Primary and backup independent trip circuits 4

[Mbrooke]

Ok, so I am hearing arguments for 2 methods of connecting the 2 independent trip circuits on each circuit breaker. One is for relay A (primary) to activate only trip coil 1, and relay B (backup) activate trip coil 2. My thinking is that OUT101 should trip coil 1 and OUT2 should trip coil 2 on relay A with OUT101 and OUT102 on relay B being in parallel. The argument for the first option is that you don't loose an extra high current output.

What is typical for you guys?

 

[davidbeach]

We started with that type of cross tripping. After a few we realized that testability would be much better if we kept everything separated to the extent possible. Now we have an A DC and a B DC and try to keep them apart as much as possible. At a minimum A and B come from different DC panelboards, ideally from different batteries.

What you're doing will get you a trip with more separate contingencies than we'll get, but we believe we can maintain the relays with the position in service with less risk.

The one thing we can't keep isolated between the two relays is the single close coil.

 

[Mbrooke]

Everything is separate except as you mentioned the trip coil. The only advantage I see to having both coils to one relay is the failure of one trip coil while a relay is out of service will have no negative side effect.

In my relaying topology all the relay input and outputs can be isolated via test switches to mimic the draw out ability of old electromechanical relays.

 

[davidbeach]

It's one of those things where there's lots of different approaches. In addition the art and science of protection there's also the whole philosophy of protection discussion.

You're right about that one relay out and the opposite trip coil fails condition; in the newer installations we continuously monitor the trip coils and we have breaker failure protection.

If cross tripping fits your operation then go forth and prosper. In our case I wish we either hadn't started down that path or that we'd never changed. Now we have a few odd-balls. At this point we have a whole lot more A is A / B is B installations than cross trip installations and I've found consistency to be a major virtue. For us now cross tripping is undesirable and we'll eliminate it opportunistically.

 

[Mbrooke]

Sounds like eliminating cross tripping has been a major improvement for you guys, but Im still somewhat confused as to why. Or is it just from a consistency stand point?

My major concern is that you loose one of your high current outputs on the relay (103) which is normally used as a master lockout (BF) initiate trip.

 

[davidbeach]

The full separation is the culmination of a long process that started with the both relays and the breakers on single DC circuit with the relays inter-wired to where now have as few connections in common as possible. We're happier, but that's us.

The 411L part number we order has two IO boards with 13 'H' outputs and 2 form 'C' outputs. OUT201/OUT202 are Trip and Close for the first breaker and OUT301/OUT302 are Trip and Close for the second breaker. If you're hardwiring various alarm outputs from the relay to SCADA you probably don't want that IO board, but our SCADA outputs (other than relay fail) are read by DNP and aren't hardwired. We can still pulse the output and hear the relay click but we don't need the wires. The 'H' outputs bleed enough that they can cause a high impedance input to pick up.

 

[Mbrooke]

I thought about 2 IO boards, and I think that option is available on the 311C also? I was under the impression that you wanted the extra outputs for SCADA hard wired alarms and annunciation.

 

[davidbeach]

You can definitely get two IO boards in the 311C, but I don't recall the various configurations off the top of my head.

 

[Mbrooke]

Thats fine, I can look at the SEL's flyers and spec sheets.

 

[Mbrooke]

And also, I know people will make the comment that I do not need high current interruption because the breaker's coils and lockout relay will be denrgized first before the relay's contacts open, however in reading manufacturer literature on documented failures every single contact fault has been cause by the relay's internal contacts trying to break normal coil current.

 

[davidbeach]

Where we don't have the H outputs we'll put an SEL-9501 across every output used for either trip or close.

 

[submonkey]

Hi Mbrooke,

Protection systems are highly reliable because
they are (usually) made up of two independent
schemes which must both fail before the protection fails to operate. The chances of
both failing at the same time are very low.

Building a single monolithic system of
any complexity with no failure modes is
very difficult - practically impossible.
Building two monolithic systems with reasonable reliability is easy.

The key point is that the two systems must
be independent. They must not share common
failure modes.

The more you interconnect your 'A' and 'B'
protection, the more you stray into trying
to build the single monolithic system.

DC circuitry can be accidentally connected
to low voltage AC. I have seen cases where
primary flashovers have damaged DC wiring.
Interconnected circuits can misbehave in
unexpected ways. Difficulties in separately
proving the 'A' and 'B' protection can lead
to errors in both.

I put a very high value on 'A' and 'B' independence, and in my opinion attempts
to 'improve' reliability by cross connecting
are almost always a mistake.

