00013025

8/3/2019 00013025

1/7

Aspects of Power System Protection in the Post-Restructuring Era

A. G. Phadke,VPI&SUBlacksburg, VA

S. H. Horowitz,ConsultantColumbus Ohio

J. S. ThorpCornell UniversityIthaca NY

Abstract

Protection practices in electric utility industry as itexisted prior to re-structuring were designed to meetcertain goals of sound engineering principles as theywere applied, primarily to component protection invertically integrated electric utility systems. There hasbeen a significant shift in emphasis from uncomplicatedcomponent protection to system protection to avoid or

mitigate wide-area disturbances. It is not clear how theresponsibilities for designing and maintaining the protection systems will be divided between thetransmission system owner and the ISO. Protection andcontrol of generators will also impact the performance ofthe power system. The settings used in many protectionsystems that are designed to protect power apparatuswill affect the ability of the transmission system totransfer power between two points on the network. Theowners of the transmission system as well as the ISOshould have an interest in knowing the limitationsimposed by both the apparatus and the systemprotection, and the ability to change those settings if theydo not meet their respective objectives. It is possible that

the objectives of the two entities will be in conflict. Thispaper will examine the existing protection philosophies,and their impact on these issues.

Introduction

System protection concepts exist in the verticallyintegrated systems now to assure continuity of serviceeven at the expense of immediate economicdisadvantage. How is it to be altered and expanded whenan ISO encompasses many existing utilities and aredriven by economic concerns? There have beensignificant advances in the field of protective relayingdue to the impact of computers and communications andthe introduction of adaptive relaying concepts. Can thesenew systems play a role in a new era of protectiondesign?

The protection system has not received muchattention in the literature on re-structuring in the powerindustry. Subjects such transfer capabilities, generationmargins, and other issues related to sale and transfer ofpower in the new era of power systems without borders

have received the greatest attention. We believe that it isnecessary to examine protection systems, because of therole it plays in system security. This paper is anexamination of some issues in restructuring from aprotection engineer's point of view.

We recognize that the proposed changes andimprovements to the protection practices that we putforward here may be desirable not just from the point ofview of the post-restructuring era, but also for protection

practices in general.

Present Power System Control

Traditional system operation is organized in ahierarchical configuration with two or three layersdepending on the specific organizational and geographicarrangement of a given utility. (See Figure 1.) Basically,there are several local and/or regional control centers thatare responsible for the distribution and thesubtransmission systems. Line and equipmentmaintenance outages and switching orders are directedby this center; customer complaints are received andresponded to. The system control center is a single entity

responsible for the HV and EHV systems. This center isresponsible for the control of all generation in terms ofeconomic dispatch, load frequency control, generatingunit commitment and maintenance scheduling. It hasoverall responsibility to achieve optimum economicoperation on the bulk power supply system, subject tosystem security constraints.

Figure 1.Hierarchical Control Centers

In the pre-restructuring era, i.e., with thevertically integrated, non-competitive utility there is aclose interaction between the planning and operation

System Control Center

RegionalControl

RegionalControl

LocalControl

LocalControl

LocalControl

LocalControl

Proceedings of the 32nd Hawaii International Conference on System Sciences - 1999

0-7695-0001-3/99 $10.00 (c) 1999 IEEE


1

8/3/2019 00013025

2/7

disciplines. The effect of a maintenance outage on theHV and EHV systems would have undoubtedly beenstudied beforehand and addressed by planning, operatingand relaying engineers before scheduling and performingany given outage to be certain that the system is notendangered by removing transmission elements.

Similarly, the general subject of power sales andpurchases and the resulting flows would have beendetermined off-line to establish guidelines for thedispatcher to follow in his/her daily activities. Summerand winter thermal limits are established, unusualmagnitudes of loads are identified, generation schedulesare determined to maintain the most economicperformance and to assure load-frequency balance, andvoltage levels are calculated. The system control centerhas the primary coordinating responsibility for thesystem configuration and the balance between all of themaintenance requests and the sales and purchases withthe power systems overall security. In the verticallyintegrated utility, the relationship between security and

optimum performance can be relatively easily reconciled.Generation dispatch is not as easily balanced. Eachpower plants operating personnel has its own agendawith a significant measure of control. There arelegitimate reasons to limit a units output based upon thecondition of the unit and /or its auxiliary equipment. Asa result, the real or reactive output of a generator may berequested by the system dispatcher but not delivered.Again, since we are dealing with a unified organizationthe conflicts are amenable to a rapid resolution.

