Transformer redundant protection design

[obut4]

Hello,

The problem is following: we have 2 redundant numerical differential protection relays for a generator step up transformer.
Each numerical relay has it own separated 125 Vdc power supply and lockout relay.
There are 2 separate channels.

We receive only one dry contact (not 2) for each of the following protections:
- Pressure relief device
- Oil temperature trip
- frame temperature trip
- etc

How can we use these signals to trip both channel?

Can we send 50% of these signals on the Channel A and the other 50% on channel B?
In this case only one channel will trip each time.

The only solution i see is to duplicate the trip signals with auxiliary relays which must be supplied by a redundant power supply. To obtain redundant power supply, we will need a DC/DC converter (125Vdc/125Vdc) to provide galvanic isolation between the 2 independent 125VDc power supply.
I'am not sure introducing additional relays, DC/DC converter is the best solution.

What is the best practice?
Did you already meet this problem?

Thanks for your help.

 

[dpc]

Not sure of specific regulations for reliability, but I would probably just split them between the A and B side lockout relays. This is equipment protection, so from a grid perspective, reliability of tripping is not quite as high of a concern. The transformer has a multiplicity of protective devices. Besides for true redundancy, you'd need two of each monitoring device - not just two contacts from a single device.

Just an aside: you could diode auctioneer the two 125 V DC supplies. No need for a converter that I can see.

 

[cranky108]

Because the transformer trips are not consitered "Protective relays" they don't have to be redundit.

Specify why each of these would operate for a fault that the "Protective relays" would not, and you will see they will operate for either a non-fault, or they should be slower than the protective relays.

 

[odlanor]

dpc,
with your diode auctioneer you eliminate the security of 2 separate channels for protective relaying.

 

[dpc]

I'm only talking about using diode auctioneering to power the aux relays he was proposing, not the entire protection system. If properly fused, I don't think I'm eliminating anything.

 

[jkristinn]

I agree with dpc, I would (and have) split them.
But try to distribute them wisely (e.g. Buchholz and PRD on different channels, oil and winding temps on different channels, Buchholz and RPRR on different etc.).

 

[obut4]

Thank you all for your replies.

We will split the signals.

When paralleling two independent 125Vdc power supply diode, everything is ok until there is a ground fault.
Usually the voltage is -62.5 Vdc and +62.5 Vdc.
The two (-)of the power supply are connected together and the 2 (+) are paralleled with diodes.
If there is a ground fault on the (-) of one 125 Vdc circuit, the other one will also be affected.
Therefore we have considered a DC/DC converter with galvanic isolation.

I have an additional question.
If we need the generator breaker status for a redundant protection system with 2 separate channels and only one contact is available what is the solution if the customer can not supply a second contact?

Thanks for your help!

 

[xnuke]

In my experience, true redundancy is only possible if the equipment specification is written to require redundant components for use in a protection system, and this spec has to be provided to any potential vendors before you purchase the equipment. Otherwise, you only get one contact as you've described.

xnuke
"Live and act within the limit of your knowledge and keep expanding it to the limit of your life." Ayn Rand, Atlas Shrugged.
Please see FAQ731-376 for tips on how to make the best use of Eng-Tips.

 

[jkristinn]

If we need the generator breaker status for a redundant protection system with 2 separate channels and only one contact is available what is the solution if the customer can not supply a second contact?

As you might guess, you need an auxiliary relay to multiply the GCB status, better have that a fast acting relay from a reliable manufacturer. You might consider connecting the GCB auxiliary contact directly to one protection channel (e.g. channel A) and the auxiliary contact in parallel. This way you don't get the time delay on the signal to channel A, only to channel B. But other design factors, i.e. regarding the possibility of a single failure bringing down both protection channels or both DC branches, might influence this. You might be facing the trade-off between time-delay on the GCB status signal and higher risk of double channel failure. Each additional component to your critical protection system adds complexity and failure probability. A second contact on the GCB is a far better solution IMO.

 

[marks1080]

Can your relays take inputs over fiber?

If so consider using a contact transfer module, like a SEL-2506. This is a very slick way of meeting 'galvonic seperation' requirements.

Mark

 

[controlsdude]

This sounds like dual channel estop relays where you need a higher category of protection. Is this driven by customer to have dual devices? If not then use a force guided relay to duplicate the function of the sensing
device.

Can the dual channel input device be configured for single channel input? I know on estop relays there was jumper settings to make it single channel input versus dual input channel.


If its customer driven to have 2 devices then you have to provide another seperate device to do the sensing since your device only has 1 contact output.

 

[crshears]

jkristinn (Electrical) wrote:

A second contact on the GCB is a far better solution IMO.

...to which I offer strong assent! The interposition of other devices where these can be avoided only increases the likelihood of a functional failure.

Also, dpc wrote:

Not sure of specific regulations for reliability, but I would probably just split them [gas trip, oil temp trip, frame temp trip, etc.] between the A and B side lockout relays.

Which leads me to respond:

I'm curious about "specific regulations for reliability" as well; in my utility, transformer protections are not typically dual-redundant, other than for some of the largest / highest-rated / mission-critical equipment. For most equipment therefore the various protective devices are grouped in such a way that one complete protection can be removed from service while the remaining scheme affords "adequate" interim equipment protection for the duration of the work. How the standard for "adequate" protection in these instances is derived is above my pay grade...

IEEE standards? Customer-driven? Local AHJ?

 

[dpc]

In the US, the are fairly specific NERC requirements for protective relaying that is considered to be part of the "Bulk Electric System" grid.

 

[stevenal]

Those same NERC regulations have also been adopted by parts of Canada and Mexico, so not just the US is affected.