Fundamental Reliability Considerations in the Design, Manufacturing and Application of Multifunction Digital Relays for Generator Protection

Transcription

1 Canadan Electrcal Assocaton Engneerng and Operatng Dvson Power System Plannng and Operatng Secton Aprl 1996 Montréal, Canada Fundamental Relablty Consderatons n the Desgn, Manufacturng and Applcaton of Multfuncton Dgtal Relays for Generator Protecton by Charles J. Mozna and Dr. Murty V.V.S. Yalla Beckwth Electrc Co., Inc th Avenue North Largo, FL USA SUMMARY A major concern n the applcaton of multfuncton dgtal relays for the protecton of generators s that almost all the electrcal protecton, ncludng both prmary and the backup relay functons, are emboded n one dgtal package. The falure of that package results n the loss of vrtually all generator electrcal protecton. Ths paper dscusses how multfuncton relays can be desgned and manufactured to mnmze such falures. It descrbes the role of self-dagnostcs n determnng the health of the relay. Most mportantly, t proposes cost-effectve applcaton strateges whch can be employed to survve an n-servce multfuncton relay falure wthout loss of generator protecton. Keywords: multfuncton relay, self-dagnostcs, mean-tme-between-falures (MTBF), redundant protecton systems.

2 INTRODUCTION As all relay engneers are aware, protectve relay technology over the past twenty-fve years or more has evolved from sngle-functon electromechancal relays to statc relays and fnally to dgtal relays. The frst dgtal relays were sngle-functon unts. However, as mcroprocessors became more powerful, desgners soon saw the economc advantage of desgnng multfuncton relays. In these relays, vrtually all protectve functons for a specfc protectve zone are ncorporated nto a sngle hardware platform. Fgure 1 llustrates the number of protectve functons whch can be nstalled on a sngle hardware platform for generator protecton. A falure of the hardware platform wll typcally dsable all protectve functons wthn a protectve zone. Therefore an mportant ssue n the applcaton of multfuncton dgtal relayng s how to handle havng all the eggs n one basket. The nstallaton of both ndependent prmary and backup protecton s one of the most fundamental concepts of protectve relayng. Utlty System 52 Unt I N BF-N Sngle Hardware Platform Sngle Hardware Platform 52 Gen BF 87 60FL TN 59N M-40 Hgh-Impedance Groundng Fgure 1 Protectve Functons

3 In recent years, some manufacturers have argued that wth self-dagnostcs (the ablty of the relay to check tself), a relay falure would be mmedately known and the protected pece of equpment could be removed from servce untl the relay was replaced or repared. Most users have found ths phlosophy unacceptable. Ths s especally true n relaton to generator protecton. Even wth a mean-tme-between-falure rate of 70 years or more (based on n-servce operatng experence wth dgtal relays), the consequences of removng a major generator from servce due to a sngle relay falure are unacceptable to most users. The loss of a major generator mmedately ncreases the cost of generaton for a utlty for the tme the machne s out of servce. The utlty compensates for ths lost generaton by ether runnng less effcent generaton n-house or purchasng more expensve power off-system. Even the loss of a moderately-szed (200 MW) generator can cost a utlty and ts customers $100,000 per day n added fuel or purchased power costs. In addton to the economc consequences, many relay engneers fear the falure of a dgtal relay could occur concurrently wth a protecton event when the relay s necessary to protect the generator. Ths paper explores these relablty ssues from the vewpont of both a manufacturer as well as a user. It dscusses one manufacturer s experence wth n-servce falures, as well as the desgn, manufacturng and testng to reduce or elmnate such falures. The role that self-dagnostcs can play n the development of applcaton strateges to survve a sngle relay falure s also presented. DESIGN CONSIDERATIONS TO MINIMIZE FAILURES In the 1960 s, sold-state electronc protectve relays usng dscrete components were developed. These relays used many dscrete components and assocated nterconnectons and therefore were not as relable as equvalent electromechancal relays. Contnued developments n the semconductor ndustry led to the ntroducton of ntegrated crcuts whch combned complex electronc crcuts nto sngle chps. Ths use of ntegrated crcuts reduced the number of components and enhanced the relablty of the sold-state protectve relays. In the 1980 s, the advent of mcroprocessors and hgh-speed dgtal sgnal processors brought a new generaton of relay desgns. These dgtal relay desgns contaned less hardware but requred consderable software development. Usng self-dagnostcs, these relays can detect most relay falures and alert mantenance personnel usng alarm ndcaton. Hardware Relablty The block dagram n Fgure 2 shows the hardware archtecture of a dgtal multfuncton relay used for generator protecton. The voltage nputs of the relay are scaled down from the nomnal 120/69 V to a low level determned by the ADC (analog-to-dgtal converter) nput range. The current nputs to the relay are scaled down from nomnal 5/1 A and are converted to equvalent voltages. These scaled sgnals are fltered usng a low-pass flter to prevent alasng of the hgh-frequency components nto the fundamental frequency component. The fltered sgnals are multplexed usng an analog multplexer and amplfed, f needed, usng a programmable gan amplfer. The multplexed analog sgnal s sampled and converted to dgtal data usng the ADC. The relay uses a dual-processor archtecture wheren the dgtal sgnal processor executes complex algorthm calculatons and the host processor performs all other tasks. Communcaton between the two processors s provded by the dualported memory. Flash memory s used for storng the program and RAM (random-access memory) s used for temporary storage of varables, target nformaton and oscllography. Contact nputs and outputs, user nterface (keyboard and lqud crystal dsplay) and the seral communcaton ports (RS-22 and RS-485) are nterfaced to the host processor. The dgtal sgnal processor executes a varety of sgnal-processng algorthms to estmate several parameters of the dgtzed voltage and current sgnals and transfers them to dual-ported memory. The host processor receves these parameters from the dual-ported memory and performs relay logc and other tmng functons to generate approprate trp or alarm output sgnals. The host processor, runnng under a multtaskng operatng system, also performs several other tasks ncludng: communcatons, setpont updates, target updates, and user nterface.