Present protective systems

Some of the key features of current protectionsystems are:

Security and dependability Modern protectionsystems are biased toward dependability at the expenseof security. Such a bias has been historically correct forthe robust power system of the past, i.e. an accidentalloss of some equipment through incorrect relay operationcould easily be tolerated without stressing the remainingpower system. It has been recognized that such a bias isinappropriate when the power system is in a stressedstate. The involvement of the protection system in majorsystem disturbances can be attributed to this built-in biastoward false trips. When the system is stressed or in earlystages of a sequence of events that will lead to a major

disturbance, it would be desirable to avoid incorrecttripping of unfaulted equipment. It should be recognizedthat if new systems can accomplish this it will have to beat the risk of not clearing an actual fault. The trade-offsinvolved in such decisions must be examined in moredetail but the high costs of major disturbances in arestructured environment must be considered.

Compatibility of protection philosophiesamong interconnected systems will become more

important. Strong interconnections between largernetworks make it necessary to be sure of the nature of theresponse of the protection system to a fault ordisturbance on any partof the system.

Local inputs must be involved for some at leastsome relays. Hard wired connections to inputs that are

independent of any outside device within the substationor at some remote location are required to insure thatequipment is protected in the event of communicationfailures

Primary protection Primary protection isusually based on closed zones such as differentialprotection of transformers and buses and phasecomparison and longitudinal differential relaying oftransmission lines. Such schemes are preferred to openzone protection schemes since infeed, loadingconditions, power swings, and other exogenous eventscan affect the later.

Back-up protection schemes are required tooperate when the primary protection equipment fails toclear a fault. Both local back-up protection (breakerfailure protection) and remote back-up protection arecommon. The operation of any back-up protectioninvolves a larger part of the system than thecorresponding primary protection. These schemes arealso frequently open zone schemes, and are subject to theproblems mentioned above.

Coordination of primary and back-upprotection schemes is used to avoid incorrect operationof back-up systems. Back-up protection should not beused when the fault can be cleared by the primaryprotection. Coordination involves both relay operatingtime as well as in the relay reach.

Special protection schemes (Remedial ActionSchemes) have become control schemes that areintimately tied to protective relays. They are pre-programmed to operate after a relaying event and inresponse to prevailing conditions on the network.

Substation Equipment

Transformers- the traditional and mosteffective protective system for power transformers isdifferential protection. With such protection there is nocoordination problem since the differential zone is aclosed zone and only detects faults within the area

defined by the current transformers. Except for hiddenfailures then, power transformer protection should notmiss-operate during any other system faults.

As backup protection, it is not uncommon toadd instantaneous and/or time delay overcurrent relays.Instantaneous relays are not of any concern in the presentdiscussion since they are set above maximum inrush andwould not be in a position to miss-operate during anysystem faults. Time delay overcurrent relays are set for


0-7695-0001-3/99 $10.00 (c) 1999 IEEE


2

8/3/2019 00013025

3/7

unusual loads and may miss-operate as system elementsare removed during any widespread outages.

Buses - Differential protection is virtually theonly protection used and should not miss-operate duringany unusual system events. However, bus differentialrelays are uniquely sensitive to current transformer

saturation depending upon the specific relay design andmay be subjected to severe fault contributions duringunusual system configurations and may be a cause forconcern.

Shunt Reactors and Capacitors - Theseelements are used to provide system voltage support orcorrection and are protected by a wide variety ofprotective devices; differential, impedance and negativesequence relays for reactors, fuses and overcurrent relaysfor capacitors. They are susceptible to misoperation assystem parameters change drastically under unusualsystem events. Their misoperation would exacerbate anysystem problem by changing the voltage at the associatedsystem node.

Transmission System - Extra-High Voltageand High Voltage are almost exclusively protected bypilot schemes with stepped distance backup. The pilotschemes are relatively immune to misoperation due tothe differential nature of its measurement. However, asdiscussed above, hidden failures may be involved and theparameters that accompany unusual system events maytrigger these failures and cause misoperations. Inaddition, system swings appear to the impedance relaysas slowly moving faults and, unless properly monitored,could cause them to operate. This has to be evaluated foreach situation. For stable swings lines should not trip anda out-of-step blocking and tripping scheme may be

required For unstable swings it is sometimes desirable totrip a line that sees the swing but sometimes it isdesirable to transfer trip another line.

