2011The International Conference on Advanced Power System Automation and Protection

Preventive Methods against Blackouts Based on Protection Security

Assessment in Future Grids
!
!
Jochen Fuchs , Johann Jager , Rainer Krebs
I FAU

University Erlangen, Germany;

Erlangen, Germany;

2 Siemens

Abstract: The paper presents a new automated method for assessing the security of protection systems concerning selectivity
and speed to reduce the risk of unnecessary disturbances and blackouts. The invented algorithms are capable to handle complex
structures. Hence, the system behavior of a protection system and network is analyzed and assessed as a whole and it has not to be
reduced to its single components or devices. The simulation tool is used as an engine to provide the possibility of a holistic si
mulation of networks together with the protection.
The system-method can be divided into two main approaches: Fault pattern analysis (FPA) and economic impact assessment
(EIA). The FPA calculates running faults through the whole grid for diverse scenarios of load flows. Economic aspects of non
selective protection systems are also be introduced and presented by the EIA method. It benefits from the fact that protection
devices violating dependability or security will lead to additional outage. This outage is calculated and evaluated by the differ
ences of simulated outage and unavoidable outage. The large amount of resulting data is stored in a central database. Intelligent
filtering and data preparation allow a holistic assessment and visualization of complete networks of different architecture.
Routinely checks of contingency sequences with the presented methods will reveal bottlenecks of the protection behavior itself
and of the coordination of network and protection.

Keywords: Protection security assessment, selectivity, speed, blackout prevention, protection coordination, holistic si
mulation, routinely contingency check, fingerprint analysis

Introduction

There is a change of global energy supply going on with in

creasing demand of energy transportation, reversal of load flows
in distribution grids and a huge amount of dispersed generation,
i.e. caused by wind energy plants. Especially in those grids of
rural regions the load flow is more often turning from a top-down
into a down-top principle, which means that the load flow is not
always nmning from higher to lower voltage levels. The varying
states of grids, the behavior of secondary equipment and the
consequences out of switching operations are getting more and
more difficult to predict. The analysis of past blackouts studied
by the North American Electric Reliability Council (NERC)
shows that protection relays are involved in about 75% of all
major disturbances. One reason for that is the non adequate adap
tion of the protection systems to the changing network
conditions.
In particular the relay hidden milures caused relay malfunctions
and blackouts, following cascading trippings.
In this context Protection security assessment (PSA) of power
grids becomes an important task in the course of a competitive
energy business and a decarbonized power generation. PSA will
provide the opportunity and capability for improvement by ana
lyzing the holistic behavior of the grid with automatic identifica
tion of weak-points by technical or economic impact.

Method of investigation

The presented method is analyzing networks as a whole. By

simulation of routinely sequences of mult and contingency scena
rios bottlenecks due to the selectivity of the protection system can
be revealed. Based on the identification of bottlenecks, adapted
settings can be derived, improving the protection behavior under
the changing network conditions. The principle structure of the
automatic system is shown in figure 1. The system includes a
storage system to store all information and also the grid model
data, a system for management of simulation, an evaluation tool
to control routinely methods to analyze the tripping behavior and
effect of those reactions on the grid and a qualification and as
sessment center for the interpretation of these effects.
A. Data storage
The holistic approach of the presented method demands an ex
traordinary effort of calculations and storage of all results follow
ing from these calculations. Therefore, a well-designed data han
dling structure and storage system is essential. The data storage
system is implemented on a mysql-database nmning on a data
base server. At the beginning of the procedure the underlying
APAP2011

Corresponding author (email: fuchs@eev.eeLuni-eriangen.de)

978-1-4244-9621-11111$26.00 2011 IEEE

1857

www.apap2011.org

2011The International Conference on Advanced Power System Automation and Protection

SIMULATION TOOL

resistance and to the related scenario of the power grid

S

ARJO BUILD

C. Evaluation Tool
A general evaluation method of protection system behavior is
given by the terms of Fig. 2. Following definitions are stated
[1]:

SC FAULT
SIMULATIO
N

DATA

Reliability - The probability that a protection system will oper

ate with the required performance. This parameter includes
the
aspects dependability and security.

