Designing a Wind Generation Integration Substation with IEC 61850 GOOSE

Author:Michael J. Thompson, Schweitzer Engineering Laboratories, Inc.


These two line terminals for the existing line that is being cut into the substation and two line terminals for connection of two nearby wind generation facilities. Construction of this green-field substation was used as a pilot project for the use of IEC 61850 Generic Object-Oriented Substation Event (GOOSE) messaging as part of the tripping architecture. As shown in Figure 2, the substation has a two-rung, breaker-and-a-half configuration with room for expansion to additional rungs.

A significant challenge for protecting transmission circuits interconnecting unconventional sources to the grid is the need to have high-speed protection. This improves the likelihood of ride-through for the wind generators during a short circuit near the interconnection. Figure 1 shows the FERC low voltage ride-through requirement as an example. The system was designed to ensure high-speed protection for any single-contingency operating scenario, including the likely possibility of extremely weak sources supplying a fault. 

Because this substation is on the western fringes of the North American Eastern Interconnection, the system can have large angles between terminals when a line is open in this sparse region of the grid. For this reason, the substation is designed for single-pole trip (SPT) and reclose operation to improve stability and reclose performance. The downside of SPT systems is that they almost triple the I/O and wiring for tripping and breaker failure initiate (BFI) circuits.

Ethernet-based IEC 61850 GOOSE messaging was used for lockout and breaker failure (BF) functions to reduce the hard-wired I/O requirements.  The protection system design, with emphasis on the following points, will be discussed:
  Design philosophies and guidance on how to use GOOSE messaging.
  Design of the protection and control system to meet application requirements
 Single-line diagram documentation.

Guiding Principles
In the preliminary stage of the system design, it was important to establish guiding principles of how IEC 61850 GOOSE messaging would be used to achieve the design goals. These rules are detailed in the technical paper, “Case Study: Using IEC 61850 to Simplify Lockout Circuits in a 345 kV Wind Generation Integration Substation,” available at, and are summarized here.

A.  Direct Tripping for Primary Fault Clearing
Rule 1: For primary fault protection, all relays must be hard-wired to directly perform all signaling and tripping to isolate their zone of protection
This rule was adapted from the modern practice of eliminating the use of auxiliary relays for contact multiplication and circuit isolation in favor of using the multiple programmable output contacts available in multifunction relays.

1)  Zone Protection:  Applying this direct tripping rule to the design meant that the zone relays were all wired directly to the trip circuits of the breakers for their zone of protection using high-speed hybrid contacts to optimize performance. GOOSE messaging was not used to trip breakers for primary fault protection.

2)  Lockout Functions:  For zones that require lockout, the zone protection relays also trip a physical lockout relay (86). However, the physical lockout relay has no tripping contacts. It only asserts inputs on the tripping relays. The relays then broadcast the status of the physical lockout relay via GOOSE messaging to the breaker control relays. The breaker control relays for the breaker that is locked out assert their tripping contacts and block all close commands.

B.  GOOSE Signaling for Backup Functions
Rule 2: For backup protection, all signaling must be via GOOSE messaging
This design rule promoted using GOOSE messaging for the most I/O-intensive functions, where the greatest economy in wiring reduction could be achieved, while not impacting the primary fault protection. 

 1)  Breaker Failure Protection: BF relaying is the backup system for interrupting fault current in case a breaker fails to open or clear. In a breaker-and-a-half substation, the BF system design is complex. Every breaker separates two zones that are different for every breaker in the substation. Thus, each breaker has a unique set of phase-segregated BFI signals and a unique set of backup breakers to trip. Using GOOSE messaging for BFI and BF trip greatly simplified the dc schematics and reduced the I/O requirements and inter-panel wiring.
When this rule was applied to the three-channel tele-protection transceivers, the system had the seemingly odd arrangement that permissive or block and direct under-reaching transfer trip (DUTT) signals were hard-wired, but BF direct transfer trip (DTT) signals used GOOSE messaging.

