60

IEEE power & energy magazine

1540-7977/06/$20.002006 IEEE

september/october 2006

Authorized licensed use limited to: EMEKA OBIKWELU. Downloaded on February 19,2010 at 02:25:04 EST from IEEE Xplore. Restrictions apply.

IN RECENT YEARS, WE HAVE SEEN SEVERAL CATASTROPHIC FAILURES OF power systems throughout the world. The usual scenario of such events is that the power system is in a stressed state, followed by faults on critical facilities, followed by unanticipated tripping of other facilities, finally leading to system breakup and blackouts. It is well recognized that, in most of these events, protection systemsrelaysplay an important role in that they operate in an unexpected manner and are often a contributing factor to the cascading phenomena. In many postmortem analyses of such events, relays have been unfairly singled out as the main culprits, and often draconian measures have been suggested to correct the perceived faults in the protection system. This article addresses the broad question of relaying philosophies, modes of operation of relays under abnormal system conditions, the categories of their failure modes, and advances made possible by modern technology in computer relays, adaptive relaying, and the use of widearea measurements for improved protection and the ability to mitigate wide-area outages. It is hoped that this discussion will lead to a dialogue among system planners, relay engineers, and operating personnel to explore the realities of relay system performance under stressed system conditions and to adapt solutions made possible by new technological innovations.

An Overview of Relaying Practices

The number of relays on a modern high-voltage transmission system is very high. A very rough estimate of relays in service in the North American grid is on the order of 5 million. The primary task of relays is to trip associated circuit breakers (i.e., transmission lines, buses, generators, transformers, etc.) in response to faults or other conditions for which the protection system is designed. All protection systems usually consist of several relays with well-defined conditions under which they should trip. In most high-voltage networks, there are high-speed relays that operate in less than three cycles of the fundamental power system frequency. Their main application is in protecting equipment against damage due to faults. These relays are autonomous, utilizing locally measured signals, often supplemented by remote terminal data over pilot channels. These relays, referred to as primary protection systems, may be duplicated for reliability. In addition, backup relays are provided, which, in general, operate more slowly and disconnect a larger portion of the power system. Traditionally, the relaying philosophy has been biased towards dependability, meaning that if a fault should occur, the primary relay must operate to clear the fault. This bias is a result of decades of experience with operating ac power systems where the main threat to the system, aside from damage to equipment, is a loss of synchronism among generators due to slowly cleared faults. High-speed fault clearing is considered essential on modern power systems since operation of backup relaying would increase the probability of system instability and extensive outages when primary protection fails to clear a fault. The bias towards high dependability inevitably leads to a reduction in security of the protection system. In other words, by making the protection system highly dependable, the protection system is also made more prone to false trips when no trips are warranted. For most traditional power systems, this increased probability of an occasional false trip was considered an acceptable risk to ensure a dependable high-speed clearing of all faults coupled with the fact that the system itself must withstand the loss of a single system element. However, as the power systems undergo fundamental changes, such as those brought on by open access and deregulation, one must reexamine this traditional protection philosophy, especially when the power system is stressed.
DIGITAL VISION

What Are the Types of Relay Misoperations?

In how many ways can a relay misoperate? Of course, there is a possibility of the failure to trip for a fault. One could rule out this type of misoperation in light of the multiple tripping relays

september/october 2006

IEEE power & energy magazine

61

Authorized licensed use limited to: EMEKA OBIKWELU. Downloaded on February 19,2010 at 02:25:04 EST from IEEE Xplore. Restrictions apply.

Zone 3 Time Zone 2 Zone 1 Zone 1 Zone 2

patterns on the networks have changed due to open access and deregulation, the engineers who specify conditions under which the relays must operate have to revisit their network contingencies. Another reason for this type of operation could be a wrong setting made when the relay was installed or calibrated. The result is that the relay operated as it was designed or set to do, but the result was not what was intended.

figure 1. Step distance protection of a transmission system; zone coverage and time delay coordination.

Incorrect and Appropriate

Although, for completeness, we include incorrect and appropriate in this category, we do not believe this is a common occurrence. One could include those operations in which a relay operated incorrectly, but in so doing prevented another, more serious trip and avoided a major cascading failure.

employed in most modern power systems. This leaves the mode of failure that could be generically labeled an unanticipated trip. To further understand this phenomenon, consider the following ways in which the protection system may operate.