EVALUATION TOOL

STORAGE
FAULT PATrERN
ANALYSIS (FPA)

Cl

:;::

Cl

ECONOMIC IMPACT
ASSESSMENT (EIA)

<
iii
c

;::
:

-lr

Z
-l

Dependability - The probability that a protection system will

trip circuit breakers when it is required.
Security - The probability that a protection system will not trip
circuit breaker when it isReliability
not required to do so.

is

C/>
C/>

-<
-l

;::
:

Dependability

Figure 1

Security

Principle structure of method of investigation

power grid model will be copied to the database. All other sys
tems read required information from and write their calculated
results to the database. By the use of an entity-relationship-model,
the data storage system enables associations and filtering by keys
between all scenarios, simulated :faults, results and the selection
of
data under consideration of various conditions.
B. Simulation tool
The simulation tool starts with the initialization of the
power
grid model to be assessed. ill the first step, all installed
protection
devices are analyzed, categorized and linked to their
associated
electric equipment. From these results protection zones
and selec
tivity-requirements may be defined. After initialization
and sto
rage of the results, the scenario builder generates a broad
diversi
fication of grid states with different load flows. For each
defined
scenario and for each protection zone the SC :fault
simulation
program calculates different kind of short circuits and
different
amounts of :fault resistances. As the simulation
engine
PSSSINCAL is used. [8] The location of the SC-faults
is mov
ing from calculation to calculation through the whole
network in
steps of i.e. 1 - 5% of the line length. The setngs for step
size,
resistances, scenarios, etc. either may be on standard
values or
may be limited or specialized by user's selection over 1858
graphical
user interfuces. The use of an automatic control of the

Figure 2

General structure of protection behavior evaluation

The use of the database with entity-relationship-model as sto

rage system enables automatic evaluation of all calculated results
in many different ways. This paper will be focusing on two main
approaches to evaluate the protection system: Fault Pattern Anal
ysis and Economic hnpact Assessment.
I.
Fault Pattern Analysis (FPA)
The :fault pattern analysis calculates and displays the effect of
an occurring fault by relating the protection response according to
the :fault. hnportant parameters are :fault clearance time,
selectivi
ty in combination with over- and underfunction and electrical
equipment that is still in operation or has been disconnected.
These values and elements are evaluated for every single simu
lated :fault. For the selection of the clearing time, it is important
to
ensure that protection devices, which just tripped because of
sympathetic tripping, but without shutting down an active cur
rent-path to the :fault, are not taken into account. Those malfunc
tions are recognized by the selectivity analysis, which is also part
hnpact Assessment (EIA)
of theII.:faultEconomic
pattern analysis.
While for protection systems of transmission networks the re
liability must be maximized, for distribution networks economic
aspects must also be taken into account. To determine the eco
nomical effect of a protection system's response to faults and to
assess the need for improvement there is a second automated
evaluation mode- the economic impact assessment. The general
idea of those outage cost assessment methods can be divided into
three approaches: macroscopic, microscopic and analytic [5].

2011The International Conference on Advanced Power System Automation and Protection

The macroscopic approach attempts to relate the outage costs to

a national level by estimating the total cost of outages over an
annual period of time.
It is difficult to assess accurately the value of unserved energy
for every customer due to a large amount of data.
Thus as a first macroscopic approach the Gross National Prod

This tool contains a collection of methods for automatic genera

tion of drawings for different scenarios, single fuults, protection

uct (GNP) estimation is proposed. The outage costs per kWh can

zones and statisics. Selection of required information is estab

lished by SQL statements. Control and selection can be easily
performed by the use of graphical user interfuces.

be calculated as follows:
outage cost ($/kWh)

GNP ($)
TotalEnergConsumption(kWh)