Generator - Generator protection is providedby a wide variety of devices to cover an extensive arrayof abnormal operating problems. The primary protectionfor stator phase faults is the differential relay and itsoperating features are the same as described above fortransformers and buses. These relays should not tripincorrectly for system events. It is common practice toprovide loss-of-field relays using some combination ofimpedance relays and these can operate incorrectlyduring stable or unstable system swings. This operationwill, of course, worsen any cascading or potentialcascading outage. In addition to the loss of field, moderngenerators have field limiting circuits and these canresult in adverse conditions during cascading outages asthe voltage across the system calls for more reactivesupport. Volts per Hertz relays monitor the rationbetween system voltage and system frequency. Theymay be set to trip depending upon the philosophy of theutility although it is more common to allow the relay totrip only when the circuit breaker is open. The

assumption is that neither systemvoltage nor frequencycan vary significantly with the unit connected. This maynot be true during abnormal system events and somelogic may be required to reconnect the relay to trip.Reverse power or directional relays and system backuprelays are sometimes used to trip the unit if an abnormal

system condition lasts beyond a reasonable length oftime. Since widespread outages do result in severeabnormal conditions these protective may operate.

The Role of Protection in Wide-area Outages

The question of eliminating or mitigatingcascading outages eventually focuses on the performanceof the protection system during abnormal system events.Ideally, within the umbrella of the operating utility, relayapplications and settings are determined by closecooperation between the relay, planning and operatingengineers. That this isnt done as thoroughly as it shouldbe is evident by the fact that we do experience blackouts.In the best of all possible worlds, each such event,however, is studied and appropriate remedies areinitiated. The most familiar causes of such cascadingoutages are usually the result of a series of abnormaloperations very often involving load encroaching in thethird zone of a distance relay, a power swing entering atripping characteristic, a communication failure or somecurrent or voltage transducer misoperating under asaturating or transient condition. These are not allidentifiable or anticipated, are not amenable to easysolutions but they are not fatally intractable under theexisting organization with cooperating disciplines. Theemergence of the computer relay is providing another

dimension to the protection systems dependability andsecurity. The ability to self-check, perhaps self corrector operate in an adaptive mode thus becoming responsiveto system changes, plus other sophisticated measures areall being actively investigated.

There are several concepts that are specific tothis restructuring activity that have special application tosystem protection.

Available transfer capability (ATC) is the totaltransfer less reserves for reliability and existingtransmission commitments. This reduction in the ATC isthe margin which protective relaying must recognize ifthe contracted power flows are not to cause relaymisoperation.

Curtailability is the right of the transmissionprovider to interrupt all or part of a transmission servicedue to conditions that reduce the capability of thetransmission path to provide transmission service. If theprotection system can anticipate misoperation than it caninvoke this feature.

A secondary transmission provider (STP) is anycustomer who has acquired rights to use transmissionrights to use transmission facilities and chooses to resell


0-7695-0001-3/99 $10.00 (c) 1999 IEEE


3

8/3/2019 00013025

4/7

8/3/2019 00013025

5/7

Maintenance and calibration schedules that arecompatible with the protection system on the contiguouspower system should also be developed.

It may be profitable to rethink back-upprotection philosophy for the restructured utilityindustry. The communication network may be used to a

greater extent to improve back-up protection.Recognizing that the loadability of back-up protectionsystems is frequently involved in cascading outages onpower systems, existing telescoping back-upcharacteristic can be abandoned in favor of back-updifferential protection on larger portions of the system.Back-up protection systems can also be altered from acentral control point as the network conditions change.

Load-independent relays should be developedand installed at critical locations on the power systems.Pre-fault load currents can be removed from protectionconsiderations by devising relaying algorithms thatoperate only on incremental currents (and voltages).Relays that automatically check the historical loadpatterns over long periods (years), and generate alarmswhen loads approach any of the protective relay can bedesigned. Relay characteristic databases will have to bedeveloped and maintained for these purposes.

It may be possible with computer relays toswitch the protection system to a single-phase mode inthe event that the power system is stressed.

