56302225-substation-automation-handbook.docx

5.6.3

And after compensation with Oc = P tan Q 1) must be avoided as this gives rise to capacitive reactive power, which stresses the conductors in the same way as inductive reactive power, and in addition, unwelcome voltage increases can occur.

5.6.3 High voltage reactors u

u

a,

5.6.3. 7 reactors

Current

limiting

Current-limiting reactors are reactances employed to limit short-circuit currents. They are used when one intends to reduce the short-circuit power of networks or installations to a value which is acceptable with regard to the short-circuit current carrying capability of the equipment or the breaking capacity of the cir cuit-breaker. Since the reactance of a series reactor must remain constant when short-circuit currents occur, only the air-core type of construction is suitable. If iron cores were used, saturation of the iron caused by the short circuit currents would result in a drop in the induc tance of the coil, thus seriously reducing the short cir cuit protection.

Figure 5-23 Active and reactive currents in an electrical installation, a) uncompensated, b) compensated with capacitor, c) power vector diagram

5.6.3.1.1 Voltage drop and voltage variation The rated impedance is the impedance per phase at rated frequency. The resistance of a current-limiting reactor is negligible and in general. amounts to not more than some 3% of the reactance XL·

85

AU,

AU,

u"'

u

5.6.3.1.2

The rated voltage drop !:!. U, is the voltage induced in the rea'ctor when operating with rated current and rated reactance: !:!. U= I, XL

When the vditage drop is referred to the system vol tage, the rated voltage drop is denoted !:!. u, and usually stated in %. !:!.

u, =!:!. u v3 I Un 100%

For given values of reactance and current. the voltage variation U"' in the network. i.e. the difference be tween the network voltage before and after the reac tor, is also dependent on cos
5.6.3.

7.2 Reactor

9 j

) )

)

86

Figure 5-24 Vector diagram of reactor; a) normal operation, b) short circuit operation

U,: System voltage before reactor U2 : System voltage after reactor U'f: Voltage variation in the system U2 K: System voltage after reactor during short circuit I, : rated current IK : Short circuit current

circuits

0 )

)

j

t t a)

b)

a)

1)

r'l

)

I

I

lI b)

11

I

)

1I c)

9 )

j j

)

1- r

Figure 5-25 The most common reactor circuits, a) branch circuit b) group reactor circuit c) busbar reactor circuit

)

i

' l_

. '?

The scheme shown in Figure 5-25 under a), with the reactors in the branches, is the most commonly used. The circuit shown in b), with one common group reactor in the supply feeder for several branches, is often chosen for reasons of saving space. The costs of purchase and operation for the same degree of protection are higher than with reactors in the bran ches. In power stations with a high short-circuit power, it is usual to fit busbar sectionalizing reactors together with bypass circuit-breakers, as shown in c). In normal operation, the closed circuit breaker and isolators pro vide a permanent connection between the busbar sections. In the event of a fault, the circuit-breaker opens, and the reactor prevents that both generators feed into the fault and limits the short-circuit current magnitude approximately to that of the individual systems.

5.6.3.2 reactors

Shunt

Shunt reactors in long EHV lines, mainly 400 kV and above are applied to compensate the effects of line capacitances and to limit the various types of over voltages. The example in Figure 5-26 shows the occur rence of closing overvoltages, which are caused as soon as the line is energized with the circuit breaker closing at t 0. Before closing the line voltage UL = 0. The closing overvoltage is rising fast to its maximum value OM and after approximately 10 ms the overvol tage OM = OLand line voltage OL becomes equal with the source voltage 05. The maximum value of 0 M and the rate of rise depends on the source impedance X 5 and capaci tance C 5 as well as the line impedance ZL and capaci tance CL. The characteristics of the line ZL and CL depend on voltage level and length of line.

The higher the voltage level and the longer the line distances are the higher are the closing overvoltage. In certain cases the value for OM can be more than 3 times 05 without any measures for limiting the peak value to less than 2 times 05.

5.6.3.2

Such a measure can be the lateral compensation by shunt reactors at both end to prevent pre-charges of the open line and/or closing resistors on circuit brea kers (CB+CR). The closing resistors contact is closed shortly before the main contact closes to limit the line energizing current inrush and is opened immedia tely after the main contact has closed. Its insertion time is not more than 3 ms. The closing resistor value is between 0.4 to 1 kQ. Shunt reactors of suitable size must be permanently connected to the line to limit the temporary funda mental frequency over voltages. Such line reactors also serve to limit switching over voltages to some extent However, reactive shunt compensation increas es the surge impedance of the line and thereby reduces the surge impedance loading (SIL) level that is, the load at which a flat voltage profile along the line can be achieved. These permanently connected shunt reactors also consume active power, which is a continuous loss to the system. Such disadvantages can be overcome with the aid of thyristorized controlled shunt reactors (CSR), which offers all the advantages of the permanently connect ed shunt reactor but only when it is required thus reducing the continuous reactive power drawn as in the case of a fixed shunt reactor. CSR automatically goes of the circuit during increased line loading to limit the power frequency dynamic over voltag s.

87

optimization of the control system for short term and long term operation, namely power system damping and power flow optimization.

Closing EHV transmission lines

Load

---® ·--· ----·----r Transformer• reactor Generation Plant

,---

CJ ,. l 1

CR

reactors 400 kV Transmission line

The technological basis for the development of FAGS devices is a yoltage ource onverter (VSC) with high power ratings. By converting direct current to alternating current quantities, with respect to magnitude and phase, a VSC acts like a voltage sour ce injecting an AC-voltage or AC-current in series or in parallel to transmission devices. Additionally. this technology opens new possibilities with the combi nation of conventional equipment and power elec tronic based components for rapid power flow and voltage control Figure 5-27 and hence the functiona lity of existing devices can be optimally extended. i

i.

Substation

Figure 5-26 HV transmission with shunt reactors to limit switching overvoltages OM 5.6.4

The shunt reactors are switched off sometimes to increase the power transfer capacity of the transmis sion line during heavy load conditions. This, however, involves the risk of oveNoltage during sudden load throw off.

vsc

vsc star point connections

Series connections

Figure 5-27 Examples of voltage source converters (VSC) confk;;urations

5.6.4 FACTS Taking into account the actual structure and opera tion of the interconnected power systems the demand grows to utilize the network capacity in a more effective and flexible way. That means to increase the utilization of existing transmission facili ties in sense of enhancement of technical and eco nomic performance and more flexible adaptation to changing environments.

88

Much research has been directed to point out the operational benefits of flexible AC Iransmission System (FAGS) controllers for steady state operation as well as the power system dynamic improvement. Using existing networks more effectively is the main objective in the framework of FAGS device applica tions. Most of these applications are focused on the

The VSC modules can also be placed on high volta ge potential (Figure 5-28) as well as on low voltage potential, which will reduce the insulation level and hence the equipment costs (Figure 5-29). Against this background the definition of Flexible AC Transmission System devices is expanded to encom pass intelligent network nodes. These are optimized power electronic assisted substation systems aimed at power flow control as well as voltage control and active filtering for more effective network utilization in a deregulated environment and large system exten sions projects. In modem power systems the trend to transmit power through given corridors is rapidly evolving. The reason for this is the lack in the right of way for new

4

transmission lines, mainly because of environmental issues. In addition to this, due to deregulation and reconstruction of the electric power industry, the need rises to transport large blocks of power between partners, through defined line corridors without involving other partners. Thus, it is necessary to operate the existing transmission systems more efficiently and control power flows without risking the security of the system and the quality of energy delivery.

Figure 5-28 FAUS installation at high voltage potential

5.6.4

In this new environment in transmission system ope ration and in combination with the rapid develop ment in power electronics, FACTS devices can play a Figure 5-29 Facts at low voltage potential

89

5.7 Static Var (reactive power) compensation (SVC) ,--::·

5.7

5.71 Applications

5.72 Types of compensation

In recent years, the control of reactive power has .gain ed importance alongside active-power control. The use of mechanically switched choke and capacitor banks has improved the reactive current balance in the networks. This has reduced transmission losses and kept stationary voltage deviations within the pre set limits. In addition to this equipment, thyristor-con trolled reactive-power compensators (SVC=$.tatic ar ompensator) have also been implemented. They read virtually instantly and also offer the following advantages:

5.72.1 Thyristor controlled reactor (TCR)

• Very quick and infinitely variable reactive power conditioning

Features of this type are:

• Improvement of voltage stability in weak networks

• Continuous correcting range

• Increase of static and dynamic transmission stability and attenuation of power swings

• Generation of harmonics

• Enhancement of transmission capacity of lines • Quick balancing of variable non-symmetrical loads • Lower losses

• No transient influence

To avoid stresses due to harmonic overswingings, the parallel capacitor banks have to be enhanced by fil tering circuits.

transmission

• Increased static and dynamic stability and reduced power fluctuations • Increased transmission capacity • Balancing of unsymmetrical loads • Continuous regulation of power factor Equipped with electronic components, SVC systems respond almost instantaneously. SVC systems allow infinitely variable control across a whole band of reac tive power. Also, the stability of networks can be improved.

90

An inductance (reactor bank) (RC) is controlled by thy ristors as shown in Figure 5-30 a). The reactive power in this case can continuously be changed between zero and the maximum value by controlling the thy ristor valves (THV) via the control unit (THC) in rela tion to the system voltage. In many cases, this confi guration is operated together with a parallel-switched capacitor bank This occurs when the entire reactive power range also includes a capacitive component.

5.72.2 Thyristor switched capacitors (TSG) Thyristor-switched capacitor banks are switched ON and OFF, path by path as shown in Figure 5-30 b). In order to avoid transients, the thyristor gates are fired only if thyristor voltage is zero. The feature of this method are: • Stepwise control • No transient interference • losses

Low

DC

$([)

RC

THV

THV 1-5.7.2.3

RC 1-I--

THC a)

b)

THC

RC THV RC

c)

Figure 5-30 Types of static var compensation, a) Thyristor controlled reactor (TCR), b) Thyristor switched capacitor, c) Thyristor switched capacitor/thyristor controlled reactor (TSCITCR)

THC 5.72.3 Thyristor switched capacitors/ thyristor controlled reactor (TSCITCR)

Often a combination of both methods provides the best solution as shown in Figure 5-30 c). This com pensator allows low loss thyristor control of the enti re capacitive and reactive power correcting range. A smoothly varied output of reactive power is obtained by changing the phase section control of the TCR part. As soon as the TSC range has been compensa ted by the TCR, the capacitive part is disconnected and the compensator works as reactor. Features of this method are: • • • •

Continuous adjustment No transient interference Slight generation of harmonics Low losses

91

5.8 References

5.8

;

...

1---

Switchgear

[1] Switchgear Manual· © ABB Calor Emag Schaltanlagen Mannheim, 1Oth revised edition, Cornelsen Verlag, Berlin, 2001 [2] KP. Koppel. B. Stepinski, H. Ungrad, K-P. Brand · New Sustation Concepts, 5th Conf. on Electric Power Supply Industry (CEPSI), Manila (1984) SF6

[3] K-P. Brand, H. Jungblut · The Interaction Potentials of SF6 Ions in SF6 parent Gas Determined from Mobility Data, Journal of Chemical Physics 78, 4, 1999-2007 (1983) [4] K-P. Brand ·Dielectric Strength, boiling Point and Toxicity of Gases- Different Aspects of the same Basic Molecular Properties IEEE Trans_ on Electrical Insulation El-17, 5, 451-456 (1982) [5] K-P. Brand, W. Egli, L. Niemeyer, K Ragaller, E. Schade· Dielectric Recovery of an Axially blown SF6 -Arc after current Zero: Pt./11 - Comparison of Experiment and Theory IEEE Trans. on Plasma Science PS-10, 3, 162-172 (1982) [6] K. Ragaller, W. Egli, K-P. Brand ·Dielectric Recovery of an Axially blown SF 6 -Arc after current Zero: Pt./1- Theoretical Investigations, IEEE Trans. on Plasrna Science PS10, 3, 154-162 (1982) [7] E. Schade, K Ragaller ·Dielectric Recovery of an Axially blown SF 6 -Arc after current Zero: Ptl- Experimental Investigations, IEEE Trans. on Plasma Science PS-1 0, 3, 141-153 (1982) [8] K-P Brand · A Model Description of the !on Mobility in SF6 at elevated Pressures, Proc 15th lnt.Conf.on Phenomena in Ionized Gases (ICPIG) Minsk (1981), Part I, 301-302 [9] K-P Brand, J Kopainsky ·Model Description of Breakdown Properties for Unitary electronegative Gases and Gas mixture, Proc 3rd Int. Symp. on High Voltage Engineering (ISH), Milan (1979), Paper 31.05 (4 pages) [10] K-P. Brand, J Kopainsky ·Breakdown Field strength of Unitary attaching Gases and Gas mixtures, Applied Physics 18, 321-333 (1979) [11] K-P. Brand, J. Kopainsky ·Particle Densities in a decaying SF 6 Plasma Applied Physics 16, 425-432 (1978) Sensors

_

[12] F. Engler et al. ·Test and Service Experiences on Gas insulated switching Systems and Substations with intelligent Control, Cigre 2000, Paper 34-101 (7 pages), Paris, September 200 l

92

----

',-

6 The Functions of Substation Automation

6.1 Introduction 6.2 Process Connection 6.2.1 Sensors and Actuators 6.2.1.1 Instantaneous analog process inputs (current, voltage) 6.2.1.2 Other analog inputs 6.2.1.3 Binary process inputs 6.2.1.4 Binary process outputs 6.2.1.5 Other binary outputs 6.2.1.6 Analog outputs 6.2.1.7 Analog data from unconventional sensors 6.2.1.8 Binary data from unconventional sensors 6.2.1.9 Binary process outputs to unconventional actuators 6.2.2 Pre-processing of data 6.2.2.1 Pre-processing binary data 6.2.2.2 Pre-processing of analogue data

6.3 Operative Functions 6.3.1 Monitoring and supervision functions 6.3.1.1 Process state display 6.3.1.2 Process overview display 6.3.1.3 System configuration display 6.3.1.4 Event list and handling 6.3.1.5 Alarm annunciation and handling 6.3.1.6 Measuring and metering 6.3.1.7 Blocking list 6.3.1.8 Disturbance recording 6.3.1.9 Archiving 6.3.2 Control Functions 6.3.2.1 Control management functions 6.3.3 Protection and safety related functions 6.3.3.1 Main protection functions 6.3.3.2 Protection related functions 6.3.3.3 Interlocking 6.3.4 Distributed automation support functions 6.3.4.1 Distributed Synchrocheck 6.3.4.2 Busbar image 6.3.4.3 Station wide interlocking 6.3.5 Distributed Automation Functions 6.3.5.1 Switching Sequences 6.3.5.2 Breaker failure 6.3.5.3 Automatic protection adaptation 6.3.5.4 Reverse blocking

95 95' 96 97 98 98 98 98 99 99 99 99 99 99 101

6 Table of content

104 104 105 106 106 107 108 109 109 111 111 111 112 118 119 126 127 128 128 128 129 132 132 132 132 133

. ?

93

'

,··

'

1·.·

6 Table of content

6.3.5.5 6.3.5.6 6.3.5.7 6.3.5.8

Load shedding Power restoration Voltage and reactive power control lnfeed switchover and transformer change

6.4 System Configuration and Maintenance Functions

6.4.1 System Configuration and Adaptation , 6.4.2 Application Software Upgrade and Maintenance 6.5 Communication Functions

6.5.1 Data Exchange within the Substation 6.5.2 Data Exchange with External Systems 6.6 Network Operation related Functions

6.6.1 Supervisory Control and Data Acquisition (SCADA) 6.6.2 Power Application Software (PAS) 6.7 References

133 134 134 135 136

137 137 138

138 138 139

139 139

I

I'

140

'\_

94

1-i

6 The Functions of Substation Automation

6.1 Introduction This section describes the functions typically perform ed by a substation automation system. We start with the data connection at the process side and the pro blems resulting from real physical data inputs and outputs. We continue with the operative functions control, monitoring, supervision and automatics including pro tection, and then take support functions like commu nication, configuration and system maintenance relat ed functions. These functions are described indepen dently from the realization by physical devices and technologies; only examples refer to some extent to implementations.

6.2 Process Connection Each control and monitoring system needs input data from the process, and outputs to control the process. This process interface is the connection between the Process

Contro

_

'

'":!ay ...... . . , : : :--

On one hand the process interface allows to transfer information from the SA system to the process and vice versa, on the other hand it is the barrier between the control system equipment and the hostile envi ronment of the process. The high level of electromagnetic disturbances led classically to interface solutions with relatively high voltages and currents as physical transfer medium between process and SA system. To save power as well as cabling effort and space, the latest develop ments allow to locate electronic sensors for voltage, current and gas density measurements as well as for position indication, and actuators for switchgear con trol like circuit breakers and disconnectors into a shield ed box directly integrated into the switchgear, so call ed "intelligent" primary equipment. In this case a seri al bus interface (normally an optical process bus) can be considered as the process interface (Fig. 6-2). Since the shielded boxes provide some functionality,

·l/P

'

l;

6.2

Substation Automation System

-Q1

i

switchyard, being the process to be monitored and controlled, and the substation automation system (Figure 6-1).

rotection Cubicles l..b==!O!lfii;J!!!IIi

rN" 7rk control centre

Figure 6-1 Process connection between HV switchyard and substation automation system HVLine bav.

=

IL ··-

. ?

95

Intelligent Primary Equipment

6.2.1

Substation Automation System

Drive control & monitoring circuitry

·Q1

I I I

·Q51 ·QO

·T1

1 Proce

- - -· ss bu

s

- - -;..1

Star coupler

!

_. :_

\ Proces l1 Bus

a<

- - - - - lnterbay bus '=====d

cou pl er

, ' ....

=

:::··

d\-A'-

Network Centre

Sampling AD-Conversion Signal Processing -Q9

Signal Filtering

at least the AID conversion and serial communica tion, they act at least similar to conventional I/O cards. Preprocessing of data for maintenance purposes and more functionality can be added. Therefore, the pro cess interface is moved directly into the process, i.e. to the switchgear. Another change regarding the process interfaces is the introduction of non-conventional sensors and actuators, e.g. based on fiber optics to generate opti cal signals that are related to the magnitude of the primary current rather than a magnetically transfor med current. To make signal processing not compli cated, all these non-electrical sensors should produce signals that are directly proportional to the primary source signals. Non-conventional actuators allow to operate the drives of the switching devices directly via a serial link also(optical process bus).

6.2.1 Conventional Sensors and Actuators

96

The most important inputs from the process are the currents and voltages from different places in the switchyard, and the positions of switches and trans-

0

·- · m - - - = t

'i

i

I

I,

Figure 6-2 Process connection between intelligent primary equipment and substation automation system former tap changers. The most important outputs are the control of switches and tap changers. Additionally other physical quantities like temperature, gas pres sure etc have to be monitored, and binary as well as analog control outputs to different other equipment may be necessary. This leads conventionally to the following kinds of sensors and actuators respective interfaces to them: • Currents and voltages from the switchyard:

Current transformers (CT) and voltage transformers (VT) directly located in the switchyard deliver cur rents in ranges from 0 to 1 A or to 5 A, respective voltages in the order of 100 or 200 V AC Voltage transformers are sometimes also called Potential Transformers (PT). • Switch positions: Auxiliary switches are mecha

nically connected with the main contacts. With the help of the station battery (auxiliary voltage) of 1001110/220 V DC they deliver binary information to the SA system. A switch position is normally indicated by two contacts: one is closed if the switch is closed, and a second one is closed if the switch is open.

I

1.

.I

6.2.1.1 Instantaneous analog process inputs (current voltage)

This double indication shows a moving switch in the so-called intermediate position if both contacts are open. For disconnectors and earthing . switches it is physically impossible that both contacts are closed at the same time in normal operation, so this must be regarded as an error. The same is true for the intermediate position, if it lasts longer than the switch movement tirr,e (often called running time). For circuit breakers in high voltage switchyards often each of the three phases has its own drive. It may then happen that one phase is in a different state than the others (phase discrepancy). If the contaQ:s of the phases are connected in parallel (logic OR) to get one double indication again, then the 1-1 state may happen, and may be cleared e.g. by an open command. If however this state lasts too long or can not be cleared, then again this is a serious error (permanent pole discrepancy). • Other indications or alarms: Similar auxiliary switches like for switch positions are used, but each indication has one contact only: single indication. • Commands: Tripping or closing coils have to be supplied with power. Again normally a process auxiliary voltage in the range of 1 00/110/200 V DC is used, and up to 1 A currents have to be switched by the auxiliary contacts.

·

J

For other physical quantities special sensors are used, which normally deliver proportionai outputs in the range of 0...20 mA or +-10 V DC Other ranges (e.g. 0...10 mA, 0... 20 V) are also sometimes used. For sen sor failure supervision 4...20 mA is also often used, where 4 mA corresponds to a physical value of 0, while 0 mA indicates that the sensor has failed, e.g. because of a broken wire. These electrical quantities have to be fed into the SA system, and there encod ed into binary information, which is suitable for fur ther processing.

The analog process inputs are transferred to a sui table signal range by appropriate signal transformers, which additionally provide the galvanic isolation from the process. The analog signals are filtered by an anti alias filter, which suppresses multiples of the sampling frequency, and finally converted to binary samples by means of an AID converter (Figure 6-3). Also high frequency damping filters are sometimes used to suppress disturbing spikes, depending on the func tion to be performed. After this conversion further fil tering with digital filters is made if necessary. Important criteria here are the .accuracy of the AID conversion related to the measuring range, and the sampling frequency, which may possibly influence the functionality that is based on the signal data. Both, amplitude and phase relations are needed. If different phases must be compared, then they need a time synchronization accuracy in the order of some micro seconds, providing the accuracy needed by the func tions considered. A timing jitter of 25 [!S leads to an accuracy of about 2 %. The information content of samples may be also represented as phasors, i.e. as a value with an amplitude and a phase angle with the same accuracy.

6.2.1.2

In pure control systems, where only RMS values of currents, voltages and power values are needed, dedicated measurand transducers are sometimes used to preprocess and calculate the needed values from VT and CT inputs. They deliver the needed analog qu9ntities to the control system either via some serial link, or as mA or V signals similar to e.g. pressure sen sors.

6.2.1.2 inputs

Other

analog

Because of electromagnetic disturbances the mA or Volt inputs have to be galvanically isolated, e.g. by iso lation amplifiers (Figure 6-3), before they can be fed directly to an AID converter. The needed sampling rate is normally much slower than for the voltage and current inputs. Very often sampling is done directly in the application function. Examples are the so-called PT sensors for temperature with different characteristics (PT20, PT100, etc.).

97

6.2.1.6

Most of the sensors have a linear characteristic, but for some of them a non-linear characteristic has to be applied to get the correct physical value (non linear scaling).

6.2.7.3 Binary process inputs The process voltage, which indicates either an open or a closed contact, is normally connected to optical couplers for galvanic isolation (Figure 6-3). Thereafter a discriminator determines the 0 or 1 state. Note that the 1 state may denote a closed contact (normally open, NO-contact) as well as an open contact (nor mally closed, NC-contact). The contact inputs may be grouped to double indications or, e.g. in case of trans former tap changer position, to multiple indications representing digital numbers. These digital numbers may be binary coded, BCD coded, or even have some other code like Grey code. The appropriate decoding has to be made in the substation automation system e.g. by the tap changer controller.

may happen. An often-used solution is reading back the state of a second contact which is mechanically coupled to the operating contact. With this contact arrangement, the proper functioning of the control circuit can be supervised by conducting operation simulations e.g. once a day without activating the operating coils. Usually, a contact has to separate each side of the operating coil,-so that in normal state the coil is com pletely isolated. This assures that even a short circuit cannot lead to unintended switching (Figure 6-14). Several contacts in series lead to additional time delays. For protection trips, which must be fast, there fore often only one heavy-duty relay (contact) is used. These single command relays are then over-dimen sioned to get a very high reliability. This applies only for circuit breaker opening, which is not considered as unsafe as other switching operations.

6.2.

7.5

Other

binary

outputs

6.2.

7.4 outputs

98

Binary

process

Binary command outputs to the process are perfor med via relays whose contacts can directly switch the trip/close coil currents, so called heavy-duty contacts (Figure 6-3). The problem here is that these contacts may burn or melt together, if they switch relatively high currents. These command outputs are safety cri tical. because an unintended operation of a switch may cause physical damage or endanger human beings, which happen to be nearby the switch during opera tion. To minimize the risk two separate output chan nels that are connected in series must be used to supply the operating coil current. In line with the for mer RTU based solutions one is called the Select channel, which selects the switch, and the other Execute channel, which switches the load current. Both contacts have to be supervised, so that a relay (contact) failure is detected before any second failure

Other binary outputs may be provided for local or remote state and alarrn indications. For these outputs signaling relays are used, which are normally not safety critical and must switch only low currents in the mA range. They may however also be used to ope rate the heavy duty relays mentioned above to provi de an additional barrier against electromagnetic inter ference.

6.2. 7.6 outputs

Analog

For analog outputs normally + -10 V or +- 20 mA outputs are used. If an EMI barrier is Jlecessary, addi tional separating amplifiers are provided. In a modern sutslstation, there is normally no need for analog out puts, as mostly serial interfaces and LCD or Led based displays are used.

..

•

6.2.1.7 Analog data from unconventional sensors Unconventional sensors for voltage and current are not based on the magnetic transformer principle but on electro-optical effects. Their output is either an optical amplitude or the plane angle of polarized light modulated according to the AC voltages and currents from the electric power process. Semi-conventional devices are capacitive voltage dividers providing a small voltage signal proportional to the AC process voltage. Rogowksi coils provide di/dt according to the AC process current and need an integration algo rithm to obtain the current signal. Common to all these sensors is that they do not provide the com mon signals of the order of 1 A, 5 A, 100 V. or 200 V, partly no electrical signals at all. Converting the out puts to small electrical signals as defined in IEC 60044 is possible, but small signals are both subject ed to electromagnetic interferences and not compa tible to conventional lEOs e.g. for protection. To over come these problems, the most convenient way is to provide these signals as telegrams over a serial

•

6.2.1.9 Binary process outputs to unconventional actuators

6.2. 2

link (optical process bus) as foreseen by IEC 61850. As a result, these values are already EMI proof, pre filtered (at least for anti-aliasing) and AID converted. The new requirement is an adequate serial interface in the IEDs for protection etc. The same holds for all other analog input?.

6.2. 1.8 Binary data from unconventional sensors Also binary data may be produced by sensors as optical or low level electrical signals not fitting into the 110/220 V DC scheme. The most convenient way again is to provide these signals as telegrams over a serial link (optical process bus) as foreseen by IEC 6 1 8 5 0 .

The principles of unconventional actuators integrated into the switchgear are very dedicated depending on the type and design of controlled equipment The common interface is again the serial link (optical pro cess bus) as foreseen by IEC 61850. All safety meas ures must now be handled by the actuators themsel ves and their controlling electronics.

6.2.1.1 General remarks

0

Conventional process interfaces, sensors and actua tors, input and output are harmonized by standard ized common current and voltage levels. Unconven tional ones have to be harmonized by standardized communication protocols like IEC 61850. As interme diate step e.g. for retrofit, signals from conventional sensors and actuators may be converted directly nearby the switchgear and the resulting data trans mitted as for unconventional ones.

6.2.2

Preprocessing of

data 6.2.2.1 processing data

Prebinary

Binary data is used for two different purposes: show ing the current state e.g. of switches, alarms etc., and logging of occurred events for later fault analysis. For the second purpose, a time stamping resolution of 1 ms is required. The time stamping accuracy de pends beneath this resolution also on the device internal time stamping accuracy as well as on the time synchronization accuracy between different devices. In prindple this time stamping accuracy should therefore also be 1 ms. The accuracy is however very cost sensitive. Depending on the purpose, accuracy up to 10 rns may be considered as sufficient for some functions.

99

6.2.2.1.1

Communication Interfaces

Process Interfaces

Line bay

... 1-r-1 • ... [][] ...

f1 . . Bl

Local MMI

B O

AI

Bl

..

•

81

I

,-,-:I

•SA

..

..

•SMS

Intelligent electronic device (lED) for protection and control

Bl Binary Input BO Binary Output AI Analog Input Fl Filter AD Analog/Digital Converter

Figure 5-3 Process connection to a typical/EO

6.2.2.1.1 Debouncing

Sensors for binary data are often contacts, which may bounce for several milliseconds. Also mechanical vibrations of short duration caused e.g. by circuit breaker operations may sometimes lead to contact bouncing. In order to avoid wrong position indica-

tions, these contacts need debouncing, but without jeopardizing the time stamping accuracy. This is nor mally achieved by taking the slope of the first change for time stamping and then waiting for some time whether the new state gets stable. If it becomes sta ble, then the earlier time stamp is further processed with the new state. Otherwise the time stamp and

Figure 6-4 Principle of debouncing

- -----

-

-----

f

No change of position

; lv 6

\jC

Auxiliary contact

Position has changed

v

VA\ 100

Time stamp

Time stamp

•

Time

the change are suppressed. Figure 6-4 illustrates this method. It has to be noted that it causes an additio nal delay for the communication of the change of state. If a fast reaction is needed, contact debouncing should be avoided. It must however be kept in mind that even for an optical input debouncing cannot be avoided if the source in the process is a mechanical contact. 6.2.2.1.2 Oscillating Some process phenomena like waves of lake water actuating special contacts for water level indication may lead to oscillating, i.e. repeated opening and clos ing of the contact within a time span of 100 ms or even longer. The oscillating may also be caused by a broken wire of an input signal, which flatters due to air circulation. These changes may lead to unneces sary load of the communication system as well as unnecessary triggering of processing functions. Oscillation should therefore be suppressed, but an nounced to the operator. This feature is called anti oscillating or oscillation suppression. It is often imple mented by counting the changes within a fixed time interval. If this counter reaches a pre-set limit, the oscillating state is set, and the communication as well as the processing of any further state changes are suppressed. If the counter value declines below this limit (plus sometimes an additional hysteresis value), the oscillating flag is reset and new values are sent and processed again.

6.2.2.2 Pre-processing of analogue data The preprocessing of analog values after the conver sion from analog to digital data depends on the kind of value, and the purpose. As already stated in 6.1.1.1, the prerequisite in each case is that the analog inputs pass through an anti-alias filter in ordei to prevent any negative impact of the sampling frequency. The current and voltage samples are stored into a buffer. Different filtering algorithms may be applied to

this buffer depending on the kind of function, which has to rely on them (mostly protection). These fil ed values may then be used by the various functions. A common application for measuring purpose is to cal culate voltage and current RMS values, frequency, active and reactive power, as well as the power fac tor COS!p.

6.2.2.2

The measuring process at a certain point in the pro cess possibly leads to a calculated value like the RMS values mentioned above. This value at a certain point of the process, or sometimes this point itself is called measurand. The following general measurand hand ling functions refer to electrical measurements as well as to non electrical measurements from sensors or transducers, but normally not to the raw sampled values, which are handled specially e.g. by protection functions. 6.2.2.2.1 Scaling The measurands coming from the AID converter are some integers, depending on AID converter accuracy between 8, today mostly 12 up to 16 bits wide. Application functions need an application value in some engineering unit. The conversion of the inte gers to engineering units (e.g. Volts or Megawatts) is called scaling. The resulting value then normally has a floating-point data type. Sometimes also calculated values have to be scaled. A power value calculated as U * I* cos IP might already have a floating-point for mat, but has to be normally scaled to the MW range. The scaling process has to consider the converter characteristics across the converter measuring range. Most converters have a linear characteristic, but not all. Therefore, in special cases also other than linear conversions might be necessary. Linear conversion is mostly performed by providing an offset b and a factor a, so that the scaled value s (floating point) can be calculated from the measured value m (integer) as ·-

s =a* m +b. If the communication capacity is small and the value must be transmitted as compact as possible, the sen der scales the value down to a minimum number of

101

6.2.2.2.3

digits for communication, and the receiver scales back to the engineering units. If the communication capa city and processor capabilities are not an issue, then scaling to floating point values is performed as near to the process as possible, i.e. immediately after AID conversion and measurand calculation. 6.2.2.2.2 Limit supervision and dead band suppression The obtained measurands as well as other measur ands coming via transducers can be supervised on warning or alarming limits. Normally two limit pairs (warning and alarm) can be defined for each measur and, each pair consisting of a low and a high limit. If the measured value crosses the limit, the value gets an appropriate warning or alarm state attached. This may also be logged by a time stamped event. Measurands are often oscillating quite a lot. If this happens near an alarm limit, this may lead to a flood of events, which can be reduced by defining a hyste resis value. If once an alarm state is reached e.g. by crossing a high alarm limit, then it is only reset if the measurand value is lower than the hysteresis value below the alarm limit. This is illustrated in Figure 6-5 . In case of voltage supervision e.g. on an overhead line, normally the voltage should be kept within a narHigh alarm Hysteresis

Value

.·-7 ---------- --······-···--···-··-------·--------

1/ -·-- ..:-: -. -·-------- - C7\•----------------. -- ---·- --- --·---

High warning

-·--------- - --------- ------------ ---·- --

1 ---,.,...-·---- --

-- ·-·-·-·--···-·-- --···------- -· ---------

-- -------------------- - ------- 1':-:-:...- -

Low warning ·

Low alarm Zero deadband

Time Warning

102

Alarm

W

w

Alarm

w

Figure 6-5 Measurand limit supervision with hysteresis and zero deadband

row range around nominal value of the line voltage. If the line is taken out of operation, the voltage value becomes zero. As this is below any low voltage limit it would lead to an alarm, although it is a normal ope rating state. Therefore the alarm handling is mostly combined with a zero dead band suppression. A configurable range around zero can be exempted from the alarm zone, even if the value zero as such would be within an alarm zone. 6.2.2.2.3 Oscillation suppression for communication The same cause of frequent measurand value oscilla tion that leads to the introduction of the limit value hysteresis might create flooding of the communica tion system with measurand values. Appropriate filter ing before sending is therefore needed, but without sacrificing the measurand accuracy at the receiver. The simplest method, only sending if the difference between the new and last value sent is bigger then some parametrizable delta value, very often jeopard izes this accuracy to reduce the communication load. As an advantage it makes a hysteresis on limit super vision superfluous. Other often-used methods are the following: • Cyclic sending with cycle times between some seconds up to some minutes, depending on how often an accurate measurand value is needed by the receiving function: the measurand is accurate at least at the time it has been sent (in the order of the measurement input chain accuracy). • Summation of the absolute changes with a samp ling rate of 100 ms up to 1 s. If this sum reaches a parametrizable delta value, then the last actual value is sent, and the delta sum is reset to zero. This method reacts fast on big changes (in the order of the sampling rate), and values with better accuracy are sent more often due to the absolute sum of deviations. The product of time (measu rand age) and value change stays constant. • Combination of both of the methods mentioned above, mostly together with a large time cycle. The cyclic sending allows bigger delta values with out obtaining too 'old' values at the receiver end, . '

and assur es updat ing even in the case of mess age losse s.

6.2.2.2.4 Measurand Accuracy

The accuracy of a measurand depends on the accu racy of the whole chain from the sensor up to the measurand application, e.g. an application for display or storage. In earlier times the small communication bandwidth allowed to use only the minimum num ber of bits that were absolutely needed for the trans mission of the measurand value. Today the sensor is often the most determining part of the accuracy chain. However, when considering the purpose of the measurand, the 'age' is as important as the accuracy of the actual value, as already mentioned in the pre vious section. A typical measurement chain for an RMS voltage measurand in an SA system looks as follows:

It must bkept in mind that the calculated quantities derived from several measured values normally have an inaccuracy range in the order of the sum of all the inaccuracies. This is valid for sums of values, but also a good estimation for products and divisions, if the contributions othe individual values are in the same order of magnitude as the final value. Therefore, in ths linear conversion chain the maxi mum inaccurac/ results in the sum of all inaccuracies; which is for this example around 0.706 % at nominal value (0.5 + 0.1 + 0.006 + 0.1).

Function/Device

Accuracy

.Comments

Instrument transformer: transforms kV to range of +1-200 V

Relative accuracy at nominal value 0.5 %

Ar accuracy of 0.5 % in average, is normally use:: for plausibility check of measurands me·;: details see in chapter 5.

Interposing transformer from 200 V to 10 V

Relative accuracy at nominal value 0.1 %

Ac-l5 as barrier against disturbances as ::ell

Filter

Influences frequency range only; no influence on the RMS value.

AID converter 16 bit

Conversion inaccuracy can normally be neglected. The inaccuracy depends on the bit range that is used for the measurand range (e.g full 16 bit signed used for needed range = > accuracy is 2·14 = 0.006 %)

An 3 bit measurand (either for transmission, or r'om AID conversion), leads to an accuracy of 2.5 %, a 12 bit measurand (11 bit + sign) to 0.25%

Scaling

Can be neglected, if the result is a 32 bit floating point (accuracy better than 16 bit integer)

32 bit floating point has a mantissa of 24 bits -

Communication oscillation suppression delta

Depending on the delta: to get a sufficient communication load reduction, often around 0.1 % of the measurand normal/nominal value is needed

The inaccuracy of cyclic sending is zero at the moment of sending. If the maximum change rate of the measurand is not known, no accuracy can be estimated in between.

6.3 Operative Functions

6.3

6.2.2.2.4

Operative functions are all those functions, which directly enable an operator to control the substation. These are the typical SCADA functions: Supervision, £:ontrol nd Qata cquisition. The data acquisition part of SA systems contains some

substation specific functions and performance attributes, which are nor mally not needed in standard industr:al SCADA sys tems. The same applies for the specific and safety related switch control functions. If a network control center remotely controls a sub station, then with the exception of the

103

comm a tion the n contro center the toring data acquis functio SCADA might implem

d at the substation. This monitoring part could be completely implemented locally with the possibility of remote operator access to the sub station data. Another possibility is to have only the data acquisition function implemented at the substa-

tion, and the HMI and archiving related functions are located in the remote control center, which might cover a number of substations. For special purpose applications like asset management even a separate remote monitoring center can be used. The following sections describe the operative functions in detail.

6.3.1 Monitoring functions

and supervision

The main purpose of monitoring and supervision func ti o n s is • to show the state of the process, i.e. the switch yard and the control system itself,

Il • ·'

j·.i

I·!

l

• to inform about the development of possible dangerous situations and, • to archive data for later evaluation either of the process performance, or for later failure analysis if some failures or dangerous incidents have occurred. All those functions except disturbance recording are standard SCADA functions, i.e. they are not specific for control of substations, although some of their pro perties like time stamp accuracy of 1 ms are specific for power system applications. Figure 6-6 Process state single line diagram for local substation operation and supervision

Incoming feeder(=EO1) BB1 .

BB2

Tr 101 (.

E02)

··;<

· '•' ':; 'Tr 102 (aE03) I

..... ,...."

Gl1':-':···:"

>:·,Q1_, ' . \

i

104

'

The typical monitoring functions are • Event management • Alarm management • Data storage and archiving • Disturbance recorder/fault data retrieval • Log management

6.3. 7. 7 Process state display There are different methods to browse through the process state of a system: Zoom and pan: one can move a window across a

virtual picture of the whole system (panning) and can zoom in an area to see more details, or to get an overview out of an area respectively navigate to an other (sub-)area. This is typically used for big systems or geographical views in a geographical information system (GIS), and mostly if one wishes to navigate into a neighboring area.

Hierarchical windows: starting from a high level overview window showing the complete system you navigate with a mouse click to windows showing the wanted subarea of the system with more informa tion details. This is typically used if geographical neigh bourship is not so important. but you need fast navi gation to any subarea or even specific information categories, and information condensing to higher levels. It is easy to change the way of presenting infor mation in different layers of the hierarchy

6.3.1.1

The following examples Illustrate the hierarchic win dow approach. The actual state of the whole switchyard is shown in a graphical overview, and in more detailed pictures by

Figure 6-7 Process overview example of a small system with busbar coloring Main

Oplions

Reporls

Sialions

Help

L Monday (W7) ;! I= · *= UWBaden - ---··----· --------- - -- ---------·--------- _:_ _ .... -- -------:

1'02

f"item<1

·I:J:IIl i

---- 1 -- ---o

I

v v

I1

I

D

-

.. ·.·,

•

D·

105

.T

means of a single line diagram that contains all sub station equipment (Figure 6-6) This state typically comprises

6.3.1.3

• Positions of switches (circuit breakers, disconnectors, earthing switches etc)

or earthed. Apart from this, the different voltage levels can be distinguished with different colors, or parts of the substation with different power infeeds can be distinguished by appropriate colors (Figure 6-7).

6.3.1.2 Process overview display

• Voltages (kV) and currents (A) at busbars: lines, and transformers

In contrast to the state display showing the state of one voltage level in detail, the overview display provid-

• Active power (MW) and reactive power (MVAr)

Figure 6-8 System configuration d1sp/ay for a small SA system

The single line diagram may be enhanced by a bus bar coloring function to show in different line colors whether a part of the switchyard is under voltage, not energized,

e s a n o v e r v i e w o f

the whole substation. Only the schematically connected power sources, loads, and the power flows are shown. This may be combined with a busbar coloring function as we:l. One can also combine the overview display and the process state display by means of zoom and pan functions in the HMI. It should however be considered that some overview data is normally not displayed on detailed pictures and vice versa. Main

Options

--·------------------- --

<111..

Reports

!17-01-28 14:59

Supervision Ack.

6.3.7.3 System configuration display The system configuration picture displays the state of the control system itself. In the case of missing data it allows the operator to find the reason of the pro blem, e.g. a faulted secondary device or communica tion link. It shows (group) alarms on device or com munication line level, and allows to go from here deeper into detail alarms. It further allows to modify the online state of the control system, e.g. for main tenance, and to retrieve diagnostic information from the devices. This display is specific for the actual system (Figure 68). Sta!Wns

Help

Tuesday (WS)

!

*

•

System

Alann P7-01-lB 10:12:32'

E :.Quiiioin& HA7

Q9 Ear11uw. pom!Wn indica!Wn

:!:

L o c a l A r e a N e t w o r k ( L A N )

I M a l r i x P r i n l e r

106

SPAD346C

J

'' ·

--

6.3.1.4

Figure 6-9 Typical event list

6.3.1.4 Event handling

list

and

The event list contains a time stamped log of all events that have occurred in the system in chronolo gical order (Figure 6-9): • changes

State

• Alarms appearing disappearing • Limit violations

and

• Operator's actions: commands and acknowledges etc Each event can be directly printed O!,!t on a log printer (logger). It contains the time when the event happen ed, an identification of the object (device or signal) to which the event belongs, and the specific signal state, which has been caused by the event. Sometimes there are different log printers provided for system

and process events, or for different parts of the pro cess. In modern systems this feature is however sel dom used because of the availability of highly reliable disks of big storage capacity. This avoids the problem of running out of paper, which is by far more often a problem than loosing some events on the disk. Due to restricted storage capacity, the event list is often kept in a ring buffer. If the ring buffer is full the oldest events are overwritten. New events must never be lost, even in the case of power supply failu re. Therefore, all events are also stored on nonvola tile storage media. The high capacity of modern sto rage devices allows to keep much more events than in the past. Nevertheless some, at least today manual, overflow management, e.g. with yearly transfer to a tape or CD, is necessary. Other external applications

107

for specific data evaluations should also have access to this data e.g. for maintenance or planning purpo ses.

6.3.1 .5

The display function for the event list has often incor porated filtering capabilities. In case of a failure only those events are displayed which have occurred in

the fault related time window or are identified by a fault expert system. For power failure analysis a time stamping resolution of 1 msec and accuracy between 1 and 20 ms is need ed to assure the chronological order of the events. For power network failure analysis the same accuracy is necessary between different substations. Therefore, substations are time synchronized by means of satel lite clocks like GPS or as often in Europe by radio clocks like DCF77. In addition to this, the control system must contain special means for time synchro nization of all its devices. Figure 6-7 7 Typical alarm list :E6 (1) • MicroSCAOA

I!!I Ef

108

k7 ,8

....------.._

'" Alarrr. comes Alarm goes

s

Alarm com Acknowledge

4

Figure 6-7 0 Alarm acknowledgement state transitions

6.3. 7.5 Alarm annunciation and handling Alarms are generated if a system state requires the at tention of the operator. The operator has to acknowl edge the alarm to indicate that he has noticed it.

·

'(

'?

?

control system related alarms have to be separated from switchgear related alarms.

An alarm has the following states (Figure 6-10): • acknowledged • unacknowledged • Alarm, alarm)

Normal, Alarm,

acknowledged

(persistent

• Normal, unacknowledged (process alarm state disappeared, pending alarm) The last alarm state is also called a "transient" or "fleet ing" alarm, as the process alarm state disappeared before it could have been acknowledged. A change from unacknowledged to acknowledged should only be made by an authorized operator. The purpose of alarms is to alert operators either by activating a horn, flashing lights or symbols on a screen etc. If an acoustic alarm is triggered, then its acknowl edgement only quits this acoustic alarm, but does not acknowledge the single alarm(s) causing it. If a substation is unmanned, alarm occurrences can be sent by E-mails or SMS to the operator in charge, or pagers can be triggered depending on urgency. For availability reasons this is sometimes done via special tele-alarm systems. In order to assure an immediate recognition of alarms they are shown on process displays additionally to the alarm list. These alarm overview pictures are mostly substation specific. The alarm list however is a standard representation, which contains an entry for each alarm. This entry shows as a minimum the time when the alarm happened, the alarm descrip tion, and the current alarm state. The alarm list has similar filtering capabilities as the event list, and addi tionally allows acknowledging alarms (Fig. 6-11). Special additional alarm attributes like alarm classes, priorities or sections provide additional filtering possi bilities. They are needed especially in cases where one failure would cause a lot of follower alarms, or where

The hierarchical grouping of alarms into function or region specific group alarms together with the priori tizing and filtering provides a quick overview in case of floods of alarms occurring. These group alarms can be shown on the process overview, process single line pictures, or on customer specific alarm overview pictures.

for operator information, plausibility checks and statistics. Instruments, which measure power for metering and billing purposes, must fulfill certain legal requirements to assure correct measurements and to prevent manipulation. The same applies for the data acquisition chain from the instrument transformer up to the billing application. One of these legal require ments is that data used for billing must be archived for some years. Another requirement is that the metering process must be certified by legal inspec tion to prevent manipulation in the course of the acquisition of the metering data, i.e. it must be sealed in some way. A new challenge for the metering business are the unconventional sensors. The solu tion may be extra channels for metering or, more convenient, special coding for meter data on the common communication system.

6.3.1.7

6.3. 7.6 Measuring and metering The ultimate objective of the normal operation of the power system is to supply power in the most cost effective way. The analog data from the process not only shows the current state of the process, but also provides the input for load and power consumption profiles. For billing purposes the amount of the power delivered needs to be measured. This function is call ed metering, in contrast to measuring, which is main ly used

6.3. 7.7 Blocking list There are various situations during operation when it is necessary to block operations. • For maintenance work it may be necessary to block down-going commands. There are special measures available as described in 6.3.2.1. Nevertheless, sometimes an explicit blocking is needed.

• In special failure situations it is necessary to block up-coming process indications or measurands. Some of the automatics for this have been described in 6.2.1.3. Also here sometimes addi tional explicit blocking is needed. 6.3.1.7

• If a mess is printed, or a printer is defect, then explicit blocking of printers is necessary. • For some maintenance activities the blocking of communication lines may be necessary by taking them out of use. For all these explicit blackings there should exist an oveNiew showing which blackings are currently set because at first each blocking prohibits some func tion, and second it is normally set because of a pro blem which should be fixed. For this reason there

109

exist graphical blocking oveNiews and blocking lists. For process devices any blocking is mostly also shown in the process diagrams like bay single line diagram with some mark. latest however in the operation dia log. The blocking list provides a tabular oveNiew of all blocked objects, and enables to de-block them. It has similar filtering criteria as the alarm and event list. However, normally its contents should be short, so that filtering is not necessary.

Figure 6-17 Disturbance record with fault evaluation report

l!!lr.J £I

lndactic 650 \1/iE ve 001030.FLT

File Opliom 'w'"ndiiw , Help

lillf!t u t (rns]

·200

fitir'":":'•

Jt'l';r:t;t"al-r:ilj]::=1.

0

l fi@j§t;JitiAII .!IillJ.@ Page Width 200

-.-----

400

§P 001030.FlT

1!!1£1

Automatic Fauij Location

1. Event:

I

. Station name

Station Event date and

r- - -- -- - -- -- - -- number

Event number Line name Line length Event file ; Duration of recordmg

Ut(t)

I I

••

time

I

2. Trigger Type of trigger (3) Trigger

FLT2.0ff i

= Preda (31)

=I = 11-Jun-1918:55:44.410 = 30 = Preda (31) = 94.5 km

= C:\1650\EVENTS\001030.EVE

= 1029.2 ms (-200.0 ms .. 829.2 ms)

= Digital signal

=?

mr .;......------"'--"'-' -1-llll·-----

signal 3. Faul1 Location: , Fau11type = R- 0 , Fault duration = 70.8 ms (-28.3 ms .. 45 ms) i Region with stable impedance, variations<= 3.1 % - · - · - Impedance at16.7 ms = 8.43 Ohm, 71° primary ; Distance to fault = 24.7 km (± 3.1 % = ± 0.8 km) , Faul1 resistance big, about 24 % of total loop resistance

110 I

l.

6.3. 7.9 Archiving

Certain process conditions may also cause the blocking of control, e.g. if the gas pressure on a GIS circuit breaker is too low for safe operation it is . blocked. The blocking list described above, however, only concerns manual blackings out of operative rea sons, and not those that are caused by the process conditions. Process condition related blackings are indicated in the alarm list.