Incorrect and Inappropriate

In the case of incorrect and inappropriate, the relays have produced an incorrect operation, which has contributed to a cascading outage. This phenomenon has been investigated from the point of view of hidden failures in protection systems. Given the very large number of protective devices in service, it is inevitable that some of these will have failed in a manner that does not exhibit itself when the power system is in a normal state. However, when another triggering event (such as a fault) occurs, the hidden failure causes the offending relay to misoperate. Recent research results on these phenomena, and possible countermeasures against them, have been published in the technical literature.

Correct and Appropriate

Correct and appropriate is the operation we all desire. The protection system operates as designed and its operation is appropriate for the prevailing system condition.

Correct and Inappropriate

In the case of correct and inappropriate, the protection system has operated as designed and set, but its operation was not appropriate for the prevailing system condition. This type of misoperation is quite common and can occur for many reasons. For example, when the relays were set, the network conditions for which the settings should be designed were not properly identified. In other words, the prevailing network condition when the relay operated was not anticipated in the specification stage. Depending on the utility practices, this may be an oversight on the part of the planning department or engineering department. We are seeing more and more such oversights as the number of trained engineering staff in most electric utility companies is severely depleted. Since loading

Distance Relays

A distance relay is a protective relay in which the response to the local voltage and current is primarily a function of the impedance between the relay location and the point of fault. It is independent of a communication link and is the most commonly used backup protective system. This is the most ubiquitous relay found on any power system. In addition to transmission line protection, it is also used for out-of-step relaying and loss-of-field relaying and is X often a component of many remediX al action schemes. C C Zone 3 Zone 3 In transmission line protection, which is the principal application of distance relays, several zones are B B Zone 2 Zone 2 employed in a step-distance configuration, in which each zone is separatZone 1 Zone 1 ed by a difference in operating times. Figure 1 shows a typical step-disA R A R tance relay timing arrangement. Zone 1 provides instantaneous protection (a) (b) for 8090% of the line between its terminals. Zone 2 is applied to protect the remaining 1020% of the line but figure 2. Step distance relay characteristics: (a) typical electromechanical relay with time delay. Zone 2 also provides characteristic and (b) representative electronic or computer relay characteristics.
62
IEEE power & energy magazine

september/october 2006

Authorized licensed use limited to: EMEKA OBIKWELU. Downloaded on February 19,2010 at 02:25:04 EST from IEEE Xplore. Restrictions apply.

some level of backup to the adjacent transmission line. Zone 3 is applied as a remote backup to Zones 1 and 2 of all adjacent lines in the event that the protective systems of those lines fail to clear a fault. Figure 2 shows the operating characteristics of the separate zones of the step-distance relay protection on an R-X diagram. Circular characteristics shown in Figure 2(a) are common in electromechanical relays and certain computer relays. More common in modern electronic and computer relays are the quadrilateral characteristics shown in Figure 2(b).

X0

Z0

The Liability of Loadability

Loadability of a relay is the maximum load that may be carried on the protected line such that a load greater than the loadability limit will be indistinguishable from a fault to the relay and will lead to a trip of the line. The loadability of a relay is affected by the prevailing voltage at the line terminal and also by the load power factor. When the power system is stressed, the reactive power flows may become unusual. When the power system is undergoing electromechanical swings, the voltages near the electrical center of the system may get depressed significantly. When system contingencies are specified to confirm the appropriateness of relay characteristic settings, it is imperative that these effects on loadability be taken into account. Loadability problems of overreaching zones of protection have been recognized since the early days of protection. Where a third zone as a remote backup zone is deemed to be necessary, certain technical innovations are available to alter its loadability limit. These innovations are more readily implemented in modern computer relays. However, even the electromechanical relays do have limited ability to improve their loadability. If the voltage and current phasors at the line terminal are such that the loadability limit is reached, the apparent impedance seen by a distance relay must be on the relay characteristic. For simplicity of analysis, consider a rectangular characteristic of a line relay (such as a Zone 3 setting since it has the lowest loadability limit), where the line has negligible resistance. If the line is exporting both active and reactive power at a power factor angle , the apparent impedance at this loadability lies in the first quadrant of the R-X diagram as shown in Figure 3. For the rectangular characteristic considered here, let the intercept on the R-axis be R0 . The loadability limit S0 is given by (per unit) S0 = (P0 + jQ0 ) = (E2 /R0 )(cos2 + jsin cos ). It is clear that the loadability limit is a function of both the voltage and the power factor angle. If the loadability limit at unity power factor and with the line voltage of 1.0 per unit is Smax , the loadability limit at a voltage of E per unit and power factor angle is given by S0 = Smax E2 cos .
september/october 2006