Remedial action schemes have dependencies onsystem state that must be well known to allinterconnected parties. It is necessary to examine theinteraction between all of the various remedial actionschemes that may be in service.

It is also necessary to evaluate load sheddingand restoration principles in use on the totalinterconnection. The market consequences of islandingand load restoration must be understood.

Protection and EMS functions

The State Estimator function, which determines theprevailing condition of the power network from real timemeasurements, is critical to the operation of the EnergyManagement Systems (EMS). The security of the powersystem is determined using the estimated state of thesystem is to find the response of the network to various

credible contingencies. Recent advances inmicroprocessors protection systems, communications,and measuring techniques make it possible to directlymeasure the state of the power system.

State of the power system

Static state estimation programs used in the EnergyManagement Systems determine the system state from a

collection of scanned measurements of the system. Thestatic state calculated in this fashion is not actually thestate of the power system, as it is calculated frommeasurements obtained over the measurement scan timewhich may range from several seconds to minutes.Adaptive protection systems and remedial action

schemes require the true system state.The advent of synchronized phasor measurement

technology using the Global Positioning System make

possible a state estimate which is a true snap shot of the

power system. The state could be measured in tens of

milliseconds making it possible to track system dynamic

events in real-time. As the need for adaptive relaying

and intelligent remedial action schemes becomes more

critical in the post-restructured environment

synchronized phasor measurements will play an

important role.

Contingencies and the protection systems

According to recent studies, the power protectionsystems have played significant roles in the birth andpropagation of major power disturbances. While almostall relay operations are correct, the propagation ofdisturbances through hidden failures in the protectionsystem is possible in rare situation. Incorrect orunwanted relay operations were involved in theNortheast Blackout, the New York City Blackout, andthe WSCC events of 1996. Out of the last five majorWestern Systems Coordinating Council (WSCC) events(the North Ridge earthquake, December 14

th1994, July

2nd

& 3rd

1996, and August 10th

1996); the latter threeinvolved false trips with line protection relays and

generators. In the deregulated system of the future, theability to transfer power reliably through a networkbecomes a necessity when monetary values are attachedto its reliability. Hence there exists a need to study thehidden failures imbedded within the protection system.

In spite of its importance, the impact of

protection system malfunction on overall system

reliability has not been well studied. The existing

protection system with its multiple zones of protection is

biased toward dependability and is designed to be

dependable even at the cost of global system security.

Hence, a vast majority of relay miss-operations are

unwanted trips and have been shown to propagate major

disturbances.For example, using directional comparisonprotection schemes lines originating on the same bus asthe faulted may lead to a false trip in a healthy line due toa momentary loss of carrier. Following a fault within theregion of vulnerability of the relay, relays with a hiddenfailure may also lead to a trip of a healthy line. Theseideas have been explored recently in a number of papersin the relaying literature and illustrated in Figure 4.

2


0-7695-0001-3/99 $10.00 (c) 1999 IEEE


5

8/3/2019 00013025

6/7

It is essential to take into account the performanceof the protection system, the remote possibility of hiddenfailures, and regions of vulnerability of variousprotective devices in creating the contingencies used toestimate the of various transfer capabilities and loadingmargins.

Figure 4 Progressive descent into catastrophic failure

Transfer capabilities in real time

An important new concept in the post-restructuredera is that of the Available Transfer Capability (ATC)

and its variants (NATC, RATC, etc.). It is described asfollows:

1

Available Transfer Capability (ATC) is a measureof the transfer capability remaining in the physicaltransmission network for further commercial activityover and above already committed uses. The ATC

between two areas provides an indication of the amountof additional electric power that can be transferred fromone area to another for a specific time frame for aspecific set of conditions.

The "specific set of conditions" includes securityunder a reasonable set of contingencies. It is clear thatmultiple contingencies are possible through interactionsof various protection systems and hidden failures. Atbest the ATC determination would begin with the currentstate of the power system. The static state that has beentraditionally determined with state-estimation softwarerequires complete coverage of the network to obtain thestate. In the present environment it is unlikely that allparts of the interconnected system will be metered, and

hence it would be impossible to determine the state ofthe contiguous system. Measurements based onsynchronized phasor measurements makes it possible tolocate these units at strategic points on the network asneeded, and augment the network state so thatmeaningful contingency analysis could be performed onthe entire network.