4 Ant-Alasng Low-Pass Flters (LPF) VTs & CTs v a 2-Lne by 24-Character Lqud Crystal Dsplay vb Analog Multplexer 128K byte RAM vc vn Programmable Gan Amplfer 14-bt Analog-to-Dgtal Converter (ADC) 2K X 16 RAM Dgtal Sgnal Processor (DSP) TMS 20C52 2K byte Dual-Ported RAM 256K byte Flash- Programmable ROM Host Processor 10 MHz Zlog a b c A MUX MMI Module (Optonal) Target Module (Optonal) RS22 and RS485 Communcaton ports Address/Data Bus IRIG-B Tme Code nput Relay Outputs Contact Inputs 512 byte EEPROM 8K byte RAM, Clock wth battery backup Power Supply B Power Supply (Optonal) C N Fgure 2 Block Dagram Possble hardware desgn problems can be dentfed by performng a worst-case analyss durng the desgn stage. Such problems, whch nclude voltage and current stresses, extreme temperatures, power dsspaton and tmng requrements, can then be corrected. Ths can greatly reduce hardware falures n the feld. Falures can also be reduced by usng extended-temperature components, conservatvely deratng the components to lower stress levels, and utlzng components from establshed and relable vendors. Provdng backup for crtcal components can also enhance the relablty of the relay. The dgtal multfuncton relay descrbed above uses redundant power supples. Both power supples are contnuously runnng n a hot standby confguraton and should one supply fal, the other wll contnue to provde requred unnterrupted power to the relay. The relay also sends an alarm ndcaton about the power supply falure to alert mantenance personnel. The analog sgnal nputs (voltage and current), contact status nputs, contact outputs, power nputs, and communcaton crcuts must be condtoned and protected to wthstand the harsh electrcal and envronmental condtons of the substaton and power plant. The desgn of relay nput, output and power supply crcuts must ncorporate flterng to reduce EMI (electromagnetc nterference). The prmary method of reducng unwanted nduced ac voltage s to bypass these voltages to ground wth capactors. Other components, such as varstors, chokes and ferrte beads, are also appled to suppress surge voltages and EMI.