R0

figure 3. Loadability limit for a simple rectangular impedance characteristic. The line is exporting active and reactive power.

1.0

E =1.0 pu E =0.8 pu S0/Smax

0.5

E =0.6 pu E =0.4 pu
0

30 60 Power Factor Angle ()

90

figure 4. Loadability limit of a rectangular zone shape. Note the dependence on power factor angle and the line terminal voltage.

The dependence of loadability on line voltage and power factor is shown on Figure 4. The break in the curves is due to the corner of the rectangle, which is assumed to occur at a power factor angle of 60 . It should be clear that the loadability dependence on voltage and power factor angle is strongly influenced by the shape of the relay characteristic and must be evaluated for the characteristic actually in use. Note also that the ordinate of Figure 4 shows the megavoltampere loadability; the megawatt loadability is obtained by multiplying the MVA loadability by the appropriate power factor.
IEEE power & energy magazine

63

Authorized licensed use limited to: EMEKA OBIKWELU. Downloaded on February 19,2010 at 02:25:04 EST from IEEE Xplore. Restrictions apply.

When Is a Third Zone Needed?

Zone 3 of a distance relay is used to provide remote backup protection if the primary protection system should fail. Although in common usage a protection system may mean only the relays, the actual protection system consists of many other subsystems that contribute to the detection and removal of faults. Each of these subsystems may fail, making the primary protection inoperative. Figure 5 shows the basic elements of the protection system. In the following discussion, we examine all of the protective elements in a substation with regard to the application of Zone 3 to provide backup.

two sets of relays including pilot protection. One may therefore conclude that remote backup protection may be unnecessary, but care must be taken to be sure that no common-mode failures exist within the circuitry of multiple relay sets.

Transducers
At the lower voltage levels, the transducers, current transformers (CTs) and potential transformers (PTs) are not normally duplicated, and a failure of the potential or current transformers could go unnoticed and result in a failure to trip. In this instance, a Zone 3 remote backup would be desirable. At the higher voltage levels, the current transformer secondary windings are duplicated, each serving a separate set of relays. The potential transformers or devices are also duplicated or fused separately to maintain voltage integrity to each set of relays.

Batteries
If only one battery is available at the substation, a system control, alarm, and data acquisition system (SCADA) alerts the engineering or operating department to take corrective action if the battery becomes defective. At the higher transmission voltage levels, it is not uncommon to provide two batteries, in which case providing backup protection for battery failure may not be necessary. However, if only one battery is available, even with a SCADA warning it may be advisable to add Zone 3 at the remote stations(s) if the failed battery is at a location that is not easily reached and if maintenance personnel may not have the time to correct the problem quickly.

