New approach to modelling protection in grid planning studies

In many recent blackouts and large system disturbances, the performance of protection systems was found to have played an important role in both exacerbating the disturbance and limiting the spread of the disturbance. In the past, protection systems were not widely modelled in transmission planning studies. Instead, the response of protection relays to faults was assumed to follow fixed behaviour based on conservative values for primary and backup protection operating times. For these reasons, the incorporation of more accurate representations of protection systems into planning studies may help identify potential protection misoperations and ensure that protection relay performance is tuned to yield optimum responses to system disturbances. This study begins by discussing how protection relays may participate and respond to cascading tripping, power swings, and other steady-state and transient power system phenomena studied in power system planning. It will then examine how the settings for relays may be populated with conservative ranges where actual settings are not known or difficult to transfer to the planning simulation tool. The paper concludes with an overview of a tool which has been developed to automatically create relay models in planning simulation based on high-level user guidance.


Introduction
Examination of past wide area power outages and blackouts show that in many cases protection system misoperations played a role in causing or exacerbating the disturbance. The sequence of events during a cascade is difficult to predict; however, analysis of blackouts in several reports and papers reveals a common theme [1][2][3][4][5][6][7][8].
It is necessary to note that relay misoperations do not typically present the sole cause of wide area disturbances, but are one factor among others such as the grid being loaded to an extremely stressed state, extraordinary combination of outages, weather events, or operator error. Unintended protection system operation during stressed system conditions can aggravate the initial disturbance and initiate a cascade of outages. The unexpected loss of generators caused by its protection systems or controls can also worsen the situation.
Planning studies may consist of different simulation types including, but not limited to, voltage stability, transient stability, and contingency analysis. In these simulations, protection relays are challenging to explicitly model and so the expected behaviour is represented instead. The protection behaviour is often modelled through expected switching actions in the simulations; e.g. fault clearing is modelled by switching out the faulted element a fixed time after the fault is initiated. With such practice, it is only possible to capture what the relays are expected or planned to do, not their true response to power system dynamic conditions. EPRI's broader approach to this research aims to (i) Examine protection modelling assumptions that planning departments in utilities and system operators currently use in transmission planning studies.
(ii) Use lab-tests of protection relays to evaluate the accuracy of software relay models during power swings and other transient events.
(iii) Develop techniques to improve the representation of protection in planning studies. This may include modelling distance relay reaches in planning studies.
(iv) Develop tools to simplify and accelerate protection model exchange, grid scenarios, and contingency cases between planning and protection tools.
(v) Work with planning software vendors to integrate any new learnings and outcomes from the research into new releases of the software.

Protection response to system disturbances
Many protection and control systems are expected to act in concert in response to system disturbances. Fig. 1 illustrates approximate time delays associated with such systems. Many different protection systems exist across transmission grids, generation sites, and distribution grids. The latter is especially gaining critical importance where distributed energy resources (DERs) form an appreciable proportion of the grid's energy portfolio.
Examples of system disturbances which may be examined during planning studies and which may give rise to protection relay operation include • overloading of lines and transformers, • unscheduled disconnection of load or reactive compensation devices, • line switching, • high or low-voltage grid conditions, • stable and unstable power swings or loss-of-synchronism, • frequency disturbances, • angular instability.
The last three bullets can sometimes be related in that power swings may occur due to loss of synchronism, which can itself occur due to frequency disturbance in one part of a grid.
When a synchronous power system experiences a disturbance such as a short-circuit or loss of energy supply the rotors of nearby synchronous generators will decelerate or accelerate to supply or absorb energy from the grid. These changes in rotor speed result in oscillations in generator power output and power swings between individual or groups of generators. These oscillations are normally damped by the actions of generator governors, automatic voltage regulators, or, where fitted, power system stabilisers (PSSs). These are stable power swings. If the disturbance is very large then individual generators, groups of generators or regions of an interconnection can lose synchronism resulting in unstable power swings. Protection relays may trip in response to stable and unstable power swings, but this may or may not be the desired behaviour for the grid planner.