6.3.7.8 Disturbance recording The disturbance recording function records the instantaneous values (samples) of the currents and voltages to visualize fast analogue changes around a failure (trigger) for later analysis of network problems (Fig. 6-12). In some way it is the analog equivalent to the binary event log. It stores analog data sampled with rates of 600 up to 20 000 samples per second, depending on the time resolution required. Because of the fast response time and high data throughput required, the recording is normally performed near to the process, and directly after AID conversion of the analog data. In addition to the analog values, also sta tes of binary signals are sampled and recorded in pa rallel input channels if applicable. · The analog and binary values are constantly sampled and written into a ring buffer. As soon as a predefined event like a fault has triggered the recording function, the recorded data around a time window before and after the trigger is frozen in the buffer. Thereafter, another buffer is activated and the procedure is restarted for a possible next recording. This continues until all memory buffers are full. In order to avoid loss of recorded data the files have to be retrieved and stored somewhere else, e.g. on a station level hard disk or transmitted to a remote substation monitoring system. A standard storage format of this data on disk is the COMTRADE format (IEC 60255-24 resp. IEEE Std C37.1111999). Dedicated evaluation soft ware is used to view the recordings and to conduct fault evaluations like the determination of the dis tance to a line fault to ground.

Event logging and disturbance recording files are used in conjunction with archived fault h1story for fail ure analysis. Additionally, also the power system per formance during normal operation can be archived for performance analysis and planning purposes. Typical information for this purpose is the consumed power per minute, hour, day or even longer, trends of power consumption, temperature profiles etc This archiving activity is done either cyclically or event dri ven in so called history buffers. Here also the problem of restricted storage place has to be considered in some way, e.g. by means of data condensing hierar chies like minute values per hour, hourly values per day, daily values per month etc. Other, more sophisti cated compression methods are also applied, e.g. linear approximation of the curves within a predefin ed accuracy bandwidth.

6.3.2

The archived data can be used to create reports and trend diagrams, which can be shown on the screen or printed as hardcopy. Apart from this, dedicated evaluation programs needed for special analysis tasks may require a data import/export function with a standardized format for the data exchange between the substation automation system and these pro grams.

6.3.2 Control Functions Control functions are used for the normal day to day operation of the substation. They are performed via an HMI (human machine interface, e.g. screen and keyboard) that is located either locally in the substa tion or even in the bay, or remotely at a network con trol center. The HMI presents the process state to an operator and enables him to control the process (Figure 6-13). The response time of the operational functions and the correlated communication is typi cally a second (human reaction time scale). It is often distinguished between monitoring and supervision functions thaf retrieve data from the process for per formance analysis, and the control functions that initiate actions on the process. Nevertheless monito ring and process state display is the prerequisite for conducting substation control.

111

. ?

6.3.2.1

t- -_.

Cancel j


·: -><:?:

:o.-f'X

:,

...Trl02

I

·iiiiW Figure 6-7 3 Human Machine Interface (HMI) for SIS control and monitonng

Commands that directly control the process can cause severe damage if they are issued wrongly. Therefore, control functions have to be protected against unauthorized access, and safeguarded that no dangerous and unnecessary or unprompted com mands can be issued. Examples of such safety related control functions are: • Access control and operator identification • Operative control

mode

• Control of switches (commands and back-indications) • Control of transformers (raise/lower commands on tap changer, tap position) • Management of spontaneous change of positions • Parameter setting

112

6.3.2.1 Control management functions The operator's access to functions, especially to ope rational functions, has to be restricted by a set of rules, which are defined in the access security mana gement as indicated below. They concern human user's access only, while the access security between the different devices is handled at system configura tion time. The Authentication: The control system shall sup port user authentication for user access in order to ensure that only authorized users are permitted to use the application. The user authentication process allows the system to differentiate between user res ponsibilities and roles (for example substation opera tors, administrators, maintenance sta1t, etc) and then to select role specific access rights. Under certain cir cumstances, e.g. for sensitive information retrieval or high security control an encryption procedure may be used in addition to authentication.

• A create privilege allows the user to create certain classes of application objects. • A delete privilege allows the user to delete application objects.

Access control is a function that provides the capabi lity to restrict an authenticated user to a pre-deter mined set of functions and object properties. Access control is implemented using the following privileges: ·

• A view privilege allows the user to acquire details concerning the existence of an object and the object definition. • A set/write privilege allows the user to set attribute values of an object.

I I

i

I

I.

I

i·

• A g et /r e a d

pri vil eg e

allows the user to get attribute values of an object. • An execute privilege allows the user to execute the permitted application service. Each system function and system object may provide access types for user roles with an allocated set of access rights. The sets of access rights may be defin ed by: • The type of action: e.g. control of the process, control

of the system, maintenance of the system,· etc • The area of expertise: e.g. operation,

protection, control. etc. • The level of competence of the user: e.g.

manager, substation operator, administrator, etc. • The concerned part of the substation, when a substation controlled by one system is shared by different utilities: the bays or diameters, equipment. or voltage level concerned. Access control privileges may be altered dynamically to resolve conflicting requirements of multiple users. Control can be performed at a lot of places in the system, on various system hierarchy levels as well as on multiple work places at the same level. The

lowest level is the primary equipment itself, the next higher ones are the bay and the substation level or a remote operator place for the substation, and the upper level might be one or more remote network control centers. The access from these control loca tions must be coordinated for safety reasons. Allo cating the higher access priority to the level that is clo ser to the process normally does this.

6.3.2.1.1

An operator at bay level is authorized to take over the right for bay operation by putting the bay into the local mode, e.g. by physically turning a key locked local! remote switch into its local position. This auto matically blocks commands from higher system levels in the control hierarchy of this bay, e.g. from substa tion level or network control centers. The same pro cedure is applied on all hierarchy levels. In addition to this, a split of the control system into certain regional sub-systems is possible. If an operator takes over the responsibility for a certain region, this blocks all the other operators on the same hierarchical level to con trol that region. This may happen dynamically, in con trast to the statically allocated access priorities de scribed above. For synchronization purposes on the same level it may be sufficient if the initiation of a control action e.g. by selecting an object blocks all other control actions. 6.3.2.1.1 Control functions

Control functions are either used for directing the power flow during normal operation of the substa tion, or for maintenance of some primary equipment They enable the operator or an automatic function to control the controlled object like switchgear or trans former and any auxiliary equipment in the substation, i.e. to: • open or close a breaker, disconnector or earthing switch, • raise or lower a transformer tap changer, • set a low voltage (LV) equipment to ON or OF-f. For safety reasons the controi functions normally include a "Select" step before the "Execute': to check whether the control action is valid and the correct device has been selected, and to eventually res rve the required resources.

113

'.l

6.3.2.1.2

The "Execute" command is subject to miscellaneous conditions that assure that there will be no damage if the control action is conducted: • Correctly working control device. The self

superJision of the control device will detect failures and block the control function if necessary. • Interlock validity. Interlocking is a parallel

function that delivers a state to enable or disable a control action. The control circuit may contain an interlock override switch (hardware or software) for manual control in interlocked condition. • Synchrocheck validity. When closing a breaker,

the synchrocheck function will verify voltage synchronism before the breaker is closed. This function may also be overridden in certain cases. • Locked (blocked) state. A controlled object

may be locked if the associated part of the substation has been put into the maintenance mode. This for example prohibits any control of the breaker if some repair work is carried out on the line. Note that locking an object is also a control action. • Control privilege. This privilege of an

operator is checked if he wants to control an object. • Substation and bay mode. The substation

must be in the remote mode to enable control from remote (i.e. from network control center) or in the local mode to enable control from the substation level. The bay mode must be in remote mode to enable control from the station level or from the remote control level. · • State of the controlled item. The control

114

action shall be physically possible without causing damage, i.e. sufficient gas pressure in a GIS switch and sufficient stored energy is available to perform · the Intended operation successfuiiy. It shail further be assured that the controlled object has a valid position for the intended command, i.e. it must be impossible to initiate an "OFF" command on a disconnector that is already in the open position.

If the controlled object is in an unknown state (e.g. phase discrepancy which causes a double point state with 1-1 value) the object has to be tripped and blocked. This last check can be suppressed if the object has one common operating mechanism for all phases. The control command is cancelled if one of these conditions is not met, or if a cancellation order is received form the control point. Figure 6-14 illustrates where on the control path which conditions are checked. 6.3.2.1.2 Control dialogs

Control dialogues are used to open and close all kind of HV or MV switches. They are aiways performed as a two-step process with a select and an execute phase. They mostly are initiated at station (HMI) level as shown in Figure 6-15, from there the commands are sent across the communication link down to bay level, and then from bay level to the process (Figure 6-14). For safety reason it is a principle, that a command within the dialog shall only be allowed, if all condi tions as described above are fulfilled. This means that de-blocking is only possible for a manually blocked command, for a command that is blocked by the pro cess de-blocking can only be made (if at all) by an override. Some process conditions are only checked if the switch is selected for operation. In this case the ..Select" step might be allowed, but the ..Execute" command is later blocked, so that normally only a cancellation of the command is possible. Figure 6-15 shows an example of the Select/Execute diaiog, which-appears after the selection of the switch E1 QO. It only allows to select the Close command. The Open command is dimmed, because the switch is in the open position. After verification of the correct

selection.the operator can click the "Execute" button.

Substation and bay mode state

Correctly working control device

For safety reasons it is important that this two-step procedure is performed at each control level. For cir cuit breakers mostly all the check conditions de scribed above apply, while for disconnedors and earth-ing switches no synchrocheck function is requir ed. Figure 6-15 shows one way of working.

Interlock validity Synchrocheck validity

Control authority

------l--

Integrated In case of unconventional actuators connected by process bus Locked (blocked) state

An example for the hardwired two-step control cir cuit for disconnedors and earthing switches is shown

,

State of the controlled Item (breaker)

6.3.2.1.2

>

Figure 6-74 Influencing commands from station HMI to switchgear

in Figure 6 -16. The Select open respective Select Go contacts determine the turning direction of the motor. The Execute contacts then conned the DC supply to the motor. If the motor becomes too hot, the thermal

Figure 6-7 5 Control principle "Select" before "Execute" ------------------- -------- --·--

. llOkV . Substation

Lasi

lllCOminu feeder(=E04) BB1 Q1

Q2

Q1

-BB2

·z. Q51

Q51c ... - 'Q52 ObjectMiiU

m

0

QOQ5 ,

ao:_.·.· r_;

115

+125VDC

6.3.2.1.5

6.3.2.1.4 Parameter switching

Protection parameters are normally configured in such a way that they provide safe operation in· all situations. An overload protection relay thus has to be set to the safe side for high ambient temperatures in summer, although at low temperatures in winter the line transfer capacity could be much higher than in summer. Numerical protection relays allow to select various parameter sets, e.g. adapted according to the actual weather condition. The switching of the para meter sets can either be conducted by the operator or automatically by means of a simple activate/deac tivate command for each parameter set, or by an integer setpoint that identifies the active parameter set. Important is that the identification of the active parameter set is read back and compared against the intended activation. This check-back can be perfor med by an operator, or it should be done automati cally in case of automatic switching.

Drive supervision

Figure 6-7 6 Control Circuit for disconnectors and earthing switches

contacts disconnect the DC supply, and an alarm is initiated by the drive supervision contact. For safety reasons all relays have an extra contact, which is mechanically coupled to the switching contact to supervise their correct working in order to detect a faulted, e.g. melted contact that might cause a wrong, unwanted and possibly dangerous motor operation.

If parameter sets are switched from remote, it should be kept in mind, that a faulty communication link dis ables the reset to a "safer" parameter set. Self-moni toring features of the relay can however handle this.

6.3.2.1.5 Synchronous or point-on-wave switching

6.3.2.1.3 Transformer control

116

Transformers are often equipped with automatic on load tap changer control, which has the task to keep the secondary voltage within a preset voltage range and to minimize the circulating current between pa rallel transformers (master-follower and others). The automatic control can be switched off to enable manual control of the transformer: after the selection of the transformer it is possible to either raise or lower the tap changer position step by step. All con trol conditions. except synchrocheck and interlocking apply in a transformer specific way.

Voltage withstand characteris tic Arcing time window for synchronize d switching

Circuit breaker operation can sometimes cause unde sirable transient overvoltages and overcurrents in high voltage networks. This is particularly true for reactive load switching, e.g. shunt reactors, shunt capacitor banks, unloaded power transformers and unloaded transmission lines. In these cases, the mag nitude of the switching transients can -either exceed the maximum allowable switching insulation level (SIL), or it may endanger in the long-run the electric endurance of the HV equipment in the network The traditional measure to protect transformers or reactors against overvoltages caused either by light-

Voltage withstand characteristic corresponding to tamin

Tripping impulse

Transient recovery voltage

without synchro nized switching

6.3.2.1.5

interrupti on Target for contact separation Ran ge of conta ct sepa ratio n Figure 6-7 7 Synchronized switching for shunt reactors

ning strokes or by switching operations is the instal lation of surge arresters. Switching oveNoltage can further be caused by high current inrush on long transmission lines or capacitor banks. The measure against such oveNoltages is to equip the associated circuit breaker with closing resis tors to limit the inrush current. The most modern technology for switching surge control to substitute closing and opening resistors on circuit breakers is the synchronized or point-on-wave switching. The function Synchronous switching avoids oveNol tages by closing or opening of the circuit breaker exactly at the current zero point. The example (Figure 6-17) shows synchronized opening for shunt reac t o r s .

sion lines. The desired degree of compensation depends on the operating conditions of the network in terms of load profile. Therefore shunt reactors are frequently operated. The interruption of shunt reactor currents, which are very small in comparison with the rated short circuit current of the circuit breaker, may lead to current chopping. This generates high oveNoltages in the shunt reactors, which may exceed the voltage with stand characteristic of the CB and cause re-ignition of the arc in the interrupting chamber. This generated steep front voltage waves stress the insulation of the shunt reactor winding and may lead to aging and finally to failures of the insulation. Therefore the-opti mal solution is toavoid current chopping by means of synchronized or point-on-wave switching. As all synchronous switching needs very exact timing, there are, despite the advantages, up to now not many commercial implementations

117

Shunt reactors are quite commonly used to absorb reactive power, which is generated by long transmis-

.. .

...

...

installed.

'?

'?

'?

6.3.2. 7.5. 7 Synchronized Closing The objective of synchronized closing is that the main contacts of the breaker are closed exactly at the instant of equal potential on both sides of the contact to avoid or minimize pre-arcing during the closing operation. Therefore, the instantaneous voltage va6.3.3 lues on both sides of the open breaker contacts have to be compared to calculate the optimal instant of contact touching before the closing operation is initiated, considering the specific breaker closing time. This calculated instant of closing shall be reached within a tolerance of +/- 0.1 ms to minimize prearcing that occurs in the course of the closing opera- tion before the moving and the fixed contact touch.

tad traveling time is continuously monitored. The settings of the function are adapted from breaker operation to operation accordingly. 6.3.2.7.5.4 Synchronized switching and synchrocheck Less demandi:1g and powerful but serving also the minimal purpose of connecting only voltages, which are in phase as defined by specified limits for U, and cos cp, is the very common synchrocheck (see M, 6.3.4.1).

6.3.3 Protection and safety related functions Protection and safety related functions need to be fast and autonomous, and they interact directly with ·

As the line potential has to be compared with the busbar potential the associated VT has to be selected in relation to the actual busbar configuration. This information may either be provided from the station level or already be available at the bay level.

the process and the process data without the interterence of the operator. This means on the other hand, that they must work safe and reliable. The dedicated functionality (i.e. without data acquisition or operator interface) relates either to a specific piece of The high accuracy required for comparison of the val- primary equipment or to a bay. The processed data tage samples can be achieved either by synchronized belong either to the specific primary equipment or to sampling or by asynchronous samples that are time a bay. There is an HMI provided for parameterization, tagged with the same accuracy as applied for waveor for disabling and enabling of the function. In form reconstruction. This depends on how the tuncprinciple three classes of these functions can be distin- tion is implemented and on the selected communi- guished: cation implementation (bus/protocol), in case the vol• Protection: this is the active safety level, which tage values have to be retrieved via serial communisupervises the process for dangerous situations cation. The sample time accuracy should be better and responds to clear them by tripping the than 50 f!S. associated circuit breaker(s). • Interlocking: This is a passive safety level for all kinds of commands. It identifies dangerous operations and blocks commands, which might The objective of synchronized opening is to assure become dangerous. that breaker contact separation occurs exactly at the optimal instant near to current zero, so that the short • Auto-matics: these are sequences of actions circuit current can be extinguished within the performed automatically, after some trigger minimal arcing time. The calculated instant of contact separaimpulse has started them. They may be triggered tion shall be obtained within an accuracy of 1 ms. either by an operator or by another automatic Current information from the bay CT is needed to calfunction like protection, or by the process culate this instant of time. ------condition supervision. In the last case, normally the condition supervision is an integral part of the automatic function. Each automatic function 6.3.2. 7 .5.3 Common functionality should have its own safety checks, and reside on Since the successful timing is determined by the the top of underlying interlocking and protection mechanical behavior of the specific breaker, the confunctions.

i

I'

'

6.3.2. 7.5.2 Synchronized Opening (Tripping)

118

i' I.

t·

l· I

i t. .

i

(_

63.3.1 Main protection functions

This protection concept comprises the following devices.

In general within a substation the protection of pri-. mary objects is used: protection of a line, a busbar, a power generator or a transformer. Therefore, the main protection function is dedicated to the object to be protected, although a lot of protection fur,ctions like overcurrent protection can be used for different object types. Here a short overview is given. More details can be found in the vast protection literature.

6.3.3.1.1 Protection concept for a substation A typical concept for a substation comprising line, transformer and bus coupler is indicated in Fig. 6-18.

6.3.3.1

1. Overcurrent protection 2. Distance protection 3. Autoreclosure relay 4. Differential protection 5. Directional earth fault protection 6. Overload protection 7. Frequency relay 8. Voltage relay 9. Earth fault indication relay 10. Busbar protection system 11. Buchholz protection, thermal monitoring

10

[jJ

:

I

Auxiliary 'f" line 1 I

Cable

0 0

5]

I

: Auxiliary line •

t

Overhead line

Transformer

Bus coupler

Recommended basic protection Optional protection

119

Figure 6-7 8 Protection concept for a substation

'

'?

• Medium voltage (300 - 600 V): Transportation industry • High voltage (greater than 600 V): Long distance bulk transmission, submarine, and major system interconnections

6.3.3.·1.2 6.3.3.1.2 Line protection Alternating current (AC) lines are commonly classified by function, which is related to voltage level. While there are no utility wide standards, typical classifica . tions are as follows: • Distribution (3.6 - 36 kV): Circuits transmitting power to the final retail outlet. • Subtransmission (17.5 - 145 kV): Circuits transmitting power to distribution substations and to bulk retail outlets. • Transmission (72.5 - 765 kV): Circuits transmitting power between major substations of interconnecting systems, and to wholesale outlets. Transmission lines are further divided into: • High voltage (HV): 115- 245 kV • Extra high voltage: (EHV): 300 - 765 kV • Ultra high voltage (UHV): greater than 765 kV · Direct current systems can be classified as follows: • Low voltage (24- 250 V): Auxiliary power in power plants and substations, controJ circuits and, occasionally, utilization power in some industrial plants

Most faults experienced in a power system occur on the lines connecting generating sources with usage points. A line protection relay protects a line against all kinds of overload, especially caused by short cir cuits. There are seven protective techniques com monly used for isolating faults on power lines: • Instantaneous overcurrent • Time-overcurrent • Directional instantaneous and/or time-overcurrent • Step time-overcurrent • Inverse time-distance • Zone distance • Pilot relaying or line differential The most common function is the simple overcurrent protection, the most sophisticated the impedance based zone distance protection, the most selective but demanding from the communication infrastruc ture is the line differential protection (Table 6-1). Several fundamental factors influence the final choice of the protection applied to a power line: 1. Type of circuit: cable, overhead, single line con figuration, parallel lines, multi-terminals etc. 2. Line function and importance: effect on seiVice continuity, realistic and practical time requirements to isolate the fault from the rest of the system.

Type of fault

Protection of MV lines

Protection of HV & EHV lines

• Short circuits

• Overcurrent delayed or undelayed

• Differential

• Earth fault short circuits

• Directional time over current

• Distance

• Differential

• Signal comparison

• Distance

I · • Phase comparison

• Direction comparison I Table 6-1 Short circuit and earth fault protection for medium voltage (MV), high voltage (HV)

120

and extra high voltage (EHV) transmission lines

3. Coordination and matching requirements: com patibility with equipment on the associated lines and systems. Economic factors and the relay engineer's preference based on his technical experience must be added to these three considerations. Because of these many considerations it is not possible to establish firm rules for line protection. 6.3.3.1.3 Transformer and reactor protect!on

i .

A transformer protection relay protects a transformer or a reactor against internal and external faults (Table 6-2)

Differential relays are the main form of fault protec tion for transformers rated at 10 MVA and above. In principle they work similar to the line differential pro tection, and compare all currents entering and leaving the transformer. Transformer differential relays are subject to several factors that can cause misopera tion: • Different voltage levels, including taps, which result in different primary currents in the connecting circuits. • Possible mismatch of ratios among different current transformers

i '

'

• For the small transformer with two win dings (< 10 MVA) the differential protection relay ( I) serves as rnain protection against internal short circuits. It is complemented by the Buchholz protection (BU). The first time overcurrent protec tion (> I) serves as back-up protection, while the second overcurrent protection (>I) protects against overload. The sensor (cp) monitors the temperature of the insulation oil.

• Magnetizing inrush currents, which the differential relay sees as internal fault.

Internal faults

External faults

• Coil short circuit

• Line short circuit

• Winding short circuit

• Earth short circuit

• Winding hot spot

• Overload

• Earth fault, earth short circuit

• Overvoltage

• Damage of tap changer

• Overexitation (for generator block transformers only)

• Oil leakage at the transformer tank

6.3.3.1.3

The selection of the appropriate transformer protec tion is influenced by the rated capacity, the number of windings as well as by the treatment of the star point. Therefore it is impossible to specify a protection solu tion that is generally valid. Two typical examples are explained below (Figure 6-19):

• For the large transformer with three win dings (>100 MVA) a differential protection relay (M is provided as well for the main protection against internal short circuit. It is complemented by the ground fault protection relay (GF) in the star point of the star winding and the two Buchholz

• A 30° phase shift introduced by transformer delta connection

J

In addition to the differential protection standard pro tection functions like overcurrent protection, earth fault protection, and distance (impedance) protection are applied as back-up or reserve protection (Table 6-3).

Table 6-2 Faults that endanger the operation of transformers and reactors

121

6.3.3.1.3

AI

j_ Protection for a small 2 windings transformer Figure 6-19 Typical transformer protection schemes Type of failure

• Short circuit, earth short circuit • Earth faults

Protection for a large 3 windings transformer > 100 MWA Protection function

• Differential protection (M) • Time overcurrent protection (R) or • Distance protection (R) • Earth fault protection • Buchholz protection

• Winding short circuit • Overload • Oil leakage • Overload

• Overcurrent protection • Overioad protection with thermal image

• Overexitation

• Overexitation protection (B)

(M) Main protection), (R) Reserve or back-up protection, (B) Block transformer protection

122

Table 6-3 Protection functions for transformers

protection relays (BU). The distance protection relay (>Z) anc the time over current (>I) serve as back up protection (> 1). The remaining overcurrent protection relays serve as overload protection. The sensor (S) monitors the temperature of the insulation oil.

Several of these conditions do not require that the unit be tripped automatically, since, in a properly attended generator station they can be corrected while the machine remains in service. These condi tions are signaled by alarms. Other conditions, how ever, such as faults, require prompt removal of the machine from service.

6.3.3.1.4

6.3.3.1.4 Generator protection

Modern design practices and improved materials lead to low frequency of failures in generators, yet fail ures can occur and may result in severe damage and long outages. For this reason, abnormal conditions must be recognized promptly and the trouble area must be quickly isolated. Abnormal conditions that may occur with generators include the following: • • • • • • • •

Faults in windings Overload Overheating of windings or bearings Overspeed Loss of excitation Motoring of generators Single phase or unbalanced operation Out of step

Internal faults

• Stator

e

Rotor

For any particular hazard, the initial operating and maintenance costs of protection schemes and the degree of protection must be carefully weighted against the risk encountered if no protection is applied. The amount of protection that should be applied will vary according to the size and the impor tance of the machine. Internal faults in the generator generally develop as ground fault in one of the phase windings and may occasionally involve more than one phase. Differential protection is the most effective scheme against multi phase faults. In differential protection, the currents in each phase on each side of the machine are com pared in a differential circuit. Any current deviation is used to disconnect the generator from the power network (Table 6-4).

External faults

• External short circuit • Earth fault

• Unbalanced load

• Coil short circuit

• Pole slipping

• Winding short circuit

• Stator overload

• Earth fault • Double earth fault

Table 6-4 Faults that endanger the operation of a generator

• Rotor overload • Voltage rise • Frequency decline • Motor operation (dangerous for steam turbines)

123

6.3.3.1.4

As it is impossible to provide a protection scheme that is generally valid, there are two typical examples shown in Figure 6-20: • The protection scheme for a small generator (35 MVA) comprises:

• The protection scheme for the big generator comprises: • Stator earth protection (U0 >) • Generator motoring protection (P) • Loss of excitation protection (-jX)

• Differential protection ( I)

• Plant decoupling protection (P>)

• Generator motoring protection (P)

• Stator overload protection (1 5 >)

• Under-frequency protection (f<)

• Underfrequency protection (f<)

• Stator overload protection (I>)

• Over-voltage protection (U>)

• Over-voltage protection (U>)

• Pole slipping protection (c)

• Loss of excitation protection (- jX)

• Back power protection 2 (P)

• Unbalanced faults protection (12 >)

• Rotor overload protection (IR>)

• Stator earth fault protection (U0 >)

• Unbalanced load protection (12 >)

• Rotor earth fault protection (RE)

• Distance protection (Z>) • Stator earth fault protection (U0>)

Figure 6-20 Typical generator protection schemes

124

Protection scheme for a small generator

Protection scheme for a big generator

. .

For big generators the protection schemes are always duplicated and both schemes are completely sepa rated, and each scheme is provided with a separate auxiliary power supply. For safety reason it is not recommended to keep a generator in operation if one of the two protection systems is out of service for a longer time. · It should be noted that very often the differential pro tection covers not only the generator but also the · attached step-up transformer as one single genera tortransformer block protection. 6.3.3.1.5 Busbar and breaker protection

failure

The busbar of a transmission substation is the most sensitive node in the network. Due to the merging of many supply circuits, high current magnitudes are involved. Busbar failures due to lightning strokes or connectors melting because of overload are relatively Figure 6-27 Decentralized protection scheme

rare. But if a fault occurs, the damage can be wide spread by causing disastrous cascade tripping of generators and lines and finally the collapse of large parts of the power system. The term busbar protection is related to special pro tection schemes that acquire short circuit and earth fault currents within the area of the busbar in HV and EHV substations. The task of a breaker failure protec tion function is to detect that a breaker has failed to clear a fault on the busbar, and to trip all the remain ing breakers feeding into the busbar section con cerned to clear the fault. Busbar and breaker failure protection respond in a similar way to busbar faults, therefore both protection functions are usually inte grated in one common protection scheme. Differential protection is the most sensitive and relia ble method for protecting station busses. However, problems can result from a large number of circuits

busbar Substation Automation

0

Control room

L i n e

Switchya rcl P r o t e c t i

6.3.3.1.5

o n

lnterbaybus Bay Protectio n

Q 1

QO\Tc QO\

QO\-n:

F

QO\ T1 T1.

't

T1 Double Busbar

p

T1 •

125

A busbar protection scheme has to fulfill the follow ing requirements to ensure save and reliable opera tion.

6.3.3.2

involved and different energisation levels encounter ed in these circuits for external faults. For example, if there is an external fault on one circuit of a six-circuit bus, five of the current transformers may supply vary ing amounts of fault current, but the sixth and faulted circuit must balance out all the others. Consequently, this circuit is energized at a much higher level - near saturation or with varying degree of saturation - giving rise to high false differential currents. For the same reason, DC saturation is also unequal, which is more serious than AC saturation, because a relatively small amount of DC from an unsymmetrical fault wave will saturate the CT core and appreciably reduce the secondary output. Busbar protection schemes have to be very reliable to prevent unnecessary tripping, and selective to trip only those breakers necessary to clear the bus bar fault. The clearing time is important to limit the dama ge caused by the fault current and the power resto ration time is crucial to maintain the power system integrity. Modern decentralized numerical busbar protection schemes are not sensitive against CT saturation phe nomena by proper algorithms and detect the faults single phase or multiphase very reliably. In addition the sensitivity of the protection must be combined with its capability to identify the direction of a fault on each line in order to preserve the tripping selectivity. The digital technique takes these constraints into account (Figure 6-21).

126

For selectivity reasons the busbar protection needs a dynamic image of the busbar (busbar topology), i.e. which switches are connected in the single line topo logy, and which switches are currently open or closed. If an error is detected within the substation, e.g. by applying Kirchhoff's law to the nodes, or by direction comparisons, then according to this actual topology the minimal necessary busbar part is isolated.

As auto-redosure and synchrocheck functions are activated in connection with a protection trip, these functions are considered to be protection related func tions. Synchrocheck functions are also used in the cause of a normal circuit breaker closing to prevent connecting of two voltage sources being out of phase. Synchro check is a blocking function, which is based on ana logue values of voltages on both sides of a circuit breaker. More details can be

• Fast fault detection • Fast and selective operating time irrespective of station size and configuration • High dependability to avoid false tripping • Minimum CT performance requirements • High through-fault stability even if CTs saturate • High stability in case of external faults in the vicinity of the substation These tasks are often fulfilled with two algorithms running in parallel.

6.3.3.2 Protection related functions 6.3.3.2.1 Autoreclosure, synchrocheck A successful protection operation trips the circuit breaker, which leads to power interruption in some part of the power network. This jeopardizes its main functionality, which is to supply power. In case of a lightning stroke the cause of the protec tion trip very often disappears soon after tripping the breaker, because the fault arc extinguishes if the line is de-energized. Therefore it is a standard practice to activate an auto-reclosure function after Jripping to restore the power supply after some 100 ms (fast or rapid auto reclosure). This time also depends on the dead time of the circuit breaker (see Chapter 5). If, however, the fault arc has not been cleared, the pro tection will immediately trip the circuit breaker again. The attempt to reclose may be repeated several times in intervals of several seconds or even minutes to allow e.g. a thin tree, which may have fallen onto the line, to burn out Such longer lasting auto-redo sure operations may cause the voltages on both sides of the line to get out of phase. Therefore a syn chrocheck function should be used to assure closing of the circuit breaker with both voltages in phase. Further, during minutes also manual operations or some sequence based automatics can interfere, the refore also the interlocking (e.g. running isolators) should be checked.

found in 6.3.4.1. The more demanding version is the synchronized or point on-wave switching (seE 6.3.2.1.5).

6.3.3.3 Interlocking The purpose of interlocking is to prevent destruction of switchyard apparatuses or hazard to human beings by blocking dangerous switching operations.

Figure 6-22 Bay interlocking indication

The bay level (local) interlocking considers the positi ons of switches within a bay to decide if other swit ches of this bay might be switched. If any switch is moving, i.e. it has an intermediate position, it is for bidden to operate any other switch (often in the whole switchyard), because switches, especially dis connectors and earthing switches, loose their isola tion capability during the switching operation. The interlocking function produces release and block indi cations, which are used as constraints for the control functions (Figure 6-22).

6.3.3.3

The main difference between bay interlocking and station wide interlocking is the scope of input signals to be considered. But there are general rules based on electro-technical principles applicable in both cases. The section "Station wide interlocking" in 6.3.4.3.1 describes more details to interlocking and to these rules.

127

(

6.3.4 Distributed automation support functions

6.3.4

• Distributed synchrocheck, • Station wide interlocking.

6.3.4. 7 Distributed Synchrocheck

128

I

I

I'

Distributed automation support functions are opera- bay, where the bay VT output can be directly connectting with data directly from the process and supply ed to these devices. Nevertheless, the output of the decision data to other functions, which act directly busbar VT providing the busbar voltage either directlocally on the process without the interference of the ly or via a busbar image remains to be switched to operator. In contrast to the local process automation the appropriate bay. (support) functions they use input data from the whole switchyard. The core functionality (i.e. without New fast and high capacity communication media data acquisition or HMI) uses data from several bays. nowadays allow transferring the needed busbar valThere is an HMI for parameterization, or tor disabling tage across the communication bus in digital form, and enabling of the function. avoiding any needs for physical switching. Due to the There are essentially two automatic support functions:

."

time delay caused by the communication special means are however necessary to synchronize the time of the voltage data retrieved from the two sources, bay ar:d busbar, with accuracy around 20 [.tS.

If II

ll I[·.· I

I

I\

I [

The upcoming communication standard IEC 61850 will be an enabler for the implementation of this cost

effective function, as it has the features to achieve Distributed synchrocheck is essentially the same funcaccuracy and to provide the necessary this tion as the local synchrocheck, however the data of communication band·.vidth in a standardized way. at least one voltage transformer is coming via the communication system. This may be the voltage from the busbar, or from another bay, if no voltage transformers are available at the busbar (respective not on 6.3.4.2 Busbar image all bus bar segments). The determination of which VT has to be taken to obtain the correct busbar voltage If the busbar voltage transformer has been omitted in is often called busbar image (See 6.3.4.2). the switchyard to save costs in the primary system, a busbar image function has to be applied to deterTraditionally one synchrocheck device was used per mine which line is actually connected to the busbar. substation or voltage level. For closing a circuit breaThe VT of this line is taken as the busbar voltage ker with synchrocheck the corresponding line voltage source e.g. for synchrocheck or for the busbar VT output as well as the busbar voltage VT output voltage measurement. This busbar image is based on the were connected via relay contacts to this synchrotopology of the substation single line, i.e. the check device. The result of the voltage comparison tary state of all switches as well as their static connecmomenwas fed back to all bays inclusive that one concerned. tions. This busbar image can naturally also be used to This VT output switching was rather dangerous and determine the voltage at the busbar, even if there is had to be made in a very controlled and supervised no busbar VT available (Figure 6-23), and to show way, because if accidentally two VT outputs were this calculated busbar voltage at station leveL conneeted, the VTs could be destroyed. Using this hardwired solution, power may be accidentally fed It should be noted that such a busbar image is not back from the loaded to the unloaded only needed for busbar protection but also for other line. With the numerical bay level protection or control distributed functions like distributed synchrocheck or devices the synchrocheck became a function at each station wide interlocking.

I

l\

I

I

[_:_

I

I'

I

I

i I

i..

6.3.4.3

! Cable

IJJ

Overhead line

Bus coupler

Distance protection Autoreclosure

[I)

Transformer

Distributed synchrocheck

6.3.4.3 Station wide interlocking The purpose of interlocking is to prevent destruction of switch yard apparatuses or hazard to human beings by blocking dangerous switching operations. Station wide interlocking takes the position of swit ches in more than one bay into account. This con cerns all bays around the busbar, bay circuit breaker by-pass situations, as well as special loop situations across several bays. 6.3.4.3.1 Interlocking rules

The whole interlocking is based on some general rules, which can be classified as follows: • Safety rules for operation: these are the

minimum rules to assure that no damage is done to equipment and human beings during operation. • Safety rules for maintenance: these are

the rules necessary to assure safe earthing and

Figure 6-23 Distributed synchrocheck for autorec/osure after a line earth fault trip

unearthing for maintenance work, as well as safe operation during maintenance work. • Loop rules and switching sequences:

these assure safe handling of switching in feeder and busbar loops, as well as avoid unnecessary switching operations. • Protection selectivity rules: these assure that

even in case of by-pass situations any fault can always be cleared by tripping one single circuit breaker only. These rules are of course not valid for ring bus configurations and breaker-and-a-half configurations, where lines share more than one circuit breaker and no by-pass is used. • Fault avoidance rules: these rules avoid situations, which might lead to dangerous situations, e.g. caused by induced voltages. There are stronger ru!es for G!S than for ,t..IS, due to higher induced voltages in neighboring parts. In the following the specific rules of the various clas ses are described.

129

''

6.3.4.3.2

Safety for operation

Protection selectivity

• No switching is permitted while a switch is running because a running disconnector does not isolate. So a next switching operation has to wait until the switch has reached its end position again.

• Each feeder must be disconnectable by one circuit breaker only. • Do not connect two feeders directly.

e Do not connect live and earthed parts. This leads

to a short circuit. • Do not connect two power sources by disconnector. The power flow will damage it. • Do not interrupt power flow by disconnector. The power flow will damage it. • Do not enlarge parts with unknown states.

Safety for maintenance • Earth/unearth only isolated nodes or isolated circuit breakers. • Do not switch a disconnector near a partly earthed circuit breaker, or if itself is only partly earthed. • Do not close a partly earthed circuit breaker near an earthed transformer.

• Do not close a bypass disconnector on to a busbar if other feeders are already connec.1ed to the busbar. • Open a bypass disconnector in parallel to a closed CB only, if the bus coupler is closed. This shall

i !

I ..

indicate that the protection of the line has been switched to the bus coupler circuit breaker.

Failure limitation • Connect active potential via a disconnector only to a loop (same potential at both sides) or to an open circuit breaker (weak version for AIS:

..

'

I

to an isolated node). • Connect a feeder via a disconnector only to an open circuit breaker, or (in case of a bypass disconnector) to an isolated busbar part. • Do not open a bypass disconnector in a live feeder, if the bypassed circuit breaker is open.

I

• Do not transfer earth potential (by closing disconnectors or circuit breakers) to unearthed parts.

Loop rules and switching sequences • Avoid disconnector loops in a feeder • Do not open busbar switches (i.e. all switches located on busbar, bus couplers or bus sections) during a busbar transfer. This shall assure to first finish the busbar transfer, before conducting other switchings. • Close an unearthed circuit breaker only if the disconnectors on both sides have the same position. Otherwise the disconnectors would be blocked, so that the circuit breaker has to be opened again.

130

• Open or close a disconnector near an unearthed circuit breaker only if the circuit breaker is open, and the disconnector is not part of a busbarbusbar connection.

• Do not open a bypass disconnector, if the resulting busbar part will not be isolated. • Do not open a busbar disconnector if not both resulting parts will be isolated. • Do not close a busbar disconnector if not both sides are (weak for AIS: at least one side is) isolated.

6.3.4.3.2 Topology based interlocking versus Boolean algebra The implementation of an interlocking scheme is classically done with Boolean algebra expressions, whose inputs are the auxiliary switches that indicate the positions of the switches, and where the res-ult is a release condition. These Boolean algebra expressions are constructed from the knowledge of intended switching sequences within a substation, and according to the general rules applied to the specific single line diagram of a plant bearing in mind the dangerous situations.

.I

If we consider the simple bay in the Figure 6-24 then e.g. the switching of the line side disconnector QC1 is only allowed, if the line earthing switch QE1 is opet:l, and the circuit breaker QA1 is open. This can be writ ten in Boolean algebra as follows: QC1.release: = QE1.open AND QA1.open The advantage of Boolean algebra is that it is only based on logical AND and OR operations, and can therefore be efficiently implemented. The disadvan tage is, that • for big switchyards the station wide interlocking conditions become quite complex, • in highly meshed systems even not all meaningful switching sequences can be supported, • an undefined position of a switch i.e. in case of phase discrepancy due to operating mechanism failure can not easily be handled. In contrast to this, the topology implementation approach codes the general rules into a kind of ex pert system, which is then applied to the substation single line and the current position of the switches. The advantages are: • all possible substation states can be handled, • any switch yard topology with arbitrary complex rings can be handled, • even switches in unknown handled,

restricted to one lED handling all station level inter locking'tasks.

6.3.4.3.2

The Figure 6-24 is used to illustrate the difference: As here we want to indicate also the opened and closed state of a switch, we use symbols often used on net work management single line displays. Within this simple feeder it is assumed that the line side disconnector QC1 is closed (filled rhomb), and the busbar earthing switch QH1 is closed. The topo logy interlocking then would distribute the active line potential to one side of the circuit breaker, and the busbar earth potential up to the busbar side of the busbar isolator QB1. Now we can use the general rule 'Do not connect live and earthed parts' to see that the line earthing switch QE2 must be interlocked, and the rule 'Do not transfer earth potential (by clos ing disconnectors or circuit breakers) to unearthed parts' to see that the busbar disconnector QB1 must be interlocked. The Boolean algebra for the QB1 e.g. considers this (and the state of circuit breaker QA1) by means of the switch states as follows: QB1.release == (QH1.open AND QE1.open AND QE2.open AND QA1.open) OR (QH1.closed AND QE1.closed AND QE2.closed)

state can be

• only the single line topology must be configured - much less engineering errors can occur, less engineering work is to be done. • If a switch is blocked the rule that has been violated can be indicated to the operator.

i

I

I

• I

I.

The disadvantage however is, that the expert system approach needs much more processing power. With the advances in computer technology this is more and more acceptable. For cost sensitive systems the use of a topology-based implementation can be

Figure 6-24 Simple Feeder with potentials for topology interlocking

Note: the switch naming above follows the new IEC standard IEC 61346, Plant designation.

131

6.3.5

6.3.5 Distributed Automation Functions

that they are station level oriented. Station level oriented sequences can be implemented by a distributed sequencer, where a station level sequencer coordinates several part sequences executed at bay level.

6.3.5. 7 Switching Sequences

6.3.5.2 Breaker failure

Switching sequences contain a number of switching steps to put a switchyard into the wanted operational state. All switching steps are performed autonomously one after the other. The result of an opera- tion is tested; and the sequence continues only if an operation has succeeded and reached its intended position. Before a sequence is started, certain checks are made to assure that the action is allowed and has the prerequisites to be finalized. Safety, however, can and must not rely on the switching sequence itself. Safe operation can only be assured by the appropriate interlocking constraints on the control command that is sent to the individual switches. As soon as a blocking condition is detected the switching sequence is aborted.

r

r, i

If a breaker, which is tripped by some protection (e.g. line protection), does not open because of an internal failure, the fault has to be cleared by the adjacent breakers. The adjacent breakers may include breakers at remote substations (remote line ends). For this purpose the protection trip starts the breaker failure protedion. It then supervises if the fault current disap- pears or not If not, a trip signal is sent to all adjacent breakers after a preset delay. This function needs fast detection of trip signals and fault curre1ts and very fast reset in case of a disappearing fcJJit current. The delay is settable s100 ms. The trip transfer time shall be in the order of 5 ms.

6.3.5.3 Automatic protection adaptation

Often a sequencer that operates autonomously incorporates a step mode for testing. The operator has The protection specialist may change the protection to acknowledge the sequence after each step befo- parameters (settings) if this is needed by static or prere it is continued, even if it was successful. The step dictable power systemreconfiguration. mode allows the operator to have better control over the sequence, because he can abort it after each step. If the concitions for protection are dynamically changThis function is mostly used for training purposes. ing during operation, the parameters of the protection may oe changed by local or remote functions. Typical switching sequences are Very ofter, not single parameters are changed but complete, pre-tested sets of parameters are swiched. • Disconnecting a bay (line, transformer, ...) • Earthing a bay • Bypassing a line circuit breaker • Connecting a bay (line, transformer, generator) to a specific busbar • Connecting a line in bypass mode

The chance of conditions is detected and communcated by soe other functions. The parameter switching is then performed in the order of 1 00 ms up to some seconds.

Very often the need to adapt the configuration is detected outside the protection lED and then com• Transferring some or all currently connected municated to it, e.g. by a command to·-change the bays with or without power interruption to parameter set. Therefore the availability of the communication is crucial for the working of this type of protection. It is recommended that the protection Attention is drawn to the fad that some sequences device contains a safe fall back configuration which is mentioned above concern one bay only, while other automatically enabled some configurable time after a sequences involve more than one bay, which means loss of communication. • Closing or opening a bus coupler or bus section

another busbar.

132

lc

'?

'?

'?

'?

6.3.5.4 Reverse blocking When a fault occurs in a radial network the fault cur rent flows between the source and the fault location: • The upstream protections are triggered • The downstream protections are not triggered • Only the first upstream protection has to trip One possibility to reach this goal is to have longer trip delay times at the higher levels of the radial network. · This leads however to extremely long delays on the higher levels. The reverse blocking function is a distributed function in the power network that eliminates a fault in a mini mum and constant time, wherever it occurs in a radi al electric network. It offers a full tripping discrimina tion and a substantial reduction in delayed tripping of the circuit breaker located nearest to the source (the first upstream protection/breaker). It concerns phase over-current and earth fault protections of different types: definite time (DT) and inverse tirne delay IDMT (standard inverse time SIT, very inverse time VIT and extremely inverse time EIT).

Only the first upstream protection has tripped the related breaker in a minimum and constant time. Depending on the applied time delay based fault discrimination scheme the block command has to be communicated within the order of 5 ms (transfer time).

6.3.5.5 Load shedding When loss of generation or sudden connection of big loads occurs on a network the variation of frequency depends on several dynamic factors in interaction. This can be the quantity of spinning reserve, the limi tations of the prime mover system and the speed of governors, the inertia of the power system or the sensitivity of customer load. This phenomenon is par ticularly important on isolated power systems where the largest generating unit represents a high propor tion of the total demand. On these kinds of power systems, well-tuned load shedding plans can avoid many blackouts. In general, undue variation of fre quency or voltage within a power network can be re gulated by disconnecting (shedding) a certain amount of the load, and thus "win" enough power for the remaining load.

Fault

'(

Figure 6-25 Radial network with reverse blocking

When a protection is triggered by an over-current (Figure 6-25) • it sends a blocking signai to the upstream protections • it trips (opens) its associated circuit breaker if it doesn't receive a blocking signal issued by a downstream protection.

6.3.5.5

Conventional load shedding works with hard-wired relay logic and therefore is static In case of system voltage or frequency decline, the scheme activates tripping of pre-selected circuit breakers regardless of the actual load conditions. Microprocessor based load-shedding schemes, however, are in the position to take the actual load into account and to dynami cally select only those feeders up to that amount of load to be opened, which are needed to regain the frequency. stability (Figure 6-26). Parameters to this function are the priority of the load,

and if the load is currently allowed to be shed or not. These parame ters can be downloaded e.g. from a central place whenever they change due to new operation envi-

'!

133

Dynamic Load Shedding Selection

Release

Dynamic selective feeder tripping according to actual loads

Transmission network

6.3.5.7

current per feeder

voltage and frequency (f)

Distribution network Figure 6-26 Dynamic load shedding scheme

ronment. If then the load shedding is triggered, they guide the selection process of the load shed ding, together with the measurement of actually exi stent load (Figure 6-27). The reaction time for shedding should be in the range of 100 msec, while a possible change of shed ding parameters is in the order of the human opera tor's reaction time (1-5 sec).

6.3.5.6 restoration

Power

After a fault has been cleared by a protection trip, the auto-rec\osure function tries to restore power per breaker/feeder. Sometimes this does not work because of a static fault, e.g. a permanent short circuit on some line, or a broken transformer. A busbar fault may lead to tripping of all connected bays. Some times a bigger power network disturbance happens so that at several places circuit breakers are tripped by protection functions or by load shedding. In these cases the load restoration function tries to restore power to the load per busbar or per substation.

134

The reconnection of feeders and consumers is made in a proper sequence according to some predefined

priority and according to the network conditions. This means that on substation level the load restoration consists of the execution of certain pre-defined switch ing sequences, which are selected according to the fault situation and consider the actual load situation before the fault. The reaction time should be within a range of the human operator response time or switchgear opera ting time scale, i.e. around 1 s per switching step.

6.3.5.7 Voltage and reactive power control The voltage on a busbar in the power network de pends on the position of the transformer taps and on the amount of reactive power to be moved around. By controlling both the voltage is kept at its nominal value or in a very small well-defined range. The con trol is made by changing.the tap positions or by step wise switching of capacitor or reactor"' banks. Very often only one of these means is available for such a control function in the substation under considera tion.

Any actions are started by deviations of voltage or reactive power from their set points. For more than

i

l

f (Hz) f

f f

N

6.3.5.8

Lim 1 Lim 2

+-----....... P(MW)

---:-----------.. t (s) I

r--------t First attempt: Load optimised

step 1

Load of priority 1 shedded

. Load
L----or----+---------- -

t (s)

Figure 6-27 Automated load shedding

one transformer, it is considered additionally if the cir culating reactive current is above its accepted limit. The detection that actions are necessary must be fast, but response time is limited by the switching mecha nism. The actions should however show results befo re any protection function trips. This needs careful harmonization of the set points e.g. with the trans former differential protection or over/under voltage protection functions.

6.3.5.8 lnfeed switchover and transformer change Both, infeed switchover and transformer change, are a fast switchover of power source or of load to assu re continued working of critical loads like motors in one of the following cases: 1. Busbars with multiple infeeds have to be switched over to a backup infeed in case that the main infeed is disturbed or lost. The switch-

over has to take place bumpless in such a way that no problems regarding the synchronization of lines and loads (e.g. motors) appear. 2. In case of parallel transformers, the load of an overloaded, endangered or faulted transformer has to be switched over to a healthy, parallel running transformer. The switchover has to take place bumpless in such a way that no problems regarding the synchronization of lines and loads (e.g. motors) appear. This includes besides opening and closing circuit breakers also a proper setting of the tap position of the transformer. The bumpless performance means reactions·raster than 100 msec. A typical example of a high-speed power transfer scheme consists of a H-type busbar configuration with two high voltage infeeds, and a single busbar with a section coupler on the medium voltage side.

Each section of the medium voltage busbar has three cable feeders and three motor feeders (Figure 6-28). In normal operation each is fed via one transformer.

6.4

In case that one of the two line circuit breakers of line F1 or F2 is spontaneously tripped because of line or transformer faults, the high speed power transfer scheme assures that supply for both busbars is main tained without extensive stress of the motors. This

135

6.4 System Configuration and Maintenance Functions requires that the CB of the MV bus section is preci sely closed at the instant when the voltages are syn chronous taking in consideration the motors slowing down. After the fault has been eliminated the re transfer of the loads can be automatically conducted.

This functi on is prima rily used to maint ain powe r sup

ply to vital auxiliaries in power plants and sensitive industrial processes.

