Copyright © SEL 2015

How Disruptions in DC Power and Communications Circuits

Can Affect Protection

Karl Zimmerman and David Costello, Schweitzer Engineering Laboratories, Inc.

Outline

• Review effect of dc and communications disruptions on overall reliability

• Compare fault tree analysis with system analysis

• Discuss traditional dc and communications issues and solutions

• Show recent cases of protection system performance affected by dc and communications disruptions

The Role of DC and CommunicationsPart of Overall Protection System

52 52

21 21Comm Equipment

Bus S Bus R

125 Vdc 48 Vdc 48 Vdc 125 Vdc

Channel

Comm Equipment

DC and Communications Failuresvs. Relays and Human Factors

SubsystemFailure Rate* Unavailability* % of NERC

Misoperations

DC power – 30 5

Communications – 100 to 200 15

Relays 333 137 21

Human factors 1,000 1,000 37

* Times 10–6

Main 1 Protection at S Fails

1969 2219

Main 2 Protection at S Fails

Protection Fails to ClearIn-Section Fault in Prescribed Time

1178

Same as Protection at S

Note: Numbers shown are unavailabilities • 106

Protection at S Fails

589

Protection at R Fails

589

Breaker at S Fails to Interrupt

Current80

Common-Mode Hardware/ Firmware Failures

5

Common-Mode Settings/Design

Errors500

DCSystem

Fails30

DCWiringErrors

50

CT Fails3 • 9 = 27

CTWiringErrors

50

Relay App. or Settings

Errors1000

RelayFails137

VTWiringErrors

50

HiddenFailures

10

VT Fails3 • 15= 45

Comm. DC System

Fails50

MicrowaveTone Equip

Fails100

MicrowaveTransceiver

Fails200

MicrowaveChannel

Fails100

BreakerTrip Coil

Fails120

1

2

3

4

Fault Trees Show Effect on Entire SystemInteraction Between Subsystems Less Evident

Aviation and Power Systems Are Complex

Airlines

Controllers

Manufacturers

InvestigatorsRegulators

Pilots

MechanicsThe

System

Relays

CTs

VTs

CommunicationsDC

Utilities

BreakersThe

System

Coupled and Interdependent Subsystems Must Work Together

DC Control Circuit Example87-Z (OUT1) Closed When Technician Bumped Panel

TS

87-ZOUT 1

86B

TS

X-Ray Images of Contacts

Healthy Form C Damaged Form C

Pictures of Contact Confirm DamageInterrupting Current in Excess of Rating

What Is Root Cause?

• Human error (bumping panel)? No

• Product defect (failure to meet shock, bump, vibration standards)? No

• Relay hardware failure? Yes (NERC)

• Incorrect test procedure? Yes (NERC)

• Failure to ensure proper test procedure (management)? Yes (NERC)

• Theme for case studies – action or failure in one subsystem affects others and overall system reliability

Traditional DC Problem63 Dielectric Problem Required

Extra Security Measure

9463 94

6394

(+)

(–)

86

Traditional Communications Problem 1Fault-Induced Transient on

PLC Produces Block

Momentary Carrier Block

Traditional Communications Problem 2Carrier Hole on PLC Presents Security Failure

Carrier Holes

Traditional ProceduresReinstalling Relay After Maintenance

1. Place VTs in service (close test switches)

2. Place CTs in service

3. Verify metering is okay

4. Place inputs in service

5. Verify input status is okay

6. Reset trip targets, ensure outputs reset

7. Place trip and output contacts in service

Case 1: DC InterruptionCauses Misoperation

Breaker Flashover Scheme OperatesAfter Relay Powered Off / On

161 kV

12.47 kVLockout Relay

Communications Link

21, 67, etc.