Power swings occur following different grid events, including • sudden changes in load, • tripping or disconnection of generators, • switching of transmission lines, • overloading of transmission lines and/or voltage instability, • short circuits and grid faults.
While local or inter-area oscillations and sub-synchronous oscillations are related phenomena, these have not historically been found to contribute to major grid events. Stable and unstable power swings may be studied at the grid planning stage and also in the near or real timeframe using on-line transient stability assessment tools. It is often the case that rotor, voltage and angular stability are primarily the focus of these studies.
There follows a brief discussion of the protection systems which may operate in response to the typical events considered in planning studies. It should be understood that protection philosophies vary across the world and while general guidance can be given on these devices the discussion in necessarily limited.

Inverter protection
While the dynamic behaviour of inverters is outside of the scope of this paper inverter protection is a topic which warrants some discussion. Many grids have Grid Codes or Interconnection Requirements which set out voltage and frequency ride-through performance curves for inverter-interfaced energy sources. While some inverters may exceed the minimum requirements, some may only just meet them. Thus, a conservative approach to modelling such behaviour may be to assume that any inverter exposed to a voltage or frequency dip will trip in accordance with the ridethrough curve. This enables the grid planning engineer to study the worst-case of wide-spread inverter discussion for transmission faults and other phenomenon.
The main inverter protection functions which impact transmission grid planning studies are • voltage protection, • frequency protection, • loss-of-mains protection, • in the case of wind turbine generators the protection against multiple consecutive voltage dips.
Loss of mains protection systems are intended to detect when an energy source has become islanded from the main transmission or distribution grid; however, certain loss-of-mains algorithms such as rate-of-change-of-frequency and vector-shift protection may also operate in response to fast frequency changes on the bulk system. This tends to be a more immediate issue for electrically-islanded systems such as Ireland, Great Britain, and Texas (ERCOT) who have experienced significant decreases in grid inertia due to their high proportions of inverter-interfaced energy sources, but similar issues will ultimately be experienced by larger interconnections where inertia decreases.
While many planning tools offer loss-of-mains protection models, these can be difficult to configure as some of the parameters -such as the time-window over which the phase shift or frequency shift is calculated -are manufacturer-specific and may not be known to the planning entity.
Wind turbine generators may also be equipped with protection scheme which disconnects the turbine following a certain number of voltage-dips within a period of time. Each time a wind turbine generator is exposed to a voltage dip the drive-train and other components are disturbed. Protection systems which respond to multiple consecutive voltage dips came to the fore following the South Australia blackout of 2016 [2]. The effect is that wind turbine generators may trip offline in response to multiple voltage sags within several minutes or tens of minutes.
To give one recent example of the impact of inverter voltage protection -in August 2016 twelve 500 kV lines tripped in California due to flames and smoke from a forest fire [9]. The associated voltage dips resulted in the sudden loss of nearly 1.2 GW of power from solar PV sources. While about 700 MW of the solar PV inverters tripped due to inaccurate frequency calculation algorithms, the remainder were due to inverters tripping offline or inverter momentary cessation where the real power output of the inverter drops in proportion to the voltage dip. For those inverters which remained connected during the voltage dips, it took some seconds for their power output to recover to pre-fault levels. For those inverters, which tripped offline, it took in the region of 5-7 min before they re-connected and began exporting power again. This resulted in the localised voltage dip events turning into widearea frequency disturbance with a nadir of 59.85 Hz.
For this reason, it may be prudent in certain cases to include inverter voltage and frequency protection models in planning studies. For transmission-connected energy sources, these may be explicitly represented on a per-site basis, while distributionconnected inverters may be represented in aggregation [10]. Most planning simulation tools provide the use of generic voltage and frequency protection models; typically these offer multi-stage, definite-time under and over-voltage and under and over-frequency functions. Where the actual inverter voltage or frequency protection settings are not known the Grid Code or Interconnection Requirement ride-through curves may be used to develop conservative parameters.
