Aspects of Power System Protection in the Post ... - Semantic Scholar

Proceedings of the 32nd Hawaii International Conference on System Sciences - 1999 Proceedings of the 32nd Hawaii International Conference on System Sciences - 1999

Aspects of Power System Protection in the Post-Restructuring Era A. G. Phadke, VPI&SU Blacksburg, VA

S. H. Horowitz, Consultant Columbus Ohio

Abstract Protection practices in electric utility industry as it existed prior to re-structuring were designed to meet certain goals of sound engineering principles as they were applied, primarily to component protection in vertically integrated electric utility systems. There has been a significant shift in emphasis from uncomplicated component protection to system protection to avoid or mitigate wide-area disturbances. It is not clear how the responsibilities for designing and maintaining the protection systems will be divided between the transmission system owner and the ISO. Protection and control of generators will also impact the performance of the power system. The settings used in many protection systems that are designed to protect power apparatus will affect the ability of the transmission system to transfer power between two points on the network. The owners of the transmission system as well as the ISO should have an interest in knowing the limitations imposed by both the apparatus and the system protection, and the ability to change those settings if they do not meet their respective objectives. It is possible that the objectives of the two entities will be in conflict. This paper will examine the existing protection philosophies, and their impact on these issues.

Introduction System protection concepts exist in the vertically integrated systems now to assure continuity of service even at the expense of immediate economic disadvantage. How is it to be altered and expanded when an ISO encompasses many existing utilities and are driven by economic concerns? There have been significant advances in the field of protective relaying due to the impact of computers and communications and the introduction of adaptive relaying concepts. Can these new systems play a role in a new era of protection design? The protection system has not received much attention in the literature on re-structuring in the power industry. Subjects such transfer capabilities, generation margins, and other issues related to sale and transfer of power in the new era of power systems without borders

J. S. Thorp Cornell University Ithaca NY

have received the greatest attention. We believe that it is necessary to examine protection systems, because of the role it plays in system security. This paper is an examination of some issues in restructuring from a protection engineer's point of view. We recognize that the proposed changes and improvements to the protection practices that we put forward here may be desirable not just from the point of view of the post-restructuring era, but also for protection practices in general.

Present Power System Control Traditional system operation is organized in a hierarchical configuration with two or three layers depending on the specific organizational and geographic arrangement of a given utility. (See Figure 1.) Basically, there are several local and/or regional control centers that are responsible for the distribution and the subtransmission systems. Line and equipment maintenance outages and switching orders are directed by this center; customer complaints are received and responded to. The system control center is a single entity responsible for the HV and EHV systems. This center is responsible for the control of all generation in terms of economic dispatch, load frequency control, generating unit commitment and maintenance scheduling. It has overall responsibility to achieve optimum economic operation on the bulk power supply system, subject to system security constraints. System Control Center Regional Control

Local Control

Local Control

Regional Control

Local Control

Local Control

Figure 1. Hierarchical Control Centers In the pre-restructuring era, i.e., with the vertically integrated, non-competitive utility there is a close interaction between the planning and operation

0-7695-0001-3/99 $10.00 (c) 1999 IEEE

1


disciplines. The effect of a maintenance outage on the HV and EHV systems would have undoubtedly been studied beforehand and addressed by planning, operating and relaying engineers before scheduling and performing any given outage to be certain that the system is not endangered by removing transmission elements. Similarly, the general subject of power sales and purchases and the resulting flows would have been determined off-line to establish guidelines for the dispatcher to follow in his/her daily activities. Summer and winter thermal limits are established, unusual magnitudes of loads are identified, generation schedules are determined to maintain the most economic performance and to assure load-frequency balance, and voltage levels are calculated. The system control center has the primary coordinating responsibility for the system configuration and the balance between all of the maintenance requests and the sales and purchases with the power system’s overall security. In the vertically integrated utility, the relationship between security and optimum performance can be relatively easily reconciled. Generation dispatch is not as easily balanced. Each power plant’s operating personnel has its own agenda with a significant measure of control. There are legitimate reasons to limit a unit’s output based upon the condition of the unit and /or its auxiliary equipment. As a result, the real or reactive output of a generator may be requested by the system dispatcher but not delivered. Again, since we are dealing with a unified organization the conflicts are amenable to a rapid resolution.