Anyone who assumes they can predict all failure modes will eventually be punished
for their arrogance.

Thanks,
Alan

 

[Mbrooke]

In larger stations I even go as far as having separate VTs for both primary and backup relaying, so I guess what you say goes hand in hand with my original philosophy. However, playing devil's advocate, what is the worst that could happen with cross tripping? In my eyes a short circuit, but that would just trip the breaker. But, I am probably wrong lol.



@DavidBeach, I had not considered an SEL arc suppression device. Great recommendation, thank you

 

[Mbrooke]

Looking things over, should I consider running two separate close conductors all the way back to the breaker or leave that as the only 2 wire pair being shared between the two relays?

 

[marks1080]

Careful when you refer to a system as a 'backup' system. In my region I wouldn't consider a primary and backup protection system to be equivalent to an independent 'A' and 'B' system. Not at all.

Primary and Back-up protections seem to be a legacy thing to me. I often work on old sites that have a primary 'A' bus protection with a bus back-up protection. I would never issue a new green field design like this now. I would only use fully independant 'A' and 'B'. These rules can get squiffy at different voltage levels.

Just a little more insight on a 'back-up' protection: If you have a fully redundant 'A' and 'B' protection on some HV element, there generally is no issue taking a protection outage on either the 'A' or 'B', because they are duplicated systems. However, this may not be the case for primary and back-up. It may not be acceptable in some parts of a grid to leave an element in service with ONLY back-up protection. Typically when you call something a 'back-up' protection it's almost implied this is not a full protection with all the capabilities of the primary protection. It is a back-up last chance option to trip an element if there is a failure of the primary protection. It generally wouldn't have the same 'instantaneous' tripping ability as the Primary system.

 

[Mbrooke]

Good point, but in all honesty (in my case) primary and backup is a catch all term for both identical fully functional A and B relaying (like 2 SEL421s per bay) in addition to scenarios like a main relay with a last resort limited protection backup (like a SEL387 and an SEL501 backup) for a 35kv to 12kv transformer.

It generally wouldn't have the same 'instantaneous' tripping ability as the Primary system.

Well, that can vary by application. Above 35kv (for me anyway) its generally not the speed or protection quality itself sacrificed, rather the "superfluous" abilities of the second relay. For example: very short line spans (like substation to generator) might have something like an SEL311L and with an SEL387L or a typical 115kv line might have an SEL311C with an SEL321. Both provide instantaneous tripping, and both the 311C and 321 may have POTT or DTT, however one relay (backup) is not capable or not set to perform functions such as auto-reclosing, event data recording, control of MODs, ect, ect, ect. The idea is that protection needs come first, and unless other functions are absolutely essential beyond that; a much cheaper, function limited secondary (backup) relay is used.

On things like 345kv and above, the general design idea is having having everything identically replicated with any relay having the full ability of the other. To sum it up 3 types of primary and back exist for me:

Level 1. Full protection primary relay with an essential protection limited backup (such as transformer differential, neutral over current, buckholtz, overtemp, ect A; over current 50/51 only B). Typical for 12 to 66kv systems.

Level 2. Full spectrum protection only for both primary and secondary relaying, with secondary having no burden beyond protection. (such as a 115kv transmission line where both A and B posses identical step distance, POTT, 87, ect; however B does not provide anything beyond that like auto reclosing) Typical for 69kv to 230kv

Level 3. Full protection, monitoring, recording and control capabilities for both A and B relays. Any can do the full work of the other no limitations. Often done via 2 identical relays. Typical for 345kv and over.

However, thats not to say Level 3 is like Level 1 or 2, even though every application gets called primary and backup.

 

[Mbrooke]

Also, to add. At Level 3, the requirements are to keep everything as separate as possible, including controlled voltages kept to the same bank of cabinets/racks unless its necessary for protection like with transformer protection. Ie, All 500kv relaying to one section, 345kv relaying to another and so forth. All DC circuits in separate conduits and spaces. "Primary" batt banks isolated in a different room than Secondary batt banks, dedicated chargers and all. Some ultra critical application have yet a 3rd isolated bank that can take the place of either P or B.


And there is a Level 0, but thats basically where no backup exists provided a relaying failure is caught by upstream devices not necessarily meant for normal protection of said equipment. Ie, at the 12 and 4kv levels a single feeder relay may be used provided that a feeder relaying failure during a fault is still cable of encroaching the 50/51 or zero sequence elements programmed into the 35-12kv transformer protection relays so long as the transformer itself, buss bar, feeder cables and distribution line are not subject to thermal (or other noted) violations.