Substation Control and Protection Project

Substation Control and Protection
Project
EPRI
EPRI EL-1813
System Requirements Specification Project 1359-1
Interim Report
Keywords: April 1981
Substation Instrumentation
Control System
Protective Relaying System
AC Protections
Prepared by
Westinghouse Electric Corporation
Pittsburgh, Pennsylvania
SISTWBIIIIM Of THIS poconon IS mmm
^LECTRIC POWER RESEARCH INSTITUTE

DISCLAIMER
Portions of this document may be illegible in

electronic image products. Images are produced
from the best available original document.
Substation Control and Protection Project
System Requirements Specification
EL-1813
Research Project 1359-1
Interim Report, April 1981
Prepared by
WESTINGHOUSE ELECTRIC CORPORATION

Industry Systems Division ——
200 Beta Drive
Pittsburgh, Pennsylvania 15238
Prepared for
Electric Power Research Institute

3412 Hillview Avenue
Palo Alto, California 94304
EPRI Project Manager

S. L. Nilsson
Transmission Substations Program
Electrical Systems Division
BISWBUTinU OF THIS PnCUMENT IS UNLIMITED

ORDERING INFORMATION
Requests for copies of this report should be directed to Research Reports Center
(RRC), Box 50490, Palo Alto, CA 94303, (415) 965-4081. There is no charge for reports
requested by EPRI member utilities and affiliates, contributing nonmembers, U.S. utility
associations, U.S. government agencies (federal, state, and local), media, and foreign
organizations with which EPRI has an information exchange agreement. On request,
RRC will send a catalog of EPRI reports.
EPRI authorizes the reproduction and distribution of an or any portion of this report and the preparation
of any derivative work based on this report, in each case on the condition that any such reproduction,
distribution, and preparation shall acknowledge this report and EPRI as the source
NOTICE
This report was prepared by the orgamzation(s) named below as an account of work sponsored Py the
Electric Power Research Institute. Inc. (EPRI) Neither EPRI, members of EPRI, the orgamzation(s) named
below, nor any person acting on their behalf, (a) makes any warranty or representation, express or
implied, with respect to the accuracy, completeness, or usefulness of the information contained m this
report, or that the use of any information, apparatus, method, or process disclosed in this report may not
infringe privately owned rights, or (b) assumes any liabilities with respect to the use of. or for damages
resulting from the use of, any information, apparatus, method, or process disclosed m this report.
Prepared by
Westinghouse Electric Corporation
Pittsburgh, Pennsylvania
ABSTRACT
This specification evolved during Phase I of EPRI Project RP 1359-1. This project
involves the design and implementation of a microprocessor-based, integrated protec
tion and control system for transmission class substations. In order to define the
scope of the system, a list of possible functions was generated and the requirements
for each function were defined after extensive consultation with Host Utility
personnel and with other utility Advisors. A list of general system requirements and
design criteria was also generated. This specification has served as the starting
point in the development of more detailed functional specifications and in the
translation of these into implementation specifications. The requirements listed
here, are considered to be design goals whose feasibility and practicality will be
tested during the design and implementation of the system.
iii
EPRI PERSPECTIVE
PROJECT DESCRIPTION
This project covers the development of a microprocessor-based control and protec

tion system for transmission-class substations. The system is intended to operate
in a distributed processing mode with the different processors tied together by
means of communications links, some of which are assumed to be using optical
waveguides.
When a new technology is introduced it is often necessary to reflect on and

examine the fundamental requirements the new technology has to meet; this has been
found to be imperative when dealing with computer systems, in order to maintain
control over a new development project. This interim report under RP1359-1 docu
ments the requirements for the substation control and protection system.
PROJECT OBJECTIVE
This project is divided into different phases. This report was developed under
Phase I of RP1359-1, which covered the development of the system requirements and
trade-off studies for selection of a system architecture and top-level system
design.
PROJECT RESULTS
This interim report documents the requirements for a new, microprocessor-based

digital substation control and protection system. The requirements were developed
jointly by a group of utilities acting as project advisers to EPRI and the con
tractor that compiled and edited the document. These requirements will be the
guide for the design and implementation of hardware and software modules needed to
satisfy a selected set of the functions depicted in this report.
The intent was to define the requirements in a strict form to allow compliance
with the requirements to be tested. However, this was not possible to do at all
times. Rather than eliminating a requirement for lack of a good test criteria,
the requirement was included to serve as a flag for further requirements that will
be made at a later date. The requirements were reviewed for consistency and
examined to determine technical feasibility. However, in a complex system such as
the one defined in this report, errors were unavoidable. In spite of these, the
publication of this report provides an opportunity, which otherwise would be
impossible, for feedback to the project group from a larger audience.
Stig Nilsson, Project Manager