Circuit Breakers
Circuit breakers are not duplicated, and failure of a circuit breaker to clear a fault must be considered. Circuit breaker failure tripping schemes are sensitive to system and station configuration. In some cases, it is sufficient to open all local breakers that can contribute to the fault upon detecting a breaker failure. This may not be sufficient to clear a fault, and a transfer trip scheme is required. This involves expenditures for communication equipment, which may not be justified, and a remote Zone 3 would be preferable. It is not our purpose here to catalog all possible bus arrangements, but some examples are instructive. As extra-high voltage (EHV) transmission systems matured, local backup replaced remote backup, and breaker failure schemes started to evolve as a subset of local backup protection. At first, a separate set of relays was used to initiate the required tripping, but this quickly was replaced by a special isolated circuit that employed all of the protective relays that simultaneously initiated tripping the appropriate circuit breaker(s) and started a timer. When the timer timed out, a tripping relay opened all of the breakers that could see the fault for which the protective relays had operated. The timer was set just beyond the normal clearing time of the circuit breaker, usually on the order of 710 cycles. Substations are designed for reliability of service and flexibility of operation and to allow for equipment maintenance with a minimum interruption of service consistent with an economic evaluation of the costs involved versus the benefits derived. Bus arrangements range from a single-bus, singlebreaker scheme common to low-voltage distribution stations to the breaker-and-a half configuration that is almost universal for EHV stations. In situations where breaker failure schemes trip all of the breakers that can sense a fault, including transfer trip, a Zone 3 application may not have any advantage. However, in the absence of a communication channel for technical or economic reasons, a Zone 3 setting may be of some advantage. Nonetheless, the Zone 3 setting must encompass all possible infeeds. In the case of tapped loads, it is not always
september/october 2006

Relays
To cover any single relay failure, it is common practice to use multiple relays covering the phase and ground faults. At the higher voltages or at more critical stations, there would be

Circuit Breaker

Relay Transducers

Battery

figure 5. Elements of a protection system.

64
IEEE power & energy magazine

Authorized licensed use limited to: EMEKA OBIKWELU. Downloaded on February 19,2010 at 02:25:04 EST from IEEE Xplore. Restrictions apply.

The number of relays on a modern high-voltage transmission system is very high. A very rough estimate of relays in service in the North American grid is of the order of five million.

possible to set Zone 2 to see the apparent impedance to the far end fault and not overreach other Zone 2 relays. In such cases, a possible solution is to set a remote Zone 3 to see the apparent impedance to the remote location. As each component failure is identified, a backup scheme capable of covering that failure must be designed. In general, in the absence of a communication channel, duplicate transducers or batteries, and for certain bus configurations, remote Zone 3 provides the most effective backup protection. Of course, catastrophic physical failures such as earthquakes or storms that destroy the building, panels, or multiple primary equipment will also require a remote backup system such as Zone 3. We may also classify as a catastrophic failure certain human errors such as incorrect settings or equipment outages during maintenance.

Electronic Relays
Solid-state relays can shape their characteristics or introduce load encroachment elements that are also attractive solutions. Quadrilateral characteristics, which shape the protection zones to any desired shape, are a definite improvement.

Computer Relays
Computer relays have the potential for solving many of the problems that could not be addressed by conventional relays. Many computer relays now offer multiple groups of settings, so that Zone 3 settings could be adapted to changing system configurations and the accompanying in-feed variations. It is also possible to include a load-encroachment characteristic which outlines an area within the relay characteristic that prevents operation for a defined load impedance. Computer relays could also be made to block trip if a balanced condition exists and the power factor of the line current is characteristic of system loading conditions. This approach is indeed reasonable and should provide security in the case of a heavy load. However, one should take note of the fact that often under unusual system conditions where significant amounts of vars are being transmitted, the power factor may not always be a sure indicator that a load, rather than a fault, exists on the line. Under normal system conditions, vars and watts are tightly coupled through the generator operating parameters. Under system stress or fault conditions, vars and watts may be decoupled and the 30 power factor criteria may not apply (see Figure 3 for the effect of power factor and voltage on loadability). If one postulates communication between relays at a station or with relays at remote stations, it may be possible to design more effective logic for differentiating between a load and a fault. Trending observed changes in line currents, correlating changes seen by different relays, and using information received from control centers indicative of the state of the power system could all be integrated in computer relays with a very effective check on the operation of backup protection systems.

Countermeasures for Improving Zone 3 Loadability

One thing to note is that load excursions are balanced phenomena, so that the presence of unbalanced currents (negative sequence) would indicate a fault. Thus, loadability should not be an issue when negative sequence currents are present. The third zone characteristic for three-phase faults is the only one where load conditions could be confused with remote faults. It is also unlikely that three-phase faults would have a significant fault resistance, so the third zone shape for such faults could be considerably modified to reduce the resistive reach of the relay, thus increasing the loadability of the relay. These and other improvements are generally available only in computer relays.