5 Software Relablty The relablty of software n the dgtal relay s crtcal to the overall relablty of the product. The majorty of the software problems n dgtal relays can be attrbuted to desgn and mplementaton errors. More than half of all the errors occur long before the frst lne of code s wrtten,.e., durng requrements analyss and top-level desgn. Most of these errors are caused by poorly-defned requrements but very few errors are detected when they occur. A majorty of the remanng errors occur durng the detaled desgn phase of the development, manly due to poor translaton of the user s requrements nto the programs and data. These problems can be mnmzed by carefully plannng and desgnng before codng starts, resultng n a more relable product. A software qualty assurance plan must be carred out throughout the product development program. Test plans, documentaton, detaled software valdaton and audt programs can greatly reduce software errors. Product falures that are not detected early n the desgn stage can be very costly to fx when they happen n the feld. Software verfcaton and testng of multfuncton relays offer unque challenges to relay manufacturers. Testng should be dvded nto several categores and should be conducted at varous desgn phases. The followng are some of the key tests conducted on dgtal multfuncton relays for generator protecton. 1. Relay algorthm smulaton testng 2. Statc functonal testng. Dynamc functonal testng 4. Envronmental and hardware-related tests 5. Beta-ste nstallaton and testng SELF-DIAGNOSTICS Self-dagnostcs s one of the most mportant features of dgtal relays; t was not avalable n ether electromechancal or statc relay desgns. The ablty to detect and correct a falure before the protecton system has to operate contrasts to tradtonal protecton systems where a relay falure remans undetected untl t fals to operate correctly durng an event or untl the next mantenance test. The qualty of electronc components avalable today s excellent; however, falure of these components can stll occur. Dgtal relays can be desgned to detect most of these falures. The followng are some of the most mportant self-dagnostc functons mplemented on dgtal multfuncton relays. 1. Data acquston system testng Power supply voltages and ground are connected to the analog nput channels of the multplexer and checked aganst warnng and falure thresholds. Ths also verfes the analog data acquston system ncludng: multplexer, programmable gan amplfer, and ADC. The ADC s converson tme s also checked to see f t s wthn the specfcaton. 2. Memory testng The flash ROM contents are checked by calculatng the checksum and comparng t to the pre-computed and stored checksum. The checksum s calculated as the modulo-256 sum of all the bytes. The RAM s tested by wrtng and readng a test pattern.. Setpont testng Setponts are stored n the seral EEPROM and a copy of these setponts s also stored n the RAM for executng relay logc. Whenever any setpont s changed, the checksum of the setponts s calculated from the contents of the EEPROM. Ths checksum s then compared wth the calculated checksum of the setponts stored n the RAM every tme a setpont task s executed. 4. Watchdog tmer The relay hardware desgn ncludes a watchdog tmer reset crcut to take the processor through an orderly reset should the program get lost due to hardware/software gltches.

6 MANUFACTURING METHODS TO MINIMIZE FAILURES Major efforts are made at every step of manufacturng to elmnate falures. At the component level, attempts are made to weed out faulty components. Some components are 100% tested, whle others are sample-tested. The decson as to whch type of testng to do s based on experence wth the falures of that partcular component. Beckwth Electrc selects and uses components that are ndustral-grade or better. Component selecton and approval comes after extensve testng by the Qualty Assurance Department. Once components are tested, the crcut boards are bult. These are then tested to determne f there are any component falures, poor solder connectons, mproperly nstalled components or open connectons. Once ths test s passed, the relay s assembled and agan tested. Each relay s heat-cycled for 100 hours. It s programmed wth factory settngs and comprehensvely tested wth currents and voltages usng a computer-drven, three-phase test set. Each relay s also subjected to ndustry surge tests such as the SWC and Fast Transent Tests outlned n ANSI/IEEE C7.90. To mnmze the chances of statc dscharge falure due to handlng of the components and crcut boards, the floor of the plant has been covered wth an ant-statc coatng n addton to usng grounded handstraps as a standard part of the manufacturng process. Beckwth Electrc has been buldng multfuncton dgtal generator relays snce 1989 and has over 1000 unts of our frst generaton of dgtal relays n-servce around the world. Falure statstcs are carefully kept to attempt to determne f there s any pattern or specfc components that fal. To date, we have had a total of 20 n-servce falures n over 1.6 mllon operatng hours; our mean-tme-between-falures (MTBF) rate s slghtly over 74 years. We have not detected any pattern to these falures. All falures have been detected by self-dagnostcs operatng as desgned (the relay beng automatcally removed from servce wthout trppng the generator). Each year, as we put more relays n-servce, our MTBF rate also ncreases. Another way to look at these statstcs s that f you have ten relays n-servce for twenty years, you could expect roughly one falure. Ths holds true, however, only f past performance s reflectve of future performance. Is there an agng factor? Does the number of years that the relay has been n servce decrease the performance of the relay? Most ndustry experts say no, but ths has not been proven. Based on the performance to date, one can say that ths technology has an excellent relablty record. LEVEL OF REDUNDANCY Gven the performance level of dgtal generator protecton, what s the approprate level of redundancy? On larger generators protected by dgtal relays, the use of fully redundant systems s justfed. Such a scheme s shown n Fgure. Ths system has been adopted by a number of users, ncludng two major manufacturers of large (100 to 1 MW) gas turbnes. Ths level of redundancy s suffcent to allow the generator to reman n servce f one relay should fal. If a major generator s forced off-lne due to a relay falure, the utlty/generator owner wll have to ether generate from less effcent machnes or buy more expensve power off-system. Ether acton wll result n hgher producton costs of over $100,000 a day for the loss of a moderately-szed utlty generator. Gven these costs, the addton of a second relay s certanly prudent even wth MTBF rates that are 74 years or better. The smultaneous falure of both relays s extremely rare. Even wth two dgtal relays, the nstallaton cost s generally less than half the cost of dscrete statc or electromechancal protecton costs, due to panel space and wrng cost savngs. A typcal panel comparson s shown n Fgure 4.