Present protective systems Some of the key features of current protection systems are: • Security and dependability Modern protection systems are biased toward dependability at the expense of security. Such a bias has been historically correct for the robust power system of the past, i.e. an accidental loss of some equipment through incorrect relay operation could easily be tolerated without stressing the remaining power system. It has been recognized that such a bias is inappropriate when the power system is in a stressed state. The involvement of the protection system in major system disturbances can be attributed to this built-in bias toward false trips. When the system is stressed or in early stages of a sequence of events that will lead to a major disturbance, it would be desirable to avoid incorrect tripping of unfaulted equipment. It should be recognized that if new systems can accomplish this it will have to be at the risk of not clearing an actual fault. The trade-offs involved in such decisions must be examined in more detail but the high costs of major disturbances in a restructured environment must be considered. • Compatibility of protection philosophies among interconnected systems will become more

important. Strong interconnections between larger networks make it necessary to be sure of the nature of the response of the protection system to a fault or disturbance on any part of the system. • Local inputs must be involved for some at least some relays. Hard wired connections to inputs that are independent of any outside device within the substation or at some remote location are required to insure that equipment is protected in the event of communication failures • Primary protection Primary protection is usually based on closed zones such as differential protection of transformers and buses and phase comparison and longitudinal differential relaying of transmission lines. Such schemes are preferred to open zone protection schemes since infeed, loading conditions, power swings, and other exogenous events can affect the later. • Back-up protection schemes are required to operate when the primary protection equipment fails to clear a fault. Both local back-up protection (breaker failure protection) and remote back-up protection are common. The operation of any back-up protection involves a larger part of the system than the corresponding primary protection. These schemes are also frequently open zone schemes, and are subject to the problems mentioned above. • Coordination of primary and back-up protection schemes is used to avoid incorrect operation of back-up systems. Back-up protection should not be used when the fault can be cleared by the primary protection. Coordination involves both relay operating time as well as in the relay reach. • Special protection schemes (Remedial Action Schemes) have become control schemes that are intimately tied to protective relays. They are preprogrammed to operate after a relaying event and in response to prevailing conditions on the network.

Substation Equipment • Transformers- the traditional and most effective protective system for power transformers is differential protection. With such protection there is no coordination problem since the differential zone is a closed zone and only detects faults within the area defined by the current transformers. Except for hidden failures then, power transformer protection should not miss-operate during any other system faults. As backup protection, it is not uncommon to add instantaneous and/or time delay overcurrent relays. Instantaneous relays are not of any concern in the present discussion since they are set above maximum inrush and would not be in a position to miss-operate during any system faults. Time delay overcurrent relays are set for

0-7695-0001-3/99 $10.00 (c) 1999 IEEE

2


unusual loads and may miss-operate as system elements are removed during any widespread outages. •Buses - Differential protection is virtually the only protection used and should not miss-operate during any unusual system events. However, bus differential relays are uniquely sensitive to current transformer saturation depending upon the specific relay design and may be subjected to severe fault contributions during unusual system configurations and may be a cause for concern. •Shunt Reactors and Capacitors - These elements are used to provide system voltage support or correction and are protected by a wide variety of protective devices; differential, impedance and negative sequence relays for reactors, fuses and overcurrent relays for capacitors. They are susceptible to misoperation as system parameters change drastically under unusual system events. Their misoperation would exacerbate any system problem by changing the voltage at the associated system node. •Transmission System - Extra-High Voltage and High Voltage are almost exclusively protected by pilot schemes with stepped distance backup. The pilot schemes are relatively immune to misoperation due to the differential nature of its measurement. However, as discussed above, hidden failures may be involved and the parameters that accompany unusual system events may trigger these failures and cause misoperations. In addition, system swings appear to the impedance relays as slowly moving faults and, unless properly monitored, could cause them to operate. This has to be evaluated for each situation. For stable swings lines should not trip and a out-of-step blocking and tripping scheme may be required For unstable swings it is sometimes desirable to trip a line that sees the swing but sometimes it is desirable to transfer trip another line. •Generator - Generator protection is provided by a wide variety of devices to cover an extensive array of abnormal operating problems. The primary protection for stator phase faults is the differential relay and its operating features are the same as described above for transformers and buses. These relays should not trip incorrectly for system events. It is common practice to provide loss-of-field relays using some combination of impedance relays and these can operate incorrectly during stable or unstable system swings. This operation will, of course, worsen any cascading or potential cascading outage. In addition to the loss of field, modern generators have field limiting circuits and these can result in adverse conditions during cascading outages as the voltage across the system calls for more reactive support. Volts per Hertz relays monitor the ration between system voltage and system frequency. They may be set to trip depending upon the philosophy of the utility although it is more common to allow the relay to trip only when the circuit breaker is open. The

assumption is that neither system voltage nor frequency can vary significantly with the unit connected. This may not be true during abnormal system events and some logic may be required to reconnect the relay to trip. Reverse power or directional relays and system backup relays are sometimes used to trip the unit if an abnormal system condition lasts beyond a reasonable length of time. Since widespread outages do result in severe abnormal conditions these protective may operate.