Electrical Systems Division
v
' -!>.
ACKNOWLEDGMENTS
Many people have contributed to the development of these specifications during the
last two years, and their efforts are hereby acknowledged with gratitude.
Howard R. Petrie and his associates Steve Leveckis and Carlos H. Castro representing
the Host Utility, Public Service Electric and Gas Co. of New Jersey, contributed to
the initial definition of functions and to subsequent discussions and evaluation of
functional requirements.
Five Advisory Utilities have contributed original suggestions and critical review
comments through their designated representatives. These are:
Pennsylvania Power and Light - Jeff G. Gilbert, Nick P. Marino

Public Service of New Mexico - George R. Nail
Texas Electric Service Company - George A. Clary, Ken R. Thompson
Tennessee Valley Authority Bob H. Venable
Utah Power and Light - Paul Dalpiaz
The EPRI Project Manager Stig L. Nilsson has provided valuable suggestions and
comments, and has also given direction and motivation during the development of these
specifications.
Finally, the following individuals within the Westinghouse organization participated

in the development of the specifications during Phase I of the project:
John S. Deliyannides
Frank G. Willard
Mladen Kezunovic
Bob j. Masterson
Mike J. McGarry
John F. Reuther
Milt Sackin
Tom H. Schwalenstocker
Eric A. Udren
vii
CONTENTS
Section Page
I. GENERAL SYSTEM REQUIREMENTS 1-1
1. INSTALLATION 1-1
2. ENVIRONMENTAL 1-2
3. OPERATING PERSONNEL 1-3
4. MAINTENANCE AND TESTING 1-5
5. EXPANSION, ADDITION, AND MODIFICATION 1-6
6. DESIGN 1-7
7. DOCUMENTATION 1-10
8. RELIABILITY 1-11
II. FUNCTIONS 2-1
1. LINE FAULT PROTECTION 2-1

2. TRANSFORMER FAULT PROTECTION 2-8
3. BUS FAULT PROTECTION 2-13
4. BREAKER FAILURE AND FAULT PROTECTION 2-17
5. AUTOMATIC SWITCHING SEQUENCES 2-21
6. LOCAL CONTROL OF VOLTAGE AND VAR FLOW 2-25
7. LOCAL MAN-MACHINE SUBSYSTEM 2-28
8. REVENUE METERING 2-33
9. REMOTE SCADA INTERFACE 2-37
10. TIE TRIPPING 2-44
11. LOAD SHEDDING 2-47
12. SHUNT REACTOR PROTECTION 2-50
13. TRANSFER TRIPPING 2-53
14. PILOT AND TRANSFER TRIP CHANNEL MONITORING 2-56
15. INDICATION AND SEQUENCE OF EVENTS RECORDING 2-60
16. LOAD MONITORING AND OUT-OF-STEP PROTECTION 2-64
17. AUTOMATIC RECLOSING 2-69
18. MONITORING AND CONTROL OF BREAKERS AND SWITCHES 2-74
19. SYNCHRONISM CHECKING AND SYNCHRONIZER CLOSING 2-78
20. OSCILLOGRAPHY 2-81
21. LINE FAULT LOCATION ESTIMATION 2-85
22. DATA LOGGING 2-88
23. ALARMING 2-92
24. INFERENTIAL MEASUREMENT CHECK 2-97
25. TRANSFORMER OVERLOAD MONITORING 2-100
26. SELF-CHECKING 2-103
ix
SUMMARY
One of the major activities during Phase I of Project RP 1359-1 was the development
of functional specifications for a substation protection and control system. The
procedure used to generate such a specification was as follows: An initial list of
general requirements and functions was prepared by a joint effort of Westinghouse and
the Host Utility. This information was transmitted to five Utility Advisors for
their review. Each advisory Utility was visited and discussions on the functional
requirements were held. Following these discussions and a review of written comments
by the Advisors, the requirements were combined and regrouped into the form that
appears in this document. General requirements cover the areas of installation,
environment, operating personnel, maintenance and testing, expansion and
modifications, design, documentation and reliability. Twenty-six functions are
described individually. Included for each function is a functional description, an
input and output list, and a set of requirements.
The list of functions and requirements presented here is a long wish list of all that
could possibly be implemented in such a system. It is realized that any one
installation would only contain a subset of these functions and features. The list,
however, has served as the starting point of detailed design considerations during
the process of translating functional requirements into implementation details.
S-l
SECTION I
GENERAL SYSTEM REQUIREMENTS
INSTALLATION
1.1. The following functions shall be designed so that they can be implemented,
if desired, in a stand-alone mode. As much as is practical, they shall be
physically packaged separately from one another and shall be able to inter
face directly to substation apparatus such as pt's, cpd's, ct's, trip
coils, breaker auxiliary contacts, dc supplies, etc., independently of
other system functions or equipment:
PRIMARY LINE PROTECTION