Figure 6-28 High speed busbar transfer

Line F1

line Protection

A substation automation system normally consists out of a set of standard software packages, running on a distributed system, and a lot of substation and customer specific configuration data, function para meters, and specifically developed software. In the ideal case all software is stable, and any necessary adaptations during operation or for eventual later sys tem modifications and extensions can be just done by configuration and parameterization; this means by adaptation of the appropriate data, which describe the switchyard, the control system and its functions, line Protection

High-Speed Busbar Transfer Transformer Protection

136

·

?

and its connections to its environment The System Configuration and Maintenance functions are a sub

?

set of the engineering functionality, which is needed during commissioning, and during operation and maintenance of the system. Note however, that the limits between software and data are fluent and depending on the view point. So on one extreme a Java program is just data for the Java compiler. On the other extreme a selection of options for a data object can completely change its behavior. Therefore this set

of

functions cannot described.

be

clearly

delimited

and

In any case these functions must mark all the objects (data or software) describing a system instance with revision information. This must as a minimum identify the revision and contain the date of the last change. As this is normally not done for a single item of a configuration data base, this data must be structured into entities with a common purpose, which then have a common revision index. This allows to track changes during the life time of the system. Normally more than this absolute minimum in revision history and change tracking should be provided, otherwise error tracking and removal, and adaptation and enhancement of a system will be a Sisyphus work.

6.4.1 System Configuration and Adaptation The system configuration consists of all data describ ing the individual configuration of a system. It exclu des those data which are normally changed/adapted during operation. In some cases, e.g. for the limits of certain measurands, it might depend on the opera tion philosophy of the customer if these are opera tional parameters or configuration parameters. Configuration parameters normally have to be resto red during replacement of hardware, and they are changed only, if the system is modified or if they con

parameters as well as their physical storage often fol lows the physical (lED based) structure of the auto mation system, and only within this structure, there might be function related substructures. Additionally to this lED based structure there must exist a system configuration description, which contains the system related configuration data holding the single lEOs together in the system. A typical example is a com munication connection scheme with connection information.

6.4.2

System configuration functions allow to store, load and modify configuration data in a systematic way, and to keep the version or revision history.

6.4.2 Application Software Upgrade and Maintenance It may happen, that errors found in a base software package cause a replacement by a newer version, or that the new hardware implemented after a hard ware defect is not 100 % compatible, so that other drivers or a newer operating system version has to be installed. Sometimes these modifications can be done on top of the existing system. But mostly the repla cement of some base software requires a reinstalla tion of all correlated packages, and especially of the system specific data. Sometimes, some system speci fic data have to be converted into a new physical for mat, or even some new configuration parameters have to be set, before the new package can fully per form its task It is important, • that these new versions of a functional package are compatible with the rest of the system soft ware and data, • and that a systematic backup process and installation procedure allows to re-install the complete system software and system con figuration data afterwards. For application related functions, the standardization of parameter formats and archiving in an implemen tation independent way can also lead to better upward compatibility in case that new software ver

tain errors. Therefore the structuring of configuration

sions of the application have to be installed.

137

65 Communication Functions

6.5

Communication functions are suprort functions, which are necessary due to the fad, that • either the system is widely distributed and the communication performance is not sufficient when all functions would individually and directly access the same data source, • or devices from several manufacturers or different implementation generations have to be connected with different protocols.

6.5.1 Data Exchange withithe Substation Data exchange within the substation is needed in dis tributed systems, or for coordination purposes within redundant systems, respectively between parts that have been physically separated because of reliability reasons. A typical communication function within the substation enables data exchange between the con trol devices or the station level devices at one side, and the protection devices on the other side. This task has become simpler since the IEC 60870-5103 standard exists for the serial connection of protection devices to a substation automation system. Another usage for communication functions is to inte grate devices with 'third party manufacturer' specific protocols like DNP3, Modbus etc Only with the upcoming lrC 61850 standard for communication within the substation it can be expect ed, that the communication as a special function gets invisible at least for new systems.

6.5.2 Data Exchange with External Systems

138

The data exchange with external systems is the clas sical task of Remote Terminal Units (RTUs), arJd the Network Control Center (NCC) is the classical external system. This ata exchange functionality has been allocated to the gateway function of modern SA

systems. It provides binary and analog process relat ed data as well as time stamped events for a net work control center. For this functionality the standard protocol is today IEC 60870-5-101, which is especial ly designed for slow speed, unreliable modem or power line carrier connections. With the advent of high speed wide area networks e.g. through optical cables contained within the earthing rope of trans mission lines, there is a shift to the IEC 60870-5-104 protocol, which is a TCP/IP based variant of 101. In future, the new communication bandwidth capa bilities together with the IEC 61850·protocol could make a gateway function superfluous. A simple bridge, router, or (for security) firewall device could then be sufficient. It should however be kept in mind, that at least for control not everything of the lower level shall be directly accessible at all higher levels. A control coordination, data concentration and data filtering, perhaps in specially designed firewalls, will always remain. New functionality and new needs lead to a second kind of wide area connection directly to substations: connections from maintenance centers. These com munication functions are already now mostly based on TCP/IP connections, because maintenance func tions are not time critical. Therefore here the slow speed of modem connections and higher protocol overhead is acceptable. IEC 61850 will also here sim plify life further by standardizing also the application level, especially for new asset management and power quality functions.

•

•

6.6 Network Operation related Functions

6.6.1 SupeNisory Control and Data Acquisition (SCADA)

6.6

The term SCADA is used for the basic data acquisi tion, supervision and control functionality of any con trol system, and therefore is also the basic functiona lity of an SA system. The appropriate SA related func tions are described in 6.1, 6.2.1, and 6.2.2. This func tionality naturally supports the appropriate SCADA functionality at network control level. In some cases the network control center can even shrink to a set of remote terminals at the SA systems. At present, it is normally the other way around, i.e. the SA system is the data acquisition part for the NCC.

6.6.2 Power Application Software (PAS) The term "Power Application Software" is used for all applications that support the network operation of a power system under normal working conditions, and these applications run normally in network control centers (NCC). The SA system delivers the basic data needed for the power application functions like RTUs to NCC systems for energy management (EMS), automatic generator control (AGC), energy scheduling etc The performance of the data transmission has to be tuned according to the functional needs. AGC e.g. requires only a few but critical measurands with a maximum allowed data age of 4-10 s. If the NCC communication cycle time is in the order of 3 s, then this data must be available at the SA gateway func tion not later than every second. On the other side, each central function can in princi ple be distributed to a lower level, if the devices at this level are interconnected with sufficient communi cation capacity. This possibility has to be further explored with the upcoming high bandwidth wide area communication networks 0/VAN).

139

..

6.7 References

6.7

[1] Walter A Elmore (Ed.)· Protective Re(aying Theory and Applictions, Marcel Dekker, New York (1994) [2] Helmut Ungrad, Wilibald Winkler, AndrejWiszniewski ·Protection Techniques in Electrical Energy Systems, Marcel Dekker, New York (1995) [3]1EC 61850-5 Communication networks and systems in substations- Part 5: Communication requirements for functions and device models [4] K-P. Brand, J. Kopainsky, W. Wimmer · Mikroprozessor-gestOtzte Verriegelung von Schaltanlagen mit beliebiger Sammelschienenanordnung (Microprocessor-aided interlocking of substations with arbitrary busbar arrangement), Brown Boveri Technik 74, 5, 261-268 (1987) [5] K-P. Brand, J. Kopainsky, W. Wimmer · Topology-based interlocking of Electrical

Substation, IEEE Trans. on Power Delivery PWRD-1, 3, 118-126 (1986) [6] K-P. Brand, W. Wimmer· An Expert System for Topology based interlocking in digital Substation Control, CIGRE SC34 Colloquium, Brasil, 21-26 September 1991, Paper 02-10 [7] K-P. Brand, D. Weissgerber ·Adaptive Load Shedding for industrial power networks, CIGRE SC34 Colloquium, Stockholm, 11-17 June 1995, Paper 34-209 [8] B. Sander, S. Laderach (Eiektrizitatsgesellschaft Laufenburg/Switzerland), H. Ungrad, F. liar, I. De Mesmaecker, (ABB Relays AG/Switzerland) ·Adaptive protection based on interaction between protection and control, Cigre Paper 34-205, September 1994 Session in Paris

140

7 Substation Automation Structure

7.1 Introduction 7.2 Station Level

72.1 Human Machine Interface (HMI) 72.2 Local Control and Station Level Automatics 7.2.3 Substation Database and Archive 72.4 Process Data Access 7.2.5 Time Synchronization 72.5.1 Local time 7.2.5.2 Global time 7.2.6 Remote Control and Monitoring 7.2.6.1 Communication Gateway 72.6.2 Remote Control Functions 7.2.6.3 Monitoring Functions 72.7 Data Exchange between Station Level and Bay Level

7.3 Bay Level 7.3.1 7.3.2 7.3.3 7.3.4

Bay Level Control Bay Level Protection Bay Level Monitoring Human Machine Interface (HMI)

7.4 Process Level 74.1 Hardwired Terminals 7.4.1.1 Binary Switchgear Position Indication 7.4.1.2 Analog Process Status Indication 7.4.1.3 Commands 74.2 Remote Input/Output (1/0) Units

142 143 144 144 144 1Ll4 145 145 145 146 146 146 146 146 147 148 148 148 148

7

Table of content

149 149 150 . 150 150 150

141

7 Substation Automation Structure

7.1

· 71 Introduction The previous chapter dealt with the functions typical ly available within a substation_ Already there we distinguished between bay level functions, which only provide and work on data from one substation bay, and station level or system level functions, which need or provide data across several bays. This chap ter is more focused on the operational and physical separation between 1. the station level, often located in a special. if necessary shielded room and providing an overview across the whole station, and 2. the bay level, which is usually close to the switchgear, allows the operation within one bay only e.g. for conducting maintenance work on this bay or on a single switchyard object (apparatus).

3. the process levei. which is close to or even integrated in the switchgear, allows only the operation of a single switchyard object (appa ratus) and provides the interface between the substation automation system and the switch gear. Both, the functional structuring as well as the opera tional/physical structuring, are in principle indepen dent from the communication and physical structure of the SA system (except the HMI part allowing the operator interaction). However, due to technical limi tations, cost and especially reliability considerations, each meaningful control system architecture should also have some relation to these levels.

Figure 7-1 Substation Automation structure Network Control Center NCC

> Q)

....1 1:

0

i.....

U)

G)

>

Q)

....1

m

!

Iiiii HV equipment

Q)

-'f

> Q)

)l

....1 t/1 t/1 Q)

u

142

0 .... D..

-Q1

-Q)

-09

-

...

GIS or AIS Switchgear Instrument Transformers Power Transformers Surge Arresters

7 2 Station Level

7.2

Figure 7-2 Operator workplace

The station level provides the Human Machine Interface (HMI) as central place for substation opera tion. This is normally located in a central room, which should be shielded against electromagnetic distur bances from the switchyard. Further also all general purpose hardware, screens and printers are concen trated on station level. This commercial equipment needs air conditioning and AC supplied by a special uninterruptible power supply (UPS). The rest of the substation works with 110 or 220 V DC, which is supplied by the station battery, directly in the switch yard environment. Consequently, all general manage ment and station level functions like event logging and printing, archiving and history data stonng are located at station level, as well as more complex sta tion level automatic functions that can easier be implemented on powerful, general purpose compu ters.

operational and communication software, so that this PC is normally located in the operation room. In case that this also applies for the telecommunication equipment. all can shrink down to one

Also the interfaces for the communication with remo te centers for network control, monitoring or main tenance are usually physically located at the station level. The station level equipment is often separated into two rooms: •. the operation room providing comfortable working conditions and noise protection for operators is equipped with the Human Machine Interface that consists of scr€ens, keyboards, tablets or mice, printers, and in earlier times also a control panel (Figure 7-2), • and a communication equipment room, where the computers,..backup printers, and communication equipment reside, which may be more noisy. Due to the miniaturization of electronics the PC hosting the HMI software can also run parts of the

143

room where equipm may integra one de

least for small substations.

to

medium

size

...

7.2.4

ed on one general-purpose computer, the

.,

additional-

72.1 Human Machine Interface (HMI)

ly needed work places are realized as terminals, which are associated to this central station level computer. The central station computer provides the

The human machine interface (HMI) seNes to operate and supeNise the substation. In modern substa- access to the process and conducts the archiving, log- tion automation systems it comprises one or several ging and station operator places. Each operator place has one or, in kept automation functions. It has to be in mind, however, that all station level automatic rare cases, even two to three screens, a keyboard, and functions must be coordinated with the operator's a mouse. Sometimes also functional keyboards or actions whether taken on station or on bay level. graphical tablets are used, but the mouse in combination with active buttons on the screen pictures is more and more standard practice, so that 72.3 Substation Database and Archive functional keyboards are no longer required. Exceptions to this are screen-based HMis in The large storage capacity that is available on station ,, harsh environment. which level by means of hard disks, tapes and nowadays must be sealed against dust or humidity. Here often touch screens are used, or specially designed functio- CDs, naturally leads to a system architecture, that locates the data archive for all archiving nal keyboards. functions on station level. Also the data for engineering and A printer for screen hardcopy and reports supple- system configuration as well as for maintenance are ments the operator place. In earlier times, also event usually stored on this level. if not even higher to allow log printers have been used in order to overcome the central administration for a lot of substations. Depen- limited computer storage capacity by "storing" event ding on the purpose, either data files or relational history on paper. The disadvantage was that the prin- databases are used for data storage. Because of per- ters could run out of paper. In view of the huge starformance requirements actual process status data is age capacity that is today available on modern hard very often held in manufacturer specific real time disks in combination with the advent of high capacidatabases implemented in the RAM memory. New ty backup media like CDs or tapes as well as of the technologies like object oriented databases, OPC (OLE, possibility to use high speed communication links to i.e. Object Linking and Embedding, for Process Con- maintenance centers the event log printer is slowly trol) for process data access, as well as the increasing outdated. computer performance will change this present prac- tice resulting in an object oriented data storing concept that provides data access via multiple views res72.2 Local Control and Station Level pective different usage aspects.

Automatics

Depending on size, complexity, and required reliabi72.4 Process Data Access lity, station level automatic functions may reside on a

I

144

separate station levellED with the same reliability and All station level functions need to haveprocess data. This has access to the environmental quality than the bay leveiiEDs. These to be enabled via specific com- functions may also be implemented into the station munication functions depending on the kind of data HMI computer or another station level general-purto be accessed as well as on the pose computer, which then normally needs special tocol to be communication promeasures like redundancy to obtain the needed avaiused. In order to decouple the station level functions from the communication protocol. a lability. If all needed functionality can be concentrat- process access layer is implemented in between.

r

J

r

,.

. '?'

GPS Master clock

In SCADA systems a central process database is typi cally used provided with relatively slow wide area communication links. Its state is regularly updated from the process via the communication system, and the process related information is used by all station level functions. Industrial control systems with high speed LANs rely in contrast on distributed process databases that are located in the bay level controllers and are accessed from the station level functions via LAN. The latest SW development harmonizes both ap proaches by standardizing an API (Application Pro gramming Interface) to process data. The OSF (Open Systems Foundation) has set up an industry standard interface for accessing the process: OPC/DA (OLE for Process Control/Data Access). It hides the details of data access, and can itself offer communication-bas ed access to the process data via remote procedure calls. The OPC history data access provides the same service for certain kinds of archived data.

72.'-J Time Synchronization 72.5. 7 Local time As it has been explained already in the functional description chapter, a lot of functions need time stamped data, and time synchronization is therefore a very important system support function. A lot of dif ferent methods for time distribution and time syn chronization are applied. Two general methods can be distinguished: Time synchronization via a separate synchro nization pulse: This method needs a separate wire or optical cable for the distribution of the synchro nizing pulse once a second or a minute to all IEDs concerned.

7.2.5

lnterbay bus 1

Master clock lnterbay bus 2

Figure 7-3 Time synchronization via /nterbay bus

Time synchronization via communication bus ses: A master clock that is located at each communi cation bus maintains the correct time. The clocks of all connected IEDs that need a synchronized time are synchronized via the master clocks. This may either be done by broadcasting time telegrams from the master clock, or by slave clocks that are regularly asking for the valid time (Figure 7-3).

72.5.2 Global time If time synchronization is needed between several substations, then a common external master clock has to be used. This can be located at a network con trol center to synchronize the clocks of all connected substation automation systems and RTUs. The·even more accurate method mostly applied today is, to use a publicly available radio clock time master for synchronization, like the GPS satellite system or the DCF77 radio time sender. The corresponding time receivers are then located in the substations, typically at station level.

145

72.6 Remote Control and Monitoring

7.2.7

72.6. 7 Communication Gateway The communication gateway provides data access and control from a network control center. It needs a physical coupling to the wide area communication connection used by the NCC, and a protocol con r ter, which interprets the messages according to the NCC protocol and translates these to actions in the Substation Automation system. The protocol conver ter can either be a dedicated device that is connected to the station communication system, or it can be a SW function that is integrated into some station level computer. In each case, it is located at station level as well, possibly in a special communication equipment room together with tele-protection, tele-alarm and tele-monitoring related communication equipment

72.6.2 Remote Control Functions The remote control function is used to operate the power network The response time for control actions should be within the order of seconds. Since the communication bandwidth for remote connec tions (Wide Area networks, WAN) and dis urbances of communication used to be a problem in earlier times, dedicated communication protocols have been invented for control, which were optimized for error detection and efficient coding, and contained a "Select before Operate" procedure for the safety criti cal commands. This two step control procedure together with high redundancy enabled the operator to check whether the selection of a switch was correct before he initiat ed the command, and assured that commands were transmitted in a safe way. The disadvantage, however, was that due to the lack of internationai Standards, each manufacturer of net work control systems or Remote Terminal Units used his proprietary protocol. This lasted until the year 2000 when the IEC 60870-5-101 standard was

146

ready to be used worldwide.

New communication technologies together with high bandwidth communication media of high quality e.g. with optical fibers are virtually disturbance free and will in future allow tc use other protocols, which are derived from standard commodity technologies. As an intermediate step, IEC 60870-5-101 was upgrad ed to be used on high-speed Wide Area Networks (WAN) in IEC 60870-5-104.

72.6.3 Monitoring Functions The monitoring functions provide an overview on the condition of the substation equipment. the control system equipment. and on all events and disturbanc es that occur in the substation. The process condi tions are naturally also taken into account for the con trol actions. Pure monitoring functions are usually used for asset condition monitoring, or for detailed disturbance ana lysis after a fault. This means that time is not critical for remote data transmission, and it may last in the order of minutes to hours rather than seconds. On the other hand, the amount of data that is archived in a substation is much bigger than just some limited state information. If cost and bandwidth is a problem, monitoring data can be exchanged via dial-on demand systems, i.e. a permanent data link is not required. This is the reason why dedicated communi cation links for monitoring are often separated from those used for control purposes. The protocols used are derived from commercially available protocols at the physical and link layers, and complemented with manufacturer specific protocols at the higher levels. The application of the modern communication tech nologies will however lead to a merge of control and monitoring related protocols based on commercially available stacks - like it is envisaged in the new sub station communication standard IEC 61850.

72.7 Data Exchange between Station Level and Bay Level The station level functions rely on data exchange with the bay level functions - sending down commands as well as configuration parameters and data, and retriev ing the process state and locally captured fault and

.,

1, -

7.3

--,""='"="""""

Figure 7-4 Bay control and protection cubicles in a control building

disturbance data. Up to now this has been conducted on the basis of manufacturer specific communication protocols often derived from existing protocol stacks and adapted at application layer to the specific needs. Depending on the manufacturers tradition, master/ slave protocols or multi-peer protocols have been used (see chapter 8 for an explanation of these com munication modes). This also had an impact on the implemented control system architectures. Master/ slave based protocols lead to star structures with a central master, while multi-peer protocols allow the distribution of functions between bay level devices and also distribution of station level functions to dif ferent devices. The new IEC standard IEC 61850 har monizes these practices and leads to a new flexibility for control system users as well as to improved main tenance quality.

7.3 Bay Levei The physical bay level is close to the switchyard equipment, i.e. • In the case of medium voltage equipment this is the medium voltage cubicle. Modern control and protection IEDs can be incorporated directly into this cubicle in order to save material for a separate cubicle as well as cabling costs. The IEDs' built-in HMI can be used directly to safely operate the bay. .,_ • In the case of high voltage switchgear it has to be distinguished between air insulated substations (AIS) and SF6 gas insolated substations (GIS). GIS is normally housed in a building for protection against rain, temperature variations, wind and dust.

147

73.3 Bay Level Monitoring

7.3.4

Protection and control cubicles for GIS are located in the building directly next to the switchgear to keep cables short between cubicles and switch gear. The building is further used as shielding of the outer world, e.g. station level devices, against electro-magnetic interferences. In the case of AIS special bay level housings or shielded kiosks are built near the bay. Despite of the fact that serial communication links are provided between the station level operator places and this bay level kiosks to save cabling costs, a significant amount of cabling remains between the bay kiosks and the primary equipment (Figure 7-4).

73.1 Bay Level Control The bay level control function allows to operate a bay locally. All bay related measurands, alarms and rele vant state information are displayed here, and control commands can be initiated by means of a control panel normally located at the same place as the bay level cubicles. This HMI may be also integrated in the bay control unit (BCU) as touch screen or.screen with functional buttons (see 7.3.4).

The state information and alarms necessary for ope ration and maintenance are displayed in the bay, as described in 7.3.1 and 7.3.2. Additional monitoring functions might also be located in bay level cubicles, but there is normally no dedicated HMI provided as the condition evaluation is conducted either on sta tion level or even higher levels. For more accurate performance and failure analysis, high resolution disturbance and event recorders may be installed on bay level, often retrieving data from several bays.

73.4 Human machine Interface (HMI) The bay level HMI allows local control of the bay, and performing of all control actions, which are essential to isolate the bay from the rest of the substation, so that maintenance work can be conducted on the pri mary equipment

•

73.2 Bay Level Protection level, as the classical objects like lines, transformers and generators are all allocated to switch bays, so that they can be isolated from the substation busbar by tripping the corresponding circuit breaker.

148

Digital microprocessor based protection relays can be placed into the bay cubicles as well. Typically,the state of a relay and some important alarms are shown with some LEOs at its front side. Often numerical protection relays have a LCD based builtin HMI, which allows checking the last events and the activated protection parameters. Sometimes this is done additionally or instead with a plugged-in laptop computer and spe cial parameterization software.

Figure 7-5 Bay level control via built-in LCD display

Alarm annunciators indicate causes of failures, and the state of the protection and control equipment It further displays the current position of the switches, and bay related measurements. The control panel can either consist of a LCD panel that is integrated into the control device (Figure 7-5), or it can merely comprise some LEOs as in the case of protection devices.

li

G-1 !

r·

Station HMI

7.4 Control cubicle

Process level

Protection cubicle

Bay level

Station level

Figure 7-6 Local bay level control via cubicle

For HV or EHV transmission substations the HMI can be located in a completely separate control panel with mimic and key interlocked operation over swit ches or push buttons, complimented with alarm LEDs, analog measurement instruments, or digital LED bars for the indication of the measured values of voltage, current, frequency, active and reactive power (see Figure 7-6) A separate control panel operating on 220 V DC has the advantage that the switchgear can be operated even if the controllED is out of operation. In such an emergency situation the functionality of the local con trol cubicle is degraded, i.e. the interlocking and syn chrocheck functions are not active.

74 Process Level The process level comprises: • Hardwired cable connections to the primary equipment. • Auxiliary switches indicating the switchgear positions. • Electromechanical control relays with associated solenoids to transfer the switching commands into mechanical switching operations, or IEDs

• Connection of conventional or electro-optical CTs and VTs for voltage and current measurements. • Sensors for non-electrical measurements like gas density, oil and gas pressure, temperatures, vibrations etc., providing electrical signals or serial telegrams. • Serial communication links if applicable. Operation at this level means direct manipulation of the switchgear (Figure 7-6). With the advent of the unconventional sensor technologies for voltage and current measurement, electronic sensors are directly located in the switchgear, so that the hard-wired pro cess interface becomes an electronic serial process bus interface (Figure 7-7). A prerequisite for achieving ge neral acceptance for this new technology is how ever the availability of a world standard for process bus communication, as it is coming with the standard IEC 61850. If this kind of technology is widely accepted, then, apart from unconventional sensors, also other archi tectural changes are possible. They range from·-sim ple remote inputs and outputs to reduce the cabling up to additional functions incorporated in the sensor electronics, which support e.g. maintenance and asset management. These are then called intelligent sen sors and actuators, and the whole concept is known as intelligent switchgear.

149

Actuator for 01

Line Protection 1

Actuator for circuit breaker control

7.4.2

Bay Controller Line Protection 2

Sensors for current & T1 voltage measurement

Busbar Protection

Process Bus Phase 1

Q8

Figure 7-7 Bay protection and control with intelligent primary equipment

7.4.1 Hardwired Terminals

74.7.3 Commands

The conventional way for the exchange of data from and to the switchyard is to use hard-wired connec tions to terminals and marshalling kiosks, which allow distributing the switchgear state and position to diffe rent control locations. Cables installed in underground cable channels conned the marshalling kiosks with the bay level equipment.

The terminals are wired to the opening and closing coils of the primary equipment. The needed power for operation is supplied via the cable to the bay level from the auxiliary DC power supply from the station battery.

74. 7. 7

Binary

7.4.2 Remote Input/Output (1/0) Units

Switchgear

Position Indication The most common way is to wire potential free contacts to the terminals of the control or protection cubicles. The substation automation system then uses the auxiliary DC power supply from the station bat tery to convert the contact position into an electrical signal as input to the bay level binary input of the electronic cards respectively its interposing relays.

74.

7.2 Indication

150

Analog

Process

Status

The outputs from VTs (100 or 200 V) and CTs (1 or SA) are wired to the terminals. Caution must be taken not to overload these connections, otherwise the instrument or interposing transformers could be de stroyed.

A way to reduce cabling and enlarge the number of inputs and outputs (1/0) of the electronic equipment is to use remote 1/0 units, short RIO. They can be located close to the process terminals, and they are connected to bay level equipment via a serial process bus. Because of the severe electromagnetic interfer ences that occur close to the switchgear, the process bus should consist of optical fibers only. Modern sensor technologies especially for voltage and current transformers need electronics for sensor information evaluation. This means that the electronic equipment of the sensors and actuators merges with the HV switchgear, and that only the optical process bus remains as process connection. In this case we use the term Process Interfaces for Sensors and Actors (PISA) rather than Remote 1/0 units (RIO).

I.

8 Substation Automation Architectures

8.1 Introduction 8.2 From conventional control to intelligent automation

8.2.1 The Impact of Computer Technology 8.3 Communication within the Substation 8.3.1 Design Aspects for Communication 8.3.1.1 Communication Requirements 8.3.2 Communication Modes 8.3.2.1 Master/Slave Communication 8.3.2.2 Periodic process state transfer 8.3.2.3 Peer-to-Peer Communication 8.3.2.4 Multi-peer Communication 8.3.2.5 Client-Server Communication 8.3.3 Time Synchronization 8.3.4 Performance of Communication 8.3.5 Safety and Availability Aspects 8.3.6 Communication Media 8.3.7 The User Benefits Derived from serial communication 8.4 From Remote Terminal Units (RTU) to Substation Automation 8.4.1 The Impact of communication technology on Network Control 8.4.2 From Centralized SCADA to Decentralized Automation 8.5 The Integration of Protection and Control Systems 8.5.1 Motivation for the Integration of Protection and Control 8.5.2 Safety and Reliability Aspects 8.6 Allocation of Functions 8.6.1 Criteria for the Allocation of Functions 8.6.2 Remote Control Function 8.6.3 Local Control Function 8.6.4 Local Automation 8.6.5 Safety and Reliability Criteria 8.6.6 Availability Criteria 8.7 Integration of Primary Equipment 8.7.1 Process Bus 8.8 Asset Management Support 8.9 Dependability 8.9.1 General 8.9.2 Functional Redundancy 8.9.3 Physical Redundancy 8.9.3.1 NCC Connection 8.9.3.2 Station level 8.9.3.3 Inter Bay Communication 8.9.3.4 Bay level 8.9.3.5 Redundancy on process bus 8.9.3.6 Availability calculation examples 8.10 References

·

152 152

8

156

Table of content

153

156 156 157 157 158 158 158 158 158 159 159 160 160

161

162 162

163 163 163

164 164 165 165 165 166 167

167 167

168 168 168 170 171 171 171 172 173 173 174

182

151

8 Substation Automation Architectures

8.2

8.1 Introduction In the previous chapter we looked onto substation automation system structures from the switchyard geography and from the operator location point of view. Here we will have another look from the up grade possibilities of existing conventional systems to typical communication structures, and from the relia bility and availability point of view of these structures.

• is realized within its own dedicated hardware, • needs its own inputs and • delivers its own outputs to the process and to its own HMI (Figure 81). The local control cubicle serves additionally as a mar shalling point for wiring the data from the switchgear to all devices which need it, using contact multipliers, separation amplifiers etc.

8.2 From conventional control to intelligent automation Conventional Control means that the substation con trol functionality is implemented by means of devices

Fault

like electromech_anical relays and push buttons only. The main characteristic from the system structure point of view is that each function

For bay level control as well as central control from station level this means a lot of cabling, parallel wiring

Bay Protection

Bay Control

Bus bar Protection

II)

...1

c:

i

0

-

•

(I)

G)

> II)

Local Control

...1

•

m

-

II)

...1

ttl ttl

II)

e

( J 0..

152

-Q1

Figure 8-7 Conventional substation controi and protection

-._ GIS or AIS Switchgear

For bay level control as well as central control from station level this means a lot of cabling, parallel wiring and marshalling from the switchyard primary equipc ment to the appropriate control panels. Interlocking is implemented - if at all existing and not handled by rigorous working procedures - by means of electro mechanical relays and contacts with application of the Boolean algebra approach. If additional functionality is required like event record ing, fault recording, measurement trend logging etc. physically separated, dedicated devices have to be used and wired to the process. CAD systems are used to engineer all the electromechanical equip ment as well as the wiring and cabling between them. Protection devices are typically connected to control or monitoring devices with two or three con tacts, providing information of a protection function start, a trip, and of the state of the protection device.

8.2.1 The Impact of Computer Technology

• With growing processing .;:Jnd memory capacity of microprocessors more intelligent functions can be added. • This intelligence allows a much higher degree of self-supeNision of an lED, thus enhancing the system safety and availability. • Multiple processing of the same data by different functions saves raw data connections previously each function needed its own inputs. However, digitalization of analog data introduces other categories of problems to be handled: • Serial communication introduces additional delays. • Instead of CAD based connection engineering for wires and cables now signal engineering and communication system design is necessary. • The information processing hardware must withstand the harsh environment in the substation, especially the electromagnetic interferences.

The advent of the microprocessor in the substation allows to process data in digital form. Therefore, the data must be converted to digital form, before it can be processed. For all binary data like alarms and switch positions this is not a big problem, because this data is already available at (relay) contacts. For analog data the analog/digital converters (ADC) are used to con vert measured values to digital samples. The advan tages of providing data in digital form are:

This leads to the following typical structure for IEDs (Intelligent Electronic Devices) used at bay or process level close to the process (Figure 8-2):

• Digital data cannot be distorted by aging of the hardware. Data gets and stays much more accurate than before. No calibration or testing is necessary after commissioning. But the super vision of the ADC may be recommended at least

• An EMI barrier against disturbances and over voltages consisting e.g. of opto-electric couplers or separating relays and interposing transformers shields the 1/0 from the outside world.

fm protection. • Data in digital form can easily be exchanged by serial communication. This reduces the former bundles of cables to a thin serial bus, usually in form of optical fibers.

• An internal bus connects the central processing unit (CPU), the needed RAM, ROM, EEROM or flash memory and the serial interfaces for communication at one side, and digital as well as analog 1/0 modules at the other side.

• A local HMI, either built in or via a serially connected PC allows to configure_the lED.

153

...

?

·

8.2.1

.,

Line bay

8.2.1

y

Process Interfaces

..

Bl

..

Communication Interfaces

Local MMI

B O

AI

Bl

G •

.. [][] .. .. ..

Bl

•

,------1

j- ...-,

Bl Binary Input BO Binary Output AI Analog Input Fl Filter AD Analog/Digital Converter

• SA • SMS

... Intelligent electronic device (lED) for protection and control

Figure 8-2 Typical bay levellED structure

In spite of the fact that a microprocessor is able to perform a iot of functions, some redundancy must be kept in the data acquisition part as well as in the hard ware performing the functions to assure the required availability. The ever-growing communication bandwidth makes the communication-related problems treatable. The new bus technology together with multi-purpose processing capacity allows separating availability issu es from the functional issues, and both can be tai lored as needed.

154

This fact allows structuring a modern substation auto mation system according to the operational needs as it has been described in the previous section, and in accordance with the physical layout of the substation.

The resulting principle system architecture is shown in Figure 8-3. The data is acquired at the proces's level by means of remote 1/0 units (RIO) and intelligent sensors and actuators (PISA= j)ocess )nterface for ensors and 8ctuators). The process bus connects them to the bay level equipment, where the bay related protec tion and control functions including the bay level HMI are located. The bay level units talk either to each other or to the station level servers via the interbay bus. The station level functions implemented on the station servers talk via gateways either to network control centers or monitoring centers, and to each other. The station level control unit performs station level process related tasks like switching sequences.

l_

External systems

HMI components

NCC

Station bus

8.2.1

Station level lnterbay bus

Bay level

;··t :.

/

. . fJ ::-.:\ :

Process level

Figure 8-3 Basic substation automation system architecture This architecture leads to a high degree of dependa bility. Functions for lower hierarchical levels are imple mented in appropriate parts of the control system and remain operative even if devices on higher levels or other parts in the same hierarchical level become faulty. Further, the environmental conditions are the harsher the closer the hierarchy level is to the process, which requires an appropriate physical design of the used components.

• The bay related control and protection functions as well as the safety related functions like station level interlocking are executed on bay level. If the process bus is an internal bus inside the lED and no external process bus exists, and the EMI barrier (relays, opto couplers etc.) is internal as well, then the IEDs can directly be connected to the process. But the devices must withstand the harsh environ ment of a HV or MV switchyard and must be able to be built directly into bay level cubicles close to the switchyard.

The system is divided into the three hierarchy levels described already in the previous section:

• The process level comprises the connection to the switchyard (the process) via cables from the bay level 1/0s, via remote 110 devices (RIO), or via sensors and actuators (PISA) with integrated electronics, which may additionally contain sqme process related functionality. All these devices are either located in the vicinity of the switchyard, or are even integrated into the HV or MV switchgear.

• On station level there are the HMI and archiving functions, and the connections to the external world: to a network control center (NCC), to tele alarm systems, remote work places, protection maintenance systems, asset management systems, office systems etc Also devices with control func tions covering more than one bay are related to the station level. Station level devices can some times be placed in office type environment, how ever, for EMI reasons industry versions are often needed.

Each level contains a bus to allow communication between devices in the same level and in adjacent levels.

155

',:

'? '?

8.3 Communication within the Substation

8.3

• The station bus is mainly used for HMI connec tions to terminals and printers, as well as interface to office environments, and for the supervision tasks between servers. • The inter-bay bus connects bay devices to station level (vertical communication), and additionally allows real time communication between bay devices (horizontal communication). • The process bus connects actuators, sensors, intelligent peripheral units and remote 1/0 units with time critical real time data to the bay level processing units. This structuring is also a logical concept. If the data transmission capacity of the bus used and the com munication protocols allow it. several of the logical busses may run on the same physical bus. Very often, the station bus and the inter bay bus com munication are implemented on one and the same physical bus. Other groupings are possible as well, if it is required with regard to the scope of functiona lity and if the bus capacity allow this. The extreme is that all communication runs on one physical commu nication system. In such a case, however, the reliabi lity of the system has to be analyzed at communica tion system level as well, and very often the commu nication system itself has to be structured according to the operational levels and groupings respectively. As is shown in [6]. even at the current state of 100 MB Ethernet this might also be forced by performance reasons.

156

One of the special features of a SA system is the pos sibility of accurate station-wide time synchronization, which may even be region wide if radio or satellite clocks are used as substation level time sources. The time master can in principle be coupled to each level. In most cases it is connected to inter-bay bus level, and then all devices are synchronized from here via the communication system.

8.3.1 Design Aspects for Communication 8.3.1.1 Communication Requirements As already stated by CIGRE [10] and taken up in IEC 61850 part 5, the communication requirements for communicating functions can roughly be classified with three criteria: 1. Maximum allowed age: the maximum age allowed for using the data by the (receiving) function. This corresponds roughly to the response time and can be considered as a worst-case response time that can be tolerated. This means, that this response time must be guarantied in normal operation, and that it must be detected and handled appropriately by the receiving function in the rare cases when it can not be kept. 2. Data integrity: the degree of communication safety in case of disturbances. Here three levels are identified: • High integrity is needed, if the

data directly influence the process (e.g. a command); • Medium integrity is needed, if the

data indirectly (via a human operator) influence the process (e.g. an alarm which leads to an operator interaction); • Low integrity can be used, if the data does not have any influence on the process, like monitoring data used for later analysis only. 3. Exchange method: Spontaneous means that data is communicated as soon as any change happens. On request means, it is only acquired if needed by some function or human being iike an operator or maintenance engineer. The following table illustrates this classification for some typical kinds of data exchanged in a SA System.

Data type

Maximum allowed age

Data integrity

Exchange method

Remarks

Alarm

1s

Medium

Spontaneous

Alarms are urgent process changes that must be brought to the attention of an operator, to perform corrective actions

Commands

1s

High

Spontaneous

Commands directly act on the process

Process state data

2 s (binary), 5-1 0 s Medium (measurands)

Spontaneous

Gives the operator an overview on the process state

Time stamped events

10 s

Low

On request

Sequence of event data is used for later analysis of a problem

Interlocking data

5 ms (fast block)

High (directly influences the process via commands)

Spontaneous

Used to prevent dangerous commands

Interlocking data (state information), other Automatics

100 ms

High (directly influences the process via commands)

On request (upon a command)

Used for Interlocking to prevent dangerous commands; or for automatics like load-shedding

Trip from protection

3 ms

High (directly influences the process via trips)

Used to clear dangerous situations Spontaneous by fault in the power system or in the switchgear

8.3.2

Table 8-7 Classification of communication functions

8.3.2 Communication Modes

8.3.2.7 Master/Slave Communication

The architecture shown in Figure 8-3 allows in princi ple that each device connected to a bus can com municate with other devices. But a completely free sending of messages from any device at any time leads to telegram collisions on the bus, and thus to communication disturbances. Therefore, the sending of messages has to be regulated by communication media access mechanisms to restrict the communica tion access or allow the handling of collisions. This has a big impact on the possibilities to distribute a function between the physical devices. The most common communication modes are discussed in the following. Observe that these modes might be used on link level for media access as well as on applica tion level for application communication. We focus here on the second aspect.

One master accesses a lot of slaves. The slave devic es are only responding if they are polled, i.e. they are not allowed to send information spontaneously. This avoids message collisions, and the master can per fectly determine how the communication bandwidth is distributed between the slaves respective the diffe rent kinds of data. However, no direct communica tion betweeslaves is possible.

8.3.3

The Master /Slave mode is the standard mechanism used for the communication of substations/RTUs to a network control center, which is the master. In sub station automation systems, the station level device is usually the master. This restricts however the com munication to a data flow between station and bay level only. This means further, if the master fails, the whole system is down.

8.3.2.2 Periodic process state transfer The process state data are periodically sent. via the communication bus. It is marked with the source address, thus facilitating data distribution on the bus to many possible users

157

simultaneously. A bus mana ger controls the access of IEDs to the bus. This is a generalization of the master-slave communication mode, and all bus participants can hear and use all process data. It is applied in some process busses like MVB (IEC 61375) and WorldFIP. The advantages are that no data collisions can occur, so that the full bus bandwidth can be utilized, and that the maximum data age is deterministic and determined at the engi

neering phase. However, the disadvantages are that • some additional measures are needed to avoid the single point of failure: a defect of the bus manager, • the bus capacity is always fully utilized, even if the data values have not changed at aiL

8.3.2.3 Communication

Peer-to-Peer

With this communication mode, two peers can freely talk to each other at any time This mode is typical for a full duplex physical point to point communication link. If applied on higher level across a bus with more than two devices, collisions can occur at the lower level which must be resolved on the lower commu nication stack levels. A typical highlevel peer-to-peer protocol is TCP, the Transfer Control Protocol that is used for Internet communication.

8.3.2.4 Communication

Multi-peer

Also in this mode, each device is a peer that can free ly talk to any other peer. By using a multicast or broad cast mechanism, it can even transmit one message to several other peers at the same time. Again, this

be solved on the lower communication stack levels. Note, that protocols with periodic sending (8.3.2.2) allow multi-peer communication that is collision free by definition. If a packet switched network is used with point to point duplex lines between the routers, e.g. in the case of Internet or with Ethernet switches, no collisions occur on the link as well. However, as queues within the routers have to be build up instead, the lack of buffers might lead to message losses like due to collisions.

8.3.2.5 communication

Client-Server

This mode is a variant of the master slave mode, which is e.g. applied in the world wide web for the HTIP protocol. or for accessing remote data bases. A server offers data, and the clients can ask for these data. The differences to master slave are, that not only one client (master) can talk to several servers, but also a server can simultaneously be connected to several clients. The server can even spontaneously send data to the client as soon as the client has esta blished a connection. Again, collisions that might occur on the physical bus must be resolved on lower protocol stack levels.

8.3.3 Synchronization

Time

The standard time stamp resolution within a substa tion is 1 ms. If the SA system is a distributed system, then either all changed data have to be transmitted to a central time stamping device within 1ms time, or the clocks of all devices must run synchronously with 1ms accuracy. For this last concept either a separate time synchronization 'bus' is used, which sends a time synchronizing pulse from a central master clock to all I

devices that conduct time stamping, or the central master clock synchronizes the individual clocks of all devices connected to the communication bus. If an other bus is connected via a gateway, then the gate way clock is used as master clock on the connected bus. The gateway clock thus separates the time set ting mechanisms of the different connected bus seg ments (see also 7.2.5).

15 8

mode leads on a bus system to collisions that must

The concrete time synchronization method within a bus is specific for a bus and protocol type. In case of

· a master/slave bus, synchronization simply means sending time telegrams from the master to all slaves. In case of an Ethernet based peer-to-peer communi cation system like IEC 61850, specialized time servers are provided with the SNTP (Simple Network Time Protocol from Internet ) protocol. Each slave asks for the current time as often as needed to assure accu racy of its own clock, and special mechanisms are applied to compensate for the communication time delays.

becomes a single point of failure that can block the entire system. Especially it sh'ould be investigated if some of its devices have failure modes that may block the whole communication system e.g. by con stantly sending rubbish on the bus.

8.3.4 Performance of Communication The challenge for a SA system that performs real time functions is to guarantee the maximum allowed age of data, to identify outdated data, and to react accord ingly. This means, that communication throughput alone is not sufficient to judge the suitability of a communication system for real time communication. It may be that a relatively slow master slave system, where the performance is calculable in advance, has a higher communication related reliability than a faster communication system, that is subject to colli sions causing stochastically varying response times. The performance that is really needed and measures taken to guarantee the maximum allowed age depend on the actual requirements of functions to be performed. To summarize the performance requirements in a simple sentence: The actual communication system throughput capacity must be higher than needed for normal operation (at least 10% higher), and high enough to guarantee the maximum age required in the worst case load scenario to be handled.

8.3.5 Safety and Availability Aspects The availability of a communication system depends on all devices that belong to the communication system. As the communication system serves for some specific purpose, the availability is handled as a common system requirement on functional level (see 8.9). It should however be noted, that only careful system design can prevent that the communication

. '

8.3.5

The term "Safety related" to a communication system has two aspects: • No communication message failure shall lead to unsafe actions • No lost or late message is .allowed to lead to unsafe actions. The first point can be tackled in two ways: 1. by using communication error detection mechanisms, 2. by making the transmission media immune against disturbances to reduce the number of bit errors.

The standard IEC 60870-5-1 provides guidelines, to specify how safe the communication of certain types of data should be within a control system, and de fines three integrity classes, which roughly corre spond to the three classes also used by CIGRE and the standard IEC 61850. For each integrity class the safety is specified in terms of the allowed residual error rate, i.e. the probability that a communication error is not detected. The so. called Hamming distance gives the figure how many errors can be detected in one message. Today all pro cess buses use typically a Hamming distance of at least 4, sometimes 6, to detect transmission errors. For normal telecommunication environments this is sufficient for medium integrity, but not for high inte grity. And within substations the error rate is normal ly higher than in Tele-communication environments. Therefore glass fibers have to be used, and special redundant communication procedures are introdu-

159

i,,

8.3.7

ced, like Select before Operate for issuing commands as known from network control protocols.

only protection against electromagnetic disturbances, but also special care for adequate earthing of the cable shielding.

But even if the residual error rate is small enough, In order to avoid earthing problems and to keep the messages could be lost due to buffer overruns or bit error rate due to electromagnetic disturbances overloaded routers and switches. Therefore, lost · practically at zero, optical cables are recommended mes sages as well as the loss of a message source within the switchyard environment Glass fibers can must be detected. Also here the methods used are cover a distance up to 2000 m or even more in depen dent on the bus and protocol types. spe cial cases without loosing transmission speed, while plastic fibers could be used for shorter What is important and protocol independent is the lengths of some tenth of meters. As plastic fibers provision of a means that informs an application pro are ageing relatively soon in comparison with the gram, that such messages have been lost. In the long life of SA systems, it is highly recommended to stand ards IEC 60870-5-101 and IEC 61850 this is use glass fibers instead for all distances. realized by the provision of data quality attributes, which indi cate beneath the invalid flag also a topical flag to indi cate that the data is up to date. It 8.3.7 The User Benefits Derived from depends on the application, however, to define serial communication what up to date means and to take actions if the data is not up to date. Further, the application must be designed in such a way that missing or With careful print design, input isolation and device late information does not lead to an unsafe state shielding, microprocessors and related electronics can respective that the probability of an unsafe state is nowadays be installed close to the process. Data in digital form allows easy serial communication. So dis sufficiently low. tributed systems can be built, which keep the cabling to the process straight forward and short, and after wards distribute the data with serial busses 8.3.6 Communication Media preferab ly in optical form to all places where they are needed. This new system architecture saves Apart from the RS232C standard for serial connec space for cabling as well as for central electronic tions of modems the industry process busses often cubicles, which are eith er obsolete or significantly used the RS485 standard with shielded twisted pair smaller. The physical signal marshalling is replaced by cables. Later the Ethernet bus came up using coaxial the logical signal marshal ling, which means that the cables to enable higher bit rates. In order to achieve complexity is the same or even higher. On the other better HF shielding, higher mechanical flexibility and hand, the electrical CAD systems are replaced by multiple connections in one cable, Ethernet has switch powerful signal engineering tools. The physical ed back to twisted pair cables. Therefore, communi wiring and connection work that remains is cation links for Ethernet with a speed of ;;;:100 straightforward and can be executed much faster. Mbit/s are using shielded twisted pairs or fiber optic cables only rather than coaxial cables.

160

Within the substation environment long electrical cables, however, are sensitive against induced high transient voltages and currents, which requires not

Another big advantage of general purpose micropro cessors that are capable to perform all kinds of func tions is that functionality and availability aspects can

'?

·,

?

8.4 From Remote Terminal Units (RTU) to Substation Automation be separated to a large extent from each other. Distributed systems inherently have a 'built-in' redun dancy, however system level oriented rather than function oriented like in a classical system. A failure of a station level unit leaves the bay level functionality working, and a failure of bay level devices just leads to failed functions of the bay concerned, whle the other bays and the station level functions continue to work. If there are certain critical devices that perform func tions where failure cannot be tolerated, hardware redundancy can be added as needed. A typical example is a duplicated system at station level, while all bay level (control) units are single devices. For the same reason, duplication of protection devices is very common at least for HV substations. General-purpose microprocessors even allow that different kinds of functions can be performed on the same device. This feature can be used for new redun dancy concepts. However, as especially protection is a 'traditional' business, people are used to the 'one function-one-device' concept and they do not easily accept the new system architectures that are possi ble. The ever increasing communication bandwidth for wide area communication enables direct access to SA systems from remote, e.g. for secondary and/or pri mary system maintenance as well as for planning purposes, network monitoring etc This new possibi lity enables different parties or even companies to share this access and to offer various kinds of main tenance services. The Internet offers a widespread and cheaply available communication medium all over the world, under the condition that security aspects are solved.

The centralization of network operation needs remo te access to the substations. In case of conventional substation control systems, this is implemented just by adding a remote terminal unit (RTU) in the sub station, which takes the needed data from some marshalling kiosk and transfers it to the network con trol center, respective connects commands from the network control center to some output contacts at the process. The RTU itself has, apart from pure com munication handling, only the tasks to time stamp incoming data, and to assure the safety of outgoing commands by means of 1 out of N criteria super vision and the select before operate principle. So, essentially it is just a digital conversion and serializa tion device.

8.4

The advances in microprocessor technology lead also to more and more functionality of the PLC (Erogram mable Logic ontroller) type within an RTU, e.g. it becomes programmable with function charts accord ing to IEC 61131. Advances in communication tech nology lead to distributed RTUs. These typically con sist of some core device containing the NCC protocol processing and the PLC functionality, and remote 1/0 cards for binary as well as analog data. Also a direct connection of CTs and VTs via analog inputs can be added to omit separation amplifiers and transducers (Figure 8-4). Thus, the RTU becomes a very basic SA system. Nevertheless, its central or master slave relat ed architecture normally causes some restrictions to its functional capabilities, performance and availability. Therefore, in a complete SA system, the RTU functio nality is reduced to a station level gateway to the net work control center (NCC), which could run even independent from the station level HMI,thus enhanc ing the overall system availability.

161

'(

i '·

. ...:v

Network Control Center

8.4.2

_.·_..:.f!

--1

Protection Bay 1,

r.:::_>'::

-·ijir--------- 4i&'ii .A.i....v 110 , .·-''i , Bay ti,

- Protebtl ff: Bay 'Nt\i':

1/0 Bay N

Figure 8-4 Distributed RTU with station level HMI

162

8.4.1 The Impact of communication technology on Network Control

8.4.2 From Centralized SCADA to Decentralized Automation

When SCADA systems were introduced, RTUs were connected to network control centers via specific modems, which, due to the physical media used and implementation technology available, had narrow bandwidth from 20 Bit/s up to 2.4 kBit/s. The upcom ing wide area communication technology like optical cables, PDH and SONET respective SDH, or Gigabit Ethernet allow today bandwidth from 10 Mbit/s up to some Gigabitls. Therefore it is today technically feasi ble to use commercially available, standardized com munication protocols with high data throughput also on wide area connections.