The Role of Protection in Wide-area Outages The question of eliminating or mitigating cascading outages eventually focuses on the performance of the protection system during abnormal system events. Ideally, within the umbrella of the operating utility, relay applications and settings are determined by close cooperation between the relay, planning and operating engineers. That this isn’t done as thoroughly as it should be is evident by the fact that we do experience blackouts. In the best of all possible worlds, each such event, however, is studied and appropriate remedies are initiated. The most familiar causes of such cascading outages are usually the result of a series of abnormal operations very often involving load encroaching in the third zone of a distance relay, a power swing entering a tripping characteristic, a communication failure or some current or voltage transducer misoperating under a saturating or transient condition. These are not all identifiable or anticipated, are not amenable to easy solutions but they are not fatally intractable under the existing organization with cooperating disciplines. The emergence of the computer relay is providing another dimension to the protection systems’ dependability and security. The ability to self-check, perhaps self correct or operate in an adaptive mode thus becoming responsive to system changes, plus other sophisticated measures are all being actively investigated. There are several concepts that are specific to this restructuring activity that have special application to system protection. Available transfer capability (ATC) is the total transfer less reserves for reliability and existing transmission commitments. This reduction in the ATC is the margin which protective relaying must recognize if the contracted power flows are not to cause relay misoperation. Curtailability is the right of the transmission provider to interrupt all or part of a transmission service due to conditions that reduce the capability of the transmission path to provide transmission service. If the protection system can anticipate misoperation than it can invoke this feature. A secondary transmission provider (STP) is any customer who has acquired rights to use transmission rights to use transmission facilities and chooses to resell

0-7695-0001-3/99 $10.00 (c) 1999 IEEE

3


transmission services derived from those rights. The STP must use the Transmission Services Information Network (TSIN) node and must comply with requirements for secondary market information. The STP introduces a very possible cause of incorrect relay performance. To appreciate this, let us study the operation of control areas in the pre- and postrestructured era. (reference 1) In the Figure 1 the existing simple interchange scheduling is shown. There are 5 interconnected control areas. A typical schedule would be with adjacent areas, i.e, “A” is scheduling to control “B” and “B” with “E”. What is not visible to anyone but “ B” is whether “B” is wheeling from “A” to “E” or purchasing from “A” and reselling to “E”. Of course. “B” has all of the information needed to include the associated costs in its contracts with “A” and “E”. From the protection point of view, “B” is aware of the loadings, real and reactive power flows and, as discussed above, should be able to coordinate any generating and relaying problems within its own organization. Control Areas “C” and “D” have no involvement directly in the schedule although some of the energy from “A” is flowing through the transmissions systems of “C” and “D” on its way to “E”. Herein lies the potential danger to relaying even in the pre-restructured era. If this parallel flow is not recognized by previous studies or through a sophisticated monitoring system then, again relay settings may be inadequate.

C

A

B

D

E

Figure 2 Simple Interchange Schedule An illustration of what the post-restructured era may hold is shown in Figure 3. The same five interconnected control areas are now dealing with an energy broker who has contracts with generation resources G1 and G2 and locates buyers L1 and L2. Using wheeling contracts with control areas “A”, “B” and “E”, a schedule is established for a transaction between G1 and L1. The parties involved in this one transaction are now the broker, G1, L1, control areas

“A”, “ B” and “E”. Similar arrangements must be made for the transactions betwen G2 and L2. In addition, there is another player that has a major role in this game. An Independent System Operator (ISO) has entered the arena and is the actual point of contact between the control areas and the broker. G1

Broker

L1 C

A

B

ISO

D

E Broker

G2

L2

Figure 3 Complex Interchange Schedule When we consider that a large control area may have over 1000 individual transactions taking place each hour the complexity is obvious. Again, our interest is in the effect on the protection system and visa versa. As long as the extremes of line loading, voltage profile and system configuration are known the settings can be conservative, traditionally erring on the side of dependability, i.e. allowing an incorrect trip to avoid tripping times that would endanger system stability. Under this post-restructured arrangement, however, we must recognize the impact of a line or generator outage on the many contracts negotiated.

Changes in protection systems? It is reasonable to consider several possible changes in protection practices currently in use in the new operating environment. • The impact on the surrounding system of the use of multiple primary protection systems to improve dependability should be examined. Blind spots in the design of one relay type should not create conflicts within the contiguous system. • A uniform practice regarding safeguards against hidden failures of primary protection elements is necessary. A uniform practice for determining regions of vulnerability of protection systems to hidden failures should be established.