Case Studies - Results and discussion

A. Grid model
The case studies were carried out on an existing 20-kV- dis

(1)

tribution network. The earth-fuult current in the grid is limited by

The calculated outage cost represents the ratio of the served
energy and the economic value that is derived from the served
energy.
Estimated values of intertion costs for individual customers
are different, depending on the types of customer sector, such
as
residential, agricultural, industrial or commercial. Relatively,
res
idential and agricultural sectors have lower outage costs,
while
industrial and commercial sectors have higher outage costs.
It
was reported in [6] that estimated outage costs for
residential,
agricultural, industrial and commercial sectors due to a
temporary
outage are $4.05/kWh, $3.53/kWh, $6.78/kWh and
$39.69/kWh
respectively. Although the macroscopic approach does not pro
vide the exact annual outage costs, it is easier to evaluate this
by
using the microscopic or analytical approach which is based
on a
large data collection and further assumptions which includes
fur
ther uncertainties.
This method is using the macroscopic aprp oach and is based
on
the centralized database recordings of the simulated fuults and
on D. Qualification and assessment tool
The
quality of
a protection
can be measured by statistic
the
evaluated
results
from thesystem
FPAmethod.
analysis
of
various
combinations
of
different
evaluation
results.
Every fault that has to be disconnected causes
a loss of opera
Those
individual
results
are
merged
by
probabilistic
logics,
whichtional equipment. Violating dependability or security
lead
whichto a quality indication. Hence, quality indices can be given
formeans
the complete
system,
for protection
single protection
andnot
for grid
fimctions
of the
systemdevices
that do
meet
areas.
the Areas or devices with poor quality indication are potential
lyselectivity-requirements
revealing bottlenecks, which
remedied. loss of equip
- willshould
lead tobeadditional
ment.
Those this
additional
losses, method
the differences
between
evaluated
Because
qualification
is universal,
definite
and
repeatable,
it isclalso
helpfulunavoidable
to discover losses,
the trend
im
losses and for
earanvery
ce reasons
are of
calcu
lated for every
by the EIAsystem
method
saved to
provement
aftersimulated
changes offuult
the protection
or and
for optimiza
the
tiondatabase.[I]
of settings.

means of a low impedance star-point earthing (llp:S 2 kA).

The
network operates normally in an open-ring structure. The main
infeed is established from the 1l0-kV-subtransmission. The con
figuration is depicted in Fig. 3. The 20-kV-distribution network
consists of 14 cable feeders A to N, equipped with a distance re
lay each. At station A6 and 15 the lines are protected by two
overcurrent relays. The feeder lengths are between 2.1 km and
14.6 km. The impedance data refer to R' 0.17 ... 0.38 nIkm and
=

X'

0.12 nIkm

Five distributed generators (DG) are connected and are in op

eration. Their point of common coupling (PCC) is along
the
feeders DG1
respectively.

to DG4

and the busbar BB2

They comply with the distribution code of the distribution

net
work
(DNO).

operator

o
6,5
2,1

4.2
-1.4

Figure 3

B.

Relay
Sectinjn
g pomt

3+Por--..(MW]

I
Qou-(MVAr(

20-kV-<listnbution network with DO infeed

Protection system

The distance protection relays pick-up by means of the un

der-impedance starting facility as com
nm
o

in such networks. The

low-set current threshold is I> 0.67 In Gentral pick-up is set

=

E.

(DG5)

Visualization tool

above I>> 2.33 In For phase-to-phase faults a voltage drop

=

1859

2011The International Conference on Advanced Power System Automation and Protection

Starting the assessment with the EIA, fig. 4 shows additional

down to 70010 of Un leads to a sensitive pick-up

between
0.67...2.33 m. Thenon-directional pick-up delay time for trip

losses for the test distribution network and the 19 protection

zones on the x-Axis. All protection zones from 3 to 14 show ad
ditional losses, \\-hich are caused by malfimctions like over- and

ping is 400 ms. Only the wderreaching tripping zone 1 with a

time delay of 50ms is activated. It covers between 10% and
100% of the feeder length depending on the consmner stations

wderfimctions. Especially mults in the protection zone of devices

no. 4 (feeder L) and no. 14 (feeder J) cause the biggest amowt of

along the feeder. The rest of the feeder is protected by the

additional load drop through all of the simulated mults and scena
rios.

