When it comes to commissioning and testing protection systems, there are many testing options, methods, and approaches to choose from. In order to make the correct decision as to the most appropriate testing strategy, protection testers first have to define these and then constantly review them. Therefore, the goal is to minimize misoperations of the protection system, so that all associated installations are protected and network stability is ensured.
To do so, engineers and technicians must firstly be aware of possible causes of mis-operations. Once the causes have been identified, the testing requirement can be focused efficiently. As with all complex systems, it is almost impossible to foresee all types of misoperations and, therefore, to eliminate them all.
Fault statistics that contain almost all known causes for misoperations to date, as well as the frequency with which they occur, provide help here. For this reason, the North American Electric Reliability Corporation (NERC) has drawn up detailed fault statistics on misoperations of protection systems.
To this end, the above authority evaluated faults that occurred in North American protection systems during the period from 2011 to 2013 and published the results in a study.
Although the results initially had a regional focus, they can also be carried over to European systems, as the technology used is comparable in terms of its operating principle.
This article will now discuss the causes for the misoperation of protection systems identified on the basis of the NERC study. In addition, it will describe a series of test approaches that can be used to detect possible misoperation. Furthermore, with the system check, we will introduce a novel test approach that makes it possible for protection testers to test the protection system in a more comprehensive manner.
Figure 1: The NERC study analyzed the misoperations of protection systems between 2011 and 2013, based on possible sources of errors, and broke these down by the frequency with which they occurred…
Research into Causes
The NERC fault statistics provide a detailed breakdown of the possible misoperations of protection systems (Figure 1). Two important findings can be drawn from these statistics:
- A misoperation can be caused by every single component that is part of the protection system:
The protection concept, communication, power supply and the protection relay itself
• Incorrect protection relay settings, together with logic and design errors, are the most probable causes of misoperations.
Changing Times for Protection Systems
The triggers for misoperations can be traced back to more than just rising cost pressure, indeed the requirements placed on the protection systems themselves have changed greatly in recent years. Not too long ago, network protection consisted of electromechanical relays that protected the energy transmission system on the basis of analog values and binary circuitry. It is true that electromechanical relays are still found in isolated installations, even today, but with the advent of digital technology, the task of network protection was largely taken over by multi-functional digital protection relays. Of course, modern protection relays offer a whole range of advantages: where in the past, multiple devices were required for different protection functions; today an extremely wide range of such functions can be combined in a single device. Based on IEC 61850 and the protocols defined there, today’s protection devices can be connected with one another in a flexible and versatile manner. At the same time, the devices communicate with one another and therefore, enable protection system configurations that would previously have been inconceivable, or at least unprofitable, due to the outlay involved. In addition, digital protection relays provide the option of parameterizing logic, similar to a Programmable Logic Controller (PLC), which drives forward automation of installation technology.
Against the background of the challenges presented by increasingly decentralized energy provision, this is a major criterion. Accordingly, modern digital protection relays contain hundreds of different setting values so that they can be parameterized in line with the relevant customer requirements. However, both the logic functionality and the high number of parameters make correct configuration all the more complex for the user. Nonetheless, in this context the NERC study clearly shows that incorrect protection relay settings, together with logic and design errors, are among the most frequent causes of misoperations in protection systems.
Testing technology has also developed with modern test sets and software. However, the essence of testing has scarcely changed during this time. A typical testing process involves the output of ramps of different signals (voltage, frequency, impedance etc.) in order to review the pick-up values from a relay. This test was originally based on the maintenance of electromechanical relays, where it was necessary to check the setting parameters at regular intervals. Such electromechanical relays were exposed to the influence of external conditions such as temperature or contamination, with resulting effects on the mechanics of the system.
Figure 2: There is a range of different protection tests available, but these tests cover completely different areas…
A further test is the static output of analog signal sequences to the protection relay and subsequent evaluation of the protection response. Such sequences consist of at least two states: the pre-fault and the fault itself. With more complex tests, such as for an automatic reclosure, such sequences can certainly be long and confusing.
In principle, however, automated tests greatly simplify the testing process with the use of a test plan, as provided by the OMICRON Control Center and the Protection Testing Library. They support the protection tester’s need to test each individual protection function in isolation in order to be able to carry out a precise evaluation. However, overlapping functionalities among the protection devices render this difficult, or even impossible. As a result, the protection tester sometimes has no other option for testing individual protection functions than to switch them off and then reclose them. This process is virtually predestined for faults caused by operating errors, as clearly shown by the NERC study: modified/incorrect settings as a result of protection testing accounted for nine percent of protection system misoperations.
In this context, it is certainly worth posing the provocative question of just how worthwhile extensive testing of response thresholds and tolerances on digital protection relays actually is nowadays. Modern devices have an internal self-monitoring function and operate in a deterministic manner. Would it not, therefore, be more intelligent to focus on correct parameterization and the reliability of the complete system in accordance with its requirements?
Moving Forward to System Testing
In order to guarantee that a protection system will function correctly, all the components must work together. It is not sufficient to test components individually, isolated from one another, instead overlapping functions should be tested together wherever possible.