Electromechanical Relays
The traditional electromechanical relays have fixed zone boundaries, and usually they are made up of circular shapes or straight lines. Directional relays can be applied as blinders restricting the admittance (mho) circular characteristics of Zone 3 to high X/R values as opposed to normal load power factor angles. As indicated above, the presence of negative sequence current is a good indicator that a fault, not a balanced load condition, exists. Some innovations in electromechanical relays have addressed the loadability problem by proposing the use of a figure-eight shape (a forward offset characteristic) to increase the loadability limits of relays. This offset mho characteristic is easily attainable with electromechanical relays and may offer one of the best and most inexpensive solutions to the loadablity problem.
september/october 2006

Adaptive Relaying
The intelligent supervision of Zone 3 is an excellent example of adaptive relaying, with its ability to adjust its performance to match the prevailing power system conditions. The problem of the sensitivity of the Zone 3 characteristic to emergency load or power system instability can be solved with the use of adaptive relaying principles. Several solutions using electromechanical or electronic relays have
IEEE power & energy magazine

65

Authorized licensed use limited to: EMEKA OBIKWELU. Downloaded on February 19,2010 at 02:25:04 EST from IEEE Xplore. Restrictions apply.

Backup relays are provided which, in general, operate more slowly and disconnect a larger portion of the power system.

already been suggested. Each of these solutions is more readily applied with computer relays. Using computer logic instead of complex wiring immediately improves the reliability of the relay. Prefault load could be taken into account, and prevailing stability margins could be introduced into the relaying algorithms. The overwhelming thrust of the North American Electric Reliability Council (NERC) rules and other instructions regarding the application of Zone 3 elements has been to prevent their operation during emergency conditions. Although this is a desirable goal, it should be recognized that even with all the intelligence available to modern computer relays, the problem of distinguishing a fault from a heavy load in a relatively short time and using only the current and voltage signals available to the relay cannot be solved in every single imaginable (and some unimaginable) power system scenario. If Zone 3 is the protection system of last resort, and if it is incorrectly prevented from operating when it should do so, the consequences to the power system may be much worse than those resulting from an unwanted Zone 3 trip.

not always the case. Known cases abound where the very act of maintenance has induced a hidden failure mode that remains unexposed until cascading failures begin to unfold. Given the large number of protective devices present on a power system, it is not possible to rule out the possibility of hidden failures in some relays. An approach for providing countermeasures against false trips due to hidden failures is to identify locations in the network where hidden failures would be particularly damaging to the power system and then provide a computer-based relay as a supervisor of the relay operation. In addition, a voting scheme among all the protection systems can be implemented at such critical sites.

Integrating Protection and Control

Our concern up to this point has been the loadability of backup protection schemes. In any realistic scenario, the total protection, operation, and control package must be considered as an integrated system. It is being recognized that the advent of new technologies has provided two of the most valuable elements of this total package: system integrity protective schemes (SIPSs) and wide-area-based protection systems (WAPSs).

Hidden Failures
A vexing problem for protection engineers is that of hidden failures in the protection system. These are failures that go undetected when the power system is in a normal state and that contribute unnecessary trips when the system is disturbed by faults or severe dynamic conditions. Although increased maintenance, calibration, and frequent reviews of protective settings would reduce the likelihood of hidden failures, this is

SIPS
SIPS is an increasingly valuable tool to initiate system corrective actions as opposed to equipment protection. Among the many system stress scenarios that a SIPS may act upon are transmission congestion, transient instability, voltage and frequency degradation, and thermal overloading. Many corrective actions are available to respond to these potential system

Initiating Event

Initiating Event

New Control Elements (a) (b)

figure 6. (a) Brittle power system breaks up into synchronous islands when a strong disturbance occurs. (b) By using high-power electronic devices at optimum locations, the damage due to the initiating event can be confined to a small region, rendering the power system ductile.
66
IEEE power & energy magazine

september/october 2006

Authorized licensed use limited to: EMEKA OBIKWELU. Downloaded on February 19,2010 at 02:25:04 EST from IEEE Xplore. Restrictions apply.