non-directional starter mcility. Both overcurent relays have only

activated one definite time stage as I> =2.33 . m and t>=100 ms

LMddrop

Mc.m lIddiliol1l1llond drop due to nullrunclion

non-directional.
The considered protection fimctions of the DG tmits at the PCC
are:

Undervoltage (27) - U =0.45 .Un, t(U)=300 ms

U<=0.8Un, t(o.9=1.5...2.7 s
Frequency (81) -

t> =51.5 Hz, t(t>) =100ms

f<=47.5 Hz, t(f<) = lOOms
I

An overcurrent protection fimction protects the DG system

J 4 5 6 7 8 9 10 II 12 IJ 14 15 16171819
Zone

(e.g. the cable from the PCC to the generator transformer). For all
DG tmits it is possible to discriminate faults in the distribution

Figure 4 Unnecessary loss of load due to malfunctions

network from mults in the DG system by current, activating the

m comparison to Fig. 4, the diagram of Fig. 5 shows a differ

instantaneous high-set element and the delayed low-set element

ent allocation of the highest values. Here, zone no. 4 and no.7

(t(I>) =400ms). Faults in the DG system are cleared instanta

neously whereas for mults in the distribution network tripping is

(feeder H) contain the highest additional costs due to malfimc

tioning protection. The change of those peaks is caused by the

delayed. [2]

different importance of individual loads in the protection zones

i.e.

C. Application of method, settings and results

The method starts by loading the described grid model to the

a load that represents a hospital needs to be assessed at a higher

database. Then the initialization algorithm is collecting

equipment

priority with a greater monetary impact This evaluation method

supports the decision for improvement and suggests proceedings

elements according to their protection devices and is linking it

to

in the change of equipment, \\-hich become measurably by mon

protection zones. m the presented grid 19 protection zones

fault-resistances are defined in steps of 5
n from 0 n to 50 n for
are
single- and three-phase mult types. The mult locations are auto
identified. By user definition the scenario builder generates
matically defined in steps of 2% of the corresponding feeder
two
length.
The step
is always
in relation
to the feeder
different
grid size
scenarioo:
one
with a minimum
(alllength,
DGs but
oft)

etary advantages.
Costs

[]

Mean additional costs due to protection malfunction

20000

and
it can also be configured smaller or wider by the user. The com
one with
maximum
DG infeed
DGs
on).
The
bination
of the asimulation
definition
leads to (all
41,800
single
simu
considered
lations that are transferredand executed by the SC simulation tool.
Parallel to the simulation tool and after all simulations, \\-hich are

in total very time consuming, the evaluation tool will be starting

automatically to analyze the simulation results. The qualification
and assessment tool generates statistical information by intelligent
filtering and combining the assessed values in an indexing sys
tem.

Figure 5

follow a statistical approach. This approach is very useful to

get a

because it
maloperations.

shows

and

To get an idea of the system effects each protection zone can

be evaluated either by the impact of mults occurringinside of this

zone or by the behavior of its protection devices. Fig. 6 illustrates

on the protection system

rates

the

importance

Economic impact caused by malfunctions (additional costs)

As a first result from fig. 4 and fig. 5, zone no. 4 is obviously

the most critical zone.

The EIA-methods for additional load drop and additional costs

fast and holistic impression

behavior,

J 4 5 6 7 8 9 10 11 12 IJ 14 1516171819
Zone

of

1860

2011The International Conference on Advanced Power System Automation and Protection

those two incidence distributions for the critical protection zone 4

(feeder L). On the left side of fig. 6 the tripping behavior of de

~ --cc--1------- ---

vice no. 4 is displayed. On the right side the statistic shows all
devices that trip for faults in protection zone no. 4. It can be easily
seen that the device itself reacts selective without any overfunc

-+----=~~-----

-----l ~
1

n(s)

1.0

tions. But the right side of the diagram shows several devices that
are tripping on faults in zone no. 4.
20

25

30

35

fa111tplx~in1.0
0C
Fault zonn ",ilb n:aclK)fl

orprotccl1oon device
no.4

Tnppll1g prote<:lion dI:\ icn fOl'" faulu:

A
A6

in wnc

00.4

1
2

0.8

0.'

