"Fail Safe" Trip Circuit for MV Motors Fed By Circuit Breakers

[rcw retired EE]

What does your plant do if a motor controlled by a MV circuit breaker is running and the DC trip circuit fails defeating the normal trip?

1. Automatically trip immediately using a back up source and accept the process upset?
2. Alarm the failure and let operators determine the best course of action: manually trip at the breaker faceplate, let the motor run unprotected while the problem is fixed or the process is set up to handle the trip, trip the MV Main Breaker, or??
3. Install dual trip coils with separate power source and trip contacts?
4. Use capacitor trip device to maintain tripping power for a few seconds on DC failure?
5. Use Breaker Failure scheme that trips upstream breaker?

Our client operates a 300 MW two-unit power plant and was concerned about not being able to stop large (1- 4 MW) motors fed by 6 kV circuit breakers if the breaker 220VDC control power fails. They added de-energize-to-trip relays that supplied +220VDC from another circuit off the same unit battery to the breaker's single trip coil. The trip relay was actuated (dropped out) by a series string of the Unit Master E-Stop, DCS Watchdog and Protective Relay Fail contacts powered from the breaker trip circuit. Any loss or dip in DC power trips the major motors: boiler fans, boiler feed water pumps, cooling water pumps, etc. If the DC problem is at the main unit battery or the main distribution panel, the backup trip power is also affected so the "Fail Safe" trip doesn't work and the plant continues to produce power.

The plant had a couple inadvertent trips and has blocked the Fail Safe relays in the non-trip position. We were asked to review the system and make recommendations.

Some things we found:
[ul]
[li]220VDC time delay off relays don't time when power fails.[/li]
[li]DC under voltage relays don't actuate if the voltage drops to <15% or the relay control power goes away.[/li]
[li]It is not possible to retrofit these Chinese circuit breakers with dual trip coils.[/li]
[li]The more complicated the circuit, the more chances there are for misoperation.[/li]
[/ul]

The plant was designed and built by a Chinese contractor. We believe it is a standard design used on many fossil fuel power plants.

Our normal design on motor circuits uses the protection relay to alarm in the DCS for a control circuit failure: Loss of DC power, Trip Coil Monitor alarm, or Protective Relay Failure. No automatic trips are initiated on loss of control power. It is up to the operator to decide the best course of action. Trip circuit failures are rare and are not dangerous unless a motor circuit failure also occurs. The switchgear is usually within a 2 minute walk of the control room for a quick response to the problem. A short circuit will eventually get picked up by the upstream relaying. This philosophy maximizes production, gives the a chance to correct issues before tripping but risks equipment damage if simultaneous failures occur or the control power loss was related to an attempted protection trip.

What is the industry consensus? Trip immediately on control power failure? (How do you trip without control power?) Alarm only and give operator time to correct problem? Or ??

Thanks for any input.

 

[ppedUK]

If your switchgear is conventional spring close / open mechanism, then a solution might be to fit a DC No-Volt release coil on the breaker. This is becoming more common on embedded generator schemes (where the generator manufacturer doesn't want their machine destroying because it can't be tripped off the grid) for the same reasons as your Client's concerns. However if you cannot fit such a coil to the existing gear, then you are limited in what you can do for this failure scenario, but note that although some breakers cannot be fitted with 2 shunt trip coils, they can sometimes be fitted with one shunt trip and one DC No-Volt release.

A breaker fail scheme is of no use if your tripping battery has failed.

I have have been forced (by the Client) to install magnetic actuator breakers on some of the afore-mentioned generator schemes, and the only way we could guarantee disconnection from the mains on Tripping supply failure was install capacitor tripping units and No-volt relays to trip the breaker immediately on failure of the DC tripping supply, but the system still relied on the magnetic actuator coil being healthy and therefore this also had to be supervised.

 

[waross]

How about a relay to connect a second battery bank and activate an alarm in the event of the failure of the main battery?

Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[cranky108]

I have used a capacitor trip device, where we had no batteries in the substation.

Or don't lose battery DC power. Just like that. Do the design to prevent or reduce such DC outages, and increase maintenance.

Battery testing also helps identify end of life for the battery.

 

[rcw retired EE]

Thank you for the input. We looked at using an undervoltage release, but the Chinese supplier (Tianshui Chancheng Switchgear Co.) has not provided information on second trip coils or under voltage release.

We have had poor experiences with undervoltage release coils on distribution breakers tripping on control voltage dip.

DC, de-energize to trip relays have also created issues when the plant switches from battery A to B with a short dead time in the transfer. Adding an automatic trip on loss of DC voltage is asking for inadvertent trips, but it may be the only way to be "Fail Safe". Use of a time delay to ride through dips would minimize inadvertent trips but we haven't found a time-delay-on-drop-out DC relay that works without power. Client believes pneumatic time delays are not good in the dusty coal plant environment.

Cap trip units work well if the circuit is only trying to operate the trip coil and not maintain power to the protective relay(s) and associated auxiliary anti-pumping and trip seal-in relays. We looked at a diode isolation scheme to use the fail safe trip from a different source on the same trip input, but the seal-in circuits internal to the relay and breaker backfeed power to the entire breaker operating and protection circuits. Multiple cap units would be required on each breaker.

The 800Ah, 220 V battery banks have battery condition monitors, ground detectors, insulation monitors, two redundant banks of five chargers and multiple ways of feeding the switchgear's "Mini-Bus" distribution panels. Battery system should be reliable.

At client's request we are looking at a DC transfer switch that could power the switchgear from the other unit's battery on loss of the primary DC. I have concerns about automatically energizing a bus without knowing if voltage was lost due to a fault. DC fuses and circuit breakers don't give enough information to know if the fault is still present. On AC, transfer is inhibited if the trip was a short circuit.

Client did have a motor protection relay failure, Bad News/Good News. Operator noticed BFP flow was good but pump motor amps were zero on DCS. Electrician found no 4-20 mA signal from protection relay with relay trouble lamp lit, no DCS alarm. They isolated relay and replaced bad I/O card without affecting the pump operation. I'm using that as an example of what could be done with good alarms and operators.

Thanks again for the input.

 

[LionelHutz]

To me, the only real fail safe scheme uses under-voltage release coils. But, that can cause lots of undesirable trips.

So, you just have to plan out an operating scheme that best suits the system. This involves both a well planned system and trained operators and maintenance people.

I would have thought that loss of DC would not be one of the major concerns. A well maintained battery bank and good wiring practices should eliminate most DC supply issues.

Two trip coils can help make the breaker more likely to be trip-able, but if you have a single relay then that's still a single point of failure.

Cap trip units are really only good to power the trip coil. So, a wiring scheme with hard wired trip button/switch just allows the operator to trip the breaker remotely.

I suppose true redundancy would be duplicates of everything from the source to the trip coil, but I doubt you'll find many places with that kind of system. That system could still get false trips on one of the systems.