7 Utlty System 52 Unt I N BF-N 51N M-40 M Gen AVR AVR 2 BF BF V 40 60FL 60FL M-420 TN 59N 59N M-40 M-420 Hgh-Impedance Groundng Fgure Dual-Relay Protecton Approach for Major Generators

8 Negatve Sequence s ELEMENT #1 ELEMENT #2 Loss of Feld s 21 AB 21 BC 21 CA Breaker BF 60FL 24 Falure/Flashover N s Φ Φ Phase Dstance s Volts per Hertz VT Fuse-Loss Detecton Thrd Harmonc Neutral Undervoltage TN /59 87 GD Ground Dfferental Inadvertent Generator 59 59I AΦ 59 BΦ 59 CΦ Phase Voltage s Over/Under Frequency s 81 O/U 2 Φ 59 N RMS Overvoltage Neutral Drectonal Power Fgure 4 Panel Space Savngs The desgn of the self-dagnostcs n the multfuncton relay s such that f a falure s detected, the relay wll automatcally take tself out of servce and close ts alarm output contact. The self-dagnostcs s desgned to remove the relay from servce wthout trppng the generator. To date, ths desgn has been 100% successful wth no n-servce falures resultng n the trppng of a generator. Also, all n-servce falures were successfully detected by the self-dagnostcs. Is dual protecton necessary on all szes of generators? The answer s clearly no. If a relay fals, the generator must be removed from servce, by ether manual or automatc trppng methods. If the cost of takng a generator off-lne for a few days to replace a relay s not sgnfcant, then a sngle relay s adequate. The generator owner must balance the cost of an addtonal relay aganst the probablty of a relay falure over the lfe of the nstallaton. Wth a MTBF rate of 74 years or better, smaller generators can be protected wth a sngle relay. Dual protecton s justfed when the cost to the generator owner for the loss of the generator s sgnfcant. Some people have suggested that mportant generators be protected usng two-out-of-three logc. Ths type of logc has been used at nuclear plants for some types of protecton such as second-level voltage separaton. It has not been used to protect generators, even at nuclear plants. Fgure 5 llustrates ths logc. The use of the thrd relay adds securty aganst false trppng by requrng a second ndependent relay to confrm that trppng s requred. Thus, f a relay fals and gves a erroneous trp sgnal, no trppng wll take place because a second relay output s requred. In our vew, two-out-of-three logc s an unnecessary complcaton because of the self-dagnostcs desgned to remove the relay from servce wthout trppng the generator. Wth Beckwth Electrc s frst generaton of dgtal relays, feld experence to date has been 100% successful wth no n-servce falures resultng n generator trppng.

9 (+) CT CT CT Relay 1 Relay 2 Relay Relay 1 Relay 2 Relay VT Relay 2 Relay Relay 1 86G Generator Lockout Relay (-) Fgure 5 Two-Out-Of-Three Logc IMPACT OF SELF-DIAGNOSTICS ON PERIODIC MAINTENANCE One of the major benefts of relay self-dagnostcs s ts mpact on perodc mantenance. Wth conventonal electromechancal and sold-state electronc relays, the user has to verfy that the relay s operatng properly by perodcally njectng currents and voltages. Most utltes do ths every two to three years. Another source of frequent falure s the external wrng connectons between prmary relays to provde the logc requred for trppng. Generator protectve relays are frequently supervsed by VT potental falure (60) logc, generator crcut breaker poston and generator termnal voltage. Ths logc frequently requres the use of numerous auxlary relays whch reduces the overall system relablty. In today s modern multfunctonal dgtal relay, ths type of logc s programmed nto the relay. Once programmed, t s checked by the same self-dagnostcs as s the prmary relay logc tself. What type of perodc mantenance s meanngful for dgtal relays? We beleve the user should perodcally check the nputs to the relay. Extensve nput meterng nformaton can be accessed ether va computer or locally by the man-machne nterface. Ths nformaton ndcates the relay s recevng proper nput data. An example of such a meterng computer screen s shown n Fgure LAG Fgure 6 Computer Meterng Screen

