1 Introduction

Conventional protective relays cannot cover the whole power supply configuration because of the combined effect of economy and technology on the configuration of current transformer (CT) used in the design and construction of the power grid. A fault occurring between a circuit-breaker and the CTs cannot be eliminated by busbar protection. Similarly, the fault also cannot be isolated by breaker failure protection rapidly because of the time delay involved. As a supplementary form of protection, dead-zone protection can be installed to isolate faults quickly to avoid affecting the operation of the segments of the power system grid that are 220 kV and above [1, 2].

A mal-operation of dead-zone protection occurred in the 500 kV Cuiabá substation within the Brazilian Midwest Grid on September 19th, 2012, because of the time delay mismatch between the circuit-breaker main pole and auxiliary contact when its position changed from “OFF” to “ON” during re-closure. The defects in the protection scheme are identified by analyzing the operation behavior of the functional component. Promotion plan are suggested and verified by experiment using a test platform.

2 Operation process

2.1 System single line pre-fault

There are three 500 kV outgoing lines, two main transformers and two shunt reactors in the Cuiabá substation shared by two different transmission companies, TME (Transmissora Matogrossense de Energia) and ITE (Itumbiara Transmissora de Energia). The assets to the left of the dotted line in Fig. 1 belong to TME and to the right belong to ITE. Figure 1 shows the system single diagram, in which a fault occurred at location F. The primary equipment are all air insulated system (AIS) and all circuit-breakers’ positions in the “ON” condition.

Fig. 1
figure 1

System single diagram pre-fault

2.2 Protection configuration

REB500 decentralized busbar protection system and REL531 pilot distance protection were adopted for the busbar and line, respectively. The configuration for line protection was redundant and there was one set of busbar protection. Each busbar protection set consisted of one center unit and four bay units. Communication between the center and bay units was through an optical cable [35]. Automatic re-closure was employed with line protection, and the timer setting was 700 ms. Breaker failure protection, dead-zone protection, over-current protection and current measurement of each branch were implemented in the bay units, while busbar differential protection was completed in the center unit.

The configuration of CTs for the line protection zone and busbar protection overlapped, and the current transformers in bay A had 2,000:1 CT ratio, while the others had 2,000:5 CT ratios.

In addition, the busbar protection system belonged to the ITE company. The circuit-breaker (TME’s assets) position that busbar protection needed was wired from an intermediate relay within the auxiliary protection because of limitations of the position signal contact.

2.3 Process of protection operation

On September 19th, 2012, shutdown occurred on the 500 kV Cuiabá-Jaurú line (LT_JAURU) because of a short circuit that involved phase A and the earth. It was eliminated by the operation of pilot distance protection on this line. After 702 ms, automatic re-closure of the line acted, but failed because of the permanent fault and thus triple tripping occurred, caused by the operation of the same protection unit. After 40 ms all the breakers connected to busbar I also tripped because of the differential protection of this busbar (The wrong configuration resulted in the operation of the busbar protection because of the link between the measuring component and bay’s circuit-breaker position) [6]. Table 1 shows the sequence of events.

Table 1 Sequence of events

3 Analysis and comparison

In this accident, four protection components operated, including pilot distance, automatic re-closure, dead-zone protection and busbar differential. It was confirmed later from the disturbance recorder report and a site inspection that phase A had a permanent fault with earth.

3.1 Behavior analysis on dead-zone protection operation

The operation of dead-zone protection, which will not operate unless faults occur between the CTs and the breaker, is the most likely cause of this accident, while the breaker was normal after later examination. By analyzing the dead-zone logic scheme of the REB500 (see Fig. 2), the breaker position signal appeared to be the probable source of the problem. In the operation, the time delay of the breaker position changing from “OFF” to “ON” was about 92 ms, which was greater than the typical value (37 ms). Figure 3 shows the sequence of dead-zone protection [4].

Fig.2
figure 2

Logic scheme adopted for dead-zone protection

Fig. 3
figure 3

Sequence chart for dead-zone protection

Upon inspection, the “close command” signal mentioned in Fig. 2 was seen to be absent in the adopted busbar protection in this substation, and was the same in other substations.

The recorder picture shows that the fault current existed for 78 ms, and the time delay between the main pole and auxiliary contact was more than 36 ms. During this period, when the breaker’s main pole was “ON”, and the fault current detected by the relay was 0.77 A, which was greater than the setting value (0.1 A). Thus, the condition in logic scheme (see Fig. 2) that the current of any phase is greater than setting was considered true. Another condition indicates that the breaker position is “OFF” was also considered to be correct because the breaker position was detected by protection device as “OFF” during the time delay between the main pole and the auxiliary contact. In addition, the “close command” signal had no influence on the logic because of absence, and thus dead-zone protection acted after 36 ms. This was consistent with the site situation.

3.2 Analysis of dead-zone protection scheme adopted [7, 8]

Figure 2 shows the operation scheme for dead-zone protection adopted in the Brazilian system, which was determined by the following conditions: first, the breaker position signal, second, the current of any phase, and finally the block signal (“close command”). Dead-zone protection will be activated after a further time delay (set to 36 ms) when all the above items are true. To ensure that the protection bases its decision on an effective image of the circuit-breaker status, the position signal “OFF” was delayed with a configured timer while the circuit-breaker was actually opening. In addition, the timer t2 (set to 200 ms) was the width of the tripping command. The purpose of this timer (36 ms) was to enable the detection of a circuit-breaker close command that was subject to internal signal transit times and breaker contact bounce times [6]. This logic adopted by protection has the following three drawbacks.

