009 percent per year (a failure rate 52 52 of 90 • 10–6). However, undesired operations caused by relay application and settings errors (human factors) are 0.1 percent per year (a failure rate of 1,000 • 10–6) [1]. Communications Communications 21 21 Equipment Equipment Unavailability, which is the failure rate multiplied by the Channel mean time to repair, is another measure used to compare reliability. The unavailability of dc power systems is low at 30 • 10–6, compared with 137 • 10–6 for protective relays and 125 Vdc 48 Vdc 48 Vdc 125 Vdc 1,000 • 10–6 for human factors. These data assume a faster Fig. 1. Two-Terminal Digital Line Pilot Protection Scheme. mean time to repair a dc power system problem (one day) To successfully clear all faults on the line within a compared to relays and human factors (five days). prescribed time (e.g., less than 5 cycles), all of the elements in Communications component unavailability indices are similar Fig. 1—breaker, relay, dc supplies, communications, current to those of protective relays [2]. transformers (CTs), voltage transformers (VTs), and wiring— The North American Electric Reliability Corporation need to perform correctly. It is not unusual for lines to have (NERC) State of Reliability 2014 report found that from the redundant and backup protection schemes, often using second quarter of 2011 to the third quarter of 2013, 5 percent different operating principles, with multiple channels and/or of misoperations involved the dc system as the cause, dc supplies. compared with 15 percent for communications failures, Human factors (such as design, settings, procedures, and 21 percent for relay failures, and 37 percent for human factors testing) are not shown in Fig. 1 but must also perform [3]. correctly. Additionally, security is as important a From these data, we can see that dc and communications consideration as dependability. All of the elements and human failures are a small but significant factor in reliability. 2 1178 Note: Numbers shown are Protection Fails to Clear unavailabilities • 106 In-Section Fault in the Prescribed Time 3 589 589 Protection at S Fails Protection at R Fails Same as Protection at S 2 4 Common-Mode Common-Mode Breaker at Hardware/ Settings/Design S Fails to Firmware Errors Interrupt Failures 500 Current 5 80 1969 2219 Main 1 Protection Main 2 Protection at S Fails at S Fails 1 Relay Relay Breaker DC CT VT CT VT DC Hidden Microwave Microwave Microwave Comm. Fails App. or Trip Coil System Fails Fails Wiring Wiring Wiring Failures Channel Tone Transceiver DC 137 Settings Fails Fails 3 • 9 3 • 15 Errors Errors Errors 10 Fails Equipment Fails System Errors 120 30 = 27 = 45 50 50 50 100 Fails 200 Fails 1000 100 50 Fig. 2. Dependability Fault Tree for Dual-Redundant Permissive Overreaching Transfer Trip (POTT) Scheme [2]. Fault trees allow us to see how the failure rate of one change in one subsystem likely has an effect throughout other device impacts the entire system (see Fig. 2). Fault trees also subsystems (see Fig. 3) [4]. allow us to evaluate how hidden failures, common-mode failures, improved commissioning tests, and peer reviews impact reliability. However, fault trees do not easily identify how a failure or activity in one subsystem affects another subsystem. Inspired by Christopher Hart, acting chairman of the National Transportation Safety Board, we wanted to investigate the interaction of components, subsystems, and human factors on the reliability of the entire protection system. At the 2014 Modern Solutions Power Systems Conference, Mr. Hart spoke of the aviation industry as a complex system of coupled and interdependent subsystems that must work together Fig. 3. Aviation Safety Involves Complex Interactions Between Subsystems. successfully so that the overall system works. In aviation, a 3 The protection system, and the entire power system, is very similar to the aviation industry. Fault trees and high-level apparent cause codes do not necessarily make these subsystem interdependencies apparent. For example, in December 2007, while performing maintenance testing, a technician bumped a panel and a microprocessor-based, high-impedance bus differential relay closed its trip output contact (87-Z OUT1 in Fig. 4), tripping the bus differential lockout relay (86B in Fig. 4). Fortunately, due to testing that was being performed that day, the lockout relay output contacts were isolated by open test switches that kept it from tripping any of the 230 kV circuit breakers. Fig. 5. X-Ray Images of the Healthy, Adjacent Contact (Left) and Damaged Contact (Right). The output contact manufacturer further inspected the output contact part. The output relay cover was removed and 18 the inside of the part was observed and photographed (see TS 17 Fig. 6). The plastic components were melted, the spring of the 203 87-Z contact point was discolored and deformed by heat, and the OUT 1 204 contact surfaces were deformed, rough, and discolored. The 13 root cause of the contact damage was confirmed: at some TS point prior to the misoperation, the interrupting current was in 14 excess of the contact’s interruption rating. G F 86B C B Fig. 4. DC Control Circuit Showing Bus Differential Trip Output. Fig. 6. Pictures From Contact Manufacturer Confirming Heat Damage From The bus differential relay contact closure was easily Exceeding Current Interruption Rating. repeated by bumping the relay chassis. The simple apparent cause could have been classified as human error, product It is important at this point to persist in analysis and defect (failure to meet industry shock, bump, and vibration examine testing mandates, procedures, and work steps to find standards), or relay hardware failure. However, subsequent root cause. In this case,