Redundancy - Considerations for Protective Relay Systems

Authors:
IEEE PSRC, WG I 19 members

INTRODUCTION

Different users may have different terminology for referring to the redundant protection systems.  They may be called "System 1" and "System 2" or "System A" and "System B" or sometimes "Primary" and "Backup."  This latter terminology, "Primary" and "Backup", implies, although unintentionally, that one of the two systems serves the main function of protection and the other serves to assist in the case of failure of the first system, analogous to carrying an undersized spare tire in the trunk of a car in case of a flat.  In actual practice, the redundant systems are each fully capable, each system is able to detect and clear faults on its own, and each system serves as a backup to the other.   

  •  Redundancy is the existence of more than one means for performing a given function. Redundancy plays an important role for reliability.
  •  Reliability is a combination of dependability and security. Note that reliability denotes certainty of correct operation (dependability) together with assurance against incorrect operation (security) from all extraneous causes.

Purpose of redundancy: Redundancy is required for several reasons including governmental and regulatory requirements, reliability, to maintain customer satisfaction, to increase system stability, and for maintenance purposes.

Because protective relaying provides no profit and is only required for infrequent and random abnormal operation of the power system, it can be described as insurance that prevents damage to the main grid equipment while minimizing outage time.  Like all insurances the economics of the risks versus benefits are analyzed by utility managers and engineers.  Larger utilities with abundant financial and technical resources research different protection schemes to determine the optimal balance between robustness and performance.   However, there are different types of economic justification other than insurance that drive the application of a redundant protection scheme.  As the power system is operated closer to its limits, less time is available for controlled outages for maintenance and uncontrolled outages due to equipment failure.  The scenario of a stressed power system enforces the need for redundant protection systems that allow for relay maintenance without a line outage or for continued operation when the primary relay system fails.   

Redundancy’s influence on reliability: Reliability is a combination of dependability and security. While not practical to use, it could be of interest to illustrate the concepts by looking at the two extremes; 100% dependability and 100% security. 100% dependability would be achieved by a protection system that is in a constantly tripped state, hence there is no possibility that there would be a fault that would not be detected. 100% security would be achieved by disabling the protection system entirely so that it could never trip. From this we can see that while high dependability and high security are desirable, they will both have to be less than 100%. Generally, an increase in dependability will decrease security, and vice versa. However, measures to increase dependability may not penalize security to an equal degree and the aim of a protection system design is to find the optimum combination of the two in order to provide adequate reliability.

In order to illustrate how redundancy influences dependability and security, an example based on Direct Transfer Trip Teleprotection requirements is used; 99.9999% security and 99.99% dependability. If a fault occurs and is isolated by a redundant protective system B, the fact that relay system A did not operate does not constitute a mis-operation; however, from an operational point of view this would be investigated in the chance that relay system A was defective in some respect. In our example, “redundant” refers to completely independent systems or components. The failure rate for each system or component is independent from the redundant system’s failure rate. A failure in one device does not influence the other and the failures are not triggered by a common cause. Our security and dependability numbers can be expressed as probabilities (the reciprocal). The probability of a false trip (Ps) is thus 10-6 and the probability for a missed trip (Pd) is 10-4.

Influence of redundancy on security and dependability: If a redundant system is added, and the systems are equal and independent, the probability of a false trip will be the sum of the probability for each system to give a false trip (Figure1a).  Security is consequently reduced from 99.9999% for a single system to 99.9998% for a redundant system. For dependability, as the systems in our example are equal and independent, both of them need to fail at the same time for a missed trip to occur. Therefore the resulting probability of a missed trip is the product of the probability of each individual system (Figure1b). Consequently, dependability has increased from 99.99% to 99.999999%. Table 1 summarizes the influence of redundancy on security and dependability for the example used with individual unit probability of a false trip of 10-6 and probability of a missed trip of 10-4. The example in table 1 explains why redundancy is important for protective relay system reliability. By adding a redundant system, the probability of a false trip increased by a factor of 2, while the probability of a missed trip decreased by a factor of 10,000.

Voting schemes: One variation of redundancy is the two-out-of-three voting scheme. For this scheme, both security and dependability are improved by added redundancy. A voting scheme requires the simple majority (usually through output contacts in series) of an odd number of primary relays to indicate a system disturbance before the overall protection scheme is energized.  Voting schemes typically consist of three primary relays of different manufacturers that receive the same analog and digital inputs from different sources where any two-out-three devices must agree to initiate any tripping action. 

Voting schemes are often applied when a high degree of certainty that a protection system will not operate incorrectly is required.  They are most commonly utilized in special protection schemes and EHV transmission line protection systems where system studies or operational experience have shown that the misoperation of a scheme or inadvertent transmission loss would be detrimental to the overall stability of the system. Figure 3 is an example of a complete redundant transmission line protection two-out-three voting scheme. Each relay is connected to its own voltage and current source.  The trip circuits consist of separate dc sources connected to the three possible combinations of two separate relay contacts connected in series to each other and to separate trip coils of the circuit breaker.   In this scheme if one of the relays misoperates due to a CT failure, PT failure or internal logic failure the circuit breaker will not be tripped without one of the other two relays operating.   

PDF Version

Relion advanced protection & control.
Protecting your electrical assets? today and tomorrow