II
I
IS
J

0.'
O

8
7

1
9

IS

. ..

16
17

16
17

I
z......of r

1
3)
IS

OJ

u
s

10

20

faultplacei.n1l
)l'IC

IS

"

1,
0,0

Zoneofp1occcuondc\ttt

11

Figure 7

FPA for defined scenarios with no active and active DG infeed, fault
resistance 0

Figure 6

?O

II

0.'

IS

"

..

0.'

0.'

10
18

IO

FPA-statistic for protection zone no. 4 on feeder L

The tripping protection devices refer to zones, which are in

Conclusion

fluenced by intermediate infeeds. The associated charts are

not

The presented method analyses the protection system behavior

in power networks in a holistic approach. The developed algo
rithms are designed to handle structures of com
nm
o
networks.
The evaluation tool with its main methods FPA and EIA is able to
estimate the damages of equipment caused by extended fault
durations, the additional loss of loads and the monetary losses
caused by unintentional outages due to relay mal operations. The
method reveals and assesses hidden failures by statistical and
probabilistic tests and gives an idea of remedies to an expert.

given, but they all would show a spread distribution of

tripping
malfunctions (left side of fig. 6) for zone 3 to 14. Those
devices
should be upgraded by directional protection.
Fig. 7 shows four drawings. The upper part contains the
fault
clearing times while the lower part contains the selectivity of the
protection system. The difference between the left and right part
is the state of the generator units. The scenario that is without any

[I]

DG unit connected to the network is located on the left side and

Jager, J., Krebs, R.: ' Automated protection security assessment of today's and
future power grids', IEEE Power and Energy Society General Meeting, 2010

on the right side there is the one with all DGs active. The x-axis

[2 ]

color-coded. [3] The end of each underreaching zone can be iden

tified as the change of the clearing time from 50 ms (dark) to

Keil, T., Jager J.:'HolisticAnalyses of Power System Protection in Networks

with Distributed Generation',

[ 3]

always corresponds to the fault location in the corresponding

APAP, Korea, 2009

Keil, T., Jager J., SOllner N., BoppT., Krebs R.:'Software Assisted Develop
ment of Protection Coordination Concepts in Nationwide Power Systems', 9.

protection zone. The clearing times and the selectivity are 400 ms

IEE Int Conf. on Developments in Power System Protection, (2008)

(light). With focus on zone no. 14, the first zone is very short.

Ordacgi, M.; Solero, R.B.: MinimizingRisks of Cascade Tripping, A Syste

[ 4]

Therefore, the average speed of this device is slow for its faults.

6,

maticAnalysis of Component Protection, Cigre Conference, Paris, 200

Without the DG units the selectivity shows green color and no

over- or underfunctions.

ill that

Report B5-202

case the trippings are selective. ill

[5]

.
function, but overfunctions that are caused by sympathetic trip
the case of full DG infeed the selectivity shows still no under

Yamashita K., Joo S.-K., Li J., Zhang P., Liu Ch.-Ch.: Analysis, Control, and
Economic Impact Assessment of Major Blackout Events. ETPEP Euro. Trans.
on Electr. Power, 18:854-871,2008

[6]

ping (cp. also fig. 6). The malfunctions occur for faults behind the

Bums S.,

GrossG: Value

of SeIVice Reliability. IEEE Trans. on Power Sys

tems, 5(3(:825-834, 1990.

end of the first zones where the undirectional starter facilities trip.
hnprovement can be accomplished in two ways: First by accele
rating the average tripping time by increasing the first zone of

[7]

PSSSINCAL 'Efficient planin ng software for electricity and pipe networks', SIEMENS AG, PTD
SE PTI, www.siemens.com
lpower-technologieslsoftware

each device to 85% of the zone length and second by prevention

of overfunctions caused by sympathetic tripping, that means to
upgrade the protection devices in the DG supplied feeders by
directional protection.
186 1