Recommendations for modelling inverter protection in transmission planning studies: • Model multi-stage definite time-voltage and frequency protection to reflect Grid Code or Interconnection ride-through requirements. • Model distribution-connected inverters as lumped equivalent unless other requirements call for more granular modelling of individual sites.

Synchronous generator protection
Synchronous generators also have protection systems which may operate in response to bulk-system disturbances [11,12]. Power plant protection systems which could operate undesirably or unexpectedly in response to bulk system disturbances include: • generator transformer overcurrent protection, • generator transformer distance protection, • volts/Hz, over-fluxing, or over-excitation, • Loss of field (in old generator units), • pole-slip, loss of synchronism or out-of-step, • reverse power protection, • voltage protection, • frequency protection, • auxiliary plant voltage protection.
Transmission system backup protection on the generator stepup transformer is used to isolate the generator from a fault in the case where the transmission protection systems fail to operate. In many cases, such protection is implemented using distance relays, voltage controlled overcurrent relays, or voltage restrained overcurrent relays installed on the generator side of the generator step-up transformer. While these devices may be coordinated with transmission protection for fault clearance they may still trip in response to stable or unstable power swings.
The reach of the generator transformer distance protection may vary depending on protection philosophy, but would typically have value in the region of 85% of transformer impedance for Zone 1 undelayed tripping and 150% of transformer impedance for Zone 2 with a time delay in the region of 0.25-0.5 s. A reverse zone looking into the generator may also be used with a reach of ∼200% of the Xd″ generator reactance parameter. The overcurrent elements may be set in the general range of 150-250% of the maximum load current.
Elevated operating voltages in combination with a frequency depression may cause over-excitation of the generator or generator transformer. This can result in excessive heating and vibration. Volts/Hz relays are applied to trip to prevent this from causing damage to the generator or generator transformer and the protection is implemented on an inverse curve with a pickup setting around 105% [13]. In older excitation systems they can also cause loss of field relay to trip a unit. Modern excitation systems have a minimum excitation limiter that would prevent a reduction in field current to a level that could look like a loss of field condition.
Most modern synchronous generators are equipped with poleslip protection which operates on detection of the first or subsequent unstable power swings. Generator typically experiences pole-slipping when they lose synchronism with the bulk system, which can arise for a number of reasons such as the generator accelerating during nearby uncleared or slowly cleared faults. For older generators dedicated pole-slip protection relays may or may not be installed; in such cases, it is difficult to predict which protection devices, if any, will trip during unstable power swings although distance or overcurrent protection are the most likely candidates. Where applied, pole-slip protection is typically implemented using a specially-adapted distance protection function. The implementation will vary between manufacturers, but to give one simple example the relay may measure the time the measured impedance takes to traverse through an impedance zone centred around the reactance axis; if the time has taken is within the configured threshold the relay trips.
Reverse power protection is applied to generators to detect if it has started motoring. Reverse power protection is typically implemented with a time delay (e.g. 5 s) to prevent it from operating due to small-scale stable power swings when the generator is synchronised to the grid.
Generator over-speed protection is normally set far outside of the normal operating frequency range and, as such, is unlikely to operate during the types of events studied in planning simulations.
Generators also incorporate protection of ancillary and mechanical systems and these may be activated during power swings. Depressed terminal voltages at a generating unit may cause plant auxiliary loads to trip causing the generator outage. Examples include boiler controls of steam turbines, combustion controls of gas turbines, boiler feed pumps, and lubrication pumps. Generator voltage protection may often be set with long time delays and will tend to be more associated with preventing damage to these auxiliary pumps and motors rather than the turbine generator itself.
It may also be implemented to alarm rather than trip the unit [13]. Nonetheless, if critical auxiliary equipment trips then the generator may trip offline as well. Generator voltage protection would be required to meet grid voltage ride-through requirements at a minimum and may be modelled as such in the absence of known settings.