10 The user should also perodcally actvate the dgtal relay trp output contacts to verfy that they are workng and are wred to perform the desred external trppng and alarmng. A convenent means should be provded to sequentally actvate each of the output relays to facltate ths type of trp testng. Both types of nput and output functonal tests descrbed above should be done on a perodc bass. The need to do costly and tme-consumng current and voltage njecton testng has been sgnfcantly reduced by self-dagnostcs. Many utltes have extended the perod for ths type of testng from two or three years to ten years or longer. Ths s a sgnfcant mantenance cost savngs provded by dgtal technology. CONCLUSIONS Ths paper descrbes how the desgn and manufacturng methods are used to reduce n-servce falures of dgtal multfuncton generator relays by a major manufacturer. It presents the resultng falure statstcs based on over 1 mllon hours of n-servce experence. Even wth hgh relablty levels, the use of redundant protecton s recommended for major generators where dgtal multfuncton relayng s the sole source of protecton. To determne the generator sze at whch a second redundant relay s justfed, measure the cost of the generator loss for the tme t takes to nstall and commsson a new relay. The user must balance the costs of an addtonal relay aganst the probablty of a relay falure over the lfe of the nstallaton. Two-out-of-three logc s an unnecessary complcaton because self-dagnostcs s desgned to remove the faled relay from servce wthout trppng. Feld experence to date has been 100% successful wth no n-servce falures resultng n generator trppng. The mantenance mpact of self-dagnostcs results n a major savngs allowng the user to substantally extend the current- and voltage-njecton testng perod. Functonal testng of the relay nputs and outputs, however, s recommended on a more frequent bass. REFERENCES [1] A Dgtal Multfuncton Relay for Interte and Generator Protecton, Murty V.V.S. Yalla and Donald L. Hornak, Canadan Electrcal Assocaton, March [2] A Dgtal Multfuncton Protectve Relay, Murty V.V.S. Yalla, IEEE Transactons on Power Delvery, Vol. 7 No. 1, January 1992, pp [] Upgradng Generator Protecton Usng Dgtal Technology, Charles J. Mozna, Canadan Electrcal Assocaton, March BIOGRAPHIES Chuck Mozna s currently Manager of Applcaton Engneerng for Protecton and Protecton Systems for Beckwth Electrc Co. He s responsble for the applcaton of Beckwth products and systems used n generator protecton and nterte protecton, synchronzng and bus transfer schemes. Chuck s an actve member of the IEEE Power System Relay Commttee and s the past charman of the Rotatng Machnery Subcommttee. He s the U.S. representatve to the CIGRE Study Commttee 4 on System Protecton and chars a CIGRE workng group on generator protecton. He also chared the IEEE task force whch produced the tutoral The Protecton of Synchronous Generators. Chuck has a bachelor of scence n electrcal engneerng from Purdue Unversty and has authored a number of papers and magazne artcles on protectve relayng. He has over 25 years of experence as a protecton engneer at Centeror Energy, a major nvestor-owned utlty n Cleveland, Oho. He s also a former nstructor n the Graduate School of Electrcal Engneerng at Cleveland State Unversty. Dr. Murty V. V. S. Yalla s currently Vce-Presdent of Research and Development Engneerng for Beckwth Electrc Co. where he s responsble for the development of new products n the areas of dgtal control and protecton of power apparatus, and the desgn enhancement and engneerng support of current products. He had prevously served as Beckwth Electrc s drector of research and development, staff engneer and senor engneer. Dr. Yalla s a senor member of IEEE and s actve n the Power System Relayng Commttee. He has publshed several research papers on dgtal protecton n varous nternatonal journals and s the co-author of three patents. Dr. Yalla s degrees, all n electrcal engneerng, nclude: a bachelor of scence degree from Jawaharlal Nehru Technologcal Unversty, Kaknada, Inda; a master of scence degree from the Indan Insttute of Technology, Kanpur, Inda; and a doctorate from the Unversty of New Brunswck, Canada. Pror to jonng Beckwth Electrc n 1989, Dr. Yalla taught and conducted research n the dgtal protecton of power apparatus at Memoral Unversty of Newfoundland, Canada.