50BF With Breaker Flashover

Logic

Remote I/O Module

Breaker Status Communicated, Not WiredRemote I/O Module and Fiber

Replaces Copper Wiring

Relay

Remote I/O Module

Communications Link

52 Trip 1

52 Trip 2

52 Close

52 Low Gas Alarm

52 Low Gas Trip

I/O Module Alarm

52 Spring Charge Alarm

52 Trip Coil Monitor 1

52 Trip Coil Monitor 252a

52b

Breaker Flashover LogicCurrent During Open Breaker Condition

Breaker Failure Flashover

Tripor

Close

50FO52a S

R

Q

Breaker Failure

Flashover Timer

0

6

Dropout Delay

9

0

Event Data Captures Misoperation

Timeline of EventRelay Restarts, Logic Processed Before

Communications OK

SRQ

FOBF1BFTRIP1

52AC1ROKB

Relay Restart 9 Cycles 22 Cycles

1/4 Cycle

Communications Link Reestablished

Pre-Event Report Event Report

Case 1 Lessons Learned

• Consider loss of communications AND consider power off / on

• For breaker flashover logic, supervise with healthy communications (e.g., FOBF1 AND ROKB)

• Test schemes

Case 2: DC Interruption Causes Misoperation

• Transformer fault produces lockout

• Transformer is isolated

• Dispatchers close Breaker T to restore load

Alternate Source

Line Switch(89)

87 86

T

89b

Operators Arrive at Station

? Should I…A) Reset the lockout via a pushbutton?

B) Turn the dc off?

Internal Latch LogicInternal Lockout and Self-Testing

Replaces Traditional Lockout

External Trip

87T Trip

63 Trip

Manual Reset

89b (Line Switch

Open)

86(Lockout)

LT1

LT2

LT3

0.5

0.5

S

RQ

S

RQ

S

RQ

Debounce Timer

Timeline of EventInternal Lockout Logic Operates After

Relay Power Off / On

Initial Fault and Trip

Dispatchers Close Breaker T

DC Off DC On

87T Trip

LT2 (Latch)

89b Asserted (When Line Switch Open)

86LODC Supply

Relay Enabled

86 Lockout Reset Pushbutton

Modified Lockout LogicRelay-Enabled Health Supervision

and Dropout Delay Added

External Trip

87T Trip

63 Trip

86 Lockout Reset Pushbutton

89b (Line Switch Open)

86 (Lockout)

LT1

LT2

LT3

0

0

SR

Q

SR

Q

SR

Q

Debounce Timer

Relay Enabled

0

12

Dropout Delay

Case 2 Lessons Learned

• Update and adhere to new lockout procedures (as technology changes, stay current and educate)

• Develop robust logic to consider possibility of loss of dc

• Test schemes

Case 3: DTT Due to Channel NoiseProtection One-Line Diagram

Relay-to-Relay Digital Communications Link

POTT and DTT

M1M2

A

T

21/67Network Multiplexer21/67 Multiplexer

Channel Noise Results in DTT10 Channel Dropouts Per Minute,

0.5% Unavailability

DTT

BFI

CommunicationsDrop Out

Case 3 Lesson Learned

Adding extra processing interval (1/4 cycle in this case)

improves reliability by 10,000 times

Channel Noise Results in 87L TripDegradation of Fiber-Optic Transmitter

Results in Constant Noise

Case 4 Lesson Learned

Enable disturbance detection to supervise 87L

Relay Trips During Power Cycle While Testing

5 V DC Used by A2D, 3.3 V DC Used by µP and DSP

Nominal

5.0 V

3.3 V

Supply Voltage

TimeDtT1

Case 5 Lesson Learned

Design to gracefully shut down processing on power off / on

Conclusion

• Design and test for disruption of dc (e.g., relay power cycled off / on)

♦ What is default state of I/O and logic?

♦ How does dc power cycle affect communications and logic?

• Design and test for disruption of communications

♦ Is logic forced to “safe” state?

♦ Are communications monitored and supervised?

Conclusion

• When replacing traditional lockouts with internal logic, ensure operator interfaces are familiar and well-understood

• Even with excellent data integrity checks, watchdog counters, and more secure channels, data errors can occur

• In DTT applications, adding one additional processing interval security count improves security by 104

Conclusion

• Monitor channel performance and act on alarms

• In 87L applications, use disturbance detection to greatly improve security

• Teach and apply best practices for removal of equipment and its restoration to service

Conclusion

• System interdependence requires system engineering and testing

• Like the aviation industry, continue to test and understand how changes in one subsystem affect others and the overall system