The growing processing capacity at substation level as well as increasing wide area bandwidth allow prin cipally to distribute most of network control center SCADA functionality down to the substation automa tion systems. In some cases the NCC system can be reduced to a workplace consisting of a simple remo te terminal that is capable to communicate with all substations. Ho\!Vever, this does not always make sense. If it is for example required to compare the history of events in the two substations at both ends of a line in correct time sequential order, then the cor related event logs have to be merged - and this is more than a simple terminal functionality. Apart from this, the overall system data archiving facilities have to be taken into account if new structures are set up. But for a lot of functions their distribution down to SA level is useful, e.g. that station level switching sequen ces can be initiated with one command from the NCC, or inter-substation interlocking can be made via direct communication via the connecting transmission lines between the SA systems concerned rather than via the NCC system or the common telephone net

The telegram coding efficiency is no longer an out standing protocol property. Therefore, new standards like IEC 60870-5-104 and IEC 61850 are technically feasible and reduce drastically the interfacing effort and enhance the application versatility. TCP/IP based protocols also open the ways for new applications like remote monitoring and maintenance, and online connection to asset management and planning appli cations. Their networking facilities with automatic re routing allow further highly reliable communication networks.

8.5 The Integration of Protection and Control Systems

Historically there was one device per function. This not only concerns protection and control functions, but different protection functions as well. Numerical relays lead to multi-functional devices that perform several protection functions in parallel. Only for relia bility and

work

availability reasons more than one protec tion device is required like main 1 and main 2 for transmission lines. In the utility organizations protection personnel used to be separated from operation personnel. This caus ed functions to be separated to different physical devices in order to set up boundaries between the various areas of responsibility - even if this is techni cally no longer necessary. It was claimed that reliabi lity of protection is crucial - but this is true for control as well.

8.5.1 M o t i v a t i o

n for the Integration of Protection and Control The occurrence of protection events - starts, trips, as well as problems with protection devices themselves - is critical for substation and network operation. So at least protection-monitoring data should be shared between operation and protection maintenance. Therefore the first step towards the integration of protection and control responsibility is, that monito ring data needed from the protection units are trans ferred to the substation automation system by means of serial interfaces. This minimal form of inte gration is widely accepted and is supported by the communication standard IEC 60870-5-103.

A third step is the physical integration of control and protection functions in the same device. This saves cost and maintenance efforts (one device instead of two), but leads to the question whether the protec tion function reliability is affected by the additional control functionality sharing the same HW resources.

8.5

8.5.2 Safety andReliability Aspects Both, for protection and control functions, the requi rements for reliability and immunity against their envi ronment are equally high. This means, that from the general implementation point of view there are syn ergies that can be exploited by using the same system platform for both functions. There are how ever also differences: control does only work. if a command can be communicated, while a protection device has to perform its local protection function also, if no communication exists. Therefore, a protec tion system must be designed in such a way that disturbances in its communication subsystem do not affect the working of the protection itself. How this is achieved, depends on the implementation strategy. For the first numerical protection devices special ope rating systems had been developed to assure that sufficient processing power to perform a protection function was always available. Nowadays, where a lot of processing power is relatively cheaply available, more and more commercially available real time ope rating systems are used. The separation of communication from function like proted1on can be done on hardware level. The com munication relies on its own hardware resources, while the protection function is designed in such a way that it can never be blocked by the communica tion part.

A next step is to coordinate operational states with protection parameterization, i.e. to combine operatio nal actions with adaptation of protection functions. A line can transfer more power in winter than in sum mer. So, the ambient temperature measurements that are available at an SA or NCC system could be used to adapt the protection parameters accordingly via the communication links, which is an example for so-called adaptive protection.

Nevertheless, the use of a common HW and SW plat form for protection and control is beneficial also to the control part, as it allows implementing backup protection functions directly in the control unit. !f this backup protection provides alternative protection algorithms to the main protection, this leads to an improvement of protection availability without the need of additional physical devices, i.e. without having more maintenance effort

--

._

·.

·

· 8.6

--

163

8.6 Allo cati on of Fun ctio ns

Most of the substa tion autom ation functio ns are dis tribute d; at least

to the extent that the protection func tions are distributed. They consist of an input/output processing function part on process level. a ·proces sing function part on bay level, and an HMI function part on station or bay level. Those par-s of a function that must be allocated to one physical device and cannot further be distributed are called logical nodes (LN) according to IEC 61850. One physical device may host several logical nodes. On the other hand, the same logical node type can be instantiated on dif ferent physical devices. All functions are implemented in te system by means of communicating logical nodes. The physical communication path is provided by the physical communication connections between the devices, to which the logical nodes are·allocated. We use the term horizontal communication for data exchange between logical nodes in the same level, and vertical communication for data exchange be tween logical nodes on different levels.

r---r---1 overcu"ent I Distance

Physical Devic

I

I protection I I protection

I

r------.. r,sx;n::'!-..-r._- - --S: !_ i!_ c! !i! 2!/.

. HMI

X

I

X

I

---------,

,DJ.s!_af!.Cf! !!.l'!!t!!_C_E"!_n1 :Ove'fcurrelit- - -

IJT>lf!Et.i.Of2 _ _ _ _I

r,CJ;.rr::_-uf!-l-!a-- _ !e _n X

_x

164

The left column of Figure 8-5 lists several logical nodes. Each of the remaining columns illustrates by crosses in boxes how these logical nodes are used to implement the functions Synchronized or point of wave CB switching, distance protection and over current protection (vertii:al boxes). Horizontal boxes indicate the physical devices, which host the logical nodes. The functional specification of the functions defines their implementation by means of logical nodes and interfaces between the logical nodes; especially also what kind of data does the client logical node need.

8.6.1 Criteria for the Allocation of Functions

r------Logical Nodes, 1

and communication services. This allows an easy sig nal engineering by just putting together logical nodes and allocating them to physical devices. The Fig. 8-5 gives some examples, how logical nodes can be used to implement functions.

I I I I 1

:1 - - -

- .I

The basic criteria for function allocation are the requir ed reliability and the communication needs in terms of bandwidth and maximum allowed age of data, in relation to the communication system available. A function be allocated close to the process as possibleshould to satisfy both as the communication needs as well as the reliability requirements. As mentioned in the previous part, a function can be implemented by several logical nodes that reside as close as possi ble to the location where they are used. If we take the overcurrent example of Figure 8-5, the logical nodes representing the bay CT and circuit breaker should be placed as close to the associated primary devices as possible as they typically belong to the process level.

Figure 8-5 Functions and logical nodes

The overcurrent logical node shouldbe placed at the bay level, where it can acquire data from the bay CT and has access to the circuit breaker.

For all common functions in substations the standard IEC 61850 identifies the logical nodes and their inter face to other logical nodes providing data objects

The HMI LN is placed in the HMI device- a station level PC, a bay level control panel, etc as needed.

i

.I

'?

'?

?

This allocation of the functions into the various levels has then to be matched with the physical substation layout, which reflects the reliability considerations for the substation, environmental conditions, installation costs, communication and lED performance aspects as well as operational considerations.

8.6.2 Remote Control Function The remote control function allows operating of the substation from one or several remote network con trol centers. The interface to the NCCs therefore resid es on station level. It uses, however, the same control function parts to perform a control function as used for station or bay level control, provided that it is al lowed to do so. The coordination with station level and bay level control has to be provided.

8.6.3 Local Control Function Local control can be performed from station level, from bay level, or directly at the primary equipment. For the first two the associated HMI logical nodes should reside at the relevant levels as illustrated in Figure 8-6.

8.6.4 Local Automation Local automation can either concern a bay, or the whole substation. The allocation of HMI logical nodes or just of the executing LNs to the relevant levels is to be done accordingly. Examples for general automatic functions are shown in Figure 8-6 on the left, and for a voltage regulator function on the right. Voltage Regulator

I VC I

LN for station level functions

LN for

8.6.4

Interlocking on Station Level Automatic Process Control means Generic Node for all .............undefined functions ,......"'-',

Interlocking on Bay Level

bay level

Tap

functions

Changer Controller

165

Figure 8-6 Interaction of LNs for the command function and (automatic) transformer control function HMI

8.6.5 Safety and Reliability Criteria From the safety point of view all logical nodes can be classified as follows: • Active safety: if the process 8.6. 5

(switchgear) is in an unsafe condition, active safety functions clear the fault This is the classical task ot protection. • Passive safety: these functions prohibit

(block) actions, which lead to an unsafe state of the process or could cause possible damage of equipment or endanger people.

CB Circuit

CBC

Breaker

T h i s i s t h e c

la s si c al t a s k o f

interlo cking and blocki ng functi ons. • N o t

s a f e t y r e l a

Sel ect

t e d

(

" )

a r e

.."

i : l

c r

j

Contro l circuit for comma nds

I· ·

(

" C

Ii i

n o r m a l l y

E E

0 ( )

I

i

Indication for circuit breaker position

a l l o t h e r f u n c t i o n s . From the architecture point of view it is important, • that safety related functions can not be blocked by other functions, • that a single failure e.g. within the needed resour ces (processor, memory, 1/0 channels, support functions, communication) of any function cannot lead to unsafe behavior, • that all logical nodes, which supply data for safety related functions either to block them, or to influence their safety related behavior, have to be regarded as safety related. The Figure 8-6 gives an example: The command out put of the circuit breaker controller (CBC) is a function that may cause damages in the process, if it is activ ated wrongly. The interlocking function (I L) providing passive safety should prohibit this to happen at the operational level. If, however, this happens accidental ly due to interlocking failure, the protection functions

(active safety) should clear this fault Therefore the logi cal nodes CBC, CB, DIS, and IL have to be regarded as safety related, while HMI is not safety related, as long as it can not block or affect otherwise any of the other LN's. The safety of commands also assured by the spe

is

F i g u r e 8 7 C o m m a n d s e q u e n c e

cont ext

as shown in Figure 8-7 A Select command is sent from the HMI to logical node CBC. The CBC, after checking if a command is allowed at all, for wards this select request to the CB lED. After success ful selection of the CB lED the Selected response is distributed back Now the operator at the HMI is al lowed to give the Operate command, but only for exactly the same switch.

i

I

I

I ·:

!

I

Starting from successful Select up to the Command termination, which happens either if the switch has successfully reached the intended position, or after a run time supervision timeout, the CBC is in the Select ed state. This state can be used to block during this time all further commands, which influence the inter locking conditions for this switch. This principle en hances the safety even further. It has already been used with RTUs as so-called 1 out of N blocking cri teria. As shown in Figure 8-7, the response of the CBC to the

Select request has to wait until the response from the next lower level arrives. Sometimes, especially if the client is not an HMI logical node, buta network cial command procedure. Most protocols fulfill only the requirements of IEC 60870-5-4 integrity class 12, while commands must fulfill the integrity class 13. This is reached be sending at least two telegrams before a command is executed. This two step approach, call ed 16 Select before Operate (SBO), might look in 6 this

I

control center, waiting times might get very long. In that case the select from CBC to the CB can be delay ed to the Operate phase of CBC. In any case, all pos sible blocking conditions already checked at the Select request including interlocking have to be rechecked when the Operate command arrives.

l

8.7 Integration of Primary Equipment

8.6.6 Availability Criteria The availability aspects have to be addressed by appropriate measures depending on the importance of the substation, or on the functions of the substa tion respectively. The single failure criteria is also a general rule for ·availability: • No single failure shall block several functions at once (weak form). • No function shall be blocked by a single failure (strong form). Naturally the criteria have to be specified to define what it means that a function is blocked. In a distri buted, multi level control system the control function is often assumed to be available, even if one bay can no longer be controlled. Only if more than one bay can no longer be controlled, the control function is blocked (failed). There are principally two ways to achieve a high func tional availability: 1. To use highly reliable components and duplicate only those, where it is absolutely necessary for safety reasons or single-point-of-failure criterion. 2. To use commercially available (cheap) components in a redundant architecture. Both methods may lead to the same operational availability. The first one might cause slightly higher investment costs, but only if not every part of the second solution has to be duplicated. The second solution, as a contrast. needs much more spare parts and repair efforts, i.e. higher maintenance costs. In practice a mixture of both methods might be used, or the commercial parts may be hardened for industrial applications. The burn-in phase is therefore a must for components in substation automation to get all com ponents to the bottom of their individual reliability bath tube curve. If non-industrial components are used, then the first 3 to 6 months of system opera tion have to be considered as burn-in phase with a higher failure rate in the beginning.

.

·

Chapt er 6 descri bes the conne ction of a subst ation autom ation syste m with conve ntiona l curren t and voltag e transf ormer s and auxilia ry switch es. Apart from this, new electr onic senso r and actuat or princ i ples have been devel oped, which provid e the data in digital form alread y. Also proces

s interface optimiza tion leads to primary device oriented grouping of sig nal interfaces, which then can directly be converted to serial form. They may even be directly incorporated into the primary equipment. This development requir es the introduction of the process bus into the system architecture.

8.7.1 Process Bus The process bus is next to the process, i.e. it has the highest requirements for electromagnetic interferen ce (EMI) withstand capability. Apart from this, it needs a very high throughput capacity with minimum delay, if voltage and current samples have to be transferred for measuring, metering and protection purposes, which are very demanding requirements. One of the first process bus solutions was based on IEC 61375, the Multi Vehicle Bus MVB. This is a cyclic bus with deterministic cycles ranging frorn around 1 ms up to 1 s. The bit rate is 1.5 MBit/s, which can be nearly fully used for data transfer due to the cyclic nature of the bus. In view of the fact that the MVB is a standard that ori ginates from train control it is not widely accepted as process bus solution. A process bus concept can how ever only be successful on the market if a widely accepted standard for electrical and mechanical inter faces enables to connect switchgear, transformers and protection and control equipment from different manufacturers. The new standard IEC 61850 is de signed to fulfill all these requirements.

8.7

167

·-

8.8 Asset Management Support

8.9

Modern asset management systems need condition related data from all primary and secondary equip ment in the substation. The SA system allows to acquire such data and to transmit them to one or several centrally located disturbance evaluation and c:sset management systems. This means, that this nor mal data acquisition, archiving and logging facilities of the SA system are used for the data acquisition as well. In cases where maintenance activities are need ed relatively fast, these may binitiated by means of dedicated evaluation functions at substation level in conjunction with the alarming facilities. The open sys tem features of modern SA systems and the Internet based communication possibilities will allow to inte grate this data exchange even more into asset and maintenance management concepts. The upcoming interfacing standards IEC 61968 be tween distribution automation andmanagement func tions, and IEC 61970 for power application functions at network level will accelerate this process. The imple mentation of the data exchange into an open com munication architecture must, however, be done in such a way that neither the power network opera tion can be endangered, nor the database can be accessed by unauthorized people.

8.9 Dependability 8.9.1 General

168

All hardware and software components of the Sub station . .utomation system are designed and manu factured in such a way that they meet the high avai lability requirements. This means a high reliability (long MTIF times) as well as short down times (low MTIR) in case of a fault. (see chapter 12 for general definitions with regard to reliability).

Short down times are achieved by means of • extensive diagnostic functions down to replacement module (circuit board) level with associated reporting, • a modular hardware design, • fast reconfiguratiqn and restart after repair, • automatic restart after a power supply failure, • combined with an efficient repair. The basic distributed architecture allows very high system availability and functional redundancy for the most important SA function, namely control, even if no explicit redundancy is used. If the NCC connection function runs on another hardware than the SCS ser ver for station level operation, then only the power supply modules of a passive star coupler of the inter bay bus must be redundant. This assures that there is no single point of failure for the control function of the complete system (although control of one single bay may tail). Apart from this, all functions are de signed for graceful degradation in case that a com munication connection or one of the connected devi ces fails. From an overall system point of view, also the power supply for the SA system should be redun dant, i.e. by means of a redundant station battery. Even in a non redundant system critical data like com mands and interlocking states are secured for safety reasons by two hardware channels from/to the pro cess and appropriate information redundancy on the communication system. These two channels as well as the timely updating of needed information are supervised, and a fault leads to an invalid state or blocking of command execution. Even if a part of the system fails, the system-wide functions can continue to operate safely, but eventually with restricted scope of function (graceful degradation). Note that such an invalid state or blocking shall only be reset by human intervention, to avoid that a second failure can endan ger the safety. If a higher availability is needed, then redundant (dupli cated) devices or modules can be used. It should however be kept in mind that redundancy introduces more hardware, i.e. the overall failure rate and there fore repair activity is duplicated, and that redundant devices mostly need some additional, often not re-

.

·

dundant hardware for supervision and switchover. Redundancy can be introduced: • At station level by redundant and HMI devices.

servers

• At the inter-bay bus by redundant power supplies and duplicated lines between star couplers and to station level. • At bay level by redundant control devices and several protection devices. • At process bus level by duplicated PISAs/RIOs together with duplicated protection devices. In this case each protection system needs its own physical process bus. A prerequisite to achieve higher availability is that even inactive redundant hardware parts (spares, standby parts etc) are regularly supervised and repair ed in case of a failure. Experience with electronics shows that the failure rate on unused equipment is as high as on normally used (not overloaded) equip ment. As indicated below, there are different possibilities how redundancy can be used or which class of redundancy is needed in the system under the consi deration of the length of the down time and loss of historical data. The choice depends on the availability required, the functions considered as well as the struc ture level. What kind of redundancy is the recom mended will be explained further below. • Spare parts: diagnosis and repair of faulty parts

inclusive reloading of configuration data by trained people can be done in less than 2 hours in case of bay or process level devices, less than 4 h for station level devices. But, the traveling time to site

should be short. • Cold standby: a standby hardware device exists,

which is physically connected and preconfigured (but it may be used for other purpose). In case of a failure the operational software is started

manually. Start up time is in the order of 5 to 1 0 minutes, archived data on the failed part, which has not been secured, is probably lost.

8.9.1

• Warm standby: a standby part constantly

super vises the active (hot) component. In case of a failure it takes over automatically. There is a small risk that time stamped events may be lost, but all archived data is preserved, and commands are reusable after 1 0 - 30 sec. If the failed system is repaired and put to standby mode again, its archive and configuration data is automatically updated. • Hot standby: a standby part constantly super

vises the active (hot) component. In case of a failure it takes over. No time stamped events are lost, no archived data is lost, and commands are reusable after 1- 5 sec. If the failed system is repaired and put to standby mode again, its archive and configuration data is automatically updated. In the case of bay devices where the switchover times are usually below 100 ms, this switchover is called bumpless. • Duplicated Components: two devices are

running in parallel (hot). This means: commands are always usable at least on one of them. But configuration data, event- and alarm lists as well as archived data may be and mostly are different, resulting from different operations at the systems. Further a special management for common resources (e.g. serial connections, event loggers) is needed. The two hot systems may supervise each other to give an alarm if the other system fails. Warm and hot standby systems need a manual switch over function to be able to perform maintenance. This allows a controlled shut down of the hot system and the communication, so that even on a warm standby system no events are lost, and the data integrity of the shut down system for later upcoming is guaran .

·

teed.

169 Net wor k

cont rol cent er

Operator Remote workplace workplace

8.9.2 Hardcopy Printer

b

.F

Alarm/EVent Printer Ethernet (TCP/1 P)

:·

Protection Protection Unit · Unit

Third party Protecti on

Transmission level

Distribution level

Figure 8-8 Functional redundancy configuration

It has to be kept in mind, that availability considera tions always refer to the availability of a function with in the whole system. This concerns usually the control function, if not other functions are specified. Control as a system function is regarded to be available even if one bay has failed, as this has only seldom an impact on the interlocking scheme. If this would be the case, it could be circumvented by means of the interlocking override function.

8.9.2 Redundancy

170

Functional

The Figure 8-8 shows a single SA system, where the SCS server and the station level HMI use another hardware device than the NCC server. Both servers are completely independent from each other, al though they supervise each other. Further, the interlocking function across the interbay bus is com-

pletely independent from all station level units. This concept in conjunction with a redundant power sup ply in the star couplers (which are the possible single point of failure in this system) assures a very high availability for the control function. The NCC control io:; functionally redundant to station level control, which is, on the other hand, functionally redundant to bay level control. If the availability of control from the NCC is an issue, then installing a separate remote work place at the NCC, which is directly connected to the SA server, could enhance this. This workplace can be used e.g. over the telephone network in case the NCC server connection is disturbed. The separate protection devices, which are connect ed to the NCC server, are not relevant for the control function, they are however not available if the NCC server fails. Usually, remote control is the more impor tant function. This is the reason why they are connect ed to the NCC server.

. '-?

In case that the station level operation is most impor tant, they might be connected to the SA server instead. The time synchronization task of the clock master (CM) could also be taken over by the SA server, but possibly with less synchronization accuracy against absolute time. An alternative would be to duplicate the satellite/radio master clock Due to the interlocking override functionality, the con trol can be regarded as available even in case that one bay control unit fails.

• Two serial lines at the server: The NCC

8.9.3

always sends on both lines and selects one receiver. The NCC server listens and responds on both lines to all received requests, but uses only one line (on which it receives requests) for activating commands. • Two NCC servers: in this case a hot-hot confi

8.9.3 Physical Redundancy Physical redundancy means duplication of critical devic es. This can be done in different ways, depending on the level of system/function availability required. It has to 9e noted that physical redundancy of the secon dary equipment should be accompanied by a dupli cation of the auxiliary power supply, e.g. a battery backup system or uninterruptible power system (UPS). This is, however, not investigated here any fur ther, as it is normally outside the delivery scope of a secondary system itself. Nevertheless, this aspect has to be taken into account for the sake of the overall availability, as it does not make sense to have a high ly redundant SA system and the system power supply is a single point of failure. ·

8.9.3. 7 NCC Connection Dependent on the needs of the network control cen ter different levels of redundancy can be employed: • Double NCC connection (lines) with its own modems, but one server line interface only:

Two modems on two NCC connection lines from the NCC server are connected to one serial inter face of the SA system. This serial interface sends to both modems, its receiver is connected to the modems with a switch, which is controlled by the NCC server via the RS232 control wires. The server switches its receiver to another modem, if it does not receive any signal for a certain time. Further it switches the receiver e.g. once a day to supervise, if both lines are working.

8.9.3. 3

guration with supervision is used, as there is no problem with event lists and archives. The NCC sends on both lines and selects one for receiving. Both servers respond to received requests, but only one of them executes received commands. In case that one server does no longer receive messages, the other one gets the command responsibility. For better transparency (e.g. if the connection of the command responsible server to the NCC is lost, this can only be detected by the NCC) the NCC could have the possibility to determine which of the two servers shall execute the commands. Note: a redundant NCC server which is connected to only one NCC line connection normally makes no sense from the system availability point of view. It may, however, make sense if NCC server and SCS server run combined on the same hardware, thus also offer ing a redundant station level HMI. In this case, a warm or hot standby solution is recommended (see also next chapter).

8.9.3.2 Station level Here it can be distinguished between SCS server re dundancy and HMI (terminal) redundancy. • In case that consistent configuration and archives are important, a warm standby configuration is chosen. in case that under no circumstances time stamped events shall be lost, a hot standby system is needed. • In case that configuration and archive consistency

is not so important, a duplicated hot-hot system

171

172

can be applied. This allows to have different confi gurations on both servers, e.g. for testing configu ration changes/extensions or new functions only on one server, while operation is performed by the other server. The process database on both systems is always up to date, so that in case of a shut down of one server the other one can continue giving commands without interruption. The management of common resources like disturbance archive, NCC connections, event log printers etc must however be specified and engineered on a per project base. Archives may be different (although equivalent) even if both systems are operating, and holes in one archive during shut down are not automatically filled on system startup. Event lists are different, because e.g. commands and alarm acknowledges are logged only on the executing system, and opera tional parameters like measurand limits and dead band may be different if they are interactively changed during operation of the system. • In case of HMI devices like terminals and printers always duplicated components shall be chosen. If more than one physical device (PC) exists, pre ferably an HMI terminal should run on each of them (e.g. one on the hot system and one on the standby system). Additional terminals can be added as X-Terminal devices at the station bus. The supervision of the HMI hardware like screen, keyboard and mouse has to be done by the human users.

The Figure 8-9 shows a standard configuration, where NCC server and SCS server are running on the same physical server. The redundancy is configured as a hot standby system. Therefore each physical ser ver is connected to an alarm unit, the master clock, and with a fall back switch to the NCC line and to the serial communication to bay devices with master slave protocol. Printers and a third HMI are connec ted to both servers with the station bus. This means that the printing function is not redundant, but has a high reliability, as no (electromechanical) switches are used. The redundatlcy of the time synchronization is assured (except for the satellite/radio clock itself), because the SCS server can take over synchroniza tion in case that the inter-bay bus master clock fails, Networ1<: control center

Operator wor1<:place 2

! ...

although eventually .with reduced accuracy. If a high accuracy across the system is needed to fulfill its func tionality (e.g. for distributed synchrocheck), then a second bus master clock should be used. If high accuracy against absolute time is mandatory, even the satellite/radio clocks themselves should be dupli cated.

8.9.3.3 Inter Communication

Bay

The behavior of inter bay communication depends a lot on the type of bus that is used, and how it is phy sically implemented. The following example assumes that the communication network distributes messa ges only on physical level. Schemes with redundant communication might have to be designed different ly, if the physical network includes switches and rou ters, which are also complex electronic devices. An appropriate example is shown in Figure 8-13. The inter-bay communication scheme discussed below consists physically of star couplers that inter connect the bay and station level devices by means of optical links (Figure 8-9). Within the passive star couplers the physical bus consists of wires with an availability of practically 100 %, and for each connect ed device there is one opto-electrical converter. So the common points of failure of the star coupler are: • The power supply. This can and should

be duplicated, and (if possible) each power supply supplied from another power source. • A common mode failure of the opto electrical converters to the bus. This probability can be neglected,

if the couplers are carefully designed. • A failure on one line (e.g. permanent light), which blocks the whole star coupler. This is prevented by appropriate

design of the star coupler converter modules. Operator wor1<:place 1

Remote wor1<:place

Optional Operator wor1<:place

.,:...} .

8.9.3.5

··· scs -> · HMI system: .:

Protection Protection Uriit Unit

Third party Protection

Protection Unit

Transmission level

Distribution level

Figure 8-9 Hot Standby Configuration

The optical glass fibers have practically an availability of 100 %, unless they are endangered by a special environmental aspect like frequent construction work. In such a case the links to the station level devices and betvveen star couplers should be duplicated and laid in separately routed cable channels, and they should be supervised to detect interruptions.

8.9.3.4 Bay level The usage of redundant control units is possible, al though in most cases not necessary. A functional redundancy (e.g. emergency circuit breaker control with use of protection devices) is sufficient in most cases, if redundancy is needed at all. Apart from this, a possibility for either direct switchgear control or a backup panel can already provide the means for emergency control. Redundant protection, however, is necessary at least on HV transmission level. On the functional level this means the usual duplication of protection device as

a main1, main 2, and backup protection. This practice results not only in physical but also in functional redun dancy, if different protection algorithms are employ ed for the main 1 and main 2 protection.

8.9.3.5 Redundancy on process bus If a process bus is used, it should be redundant, in particular in case of redundant protection, and also the most critical PISAs (for VT and circuit breaker) should be duplicated. A simple way is to provide a dedicated process bus and dedicated PISAs for each bay device together with redundant bay devices. More sophisticated ways of how to achieve redun dancy depend on the process bus type.

a,

If redundancy on PISA level is considered, then the failure rate of the PISA has to be compared with the failure rate of the sensor. Often the PISA electronics has a much higher reliability than the sensor. Then redundancy makes only sense if also the sensors are duplicated.

173

Network Control Center

Nc' ·' ( wr

.- . -

8.9.3.6

P

ectio

serveF·

-;;;-

rot

n

star coopier Bay 1

,---

Prdt!ed:ion

control

Bay; -

Bayt.:

Control

I

I

BayN

Figure 8-7 0 SA configuration for Availability calculation i,.•.

8.9.3.6 Availability calculation examples Availability normally refers to a function. Therefore it must be defined what system availability really shall means. In the following example the availability cal culations refer to the availability of the control func tion from station level or from remote. It is further assumed that the control function is considered as available, if one, but not more than one bay is no long er controllable from station level or from remote. The calculation uses the form of availability diagrams, where the components that are used together to perform a function are put in series, and the redun dant components are put in parallel. The first system is described in chapter 8.9.2, Figure 8-9. The configu ration is however reduced to that shown in the Figure 8-10.

174

We assume 18 bays with bay controllers (BCU), one station level SA seNer and one NCC seNer inclusive gateway function. The system needs one star coup ler with 20 lines, which works on the physical level of the communication stack and therefore has a high reliability. To enhance this reliability even further, i.e. to fulfill the single failure criterion, a redundant power supply is used in the star coupler. The following table lists typical MTIF times in hours of the used compo nents. It is a typical example for a system built from

. '?

h i g h l y r e l i a b l e c

omponents as currently available from protection system manufacturers.

diagram. The rest of the star coupler is passive and can therefore be neglected.

In the following the availability diagrams are shown for the single parts, up to the whole system.

Mean time to failure (MTIF) is the statistical time until the component needs repair. MTIF with repair means the statistical time until a second failure appears at the same time before the first fault is fixed and the whole system is declared unavailable, despite of im mediate repair of any faulted components (e.g. within 8 hours).

The bus system (Table 8-2) consists of the star coup ler with redundant power supply. The opto-electronic converters on both sides of an optical line are from the availability point of view combined with the opti cal line to an 'optical connection'. This is put in series with the connected components, i.e. not seen at the star coupler availability

The availability diagram Table 8-2 show- the calcula ted J'.'ai!abi!ity of the redundant power supply of the star coupler, which is a critical part of the bus system: • The resulting mean time to failure (MTIF) of the system (without any previous repair of failed redundant components) is 342 years.

l.

Device type

MTIF(h}

MTIF(y}

"Star coupler Pows:·

1 500 000

171

6.666666666666667E-7

11 750 000

1341

8.51 063829787234E-8

"optconnection"

Failure rate(lh }

"NCC Server"

251 000

28.7

3.98406374501992E-6

"SCS Server"

251 000

28.7

3.98406374501992

87 600

10

1.141552511415525E-5

"BCU"

850 000

97

1.176470588235294E-6

"NCC Modem"

100 000

11.4

1.0E-5

"Industrial-proof Ethernet switch" *)

438 000

50

2.2E-6 *)

"HMI Console"

8.9.3.6

*) it should be noted that with the fast increasing use of switches in industrial applications, the MTIF will be improved

continuously.

• All 749 999 hours (= 65 years) a repair has to be performed.

•

• If the repair can be made within an a mean time to repair (MTIR) of 8 hours, the MTIF with repair that can be achieved is

• Availability:

321 065 years.

• The corresponding availability with repair is 99.99999999 %. • If a repair is only done in the case the system fails, i.e. if both power supplies have failed, the corre sponding availability without repair is

MTIF with repair: 8

years 99.9887 %

In case that fibers could be damaged, or faster aging plastic fibers were used, this would have to be taken into consideration accordingly. NCC gateway single MTTF(h):710n (y): 8.113858180MTTF for repair(h): 71077 MTTR(h)8.0 MTTF(y) with repair: 8.113668881 Availability(%): with repair: 99.98874566 no component repair: 99.98874593 opt.connection NCCModem NCC Server MTTF(h):11750000 MTTF(h)100000 MTTF(h)251000

99.9997%

and the corresponding MTIF is 342 years, as mentioned under the first bullet. Bus system MTIF(h)3000000(y): 342.4657534 MTTF for repair(h): 749999 MTIR(h)8.0 MTTF(y) with repair: 32106512.61 Availability(%): with repair. 99.99999999 no component repair. 99.99973333 star coupler PS MTIF(h):1500000

[

r

star coupler PS MTIF(h):1500000

Table 8-2 Availability of a redundant star coupler

The diagram in Table 8-3 shows the availability of the NCC server, which is connected to the star coupler via optical fibers, i.e. two opto-electric converters plus the connecting glass fibers, with an assumed availability of the fiber of 100 %.

Table 8-3 Availability of a network control center (NCC) server

Table 8-4 shows the availability figures for the HMI part, which consists of the SA server and the HMI console, and is connected to the star coupler similar as the NCC server above: • MTIF with repair: 7 years • Availability:

99.987 %

HMI part single MTTF(h)64579 (y): 7.372134185MTTF for repair(h): 64579 MTTR(h)8.0 MTTF(y) with repair: 7.371955975 -Availability(%): with repa1r: 99.98761347 no component repair: 99.98761377 opt.connection MTTF(h):11750000

SCS Server MTTF(h)251000

HM! Ccn c!c MTTF(h)87600

·

Table 8-4 Availability figures of the human machine interface (HMI)

175

· The Table 8-5 shows the availability figures of bay control units (BCU) which are also connected via the optical fibers to the star coupler: •

MTIF with repair: 90

years

• Availability:

99.99899074 %

=CU+opt. MTfF(h):792658 (y): 90.48615641MTfF for repair(h): 792658 MTIR(h/;8.0 . MTIF(y) with repair. 90.48609895 Avallab11ty(%): With repa1r. 99.99899074 no component repair. 99:99899074 BCU MTfF(h):850000

opt.connection MTIF(h):11750000

Table 8-5 Availability figures of the bay control units (BCU)

8.9.3.6

From the availability figures of the individual compo nents the availability of a small system, where the NCC gateway function runs on the SA seNer, is shown in Table 8-6. It has not been taken into account that control from NCC could be possible even without the HMI console, and that the SA seNer could run with out modem to NCC. so the calculation below is a worst case consideration. For the bay controllers we assume that the system is available if not more than one of them has failed. Therefore the (n-1) of n condition is maintained. • MTIF with repair: 8 years • Availability: 99.9887%

=ingle System MTTF(h): 64127 (y): 7.320463234 MTTF for repair(h): 26239 MTTR(h): 8.0 MTTF(y) with repair. 8.112543568 Availabllily("h>): with repair. 99.98874410 no component repair. 99.98752636 BCU+apt MTTF(h):839285 (n-1) ofn: 18

Bussr. tem MTTF(h): 3000000

In the diagram we find two MTIF times.

176

• The second one, MTIF with repair of 8 years, is the resulting system MTIF, if any failure is repaired within in average the MTIR of 8 hours. • MTIF between any repairs 26239 hours = 2.99 years

The second MTIF is longer,.because of the high pro bability that the system remains available during the repair of a redundant component, e,g. during the replacement of a star coupler power supply, or a bay control unit For the single system above these figu res are more or less identical, due to the fad that the most critical part is the sta!ion level NCC gateway. If, however, independent seNers for the NCC connec tion and for the station level HMI are provided instead, as shown in the Figure 8-10, this is regarded for the control function as redundancy, and the cor responding availability figures obtained are indicated in Table 8-7. • MTIF with repair: 30 903 years 2.13 years • MTIF for repair: 99.99999704 % • Availability: =unci.Redundancy MTTF(h): 112405 (\1): 12.83171046 MTTF lor repair(h): 18658 MTTR(h): 8.0 MTTF(\1) wilh repair. 30903.51988 Availabilily(%): with repair. 99.99999704 no componenlrepair: 99.99288343 BCU+opl.

MTTF(h): 839285

(n-1) oln:

18

Table 8-7 Availability figures with separate HMI and Gateway server to NCC

NCC gateway single MTTF(h):7f077

Table 8-6 Availability figures of a small SA system

• The first one of 7 years is the system MTIF, if it is operated without any repair until it fails entirely.

'?

The availability with repair has drastically gone up, however the average time between any component repairs (MTIF for repair) has gone down, because of the fad that the quantity of components involved has increased. In order to obtain real redundancy for remote control, a redundant station HMI is installed at the NCC as shown in the Figure 8-12.

! •

Network Control Center

8.9.3.6

A Protection Bay 1

Control Bay1

ProteCti<).ri BayN ····.··

Figure 8-11 SA system with NCC GW and station HMI redundancy

Network Control Center_.•••

•:Jt

I .? F:t"t'

Remote HMI :·· Modem

L_Telephone networ1<

:a ;mA-r

Aif Modem/ NCC (GW) server

C server

t m- ·· '

Star coupler

45 Protection • Bay;1

Control Bayt

Figure 8-12 SA system, functional redundant with remote HMI at NCC

It is assumed that this is PC based, having the same MTIF as the SCS server with HMI and two modems. The resulting availability figures are indicated in Table 8-8.

• MTIF with repair:

47359 years

• MTIF for repair: • Availability:

1.63 years 99.9999807 %

177

=ingle Sys, rem.HMI MTTF(h): 130945 (y): 14286 14.94816226 MTTF for repair(h): MTTR(h): 8.0 MTTF(y) with repair: 47359.69576 Availabilily(Ok): with repair: 99.99389098 99.99999807 no component repair: BCU+opl MTTF(h): 839285 (n-1) of n: 18

8.9.3.6

Vsus system MTTF(h): 300000J .

SCS server+opt MTTF(h): 245280

SYS500MMI MTTF{h): 87600 .

Remote PC+Modem MTTF(h): 61000

CC gateway single MTTF(h): 71077

Table 8-8 Availability figures with redundant NCC workplace for control

As can be seen, this measure changes the availability figures only marginally, but it provides genuine redun dant remote control. The calculation in Table 8-9 is made for a system where both, NCC server and SA server run on the same but duplicated computers (Figure 8-11). A seri al switch and a modem are used at each server but the NCC connection between the two PCs has to be switched over. The resulting availability figures are: • MTIF with repair:

23 years

• MTIF for repair:

1.42 years

• Availability:

99.99599444 %

Due to the relatively low MTIF of the serial switch the overall availability of control from NCC is much lower than for the system with remote HMI above. On the other hand, there is also only one communication line required. This example shows the high impact of com mon/voting equipment in case of redundant com munication. The provision of either a more reliable switch or a second communication line to avoid swit ching can help to obtain reliability figures that are clos er to the above ones. Only a slightly higher availability could be achieved if the HMI part (screen, keyboard etc.) or the modems would be switched (e.g. by manual plugging) bet-

=

MTTF(h 901 (y): 5.924858153 MTTF forrepair(h): 12498 MTT h :8.0 MTTF(y) with re air: 22.79846674 Availa · ): with repair: 99.9 9444 no component repair: 99.98458863 BCUll MTTF ):839285 (n-1)o n: 18

178

Bus em MTT (h):3000000

Serial Swtlch MTTF(h):200000

HM arts MT F(h): 9

Modem MTTF(h):100000 -

HMI part single MTTF(h):64579

Modem MTTF(h):100000

Table 8-9 Availability figures for SA and NCC server on the same but redundant PC

Network Control Center q;_

NCC(GW) server -

Switch A••I'W'Switc h -- • ., 'Proteeti.on Control --Bay 1.. Bayl

: scs serJci'

......

8.9.3.6.1

Switch.' {witc_..h.).liiii.-

......

Protection Bay N

coiiff6i

Bay·N_ -

Figure 8- 7 3 Ethernet ring configuration

ween the two computers. An automatic switching would further reduce availability due to the common component

8.9.3.6.1 System availability for Ethernet based station level communication equipment

For the calculation of system availability for an Ether net based station level equipment it is assumed that the bay control units and the station level hardware as such have the same MTIF as in the previous examples. This might not necessarily be true because of the fact that the reliability of commercially available Ethernet chips is relatively low. This can also be seen from the fact that Ethernet based routers and swit ches for office environment have a MTIF between 5 and 20 years. Only recently special industrial swit ches for redundant Ethernet rings with an MTIF around 50 years have appeared on the market but with continuous increasing MTIF. We consider in the following calculation a redundant Ethernet ring confi guration (Figure 8-13) with such a switch at each con nected control device. All these switches are connect ed with glass fibers to a ring. Again the availability of the glass fiber itself is regarded to be 100 %. Thus

from the availabiiity modeling point of view, this is similar to a 1 out of n BCU configuration plus switch at the lower layer, and PC plus switch at the station layer The protection IEDs are disregarded for the con trol function. A bus system as such is, however, no longer needed, as all communication goes around the ring, which is regarded as faulty only if at least two switches ha;e failed (1 out of n of Bay).

= NCC gateway

MlTF(h)61473 (yl: 7.017524239\ATTF for repair(h): 61473 MTTR(hJl.O MTTF(y) with repair: 7.017276565 Availability(%): wi1h repa1r: 99.98698749 no component repair:99.98698795 Switch

MTTF(h OOO

NCC Server MTTF(h)251000

NCC Modem MTTF(h)100000

=CU+SWitch MTTF(h):289052_ M: 32.99689440MTIF for repair(h): 289052 MTTR(ht8.0 MTTF(y) with re_pair. 32.99668946 . . Availability(%): with repa1r. 99.99723239 no component repe1r._ 99.99723241 SWitch BCU MTIF(h):438000 MTTF(h):850000

,

Table 8-7 0 Availability figures of an Ethernet based station level equipment

179

'?

'?

with the substation and often also a station level HMI with the distributed 1/0 units (Figure 8-4).

8.9.3.6.2

From these components we calculate the availability for those configurations above with the highest avai lability. • MTIF with repair:

The central unit further hosts the control specific logic functionality, as long as it is not faster than 100 ms, and the distributed 1/0 units are connected either point to point or via star couplers, as well as the bay level protection devices. We further assume 18 bays which leads to 18 distributed 1/0 units and protection

7379 years

• MTIF for repair: • Availability:

1 years 99.99987%

=_Sv.ltem, rem.HMI

MTTF(h): 95102 (y): 10.85641651 MTTF forrepair(h): 8873 MTTR(h) 8.0 MTTF (y) wilh repair 7379 092508 Availability(%): wilh repair. 99.99998762 no component repair. SYS500MMI SCS se!Ver+SwOCh BCU+Swil:h MTTF(h) 87600 MTTF(h): 157680 MTTF(h): (n-1) ofn: 18

99.99158870

Remote PC+Modem MTTF(h): 61000

E_NCC gateway MTTF(h): 61473

Table 8-11 Availability figures of a complete system including communication availability

The result is clear: system MTIF (with repair) decreas es from 43000 years down to 73UO years. Further, the MTIF between repairs goes down from around 14000 h (1.6 y) to around 8800 hours (1y). These re sults show the high impact of the communication system reliability on the overall system availability. However, the general availability also in this case is for most applications good enough.

8,9.3.6.2 Systemavailabi/ity of a distributed RTU

180

In order to have a system that is comparable to the SA systems described above, it is assumed that the RTU is distributed to save cabling costs. This means, that a central unit handles the communication via mo dem to the NCC, and via serial interface or Ethernet to a local HMI.

An RTU based control system can be central, or dis tributed. The distributed RTU is a system with a cen tral point that connects the network control centers

devices, which corresponds to the number of the bays of the SA systern. In view of the high processing power required at the central part. we assume a higher integrated device with more electronic chips and therefore -regard the MTIF by 25% lower than for a bay unit. For the dis tributed 1/0 units that are simpler we assume a 25 % higher iviTTF. Further, we assume point-to-point opti cal connections to the distributed 1/0 units. This might not be practical for 20 or more connections, but it leads to better reliability figures than if an additional central star coupler or switch was implemented.

All these assumptions lead to the following availabi lity figures. For the distributed 1/0 unit with optical connection: MTIF with repair: 110 years MTIF for repair:

110 years

Availability:

99.999%

=tO unit+opt. MTTF(h)9 867 (y): 110.0305008MTTF for repair(h): 963867 · MTTR(hJl.O MTTF(y) with repair: 110.0304320 .. Availability(%): with repair:99.99917001 no compoQent repair:99.999170..e,1 oot.connection IOunit MTTF(h)1050000 MTTF(h)j 1750000

Table 8-12 Availability figures for 110 unit in distributed RTU system

.

8.9.3.6.2 =RTU system MTTF(h):l16230 (y): 13.26829202/ITTF for repair(h): 21854 MTTR(h)8.0 MTTF(y) with re air: 74.07761248 Availallility(%): with repa1r: 99.998 6719 no component repair:99.99311758

Vlo unit+oflt. MTTF(h) 020565 (n-1)ofn:

18

RTUbase MTTF(h)650000

Modem MTTF(h):l 00000

SCS server MTTF(h)251000

HMI console MTTF(h)86500

Table 8-7 3 Availability figures for a redundant control via NCC and local HMI

The RTU system with redundant control via NCCI modem and via local HMI. • MTIF with repair: years

74

• MTIF for repair: years • Availability: %

2.5

99.9876

Further for the comparison of the architectures it was not considered how the synchrocheck functionality is implemented in a system with distributed RTU. Very often one central device is taken for synchrocheck, which is then switched to the relevant CB that has to be closed. This synchrocheck device would, however, introduce a further single point of failure, which does not exist in a distributed SA system, where the syn chrocheck function runs on each BCU or protection device.

If we compare RTU based systems with an SA system that incorporates functional redundancy, we find that the MTIF of RTU based systems without repair is slightly better (13 years instead of 12 years), but the MTTF with repair is drastically lower (74 years instead of 30903 years) due to the RTU base being the one single point of failure. We must further consider, that the SA system addi tionally includes a (backup) protection, and a syn chrocheck function within each bay unit. Both is not considered here for the availability calculations of the RTU system. The protection could have an impact on the control functionality if the control of a bay is to be blocked as soon as the protection is out of order. This has not been considered in all configurations, because the impact would have been the same.

181

.

·

8.1 0 References

8.10

[1] G. W. Scheer, D. A. Woodward·Speed and Reliability of Ethernet networks for Teleprotection and Control, Schweitzer Engineering Laboratories Inc (SEL), 2001 [2] G. W. Scheer, D. J. Dolezilek ·Comparing the reliability of Ethernet network topologies in Substation control and Monitoring Networks, Schweitzer Engineering Laboratories Inc (SEL), (Western Power Delivery Automation Conference 2000, Spokane, Washington), 2000 [3] L. Andersson, K.-P. Brand, W. Wimmer · The impact of the coming standard /EC67850 on the life cycle of Open Communication Systems in Substations, Distribution 2001, Brisbane, Australia, November 2001 [4] L. Andersson, K.-P. Brand, W. Wimmer · The communication standard IEC67850 supports flexible and optimised substation automation architectures, Integrated Protection, Control and Communication Experience, Benefits and Trends, Session IV - Communication for protection and control. (pages IV-17 to IV-23), New Delhi, India, 10-12 October 2001. [5] T. Skeie, S. Johannessen, 0. Holmeide · Highly Accurate Time Synchronization over Switched Ethernet In Proceedings of 8th IEEE Conference on Emerging Technologies and Factory Automation (ETFA'01), pages 195-204, 2001. [6] T. Skeie, S. Johannessen, and C. Brunner· Ethernet in Substation Automation, IEEE Control Systems Magazine, 22(3): 43-51, June 2002 [7] K.-P. Brand, K. Frei, 0. Preiss, W. Wimmer ·A coordinated Control and Protection Concept Medium Voltage Substations and its Realization, CIRED 1991 [8] 0. Preiss, W Wimmer · Goals and Realization of an Integrated Substation Control System, DPSP&C 1994, Peking, 1994 [9] EWICS TC7, Dependability of critical computer systems, Elsevier Applied Science, London, 1988 [10] CIGRE - Technical Report, Ref. No.180 · Communication requirements in terms of data flow within substations. CE/SC 34 03, 2001, 112 pp. Ref. No

182

.

·

9 Asset Management Support

9 Asset Management Support 9.1 Setting new business goals 9.1.1 T&D Business Perspective 9.1.2 The Impact on Industrial Customers

9.2 Maintenance 9.2.1 9.2.2 9.2.3 9.2.4

Kinds of Maintenance Change of Paradigm for Maintenance Principles of Reliability Centered Maintenance Benefits of RCM in the Electric Utility Industry

9.3 Power system monitoring 9.3.1 9.3.2 9.3.3 9.3.4

Data acquisition Substation monitoring changes data into information Disturbance recording for fault location and power quality assessment Power system condition assessment for better knowledge

9.4 Monitoring of Substation Automation System 9.4.1 9.4.2 9.4.3 9.4.4

Different levels of monitoring Self-supervision of devices Supervision of communication The connection to central monitoring systems

9.5 References

184 185 185 185

9 Table of Content

186 186 186 186 187

187 188 189 189 192

192 192 193 194 194

196

183

9 Asset Management Support

9

Asset management in the broadest sense is the opti mal management of all assets of a company accord ing to the company goals. In this book we consider transmission and distribution (T&D) utility companies, and restrict to the assets necessary to supply power to the utility customers, i.e: • The power network consisting of lines and substation primary equipment • The protection system • The network control system • The substation automation systems (SA) The protection system can be seen as part of the SA system, and the network control system is outside the scope of the book, but its asset character may be treated similar as the SA system. Therefore, the asset

management support discussed in this chapter is focused on: • The power system • The protection system • The SA system The task of utilities is to supply power. The focus of the detailed company goals might change due to deregulation. Government owned utilities put the focus on reliable power supply, while privatized utili ties will focus rnore on return on investment The asset management policy is influenced by the com pany goals, policies and resulting strategies. Figure 9-1 tries to give an overview on the depen dencies between utility activities to illustrate the diffe-

L

t

Maintenance

184

Figure 9-7 Facets of asset management in relation to utility specific activities

I

9.1.1 T & D Business Perspective

rF-nt facets of asset management Thin arrows deno te goal setting and planning process dependencies, while thick arrows denote possible information flow during day to day business. Asset management in the narrower sense focuses around maintenance of the power system, power system development planning, and the coordination of these activities with operation to assure retrieval of data about equipment state and strain for optimized maintenance and new planning, as well as coopera tion between maintenance and operation for mini mal power interruption and safe working procedures.

9.1 Setting new business goals The focus on return on investment (ROI) caused by deregulation leads to a trend to seek for more effi cient, more accurate, more economical ways of pro viding T&D services: • The implementation of communication networking within and between substations allows for faster access to intelligent electronic devices (lED) via high-speed wide area networks and communi cation via public networks, providing the means to obtain more data about equipment state and equipment usage. • The microprocessors used in relaying, SCADA systems and other equipment provides more, and more accurate real-time information from the substations to maintenance and planning centers. This will drive automation down to distribution level. with major system architectures focused on distribution optimization. The formation of independent system operators ISO and power exchange organizations represents a pro found change in the way electricity is brought to mar ket

Today, utilities show a growing need for support and training services when tackling substation automation and integration programs. This results in the change of equipment specification from yesterday's largely utility specific requirements to today's national and international standards. In future, the needs for long term maintenance agreements, commissioning, and installation and design services will extend these requirements.