BACKUP LINE PROTECTION
PRIMARY TRANSFORMER PROTECTION
BACKUP TRANSFORMER PROTECTION
PRIMARY BUS PROTECTION
BACKUP BUS PROTECTION
SHUNT REACTOR PROTECTION
BREAKER FAILURE AND GROUND FAULT PROTECTION
1.2. For ease of maintenance, especially during inclement weather, indoors loca
tion is preferred for cortplex control devices. It is normal practice to
functionally test all control equipment during scheduled maintenance or
unscheduled repairs.
However, some devices of the system will have to be installed in locations

other than the control house. There, provisions shall be made for easy
changeout of the control devices so that any required troubleshooting can
be done at a more convenient location.
1.3. Maximum shipping dimensions shall be limited to permit movement through the
control house opening. For this R&D project, all panels can be assembled
in the factory on a common base and shall clear an opening of 2.0m high by
1.75m wide.
1.4. Panels shall be rigid and designed for easy field handling and skidding on
base; proper support points shall be provided for lifting by crane without
distortion of panels.
1.5. Equipment components and modules shall be sized to allow one man to handle
them.
1.6 Special control cables (e.g., fiber optic cables) shall be designed for
direct burial.
1.7 Special control cables supplied by the contractor must withstand cable
pulling forces of 50 kg and a minimum bending radius of 12 cable diameters.
[Pulling force will be larger if such cables are available.]
1-1
2. ENVIRONMENTAL
- ^
2.1 All control equipment shall be designed to function satisfactorily, without

misoperation or failure, under the influence of environmental extremes of
temperature, humidity, dust, seismic disturbances, and conducted and
radiated electromagnetic interference. Active environmental conditioners
(e.g., air conditioners, fans, etc.) shall be avoided.
2.2 Equipment installed in the control house will be exposed to 0° TO 55°C tem
perature variations with up to 95% non-condensing relative humidity, with a
maximum wet-bulb temperature of 35°C. Equipment installed in the other
locations of a substation must operate within -40° to +650C temperature
range and up to 95% non-condensing relative humidity. Cabinet heaters may
be used to prevent condensation where more serious humidity problems are
anticipated. Maximum rate of temperature change shall not exceed 20°C per
hour.
2.3 The seismic qualifications of the control equipment shall conform to pre
vailing national standards according to its location of installation and
service.
2.4 Equipment and components shall be protected against corrosion.
2.5 All control equipment shall withstand adverse EMI, radiated or conducted,
without misoperation or failure, in the following defined environments:
A. ANSI C37.90a-1974
B. Conducted fast transient
C. Portable RF transmitters
D. Transient electromagnetic fields (EPRI-1359-2) for switchyard
located equipment only.
2.6 All system hardware which performs critical protective relaying functions
shall conform to ANSI C37.90-1978. Critical protection functions are
numbers 1, 2, 3, 4, 12, 13, 14, plus parts of 16, 17, 18, 19.
1-2
3. OPERATING PERSONNEL
3.1 Display of equipment status and analog readings, and control of devices
shall be centralized. A CRT for displaying one-line diagrams and tables
is the preferred operator interface device during local substation manual
operation. A mimic-bus of the substation may be used optionally. For
stand-alone equipment, readouts and controls must be located at an
appropriate height for ease of viewing and manipulation by the average
operator. Controls shall be protected to prevent accidental operation.
3.2 Any operator shall have access to information at the station such as
metering, equipment status, passive sequence-of-events logs, alarms,
counters, etc.
3.3 Any operator interaction which directs, influences, or modifies operation

