Don’t Neglect Your Protection Systems

by Gregg Massar – Performance Engineer, Engineering & Technical Services

Protective relays and their associated components play a critical role in a power-generation facility. We all understand their basic purpose, which is to trip a generator or other component, but they do a lot more for us than you might think:

• Reduce the chances that a tripping event will affect other equipment.
• Decrease the cost of repairing the damage.
• Reduce the time it takes to make repairs.
• Lessen the overall financial impact of the event.

To ensure they perform these functions, however, you need to maintain the systems according to industry and NERC standards. Granted, it’s been tough to keep up with the ever-changing NERC requirements over the last 10 years. While they’ve made us more conscientious about maintaining our protection systems, there are still a lot of gaps in the industry. We can learn something from an overview issued by NERC of relay failures that occurred between 2011 and 2015.

As the chart shows, ‘relay failure’ doesn’t necessarily mean that the protective relay failed. In fact, out of all these ‘failures,’ only 21 percent resulted from a problem with the relay itself. Another 29 percent were attributed to external elements of the protection system that support proper operation — communication, circuitry, power supplies and other components. Approximately 15 percent of these issues were categorized as ‘other,’ indicating that the cause was not described specifically enough.

A surprising 35 percent, however, were attributed to human error. In other words, some human activity – a setting, a wiring problem or just a lack of planning – resulted in a trip or other event.

As protection systems get more sophisticated, they also become more complex and difficult to understand. To maintain an old electromechanical relay, you had to deal with springs, actuators, contacts and capacitors. You had to test only a single element setting. While not exactly simple, they were discrete devices that performed a single function.

A newer microprocessor-based digital relay, on the other hand, performs multiple functions and processes different layers of logic simultaneously at very high speed. To maintain one of these, we have to look at the general configuration of the relay (e.g., instrument transformer ratios, nominal settings, etc.); protection element settings; mapping of all inputs and outputs; supervision logic for alarms and internal functions; communications with other devices and elements; and coordination of protection with other equipment. It requires a lot of planning and a detailed understanding to ensure that this device operates properly – as well as competent personnel to implement the design.

To get a better feel for these challenges, let’s look at some real-world examples we’ve encountered recently at NAES-operated facilities:

• Incorrect current transformer wiring: Several facilities have returned from a unit outage and had a trip caused by incorrect rewiring of current transformers. In every case, a number of root causes were found – improper drawings, improper wire tags, and/or improper QA/QC after the devices were wired back up.
• Trips during NERC MOD testing: Many of the new NERC standards require units to test real and reactive power at levels higher than those at which they are used to running. Although studies and evaluations were performed ahead of time to understand where trips were set, tests ended up uncovering settings that were previously not known, documented or understood.
• Transformer low oil level trips: A number of units have had trips caused by low oil level that was attributed to the visual level indication not matching actual. The plants perceived the oil level to be higher than actual.

• Incorrect instrument transformer ratios: At a few plants, testing or actual events uncovered CT ratios set in relays that didn’t match field conditions, resulting in inadequate protection.
• Outdated drawings: Facilities found during circuitry testing that actual as-found wiring did not match as-built drawings. This could’ve resulted from improper documentation of modifications during commissioning or maintenance activities – or from improper field verification during system setup.

We could cite numerous other examples of improperly documented or maintained protection systems resulting in trips or other events. This is why it’s critical to maintain your protection systems – not only for the sake of regulatory compliance but to minimize the damage from an actual fault and ensure the unit’s overall safety and reliability.