9.1

9.1.2 The lmpad on Industrial Customers The quality and reliability of power supply is of vital importance to the utility customer business. The impact of voltage sags, surges and outages on po wer systems can be translated into heavy economic impact in terms of lost production time and product waste. The topic is prominently addressed in interna tional organizations like IEEE, lEE, Cigre and CIRED. The reason for all the interest and concern is the con tinuing increase in overall load sensitivity. Industrial operations of modern plants are built around sophi sticated electronic controls that are negatively affect ed by poor power quality. Further a lot of industrial processes rely on energy for a specific period of time, otherwise the production process will be disturbed resulting in high losses. While today most customers work with their local utility to resolve power quality issues, it is unclear if this arrangement works in dere gulated electricity markets. A possible solution is the accurate monitoring of power quality, and including quality requirements into pricing as well as penalties. Another solution is that the industrial customer builds up his own emergency power generation and swit ches over the power supply to obtain the needed power quality at least for his most sensitive proces ses. Maintaining power quality to the_level needed is not only a consequence of correct operation, but also of maintenance. In the following, a closer look will be taken into maintenance and the supporting monito ring functions in the operational part.

185

9.2 Maintenance

or periodically as good as possible, and based on the result it is dedded when the preventive maintenance has to take place. The advantage of preventive maintenance is that it can be scheduled in advance at times when the influ-

9.2

ences on operation are minimal, and that failures are avoided and the impact of outages due to the mainThe task of maintenance is to handle any failures that tenance activities is kept at minimum. The additional influence the power system operation. These are faiadvantage of condition based maintenance is, that lures in the primary equipment as well as in the conunnecessary maintenance or diagnostics are avoided. trol and protection equipment, and also in power These activities not only cost money, but can even system design and protection or control system cause outages resulting from errors during the main- design respectively. Failures are typically caused by tenance process itself.

9.2.1 Kinds of Maintenance

• component aging • human (operation or maintenance work) errors

9.2.2 Change of Paradigm for Maintenance

• system design errors of power system, protection system or control system

T&D equipment design and maintenance requirements have significantly changed over the past years. • environmental influences and incidents like These changes have been driven by the enormous thunderstorms, or power demand exceeding increase in the number and types of equipment that generation. must be maintained, the increasing complexity in All failures that directly influence the business goals equipment design, and the availability of new mainhave to be handled and repaired as fast as possible, tenance techniques. Maintenance strategies have also been responding to changing equipment to keep losses by power system unavailability as small as possible. This kind of maintenance is called performance expectations. This includes the growing awareness of the extent to which equipment failure repair or corrective maintenance. affects safety and the environment as well as the If the aging of components is known, aging parts can relationship between maintenance and product or service quality, and the increasing pressure to reduce be replaced before the equipment as a whole fails. This is called preventive maintenance. Preventive costs. maintenance can be done in different ways: Under this condition, a new strategic approach to • Scheduled maintenance: worn out parts are maintenance that has been successfully applied in cleaned or replaced periodically, i.e. the maintethe commercial aviation and nuclear power industries nance time is scheduled in advance. Typical is Reliability Centered Maintenance (RCM). examples for secondary equipment are replace ment of batteries and cleaning or replacement of 9.2.3 Principles of Reliability Centered dust filters. For complex primary equipment often a diagnosis is done at the start of maintenance to Maintenance determine, tf the aging caused in service was really Traditionally, equipment maintenance is performed as big as expected, and whether replacement is

186

really necessary. This is called detective main-

on a time-driven basis (scheduled maintenance) with

tenance. Typical examples are the replacement of circuit breaker contacts or transformer oil.

equipment replacement based primarily on age with a limited knowledge of the actual equipment performance and usage.

• Predictive or Condition based maintenance: the actual load of an equipment respective its actual condition is measured either permanently

The type of maintenance policy to select for specific equipment for transmission and distribution depends

!

[

'·

I

i_.

?

?

·

on reliability and on economic and customers' busi ness related availability considerations, which take the consequences of failures into account. Reliability centered maintenance (RCM) is the defini tion of equipment maintenance procedures on an as needed basis as opposed to time-driven basis. RCM can establish an effective maintenance program while keeping the needed degree of reliability and availabi lity of the system, eliminating ineffective preventive maintenance tasks, and prioritize condition based maintenance tasks. RCM makes use of analytical techniques to determine applicable and cost-effective preventive maintenance tasks that address dominant equipment failure modes that are critical to system performance. RCM establishes preventive maintenance tasks to avoid or at least to mitigate the consequences of fail ures and not always to attempt to prevent the fail ures themselves. All preventive maintenance tasks defined by RCM are technically and economically fea sible. Thus, this methodology of selecting and prioriti zing maintenance tasks translates into substantial reductions in routine work that together with the eli mination of unproductive tasks, leads to more effect ive and less costly maintenance.

es the line availability by 1 %, and costs around 50 k$ per year. Thus, it saves around 43 200 k$, i.e. mainte nance pays off.

9.3

If, however, with 40 000 k$ a second line could be built, this would enhance the availability e.g. by 4% saving 1 72 000 k$ per year, even without any pre ventive maintenance. Any availability improvement on a redundant line due to preventive maintenance is much smaller than 1 %, as long as not additional costs (like having to replace a circuit breaker) can be pre vented.

9.3 Power system monitoring For once neglecting outages as a result of wrong human operation, there are basically three reasons for power interruptions: • The breakdown of a utility asset through normal wear and aging under working conditions. • The outage of an asset being effected by an external event or fault.

9.2.4 Benefits of RCM in the Electric Utility Industry The objective of every utility is to supply reliable power at the least costs. Reliable power and mini mum cost are usually economic opposites. Higher reliability generally involves increased investment and maintenance costs. However, RCM should lead to reduced power delivery failure rates without increas ing maintenance costs. Thus, RCM has the potential of improving reliability whilst simultaneously reducing costs. An examples with fictive figures might illustrate this: A power line in the transmission backbone is critical for the whole power flow. A loss of the line might cause costs of 500 k$ per hour due to not delivered

power and penalties. Preventive maintenance increas-

• A temporary system disturbance where the external influence disappears, e.g a lightning stroke causing an earth fault on a line. Condition monitoring mainly addresses the wear

and aging caused by normal or temporarily abnormal working conditions. This is done first in that they sup port the evaluation of the actual condition of assets, and second, in that they might explicitly support the prediction of the further evolution of a detected pro blem, and the probability of breakdown. Power system monitoring in a narrower -sense addresses faults and problems in the network. As these are often cleared by the protection system, and this also delivers necessary data, it is often also called protection monitoring, although it additionally delivers power system problem diagnosis data like

fault locations on a line.

9.3.1 Data acquisition

9.3.1

The trend within data acquisition goes to intelligent electronic devices (lED) for protection or control. Besides their primary functions, they host more and more additional functionality. Many of these additio nal functions provide a sound foundation for basic monitoring systems, are cost-effective and may com prise (Figure 9-2):

187

• Disturbance recorders • Event recorders • Statistical value evaluation • Power quality analysis With computing power making its way into the pri mary equipment together with new sensor techno-

logy, more and more intern al data from

high voltage equipment can be made available to the outside at reasonable costs like

• Switching currents • Manufacturing data • Original value of key performance criteria

• Switching counters • Thermal information

This kind of data is the source of valuable condition information and exploited for building up condition monitoring.

• Quality of isolation media • Timing curves of switching operations

_

. ..., _

'>.olli .. IT

o oe '•·

,..

Uo0• :>"',"' •

1 • '- .,.. '"" o •

•••t•

!Advanced analysis :tools , 1: f.

j,

; ,.,_ .11

·

188

II

Figure 9-2 Typical example of data acquisition from various lEOs in a substation

Event printer 9.3.3

...................................... Star coupler lnterbay-Bus

Figure 9-3 Substation monitoring system

9.3.2 Substation monitoring changes data into information Substation monitoring systems are often defined and understood as functional and even physical subsets of substation automation systems, with mostly the control functionality not being included. This is how ever a rather restricted perception that does no justi ce to the importance of the monitoring applications, and neglects the currently growing interest in condi tion monitoring applications as well as the increasing need for business related information. Therefore, a more general definition of monitoring is better suited to describe the state-of-the-art monitoring approach: Substation monitoring is a station or network mana gement technique, which exploits the regular evalua tion of the actual operating condition, in orderto minimize the combined costs of power transmission/ distribution operation and maintenance. This means effectively, that it might cover condition monitoring as well as protection system monitoring at least at the concerned substation.

'(

'?

Monitoring systems are scalable solutions ranging from single IEDs respective an add-on communica tion kit for existing single IEDs up to complete stand alone systems with one or several PCs for decentra lized as well as centralized data evaluation and failure analysis. It archives the data which is collected from the IEDs like numerical protection devices through a substation wide bus. A typical structure of a local system (i.e. within a substation) is shown in Fig. 9-3. The data is presented after analysis on dedicated SMS operator displays (Figure 9-2).

9.3.3 Disturbance recording for fault loca tion and power quality assessment In the last decades, the power systems have been monitored in order to be able to determine the exact type of fault, to find the proper ways to clear the faults, and to check the reactions of the protective devices. This was mainly done for reporting purposes, i.e. extracting the exact picture of the fault. to include these data in reports. Another goal for this monito ring system was network engineering oriented, that is

'(

189

'?

improving the theoretical models of the electrical net works, thus studying the appropriateness of the "cal culated behavior of the network" against the "actual behavior of the network". 9.3. 3

These monitored data was used as well in litigation context, where the responsibility between several actors in the electrical networks was to be looked into for cost assignment in particularly severe conse quences of faults on the electrical network. In some cases a very accurate analysis of the fault was requir ed to know the exact values of the electrical para meters just before the faults, to see whether such piece of equipment was right to have failed to work or not. With the power quality concerns, the goals are diffe rent. If the use of the data for internal engineering purposes are still valid, a new approach is to evaluate the level of quality of the electrical supply, giving information on which legal contractual agreements can be based upon, and providing data which can be

issued to the public This is particularly true with the deregulation occurring on the markets, where legal interfaces have to be defined to more than one actor in the Energy market. I:'

When a disturbance record file is uploaded from a fault recording system, it can automatically be evaluat ed and the result of the analysis printed in the form of a "short fault report': and faxed to the protection engineer (Figure 9-4). This kind of automatic fault location and analysis even helps to bring the system faster back into operation. Under a fault recording system we understand here a system with dedicated recorders with mostly higher resolution than those integrated in protection devices.

Figure 9-4 Disturbance recording and fault evaluation

i-

190

9.3.3

Figure 9-5 Central retrieval and evaluation of event and fault records

Figure 9-6 Power system monitoring structure

Printer

Central EValuation Statio "

r-----------------,

Functionality Central System • Archiving I Management of the files from different Stations • Evaluation of Disturbance Records - Merging of records -Analysis I Computation I Documentation • Remote HMI

SMSSystem r--M-o-de-m'-----,1-A lnte rba y- Bus I

I

I

I

Functionality Station SMS • Automatic Collection of Data • Archiving I management offiles • Summary reports • Device HMI • Data Transfer (on request, automatic, Data Compression) • Collection of Disturbance Record files from Foreign devices

191

c

:

9.4

9.3.4 Power system condition assessment for better knowledge Precondition for condition based maintenance is to know more about the equipment, its load, and the operation conditions. For this many data has not only to be gathered, but also to be evaluated, correlated, and after evaluation some configuration data in the system to be modified. A central power system moni toring therefore offers some or all of the following features (Figure 9-5):

What the Figure 9-6 does not show is, that from the central system the evaluated data is again distributed: to office work places via intranet LAN, or to mainte nance personnel via mail. fax, SMS, pager etc

'

• Direct access to substation monitoring and automation system supervision data • Parameter setting from remote • Assessment quality

of

power

• Historical data base for enterprise resource planning • Visualization of critical areas via geographical information system (GIS) • Identification of weak spots in combination with lightning data base • Support of maintenance and asset management systems The results of monitoring systems are not needed for direct power system operation, but more for mainte nance and planning. Therefore they are often gather ed separately from the network control centers, al though some of their data should also be correlated with data gathered in network control centers. Therefore, typical Power system monitoring (PSM) systems might look like Figure 9-6.

192

Local SMS systems, substation automation systems, or even directly protection devices or disturbance recording systems are connected to some central place via wide area connections. These wide area nents is however limited both because of costs and technical feasibility for reliable switchover. Apart from this, the increased quantity of redundant devices would decrease the mean time to failures (MTIF) for repairs in the system. As is shown in chapter 8, the decrease in availability is, however, relatively small if the failed component is not replaced as fast as pos sible (see system MTIF without repair in contrast to MTIF with repair). Therefore, all these systems have to be supervised carefully to detect any degradation in time. The

I

connections can be set up on demand by the center, i.e. via modems, and therefore do not need perma nent connections like an NCC. But also other kinds of wide area connections like routed packet switched networks are possible.

• Protection related information as input for protection system supervision and fault location

9.4 Monitoring of Substation Automation System 9.4.1 Different levels of monitoring The Substation Automation System or any dedicated Monitoring System is supervising both the phenome na in the power network and the allocated switch gear. These phenomena may require fast response by protection or automatics, or actions by the opera tor e.g. an acknowledgement of the related alarms. They also produce non time-critical data for mainte nance and planning. The loss of the substation automation system would have a severe impact on the operation of the power system. Same holds to a much larger extent for the network control and management system. The deg radation of monitoring systems would affect the asset management and cause problems at least mid term. Highly sensitive components should be duplicated to avoid that a single failure can block the functionality of a complete system. The redundancy of camporesult will be an input for the utility asset management system. In the following two sections, the basic monitoring procedures for systems are explained.

'

I

(EMI). Reliable and often redundant power supplies contribute to the robustness of lEOs.

9.4.2 Self-supervision of devices Each intelligent electronic device (lED) has a lot of interacting components. The design should be made in such a way that all components have a high MTIF, and that the complete arrangement is insensitive against electromagnetic interferences

9.4.2

Figure 9-7 Typical/EO self-supervision and local communication supervision

193 !

i

·

9.4.4

Nevertheless, self-supervision is necessary. AJD con version that might be subjected to aging should be supervised by means of a reference signal. Watch dogs should supervise the response times from pro cessing algorithms. If memories are used for the sto rage of data, checksums should be used to detect any failure. Loss of power supply should be monitor ed as well. The question, how many percent of the device should be covered by selfsupervision, is very academic A typical example for self-supervision of an lED is shown in Figure 9-7

• Self-supervision of communicating devices • Supervision, if all nodes in the communication network are still operative and responding • Detection of errors in telegrams at least on the receiver side • Supervision on communication overload and acceptable response times • Counting of lost messages and detected errors

9.4.3 Supervision of communication

9.4.4 The connection to central monitoring systems

Communication is the backbone of any system and should, therefore, be supervised in any case. A stable communication is not only needed for safe operation but also for the transfer of the results from the lED self-supervision to higher monitoring levels. The com munication medium in substations normally consists of interference free fiber optical cables or of screened wires. Communication problems occur in the senders and receivers or in communication devices in be tween, e.g. star coupler, routers, switches, etc All this communication equipment is subject to self-supervi sion according to 9.4.2. There are different levels of communication supervision, i.e.

1 94

i

. i i

Self-supervision of devices or a substation automati on system is required. If, however. a substation is not manned, than it can only be used to shut down parts of the system. Thus self-supervision enhances the safety for operation errors, but it does not improve the availability, i.e. that one is able to do what is requir ed at a certain point in time. Therefore, also the results of this self-monitoring should be permanently supervised. In case of unattended substation auto mation systems this is normally performed by the associated network control center, which then has to pass the information of failures to the maintenance staff. The centralized power system monitoring sys-

Mechanical Protection, no supervision

Self supervision

Self supervision and remote supervision

MTTF (years)

50 years

50 years

50 years

MTTR

24 hours

3 month

24 hours

Error detection.time

3 month

1 hour

1 hour

Availability (%)

99.504

99.509

99.994

Safety(%)

99.509

99.99977

99.99977

Table 9-7 Comparison of availability and safety depending on supervision types

I

I,

!

tem with direct automatic link to maintenance staff as mentioned above would do this as well. It even could supeNise remotely the protection devices by gathe- · ring the results of the permanent self supeNision in order to increase the protection system availability. This is usually cost efficient even if there are no distur bance recorder data available from these devices. An example for the improvement of safety and availabi lity by self-supeNision and remote supeNision is shown in the Table 9-1. The calculations are based on a simple Markov model considering the mean time to failure (MTIF), mean time to repair (MTIR), and the error detection times due to either self-supeNision or periodic manual tests.

9.4.4

In Table 9-1 the MTIF for the JED is in all cases assum ed to be identical, i.e. 50 years, to see the effects of self supeNision and remote supeNision. It is further assumed that if no supeNision is done, then failures are only detected in the course of periodic mainte nance every 6 months. This leads to an average error detection time of 3 months. In the case of JEDs with self-supeNision, but no remote monitoring, the MTIR is assumed to be 3 month, as the periodic inspection time has to be added to the delay of repair. Apart from this, the error detection time of the self-super vision is assumed to be 1 hour. Any delay in commu nicating this by remote monitoring is within the 24 h MTIR. It can be seen immediately that the self-super vision alone mainly enhances the· safety. In order to obtain a similar degree of improvement of the availa bility, at least daily supeNision is necessary in addition. And it should be kept in mind that the availability of protection is the security of the power system.

195

9.5 References

9.5

[1] F. Engler, A.W. Jaussi · Intelligent substation automation - monitoring and diagnostics in HV switchgear installations, ABB Review 3/1998 [2] R. ltschner, C. Pommerell, M. Rutishauser · GlASS - Remote Monitoring of Embedded Systems in Power Engineering, IEEE Internet Computing, May/June 1998 [3] Xiaobing Qiu, Wolfgang Wimmer · Applying Object-Orientation and Component Technology to Architecture Design of Power System Monitoring, PowerCon 2000, 4th International Conference on Power System Technology, Perth, Australia, December 4-7, 2000 [4] I. De Mesmaeker, H. Ungrad, G. Wacha, W. Wimmer · The role of SMS in enhancing protection and control functions, CIRED 93, Birmingham, 1993 [5] K P. Brand, H. Singh, H. Ungrad, W. Wimmer · Enhancement of distribution protection by communication, 2nd Int. Symposium, Singapore, 1991 [6] V. Lohmann · Integrated Substation Automation System Support: New Maintenance Strategies for T&D Equipment, Electrical Engineering Technical Exchange Meeting at Saudi Arabian Oil Company, November 1998

'., II

[7] V. Lohmann, I. De Mesmaeker, B. Eschermann · New Maintenance Strategies for Power Systems supported by Substation Automation, Cigre Conference June 1999 in London/UK [8] V. Lohmann, 0. Preiss · Less Impact of Power Failures Due to Substation Automation, CIRED Conference, 1999 in Nice

''

196

10

New Roles of Substation Automation

10.1

Impact of the Deregulation of the Power Industry

10.1.1 Reshaping the Business 10.1.2 Working Plants Harder 10.1.2.1 Enhancing System Thermal Capability 10.1.2.2 Maintaining Voltage Stability 10.1.23 Real Time Network Analysis 10.1.2.4 Post Fault Actions 10.2 Motivation for Modernizing Substations 10.2.1 Contribution of IT to Provide New Opportunities 10.2.2 Efficient data exchange for up-to-date information 10.2.3 Advanced Power System Management 10.2.4 Typical estimates of benefits and costs 10.2.5 Cost comparison SA versus conventional 10.2.6 Capturing benefits 10.2.7 Reorganization 10.2.8 Upgrade steps towards advanced power system management 10.2.9 Summary and conclusion 10.3 Policy for substation refurbishment 10.4 Business related impact of SA 10.4.1 Better Information 10.5 References

198 198 198 199 199 199 200 200 200 200 201 204 204 205 205 206 207 207 208 209 210

10 Table of content

197

.

·

10 New Roles of Substation Automation

10

10.1 Impact of the Deregulation of the Power Industry Over the past decade the electricity supply industry has been subjected to dramatic changes. World-wide the trend is to restructure vertically integrated utilities catering for generation, transmission and distributions into smaller "unbundled" companies. The new plant owners are pushed to minimize costs through great er utilization of existing assets. This can be achieved by reducing operating security margins. As a matter of fad, this new operation philosophy is enabled by the rapid advances, which are made in the field of digital technology applied for protection, control and communication. These developments drive significant changes in power system management, substation automation and broadband communications. Various aspects of the utilities needs have been dis cussed in the Cigre 99 London Symposium on the subject: 'Working Plant and Systems harder'Enhanc ing the management and performance of plant and power systems is being addressed widely at many international conferences. The overall conclusion per ceived is that there are a lot of new technologies available, which will help planners and operators to find new solutions to maxirnize the use of the power systems and adapt to the fast changing environment.

10.1.1 Reshaping the Business

198

The final decade of the 20th century saw unprece dented changes in the structure of the electricity industry as the "deregulation fever'' spread around the globe. With deregulation of this historically con trolled market, shareholder and customer interest became a key factor in the competitive free market as corporate officers traded unbundled business sec tors internationally for the highest stakes. These board room-level issues have overshadowed the ever changing responsibilities for the engineering busi-

• Better modelling and more detailed technical analysis. Using these techniques it is often possible to assign enhanced ratings to transmission equip ment, and hence increase system power transfers. • Better analysis of system conditions. As a result of increased power transfers across the system there is a reduction in operational "margins for error'. This means that accurate prediction and analysis

ness that continues to develop new technology to meet the demand for more electrical energy. The engineering decision-making process now must con sider, in addition to engineering and financial issues, the impact on the local and global environment in the form of environmental studies and life-cycle assess ments. Consumers now regard electricity as an essen tial ingredient to improve the quality of life, and the industry faces the challenge of satisfying the demand for energy in a manner that has minimum impact on the environment. The large interconnected national and international transmission systems that bridge geographical and political boundaries continue to offer the opportunity to optimise and share the use of energy efficient resources. In the increasingly competitive arena there is signifi cant pressure on power providers for greater syst_em reliability ard improvement of customer sat1sfad1on, while similar emphasis is placed on cost reduction. These cost reductions focus on reducing operating and maintenance expenses, and minimizing invest ments in ne.v plants and equipment. If plant invest ments are [CJ be made only for that which is absolu tely necessary the existing systern equipment must be pushed :o greater limits in order to defer capital investments

10.1.2 Working Plants Harder Enhancing Lhe management and performance of plant and power systems is being discussed widely at many interrational conferences. The overall conclu sion perceived is that there are a lot of new techno logies available, which will help planners and opera tors to find new solutions to maximize the use of the power systems and adapt to the fast chanqing envi ronment. The innovations which can be developed and imple mented to enable to work the system harder include

..i i

the following:

of power system conditions are vital. • A reduction in the timescales in which the control engineer can act. To this end better alarm cata analysis is required, together with automatic instead of manual actions. In addition to the pressures to "work the system har der:there are also

pr es su re s to re du ce th e

overhead costs of the system operation function. This implies a need to use more efficient working practices, for example telecommand and sequence switching and extensive automatic voltage control equipment.

.

·

Monitor can be applied which uses the same mathe matical model as that used to derive the rating sche dule but it collects real-time data from outstations along the routes of selected With increasing environmental pressures the circuits. In a similar way, an on-line Transformer options for building new transmission lines are Thermal Monitor collects data and provides ratings very limited, even rebuilding or raising towers for for selected transmission system transformers. increased ground clearance can present considerable problems in ob taining the necessary In both cases the data collected are fed back to consents. Existing overhead line rating schedules are a master station located at the Control Center based on probabilistic methods, in many countries which has the cable and transformer models. The with four rating seasons covering the twelve results obtained are available in the control room. months of the year. These assume fixed values of Because the data is collected in real-time, it is not Vv'ind speed, temperature and isolation for each necessary to apply the same factors of safety that rating season. On certain days however, these need to be applied to probabilistic ratings, hence ratings may be enhanced if actual meteorological higher rating are generally produced. As the data is used. In the UK considerable research installation of the out stations and monitoring has been carried out and tools have been equipment is relatively expensive, its application is developed that can provide at the day ahead stage, limited to certain critical circuits. weather related iine ratings for critical circuits. Uprating up to 20 % can be possible on over 50% 10.1.2.2 Maintaining Voltage Stability of days. [6]

10. 7 .2.1 Enhancing System Thermal Capability

Transformer and cable ratings can also be based on rating seasons. In the case of cables there are usually two rating seasons, the actual ratings being derived from data provided by the manufacturers. Cables and their surroundings have long thermal time constants and therefore quite large overloads can be sustained for up to several hours. An online Cable System

I .

A system that is heavily voltage constrained requires a great deal of analysis to ensure that it is operated within security standards whilst out-ofmerit genera tion costs are kept to a necessary minimum. To exploit the increased thermal capability it may be required to install capacitive compensation for provid ing an appropriate margin to voltage instability.

10.1.2.3 Analysis

Real

Time

Network

The real time network analysis (RTNA) is an invalua ble tool for the control engineer, especially if the system is being operated at or close to its limits. Whilst off-line studies give accurate results they can never fully reflect the real system because of such factors as demand estimating errors, changes to the scheduled generating plant and transmission system reconfigurations. If real time data is used the RTNA can, in certain circumstances, give significant enhanc ements to system capability. The quality of the state

10.1.2.3

199

10.2

estimation using the RTNA depends on the accuracy of the existing metering and the representation of adjacent and lower voltage systems.

1 0.1.2.4 Actions

Post

Fault

Frequently it is necessary to identify post-fault actions such as re-switching a substation or rapidly reducing MW generation to mitigate the consequences of cre dible system faults. Utilities specific procedures spe cify maximum numbers of actions considered per missible within a given timescale. Generally, manual actions in less than 10 minutes are not considered feasible. If these actions could be carried out auto matically then the timescales could be reduced, which allows greater short term ratings to be utilized allow ing system transfers to be increased. Certain automa tic schemes are often installed but these only cater for a small number of eventualities. Also, these sche mes tend to be hard wired, inflexible and expensive to install. Advanced automatics may overcome these limitations in the future.

10.2 Motivation for Modernizing Substations

Over the past thirty years the following key technolo gies and marketing developments have affected the entire electric power transmission and distribution world: • The invention and large-scale application of microprocessors • The development of high-speed digital communications

• Setting parameters • Disturbance records • Statistics • Trends • Condition related data • Non-urgent indications

• Substation automation • Feeder automation However, for working plants harder the moderniza tion of exiting substations is a prerequisite. In addition to this, utilities will in future need more comprehensive service and support.

10.2.2 Efficient data exchange for up-to-date information The prerequisite for the provision of up-to-date criti cal operating information to engineers and account managers is an efficient communication network. This must be capable not only to support remote control from network control centers but also retrieval of data on loading, interruptions, voltage disturbances, and other electrical events from all substations throughout the utility service area for the protection, maintenance and planning departments.

1. Real time communication between the network control centers for supervisory control and data acquisition (SCADA) and energy management systems (EMS) as well as between the various substations for control actions: ..·-P·QSition status • Commands • Interlocking • Automated functions

• The world-wide implementation of Internet networking.

2. Non-real time communication to transmit data to the back-office departments for protection, engineering, and maintenance as well as for planning and asset management:

• Energy management and power system management

It is recommended to split the communication system into two partial networks:

10.2.1 Contribution of IT to Provide New Opportunities

200

All of them have become great enabler with regard to new business opportunities, challenging market needs and new requirements, in view of the fad that the pressure on utilities for cost reduction and pro ductivity improvement requires new concepts for

• Actual process values s u p p l y . .

10.2.3 Advanced Power System Management There are three area where information technology (IT) applications can contribute significant benefits in terms of advanced power system management (Figure 10-1): 1. Enhanced power system operation, which results in higher reliability of power supply 2. Substation automation which assures higher availability and flexibility of power

3. Onli ne po

wer system monitoring to work systems harder and to save maintenance costs 10.2.3

Figure 70-7 Advanced Power System Management Overview

Power .·Optimisation

Substation Automation

Substation Automation

····power Distribution ·

·fio l'er · Transrriission AI

·;Power System· The objective of the Advanced Power System Management (APSM) concept is the optimization of the power system performance in tf'rms of reliability and availability at minimal operation and maintenan ce costs. 10.2.4

It comprises a distributed concept consisting of • Power supply optimization, substation automation and demand side management · on consumer level • Wide area communication network as link between the process level and the network control and power system management level • Enhanced power system operation modules to provide data and information for energy manage ment and supervisory control and data acquisition (SCADA) systems • Online power system monitoring to provide data and information for Asset Management as well as Engineering and Maintenance The main obstacle to realise this vision was the mul

Demand side Management

ill

·Power, . Consumers 201

titude of proprietary communication protocols that

have limited the capacit y for data transmi ssion and the interop

erability between the numerous vendor specific protection and control IEDs. With the intro duction of the new international communication standard \EC 61850 all requirements for communica tion capability and compatibility, interoperability be tvveen vendor specific devices and forward compa tible engineering standards this vision is going to become reality. For further details please refer to chapter 13.

10.2.4 Typical estimates of benefits and costs The estimated first cost benefits indicated as per Table 10 -1 are for a new substation construction comparing conventional substation design with auto mated substation design. [1] These figures serve as a model for cost comparison only. The substation con figuration assumes a 138/15 kV transformer, 6-13 kV circuit breakers, breaker & 112 arrangement, and 2 times 6 position feeders of 15 kV metal clad distribu tion switchgear.

Table 7 0-7 Estimated benefit/cost for SA retrofit of medium sized utility

Qty

Eliminated items

$/Unit

Material

Mhrs/unit

Labor

Total

ea

8 000

48 000

50

12 000

60 000

Control Panels

6

Relay Panels

4

ea

5 000

20 000

50

8 000

28 000

Taxation relays

2

ea

3 500

7 000

20

1 600

8 600

Feeder relays

10

ea

2 500

25 000

20

8 000

33 000

I

Conduits

2 000

ft

1

2 000

0.20

16 000

18 000

Wiring

6 000

ft

4

24 000

0.10

24 000

48 000

160

sqft

15

2 400

5

32 000

34400

RTU

1

ea

18 000

18 000

750

30 000

48 000

Fault iecorder

1

ea

25 000

25 000

100

4 000

29 000

Sequ. event rec

1

ea

18 000

18 000

100

4000

22 000

Annunciators

2

ea

3 000

6 000

20

1 600

7 600

141 200

336 600

Control building

202

Unit

Total in US$

195 000

.

· • PC human machine interface (H'/11) with all necessary software, drivers, net:lork managment.

The estimated costs to provide fud substation auto mation for this arrangement would range from $100 000 to $200 000 and induce

• Local Area Network (LAN) with :lterfaces for all IEDs Programmable logic contro er (PLC) and remote 1/0 modules. •

Full compliment of IEDs with pr;'ilary and secon dary protection schemes on all r-ajor equipment. For most economical arrangemeIEDs are

located nearest to the eqipmenc :hey protect.

• Full drawing management software package for all substation physical, schematic, wiring, arrange menand other technical drawings at the site with as built changes, forwarded to drafting for revision and returned to the substation via included wide area network management software.

• Transformer management sense'S and software.

10.2.4

• Full system configuration, tesinstallation, documentation and commissioning. It is obvious that the benefits exceed the implemen tation costs for new substation construction. The esti mated implementation costs may vary according to the level of redundancy required and conservatism with respect to the use of traditional mimic style con trols. The least cost system will locate lEOs nearest the controlled equipment and use only one HMI (PC). Table 10-2 indicates typical benefits and costs for substation a·utomation at a medium sized utility with 116 total substations. 16 bulk power substations, 40 medium sized distribution substations, and 60 small distribution substations. [1]

Table 7 0-2 Estimated benefits/cost "Jr SA retrofit of medium sized utility

Benefit Item

Est.$ Est.$

Cost Item

Reduces time to find and fix prot ms 800 000

2 250 000

Small SIS with IEDs

4

Reduced SCADA O&M 000 000

34 800

Medium S/S with IEDs

4

Reduced metering O&M 920 000

46 400

Large S/S with IEDs

1

Transformer monitoring

1

Reduced protective relay O&M 320 000

232 000

Reduced SER & Fault recording 040 000

11 600

Remote operation via modem

174 000

Predictive maintenance

718 504

Transformer load optimization Reduced trouble shooting

Total estimated Cost

1 437 008 153 000 16

Reduced training costs

50 000 40

Drawing management

116 000 16

Small SIS Medium S/S Large S/S

12

Total estim ated bene fits (US $) 5 223 413 Total subst ation s S/S 116

203

.

·

10.2.5 Cost comparison SA versus conventional

:0.2.5

The costs benefits as per section 1 0.2.4 refer to the following cost structure for conventional protection and control of a typical distribution 138/15 kV sub station with 6 feeders 138 kV and 12 feeders 15 kV [1].

In this specific case the estimated costs for SA are smaller than indicated in the Graph 10-1.

Cost Items

%

The main savings are achieved with the following cost items:

Control Panels Protection Panels Metering Panels Feeder Protection Relays Cable Conduit Wiring Control Building Remote Terminal Unit (RTU) Fault Recorder Sequence of Event Recorder Annunciator SAT. Commisioning

16

• Wiring substituted by fibre optic cables

8

• Less cable conduits

2 9

• Annunciaters and fault recorders are integrated in the IEDs for protection and control

5

13 9 13 8 6

2 9 100

Total costs

Table 7 0-3 Cost splitting of conventional control and protection for a 7 3817 5 kV SIS

• Reduced space requirements for the control building • RTUs are no longer required The cost benefits for SA compared with transmission substations of 245 kV, 420 kV and 525 kV are even more significant due to the vast space requirement and the large amount of wiring and cable conduits required as shown in Graph 10-2.

i

I

I ;

I I

The comparisons of the installation costs reveal that SA is the most cost effective solution in every case.

Graph 7 0-7 Cost comparison between conventional control and protection and SA for a 7 3817 5 kV SIS

Cost Comparison conventional control and protection versus substation automation (SA) I

I

I

I

!

!

• SAT, Commisioning

o Annunciator o PC-based SA System, t-MI

'

& SW

1!1 Sequence of Event Recorder")

300'000

•Fault Recorder*)

o Remote

250'000

Term inla Unit (RTU) j

•Control Building EIWiring ..)

200'000 150'000

: Cab!e Cendu!t

o Feeder

Protection Relays

o Metering

100'000

Panels

•Protection Panels

o Control Panels

50'000

)04

0

Conventional

SA

\

I

Installation Costs Conventional Control & Protection versus Substation Automation 1'800'000

10.2.7

1'600'000 1'400'000 1'200'000 0 (/)

1'000'000 800'000 600'000 400'000 200'000 0 115115 k\1

2451123 kV

I-+-

420/123 kV

Conventional ----Substation Autorration

525/123 kV

I

Graph 10-2 Installation costs for conventional control and protection versus SA for various voltages

With higher system voltages the impact of the instal lation cost for conduits and wiring becomes the main driver for the steeper increase of the installation costs.

1 0.2.6 Capturing benefits The business case for doing any sizable automation implementation will likely be based on the strategic and tangible benefits mentioned previously. It is likely that a large percentage of these estimated benefits might be based on reduced operation and mainte nance costs resulting from reduced manpower and streamlined business processes. In order to capture these benefits it will be necessary to make changes in the organization as the automation functions and improved business processes are deployed.

10.2.7 Reorganization Utility departments that will be impacted by the tran sition from conventional non-automated substations

to fully automated substation environments will inclu de metering, protection, SCADA, and maintenance. These groups have enjoyed the autonomy associated with the use of independent special purpose systems requiring specially trained groups of employees. New substation automation systems Will Incorporate digi tal processing and client-server technologies that will make most of the activities associated with the "old school" obsolete. Metering personnel will no longer need to design and maintain systems with dedicated meters. Meter ing functions will be performed by certified IEDs and made available to all network applications from a- real time database._Tbeintegrated database will re cord historical data for billing, trending and analysis. Protection engineers will enjoy remote access to the configurations, reports and historical performance of

. ' . r

205

10.2. 8

those devices via direct network or modem commu nications. Travel time for information gathering, cali bration and routine maintenance will be minimized or eliminated. All documentation required to support the system will be incorporated into its integrated database. As built changes to documents and draw ings will be made online at the same time that hard ware and software changes are made. SCADA RTUs will not be required. The SA platform will filter the required analog and status information from the network and emulate the EMS protocol through a gateway that will appear as an RTU to the EMS. Control through the SA will be transparent to the EMS. Routine substation maintenance will be minimized. Fault duties of major substation equipment will be monitored and alarms will be sent when maintenance thresholds have been exceeded. Many of the lEOs and communication devices will have self-diagnostic capability. Maintenance will become predictive and not periodic any longer. The resulting staff required to support the substation will be reduced considerably.

1 0.2.8 Upgrade steps towards advanced power system management The application of modern IT solutions with imple menting lEOs is the state-of-the-art for new sub stations. The benefits of advanced power system management can, however, only be exploited if the legacy electro-mechanic control and protection sys tems in existing substations are substituted with modem IEDs, and if access is provided for data retriev al via modern communication networks. Even if a modern wide area networks (WAN) is avai lable for real-time data exchange, there remains the decision to be taken for the most feasible step-by step retrofit strategy for the substitution of the legacy equipment. The strategy as outlined below for a sub station with conventional control and protection systems suggests nine upgrade options depending on the required scope of functionality (Figure 10-2):

SCADA/EMS • System operation • Energy Management • Power Quality

206

I ·-

Figure 7 0-2 Nine upgrade steps towards advanced power system management

Utility Back office • Engineering • Planning • Maintenance

f

'(

1. Remote terminal (RTU) permit remote control from supervisory control systems (SCADA) in network control centers and numerical protection offers more functionality and the acquisition of condition related data. 2. Central control system with IEDs enhances the functionality of a RW and integration of digital fault recording reduces the costs for finding and fixing of faults. The serial link with the IEC 870-05-103 or IEC 61850 respectively proto col is used to conned the protection lED with the RTU. 3. Decentralized control system with IEDs close to the primary equipment offers significant cost reduction for secondary cabling and the data retrieval via modem allows cost-effective main tenance and parameter adaptation from remote. 4. Interaction of IEDs for control and protection via an ·Inter-bus allows more complex control and protection functions to improve the flexibility and availability of substations. 5. Substation automation systems enable local operation of substations, comprehensive substation monitoring and the provision of a substation database for data processing. 6. Substation monitoring systems enable comp rehensive substation monitoring and the proces sing of data to protection related information like fault location and short reports. 7 Inter-station automation based on wide area protection and optimization system 0/1/APS) is applied for advanced energy management, load shedding and controlled disconnection (islanding) of subsystems to maintain power system integrity and local power restoration. 8. Network level system for centralized retrieval and transmission of data enables the mainten ance and protection engineer to evaluate data from many substations. 9. Corporate information systems in terms of WAN and broad band technology allows the exchange of data and information between substations, SCADNEMS and utility back-office in order to insure that the right information is transmitted to the right people at the right time. Figure 70-3 Modern substation automation system

·

:

10.2.9 Summary and conclusion Significant benefits are available today for utilities to build a business case for integrated substation auto mation. The modular architectural concept provides a smooth migration path for utilities by initially targeting resources to the highest benefit sites,and then adding future sites as new business cases develop. The con solidation of substation automation computing and communication resources in the substation also pro vides a natural configuration for extending distribu tion automation (DA) services. Ultimately, true distri buted processing in the substations will make large scale advanced DA control and monitoring applica tions possible.

10.3

10.3 Policy for substation refurbishment Modern SA system comprise intelligent electronic devices (lED) for protection and control and provide an infrastructure to collect, to process and to transmit data and information, which can be utilized for cost effective condition monitoring of circuit breakers, power transformers, instrument transformers etc (Figure 10-3). NetlNOrk

control center Station computer (HMI)

1 1::

0

".j:i

Printer

Control panel

Protection panel

GIS or AIS

..

Swichgear

207

10. 4

In the past, utility engineers often struggled with the fact that too little data was available when they attempted to analyze problems within their power systems. They also did not have enough information to predict or ascertain the level of maintenance need ed and of when it would be required for the major equipment located within their substations. As IEDs have made their way into substations, the same engineers may be suffering from data overload. They may even have more data than can be processed and assimilated in the time available. Today the challenge is to automatically convert data to information, which frees up manpower to imple ment corrective or preventive maintenance. There are basically two strategies where SA can contribute benefits to achieve more power in terms of better uti lity performance: 1. Better information, productivity

for higher

2. Intelligent automation for higher availability The prerequisite, however, is an efficient corporate communication network for easy access from remo te to primary equipment condition related informati on and for real-time interaction between substations. The World Wide Web as an information source and its commercial application has created a mass market where the technology costs are shared by millions of developers and companies. They have, however, to be complemented by special safety and security measures to make them feasible to be used for the power business.

20 8

ii ..

Sure the answer cannot be: because SA exists and therefor€ one has to make it happen! The imple mentation strategy should rather be based on a busi ness pull and technology push, not the other way around. Business requirements should always be the leading arguments.

1. What can be gained with the implementation of SA? 2. What are the criteria the decision to implement SA should be based on7

'

The most important aspects of a profitable business are cost efficiency and reliable information. As explain ed above, SA systems are valuable sources of process data and information, which can be transmitted to a commonly shared database, where they are proces sed and evaluated to provide reliable business infor mation. Business benefits must be real and tangible and it should be possible to quantify the expected results with a relatively high accuracy/certainty. From a busi ness point of view, the following points are clear ad vantages (Figure 10-4) for the justification of the im plementation of SA:

;-.

1. Better information, which result in higher productivity 2. Intelligent automation, which assures higher productivity and higher availability

:

:-

'I

i

1 0.4 Business related impact of SA With privatization and deregulation of the power business in mind pure technical arguments as men tioned above are not convincing enough for the justi fication of SA Therefore, the following questions should be raised:

i

.

Figure 10-4 Substation automation (SA) leads to more power

More power in this context means: • Technical performance improvements • Less customer interruption MVA hours of lost power delivery

time and

10.4.1 Better Information

• Lower maintenance costs by changing from periodic to predictive maintenance practice • Power system performance data provide reliable input for system extension planning • Business performance improvements • Decreasing operation costs by reducing staff numbers • Increased productivity and cost effectiveness • Decreased maintenance costs due to less frequent and preventive maintenance • Decreased capital expenditure because of lower installation costs The prerequisite, however, is efficient communication for easy access from remote to primary equipment condition and SA system status related information and fast inter-station communication (Figure 10-5).

10.4.1

Apart from monitoring the condition of primary equipment and thereby avoiding power interruptions, an elaborate post fault analysis supported by moni toring systems is equally important. It has been observed that a large proportion of major blackouts of electric power systems is caused by pro tection system failures. In the case of conventional protection relays, such failures are hidden and only exposed during the rare occasion of system distur bances. It is therefore important to capture as much information as possible during a system disturbance from associated fault and disturbance recorders and protection relays. The subsequent settings refinement of the parameter is a corrective measure to prevent similar faults from happening again, or, at least, mini mize impact of unavoidable faults on the power sup ply system.

Figure 70-5 Communication network for access to substation related information

Protection/

.EMS/SCADA .Centre 1

Operation I Maintenance Centre

Planning I Asset Management Centre

Systemwide Master Clock

SA Substation 1

SA Substation 2

SA Substation 3

lntersubstation real time SA communication Substation n

209

1 0.5 References

i ..

10.5

[1] Ryan Bird ·,1ustifying Substation Automation, Black & Veatch http/ /tasnetcom/justa.shtml [2] V. Lohmann, H. Kattemoelle · Enhanced Customer Values enabled by Synergies between Protection and Control in HV Substations, lEE International Conference on Power System Control and Management in London/UK, April 1996 [3] V. Lohmann, J. Bertsch · Information Technology (IT) and the Application of Numerical Protection and Control Devices to enhance management and Utilization of Power Networks, International Distribution Utility Conference, Sydney/Australia, November 1997 [4] V. Lohmann · Integrated Substation Automation enables new Strategies for Power T&D, Southern Africa Power System Conference in Johannesburg/South Africa, November 2000 [5] V. Lohmann ·Advances in Power System Management Conference on Global Participation in

Indian International Grid, Energy Management and Convergence, Power Grid Corporation of India Ltd. and Federation of Indian Chamber of Commerce and Industry, in Mumbai/lndia, August 2001 [6] REIarp, MA. Lee, C. Proudfoot · Working the Protection Engineer Harder, Cigre Symposium June 1999, in London/UK, Paper No. 320-1

,

210

r

11 Wide Area Protection

11.1 Role of Wide Area Protection

11.1.1 Wide Area Power System Disturbances 11.1.1.1 Cascade line tripping control 11.1.1.2 Voltage collapse control 11.1.1.3 Undamped power swings control 11.1.1.4 Loss of synchronism cor,trol 11.1.1.5 Large frequency variatiotcontrol and load shedding 11.1.2 Measures against Power Systems Disturbances 11.1.2.1 Exchange of information, signals and measurements 11.1.2.2 Possible common studies 11.1.2.3 Principal recommendations about International defense plans 11.1.3 Conclusions

214

11

215 215 216 217 218 219 222

Table of content

222 223 224 225

11.2 Achievements with WAPS on power systems 11.3 Power system phenomena with possible WAPS solutions

226 227

11.3.1 Angle instability (transient and small signal) 11.3.1.1 Transient angle instability 11.3.1.2 Small signal angle instability 11.3.2 Frequency instability 11.3.3 Voltage Instability 11.3.4 Cascade line tripping

228 228 228 229 230 231 233

11.4 Classification of WAPS

11.4.1 Classification of WAPS according to its input variables 11.4.1.1 Response-based vs. event based 11.4.2 Classification of WAPS according to its impact on the power system 11.4.3 Classification of WAPS according to its operating time 11.5 Detailed description of the various WAPS

233 233 234 234 235

11.5.1 Generation rejection 11.5.2 Turbine fast valving 11.5.3 Fast unit and pumping storage unit start-up 11.5.4 AGC set-point changes 11.5.5 Underfrequency load shedding 11.5.5.1 Description and main characteristics 11.5.5.2 Improvement of system stability 11.5.5.3 Potential problems or harmful impact on equipment system 11.5.6 UndeNoltage load shedding 11.5.7 Remote load shedding 11.5.8 HVDC fast power change 11.5.9 Automatic shunt switching (shunt reactor/capacitor tripping or closing) 11.5.10 Braking resistor 11.5.11 Controlled opening of interconnection 11.5.12 Tap changers blocking and set-points adjustment

'·

236 237 237 237 237 237 238 239 239 240 240 240 241 242 243

211

11.5.12.1 Improvement of system stability 11.5.12.2 Reduction of set-point of LTC 11.5.13 Quick increase of synchronous condenser voltage set-point

11

Table of content

212

11.6 Voltage stability assessment guidelines 11.6.1 Off-line studies and on-line studies 11.6.2 Voltage stability margins and criteria 11.6.3 Voltage stability assessment 11.6.3.1 PV-based margin computation 11.6.3.2 QV-based margin computation 11.6.4 On-line VSA functional requirements 11.6.4.1 Introduction 11.6.4.2 Contingency selection and screening 11.6.4.3 Voltage security evaluation 11.6.4.4 Voltage security 9nhancement 11.6.4.5 General requirements 11.6.5 Contingency definition 11.6.6 Contingency selection 11.6.7 Contingency screening 11.6.8 Contingency analysis 11.6.9 Voltage stability criteria 11.6.10 Security monitor 11.6.10.1 Security monitor capabilities 11.6.10.2 Direct (scan rate) monitoring 11.6.11 Security enhancement 11.6.11.1 On-line determination of preventive actions 11.6.11.2 On-line determination of remedial actions 11.6.12 Modeling and data requirements 11.6.12.1 Modeling requirements 11.6.13 VSA Data Requirements 11.6.13.1 Model Data Requirements 11.6.13.2 Default data 11.7 On-line VSA execution modes 11.71 On-line VSA execution control requirements 11.7.1.1 On-line VSA execution trigger 11.7.1.2 VSA execution abort 11.7.1.3 Execution control 11.7.1.4 Validity of VSA results 11.7.2 Study mode execution control requirements 11.8 On-line VSA user Requirements 11.8.1 General VSA user requirements 11.8.1.1 User interface environment 11.8.1.2 User interaction 11.8.1.3 Save case capability 11.8.1.4 User documentation 11.8.2 Operator requirements 11.8.2.1 Operator interaction 11.8.2.2 Security related information provided for the operator

244 244 245 245 245 246 247 247 248 249 249 250 250 250 251 252 252 252 253 254 254 254 255 255 256 256 257 257 258 258 259 260 260 260 261 261 261 261 261 261 262 262 262 263 263 263 263

I

!

.

·

..

11.8.2.3 Applications of the on-line VSA function 11.8.2.4 Direct (scan rate) monitoring 11.8.3 Operations planners/engineers user requirements 11.8.4 Manager user requirements 11.9 Interface requirements

11.9.1 Consideration of existing automated operating orders 11.9.2 Interface with EMS functions 11.9.3 Interface with EMS services 11.10 The implementation of Wide Area protection

11.10.1 System Set-up 11.10.1.1 Hardware system set-up 11.10.1.2 System protection center 11.10.2 Voltage Instability Prediction 11.10.2.1 Options for guided control actions 11.10.2.2 Control of On Load Tap Changers 11.10.2.3 Load Shedding 11.10.3 Interaction with SA and SCADA systems 11.10.3.1 Wide area protection on network level 11.10.3.2 Disturbance Recording 11.10.3.3 Communication to SCADA/ EMS 11.10.3.4 Communication to power system monitoring 11.10.3.5 Communication to station level 11.10.3.6 WAPS communication to bay level 11.10.3.7 Substation monitoring system 11.10.3.8 Protection adaptation 11.11 References

263 264 264 264

11 Table of content

265 265 265 266

266 267 267 268 269 272 272 273 274 274 276 276 276 277 277 277 277

278

213

11 Wide Area Protection

11.,1

11 .1 The Role of Wide Area Protection Power systems are planned, built and operated in such a manner that customers should not be affect ed; within given limits, by possible contingencies. Even if a power system is planned to withstand cre dible contingency, it may be affected by more severe disturbances, resulting from multiple and simulta neous outages. Beyond such occurrences of credible contingencies, a power system may also be affected by more severe disturbances, resulting from multiple and simulta neous outages, with possible conjunction of protec tion or regulation failures leading to severe electro mechanical and slow transient phenomena with sta bility problems, vo!tage collapse and large frequency deviation. Even if the probability of such disturbances is very low, the result may be a system collapse for the whole network or a large part of it To face such severe perturbations, the utilities adopt special defensive measures under the name of "defence plans": these measures, which must be automatic and very fast, are intended to keep the spread of disturbances inside the network of each utility. or even in the whole interconnected power system. In this respect, whereas interconnecting powe(systems result in better security in case of limit ed outages or imbalances between generation and demand, it provides conditions for a wider propaga tion of complex incidents.