One simple example illustrates the underlying issue here: during commissioning, current transformers were tested first and the grounding terminal was verified using the corresponding circuit diagram. Next, the protection relay was tested with the documented polarity settings from the current transformer. Independently of one another, both components passed their tests, but the polarity setting on the protection relay was nonetheless incorrect. This is why, when recommissioning, a primary injection should ensure that analog values from the primary system are correctly reproduced via the transducer – and the secondary technology right through to the protection devices.
This test can also be referred to as a system test. Here, realistic scenarios are used to impinge on the functionality of the complete system (primary injection), so that the corresponding end result (direction of electric current at the protection relay) can be tested. The operational system can be regarded as a kind of black box.
The same issue also comes into play with protection testing. For pre-qualifications or design studies for a protection relay, testing individual protection functions and response thresholds is certainly absolutely vital. During field tests, however, the focus should lie on the correct function of the protection system in its entirety. (Figure 2).
Simulation of the Primary System
The main objective of the protection system is to protect the equipment in the primary system. Simulating this primary system using test software such as RelaySimTest can help to achieve better test coverage and simplify the test.
In this case, the simulated primary system aids the protection tester in creating realistic test scenarios. In addition, it automatically calculates the values to be output. This new approach opens up numerous new possibilities for protection testers.
Realistic Fault Scenarios under Control
The development, planning, and construction of the protection concept are based on diverse load flow and fault scenarios that are generated using network calculation programs. By using a simple network simulation, protection testers are also able to verify in the field whether the protection concept is working correctly with the current installation data. In this way, the quality of the engineering process can be ensured comprehensively (Figure 3).
Figure 3: Faults that are caused by the design of a protection system can very easily be picked up by a system-based protection test and the associated simulation of the installation function…
More Important than Ever: Communication
As a result of the increasing level of automation in secondary technology, communication between the relevant components is becoming more and more important, including in protection technology. Applications such as line differential protection or reverse interlocking via IEC 61850 GOOSE rely on secure communication. It is, therefore, becoming increasingly important to test this communication along with the protection, particularly when distributed among multiple test sets. However, users often balk at the underlying complexity, as they first have to design and calculate the relevant test steps. What is more, it is imperative that each test set is controlled by an experienced protection tester. This is where RelaySimTest can simplify many of the work steps. It is possible to control multiple CMC test sets from just one application. If there is no direct Ethernet connection available for this purpose, protection testers can access the connection via an online cloud. The central application calculates all the values to be output based on the primary system that is to be simulated, and outputs then to multiple CMC test sets with time synchronization. The response from the protection system is recorded and the protection tester receives all the results directly on site in order to carry out his or her evaluation. Many different protection testing approaches are possible using this system. These include, by way of example:
- Busbar protection – centralized and decentralized
• Line differential protection or distance protection with signal comparison – including those with multiple ends (Figure 4)
• Protection concepts with IEC 61850 – for example, reverse interlockings
Figure 4: The test set-up for a distributed protection test initially appears relatively complex, but the complete test itself is simplified thanks to the intelligence integrated in RelaySimTest…
From Logic to Simplicity
Testing the logic functionality of protection relays always presents protection testers with challenges. To achieve this, complicated sequences are parameterized in an attempt to satisfy all of the conditions required by the logic. This test is generally very abstract and not very realistic. Here, system-based testing provides a solution, with realistic scenarios. With one of its main functions, the Iterative Closed Loop, RelaySimTest adapts the simulation of the primary system by incorporating the responses from the protection system. This means that realistic fault scenarios are generated automatically, enabling evaluation of the logic functionality. Application examples for this include:
- Automatic reclosures
• Circuit breaker failure and final error protection
Testing Transient Scenarios
More and more protection functions now have to be tested with realistic transient values in order to ensure their correct operation. The transient network module in RelaySimTest also simulates these signal courses automatically, making it easy to test complex protection functions:
- CT saturation
• Transient and intermittent ground faults
• Adaptive protection functions
• Faults with different angles of incidence and DC offset
The Protection Tester’s Expertise is Required
Although protection testers may be familiar with all the functions of their protection devices down to the fine details, if they cannot relate this to the primary system, they cannot ensure that the protection is fully functioning. For this reason, fundamental knowledge of the functionality of the system to be protected is vital for the protection tester. Only this knowledge will enable the protection tester to evaluate the protection system comprehensively. The information required can only be obtained from the development, planning, and design process. If protection testers have access to all the important information on the primary system with the rating plate and the nominal data, they are in a position to carry out a system-based protection test using RelaySimTest. In addition, the tester can incorporate current measurement values obtained during commissioning into the test. For example, following a line impedance measurement with the CPC and CU1, the results can be used in RelaySimTest, or the transient behaviour measurements of current transformers with the CT Analyzer can also be incorporated into RelaySimTest. As an outcome, the protection tester receives a test, including analysis, that documents the correct operation of the protection for realistic scenarios.
The Right Tool for Each Work Step
The system-based approach to protection testing will certainly not replace testing of setting and response values. However, it may complement the existing options, help to test overlapping functions of protection devices, and reduce the resulting test outlay (Figure 4).
If you want to share thoughts or feedback then please leave a comment below.