Severe power swings may push fuel supply control loops outside of their normal operating range giving rise to loss of flame stability (lean flame blowout in combined cycle gas turbines etc.). These protection systems are rarely modelled in planning studies and the data may be very challenging to collect. Some insights into these systems were published following detailed analysis of the electrical and mechanical control and protection systems of a combined-cycles gas turbine during fast rates of change of the frequency [14][15][16]. The analysis was required in order to assess if the generator would be compliant with new Grid Code requirements in Ireland. The paper by the generator turbine manufacturer identified particular issues with the fuel supply system potentially limiting the governor response and rotor acceleration controller action resulting in large combustor temperature transients. Lean burn-out was also identified as a particular risk; this occurs when control system actions result in the loss of combustion.
The authors identified the following issues which could impact the generator's capability to the ride-through fast rate of change of frequency events: • Frequency and governing response issues, • fuel stroke reference control response issues, • evaluation of lean blowout margins, • steam turbine thrust balance evaluation, • PSS response issues.

Recommendations for modelling synchronous generator protection in transmission planning studies:
• model distance or overcurrent protection on the generator stepup transformer, • model multi-stage definite time voltage and frequency protection to reflect Grid Code or Interconnection ride-through requirements unless generators are known to have better performance, • model generator pole-slip protection where known or likely to exist, • model Volt/Hz protection if sustained low-frequency and highvoltage conditions are considered credible.

Transmission grid protection
Transmission grid protection is typically designed to operate in response to short circuits and other issues related to asset damage or failure; however, they may also trip in response to various bulk system phenomena. Past experience gained from large scale blackouts highlights the issues which may arise when protection and planning engineers do not coordinate [1,3,8]. Key areas where both parties may benefit from coordination include • distance and overcurrent protection relay loadability, • primary protection fault clearance times and speed and reliability of backup protection, • coordination of voltage protection, • under voltage and under frequency load shedding, • bulk system transformer volts/Hz protection, • coordination of protection response to stable and unstable power swings, • real and reactive power control modes of inverters.
The last point is referenced as the choice of whether inverters are permitted or required to operate in constant P or Q, constant power factor, or provide dynamic reactive power response will dictate the short-circuit current characteristics of the inverter, which, in turn, affects protection system design and performance. Distance protection is likely to operate undesirably due to either load encroachment or stable or unstable power swings during dynamics following a disturbance. In the case of power swings, the voltage and current undergo fluctuations in amplitude and relative phase angle. This combination of low-voltage and high-current can cause the trajectory of the measured impedance to enter the protection zone of the relay characteristic making it look like a fault. This may cause the relay to trip, which may or may not be desirable from a system integrity or stability perspective. This is a common feature of major blackouts in the past [1][2][3]8].
Many grids have relay loadability requirements, which limits the reach of distance protection zones to ensure they do not operate for normal or emergency loading conditions. For instance, in North America transmission line protection should be configured to ensure that relays to not operate for continuous loading of up to 150% of the maximum line rating. Thus, in planning studies, it may be assumed that once no line is loaded above this level then no relay should trip due to load encroachment. Such possibilities might be guarded in the simulations by monitoring flows on the facilities if the actual relays are not modelled in the simulations. Where relay settings are not specifically designed to coordinate with emergency line loading the relays may be exposed to misoperating, as happened during a recent disturbance where an overcurrent relay loadability was not coordinated which resulted in cascade tripping of lines and large-scale blackout [1].
Where simulations show that the line loading may exceed these limits they may be flagged for more detailed evaluation using the actual relay settings. This approach avoids requiring entering data for all distance relay settings in the planning studies.
Distance relay elements may also operate during stable and unstable power swings. Many relays offer Power Swing Block functions to prevent undesired tripping of distance relay element operation during power swings, but this function is not always used. A survey carried out by a Cigre Working Group in 2016 found that there was an inconsistent application of this feature across different utilities around the world [12].