214

The reason is that most of the measures adapted by the companies/countries in the frame of defense plans have been conceived, more or less, in a scope confin ed to each company/country and the ultimate action may be to open interconnections at boundaries. Even if the achievement of an overall coordination is very · difficult due to both technical reasons and high costs, it is however suitable to improve the coordination of defence plans because the electric phenomena do not stop at boundaries.

Definitions: Defence plan: A set of measures to be taken to pre vent major incidents or to limit their consequences. Credible contingency: any single or multiple outage of system components taken into account, such as losing any single-circuit line, losing any double-circuit line, losing any generator, etc. States of the system:

In the times of deregulation and globalization of the power industry it is for sure that an increase in power exchange between companies and countries will occur. This contributes to making the interconnected power systems less able to face large incidents if appropriate measures are not implemented. This evolution leads to a new conception of defence plans and to a proposal concerning more coordinated defence actions between companies/countries. A group of experts on "Defence Plans Against Major Disturbances" elaborated some suggestions and re commendations, which are summarized below, for a better international coordination of defence plans and the normal and emergency control actions to prevent system incidents or to limit their consequen ces in large interconnected power systems as in the case of the European System (East-West Inter connection). These suggestions and recommenda tions are based on the reflections of the Group, start ing from the answers to a Questionnaire distributed to all the companies/countries who are members of UNIPEDE (International Union of Producers and Distributors of Electrical Energy, Paris/France). In view of the fad that: • the interconnected power system should be planned to withstand credible contingencies with or without activating any emergency measures or or defence plans, tested both from static and dynamic points of view (suitable reliability criteria), • appropriate agreements, which regulate the common use of the operational reserves should be taken into account to cover some defined outages in operation planning and operations stages, a set of preventive and curative coordinated measur es should be foreseen in terms of defence plans to prevent major incidents or limit their consequences.

• Normal: following any credible contingency, all loadings are within the continuous capabilities of system components, with voltage and frequency within prefixed operational limits and overall demand is supplied. • Alert: the system is in acceptable conditions, but, if at least one credible contingency occurs, the system will enter the emergency state. The alert state requires short-term or immediate action: the existing conditions are such that

action s must be taken rapidl y to preve nt unacc eptab le

overloading, voltage conditions, frequency changes or compo nent outages caused by pro(ections operation. • Emergency: loading, voltage or frequency un acceptable conditions already exist on the system. Or the demand has been lost, or the system is split. Actions must be taken immediately to bring the system into an acceptable condition.

11.1.1 Wide Area Power System Disturbances A list of the most severe phenomena which can cause major incidents may be the following: • Cascade line tripping, • Voltage collapse, • Undamped power swings, • Loss of synchronism, • Large frequency diminution. Some of these phenomena are often present together. In the following, for sake of simplicity, each of them will be dealt with separately along with its control measures. This approach is based on preven tive and curative actions for controlling phenomena which can deteriorate the system performances and

11.1.1.1 control

Cascade

line

tripping

The cascade line tripping may affect tie-lines be tween a part and the rest of the power system, when this part is importing or exporting much power. It may occur after multiple line fault and/or multiple genera ting unit tripping and/or during an expected extreme increase of the consumption, or as a "transfer effect" between parallel tie-lines when some of them trip, which increases load flows on the remaining ones.

11.1.1

The protective relays whose activation is responsible for the cascade line tripping can be overload relays ("static overload") installed in order to prevent over heating of the lines or distance protective relays "tran sient overload': when these relays are not blocked against power swings. The dynamics depend on the relays involved: from several minutes for the static overload relays, to less than one second for the distance protective relays activation. The consequences can be voltage collapse, undamp ed power swings, loss of synchronism, or a direct net work splitting. 11.1.1.1.1 Present situation

The list of the actions taken can be classified accord ing to two categories. The first category includes the following preventive actions: e

Each company follows security rules, in planning and operating stages; this contributes obviously to prevent such problems from occurring,

• The majority of utilities use power swing blocking relays, while some use out-of-step relays, • Others use preventive (or early) automatic load shedding or unit shedding to avoid cascade line tripping. Based on the monitoring of the breaker position of determined lines. The second category includes curative actions such as: • Fast manual (5-10 minutes) load shedding (some times by remote control from Control Centers). • Fast manual action on generators power set points and starting fast power reserves (gas cause an uncontrolled and widespread blackout

turbines, Hydro units).

215

11.1.1.1.2 Recommendations

To avoid cascade line tripping it might be desirable to adopt the following criteria:

11.1.1.2

• Protection systems on major transmission lines and interconnections should be coordinated with the adjacent system, acmrding to the following requirements: • Signal links between both ends of the lines to facilitate speed and selectivity when disconnecting faulty lines. • Single-phase automatic reclosing systems on all important lines, following single phase faults. In the case of polyphase faults, automatic 3-phase reclosing systems at both ends of international tielines and important internal line (phase displace ment between 20°- 60° depending on the length of the line and on eventual stresses concerning the shaft of big generating units). • Synchronizing equipment on all major network interconnection points (inter national and internal) • Power swing blocking relays to prevent transient overloads; in such a case out of-step relays suitably located are recom mended to eliminate loss of synchronism of system areas. • Settings of overload relays (on the main lines and/or transformers) agreed with neighboring utilities. • Periodically updating of protection set tings and coordination, for example every year and whenever major changes in generating resources. transmission, load or operating conditions are foreseen. The observance of these criteria • allows correct removing of faults, • avoids tripping of lines due to untimely tripping command of distance protections, • permits quick reclosure of important connections in case of temporary faults,

216

• guarantees a high degree of connection in the absence of more severe phenomena like loss of synchronism or rapid voltage collapse.

• enables. the implementation of Wide Area Protection Schemes (WAPS) or Special Protection Schemes (SPS) such as unit shedding and/or load shedding in interconnected operations. • requires the extension of the coordination between neighboring companies for off-line detection of potential critical situations, by means of dedicated planning or operation-planning studies, and exchange of data. If necessary due to particular network structure and conditions, it could be indispensable to use signals coming from neighboring companies or to send trip ping orders to neighboring companies. In case of degraded network or heavy operating con ditions in terms of power flows, suitable automatic fast disconnection of load or generation can avoid cascade line tripping as consequence of transient or static overloads after some lines have tripped due to fault. The implementation of such WAPS also provides eco nomical advantages because it enables to work the transmission network harder, still with appropriate security margins in case of emergency conditions. Particular attention must be paid to the reliability and dependability aspects of such WAPS.

11.1.1.2 Voltage collapse control The voltage instability (or voltage collapse) phenome non may affect a part of the power system, especial ly if this part is importing much power or is connect ed to the rest of the system with rather long lines. It may occur after multiple line tripping, and/or multiple generating unit tripping, and/or during an unexpected increase of the consumption. The consequence is a voltage decrease in some seconds or minutes in the affected part, with risks of line tripping due to protection operation, generator tripping and large black-outs.

11.1.1.2.1 Present situation The list of the actions taken can be classified accord ing to two categories. The first category includes preventive actions con sisting in planning MVAr reserve margins and con trolling voltage profiles, with respect to security rules: • Adjusting schedule,

generation

11.1.1.3

• Adoption of WAPS, like load shedding (in inter connected operation) submitted to particular network conditions and/or events (e.g. important lines tripping, low voltage values in some particular critical busses). To realize such control actions on-line exchange of agreed measurements and/or signals between neighboring companies may be necessary.

• Adjusting voltage set points on generators and synchronous compensators. Manually or under automatic secondary voltage control, • Adjusting taps on some transformers, • Switching on/off shunt capacitors or reactors. Such measures are taken by all the utilities and aim at managing correctly reactive resources. The second category includes curative actions, taken in order to face a voltage collapse which is occurring: • Blocking on load tap changers (OLTCs) on trans formers, used by the majority of utilities; some initiate blocking automatically, otherwise it is manually conducted. In some cases OLTCs blocking is applied in a preventive way. • Reduction of voltage references of OLTCs is used by some European utilities. • In some special cases, early load shedding auto matically ordered following important lines trip.

• Extension to all the countries/utilities of the OLTCs blocking, the diminution of OLTCs voltage references.

7 7. 7. 7.3 Undamped power swings control Undamped electromechanical oscillations between two parts of the power system can be of a "local type" (local oscillation mode) or of a "global type" (inter-area oscillation mode). In the first case, the oscil lations have high amplitude only on the electrical quantities, mainly real power and frequency, of a single power station or a small area. In the second case, the oscillation's amplitudes are relatively high on real powers and frequencies in two or more areas of the system.

is

Taken into account that power systems are operated under increasingly stressed conditions, the ability to maintain voltage stability has become a growing con cern. Along with the need for coordinating reactive resources and operation measures in critical areas involving areas of the grid common to more utilities. 11.1.1.2.2 Recommendations • Coordination between neighboring utilities on reactive margins management and voltage profile control, particularly if some problems are detected during off-line studies. • Use of agreed procedures between neighboring utilities for coordination of manual curative actions, particularly in structurally critical arecas.

This phenomenon can be due to structural reasons and may happen without apparent initial causes (no special events) or can be the consequence of losing important inter-area lines. The main structural rea sons are: high load flows along long lines, high reac tive absorption on generators, fast primary voltage regulator of the units without suitable Power System Stabilizers (PSSs). In both the cases (local and global), the consequen ces are large swings, having an oscillation period from about 0.4 s (local oscillations) to about 10 s (inter-area oscillations), on system quantities with risks of generating unit tripping, operation of distance pro tective relays, and network splitting.

217

·

., 11.1.1.3.1 Present situation

7 7. 7.7.4 Loss of synchronism control

The list of the actions taken can be classified accord ing to two categories. The first category includes preventive actions con sisting of: 11.1.1.4.1

• The respect of real power transfer limits (according to the security rules),

The loss of synchronism (or out-of-step) phenomena may occur after a large disturbance (severe short-cir cuit, multiple lines tripping, multiple generators trip ping...). It may appear suddenly or after a series of divergent swings. The loss of synchronism can affect a single genera ting unit, an entire power plant, a region, or several reg1ons.

• The respect of reactive power absorption limits and low voltage limits on generators, • Around two third of companies/countries use WAPS on their important generators. The second category includes curative actions taken in order to face a power swing phenomenon which is occurring: • The reduction of real power transfers and/or the increase of reactive power generation on concern ed power units and synchronous compensators, • The initiation of moderation on HVDC lines. • As a last resort, the disconnection of a radially connected parts of the system. Concerning curative actions it is worth noting that around one third of companies/countries provide manual actions and another quarter rely on automa tic actions.

The risk is greater when the network is not very mesh ed or when power flows are high. The consequences are: • Large transients (frequency, voltage amplitude, real power,...) both on the generating units and on the network with serious risk of units fast disconnection and network splitting due to the distance protections operation; • Large disturbances for customers (frequency deviation, voltage dips); • Risk of fast spreading throughout the power system (in a few seconds); • Problems in supplying generating unit auxiliaries, due to large variations of frequency and voltage of the units.

11.1.1.3.2 Recommendations 11.1.1.4.1 Present situation

218

To avoid undamped electromechanical oscillations it might be desirabie to adopt the following criteria: The list of the actions taken can be classified, once • Providing each impprtant power unit of all coun again, into two categories. tries/utilities with WAPS, taking care of both local oscillation modes and inter-area oscillation modes, The first category includes preventive actions, such with (if necessary) an on-line automatic updating of as: WAPS measurements. • Security rules followed by each country/utility, in • Increasing the coordination between neighboring planning and operation stages; this contributes utilities for off-line detection of potential critical obviously lo preventing such phenomena from situations, by means of dedicated planning or occurring operation planning studies concerning this parti • Fast valving, which is used by some utilities cular dynamic behavior of-the-interconnected • Other utilities use preventive (or early) automatic system. load shedding or unit shedding either to avoid the • Making agreements concerning operating rules, loss of synchronism or to avoid the event (multiple such as power transfer limits (short term remedy), if line tripping) which could lead to a loss of problems are detected. synchronism.

The second category includes curative actions on the generators and/or on the network with reference to the units: • About half of the European utilities disconnect generators by out-of-step-relay or under-voltage protection or power derivative relays; such actions may be fast (1 or 2 electric cycles) or delayed (back-up of a network action); • Generating units without fast valving are often rapidly tripped.

As far as the actions on the network are concerned, there are: • Out-of-step relays on some lines • Blocking of distance protective relays against power swings. 11.1.1.4.2 Recommendations

To avoid loss of synchroni sm the following may be desirable : • Implem

enting of WAPS as unit shedding and/or load shedding in interconnected operation, when necessary due to particular network structure and conditions. • Using of fast valving on thermal units: this action must be coordinated with all the electrical protec- . tions of the units and the adjacent network. The effectiveness of this action is confined to small areas including few power plants. • Utilizing, in the case of loss of synchronism of large system areas and in the presence of swing blocking relays, out-of step relays suitably located in the network or network splitting along pre defined sections (another type of WAPS). • Preventing automatic reclosing during out-of-step conditions. • Increasing of the mutual cooperation between neighboring utilities, or more generally to the overall interconnected system, intending to study possible risks and remedies by specifying the scenarios and the type of data to be exchanged to perform common dynamic studies for verifying by simulations the effectiveness of the actions implemented and, eventually, their improvement.

11.1.1·.5.2

7 7. 7. 7.5 Large frequency variation control and load shedding If, in spite of the control actions taken to maintain the network interconnected, a network separation oc curs, or in case of a controlled network splitting as well as in case of a large deficit in the interconnected system, it is essential to control the frequency varia tion in both the separated parts of the interconnec ted system by balancing generation and load. Parti cular attention must be paid to the frequency dimi nution, especially when it is not completely controlled by the frequency regulation. In such a case, a com mon and coordinated automatic underfrequency load shedding scheme should operate.

11.1.1.5

11.1.1.5.1 Present situation

The comparison of the different measures in various countries leads to some general results which are stat ed as follows: • The primary spinning reserve is mainly in the range 2-3% of the demand all the time. • Network splitting on underfrequency conditions at boundaries of a company is made by many utilities. • In the range between 50 Hz and about 49 Hz, all countries activate available power reserve such as spinning reserve, pumps shedding, change from pumping to generation mode, start of hydro units and gas turbines, changes of HVDC links operation mode, etc. • In nearly all European countries the first step for load shedding is about 49 Hz; only in Switzerland. Belgium and Yugoslavia the first step is respectively 49.5, 49.4 and 49.2 Hz. In Italy the first seven load shedding steps depend on frequency (f) and the rate of change of frequency (df/dt) or pure frequency criteria: this means that 4-28% of the demand can be shed at 49.1 Hz depending on df/dt value. Most of load shedding is done from 49 Hz to 48 Hz. In some countries there are ome additional steps down to 47.5 Hz. Most of the thermal units are disconnected from the grid on this threshold in order to save their auxiliary supply. • Generally a load shedding is operating without intentional time delay. Time delays, depending on special situations in the grid, are allowed only by Portugal, some NORDEL and some IPS partners.

219

11.1.1.5.2 General principles

try/utility isolated from the rest of the system. On the other hand, a close coordination of underfrequency load shedding plans is recommended because the international interconnected grid is in general so close meshed that a sudden and severe power imbalance will not be restricted to the national borders.

Schematically, one could say that a load shedding plan has been conceived, more or less in each coun try/utility, to meet requirements related to a frequen cy drop concerning a part or the totality of the coun

As an example, two different situations can be consi dered referring to the size of the affected system. In fad, the power imbalance can concern a part of the

interconnected network, involving more than one country/utility which has been isolated due to an initiating incident or the power imbalance can ap pear in a larger part of the interconnected system (one example of this category could be a large loss of generation occurring inside the overall interconnected system itself). To comply with all the possible situations and pertur bations the following main principles should be taken into account from the "system dynamic behavior" point of view: • The frequency range from 50 Hz up to 47.5 Hz is to be considered, because most thermal units are specified for a minimum frequency of 47.5 Hz. If the frequency drops below 47.5 Hz, the thermal units have to be disconnected. This frequency range can be divided into three regions, namely: 50 to 49 Hz, 49-48 Hz, below 48 Hz. • From 50 Hz to about 49 Hz, the first action to restore normal frequency conditions has to be initiated by the primary and secondary frE>quency control. Each country/utility has to provide a suffi cient spinning reserve according to adopted rules, that is a reserve equal to a suitable percentage of the respective power demand at all time. In other

single power station happens, the frequency in the partially interconnected network should not drop below 49 Hz (where load shedding starts). Of course it is not good enough to have a sufficient amount of primary spinning reserve, but "seen · from the network" the primary frequency control loop should have suitable dynamic and static characteristics in terms of • Transient statics, responsible for the mechanical power variation in the first instants after a perturbation or respon sible for the speed-of-response, • Ratio between the minimum frequency value during the transient and the new steady-state frequency value, • Peak time (corresponding to the minimum frequency), • Permanent statics. • Sealing time (corresponding to the reach ing of the new steady-state condition). Seen from the power stations, it is desirable that at · least the 50 % of the primary reserve of all the units is available within 5 s and 100 % within 30 s. In addition to the primary and secondary frequency control, every possible measure should preferably be taken in an automatic way, to stabilize and norma lize the frequency, like:

220

words, if an outage of a single power unit or a

thermal power stations due to the operation of minimum frequency protection. From this point of view, it is worth noting that presently the most common setting value is 47.5 Hz (instantaneously or with a delay 'Of 2-4 s), but some units are tripped at 48 Hz, others in the range 47-46.5 Hz. • The interconnected partners should abstain from isolating their networks from the neighbors before common load shedding has been effected. This means that when load shedding may become necessary, for instance in case of multiple outages or network splitting, every partner of the network should participate in load shedding. The first aim

• Shedding of pump storage units, • Starting of hydro units and of gas turbines, • Quick increasing power or changing from export lo import on DC links, • Demand side management (or switching-off of customers having particular contracts). • From about 49 to 48 Hz a common load shed ding scheme should operate, in order to stop the frequency drop and to stabilize grid operation before thermal power stations trip. The first thresh old (49 Hz) should give sufficient time-for the operation of primaryfrequency control. For shed ding pumps in appropriate sequence and, more generally, taking all the measures cited in the pre vious points and facing some defined outages. The last threshold (about 48 Hz) should permit the the frequency stabilization before the tripping of

must be to keep the network interconnected as long as the frequency is above 48 Hz. 11.1.1.5.3 Recommendations about load shedding The automatic load shedding plan of the inter connected power system should be adequately coor dinated, in the range 4948 Hz, so that the amount of the demand shed in the various interconnected net works (which must be approximately equal to the power imbalance) and the related setting values should not determine overloads on the lines or other network problems, which can cause other perturba tions, network splitting and the collapse in some parts of the interconnected system.

To satisfy such basic requirements it is necessary that:· • The load shedding plan should operate strictly coordinated in all countries/utilities, sharing out the risk among the partners. This mutual help under emergency conditions is in accordance with the proposal of sharing the primary reserve rele vant to the primary frequency contra!. • The operating time of the different load shedding devices should be harmonized, otherwise only the fastest ones would operate. This means that the load shedding should not be intentionally delayed (or delayed as little as possible). • The load should be divided into small portions. For this purpose it should be shed on suitable voltage levels of the system. • The maximum load shedding amount should be about 40 % - 50 % of the total demand. This amount is reasonable because, if too little load is

shed, the desired effect could not be reached. Conversely, if more than about 50 % of the load is shed, voltage instability owing to increasing voltage values (due to the· presence of many EHV lines) and consequent frequency collapse may appear. • An adequate common load shedding scheme depends on the structure of the network of each partner. There are networks with production and load at the same place and networks having a load center and a production center far away. To unify the approach of interconnected partners the following three ranges of frequency scale with related portions of load are suggested:

11.1.1.5.3

Range 1

49.0 - 48.8 Hz =1 5 % of instantaneous load Range 2

48.7 - 48.4 Hz =1 5% of instantaneous load Range 3

48.3 - 48.9 Hz =1 5 % of instantaneous load Within these frequency ranges, every interconnected partner could be free to decide the number of thresh olds. It is particularly recommended that the first fre quency threshold (49 Hz) is the same for all inter connected partners. • The frequency thresholds and related amounts of demand to be shed could be verified by per forming an ad-hoc study including • A choice of a suitable set of operating conditions (typically peak and minimum, winter and summer demand) • A choice of a set of severe disturbances in terms of power imbalance and the absence of sufficient primary spinning reserve, taking also into account critical sections (in terms of structure and power flow) along which the interconnected systems could be separated (the sepa ration involving more han one country/ utility) and loss of units after the sepa- - ration as experience in real incidents occurred in the past Finally, it should be noted that the realization of a common load shedding plan, as suggested above, would require appropriate modifications of the present situation.

221 ,..

• Also, behavior of voltages, reactive power flows and influence of automatic voltage regulations have to be considered.

11.1.2 Measures against Power Systems Disturbances 11.1.2

power

11.1.1.5.4 Recommendations about restoration

The following paragraphs describe some reflections from the recommendations above concerning coor-

'i.

It could be important to coordinate not only the load interconnected utilities.

dination of problems among

shedding scheme itself but also the main steps for restoring the grid to normal Exchange operating 11.1.2.1 of information,conditions signals ' and measurements I after commori load shedding occurred. Of course, this t

item is not relevant to the classical restoration phase is essential after a complete black-out, which is outsideItthe scope for common operation of interconnected grid to exchange this subject, but it is limited to the particular restoraimportant information between neighbors, e.g. relating to tion after load shedding. • The non-availability or loss of important lines Such a coordination, involving the roles of the • Temporary weak points in the power generation Opera- tors and Control Centers as well as ! exchange of signals and possible mutual agreements, could be • Major disturbances in the power generation based on the following main suggestions: This information allows the partners to estimate the security of the grid operation and should • The dispatchers whose network is involved in be given as common load shedding, should restore the grid to early as possible. normal conditions in very close cooperation, e.g. The continuous exchange of signals is useful to apply by exchanging information about the respective to control actions. Normally every partner operating situation of the grid, before isolated receives indications concerning the parts of the network are synchronized or before operating situation in the neighboring the shedded load is reconnected to the network. networks for his own measuring equipme nt abo ut: • The reconnection of the shedded load should take place in taking the transmission capacity • Deviations of the scheduled power of the respective network into account. exchange • Changes of reactive power flows

'.

and voltage • If it is possible to synchronize isolated parts of conditions in the vicinity of the borders of his the network within a short time, more generation neighbors capacity should be activated and the supply of the • The load of the tie-lines disconnected customer should be restored under the following conditions: Usually the values of reactive power, voltage and tieline load have only local importance and • Reconnection of load should take place concern bila- only if the frequency has increased to teral operational conditions of only about the nominal value, two partners. For getting more reliable information as redundancy • Reconnection of load should be initiated it is suggested that two partners establish a permain small suitable portions nent exchange of information concerning their subonly. stations next to the common border as follows: • It ought to be considered that depending on the

I,

222

duration of the interruption and because of special • Signals of tie-lines breakers demand (e.g. by heating or cooling !] equipment) • Voltage values of busbars the load after reconnection can be higher than before the disturbance happened. • Real and reactive power values of the tie-lines

1,_

i

I

. .

Moreover, it is suggested to exchange signals of breakers of the internal lines going out from the sub station next to the common border. In particular cases it may be advisable to exchange additional information continuously, e.g. power flow values of special lines, phase displacement of voltage in special busbars and so on, which can cause opera tional restrictions of the grid or a possible operation of defence plans in one or more than one country. Furthermore, the·neighboring partners should inform (minimum once a year or more often in cases of big changes) each other about the impedance values of their whole grid giving at least the lumped impedan ce to the substation next to the border to the normal grid situation. This way every country/utility is able to take into account the influence of the neighboring networks on their own grid with regard to static security calculations and on-line security analysis, and the relative data set can be adjusted according to the presentday information from the neighbors.

7 7. 7.2.2 Possible common

studies 11.1.2.2.1 Types of common studies In the planning phase each utility/country usually per forms studies on a regular basis with a several years outlook. The aim is to define the necessary measures to be taken in the system to meet the future require ments and to determine the necessary investments.· In the operation-planning phase each utility/country usually performs studies on a regular basis (e.g. each week, each month, etc.). The aim is to adapt the actual maintenance schedule for the generation and transmission system.

The increase of the mutual cooperation among the partners of the interconnected system, in particular between neighboring companies, could require some common studies on the system static and dynamic behavior for an off-line detection of potential critical situations (or possible risks) during planning or ope ration-planning phases. In particular, such studies should identify all the possi ble control actions to counteract cascade line tripping, voltage instability, undamped power swings, loss of

olds and the correlated amount of demand to be shed by the common automatic underfreq uency load shedding scheme. Besides, they should indicate the most important informatio n, measure ments and signals that have to be exchange d on-line, which can activate the opera tion of defence plans in one or more than one coun try.

11.1.2.2.2 Data required to perform common studies To perform such studies it is necessary to know: • Network structure, parameters and operating conditions. • The parameters of the dynamic components indicated below • Generators • Loads • Voltage regulators

eWAPS • Frequency regulators • Supply systems and controls • Capability dynamic limits • Secondary voltage control • Load frequency control • On load tap changer regulations

• Special system components (SVCs, FACTs) • The parameter of system protection like • Line and transformer protections • Generator protection against external faults • The parameters and characteristics of defence plans. 11.1.2.2.3 Procedures for data exchange The procedures of data exchange can have Se\f.eral different forms, but according to existing experience it is suggested to proceed in several steps: • Each partner prepares data of his system for a defined time interval (e.g. 5 years outlook). • All partners send their data in agreed form to

synchronism as well as to verify the frequenc thresh-

11.1.2.3

11.1.2.2 '

one chosen partner.

223

• The chosen partner, who may be the same each time or not collects all data and prepares the "data- book" both in written form and in computer form. • This data-book is sent back to all partners involved. • Each partner approves his data in the "data-book". This way the prepared data are valid for an agreed in teNal of time (until the next data exchange) and seNe as a base for all computations of common interest. The higher form of this organization is having all data on one

commonly accessible computer. In all the · cases, the maintenance of the data base is required. Same procedures may be used for the exchange of fixed data for short-time studies (e.g. on-line analysis) completed by some information, signals and measur ements coming from neighbors.

11.1.2.3 Principal recommendations about International defense plans Based on the recommendations explained in detail above the following principles can be summarized: • The main aim is to avoid network splitting (islan ding) and demand disconnection in cases of over load, large voltage drop, large frequency drop

and system instability. Another aim is to assure a controlled and limited separation of the network.

defence plans and to take into account that the extension of the interconnected grid can lead to wide spread and severe incidents. Apart • The majority of the utilities have from the need for coordination modified their defence plans between neighboring utilities, there following large incidents over is also ·a need for the systematic the last ten years, mainly by international coordina tion of the updating load shedding schemes various control actions, and for a and adding WAPS. common definition of defence plans philosophy as well as a common !n order to pursue the planning and operational-planning objectivesoJJbeJics.t item, it is of vital analysis related to possible defence importance for an interconnected plans operation. system to coordinate all the control techniques that are appro priate to In view of the fact that each utility control the system in normal and follows coordina ted security rules, in emergen cy conditions. On the other planning and operation stages, these can be considered as the most hand, the need is evident important pre ventive actions taken to counteract phenomena that could cause widespread and severe disturbances. In addition to this, it is recommended to coordinate the defence plans for controlling alert and emergency states of the system, as mentioned in detail above. Among those suggested actions, the most important and urgent ones in an international context, .and having the same degree of priority from the point of view of network security (even if for different rea sons), are the following: • To implement the blocking of OLTCs. In order to reduce the probability for a voltage collapse. • To provide each important power unit of all countries/utilities with WAPS, mainly taking care .I

of inter-area oscillation modes. • To coordinate with neighboring utilities the settings of overload relays and more generally of all the protective devices on the-main lines and/or transformers in the vicinity of the boundaries. • To install WAPS, as unit shedding and/or load shedding in interconnected operation, where it

is necessary because of particular network topology and conditions and to exchange information on defined events (e.g. important lines tripping, low voltage values in some particular critical busses, etc). It could also be necessary to interchange signals coming from neighboring utilities or to send tripping commands to neighboring utilities. for continuous updating and 2 improving the existing 2

• The use of power swings blocking relays to prevent transient overloads. In such a case, out of-step relays suitably located in the network, or network splitting along predefined sections (a type of WAPS), are recommended to avoid loss of synchronism of system areas.

4

• To coordinate the automatic load shedding plan of the interconnected power system in the range 4 9 4 8 H z . • To conduct common studies on the system dyna mic behavior during planning and operational planning stages, for off-line detection of possible critical grid topology and operating conditions and for the determination of the relevant control measures as well as of the most feasible informac tion, measurements and signals to be exchanged on-line.

11.1.3 Conclus ions In view of the fact that the power systems are to be planned, built and operated in such a manner that customers should not be affected, within given limits, by possible contingencies and not suffer consequen ces from a defined list of "credible contingencies" this generally leads to the adoption of planning and ope rating rules ensuring that the power system will remain viable if one (sometimes several) system com ponent (line, generator, substation) are lost.

Beyond such occurrences of credible contingencies, a power system may also be attacked by more severe disturbances, resulting from multiple and simulta neous outages, in conjunction with possible protec tion or regulation failures. Owing to that, the need aris es for the implementation of special defensive meds ures in order to avoid the spread of the disturbances not only in the network of each utility but also in the whole interconnected power system. However, most of the measures presently taken by the utilities in the context of defence plans are con fined to each utility and the ultimate action may be to open interconnections at boundaries. Even if it is very difficult to achieve an overall coordination because of technical obstacles and costs, it is advisable to extent the present coordination of defence plans as the electric phenomena do not stop at system bounda ries.

dents unless approp riate counte rmeas ures are imple mente d.' This leads to a new conce ption of defen ce plans and to more coordi nated defen ce actions amon g utilitie s.

As far as

defence plans are concerned, the new approach should be based on preventive and curati ve actions for controlling phenomena that can dete riorate the system performances and cause an un controlled and widespread blackouts. More precisely, the objectives of the such a defence plan should be the following • To provide all the measures necessary to maintain the power S)'Stem interconnected as long as possible after the occurrence of greatest number of phenomera, e.g: • Thermal overloads, • Trarsient overloads, • High and instantaneous voltage drop,

• SID':; and continuous voltage decline, • Loss of synchronism of small areas, • Frecuency drop. In the process of globalization and deregulation of the power industry, the power exchanges between utilities will increase. This causes the interconnected power system less capable to withstand large inci-

It is of vital importance to avoid the cascade line tripping, if necessary due to particular network structure anc conditions by means of WAPS for unit and/or load shedding. It is indispensable to keep the po.ver systems interconnected as long as possible as it is of utmost importance to all the partners, both to the weakest ones in terms of available pm'Ier and also to those partners who are normally exporting power. The implementation of such WAPS provide economical advantages as it is possible to stress the transmission network considerably, and to keep up the security margins even in emergency situations. • To initiate controlled network splitting aimed at isolating the phenomenon in case of loss of synchronism involving larger system areas. Such type of WAPS should be implemented on the

225

.

·

11.1.3

I '

I

11.2 Achievements with WAPS on power systems

11.2

condition that the network splitting does not cause other disturbances, e.g. cascade line tripping in the neighboring countries. • To control the frequency variation in all the separated section of the interconnected system by balancing generation and load, if a controlled network splitting or network separatior. could not be avoided, or in case of a large deficit in the interconnected system Particular attention must be paid to frequency decline because of insufficient frequency regulation: In such a case, a common and coordinated automatic load shedding scheme should be activated

The task of the power system planner is to find a technical and economical trade-off between investments, operation costs and customer service quality. WAPS play a significant part in this trade-off and are mainly used on a power system to: often conceived by operational planner specialist to cope with • operational difficulties imposed by particular power system characteristics, • operating conditions that involve heavy energy transfers due to generation co-ordination, • higher exposure to multiple faults than what was originally planned and

Finally, the increase of the mutual cooperation among the partners of the interconnected system, in particu- lar between neighboring utilities could require:

hydro generation located far away from load centers

temporary solution before a new transmission line is constructed. • Increase the power system security particu larly towards extreme contingencies leading to system collapse. Extreme contingencies

usually refer to events resulting in multiple campo. nents removed or cascading out of service such as the loss of transmission lines on a common right of-way or faults with delayed clearing (stuck brea ker or protection system failure) on a bus section. Extreme contingency evaluations are usually con

i"

'

• special operational problems imposed by long UHV transmission systems with

All examples of those situations are often mitigated by WAPS.

• Common studies on the system dynamic behavior • Operate power system closer to their limits. In many power systems, the operative safety marfor an off-line detection of potential critical gins began to decrease quickly as a consequence Situations (or possible risks) during planning or of restrained possibility of network development operation-planning phases. A list of data to be caused by environmental problems or as a conseexchanged and a procedure as proposed above quence of financial difficulties in following the that enable to conduct such studies. schedule of the transmission expansion planning. • The coordination of the main steps for restoring the grid to normal operating conditions after • Increase power transfer limits while maincommon load shedding has been executed. Such taining the same level of system security. a coordination should comprise the roles of the WAPS may be used to postpone some transOperators and Control Centers as well as the mission expansion projects to cope with scarce financial resources while maintaining the same exchange of signals and possible mutual agreements. level of power system security. In many power utilities, \fl/.f'>..PS is one of the key elements in the power system planner's toolbox to meet system performance requirements.

226

l

• Improve power system operation. WAPS are

In order to achieve the objectives mentioned above, a number of preventive and curative actions has been recommended.

• The on-line exchange of agreed measurements and signals.

:I

')

I! I;

I

I

II

r· j

I

i

l..

• In temporary installation to compensate for delays in the construction program, e.g. as a

ducted to determine their effects on power system performance and to measure the robustness of the power system. The use of WAPS to increase power system security is a world-wide acceptable practice to counter extreme contingencies, when experience proves that these events occur too frequently and/or causes system collapse. It is recognized that it is not feasible or possible to predict or prevent all multiple contingency events that could occur randomly and could lead to power system collapse. When the complexity of a system is

relative ly low a smal number of WAPS are probab ly sufficie nt to

protect the system adequately. However, large systems must call upon a set of coordinated measures whose design and operation must involve high levels of complexity. This is necessary to ensure the system is able to cope with all possible major incidents. Defence plans should be defined as a set of coordi nated defensive measures whose main purpose is to ensure the overall power system is protected against major disturbances, to limit the consequences of these low probability and unexpected events, and to prevent system collapse. Defence plans are thus mainly used to increase power system security.

11.3 Power system phenomena with possible WAPS solutions

The use of WAPS is most frequently justified for loss of network integrity characterized by one or more of the following phenomena: • Angle instability (transient and small signal) • Frequency instability · • Voltage instability • Cascade line tripping The structure of the system and its type of inter connection with its neighbors are significant factors in the analysis of the phenomena. Indeed some of these phenomena can be amplified or attenuated according to the various characteristics of the system. System structures can be roughly divided between: • Densely meshed transmission systems with dispersed generation and demand or • Lightly meshed transmission system with localized centers of generation and demand The type of interconnection can be classified as: • Transmission system which is part of a larger interconnection or • Transmission system that is not synchronously interconnected with neighbors or is the largest partner in the interconnection. Table 11-1 highlights the dominant phenomena for each type of system and makes it possible to appre ciate the relations between these two aspects.

A defence plan can be considered as an additional level of protection, designed to initiate the final attempt at stabilizing the power system when a widespread collapse is imminent. At pre5ent, very few power systems are equipped with such a defence plan and depending on the power system design they differ significantly. Individual WAPS based on generation rejection, load shedding, shunt switching or system splitting must be regarded as basic actions, that can be used within a defence plan.

The main purpose of this section is to identify if an WAPS is required and to determine the type of WAPS that will prevent a loss of network integrity. The deci sion is based on the type of instability and the-struc ture of the power system on which the WAPS is to be applied. After a severe disturbance some of these phenomena will occur together, but for simplicity, each will be discussed separately. The discussion will consider the possible WAPS actions that can be used 227 for controlling them.

. ?

11.3

11.3.1.

Densely meshed system with dispersed generation and demand

Lightly meshed system with localized centers of generation and/or demand

System in a large interconnection

Small signal stability Thermal overload No large frequency variation

Transient stability Small signal stability Voltage stability

System not interconnected or by far the largest partner

Thermal overload Large frequency variation

Transient stability Voltage stability Large frequency variation

Table 11-1 Dominant phenomena in relation to power system types

Table 11-1, presented at the end of this section, lists the types of WAPS most likely to be used to limit the consequences of transient angle instability, frequency instability, voltage instability, and instability resulting from cascade line tripping. Particular WAPS solutions are described in detail in section 11.5.

11.3.1 Angle instability (transient and sma·11 s1. gnaI,) 11.3.1.1 Transient angle instability

228

The transient stability of a power system describes the ability of all the generators to maintain synchro nism when subject to a severe disturbance such as a heavy current fault, loss of major generation or loss of a large block of load The system response will invol ve large excursions in generator angles and signifi cant changes in real and reactive power flow, bus vol tages and other system variables. Loss of synchro nism can affect a single generating unit, a power plant consisting of multiple units, a region of the net work or several regions connected together. The loss may appear suddenly (during the first swing) or after a series of divergent swings. The risk of loss is great-

er when the system is loosely meshed or the power flows are high. The main consequences are large disturbances for customers (voltage dips, frequency deviations) and/or large transients (real power, volta ge, frequency etc.) on the generating units and on the system. The latter may significantly increase the risk of fast disconnection of units and system separa tion due to incorrect line protection operation. To prevent loss of synchronism, rapid and massive actions based on the direct detection of the contin gency are often required. The following WAPS func tions have proven to be especially effective in this role: • • • • .I..,

Generation rejection and fast valving Dynamic braking Reactor switching near generators Automatic load shedding

I

..•..,.J'."I ". "'".Jr/1:tOl.l....;t)ef':j/IQ/

Qff':JI

,·nstabl·z,·ty Small signal stability refers to the ability of the power system to maintain in synchronism when subjected to small disturbance. Power systems contain many modes of oscillation due to a variety of interactions of

•

its components. Many of the oscillations are due to generator rotor masses swinging relative to one an other. Power systems having several machines will exhibit multiple modes of oscillations. These electro mechanical modes usually occur in the frequency range of 0.1 to 2.0 Hz. Undamped electromechanical modes can be of a local type (frequency range of 0.7 to 2.0 Hz) or of inter-area oscillation mode (frequen cy range of 0.1 to 0.7 Hz). In many systems the damping of these electrome chanical modes is a critical factor for operating in a secure manner. Counter-measures used to solve small signal stability problems rely for the most part on closed-loop controls. Closed-loop controls provide dynamic control of electric system quantities and fall outside the scope of this book. Examples of closed loop control devices include generator excitation con trol, power system stabilizer and static VAr, compen sators (SVCs). WPS are associated with non continuous-controls and are not normally used to improve the behavior of the system in the case of small signal stability problems.

11.3.2 Frequency instability Frequency stability describes the ability of a power system to maintain the system frequency within an acceptable range during normal operating conditions or after a severe disturbances that have caused cas cade line tripping, splitting of the system

other band. For example,. the composite curve indica tes that operation between 58.5 Hz and 579 Hz is permitted for ten minutes before turbine blade dama ge is probable. If a unit operates within this frequen cy band for one minute, then nine more minutes of operation within this band are permitted over the life of the blade.

i n t o i s o l a t e d a r e

11.3.2

as, or major outages of generating plant. If, despi te of the control actions taken to maintain the net

"'

.5

59++"-+"-,...._--i+ i}

.t

Time in minutes

work integrity, network separation occurs, it is impor tant to keep the frequency under control. Generators can operate without restriction within ± 0.5 Hz from normal frequency (50 or 60 Hz system) and for a limit ed time outside these values (according to manufac turer's constraints). Figure 11-1 illustrates typical steam turbine limitations during abnormal frequency conditions. The curve is derived by considering the worst case limitations spe cified by five turbine manufacturers. (Note: steam tur bines are generally the weakest type of turbine when considering underfrequency operation.) In this figure, time spent in a given frequency band is cumulative but independent of the time accumulated in any

Figure 11-1 Steam turbine limitations during abnormal frequency conditions

A major problem for a steam turbine is the frequen cy drop resulting from a sudden loss of generation. In a large interconnected system, this is particularly onerous if immediately prior to the disturbance signi ficant power transfer is taken place from one·region of the network to another. If an interconnection or a power plant outage occurs in a region with a gene ration shortage, a severe underfrequency disturban ce will result. Under-frequency operation (frequency deviation >-2.5 Hz) can lead to the damage of ther mal unit turbine blades and to life period reduction.

229

. ,

• Changing the operating mode of a hydro gene rator from a synchronous compensator to a synchronous generator.

11.3.3

Consequently, 'to protect the unit, the time duration for underfrequency operation is limited. In some situa tions, the frequency drop can be so deep, that under frequency relays will disconnect thermal units from the network, which· increases the power deficit. The other problem associated with operation at low fre quency is the effect on the output of plant auxiliaries (fans, boiler .feed pumps) and the reduC:ion this caus es in the output of the main generating unit. If we now consider the region of the network with a surplus of generation and assume that the inter-ties used to transfer power to the remote loads are sud denly tripped, the "local" system frequency will start increasing. If the frequency increases above a pre-set value (normally 61 Hz on a 60 Hz network) the governors may go into an over speed mode and close their main valve. If the over-frequency is not reduced within a pre-set time period the unit will be tripped because of the unstable boiler condition. The problem of overfrequency is less troublesome than underfrequency because tripping of the unit will cause a frequency reduction. However, if the reduc tion is insufficient, further units will need to be trip ped, or if excessive an underfrequency will result. Load shedding WAPS are used on most power system networks to control the frequency. Types of WAPS that have proven especially effective in the control of frequency are: • Underfrequency load shedding used to stop or reverse a frequency drop. This must occur before the thermal power plants are underfrequency tripped. The main objective is to hold the system frequency above a pre-set level (58 Hz on a 60 Hz network) and keep the network interconnected with the power plants on-line. • Automatic tripping of interconnection lines by underfrequency relays.

230

• Start-up of a unit in a hydro power plant, normally initiated when the 60 Hz frequency drops below 59.5 Hz.

(short-term) while loads fed through Load Tap Changers (LTCs) restore over one to several minutes (long-term). The same holds true for thermostatically controlled loads. This is also the time scale on which field (and in some cases, armature) current limiters ad to protect generators from thermal stress, thereby removing voltage support. Although the simplest voltage instability scenario is a . load increase above the maximum deliverable power, most experienced voltage incidents were caused by

• Islanding of thermal power units with local loads. The purpose of this measure is to keep the thermal units in service prior to the splitting of islanding of the system. After the split, these units should maintain supply to the consumers within the islanded area. • Overfrequency tripping of some or all of the units in hydro power plants (f > 61.5 Hz) to avoid thermal unit tripping. • Automatic load restoration initiated by the ope ration of overfrequency relays, designed to correct a frequency overshoot following the operation of. an under-frequency load shedding. The main influencing factors for frequency variation can be summarized as: the power deficit (P), the load damping constant (D) in the power deficit-area and the inertia constant (I) of the units. The frequency deviation in a large interconnected system can be expressed as: .M(%) =- P(%) (1-e-lff) K

where K = 1/D and T = M/D

11.3.3 Voltage Instability Voltage stability is concerned with the ability to main tain steady acceptable voltages at all buses under normal conditions, and after being subjected to a disturbance. Voltage stability results from the attempt of loads to restore above the maximum power that the combined generation and transmission system can deliver to them. This maximum power is directly influenced by electrical distances between generation and load centers, as well as by the reactive power limitations of generators. Voltage instability takes on the form of a progressive drop of voltages at the transmission level under the effect of load restoration. In turn, the sagging voltages may result in a system collapse causes by generators loosing synchronism and indudion rnotors stalling. A distinction is made between short and long-term voltage instability according to the time scale of load restoration. Induction motors restore their active

power consumption in a time interval of one second a large disturbance. Voltage instability may be caused by a variety of single or multiple contingencies. With respect to long-term voltage stability, the main con cern is the loss of transmission facilities (mainly be tween generation and load centers) or the tripping of generators (mainly those located close to the loads and supporting the voltages of the latter). With res pect to short-term voltage instability, the slow clear ing of a fault may cause an induction motor dominat ed load (e.g. air conditioning) to become unstable.

r

The main factors influencing voltage stability are: c System strength (long electrical distances between

generation and load centers) • Lack of fast reactive power reserves (generators, synchronous condensers and SVCs) • Lack of other reactive power reserves such as capacitors, etc.

• Fast increase of generator voltages (througn AVR set-points)

• High power transfers and high loading conditions.

• In the last resort, load shedding

• Low power factor loads

A proper amount of load shedding, at the proper location and with a proper tuning is very effective in stopping a voltage instability process. The objective is to restore a long-term equilibrium (operating point) for the system. It is also aimed at avoiding the system to reach a point where collapse occurs due to loss of synchronism, motor stalling, etc. Low voltages at transmission buses in load centers are typical signals but other variables may enter the decision logic as well.

• Load characteristics, in particular load power restoration through LTCs The following actions can be taken against voltage instability: • Shunt compensation: automatic switching of shunt capacitors or tripping of shunt reactors, • Emergency control of LTCs: blocking, return on a predefined position, decrease in voltage set-point. • Automatic tripping of interconnection lines (if it is acceptable to the area which imports power). • Modulation of HVDC power

In many cases, the required amount need not be large to restore an acceptable voltage profile for fre quency instability resulting from a lack of spinning reserve, but shedding must be fast enough. However, for voltage instability the location plays an important role.

• Fast unit start-up

11.3.4 Cascade line tripping Cascade line tripping refers to an uncontrolled sequence of transmission line disconnections trigger ed by an incident at a single location. In some situa tions, a severe disturbance on a transmission system can initiate major oscillations in real and reactive power flows and instability in voltage levels. These oscillations may initiate the operation of some pro tection devices or control equipment, which can occasionally result in uncontrolled cascade line trip ping. Overload or thermal problems may also cause cascade line tripping. Cascade line tripping will affect inter-ties between regions of the power system and will be particularly problematic when one regiqn is importing power and another exporting. In such situa tions the consequence of a disturbance may spread over a wide system area and could result in the loss of supply to a large number of consumers. Cascade line tripping is most likely to occur after the

11.3.4 protection has responded to a fault or faults by trip-

231

11.3.4

ping a double circuit tie-line, multiple lines in the vici nity of the fault, one/more generating units or a bus bar in a substation. Alternatively, cascade line tripping can occur during an unexpected extreme increase in consumption or as a transfer effect between parallel ties-lines, when one of them trips due to a fault or incorrect protection operation. This increases the power flow on the remaining lines and may result in load encroachment into the backup characteristics of distance relays or may be detected as an overload · condition by a time delayed phase overcurrent relay.

high speed unit or communication aided protection schemes. The dependability, security and selectivity of the protection relays and schemes, including where appropriate their communication systems, are of para mount importance in reducing the risk of cascade line tripping. However, improving the performance of conventional equipment protection may not comple tely eliminate the phenomena that leads to cascade line tripping and an WAPS may be required. The following types of WAPS are used by some utilities: •

The system dynamics will determine which, if any, relays are involved: i.e. zone 3 elements in a distance relay will normally operate in approximately 1 s, time delayed overcurrent relays set to detect an overload will normally operate in several minutes. To prevent cascade line tripping, it is important to ensure ade quate coordination margins exist between the opera ting characteristics of all the non-unit protection relays used on the network and also where possible to use

c:

WAPS actions

CT• 0... :J

0

"i3

I

c:

(])

"Q)

a: 0

I
('"")

I

(])

+-'

_c:

Vl

+--'

(])

Vl

c:

• Power swings blocking of distance relays The following tables shows an overview of the most used WAPS actions to counteract power system phe nomena:

I

?6 Q")Vl

_Q

+--'

(])

01

(\)

(\)

0

'++--'

(])

(])

:J c:

0

0

0...

(])

-

phenomena

_c:

Vl

-o
: (\) .::

Vl

(])

(\)

Vl

"i3

- o c

-a(])

\..::)

QJ

c:

0

(]) c:

(\)

(])

-oC:

·¥

01

o

01

-

CO">

(]) 0

01

(\) c: u

-ou

+--'

E:.C

oc:

(])

>(\)

0-8

:r:-5


::;·

u _c: ·-

c:

c:

jZ

E-o (])

(\) c:

01 '+-(])

UO"l

0...

(\)

+

--'

C .-

-a C:_c:


0...

·v;

::::Jlll

X

+-'

Vl

Vl +--'

c:

Transient instability

..c

+--'

001 -

0

\..::)

-i3 0

(\)

Vl

(])

Power System

-o

+--'

0"-o

c:

:J

;lO"l

c:

c: c:

QJ

s

Ui.s :J-o

·- 0

+-'

>-,

(\)

>

• Gas turbine start-up

u

t (\)

Preventive automatic load shedding or generation rejection based on the circuit breaker status (open and closed) on some important tielines.

::::J_Q

X

a:

u

0 '+-

Co

X

X

X

::0 X

Frequency instability - Frequency diminution

X ..