0-7695-0001-3/99 $10.00 (c) 1999 IEEE

4


• Maintenance and calibration schedules that are compatible with the protection system on the contiguous power system should also be developed. • It may be profitable to rethink back-up protection philosophy for the restructured utility industry. The communication network may be used to a greater extent to improve back-up protection. Recognizing that the loadability of back-up protection systems is frequently involved in cascading outages on power systems, existing telescoping back-up characteristic can be abandoned in favor of back-up differential protection on larger portions of the system. Back-up protection systems can also be altered from a central control point as the network conditions change. • Load-independent relays should be developed and installed at critical locations on the power systems. Pre-fault load currents can be removed from protection considerations by devising relaying algorithms that operate only on incremental currents (and voltages). Relays that automatically check the historical load patterns over long periods (years), and generate alarms when loads approach any of the protective relay can be designed. Relay characteristic databases will have to be developed and maintained for these purposes. • It may be possible with computer relays to switch the protection system to a single-phase mode in the event that the power system is stressed. • Remedial action schemes have dependencies on system state that must be well known to all interconnected parties. It is necessary to examine the interaction between all of the various remedial action schemes that may be in service. • It is also necessary to evaluate load shedding and restoration principles in use on the total interconnection. The market consequences of islanding and load restoration must be understood.

Protection and EMS functions The State Estimator function, which determines the prevailing condition of the power network from real time measurements, is critical to the operation of the Energy Management Systems (EMS). The security of the power system is determined using the estimated state of the system is to find the response of the network to various credible contingencies. Recent advances in microprocessors protection systems, communications, and measuring techniques make it possible to directly measure the state of the power system.

State of the power system Static state estimation programs used in the Energy Management Systems determine the system state from a

collection of scanned measurements of the system. The static state calculated in this fashion is not actually the state of the power system, as it is calculated from measurements obtained over the measurement scan time which may range from several seconds to minutes. Adaptive protection systems and remedial action schemes require the true system state. The advent of synchronized phasor measurement technology using the Global Positioning System make possible a state estimate which is a true snap shot of the power system. The state could be measured in tens of milliseconds making it possible to track system dynamic events in real-time. As the need for adaptive relaying and intelligent remedial action schemes becomes more critical in the post-restructured environment synchronized phasor measurements will play an important role.

Contingencies and the protection systems According to recent studies, the power protection systems have played significant roles in the birth and propagation of major power disturbances. While almost all relay operations are correct, the propagation of disturbances through hidden failures in the protection system is possible in rare situation. Incorrect or unwanted relay operations were involved in the Northeast Blackout, the New York City Blackout, and the WSCC events of 1996. Out of the last five major Western Systems Coordinating Council (WSCC) events th (the North Ridge earthquake, December 14 1994, July nd rd th 2 & 3 1996, and August 10 1996); the latter three involved false trips with line protection relays and generators. In the deregulated system of the future, the ability to transfer power reliably through a network becomes a necessity when monetary values are attached to its reliability. Hence there exists a need to study the hidden failures imbedded within the protection system. In spite of its importance, the impact of protection system malfunction on overall system reliability has not been well studied. The existing protection system with its multiple zones of protection is biased toward dependability and is designed to be dependable even at the cost of global system security. Hence, a vast majority of relay miss-operations are unwanted trips and have been shown to propagate major disturbances. For example, using directional comparison protection schemes lines originating on the same bus as the faulted may lead to a false trip in a healthy line due to a momentary loss of carrier. Following a fault within the region of vulnerability of the relay, relays with a hidden failure may also lead to a trip of a healthy line. These ideas have been explored recently in a number of papers 2 in the relaying literature and illustrated in Figure 4.

0-7695-0001-3/99 $10.00 (c) 1999 IEEE

5


It is essential to take into account the performance of the protection system, the remote possibility of hidden failures, and regions of vulnerability of various protective devices in creating the contingencies used to estimate the of various transfer capabilities and loading margins. Relay with hidden failure Faulted Line