The system state would then be tested for variouscredible contingencies. The contingency selectionshould take into account the performance of criticalportions of the protection systems, particularly thepossibility of having hidden failures. One would thendetermine the margins available for power transferwithout violating any of the operational constraints(thermal, voltage, or stability). These concepts areillustrated in Figure 5.

Role of Remedial Action Schemes

In some systems remedial action schemes maybe at odds with the concepts in transfer capability. Inparticular, a remedial action triggered by an incorrect tripproduced by a hidden failure would confound the ATCconcept. Suppose a remedial action scheme is employedin a transmission corridor to increase the maximumpower transfer achievable. The scheme trips generationon one end and/or load on the other if the amount of

power transfer is too large for the remaining lines.If the contingency considered in the ATC

calculation includes the loss of a line that would invokethe remedial action scheme then it is unlikely the ATCcalculation is appropriate. The market consequences ofthe scheme must also be considered in its design. Is theowner of generation shed by a remedial action schemecompensated for a contribution to system security?

Pre-fault flow

Relay with hidden failure

Faulted Line

Lines tripped by hidden failure

Excessive

Power flow

Power Flow and SystemState not sustainable


0-7695-0001-3/99 $10.00 (c) 1999 IEEE


6

8/3/2019 00013025

7/7

Adaptive security/dependability

Combining the outputs of the multiple primaryrelays can alter the security/dependability of protection.In conventional schemes where any relay can trip thebreaker the outputs are logically in parallel. Requiring all

of the primary relays to indicate fault before the relaywas tripped (a series connection). produces the extremein security. A two out of three voting scheme can beproduced with three primary systems. The relayalgorithm design can be used to produce more subtletrade-offs between security and dependability. It ispossible to imagine a relaying system that had acontinuously adjustable security/dependability index.During a cascading outage it would be desirable that arapid change in security/dependability could be achievedto stop relay involvement in the disturbance propagation.

Figure 5: Role of Protection System analysis in on-lineATC determination.

Is it also possible that security/dependabilityshould be changed under certain market conditions? Ifbecause of market conditions, the false trip of a given

line would result in a substantial economic penalty, itmight beacceptable to increase the probability of failingto trip an actual fault on thatline. Even with an increasethe probability of failure to trip is still extremely small.

Responsibility and authority for protective systemsA potential conflict can develop in terms of the

protection system if the transmission system owner andthe system operator are different entities. Thetransmission system operator might be quite willing to

make the security/dependability compromises discussedin the previous section. The owner of the transmissionsystem, on the other hand, would naturally want toprotect the equipment and would set the protectionaccordingly. . Conflicts between losses due to damage toequipment caused by a failure to trip verses losses due to

false trips must be resolved. The issue is theresponsibility for the design, setting, and maintenance ofthe protection equipment.

Conclusions

Some possible implications of existingprotection systems and practices on the post-restructuredpower system have been examined. Advances in the fieldof protective relaying primarily due to the impact ofcomputers and communications may allow changes inprotection practices that are required by new operationregimes. The role of the protection system in on-line

transfer capability determination and the possibility ofadaptive security/dependability have been considered.

References

[1] Available Transfer Capability Definitions andDetermination, NERC, June 1996[2] J.S. Thorp, A.G. Phadke, S.H. Horowitz, and S.Tamronglak, Anatomy of Power System Disturbances:Importance Sampling, Electrical Power & EnergySystems Special Issue on the 12th PSCC, Vol. 20, No. 2,August 1997, pp. 147-52.[3] A.G. Phadke and J. S. Thorp, Expose HiddenFailures to Prevent Cascading Outages,IEEE Computer

Applications in PowerVol. 9, No. 3, July 1996, pp. 20-23.[4] S. Tamronglak and S.H. Horowitz, A.G. Phadke, J.S.Thorp, Anatomy of Power System Blackouts:Preventive Relaying Strategies, IEEE Trans. on PowerDelivery, Vol. 11, No. 2, April 1996, pp. 708-715.

StateEstimator

SynchronizedPhasor

Measurements

SystemRTUs

STATE

ContingencyList

ProtectionSystem

OperationalConstraints

Margin

Estimation

AvailableTransferCapability

Proceedings of the 32nd Hawaii International Conference on System Sciences - 1999Proceedings of the 32nd Hawaii International Conference on System Sciences - 1999

00013025

Documents

Transcript of 00013025