- Frequency rise

-

X

X

X

X

X

232

Voltage instability

X

X

X

Cascade line tripping

X

X

X

X

X X

Table 11-2 Most used WAPS actions to counteract power system phenomena

X

X

11 .4 Classification of WAPS

Normally, WAPS ad after a disturbance such as a fault

r--1

on transmission facilities, loss of generation or loss of large load. The system response to such a disturbance normally involves excursions of frequency, voltage and generator angles. The WAPS provides the requir ed stabilizing force necessary to preserve the system stability. All WAPS consist of three main parts:

I

• Actions to perform (such as generator or load tripping). Figure 11-2 illustrates the general structure of WAPS. Generally, WAPS refer to controllers having some or all of the following characteristics: • WAPS usually employ laws,

discrete, feed forward

• WAPS are nominally "sleeping systems" and operates infrequently, • The control action taken is, in most cases, predetermined, and • WAPS can be an·ned or disarmed depending on the power system conditions. There are numerous ways to separate and classify WAPS. The three classifications used here are 1. the type of WAPS input variable, 2. the impact of the WAPS on the system and 3. a classification according to WAPS operating time.

11.4.1 Classification of WAPS according to its input variables As shown on Figure 11-2 , WAPS refer to a special class of controls that do not provide dynamic control of electric system quantities (open-loop or feed-for ward controls). However, some of WAPS for example

11.4. 3

T

Direct detection

Power System Disturbances

• Inputs (level of physical magnitudes, status of circuits breakers, etc.) • A decision-making system that, based on the inputs, initiate some actions

Electric variables

PCM'er System

Wide Area Protection S tstem {WAPS) Switching or non-

-

continuous actions on: •Generator

r-

Decision <(

Making

Input

System

•Load •Line •Set point

I

Figure 77-2 General w1de Area Protection System (\NAPS) Structure

11.4

under-frequency load shedding, operates in steps. The power system response from each step is thus taken into account before the next step in the WAPS is activated. Classification of SPS according to their con trol variables may be subdivided into two categories: 1. response-based WAPS and 2. event-based WAPS.

11.4. 1.7 Response-based vs. event based WAPS Response based WAPS use electric variables (voltage, frequency etc) and initiate non- continuous stabilizing actions after the disturbance has caused the measu red variables to significantly degrade. The objective is to correct the deterioration of these variables l:;>y an action, which is generally local. Two examples of this type of WAPS are under-frequency load shedding and under voltage load shedding. This type of WAPS could be used if the robustness of the system is suf ficient to allow these WAPS to ad before the system is unstable (therefore mainly for "slow phenomena"). The variables used are selective according to events

of different severity and different type. For this class whose misoperation or failure to operate would of WAPS, the effect of unintended operation is genehave a significant adverse impact outside of the rally limited because its actions are restricted and local area. The corrective action taken by the WAPS localized. This type of WAPS is simple and secure. Its along with the actions taken by other protection reliability depends extensively on the selectivity of the systems are intended to return power system chosen variables and their behavior. parameters to a stable and recoverable state.

233

E v e n t

based WAPS are designed for operation only • Type II: An WAPS which recognizes or anticipates upon the recognition of a particular combination. of abnormal system conditions resulting from extreme events and are thus based on the direct detection of me contingencies or other extreme causes, and the event (e.g: the loss of several lines in a station). whose misoperation or failure to operate would have a significant adverse impact outside of the Pre-planned actions could be local or local area. In the application of these systems, their remote. This type of WAPS is generally used for events whose security is the prime concern. severity largely exceeds the robustness of the system or when the speed of phenomena concerned is too • Type Ill: An WAPS whose misoperation or failure high to allow the use of a response based WAPS. to operate results in no significant adverse impact These WAPS are rule-based, with rules developed outside the local area. It should be recognized that from off line simulations. They are generally high a Type Ill WAPS may, due to system changes, speed because their actions must be carried out become Type I or Type II. before the behavior of the system is not too degraded and instability of the system cannot be avoided. Design and operating criteria contingencies are They may be very effective since rapid control action contingencies the system is designed to withstand, may quench electromechanical dynamics before they for example a three phase fault with loss of a line. become stability threatening. Extreme contingencies are more serious but less common than design criteria contingencies, for example The reliability of "event-based" WAPS is the loss of all the lines in a corridor. One or more of often considered a concern, but good design and adequate the following conditions arising from a fault or distur- levels of redundancy can ensure high reliability. The bance shall be deemed to have a significant adverse relative effect of a failure to operate versus unintendimpact: ed operation must be weighed carefully in selecting design parameters. Examples of event-based WAPS System instability

•

are generation rejection and/or remote load sheddynamic t"esponse; ding instigated by the tripping of a transmission line.

• Unacceptable system •

Equipment tripping e

11.4.2

Classification

of

WAPS

Voltage levels in violation of applicable

according

emergency limits

to its impact on the power system • Loading on transmission facilities in vio- WAPS can also be classified according to the severity lation of applicable emergency limits and

• of the contingency and its impact on the system. This Unacceptable loss off load. kind of classification makes it possible to consider the various WAPS installed in a system according to their relative importance and to require different perfor11.4.3 Classification of

WAPS according

mance levels for their dependability, security and

operating time maintenance criteria. WAPS may be sub-divided into

to its

['•

three types:

234

Figure 11-3 illustrates the approximate time frame associated with each WAPS listed • Type 1: An WAPS which recognizes or anticipates and shows the relationship between the duration of major power sysabnormal system conditions resulting from tern phenomena and the time frame of WAPS actions design and operating criteria contingencies, and

· most likely used to limit their consequences. The time scale is logarithmic, full line represents the typical ope rating range for each WAPS while the doted part indi cates the overall potential operating range.

11.5 Detailed description of the various WAPS actions

Also indicated in Figure 11-3 are the important areas at the extremes of the duration spectra which are not covered in this document, but which deserve men tioning since they represent Important areas of acti vity that could also be classified under the general subject of automatic actions but not under the sub jed of switching WAPS. First extreme is the important area of electro-magnetic switching transients c:mcern ed with overvoltage and automatic measures taken mainly to protect .equipment (protection system, over voltage protection and system separation). The other extreme in the duration spectrum concern manual operation and automatic actions taken to help sys tem operation after power system changes.

There has been a marked increase in the use of WAPS, particularly to withstand design criteria contin gencies, as economics and regulatory problems have led to less robust transmission system. While impro ving system stability, the application of WAPS imposes duties on system and equipment that must be based on a prudent assessment of the benefits and costs. This Section presents short descriptions of the various WAPS actions available to improve system stability and reliability whilst discussing potential problems or harmful effects on the power system. The intention is to provide a starting point for detailed investigation of a particular WAPS and to help designers of a new WAPS to select the most suitable type of WAPS to counter a specific phenomena.

Electromagnetic switching transients

Transient stability (angle & voltage) Small signal stability

Power system operation Long term stability

Long terni voltage stability

11.5

235

Figure 11-3 WAPS time frame related to power system phenomena

11.5.2

A large variety of WAPS are now in service, but most are based on one or more of the following actions: • • • •

Generation rejection Turbine fast valving/generator runback Gas turbine/pumping storage start-up Actions on the AGC such as set point changes • Under-frequency load shedding (UFLS) • Under-voltage load shedding (UVLS) • Remote load shedding • HVDC fast power change • Automatic shunt switching (shunt reactor/capacitor tripping or closing) • Dynamic braking or braking resistor • Tap changers blocking and set points adjustment • Quick increase of voltage generator set point

The majority of actions described above can be initiat ed by a local detection system or by a wide area detection system. Detection is considered local when all the information required by the decision-making process is available at the same location where the realization of the action is performed. Generally ,,ocal WAPS" are considered the most dependable type of WAPS because they do not rely on telecommunica tions facilities for their operations and are also consi dered the most secure because their actions are generally limited and localized. Under-frequency load shedding is probably the best known of this type of WAPS. Local WAPS are often distributed throughout a region of the network and together fulfil the desired level of action (for example: under-frequency load shedding). High dependability is achieved by diversi fication; failure of one local \fi/APS in a distributed sys tem will not detrimentally affect the operation of the other WAPS.

236

In a wide area detection system, the action is initiated by information acquired at one or more key buses

located elsewhere in the power system. This type of WAPS is generally used to counter complex and large phenomena that may cause danger to the integrity of the whole power system. They are consequently of a higher level of complexity than the local WAPS and strongly depend on telecommunication facilities. De pendability is the principal concern whereas the im pact of unintended operation is generally significant.

11.5.1 Generation rejection Generation rejection is one of the most widely used types of WAPS. Generation rejection schemes involve tripping of one or more generating units and most of them are event-based (based on event direct detec tion such as a line trip). The practice of generator trip ping is used on all kind of units but especially on hydro-generator units. This is because they are quite rugged as compared to thermal units and the risk of damage to the unit from a sudden trip is less. Generation rejection improves transient stability by reducing the accelerating torque on the machines that remain in service after a disturbance. The con cept behind the generation rejection is to increase the electrical power output of the remaining generators and thus to reduce their rotor acceleration. Efficiency depends on the location of generator participating to primary frequency controls. Generation rejection can also be used to reduce power transfers on certain parts of a transmission system and thus solve over load or voltage stability problems. For example, in a remote generating area with a limited number of transmission lines, generation rejection may be used after the loss of critical line to reduce the overload of the remaining lines. Normally the power shortage in the load area is reduced to zero by bringing the spin ning reserve on-line and increasing its output power to that provided previously by rejected units. The main negative aspect of generation rejection is that it subjects the rejected unit to sudden changes in electrical and mechanical loading, which may result in over-speed, thermal stresses and a reduction in the shaft life due to shock initiated fatigue.

11.5.2 Turbine fast valving Turbine fast valving is applicable to thermal units and involves closing and reopening of steam valves, in order to reduce the accelerating power of generators

11.5.3 Fast unit and pumping storage unit start-up

that remain connected to the network after a severe transmission fault. It is an alternative to generation rejection when a slower reduction in generator out put is acceptable. Generation rejection is usually used on hydro units and fast valving on steam turbines. The advantage of fast valving is that the unit remains synchronised, and for temporary fast valving, it reco vers its pre-disturbance power level. Fast valving can not be used on hydro turbines due to the water Inertia. Fast valving assists in maintaining system stability fol lowing a severe fault by reducing the turbine mecha nical power. Fast valving has been found to be an effective and economical method to address mainly transient stability. For maximum gains with fast val ving when transient stability is involved, the turbin driving power should be reduced as rapidly as possi ble. Momentary or sustained fast valving could be used. Momentary fast valving is the rapid closure of inter cept valves only and immediate full eopening at a slower rate. Since the unit is restored to full load, this method is an aid to stability when strong post-con tingency transmission system is available. Sustained fast valving is the rapid closure of main and intercept valves, an immediate partial reopening finally fol lowed by full reopening at a predetermined rate with in minutes after the disturbance. Since the unit is not immediately restored to full load, the postcontingen cy transmission system need not to be as strong as for momentary fast valving and additional stability margins can be provided. Potential problems resulting from turbine fast valving are that a slow power reduction to a pre-defined level may lead to transients on the turbine. Use of fast valving has been limited mainly because of the co ordination required between characteristics of the power system, the turbine and its controls and the energy supply system (boiler). There are several potential problems that must be considered in the application of fast-valving.

Power support by fast unit\e.g. gas turbine) or pump storage start-up could be used when frequency is low or the risk of voltage collapse caused by inade quate generation is high. The latter may rf,'sult from the tripping of important tie-lines that interconnect regions of high generation to regions of high demand. WAPS that initiate gas turbine or pump sto rage start-up are very efficient in recovering from these stressed situations. The gas turbine start-up process takes several minutes or tens of minutes and consequently provides a solution to long term critical situations. (In long term voltage stability, tap changers blocking could be used to give enough time to start the gas turbine.)

11.5.5

11.5.4 AGC set-point changes For satisfactory operation of a power system, the fre quency should remain nearly constant. The main ob jectives of automatic generation control (AGC) are to regulate frequency to the specified value e.g. 60 Hz) and to maintain the interchange power between the area at their scheduled values. AGC perform its tasks through control of the load reference setpoints of a selected group of generator units in the power system. In interconnected power systems under normal con ditions, actions of AGC is confined to its individual area to held system frequency constant and to main tain interarea power transfers at their scheduled levels. Due to the lack of generation in a certain area caused by a combination of line trips, set-point chan ges an AGC could be used to correct for the genera tion/load mismatch. In such a situation, other areas may assist the affected area by allowing system fre quency to depart from its pre-disturbance value or by permitting the inter-area power transfer to deviate from scheduled values.

11.5.5 Under-frequency load shedding 11.5.5.1 Description and main characteristics The most common type of WAPS is an under

frequency load shedding (UFLS) scheme. Schemes

237

7 7.5.5.2 Improvement of system stability

11.5.5.2

of this type are used to preserve the security of both the generation and the transmission system during disturbances that initiate a major reduction in system frequency. Such schemes are essential, if a utility is to minimise the risk of total system collapse, maximize the reliability of the overall network and protect system equipment against damages. In the event of a loss of generation or the loss of a tie-line used to import power, UFLS schemes are employed to reduce the connected load to a level that can be safely supplied by available generation. Load shedding is initiated by under-frequency relays designed to trip blocks of load when the frequency drops below discrete frequency thresholds and/or the rate of change of frequency exceeds preset df/dt values. Load shedding is generally done in several steps to prevent excessive load dropping and to allow the frequency to recover before the next step. The settings for load shedding relays and their appli cation philosophy are mainly based on turbinegene rator under-frequency operation limitations and power plant auxiliary performance. Turbine genera tors must be disconnected from the system if the fre quency drops below 55 to 575 HZ (60 Hz system), the exact value depends on the type of turbine. Main objectives of UFLS :;chemes include: • Protecting the generating equipment and transmission facilities against damage. • Achieving a near equilibrium betvveen generation and load following loss of generation. • Providing for equitable load shedding among utility serving load. • Minimizing the risk of total system collapse in the event of system separation or generation loss. • Permitting rapid load restoration and re-establishment of interconnections.

The UFLS enables the frequency to recover to a nor mallevel and makes it possible to maintain the net work integrity. Because generating units can operate continuously within ± 0.5 Hz from normal frequency, it is desirable that the UFLS restores the frequency fol lowing a disturbance to a value within this range. This minimises the potential for turbine loss of life. The main requirements for a UFLS scheme are: • they should coordinate with underfrequency protection of generating unit; • they should minimize the risk of further separation, loss of generation, or excessive load shedding accompanied by excessive over frequency conditions and • they should arrest frequency decline and leave the system in such condition as to permit rapid load restoration and re-establishment of inter connections. On large interconnected systems, close coordination of different UFLS schemes are necessary because an interconnected grid is generally closely meshed and a sudden and severe power imbalance will not be restricted to utility borders. To comply with all possi ble situations and perturbations, the UFLS plan must satisfy the following basic requirements: • The load shedding plan should be adequately coordinated throughout the interconnected members to prevent unbalanced load shedding, which may cause high transmission loading and extreme voltage deviation. • A uniform off-nominal frequency plan should be adopted throughout the interconnected system, sharing the risk among the partners and providing for equitable load shedding among utilities serving load. • The operating time of the different load shedding devices should be uniform, otherwise only the fastest ones would operate (this means that no intentional time delay must be added) The load shall be divided into small amounts and the maximum amounts reachable should be about 40 % to 50 % of the total demand.

238 11.5.5.3 Potential problems or harmful impact on equipment system Special attention must be paid to establishing the amount of load that can be disconnected by UFLS. If, following a UFLS action, the system or areas of the s tstem have a power surplus (caused by over-shed ding), the system frequency will increase to an over frequency condition and generating units may be dis

connected by over-speed protection. Methods of limiting over-frequency frequency include highspeed automatic load. restoration, braking resistors and fast HVDC power change. Due to the tripping of generators and the operation of UFLS, large voltage variations often come with large frequency deviations. When loads are shed sud denly during an under-frequency

event, shunt capaci tors that remain in service may

cause serious over voltages. The same situation may also happen on long UHV transmission lines because of the high levels of charging current. Because of this, shunt capacitors on the subtransmission system should ei ther have automatic over-voltage protection or be tripped by underfrequency relays. If the over-volta ges are severe enough, they should be tripped as an integral part of the UFLS scheme. When available, shunt reactors on EHV transmission system could also be switchedin by over-voltage relays used to control these overvoltages.

11.5.6 Under-voltage load shedding Power systems with heavy loading on transmission facilities an united reactive power control can be vul nerable to voltage instability. In some unplanned or extreme situations, when all others solutions have fai led, load shedding when voltage collapse is imminent may preserve the system stability. Undervoltage load shedding (UVLS) is analogous to under-frequency load shedding and provides a lowcost mean of pre venting system collapse. An UVLS scheme uses under-voltage relays to moni tor the voltage level in a substation. Normally, an under-voltage relay will operate and trip a feeder cir cuit breaker when the input level reduces below a

seconds. It is expected that after the shedding, the voltage will recover to an acceptable value. Developing appropriate settings for the UVLS is a challenging problem. Load shedding is often initiated in steps to avoid over shedding and the selection of appropriate time step is an important factor in effec tive under-voltage load shedding.

11.5.6

UVLS plans should be examined to determine if acceptable over-frequency, overvoltage, or transmis sion overloads might result and all potential unaccept able conditions should be mitigated. For example, if over-frequency is likely, the amount of load shed could be reduced or automatic over-frequency load restoration could be provided. On the other hand for over-voltages, the load shedding program could be modified (e.g., change the geographic distribution) or mitigation measures (e.g. coordinated tripping of shunt capacitors or reactors) could be implemented to minimize that probability. If transmission capacities are exceeded, the relay settings (e.g. location, trip, or time delay) could then be altered or other actions be taken to maintain transmission loading within the capabilities. Coordination with other systems is also a primary concern to assure selectivity in power system opera tion. It is imperative that under-voltage load shedding plans are coordinated with: • Generation control and protection systems. • Under-frequency load shedding programs and manual load shedding programs • Load programs.

restoration

• Transmission protection and control programs (e.g., timing of line reclosing, tap changing, over excitation limiting, capacitor bank switching, and other automatic switching schemes). • Other system protection and control devices used to interrupt electric supply to customers (coordi nation between the time delay of UVLS relays, the time settings of consumers minimum voltage relays, and the break - time of automatic reclosing of the feeders provided witf:dJIJLS). Finally, the characteristics and locations of the loads to be shed are more important for voltage problems than they are for frequency problems and a careful pre-set threshold for a time of greater than a few

11.5.9

choice of the type of load to be shed must be made.

239

11.5.7 Remote load shedding

240

Remote load shedding is similar in concept to gene ration rejection but at the receiving end of the power system. Remote load shedding is a dormant system design to operate after extreme contingencies affec ting the system's transmission capacity (e.g. loss of several transmission lines), whose severity largely exceeds the robustness of the power system. This kind of extreme contingencies endanger transient, dynamic or short term voltage stability. In these cases, rapid and massive actions based on the direct detec tion of the extreme contingency are required. Remote load shedding is one of the means that could be used to maintain power system stability in that situa tion. The components of a remote load shedding system can be categorized as follows: • Inputs: mainly direct detection of the disturbance • A central co-ordinating system: usually

required to decide the proper action (quantity and localisation offload to shed) • Output: feeders tripping

Remote load shedding involve direct tripping of low priority industrial/commercial load or residential load. Remote load shedding can employ the same load shedding relays used to perform underfrequency load shedding. These relays could have a dual func tion, allowing both the direct execution of remote load shedding orders and the execution of load shedding as a function of local frequency conditions.

11.5.8 HVDC fast power change HVDC transmission link is a highly controllable device and it is possible to take advantage of this unique characteristic to improve transient stability of the AC system. Power flow on HVDC links can be modulated by controlling the converters. HVDC modulation can provide powerful stabilization with active and reactive power injection at each converter.

these oscillations are not attenuated, system instabil ity could occur. The DC power can be controlled to improve transient stability by rapid discrete power level changes or to improve damping by use of con tinuous proportional control. The DC power can be either ramped down or ramped up (taking advanta ge of short-term overload capability) to assist power system stability. 'The beneficial effect of DC modula tion on the AC system is similar to the effect of gene ration rejection or load shedding. HVDC controls modulation may be used to: • regulate reactive power, • support dynamic AC voltage, • damp frequency oscillations and • improve transient stability. The controllability of HVDC links is often cited as an important advantage of DC systems. This controllabi lity can be valuable in improving dynamics perfor mance of AC system but only if DC control systems perform adequately for various disturbances and system conditions. These controls, which could be quite powerful must not interact unfavourably with other high performance controls and systems. HVDC control robustness is therefore a major concern. When the DC line is the major connection between two AC systems, the rapid modulation of the DC link could be effective in attenuating transient disturban ces. A problem with this control method is that a disturbance in one AC system will be shared by both AC systems. That is, a disturbance on one system will appear as a sudden load change on the other system. Unless there is some mutual benefit, the un faulted system may not care to share the disturban ce of the other system. Rapid modulation would also require reactive power compensation capability on the AC system near each converter to maintain pro per voltage during the DC power flow modulation.

During a transient disturbance such as a fault on an interconnected power system, generator rotors swing to new angle in response to accelerating power. If can be installed at the HV busbar in a substation, or at the tertiary winding of a transformer in an EHV/HV substation. Depending on the measured voltage level they can be tripped or reconnected. Capacitor banks are installed in many substations to improve the power factor of the consumers load or for feeder vol tage control. They are automatically switched in accordance with the busbar voltage level. This is nor mally achieved using a minimum voltage relay. Shunt reactors on the HV busbar in a power plant improve the transient stability of the generating

11.5.9 Automatic shunt switching (shunt reactor/capacitor tripping or dosing) WAPS are widely used to control the voltage levels in a substation. This is achieved by automatic switching of shunt reactors and capacitor banks. Shunt reactors

units. They ad like reactive power consumers and determi ne which generating units need to produce more reactive power. This results in a more favorable tran sient stability condition during a short-circuit fault Switching out shunt reactors following a severe con tingency also greatly improves transient stability. Two basic performed:

functions

could

be

• Over-voltages control: The closing of shunt

reactors (or the tripping of shunt capacitors) could be used to deal with overvoltages

create d by event s that cause a major reduct ion in the powe r previo

usly flowing on the power system (e.g. generation and/or load losses). • Under-voltages control: The tripping of shunt

reactors could be used to deal with under-voltage created by events that mainly affect the system's transmission capacity (e.g. multiple loss of lines).

11.5.10 Braking resistor Dynamic braking is the concept of applying an artifi cial electric load to a portion of the power system. It

has been generally studied and applied as a switch ing in of shunt resistors. This is normally for a fixed insertion time and occurs immediately after a fault has been cleared on the system. The components of an WAPS used for dynamic braking can be catego rized as: • a resistor,

11.5.10

shunt

• a switching equipment and • a system.

control

The control system is generally referred to as the ':Accelerating Power Level Detector" (APLD). A typical control system is shown in the Figure 11-4. A signal representing the total electrical output power of those machines, whose accelerating power is to be monitored, is fed into the control system. For a short duration, and only for sharp changes in electrical power, the difference between the second and the first blocks approximates to accelerating power. The accelerating power signal is further passed through a second order low pass filter to form the APLD output. This output is compared with an accelerating power threshold set-point, and if it exceeds the (positive) threshold, the braking resistor would be energised after a short delay. The braking resistor would only be energised for a sudden reduction in the electrical power input. The Figure 11-4 shows a typical control system with typical parameters.

0.5 < Tc < 5

..

_L_

l+sT,

..

,

_L_

l+sTc

APLD lag Figure 7 7-4 Accelerating power level detector (ADLP)

ro

-

s2

..+ a.roOs + ro0 0

2

2

..

+

241

:_·,,

1 ..

11.5.11

During system fault conditions, the machine output power drops as a result of the depressed system vol tages. The machines in the vicinity of the fault accele rate during this time. During the fault and also after the removal of the fault, the speed gain continues to increase the angle differences between these and more remote machines, which may lead to loss of synchronism. The drop in machine output power may trigger the energisation of the braking resistor. The increased power demand from the braking resistor now opposes the speed increase acquired during the fault incident and reduces the machine angle diffe rences. This generally improves stability for faults in the vicinity of the braking resistor. A sensitive trigger setting may lead to the energisa tion of the braking resistor for more remote faults. This may reduce the stability of the system. During a fault machines electrically close to the fault tend to accelerate more than the machines remote from the fault. Simultaneously the energisation of braking resi stors tends to retard the acceleration of the machines close to the fault more than those machines that are remote from the braking resistor. Consequently, if a braking resistor is energized for a remote fault, it tends to increase the angle difference between the machines close to the fault and the machines close to the braking resistor. This increases the likel"1hood of instability. The sudden shocks from the switching in braking resistors on the turbine can result in high levels of shaft torque. Studies must be carried out to ensure there are no adverse effects on the shaft fatigue-life resulting from the combined effect of a fault, its clear ance, the switching in, or out of the braking resistor and the possibility of unsuccessful auto-reclosure.

11.5.11 Controlled opening of interconnection

242

Controlled system separation generally represents the last measure toward saving the power system

Tripping tie-lines is not without risk. If the inter connection is supporting the individual system, then tripping the tie-lines will almost certainly mean total collapse for that individual system. If the individual system is supporting the interconnection, then trip ping the tie-lines will put the interconnection at great er risk. Unless sophisticated relaying is implemented, there is no way for an individual relay to discriminate between the two conditions. However, the ultimate decision rests with the individual system. From an overall system perspective the preferred option is to not trip interconnection lines.

following a major disturbance involving loss of gene ration or imminent instability between areas. Con- · trolled system separation is applied when specific load and generating areas can be defined within a large interconnected system. The instability between areas is usually characterized by sudden change in tie-line power. The instability is detected by monito ring one or more of the following quantities: • sudden change in power flow through specific tie-lines, • rate of power change, • change of bus voltage angle. As interconnected systems grow, it becomes more difficult to define system separation points that will be applicable for all possible system emergencies. Controlled separation as a planned method to achie ve power system stability is not widely applied main ly because it is difficult to define points of separation that will be acceptable for all system conditions. Controlled system separation is mainly used in power system where load and generation are reasonably matched and transmission tielines to external power system are easily definable. The opening of inter-area transmission interconnec tions shall only be initiated after the coordinated load shedding program has failed to arrest frequency dec line and intolerable system conditions exist. When an operating emergency occurs, a prime con sideration shall be to maintain parallel operation throughout the interconnected power system. This will permit rendering maximum assistance to the power system(s) in trouble. Because the facilities of each power system may be vital to the-secure ope ration of the interconnected system, every effort shall be made to remain connected to it. However, if a power system determines that it is endangered by remaining interconnected, it rnay take such action as it deems necessary to protect its own system.

When machines of two areas are electrically separat ed, pole slip protection should split the systEm at a location designed to improve the generation, - load balance in each of the two isolated systems. Pole slip protection operates significantly slower than distance protection and consequently, distance relays may operate and prevent the pole slip relay from tripping at the desired location. Effective pole slip protection depends on the success of power swing blocking elements in conventional distance relays. Most pole slip protection relays have a lens characteristic and the time taken for the impedance vector to pass through the lens is the criterion used to decide if a pole slip condition as

occurred. To initiate a trip, the impedanc e locus can enter the lens from the left or the right, but must

traverse completely through to the opposite side of the lens.

11.5.1 2 Tap changers biocking and setpoints adjustment The main goal of on-load tap-changers (OLTC) ope rating on power transformers is to supply the con trolled side of the transformer (normally the lower voltage) - with a voltage level within a given range, according to the dead-band and the set-point value. Typically as load increases the OLTC will ad to raise the tap position in order to maintain the voltage level. The time delay between steps varies between 1 0 se conds and 4 minutes. This ensures that following a minor disturbance the load voltage is restored to an acceptable value within a few minutes. Following a severe disturbance, the voltages will be

substations. The OLTCs applied to transformers at dif ferent voltage levels all operate on local criteria and all independently start the tap changing process de signed to re-establish the controlled voltage. If the voltage reductions start to progress towards a volta ge collapse the bulk system voltages will slowly de crease whilst the OLTCs are trying to restore distribu tion system voltages. The transmission system will be further stressed until a new steady state is achieved or voltage collapse has occurred. Depending on the number of levels of cascaded tapchangers, and their settings, this process may take from a few to tens of minutes.

11.5.12

During a period of voltage collapse the OLTC will detect a low voltage and after an appropriate time delay raise the tap position of the transformer. Assuming no change in the load demand on the transformer during this period, the load can often be considered as constant power as long as the tap changer can maintain a constant load voltage. If the primary voltage level drops, the current flow in the transmission system is increased to maintain the load power. This increase in current flow will further redu ce the transmission system voltage making a voltage collapse more likely to appear. It is common, at least in Europe, to have controlled OLTCs on both EHV/HV transformers (connecting transmission and subtransmission networks) and HV/ MV transformers (connecting subtransmission to dis tribution levels). Sweden has even up to four levels of OLTCs in cascade. The delays in tapping are usually set to shorter values as one goes higher in voltage. Tap-changer blocking or set-point adjustment can be beneficial to preserve system stability in stressed situations that are close to voltage instability. The effect depends on the load characteristics and the degree of shunt compensation. It is also necessary to control the tapchanger that is closest electrically to the customer. Generally, just lowering the voltage at

reduced over a regional area that may affect many

the sub-transmission or medium voltage level, will

11.5.12.2

244

243

make the situation worse, since the tapchanger nea rest the consumer will try to reestablish the load vol tage. This means that the reactive power losses will increase in the distribution system at the same time as the reactive power generation from shunt devices will decrease. In some cases, tapchangers can have a beneficial effect. Consider for instance a case where a transfor mer is supplying predominantly motor load with power factor correction capacitors. The OLTC keeps the

...

supply voltage high and hence does not affect the real power consumption (which is relatively inde pendent of voltage). This also maximizes the reactive support from the power factor correction capacitors.

7 7.5. 7 2. 7 Improvement of system stability Normally, where the real power loads have some vol tage dependency, appropriate control actions can be used with the OLTC to reduce the severity of the vol tage collapse. Blocking operation of the OLTC has been widely offered as a method to reduce the negative effect on the system. Load voltage reduction can also be used to reduce the loading on the sys tem. This is similar to peak shaving systems based on voltage reduction, widely used at many utilities. There fore the on-load tap-changer may be both a cause and a partial solution to the problems of· voltage collapse. The simplest method to eliminate the OLTC as a con tributor to voltage collapse is to block the automatic raise operation during any period when voltage collapse appears to be a concern. The decision to temporarily block the tap-changer can be made using locally derived information or can be made at a cen tral location and the supervisory system can send a blocking signal to the unit. This action may result in a period of low voltage on the affected loads. The effect of reduced supply voltages in the whole servi ce area must be weighted against the possible alter native of complete disconnection of some customers in a smaller area. Tap-changer blocking will be more effective for voltage decays slower than the transient time frame. It will also be more effective on loads that have a relatively high voltage dependency.

Local blocking schemes are implemented using vol tage relays and a time delay to sense the voltage level on the high voltage bus at the substation. The threshold voltage is usually chosen to be a level that is less than that which occurs during maximum acceptable overload conditions. Blocking is initiated if the abnormal undervoltage condition exists longer than a predetermined time. The time period may vary from one to several seconds. The OLTC is unblocked when the voltage has recovered to an acceptable level for a predetermined period of time, typically 5 seconds. Since the blocking action will be removed if the voltage recovers, usually a single phase-phase voltage measurement is adequate for this scheme. A coordinated blocking scheme can be utilized to block operation of OLTCs in an area where voltage instability is imminent. The coordinated scheme can be accomplished with undervoltage schemes acting independently (as described above) in a coordinated fashion at various stations within a region, or it can be a centralized scheme that recognizes a pattern of low voltages at key locations. In a centralized scheme, the OLTC blocking can be implemented in substations throughout the affected region, even if the voltage at all locations is not yet below a specific threshold. The key to operation of a centralized system is the reliability of the communication system. The data needed for decision making must be collected at the central location for analysis. Control decisions must then be sent to each affected transformer location.

7 7.5. 7 2.2 Reduction of set-point of OLTC As already mentioned, a m;re advantageous use of OLTCs than just blocking them consists of decreasing their voltage set-points. A larger load relief can be achieved. in this way. As for the blocking of OLTCs the effectiveness is largely dependant on the characte ristics of the power system, such as the type of load, the degree of shunt compensation and the number of OLTCs on lower levels.

--

An interesting strategy for controlling OLTCs is as follows: • In a secure state, all OLTCs are controlled as usual. The HV voltage set-points are chosen to minimize real losses in the subtransmission networks. • In emergency conditions, EHV/HV and HV/MV OLTCs are blocked, keeping the minimum possible transformer ratio for EHV/HV transformers.

• In an alert state, where credible contingencies would lead to voltage instability, the MV voltage setpoints of HV/MV OLTCs are decreased while EHV/HV OLTC set-points are increased. The objective is to reduce reactive losses and get more reactive support from shunt elements :n the sub-transmission networks.

11.5.1 3 Q u i c k

increase of synchronous condenser voltage set-point Synchronous condensers can generate or absorb reactive power depending on the control of their ex citation system and are an excellent form of voltage and reactive power control devices. The reactive power production of synchronous condenser is not affected by the system voltage and voltage regulator (AVR) can automatically adjust this reactive power to maintain constant terminal voltage. While AVR is con trolling the terminal voltage, the reactive power out put can be increased until heating limit is reached. The action of the AVR is instantaneous and quite effi cient in case of voltage collapse, if the synchronous condenser is located near the load demand. Following a severe event that is leading to voltage decline, the synchronous condenser AVR performs a fast corrective action. In order to optimize the effi ciency of the synchronous condenser to counteract voltage instability, automatic increase of its voltage set-point could be used as supplementary action. The voltage set-point is increased according to a steep ramp until the synchronous condenser reactive power reaches some percentages of the compensa tor capability or after some maximum time (e.g. 30 s). This WAPS differs from secondary voltage control because it is faster as needed to counteract voltage instability following the loss of several transmission lines and could thus be considered as primary vol

11.6 Voltage stability assessment guidelines

11.5

Recognizing that voltage stability is a serious concern, which must be examined during planning and ope rational studies, there is a requirement to develop practical study procedures, security margins, and cri teria. The traditional approach to planning for voltage security relied on ensuring that pre-contingency and post-contingency voltage levels were acceptable for the system states under study. As a result, utilities have developed suitable voltage criteria which specify acceptable voltage limits. These criteria are largely based on equipment tolerances and although they ensure safe voltages, they generally provide no assu rance that sufficient voltage stability margin exists. Put it simply, a system may have very healthy pre-contin gency and post-contingency voltage levels, but be dangerously close to voltage instability. The relatively recent concerns for voltage stability have motivated the development of some study gui delines The methods adopted will depend largely on the utilities' experience, policies, and regulatory requi rements. For example, if studies show that voltage instability may occur when reactive reserves on spe cific generators reach certain values, the utility may use such measures as direct indicators of voltage security. The success of any such method depends on an unders'"wnding of the mechanism of, and proximity to, voltage instability for the particular system under a wide variety of possible conditions. This chapter pro vides some generalized guidelines for developing and applying security assessment methods.

11.6.1 Off-line studies and on-line studies Voltage Stability (VS) margin is a measure or how close the system is to voltage instability. The approa ches needed to assess margin will differ slightly be tween offline studies (such as operation planning) and on-line studies (such as application of on-line vol tage stability assessment tools in the EMS environ tage control systems.

245

ment).

11.6.2

246

In the off-line environm ent, such as operation plan ning, it is necessary to determine the margin for all design contingen cies (such as single element outa ges, double outages of lines on the same tower lost by LLG faults, or double elements lost through brea ker failure) for system conditions with all elements in service and for condition s with one or

more elements out-of-service. Studying conditions with one element out-of-service is necessary to provide margin for the uncertainty of operating conditions. Because of main tenance and forced-outages, the actual system is rarely in state with all elements in-service. Often, for study purposes, each out-of-service element is com bined with each design contingency, to form a set of double contingencies, which may include unrelated elements such as loss of a line plus a generator. Care must be taken in this case to account for the pre-con tingency system readjustment which would normal ly occur for creating a new base case with one ele ment out-of service. For on-line studies, the system state and topology is known (or at least approximately known) through system measurements and state estimation. There fore, it is necessary to study only the criteria contin gencies for all elements in service. As a result, fewer scenarios need to be examined and, less margin may be required than for offline studies, in which the system uncertainty is greater. Off-line VS study tools have matured over recent years (Figure 11-5) and now on-line analysis tools are being developed to compute VS margins, verify that criteria is met, and suggest remedial actions neces sary to meet the criteria. One important aspect of practical VS assessment is the consistency between on-line and offline assessment methods. While the two approaches may examine different scenarios and require different margins, the basic procedures, and models used should be consistent. This is essen tial to ensure that the results obtained from off-line studies can be compared to on-line results. For example:

• For procedures: The use of PV, QV. or time domain simulations, should be consistent in on-line and off-line studies. The definition of how margin is measured should be also equivalent.

• For Models: The representation of loads, gene rator capabilities, field current limiters, switched shunts, ULTC should be equivalent in on-line and off-line studies. In the absence of on-line analysis capability, the off line study results must be translated into operating limits and indices that can be monitored by the ope rators. The next section describes some technical gui delines for VS assessment, which can be applied for either off-line or online studies. The present industry practice is to use deterministic methods for stability assessment. With today's analytical methods and computer hardware, it is possible to assess a wide range of conditions and contingencies in reasonable computation times. However, probabilistic assessment methods and criteria may become necessary as inter connected models grow, controls become more complex (including remedial action schemes), and deregulation increases the volume and uncertainty of energy transactions.

11.6.2 Voltage stability margins and criteria In general, VS margins are defined as the difference between the value of a Key System Parameter (KSP) at the current operating condition and at the voltage stability critical point. Different utilities may use diffe rent KSPs from two main categories: • PV-based KSPs, such as an area load or power transfer across an interface • QV-based KSPs, such as reactive power injection at a bus or group of buses Voltage stability criterion defines how much margin is deemed sufficient for voltage security of the system. It can be stated as "the system must be operated such that for the operating point and under all cre dible contingencies, the VS margin remains larger than x% (or y MWIMVAr) of the KSP':

For example, when the KSP is defined as the area load, and the criterion is defined as 7% of this KSP,

v Pre-Contingency

Post-Contingency

the system must remain voltage stable under all con tingencies when the area load is increased by 7 % above the given operating level. In addition to the criterion for VS margin, utilities may establish other operating criteria for voltage security, including: • Voltage decline/rise criteria, which specify thet bus voltages must remain within + x% and - y% of the nominal (or pre-contingency) values under all contingencies. • Reactive reseNe criteria, which specify that the reactive power reseNe of individual or groups of VAr sources (generators and controllable shunts) must remain above x% of their reactive power output (or y MVAr) under all contingencies. The combination of the above criteria define the ope rating limits, or, in other words, voltage secure opera ting range of the system. As with any criterion, the VS criteria must be selected to provide adequate security without unduly restric ting system operation. It is common to select different sets of criteria for different categories of contingen cies. For example. the system may be required to have 7% load increase margin under single contin gencies and only 3 % load increase margin under double contingencies. The criteria appropriate for a given system can only be determined after extensive analysis of the system in order to establish the KSPs and the sensitivities of the system stability to changes in KSP values.

11.6.3 Voltage stability assessment

7 7.63.7 PV-based margin computation With the KSP being defined as the system load, the process of calculating VS margins for the base case and the contingency cases is as follows (the same process applies to VS margin calculation with other KSPs):

11.6.3. 2

Post-Contingency Margin Pre-Contingency Margin

p

Figure 7 7-5 PV curves and VS margins

1. Calculate VS margin for the base case using Static Analysis. For PV CuNe computation, the system load is increased step by step and at each step (load level) the power flow is solved. The voltage stability critical point is reached at the load level beyond which power flow solution does not exist. The increase in the system load from the initial operating point (P0 ) to the voltage stability critical point (nose of the PV cuNe Pm) is the VS margin for the base case (see Figure 10-3). At each load level, a generation dispatch scheme is used to supply the increased demand for active power and power flow solution is obtained with loads modelled as constant MVA and control of ULTCs and switchable shunts enabled. 2. Calculate VS margins for all the contingency cases using Static Analysis. At each load level, after solving the power flow for the base case, the contingencies are applied one by one and the power flows are solved. The last load level where the post-contingency power flow solution exists (Pem) is the post-contingency critical point and the increase in the pre-contingency system load from the initial operating point to this point is the VS margin for that contingency (see Figure 11-5). Post-contingency cases are solved with loads modelled as voltage dependent. Depending on the time frame within which system performance is to be evaluated, and the actual

11.6.3

247

performance is to be evaluated, and the actual system operation policy, a generation dispatch scheme (e.g. governor response, AGC, etc) is used to balance the post-contingency powers and the control of ULTCs, automatically switched shunts and manually switched shunts are enabled or disabled.

248

3. Calculate VS margins for a few selected critical contingency cases using Time Domain Simulation. The

approach is the same as that of step 2 above, except that the voltage stability of the system following a contingency is determined by time-domain simulation over an appropriate time frame (which may range from several seconds to tens of minutes.) Starting with the solved cases corresponding to the different load levels, the system is disturbed by applying the contingency, and the system dynamic res ponse following this contingency is calculated. If the time-domain simulation shows that the system reaches its post-contingency steadystate equilibrium point after a finite time period, the system is post-contingency steady-state equi librium point after a finite time period, the system is stable. If the steady-state equilibrium of the post-contingency system does not exist, time domain simulation will show that the bus voltages continue to decrease and therefore the system is voltage unstable.

more parts of the system. When the KSP is selected as the reactive load at a group of buses, the same procedure determines the "Generalized" QV margin of the system. However, traditionally, the QV margin at a given bus, under pre- or post-contingency conditions, is comput ed by the following procedure: 1. A fictitious synchronous condenser (generator) with unlimited reactive power is placed at the bus to control its voltage. 2. The scheduled voltage of the condenser is varied from Vmax to Vmin in discrete steps. 3. At each point (scheduled voltage) the power flow is solved and the MVAr output of the condenser

I

I

is calculated. 4. The plot of MVAr output versus the scheduled voltage of the condenser is the well-known QV ! .

curve for that bus (see Figure 11-6). The amount of MVAr absorbed (negative of MVAr output) at the minimum point (bottom of the curve) is the MVAr margin at the bus. Q

\

An operating point is voltage secure if • the VS margin of all contingencies meet the margin criterion, • the pre- and post-contingency voltages at that operating point meet the voltage decline/rise criteria, and • the pre- and post-contingency reactive reserve of specified sources at that operating point meet the MVAr reserve criteria.

11.6.3.2 QV-based computation

margin

In the above PV-based approach, the key system parameter defined for margin computation does not have to be limited to area load or interface flow. The KSP can easily be selected as any combination of real and reactive load, as well as generation, in one or

v Figure 17- 6 QV curve

The reasons for popularity procedure are:

of this

a) It is easy to use conventional power flow programs for this procedure. L

b) The power flow solution at each voltage level converges easily because of the fictitious con denser controlling the voltage. Generally, the complete curve is computed, showing the stable and unstable operating regions.

i l

The PV-based approach, with conventional power flow techniques, determines the stable part of the curve. Experience with VSTAB has shown that in this approach, repeated solutions with automatically ad justed step size, can reliably find the critical point (nose of the curve). Although continuation method can be easily applied to compute the unstable part of the PV or QV curve as well, in practice this is not necessary for determining the VS margin. The advantages of PV-based KSPs over QV-based KSPs are the following: a) The PV-based KSPs, such as area load increase or power transfer across an interface, provide the system planners and operators with a direct and physical measure of voltage security of the system and show how much load or interface how an increase can be safely accommodated by the system. b) In the QV approach, the way the system is stressed, i.e. injecting reactive power at one bus alone, is completely artificial and has no relation with the way the system is operated. It provides· only an artificial measure of robustness at a given operating point. Small changes in the operating point can have significant impact on this measure due to the non-linearity of the power system. c) The voltage stability of the system can not be assessed completely by computing QV curves at a limited number of buses. In theory, the QV curve at every bus in the system has to be com puted to give a complete picture of voltage stability margins. On the other hand, one PV curve computation with a global load increase can reveal the general stability margin of the system. Additionally, a model analysis at the nose of PV curve will identify those buses in the system where the voltage instability occurs.

11.6.4 On-line VSA functional requirements

·11.6.4

This section specifies overall functional requirements for on-line oltage tability 6ssessment (VSA). It is developed in a format that may be used as a gene ric starting point by an utility or an independent 'iYS tem Qperator (ISO) to deve!op procurement specifi cations for on-line VSA. It is also helpful as a start ing point for use by the system suppliers to develop detailed design specifications.

7 7.6.4. Introduction

7

The on-line Voltage Stability Assessment (VSA) pack age must determine the voltage security of the system in its given condition. The system is deemed voltage insecure if any credible contingency would cause violation of Voltage Stability (VS) criteria. Different utilities have different VS criteria and diffe rent needs for on-line VSA. In general. the VS criteria may specify the required VS margins in terms of load increase, transfer increase, or other key system para meters, as well as required VAr reserves in different parts (zones) of the system. The list of contingencies to be considered may have to be screened and/or augmented based on opera ting system conditions. If the system is found to become voltage insecure for any credible contingency, preventive or corrective control actions must be sought to improve voltage security of the system. Preventive control actions move the system state to a voltage secure operating point Corrective control actions would maintain vol tage stability of the system in cas.e severe or unfore seen contingencies happen. Even if the system state is voltage secure, it is desi rable to know how far the system state can move away from its operating point and still remain volta ge secure. This is particularly true in the Transmission Open Access environment where computation of

249

i.

11.6.4.4

Available Transmission Capability (ATC) must take into account adequate static, dynamic, and voltage :;tabi lity margins. When needed, control actions, similar to the preventive controls for contingencies, should be found to expand the secure re-gion around the ope rating point. Based on the above requirements, the on-line VSA package must provide the following basic functions: • Contingency selection and screening • Voltage security evaluation • Voltage security enhancement Besides assessment of the voltage security of the present system state, the on-line VSA must assess voltage security of forecasted future states, and any specific state specified by the operator.

11.6.4.2 Contingency selection and screemng It is impractical and unnecessary to analyze in detail the impact of every conceivable contingency. Generally, only a limited number of contingencies might impose immediate threat to voltage stability and these might be quite different from the contin gencies critical for transient :;tability, thermal overload, or voltage decline. It is required, therefore, to define a credible list of contingencies and provide the capabi lity to both augment and screen the contingencies and select those most likely to cause problems, so that they will be assessed in detail.

11.6.4.3 Voltage security evaluation

250

The operators need- to know whether the system operating conditions meet the VS criteria. The VS cri teria may specify how far the system should be from the borderline of voltage instability in terms of load increase, transfer increase, or other forms of stress, when subjected to any of the selected contingencies. There might be other criteria that must be met as

well, such as required MVAr reserves in different parts of the system and limits on post-contingency voltage declines. There are also cases where computation of VS must be carried out in response to postulated conditions (e.g., to determine if a requested transmission service can be accepted). In addition to evaluating the voltage security of the given system's operating point, it is also necessary to know the voltage secure region around this opera ting point. This information is useful when, for exam ple, the system load is increasing or transfers are being increased, and the operator wants to know how much the load or transfer can increase while the system remains voltage secure. This is particularly important for determination and posting of the ATC. These computations involve detailed analysis of all the selected contingencies at several system states. Static analytical techniques (power-flow based) can perform these computations in a majority of cases, but dynamic analytical methods (time-domain simu lation) may be occasionally required.

11.6.4.4 Voltage security enhancement If it is found that the system does not have sufficient voltage stability margin for one or more of the select ed contingencies, actions must be determined to modify the system state in such a way as to create sufficient margin. These preventive control actions will be taken before any contingency happens (pre-con tingency system state). The on-line VSA should provi de different control action alternatives, such as capa citor/reactor switching, generation re-dispatch, etc., and determine the impact of eilch control action on voltage security of the system. In the event of multiple (or severe) contingencies, special corrective control actions may be necessary to prevent voltage instability. These generally affect

Change Monitor

customers (interruption of service or degradation of power quality) and therefore are reserved for use in response to very severe system disturbances. An . example of a control action of this type is coordina ted load shedding. The on-line VSA must be able to determine the best setting (location and minimum amount of required load shedding) for remedial action schemes involving automatic load shedding. The on-line VSA must validate the effectiveness of the control actions. For corrective controls, this may require time-domain simulation of the events and control sequences. For acceptable performance in an on-line application, special time-domain simulation techniques are needed, which are computationally much faster than the conventional methods and still capture the dynamics and timings important to volta ge stability.

7 7 .6.4.5 General requirements The on-line VSA function must operate in conjunction with the EMS environment to monitor the state of the power system periodically, on demand, and upon occurrence of significant changes in the state of power system, in order tp ensure power system security against occurrence of predefined specific or generic contingencies. It should also be available in a study mode. On-line VSA must allow automatic selection of speci fic contingencies from a predefined contingency list, based on actual system conditions. Generic contin gency definitions must also be accommodated; on line DSA should provide the capability to construct relevant contingencies based on the existence of recognizably vulnerable or stressed operating condi tions in the system, and the nature, location, and degree of stress. This means that additional contin gencies should be automatically added to the select ed list of specific contingencies based on system con ditions. Automatic contingency augmentation capa bility should also be provided to account for depen-

·

Contingency Screening

11.6.4.5

Contingency Analysis

)

·--········C: ·-·-·------

Steady-State Analysis ----------- _1

i

- -- ---·

1------

Dynamic Simulation

--- ----- -- -- ----------

------J

Voltage Security Monitor

Operator Console

.....-- 1---'----'------, Security Enhancement

Figure 77-7 On-line VSA Model

dent contingencies (e.g. active arming for load shed ding). The operator should be notified when contin gencies are added or augmented automatically. The operator should have the capability to designate one or more specific contingencies to be selected regard less of the system conditions. The operator should also be able to designate one or more specific con tingencies to be subjected to full processing (i.e. not be subjected to screening). The selected contingencies should be dassified ·into two groups, namely voltage stable (secure) and vol tage unstable (insecure) contingencies. Capability should exist to rank the contingencies according to indices or measures relevant to each of a predefined set of voltage security criteria.