2)  Block Close Lockout Functions: As mentioned previously, GOOSE messaging is used for all lockout functions. Every relay directly trips the breakers required to clear faults in its zone of protection, so the lockout relays are mainly used to block the close of breakers associated with a locked out zone. 
To satisfy the rule that only backup functions could be done via GOOSE messaging, the utility switching order procedures were defined as the primary system for preventing the close of a locked out breaker.

C.  Design for Full Redundancy
Rule 3: For any critical protection or control function, there must be redundancy and no single point of failure

 1)  Protection:  When this rule is applied for protection functions, it is often called dual primary. That is, both System P and System S must be functionally equivalent in sensitivity and speed.

2)  Manual Control: Manual control is implemented such that remote control signals are sent from supervisory control and data acquisition (SCADA) to System P relays and local control is supervised by System S. Thus, local control backs up SCADA control and SCADA control backs up local control.

3)  Automatic Reclosing: Automatic reclosing is typically not redundant. Remote SCADA close control is considered the backup for automatic reclosing. Thus, automatic reclosing is implemented in the System S line relays only.

D.  Isolation of System P and System S
Rule 4: Provide maximum isolation between System P and System S

1)  Physical Separation:  Physical separation is accomplished by using two rows of simplex protection and control panels with System P protection and control across the aisle from the System S protection and control panels. The two battery systems are located in separate battery rooms.

2)  Eliminate Cross-Tripping: In redundant systems, there are two main tripping philosophies: cross-tripping or letting each system trip via only one of the two trip circuits. The latter was used because, in modern systems with continuous self-monitoring, the risk of hidden failures is small, which is the main reason for cross-tripping.
 3)  Separate Ethernet Networks: The Ethernet networks for System P and System S are separate, with no crossover between the two networks. Figure 3 shows the network architecture for System P.  The System S network is similar.
The SCADA communications used serial links to the communications processor to allow the tripping network to only be used for tripping and nothing else. This eliminated the need to address cyber-security on the tripping network as well.

 4)  Separate Breaker Failure Systems:  In an integrated substation design, BF protection can be implemented in many ways. Determining the optimum design depends on many factors.

While several options were considered, a design where the BF function for System P is implemented in the System P bus relay and BF for System S is implemented in the System S bus relay was settled on.

5)  Use of a Physical Lockout:  Because the local and remote manual control functions are separated, with one on System P and one on System S, it is necessary for both systems to know when a breaker is locked out. If System P tripped and locked out a bus, for example, it would be necessary to prevent closure by the local controls that are supervised by the System S relay.

This posed some problems. Using a crossover connection between the systems was rejected because each relay would have to subscribe to GOOSE messages from both systems.
This would have greatly increased the complexity of the network design, as well as the GOOSE programming and testing, by doubling the number of subscriptions that any relay would require.

The implemented solution was elegant in its simplicity. A physical lockout relay with two tripping contacts was installed. One contact is wired to an input on the System P relay, and the other contact is wired to an input on the System S relay. The status of the lockout is broadcast by each tripping relay to the relay on its system that is controlling the locked out breaker. The only crossover between the two systems is the status of the lockout.

E.  Conventional Interfaces
Rule 5: The advanced technology should be behind the scenes

1)  Operator Interface: The panels are designed such that primary operator control functions are implemented using physical switches so that they are similar to other substations.
The physical lockout relays are another example of a conventional interface. The operators find lockout relays on the panel similar to other substations. Operating instructions for response to lockout conditions are no different for this substation than any other. From the front of the panels, no one knows that the lockout relays carry out their function over an Ethernet network.

2)  Technician Interface:  Technicians use physical test switches when they are working on a relay to isolate trips. For GOOSE BFI and trip signals, there is no physical contact associated with the signals.
To address this difference, GOOSE test switches were implemented to allow relay technicians to isolate these signals in exactly the same way that they isolate a physical trip or BFI contact. Every relay has two poles of the trip isolation test switch wired to inputs.

One is designated the GOOSE TX test switch, and the other is the GOOSE RX test switch. This arrangement is immediately familiar to any technician testing a relay, making it very easy to avoid mistakes.

Relion advanced protection & control.
BeijingSifang June 2016