Pre-fault flow Lines tripped by hidden failure

Excessive Power flow

and its variants (NATC, RATC, etc.). It is described as 1 follows: “Available Transfer Capability (ATC) is a measure of the transfer capability remaining in the physical transmission network for further commercial activity over and above already committed uses. The ATC between two areas provides an indication of the amount of additional electric power that can be transferred from one area to another for a specific time frame for a specific set of conditions.” The "specific set of conditions" includes security under a reasonable set of contingencies. It is clear that multiple contingencies are possible through interactions of various protection systems and hidden failures. At best the ATC determination would begin with the current state of the power system. The static state that has been traditionally determined with state-estimation software requires complete coverage of the network to obtain the state. In the present environment it is unlikely that all parts of the interconnected system will be metered, and hence it would be impossible to determine the state of the contiguous system. Measurements based on synchronized phasor measurements makes it possible to locate these units at strategic points on the network as needed, and augment the network state so that meaningful contingency analysis could be performed on the entire network. The system state would then be tested for various credible contingencies. The contingency selection should take into account the performance of critical portions of the protection systems, particularly the possibility of having hidden failures. One would then determine the margins available for power transfer without violating any of the operational constraints (thermal, voltage, or stability). These concepts are illustrated in Figure 5.

Role of Remedial Action Schemes

Power Flow and System State not sustainable

Figure 4 Progressive descent into catastrophic failure

Transfer capabilities in real time An important new concept in the post-restructured era is that of the Available Transfer Capability (ATC)

In some systems remedial action schemes may be at odds with the concepts in transfer capability. In particular, a remedial action triggered by an incorrect trip produced by a hidden failure would confound the ATC concept. Suppose a remedial action scheme is employed in a transmission corridor to increase the maximum power transfer achievable. The scheme trips generation on one end and/or load on the other if the amount of power transfer is too large for the remaining lines. If the contingency considered in the ATC calculation includes the loss of a line that would invoke the remedial action scheme then it is unlikely the ATC calculation is appropriate. The market consequences of the scheme must also be considered in its design. Is the owner of generation shed by a remedial action scheme compensated for a contribution to system security?

0-7695-0001-3/99 $10.00 (c) 1999 IEEE

6


Adaptive security/dependability Combining the outputs of the multiple primary relays can alter the security/dependability of protection. In conventional schemes where any relay can trip the breaker the outputs are logically in parallel. Requiring all of the primary relays to indicate fault before the relay was tripped (a series connection). produces the extreme in security. A two out of three voting scheme can be produced with three primary systems. The relay algorithm design can be used to produce more subtle trade-offs between security and dependability. It is possible to imagine a relaying system that had a continuously adjustable security/dependability index. During a cascading outage it would be desirable that a rapid change in security/dependability could be achieved to stop relay involvement in the disturbance propagation.

System RTUs

Synchronized Phasor Measurements

make the security/dependability compromises discussed in the previous section. The owner of the transmission system, on the other hand, would naturally want to protect the equipment and would set the protection accordingly. . Conflicts between losses due to damage to equipment caused by a failure to trip verses losses due to false trips must be resolved. The issue is the responsibility for the design, setting, and maintenance of the protection equipment.

Conclusions Some possible implications of existing protection systems and practices on the post-restructured power system have been examined. Advances in the field of protective relaying – primarily due to the impact of computers and communications may allow changes in protection practices that are required by new operation regimes. The role of the protection system in on-line transfer capability determination and the possibility of adaptive security/dependability have been considered.

References State Estimator

STATE Contingency List Margin Estimation

Operational Constraints

Protection System

Available Transfer Capability

[1] “Available Transfer Capability Definitions and Determination”, NERC, June 1996 [2] J.S. Thorp, A.G. Phadke, S.H. Horowitz, and S. Tamronglak, “Anatomy of Power System Disturbances: Importance Sampling,” Electrical Power & Energy Systems Special Issue on the 12th PSCC, Vol. 20, No. 2, August 1997, pp. 147-52. [3] A.G. Phadke and J. S. Thorp, “Expose Hidden Failures to Prevent Cascading Outages,” IEEE Computer Applications in Power Vol. 9, No. 3, July 1996, pp. 2023. [4] S. Tamronglak and S.H. Horowitz, A.G. Phadke, J.S. Thorp, “Anatomy of Power System Blackouts: Preventive Relaying Strategies,” IEEE Trans. on Power Delivery, Vol. 11, No. 2, April 1996, pp. 708-715.

Figure 5: Role of Protection System analysis in on-line ATC determination. Is it also possible that security/dependability should be changed under certain market conditions? If because of market conditions, the false trip of a given line would result in a substantial economic penalty, it might be acceptable to increase the probability of failing to trip an actual fault on that line. Even with an increase the probability of failure to trip is still extremely small. Responsibility and authority for protective systems A potential conflict can develop in terms of the protection system if the transmission system owner and the system operator are different entities. The transmission system operator might be quite willing to

0-7695-0001-3/99 $10.00 (c) 1999 IEEE

7