251

11.6.6

The VSA function must determine the relevant operating limits (line loading limits, interface flow limits, export/import limits, and load change limits) to ensure voltage security of the system in the event of occurrence of any of the contingencies designated by the operator, the severe contingencies determined automatically through screening and ranking, or both. The VSA function should compute indices quantifying the degree (margin) of voltage stability or instability

11.6.5 Contingency definition A contingency consists of one or more events occurring simultaneously or at different instants of time, with each event resulting in a change in the state of one or more power system elements. A contingency may be initiated by a small disturbance, a fault, or a switching action. The following types of switching actions should be supported in the definition of a contingency:

of the system for contingencies designated by the • Breaker opening/closing operator, the severe contingencies determined automatically through screening and ranking, or both. • Shunt capacitor/reactor insertion and/or removal Trends and evolution of system-wide indices, as well Series capacitor insertion or as indices per designated zone or area, should• be bypass available based on prior VSA executions to indicate • Generator tripping • Load shedding whether system voltage security is improving or degrading. • Transformer tap changing Provisions should be available to accommodate auto-

i

• FACTS (Flexible AC Transmission System) device connectivity and operation

matic determination of preventive measures, and cor• Automatic transfer tripping (armed redive actions. Figure 11-7 shows the main camporemedial action) nents (modules) of on-line VSA. The Change Monitor

252

triggers event oriented execution of the VSA function On-line DSA must provide the capability to automatibased on, status and analog data received from cally determine the initiation of some or all of the SCADA. Alternatively, the available EMS Real-Time switching actions based on a combination of system Sequence Control (RTSC) may be augmented to conditions or events. include triggering of on-line VSA execution through an EMSNSA messaging mechanism. Contingency The capability should be provided to include one or selection and contingency screening are configured more contingency type attributes or flags in the defiseparately to allow inclusion or exclusion of screening nition of a contingency to designate whether or not as suitable for the utility. If desired, they may be comthe contingency must be subjected to time sirnula- bined into a single module. Contingency analysis for tion or static analysis. voltage stability assessment may be configured to use either static (steady-state) analysis or dynamic 11.6.6 Contingency selection simulation, depending on the characteristics of the contingencies of interest to the utility. Voltage securi- The Contingency Selector should ad as a filter so that ty monitor determines the secure operating limits or only relevant and appropriate contingencies are prooperating regions to ensure adequate voltage stabicessed each time VSA executes either in real-time or lity margin. The security enhancement module assists study mode. Starting with a list of pre-defined conin determination of preventive and/or remedial tingencies, the intent is to avoid unnecessary processactions against voltage instability threat. ing of any pre-defined contingency that can be pre-

screened as irrelevant or non-critical under present operating conditions. In case the contingency list includes one or more groups of "similar" contingen cies, whose relative severity can be logically establish ed based on actual operating conditions,_ the Contingency Selector should be able to select the n most severe contingencies in each such group (with n user-adjustable; default n ='1). Moreover, the Contingency Selector should have the capability to generate new contingencies (add to the list) based on operating conditions as determined by a set of rules. These specific conditions must be recognized

I I

\·

automatically based on the operating data (SCADA) and the results of other functions (such aStatic Security Analysis). The Contingency Selector should also be able to augment a contingency definition based on active arming of remedial action schemes. It should also recognize "must select" contingencies. The must-select list should be dynamic; for example, it should automatically include any contingencies that required remedial action arming in the previous VSA execution.

The Contingency Selector rules should be applicable to any power system data quantity that Contingency Selector can obtain or derive from the EMS and/or VSA database. To support both real-time and study VSA, this

includes data from SCADA the State Estimator, Static Security Analysis, OPF, and any Operating Orders coded in the EMSNSA environ ment. Different rules should be possible for real-time and study analysis. Mathematical operations applica ble to Contingency Selector's current and past data quantities must be supported. Logical as well as alge braic statements should be possible. The Contingency Selector must support rules that check whether each contingency's related data quan tities represent a certain status and/or range-of-ope ration condition that warrants activation or deactivati on of the contingency. In real-time mode, these checks should be possible on an instantaneous, trend, rate-of-change, or time-duration basis. This should include the ability to construct rules that com bine multiple power system conditions via one or more logical statements. The Contingency Selector should also activate/deactivate contingencies based on Static Security Analysis results, using generic or user-defined rules.

11.6.7 Contingency screening

11.6.8

Contingency screening may be required to reduce the number of contingencies selected by the Contingency Selector before carrying out further de tailed analysis. A number of voltage stability indices may be comput ed via computational short-cuts to help rank the se lected contingencies in an approximate order of seve rity, or identify harmless contingencies that need not be subjected to further analysis. Alternatively, rule based criteria may be used as experience that is built up with the system. Finally, the contingency screening module may be entirely disposed of if the Contin gency Selector adequately filters the list of possible contingencies. The design of the on-line VSA should be flexible and modular to accommodate easy adaptation of contin gency selection and screening to the specific utility requirements. In particular a number of screening and ranking criteria should be provided for selection by the user. The user must have the capability to include or exclude screening separately in the study mode and in the real-time sequence execution of online VSA.

11.6.8 Contingency analysis The Contingency Analysis module should provide the capability to select the method of analysis most sui table for the utility. Both static (steady-state) analysis and dynamic simulation methods should be provid ed. (Note: Contingency Analysis as defined here must not be confused with Steady-State Security Analysis which deals only with steady-state contingencies. Here the contingencies are of a dynamic nature, but the method of analysis may be static or dynamic). 253

.;..

.;..

.;..

ficient voltage stability margin as defined by the vol tage stability indices should be defined.

11.6.10

Static analysis may include power flow methods, sen sitivity analysis, as well as traditional local analysis (e.g. V-Q and P-V curves). Dynamic simulation should pro vide for analysis of both fast and slow dynamics, pre ferably with automatic time step adjustment It should accommodate generator and governor dynamics, field current limiting dynamics, load restoration dyna mics, tap changing time delays, AGC, and prime mover dynamics. The user must have the capability to designate the analysis method to be used for all contingencies, or on a per contingency basis. In the latter case the method of analysis may be included as part of the contingency definition as specified in 11.6.5. The results of contingency analysis must include classification of each contingency as voltage stable or unstable. Depending on the method of analysis selected, a measure of voltage stability margin should also be provided. Moreover, if the method of analysis permits, sensitivity of the stability margin with respect to designated operating parameters of interest may be computed. The capability must exist for iterations between the Contingency Analysis module and the Security Monitor. Both manual and automatic iterations should be provided for. In automatic iteration, the Security Monitor will modify designated parameters (e.g., system load) and trigger a run of Contingency Analysis. This will permit the Security Monitor to determine secure operating limits or regions in terms of operating parameters which are of interest to the operators, rather than in terms of indices which may be meaningful only to the analysts.

11.6.9 Voitage stabiiity criteria Voltage security (or insecurity) of the power system should be assessed based on voltage security criteria

254

of interest to, and accepted by, the utility. Lack of suf-

The user must have the capability to have a contin gency which results in islanding or necessitates auto matic load shedding beyond a designated threshold, to be identified explicitly or labelled as insecure even though the remaining part of the system meets vc>l tage stability requirements.

11.6.10 Security monitor Security Monitor must support voltage security analy sis, in both the real-time and study modes, by inter preting and presenting to the user the VSA contin gency analysis results from the following perspec-· tives: 1. Which contingencies result in voltage insecurity? 2. Which of the insecure contingencies are the most limiting (for the system as a whole or for specific zones and areas under study), and where? 3. What is the overall voltage security condition of the power system as a whole, or of specific zones or areas under study, as measured by one or more individual or composite voltage security indices? 4. Is the overall voltage security condition of the power system getting better or worse as evi denced by tracking appropriate voltage security indices? 5. Do projected short-term operating conditions, such as scheduled interchange or interface flows, suggest that the overall voltage security condition of the power system is going to get better or worse? Security Monitor should also provide the capability for direct (scan rate) monitoring of voltage and genera tor reactive power and reactive reserve for design ated generators or plants.

7 7.6. 7 0. 7 capabilities

Security monitor

Security Monitor should have the ability to apply mul tiple user-specified rules to assess the voltage secu rity condition of the power system. The rules should operate on the pre- and post-contingency power system. The rules should operate on the pre- and

post-contingency power system data and/or the vol tage security indices that Security Monitor must cal culate using the Contingency Analysis module. The rules must allow multiple conditions associated with the data and indices to be combined via one or more logical statements. Security Monitor must be capable of establishing the margins, sensitivities and other signatures that it needs in order to calculate the various operating limits of interest to the user, such as those needed for computation of available transmission capability (ATC). The VSA Operating limits may be assumed to be of the box type (i.e. maximin limits). However, the capa bility to determine secure operating regions (interde pendent operating limits or simultaneous transfer limits) must be provided for each pair of operating parameters designated by the user, with a third para meter selected by the user to produce a family of operating regions. The user must have the ability to review Security Monitor's results via tabular and graphical displays. Presentations should include the insecure contingen cies ranked in order of severity and convenient means of comparing contingencies on the basis of their relevant voltage security indices, operating limits, and remedial actions. A convenient means of tracking the overall voltage security condition of the power system must also be included. The user must have the ability to review Security Monitor's voltage security index definitions and secu rity assessment rules. On-line modifications of these definitions and rules must be possible in the study mode.

7 7 .6.

7

11.6.11

The Security Monitor should provide the capability to monitor for the operator designated bus voltages, as well as generator and static var system reactive power and reactive reserve. Depending on the design of the interface between the on-line VSA and the SCADA systems, this capability may require either opening a window into the SCADA system from the on-line VSA environment. or scan rate (or multiple scan rate snapshot) data transfer from SCADA to the on-line VSA. Reactive power and reactive reserve monitoring capability should be provided for individual units, groups of units, and power plants for which SCADA scan rate data is available. The capability should be able to graphically display the selected monitored quantities and their trend with time. The capability should also be available to have composite voltage security indices computed and displayed accordingly.

11.6.11 Security enhancement 0.2

Direct

(scan

rate)

monitoring The on-line VSA is expected to run normally as part of the real-time sequence, starting the State Estimator (SE) solution as explained in Section 11.6.11. It may

....

be set to execute following each SE solution or a multiple thereof.' Therefore, in its normal execution, the on-line VSA results are based on system snap shots obtained once every few minutes (5 minutes to 30 minutes depending on the specific implementa tion; 20 minutes being a reasonable reference value). Direct monitoring of specific bus voltages or generat ing unit reactive power refers to scan rate (or mul tiple scan rate) monitoring of such quantities, and would be best classified as a SCADA Function. The relevant data update periodicity would be in the range of 2 seconds to 30 seconds depending on the implementation (1 0 seconds being a reasonable refe rence value).

Security Enhancement includes both Preventive and Remedial Actions. The VSA functions should assist the operator in determining the needed security enhancement measures.

...

255

....

11.6.11.2

11.6. 11.1 On-line determination of preventive actions

rections to that decision should be made and the re sults tested until an acceptable condition is arrived at.

The preventive actions will consist of manipulating a coordinated set of "controllable parameters" in the pre-contingency state consisting of the following:

7 7.6.11.2 On-line determination of remedial actions

• VoltageNAR rescheduling • Network switching

element

• Generation rescheduling • Start-up of certain units (e.g., synchronous condensers) • Adjustment of interface flows across spec;fically designated interfaces • Adjustment of HVDC and FACTS device control set points • Curtailment of certain loads (interruptible loads, load control schemes, etc) Mechanisms for arriving at the final preventive action decisions may consist of one or a combination of the following: a) User-suggested preventive actions, b) Rule-based preventive actions, and c) Preventive actions obtained through a security-constrained optimal power flow (SCOPF). The information available from the base-case VSA execution run may provide sensitivity data and limit data that are helpful in preventive action considera tions. The sensitivity data could be in the form of a "sensitivity matrix" that relates incremental changes in the "cu,,trollable parameters" to the incremental chan ges of "output variables". The latter may include vol tage security indices and/or physical variables of inte rest (line flows, inter-area transfers, bus voltages). Limit data is obtained for specific critical variables (e.g. interface flows across designated transmission corri dors) by the Security Monitor using several iterations with the Contingency Analysis module to arrive at the exact limit. The limits could be of the "box" type, i.e. upper and lower limits for a given variable, or in the form of operating regions (interdependent limits or simultaneous transfers).

256

·

·

·

Once the decision for preventive action is made, a simulation check should be made to verify that the resulting conditions would be secure. Otherwise, cor-

The main objective of on-line remedial action deter mination is to determine appropriate arming for the remedial action schemes in case the preventive actions and/or the present active arming is not ade quate to ensure system security. The proper arming for individual contingencies can be determined sepa rately. The corresponding remedial action may invol ve shedding different combinations of load groups at one or several substations depending on the contin gency, and the actual operating conditions. Often many different arming schemes are possible to ensure voltage stability. If the impact on the post-con tingency operation is the same, then for operatorls convenience, it is desirable to have VSA recommend only incremental changes with respect to the existing active arming. However, when the number of required incremental changes (in a single VSA execution, or cumulatively over successive VSA executions) ex ceeds a threshold (user-enterable), it would be advis able to have VSA ignore the existing active arming, and determine a new arming scheme. Accordingly, for on-line determination of remedial actions, provi sions must be available for both "Flat Start Arming" and "Incremental arming" as defined below. In Flat Start Arming, the VSA is performed assuming that all remedial action schemes are initially disarmed. For those contingencies that cause voltage insecurity, an "optimal" subset of arming schemes is sought with the objective to arm the smallest amount of load shedding to achieve the desired voltage stability mar gin. This may be determined through the sensitivity analysis, whereby the changes in voltage stability margins are related to various possible control actions. Flat Start Arming is performed following a large change in system operating conditions, on demand, or once every n (user-enterable) VSA cycles. In Incremental Arming, the current arming state is retained and is automatically considered by the on line VSA. Depending on VSA results, an armed sche me may be disarmed if the corresponding voltage stability margins are high enough, and vice versa. The

.

incremental arming patterns are determined so as to minimize the number of changes in the active arming, while ensuring system stability. Any sensiti vity derivatives computed in this case are evaluated with the existing active arming. The operator must, in any case, have the capability to request a graphical comparison of the existing active arming and the one recommended by the VSA func tion. In the study mode, the engineer/analyst should be able to study possible remedial action arming options that would lead to system security. Both flatstart and incremental arming capabilities must be provided. The VSA system must have the tools to allow easy modification of the arming patterns.

11.6.1 2 Modeling requirements

and

data

This section specifies modelling and data require ments of the VSA function. Some of these require ments may be in line with the utility's existing EMS models and data; others may have to be added for on line VSA purposes.

7 7.6. 7 2. requirements

7

Modeling

The VSA will require the following classes of modek • Models

Static

• Device/System Models • Models • Models

11.6.12

• the inner external (or buffer zone), where the identity of the external network model elements is preserved, and • the outer external, where reduced models are used. Depending on arrangements for data exchange with other transmission control centers, little or no real time data may be available about the external model. There may be a need to change the external model occasionally based on available scheduling informa tion, seasonal variations, etc. One or more external models may be required to account for various ope rating conditions in the system based on scheduling data or seasonal variations. For both the internal and external subsystems, busses are grouped into zones. Power transfPr interfaces from any zone to an adja cent one must be easy to identify for the purposes of interface flow and transfer computations. 11.6.12.1.2 Device Static Models

The static models are load-flow models of device/ele ment representations. The following static models should be supported at a minimum: • Lines: represented as pi-sections, possibly with unsymmetrical line charging

Network

• Device Models

and configuration of bus arrangements in substa tions. The main purpose is to be able to adequately represent switching operations in contingencies and possible remedial action schemes. The external model network may consist of two subnetworks, namely:

Dynamic

Load Fault/Control

A description of the requirements for each model type is presented below. 11.6.12.1.1 Network Models

There are two types of network models that will have to be present, namely, internal and external models. The internal model includes representation of lines, generators, transformers, loads, DC converters and shunt/series devices, as well as the status of breakers,

• Transformers: represented as pi-sections where by the various impedance/admittance components may be explicit functions of tap settings. Three winding transformers must be properly modelled, including any associated tap changers • Phase-shifting transformers: represented by complex tap ratios, allowing both shift in angl and change in voltage magnitude • Generators: represented as a real-power source together with a reactive power capability curve as a function of terminal voltage • Shunt elements: represented by their impe dances/admittances

257

11.6.12.1.4 Load Models Load models should include the following features:

11.6.13

• Non-linear voltage dependence either as in the ZIP standard model (i.e. combination of constant impedance, constant current, and constant power) or as a gEOneral polynomial in voltage

• DC lines: represented as real-power injections, with defined MVAr vs. MW characteristics

• Large induction motor loads

• Static Var Compensators {SVCs): represented by static gain and maximum/minimum limits

• Slow thermostatically driven loads (heating/ cooling)

• Loads: represented by the ZIP model. i.e., as a combination of constant impedance (Z), constant current (1), and constant real/reactive injection (P) components

This modelling requirement includes the following:

11.6.12.1.3 Device/System Dynamic Models

• Relay models: for those relays which may operate due to a disturbance, e.g. load shedding relays

The device dynamic models to be considered are as follows:

11.6.12.1.5 Fault/Control Models

• Modelling of control actions in remedial action schemes

11.6.13 VSA Data Requirements

• Generator dynamic models including the following: • Machine mechanical dynamic equation (swing equation with damping) • Machine electrical dynamic equations • Excitation systems of various types • Governor systems of various types • Selected prime mover models (selection to be based on response times) · • Power system stabilizers • DC Line dynamic models including various controls • SVC dynamic models • FACTS devices including modelling of their connectivity and time delays

VSA data requirements consist of data for the above models, additional data needed by the VSA system as a whole, and specific real-time data needed exclu sively by the on-line VSA function.

7 7.6. 73.7 Model Data Requirements 11.6.13.1.1 Network model These include connectivity/topology information for lines, transformers, shunVseries devices, and genera ting units. Additional network data will include: • Limits on bus voltages for each voltage level for normal and emergency operation • Bus configurations in substations as functions of breaker status (for internal network)

• ULTC transformers: to include time delays associated with tap-changing controls

• Zone data

Flexibility must be provided to accommodate user supplied device models easily.

11.6.13.1.2 Device static model The following data will be needed: • Line pi-section impedances/admittances data • Line thermal limits, both normal and emergency

258 • Transformer limits, both normal and emergency • Phase-shifting transformer data and limits, both normal and emergency • Transformer limits, both normal and emergency • Phase-shifting transformer data and limits, both normal and emergency • Generator static data: minimum and maximum ratings, nominal terminal voltage, reactive power capability curve as a function of terminal voltage and coolant conditions

• Transformer pi-section data including tap settings with impedance/admittance components as explicit functions of tap settings • Shunt element impedances/admittances and ratings • DC lines: voltage levels, ratings • Loads: default ZIP load partition ratios at nominal voltage (for the Z, I, and P components), load limits, and default power factors 11.6.13.1.3 Device/system dynamic model The following device dynamic model data require ments must be met as a minimum: • Generator dynamic model data:

• Machine mechanical parameters: inertia constant and damping coefficient • Machine electrical parameters: transient/sub-transient reactances and time constants, saturation model data • Excitation systems: data for each model available in standard power system stability analysis programs such as EPRI's ETMSP • Governor systems data for each model available in standard power system stability analysis programs such as the EPRI ETMSP • Selected prime mover model data (selection to be based on response times) • Power system stabilizer gains, time constants and limits • DC line dynamic model data including those for various controls and their parameters - • FACTS device data (compatible with those available in EPRI ETMSP) • ULTC transformers and phase-shifters: time-delays associated with tap-changing controls

Flexibility must be provided to accommodate data for the user-defined models in a flexible user-friendly manner.

11.6.13.2

11.6.13.1.4 Load models Load model data should include the following as needed: • Percentages of Z, I and P for each load bus and for real and reactive powers independently (percentages specified for nominal base case conditions) • Coefficient for polynomial representation of loads as function of voltage • Large induction motor loads data • Slow thermostatically driven load data (including time delay, time constant. gain, and sensitivity factors) 11.6.13.1.5 Switching/control modes The switching/control data requirement may include the following: • Relay model data including timing of breaker operation, protective action schemes, etc • Model data of control actions in remedial action schemes. Also, this may include threshold values for various arming schemes.

11.6.13.2 Default data The VSA system should have the capability to fill in missing data using appropriate default values. It must also detect and flag erroneous data based on _rea sonability checks. The user must be able to fill in the correct information and must have the option to use default data.

259

11.7 On-line VSA execution modes

11.7

The VSA function must be able to execute periodi cally, on demand, and upon occurrence of significant changes in the state of the power system. It should also be available in the study mode.

11.71 On-line VSA execution control requirements In the on-line mode (referred to also as real-time exe cution mode) the VSA must execute in conjunction with the real-

time sequence control (RTSC), which coordinates execution of the network security appli cation functions available in the EMS environment. Figure 11-8 shows where on-line VSA fits in the EMS real-time sequence. The EMS RTSC design is expected to provide the fle xibility for the operator to have an execution of the State Estimator (SE), and possibly the Steady-State Security Analysis (SSA) function be automatically trig gered to precede each VSA execution.

.----

VSA

11.7.1.1 On-line VSA execution trigger The following triggering mechanisms for on-line VSA execution should be available: 1. Periodic Execution: It is expected that the provisions in the EMS RTSC will allow the user to specify the execution periodicity of the on-line VSA based on absolute time (e.g., on the hour, 20 minutes past the hour, etc), time lapse since the last VSA execution (e.g., 20 minutes after the last VSA execution), or multiples of periodic State Estimator executions (e.g. after every other SE execution). For each utility the existing EMS RTSC capabilities will be used to trigger periodic on-line VSA execution. 2. Event-driven Execution: The on-line VSA must execute upon changes in the operating state of the power system detected by a "Change Monitor" that triggers the RTSC execution. These changes should include the following: • Changes in system topology • Variation of load, generation, or interface flow level beyond designated thresholds • Changes in the arming pattern of auto matic corrective devices, whenever applicable • Changes in the status of reactive resources (ON/OFF) • Changes in the status of generator AVR, blocked transformer taps, etc., where tele-metered • Change of state (ON/OFF) of stabilizers on the machines

State Model

Estimation

SSA

Update

SSA =Steady-State Security Analysis VSA = Voltage Stability Analysis DAS = Dynamic Security Analysis Old = Operating Limits Determination

DSA

Figure -11-8 Real-time Sequence VSA Execution

260

Old

The user must be able to specify a time delay associated with each group of event triggers, so that VSA execution starts only after the system has settled down to a steady-state and the corresponding base case is available from the State Estimator. - 3. On-demand Execution: The operator must be_ able to request execution of on-line VSA at any time. In case VSA is already executing, the opera tor must be accordingly notified, and should be given the option to have the requested on demand VSA execution queued or ignored.

'?

7 7.77.2 VSA execution abort The operator should be able to abort VSA execution at any time regardless of the triggering mechanism that started the execution. It should be possible to assign execution and abort priorities based on the type of triggering mechanism that started the current VSA execution, and the source of the incoming execution or abort request. For example, it should be possible to have any periodic VSA execution aborted by any event trigger, and have any periodic trigger ignored or queued when an event triggered VSA run is executing. It should also be possible to have a forced execution mode such that if VSA has not run to completion for a period of time (specified by the user, and longer than normal VSA execution periodicity), a forced execution is start ed ignoring subsequent execution abort requests (except for manual abort).

1 7 .71.3 control

Execution

The operator should be able to use a simple display block diagram to include or exclude contingency screening for on-line VSA execution. The operator should also have the possibility to observe the online VSA execution results (interface flow limits, genera tion limits, etc.) and authorize or prevent their use by other EMS functions. The operator should also have the capability to enable automatic transfer of the on line VSA results for use by other EMS or SCADA applications. The analyst/engineer must have the possibility to enable/disable either static analysis or time simulation for Contingency Analysis for all contingencies. If both are enabled, the contingency type flag described in 11.6.5 will prevail.

1 7 .7.7.4 Validity results

of VSA

The on-line VSA should have the capability to deter mine (and warn the operator) when the results of the most recent VSA execution are no longer valid due to changes in the system or arming conditions. It is nor mally expected that the Change Monitor will initiate

VSA execution under these conditions. However, it is also possible that the VSA executions triggered by the Change Monitor do not run to completion for some time due to frequent changes in system condi tions. The operator should then be notified that the available VSA results are no longer valid.

11.8

11.72 Study mode execution control requirements In the study mode, the user must be able to execute the VSA function using a save case steady-state or system snapshot. The real-time VSA mode should continue while stu dies are being executed. The user must have the capability to modify the save case conditions, choose an existing contingency list, add, delete, or modify contingencies, modify arming schemes, include or exclude contingency screening, and change VSA exe cution parameters and thresholds. The user must also have the possibility to select or construct a specific contingency to be analyzed without processing or modifying the contingency list.

11.8 On-line VSA user Requirements The user requirements for the integrated VSA func tion are stated in this section. Subsection 11.8.1 pre sents some general user requirements. Specific requi rements for various user groups (operators, opera tions planners/engineers, and managers) are present ed in sections 11.8.2 through 11.8.4.

11.8.1 General VSA user requirements This section presents user requirements common to all users, i.e., operators, operations planners/engi neers, and managers.

261

.

·

7 7 .8. 7. 7 User interface environment

11.8.1.3

The VSA should have an effective and user-friendly graphic user interface with point and click features, pull-down menus and Windows. Modem graphics should be used for the quick assessment of complex situations. The VSA user interface should provide facilities for effective and efficient monitoring of the various indi ces, margins and trends together with provisions for implementation of preventive action recommendati ons, and arming of automatic corrective actions (such as comparison of sting and recommended arming). The VSA should be able to store the results of inse cure cases and the associated state estimator base cases automatically when these appear in the online mode (controlled by the real- time sequence control). These cases should be archived for future analysis and consideration by the Engineer. In both on-line and study modes, the possibility must be provided to show the run time since the start of the VSA execution, as well as the progress of the VSA run (e.g., screening in progress, the number of con tingencies processed so far, the number of remaining contingencies to be examined, etc). A waiting symbol on the screen is required and copy output capability is required for both tabular and graphical displays.

7

7

.8.

7.2

User

interaction The following display capabilities must be provided as a minimum: • Displays that indicate the available VSA execution control parameters, their current value, and their default value.

262

• Displays that graphically show the variation of a voltage stability index with a given interface flow, the critical interface flow limit for a single contin gency, and its envelope curve for all contingencies processed during VSA execution. • Displays that show the unacceptable (insecure) contingencies for the previous VSA executions.

• Displays that indicate the "new" insecure contin gencies that were not identified as insecure in the previous VSA run, and the previously insecure contingencies that are no longer insecure.

7 7 .8.7.3 Save case capability The user must be able to request the on-line (real time) or study mode VSA data and results to be saved. A save case should include the following data and parameters: 1. The pre-contingency steady-state base case. The base case may have been generated under real time sequence control (State Estimator solution, possibly augmented by other VSA or EMS satellite functions, to provide a VSA base case), or via a study power flow solution. 2. Additional status and analog·data needed by the rule base (e.g. remedial action arming status). 3. All VSA execution parameters (tolerances, thresh olds, etc) and configuration (e.g. screening bypass). 4. The contingency list selected/produced by the Contingency Selector. 5. SA results generated according to the execution parameters. The user must have the capability to call up a menu to select the VSA results to be saved. This should include the capability to select a variable category, and item, as follows: • Screening results (contingencies discarded or retained). • Ranked lists of severe contingencies along with the value of the ranking index for each ranking index used. • Overall VSA summary results, including grouping of contingencies into voltage stable (secure) and unstable (insecure), final ranking of severe contin gencies, interface flow limits, recommended remedial action arming, etc

11.8.2.2 Security related information provided for the operator As a minimum, the following security-related infor mation should be provided to the operator:

11.8.1.4 User documentation The VSA user documentation should address, among other things, the following items: 1. What each function is supposed to do. 2. Low to adjust data, parameters, options, etc, and what happens once those adjustments are made. 3. Descriptions of how to accomplish various tasks using the system and how to use its features. These need to be very clear step by-step instructions. 4. The documentation should be self-contained and not reference other publications, except for general information. On-line "Help" facility is required to explain to the user all commands, functions used, its and any other fea tures of the VSA package.

11.8.2 Operator requirements The on-line VSA environment should be easy to understand and manipulate. Specifically the following facilities should be provided: ·

11.8.2.1 Operator interaction The on-line VSA environment should be easy to understand and manipulate. Specifically the following facilities should be provided: 1. The on-line VSA must be initially consistent with operating orders (see Section 11.6.13.1) based on off-line analysis. New features, whether based on indices or the use of modem graphic facilities, should take into consideration the structure and contents of the current operdling orders so that the transition to the on-line VSA is smooth and credible. 2. The operator should have the ability to include or exclude screening in on-line VSA execution.

.;..

'?

1. Operating limits associated with a prescribed set of contingencies, i.e. generation limits, VAR support limits, voltage stability margins, reactive margins, etc 2. Transfer limits on important individual or simul taneous interfaces

11.8.2.3

3. Coordinated action to affect various transfers securely against voltage instability threat. 4. Sensitivities of changes in the voltage stability limits/margins to specific operator actions (if available). 5. Time trends associated with expected system changes which would allow the operator to estimate the time available for intervention with a given operator-initiated measure. 6. Warning when the current VSA results are no longer valid due to changes in the power system conditions. This can be implemented via an appr priate alarm that indicates that system conditions have changed and that prior VSA results are no longer valid.

7. System trend information indicating whether things are getting better or worse. This trend information is to be based on changes in key system indices and customized for indices applicable to the utility.

11.8.2.3 Applications of the on-line VSA function The operator should be able to utilize the on line VSA for the following applications: 1. Compute the VSA limits needed to determine Available Transmission Capability. This will be reali zed by incorporating VSA limits along with-ther mal limits, Steady-State Security Analysis (SSA) limits,-and Dynamic Security Assessment (DSA) limits in an Operating Limit Determination (OLD) function. The OLD function (which is not part of VSA) may accommodate box-type operating limits or inter-dependent limits (operating regions).

.;..

'?

?

263

2. Outage dispatching for possible outages of gene rators, lines, transformers and reactive groups. This entails a study mode application of the VSA function. 11.8.4

3. Incorporation of critical contingency

results in relevant on-line application software like the optimal power flow. 4. Preventive actions: list of possible preventive measures for operator decision together with the "cost" associated with each measure. 5. Arming: Arming recommendations for coor dinated automatic corrective action to ensure "vigilance" against the contingencies of concern. 6. Corrective Action: following the possible occurrence of critical contingencies, a list of potential corrective measures should be made available.

4. Capability to perform model

reduction/equiva lence for operator's use. The model reduction capability may be an off-line tool, but the VSA should offer the possibility to test the impact of choosing different external models, and compare them. 5. Capability to compare cases with other utilities through standardized inputs and outputs and the I.

ability to interface with time-simulation stability

I programs. (This will be a feature to be specified l

7 7 .8.2.4 Direct

(scan

separately for each utility's VSA specification if needed.)

rate)

monitoring Using a window into the SCADA system, or other wise, the operator should be able to monitor design ated bus voltages, as well as generator and static VAr system reactive power and reactive reserve for indivi dual units, groups of units, and power plants for which SCADA scan rate data is available. The capability should be provided to graphically dis play the selected monitored quantities and their trend with time, along with relevant computed composite voltage security indices.

I 6.

Capability

l

to

compare

These include all of the user requirements stated in Sections 11.8.1 and 11.8.2 for the operators), except Section 11.8.2.4, plus the following: 1. Ability to adjust certain system parameters:

this may apply to selection of fewer or more contin gencies, together with the ability to construct system scenarios for study purposes. 2. Ability to include or exclude time domain simulation for Contingency Analysis.

against

each

I

other

through appropriate graphical means that focus on the key parameters associated with various i.

comparisons (e.g., indices, margins, sensitivities and trends). Provisions should exist for efficient and easy-tocarry out database maintenance, including the ability to define specific and generic contingencies, and .to modify the contingency list, the network, dev1ce models and the rule base.

11.8.4 Manager requirements 11.8.3 Operations planners/engineers user requirements

cases

264

user

3. Ability to recreate an actual event and study its validity against measured data.

This category of user requirements includes the fol lowing:

are study reports based on Engineer's activities in cases of severe events on the system

1. Summary reports on system

I

performance as provided by the voltage stability indices and their corresponding time evolution 2. Reports on actual vs. computed results to assess validity of the results. These

...

l

3. Reports on critical events 4. Summary logs of critical variables

...

'?

'?

11.9 Interface requirements

This section addresses the main VSA interface requi rements with other au omated functions.

11.9.1 Consideration of existing automated operating orders The operating orders involving determination of the interface flow limits and/or arming of remedial action schemes may be available in an automated environ ment at the utility. In this case, most probably an automated table look-up process is available. Since the states in the look-up table cover only sample operating conditions, usually interpolation, extrapola tion or scaling follows the table look-up process to adapt the table look-up results to the prevailing ope rating conditions. The VSA rule base should be a[Jie to accommodate such rules. VSA should interface with the Automated Operating Order subsystem to obtain information regarding selected contingencies, interface flow definitions, interface flow limits, and the arming scheme. It should provide the capability to compare the operating limits, and arming, obtained by applying the operating orders, with those obtain ed based on VSA execution.

1.9.2 Interface with EMS functions On-line VSA should be capable of using the output results of existing host-EMS functions such as State Estimator, Dispatcher Power Flow, and Optimal Power Flow to establish the power system conditions to be analyzed by VSA. These conditions may take the form of a power flow solution that represents the state of the actual power system or the state of a projected or study version of the power system.

In the real-time mode, VSA must typically interface with State Estimator results. Other options exist, however, that depend on host-EMS capabilities. For example, if actual security violations are detected by State Estimator, Optimal Power Flow may execute automatically to determine appropriate corrective

Security Analysis function . in which case, if the correc tive action is projecte d to give rise to a power system state with conting ency problem s, Optimal Power Flow may run once more to determi ne appropr iate preventi ve action. This means that the user

may wish to run VSA on a established from:

power flow solution

1. Actual real-time conditions, as reflected in the State Estimator solution 2. Conditions corresponding to "steady-state" corrective actions, or 3. Conditions corresponding to "steady-state" preventive actions. VSA implementation should allow the user to coordi nate VSA execution with the host-EMS real-time sequence accordingly. In the study mode, VSA should typically interface with Dispatcher Power Flow results. Host- EMS studies using Optimal Power Flow may also be possible. Therefore, VSA implementation must allow the user to demand the execution of VSA on any study power flow solution that can be created or retrieved via host-EMS facilities. action. The host EMS may then run its Steady-State

Further, in real-time or study mode, VSA should use both the power system model and the power flow results of the EMS function to generate and initialize the VSA power system model that will serve as a base case and hence starting point for subsequent VSA processing.

11.9

VSA should also be capable of using the output results of the host-EMS real-time and study Steady State Security Analysis functions. For example, for a given power flow solution,the corresponding Steady State Security Analysis results may help VSA deter mine the relevant contingencies it should analyze. VSA should use real-time sequence results as they are generated in response to the existing demand, event, and periodic execution mechanisms that serve steadystate security analysis in the Host EMS. In addition, however, VSA should be capable of using the output results of host-EMS functions such as remedial action arming status, the Operating Orders, etc, to determine if a change in the status of breakers

265

11.1 0 The implementation of Wide Area protection

11.10

and/or corrective device arming should trigger execu tion of the real-time sequence solely for VSA purpo se. In this case, the flexibility to execute a subset of normal real-time sequence should be provided, e.g. execution of State Estimator without subsequent execution of Optimal Power Flow and Steady-State Security Analysis. The ability of existing EMS functions to access VSA output results should also be provided. This should include the use of recommended operating limits (interface flow limits) and recommended corrective device arming status and associated threshold levels.

11.9.3 Interface with EMS services VSA should interface with EMS services to obtain real-time or study power flow solutions, correspon ding power system models, and the other results from SCADA and Automated Operating Orders that it needs. These services should provide facilities to output VSA user messages such as convergence or voltage insecurity warning messages, and provide EMS access to VSA results such as interface flow limits. To permit direct (scan rate) monitoring of designated voltage or reactive power quantities, data interface to SCADA should have the capability to transfer selected SCADA telemetered or computed data to VSA every scan cycle (e.g. 2 seconds) or a userselectable mul tiple thereof (e.g. every 10 seconds).

Wide area protection is still an important topic since system wide collapses occur fre(juently in many power systems. Since several years much effort has been taken to indicate voltage stability]. The propos ed indicators are designed for the implementation in control centers and base on SCADA data. Two major kinds of indicators can be distinguished. The first ones are the sensitivity-based indicators, the minimum sin gular value of the load flow Jacobian. This kind of indicators only consider the actual state of the system and does not predict any influence by discontinuous elements like reactive power limiters or under load tap changing transformers. The second ones are all types of power respectively stability margin calcula tions in the sense of calculating the difference be tween the actual system's state and a point on the stability boundary. The continuation power flow is the best-known algorithm for this application. All discon tinuous and steady-state effects influencing voltage stability are modelled. However, the nowadays application of all these approaches has the drawback that the basic SCADA data assumes that the system is in a steady-state equilibrium. For slow changes in the system, like changes of the load over day, this assumption is suf ficient However, a typical voltage collapse mostly occurs after cascaded contingencies or faults, which lead to an unstable system's state. This unstable state is a dynamic transient process of several seconds up to tens of minutes, which make the voltage stability problem hard to handle with the nowadays steady state approaches. In spite of a good theoretical knowl edge, there are no practical realizations considering the system dynamics for voltage stability assessment. Pre-calculations of the stability for one or a combina tion of two contingency events address only a part of the problem. This needs a huge calculation effort and the system's state, for which a case is calculated, must fit most exactly to the actual system's state. For unex pected contingency cases this approach is not useful.

266

·

'?

Conclusively, the major drawbacks of all these approa ches lie in the not appropriate steady-state system view. The solution for this is a departure from the SCADA-based approach to a transient measurement system. Such a measurement system together with the voltage stability assessment and stabilization algorithms will be called wide area protection system in the following. Phasor measurement units (PMU), which are weil known since several years, build the technical base for the wide area protection system. They offer pha sors of voltage and currents together with a satellite triggered time stamp in time intervals down to 20 ms. Single installations of such units are in an experimen tal stage at many utilities. Also voltage stability indica tors are proposed on phasor measurements for con tinuous changes of power systems. This chapter con centrates on the stability prediction after cascaded outages. The described algorithms are designed es pecially for the opportunities that are offered by the transient system's view.

11.10.1 System Set-up 11.1 0.1.1 Hardware system setup The PMUs must be installed throughout a critical area of the system. Critical area of the system e.g. in the sense of voltage stability means to look on critical paths from generation to load areas or dedicated transmission corridors. This critical area is the result from a system assessment, e.g. with the help of model analysis [11] together with critical contingency screening algorithms. For such a critical area an inter nal model with appropriate neighbouring models at the boundaries must be formulated.

11.10.1

PMUs with several input channels are able to measu re the primary voltage and currents at a substation at the feeders and lines. The analogue values are trans formed in to digital samples by the analogue digital converter and processed in the microcomputer. They are synchronized via GPS with an accuracy of 1 11-sec (Figure 11-9).

Current Primary Voltage

Figure 17-9 Principle of the phasor measurement unit (PMU)

Accuracy: 1

267

f.!S

.

·

'•

,,

System Protection

..

------------------------------

--

GPS

Satellite

-- ---

11.10.1.2

:-,.JJ . Phasor rsnaps hot

.. Figure 7 7-7 0 Set-up of a wide area protection scheme with PMUs

The measured data is transmitted from the PMUs to a central system protection center (SPC) where the evaluation algorithms are running. The PMUs are located to make the critical area completely obser vable. Together with network data, the information of neighboring stations can be calculated as well. There fore, PMUs have to be installed only at each fourth substation in the critical area. The communication between the PMUs and the system protection center can be realized via satellite, fibre optics or other per manent available communication channels. Because of the time stamped information, the snapshots show all transients and the dynamic behavior of the system. Figure 11-10 shows the typical system set up.

268

7 7. 70.7.2 System center

protection

The incoming data from the PMUs must be prepro cessed and arranged in a database structure. The system model for the actual situation is generated via

state calculation considering the actual grid topology. On this base the stability status is determined in terms of the power margin (PM) of the critical area. Optimized stabilizing actions are initiated accordingly. To let the system protection center operate in real time, it receives information in the following form: • Cyclic data: snapshot of the power system in predefined time intervals (20 - 250 ms). • Event triggered respectively contingency driven data: containing the update of the network topology according to contingencies. In order to deliver a result both in normal steadystate aQd contingency operations the functional structure of the system protection center has been designed as depicted in Figure 11-11. As long as no contingency has been detected and the power system is in a steady state, the power mar-

I

J

new and utilizes the capabilities of the dynamic system view of the wide area protection system. It will be presented and explained in detail in the follow ing section. The results of the power margin and stabilizing action calculations are displayed on a VDU. The stabilizing actions can be used for automatic in a closed-loop power restoratior procedure.

l:•t::=::=:=::::: ,--------

Voltage

::;..-.

11.10.2 Voltage Instability Prediction

Margin

to

Contingency .':=!·.' ; Detection

PM

Power

11.10.2

Collapse

TVSI Transient Voltage State Indicator

Figure 7 7-7 7 Principle of instability monitoring

gin is calculated all the time for the snapshots of the power system supplied with the cyclic data. The power margin is computed by the continuation power flow (CPF). On this model stabilizing actions are calculated, if the available power margin is too low. To be prepared against the most critical contingencies in the sense of (n-1), a cyclic pre-calculation of the power margin and stabilizing actions is carried out. This is performed for all contingencies in a contin gency list for an actual power system snapshot. Thus power margins and stabilizing actions for all proba bly worst contingencies, which can occur in the cur rent system's state, are already prepared. When the calculation for the whole contingency list is finished, the next snapshot is processed the same way. If a contingency occurs, either pre-calculated results are taken or the transient voltage stability prediction is triggered. The transient voltage stability prediction needs no pre- processed information, therefore it can follow any contingencies also cascaded ones. Whereas the power margin calculation on an actual system state and the pre-calculation is more or less standard, the transient voltage stability prediction is

Voltage stability is concerned with the ability of a power system to maintain acceptable voltages at all buses in the system under normal conditions and after being subjected to a disturbance. The main fac tor causing voltage instability is the inability of the power system to meet the demand for reactive power. A disturbance like an unexpected branch outage may cause a progressive and uncontrollable decline in voltage. The static analysis allows examina tion of a wide range of power system conditions and can identify the weakest lines which are the key con tributing factors ir voltage stability analysis. The voltage stability study may be limited to identify areas prone to voltage instability and to obtain infor mation regarding now system voltage stability can be improved most Effectively. Operation near the vol tage stability limiTs is impractical and a sufficient power margin is needed. Practically, the idea of P-V cuNe is used to determine the maximal MW margin at load buses to avoid voltage collapse. The maximum power Pm, which can be transferred is reached if the load impedance is equally low as the line impedance. With increasing load power the vol tage will decline gradually until P/Pm = 1. The effect of decreasing vo age is to monitor the operating point at actual status moving to the right The opera tor is to be alerted when it passes a threshold point and he is informed about the safety margin leftlmtil instability will occur. Once it passes the instability limit, load shedding is automatically initiated. To find the weakest branch the N-1 post-contingency load flow is analyzed. After the outage of a specific branch the bus loads are increased along with the

269

'•

l

P = Pm, Voltage collapse Precisely calculated instability limit Actual status 11.10.2

Vs = fixed source voltage Vr = variable load voltage P = Power delivered to load Pm = maximum power

Vr/Vs 1.0

0.8 0.6 0.4

0.2 0.0

0.0

0.2

0.4

0.6

Figure 11-72 PV Curve of a transmission line

proportional increase of bus generation to meenhe demand. Even if the power system is stable after a contingen cy, a transition takes place that brings the power sys tem to a new the stable equilibrium. Right after the contingency, it is not possible to determine with clas sical steady-state based stability indicators if the system state trajectory will end in a stable equilibrium. The elements of the power system which cause this delay of the collapse, are under load tap changing transformers (ULTC), reactive power limiters of power units with temporary overload characteristic and dyna mic loads with a load recovery characteristic after vol tage drops. If conventional voltage stability indicators are applied to the power system in such a transient phase, the results are faulty or the voltage in-stability is detected too late, because the actual load is not the load, which is demanded seconds later. Also it will not be detected if power units are in reactive power overload or if ULTCs are in a stable tapping position.

270

Therefore the transient voltage stability prediction has been invented to assess the voltage stability correctly after contingencies during the transient phase.

0.8

1.0

P/Pm = 1.0 Maximum power delivering capability

The idea of the method is to make a prediction from the beginning of the transient phase into the future until the steady- state operation point is reached. For this steady state operation point the stability can be determined by calculating the power margin (Figure 11-1 3). If no steady-state operation point is available the system will run into a collapse. The presented approach maps the actual measured system's status right after a contingency on an expected equilibrium point in the near future. The advantage of the whole process is, that the sta bility can be indicated directly after the contingency during the transient phase. If no equilibrium can be found, this model can be used to determine stabili zing actions, which bring this model and therefore the real system back to a stable operation point The time between the early detection of an instability, seconds after the contingency, and the occurrence of the expected voltage collapse can be used to take these actions. Possible actions are load shedding, blocking of ULTC-tapping, activation of reactive power, change of voltage set-points of voltage con trolling devices (FACTSdevices, ULTC, secondary vol tage control, Automatic Generation Control (AGC) or controlled islanding.

Network model:

E =v;l +ZNEltl

E =v;z -

-

-

1.:1, t2

0-------c=J--., E ZNET

Network

-

!

I

Zapp

load

Maximal power transfer IZNETI IZappl

=

+ZNE/n vu, t2

11.10.2

Power margin 85 Proximity to voltage collapse Safety Margine: AS = aefg - abed

!JS =SforecastMAX-l<: xlt

a

Load increase

d

g PIP m

Figure 7 7- 7 3 Power margin algorithm

The algorithm for the power margin LiS calculation is based on the network model above with the voltage source E, the line impedance ZNrr and the load impe dance Zapp· The maximal power transfer capacity is reached if line and load impedance become equal. The power margin calculation predicts the proximity to the voltage collapse by taking the gradient of the voltage decline caused by the current It, at the instant t, into account and estimates the situation at the instant t2 with the assumed current t2 . The algorithm has four steps. A flow chart is shown in Figure 11-13. 1. While the ystem is running in a steady-state situation the steady-state values of bus voltages V0 and load powers P0 and Q0 must be traced and contingencies as changes in the topology must be detected. 2. The parameters of a dynamic load model, which describe the voltage dependency of the power, are determined. For this a sliding window of values of voltage V and load P, Q at each bus is evaluated. These values are the output of the state calculation in the SPC.

...

3. The determined load parameters together with the base loads P0, 00 and voltage V0 are fed into a power flow calculation considering also under load tap changers and power margins of devices. This power flow model represents exactly the steady-state behavior of the completely modelled dynamical system. The convergence of the power flow leads to the steady state solution respectively to the equilibrium point of the dynamic system. This equilibrium point is the predicted state of the system, which might be tens of seconds in the future. If the power flow does not converge and no equilibrium is found the transient phase will end up with a collapse. 4. If the power flow converges the power margin is calculated with the continuation power flow. The system set-up traces continuously the ·state values of the system like voltages, currents and active and reactive power. From the current measurement at the minimum at one end of a line, the outage of the line is detected (Step 1). After that a sliding win dow of measured bus voltages and feeder loads is collected (Step 2).

...

271

'?

'?

'?

7 7. 7 0.2. 7 Options for guided control actions

11.10.2. 2

Examinations of the many voltage collapse incidents worldwide generally show that the disturbance prog resses in two phases. The first slow phase consists of a gradual voltage decline over a period of many minutes. If certain actions are initiated at that time the final situation will be much less severe. Following detection of power system conditions, that require corrective actions the system protection cen ter would identify suitable locations and options of counter actions. The selection of adequate control actions is based on power system conditions and the kind of recognized contingencies. The extensive system wide measurements are used to optimize locations and size of actions. Coordination of wide area protection with conventional control and protec tion is vital to the reliability of transmission networks. The following typical actions would be issued in case the power system approaches instabilities (Fig. 11-14). • Alerting the system operator by indication of the remaining safety margin VS and by providing on line guidance to counteract. this situation. In addi tion, corresponding information is produced as input for the energy management system (EMS). • Control actions can be initiated if the safety margin VS reaches a pre-set critical level to avoid voltage instabilities to occur, e.g. Adaptation of the power factor by compensating the lack of reactive power by means of FACTS (Flexible AC Transmission Systems). • Blocking of the OLTCs (On-line Tap Changer Controller) in order to avoid over compensation of the voltage. • Generation adaptation in order to maximize the active power output from synchronous machines to compensate the lack of reactive power. • Load adaptationby means of intelligent load shedding, which takes the actual load condition into account.

I,

II Provisions to enable the appropriate action require ments aie typically identified in the course of analyti cal system studies, taking into account the set of con tingencies, operation policies and procedures as well as current power system load, as well as network an generation conditions. The close cooperation of wide area protection with conventional control and protec tion is vital to the reliability of transmission networks. The following provisions have to be provided to counteract a collapsing voltage condition: • Implementation of static VAR Compensation (SVC) in areas deemed to be at risk. • In order to maximize the reactive power output from synchronous machines, it is necessary to overload stator and rotor field circuits temporarily. These possibilities can only be applied in connec tion with numerical generator protection relays which provide the features for automatic para meter adaptation. • It may also be advantageous to reduce generator active power output in order to maximize reactive power levels. • Implementation of adaptive line protection devices on critical lines to prevent tripping on overload.

e

272

• Controlled system separation by islanding part of the system.

7 7. 7 0.2.2 Control of On-Load Tap Changers On load tap changers when equipped with automa tic voltage regulators (AVR) operate progressively tap up if the primary side voltage decreases thus accele rating the voltage collapse. In order to prevent this, two options are possible, but they must be applied to all transformers with OLTCs down to the distribution level. • Blocking the OLCT in case a risk situation has been identified; unblocking ensues once the voltage recovers to an acceptable, stable level. A centrally coordinated scheme is feasible if adequate com munication links are available and if numerical

I

EMS

11.10.2.3

System Operator Guidance (Display)

1-.. · AS Online Analysis

Post-Fault AS

Automated corrective control options

Decision Making Logic

Load Tap Load Islanding Shedding

AGC

Changer Control

FACTS

Controlled Load Generation Tap Changer Cos