Recommendation for transmission distance protection models: • If relay tripping due to load encroachment is a concern monitor line flows and review relay loadability for transient or steadystate breaches of nominal line rating.
If relay misoperations during dynamic events are of concern: • Model distance protection relays on lines and transformers connected to the transmission substations with (i) generators connected, (ii) major tie-lines or (iii) long, heavily loaded lines. • Model distance relays with all tripped zones. • If company protection philosophy requires distance relay zones to meet some loadability requirements, the reach of the largest zone may be conservatively estimated by calculating the equivalent impedance for the given loading at a depressed voltage. For example, the zone impedance reach could be derived from the apparent impedance for a maximum continuous line rating of 150% of nominal at a voltage of 0.9 p.u. • For other zones, the reach may be estimated as a percentage of the line's impedance, e.g. Zone 1 equal to 85% of line impedance, Zone 2 equal to 120% and so on.

Automated protection relay modelling tool
The practical challenges of populating a planning model with vendor-specific protection models and the actual on-site settings may be extremely difficult for some or many transmission grid companies. An alternative approach is to automatically populate the planning model with generic relays parameterised with conservative settings. This would enable the planner to perform their regular studies, while also potentially capturing protection issues without significant extra effort. Based on the considerations discussed in the paper above a tool was developed using the Python coding language to do this and automatically create and parameterise protection relay models in typical planning tools. The initial version of the tool supports Siemens PSS/e platform with support for other planning tools to follow. The tool enables the user to provide high-level criteria for which types of relays to model, where they should be modelled and the general protection philosophy for how they should be configured. The tool takes an existing PSS/e raw or case file as input and produces a PSS/e dyr file with all of the relay definitions as output.
In selecting where the protection models should be created, the basic options are offered to select particular grid areas, zones and voltage levels, but also enabling more focused modelling of protection at generators above a critical size or protection of only lines or transformers on the transmission grid near generators or tie-line. Tie-lines may be selected manually as a list or they may be automatically selected based on other criteria such as minimum reactance exceeding some value (indicating a long line), line rating, or lines which link different areas or zones. This enables the user to tailor the protection to the areas of greatest interest to their study.
The tool supports the automated creation of • line distance protection with or without teleprotection, • transformer overcurrent protection, • generator transformer distance protection, • generator pole-slip protection, • generator loss-of-field distance protection, • generator over-excitation protection, • four-stage definite time generator voltage and frequency protection, • four-stage definite time inverter voltage and frequency protection.
The user may choose between a range of zone characteristics (mho, quad etc.), zone direction, typical zone reach, and whether the zone reach should be calculated based on the protected line impedance or the protected line's rating. The latter is useful where the user wishes to investigate the case where relays are configured with reaches up to their maximum permitted loadability limit.
In selecting which lines on which to create protection relays it is important for the tool to correctly treat tapped, multi-section, and multi-terminal lines. Thus, instead of creating relays at each end of every line in a grid model, they should be created at the end of lines representing a real busbar.
To achieve this, the tool requires criteria for distinguishing real busbars from fictitious busbars. Multi-section lines are identified by the presence of a busbar with two lines connected to it, but no transformer or other equipment. This busbar is also treated as fictional. Multi-terminal or tapped lines may be identified in a similar fashion. Where the above criteria identify a 'fictional bus', no relays will be modelled at the ends of the lines directly attached to that bus. As such, relays will only be modelled at the ends of the lines terminated at real busbars. they could respond to the events considered in planning studies and practical experience of where they contributed to major blackouts.
Many planning simulation tools only provide the capability to model generic protection relay functions, not vendor-specific algorithm implementations, and so are unable to fully represent the behaviour of protection during dynamic system events. Furthermore, it can be very challenging to align and synchronise protection settings databases (if available) with planning models. An alternative approach to modelling protection relays in planning studies by automatically creating the relays and populating them with conservative settings is discussed and put into practice.