Traditionally, the relaying philosophy has been biased towards dependability, meaning that if a fault should occur, the primary relaying must operate to clear the fault.

stresses. An SIPS program can initiate any one or combination of the following: load or generator rejection or fast valving, load shedding due to underfreqency or undervoltage, out-ofstep blocking and tripping, system separation, etc. These measures are normally inactive and are armed automatically when some system stress condition occurs; alternatively, they may be armed manually from a control center. The remedial action schemes (RAS) and system protection schemes (SPS) that have become popular in recent years are SIPS systems. To create more intelligent SIPSs, one must rely on the newly available wide-area measurement systems being deployed in many power systems.

collapse. This is illustrated conceptually in Figure 6. It is possible that the developing stress levels in modern power systems will compel engineers to bring some measure of ductility to the power systems by judicious use of high-power electronic devices.

Changing Nature of Power Systems

It is clear that the power systems of today are not what they were before open access and deregulation were introduced in many countries. We are witnessing unusual generation and power flow patterns, unplanned congestion, and the introduction of renewable generation with its associated uncertainties regarding protection and control. The emphasis on stockholder good versus public good has transformed the industry culture from reliability to economy. This change has resulted in a lack of incentives for infrastructure improvements, restrictions on information exchange, and, most disturbingly, the lack of signals for technical manpower needs, both present and future. To meet these challenges, the industry must embrace the latest technologies, recruit the best and brightest of our graduates, and increase the exchange of technical concepts and innovation though industry conferences and literature.

Wide-Area Protection Systems (WAPSs)

To implement effective, intelligent SIPS appropriate for the prevailing power system condition, it is essential that a realtime, fast-acting, system-wide data collection system be available. Wide-area measurement systems (WAMSs) are rapidly becoming an important element in system operation and control. The use of real-time measurements to determine the state of the power system goes back to the late 1960s. State estimation, contingency evaluations, and optimization of the operating state have been practiced by most modern power systems. However, the constraining contingencies for power systems are usually rooted in the dynamic phenomena. Thus, there has been a disconnect between what is actually needed in real time and what could be achieved by the prevailing technology. All this is changing with the introduction of the global positioning system (GPS), which can be used to provide synchronized phasor measurements for the entire power system, thus providing high-quality system data at a very rapid rate (once every few cycles of the power system frequency). High-speed broadband communication has also become available so that these measurements could be transferred over great distances with latencies on the order of 50 ms, and progress is being made in developing analytical techniques that can effectively use these measurements in real time.

For Further Reading

S.H. Horowitz and A.G. Phadke, Power System Relaying, 2nd ed. Somerset, England: Research Studies Press, 1995. S.H. Horowitz and A.G. Phadke, Third zone revisited, IEEE Trans. Power Syst. Delivery, pp. 2329, Jan. 2006. S.H. Horowitz, A.G. Phadke, and J.S. Thorp, Adaptive transmission system relaying, in Proc. IEEE Summer Meeting, 1987 Trans. PWRD, Oct. 1988, pp. 14361445. S.H. Horowitz and A.G. Phadke, Boosting immunity to blackouts, IEEE Power Energy Mag., vol. 1, pp. 4753, Sep./Oct. 2003.

Biographies
S.H. Horowitz received a bachelors degree in electrical engineering from the City College of New York. He is a consultant, author, and lecturer. He is a Life Fellow of the IEEE and a member of the National Academy of Engineering. A.G. Phadke received a B.Sc. degree from Agra University, a B.Tech. degree from the Indian Institute of Technology, an M.S. degree from the Illinois Institute of Technology, and a Ph.D. from the University of Wisconsin. He is a University Distinguished Professor (emeritus) at Virginia Tech in Blacksburg, Virginia. He is a Life Fellow of the IEEE and a p&e member of the National Academy of Engineering.
IEEE power & energy magazine

Brittle and Ductile Systems

Modern power systems deliver power to the local load centers efficiently and economically. However, they are brittle in the sense that they tend to break up through the loss of synchronism when faced with a catastrophic disturbance. The break up can be compared to the shattering of a brittle structure upon being struck with a heavy blow. A ductile structure, on the other hand, would deform around the disturbance and prevent the disturbance from cascading into a total system
september/october 2006

67

Authorized licensed use limited to: EMEKA OBIKWELU. Downloaded on February 19,2010 at 02:25:04 EST from IEEE Xplore. Restrictions apply.