  • Poor ability to avoid mal-operation

It is simple for the operation of dead-zone protection, which has a strong effect on the power system, depending on the circuit-breaker position and the current detected. It is also very easy to meet these items above in normal conditions, such as when the circuit-breaker opens on its own.

  • Application of the signal is ambiguous

It is not clear whether the “close command” occurs because of a re-closure signal, manual close signal or a combination of the two. In addition, the requirements for the time delay between the auxiliary contact and main pole are also not clear, especially when the circuit-breaker position is wired from an intermediate relay or other middle stages.

  • Logic diagram fails to reflect the protection function as originally intended

On analyzing the logic scheme, there is the misunderstanding that the dead-zone protection should act as long as the circuit-breaker position is “ON” and the current is greater than the settings, which runs counter to the original intention.

3.3 Analysis of dead-zone protection logic adopted in the Chinese power grid

The dead-zone protection scheme applied in China has a different logic scheme according to the different system single diagram, such as one-and-a-half or double busbar, etc. Figure 4 shows the protection logic adopted in the one-and-a-half single diagram. The dead-zone protection will act after a setting time delay when the following conditions are met: the protection has already received triple trip signals or a trip signal of phase A, B, C simultaneously, the over-current component has already acted, and protection has already received the position signal which indicates that the circuit-breaker position was “OFF”.

Fig. 4
figure 4

Logic scheme of dead-zone protection adopted in China

The logic applied in China is not perfect compared with dead-zone protection logic adopted in the Brazilian power grid, but it has certain advantages.

  • Criterion is well thought out and easily achieved

Besides the circuit-breaker position signal, operation signals of the protection system such as line, etc, are also adopted by protection, in addition, settings and criteria are shared by the over-current component and failure protection, all these keep the implementation straightforward. The protection logic also reflects the original intention of dead-zone protection that the fault cannot be removed at all after the protection has operated.

  • Good ability to prevent mal-operation

The condition, in which the circuit-breaker position is “OFF” and a triple trip occurs when the protection acts, is not simultaneously satisfied by the logic scheme in a normal situation.

  • Flexibility in coordinating time

It is clear that dead-zone protection sends a trip command to the next circuit-breaker, activates the remove trip command and isolates all sides of the transformer after t1, t2, and t3 time delays, all of which better reflect the “Selective” feature of the relay protection and avoid further development of the accident.

4 Solutions and verification

Three measurements were made when defects similar to the characteristics of the Brazilian power grid were applied. First, the signal, such as the circuit-breaker position, which has an influence on protection performance, should be wired directly from an auxiliary contact if possible, and avoid an intermediate relay that can add an uncertain time delay. Second, a test should be launched to measure the time delay between the auxiliary contact and main pole of the circuit-breaker. If the time delay is greater than 30 ms, the “close command” signal should be wired. The time delay value ensures that instrument error and the transformer time needed for the signal should be taken into account. Third, if the time delay tested is less than 30 ms, the port for wiring the “close command” signal may link directly to ground to avoid mal-operation of the dead-zone protection.

A test platform was constructed and a disturbance recorder used to ensure the output was the same when the fault occurred [9]. The same model devices installed on-site were adopted to ensure that the environment was the same as the substation site. The pulse duration of binary operations, such as the circuit-breaker position, was configured according to different situations. The correct operation of the solution was verified by the results.

5 Conclusions

By analyzing this accident, we acquire insights for the construction and application of relay protection in China.

5.1 To further strengthen standardized construction of relay protection design

With the need for construction of a Smart Grid, especially with the wide application of the IEC 61850 standard in substations, standardized design and construction, including component modeling, function interface, function configuration and function test on the relay protection design should be further strengthened based on the achievements in previous standardizations to keep pace with the trend for the gradual integration of relay protection technology with information and communication technology.

5.2 Adhering to correct and mature application principles of relay protection

Brazilian upgrades in electrical power systems and their operation have accumulated much successful experience, some of which has developed into a standard, but their practical application is not mandatory. During the development of a Smart Grid in China, we should adhere to correct technological and application principles proved by practice, such as the “Four Features” of relay protection, principle of distribution independence, redundant configuration and various anti-accident measures, which can remove those potential faults and will influence the reliability of relay protection, giving full recognition to relay protection as the “First Line of Defense” for power grids in general.

5.3 Focusing on the influence of the construction mode on building reliability into the relay protection system

The construction of the Brazilian power grid mostly adopts the EPC (Engineering Procurement and Construction) model, which optimizes its function and design as well as reducing the cost of construction to some extent. Conclusions can be drawn from the analysis of many faults, and experience in operation, that these potential faults are systemic and built in during design and construction, and are difficult to detect by experiments before commission. The construction of the power grid in China is changing from one based on professional and system integration to merging with the primary, secondary and EPC model. We should not reduce the reliability of relay protection and influence the safety and stability of the electrical power system because of the cost savings and optimization of design and function. Thus, we should place emphasis on the effects of transforming the construction model.