of the system shall have restricted access which may be programmed by the
user. Such interactions include equipment manual control, auto/manual,
test/service, and local/remote mode selects, any enabling or disabling
actions, addition or removal of entries in lists, any settings or setpoint
changes, any manual diagnostic or test procedures, and any alarm
acknowledgements, overrides, or inhibits.
3.4 For individual points or groups of points of the types listed in 3.3 above,
the user shall be given one category of local operators, plus 3 categories
of remote masters. He shall be able to program the system so that none,
all, or any combination of these 4 categories can control each point or
group of points. In the functional requirements, such points or groups are
characterized as operable by designated operators. Relay setting changes
shall require a more secure entry procedure.
3.5 Means shall be provided for programming of priorities for each of the 4
categories, in case more than one attempts to control the same point.
3.6 Some qualifying procedure such as code or password shall be used to iden
tify a local operator.
3.7 Local control may be initiated through the operator's console interface,
but backup electrical control of circiut breakers and switches must be pro
vided such that no single failure will affect both normal and backup
positions.
3.8 A physical way of disabling control of equipment for maintenance purposes

shall be provided by the user in the equipment cabinet.
3.9 Any operator action (remote or local) shall be recorded as an event for
sequence-of-events and related logs. The operator or remote master iden
tity shall be included in the logging. This does not apply to passive
access to data as described in 3.2 above.
3.10 Settings shall be classified into the following categories according to

their volatility and the level of expertise required to make changes:
A. Stored on non-volatile medium and changeable by unequipped personnel,

(e.g., switches)
B. Stored on non-volatile medium and changeable by specially equipped

personnel. (e.g., setting PROMs)
1-3
C. Stored on non-volatile medium and changed by programmer through soft
ware system modification or regeneration. (e.g., tables in mass
memory).
D. Stored on volatile medium and changeable by unequipped personnel with

type A, B, or C values inserted at startup or reset. (e.g., setpoints
in RAM). Set table remotely or locally.
E. Stored on volatile medium and changeable automatically by software

with type A, B, or C values inserted at startup or reset. (e.g., adap
tive settings in RAM).
Upon loss of power all settings of types D or E are initialized to their

nonvolatile fallback values.
3.11 Relay settings and other fixed operational parameters may be Class (A),
(B), or (C) as desired by user. They may be divided so that some of each
type are used, depending on likelihood of field setting changes. Variable
operational parameters such as limits and set points shall be Class (D).
Adaptive or self-settings are Class (E).
3.12 All changes of Class (D) settings shall be logged.
3.13 Optionally, all Class (E) settings which directly dictate some automatic
control action shall be logged when that action is taken. As a further
option a Class (E) setting may be logged whenever it changes, for
diagnostic purposes.
1-4
4. MAINTENANCE AND TESTING
4.1 Means shall be provided for testing each subsystem including the optical
links.
4.2 Maintenance and testing of all functions shall be performed primarily at

the substation. Optionally, some well-defined diagnostics may be initiated
remotely.
4.3 All maintenance instructions shall be in clear English language.
4.4 Each control equipment interfacing directly to substation apparatus such as

ct’s, pt’s, trip coils, etc. shall be equipped with test-switch isolation
facilities to allow removal of the control equipmet from service without
disturbing other control equipment. Test switch changes between service
and test positions shall not cause false equipment operations.
4.5 Test points, LED indicators, or card extenders shall be provided for all
equipment to facilitate troubleshooting. Routine adjustments shall be
accomodated without card withdrawal.
4.6 Sufficient test points shall be provided for localizing equipment trouble
to the card level. Use of indicators (e.g. LED's to indicate failure) is
highly desirable.
4.7 All communications channels for protective relaying and tranfer-tripping

shall accomodate or be provided with automatic test facilities. Test
failure shall be alarmed.
4.8 Maintenance personnel shall have the capability of switching between regu
lar and backup SCADA communication channels.
4.9 Loop-back facilities shall be provided at each communication interface.
4.10 Data test patterns shall be built in or shall be programmable within each
communication interface to facilitate troubleshooting.
4.11 Communication error statistics with channel identification shall be kept,

and made available on request.
4.12 The capability of injecting measured ac quantities of voltage, current, and

angle shall be provided to verify relay settings and oscillography
functions. The injection of such a test signal shall not affect the opera
tion of any component of the system which is not using the input being
tested. Design shall provide some means by which the modules receiving the
test data will be notified of that fact so that responses will be
suppressed. Degraded operation of the system, while in the test mode,
shall be accepted by the user except for functions having redundant backup.
4.13 The system shall be so designed that given sufficient hardware redundancy,
it shall be possible to arrange the primary and backup protection subsystem
so that during repair or scheduled maintenance of either subsystem, the
other subsystem can be operating and providing protection.
4.14 Diagnostic Software and test algorithms shall be provided to exercise the
processing elements on a regular basis. Test failures will be alarmed.
1-5
5. EXPANSION/ ADDITION, AND MODIFICATION
5.1 Additional control equipment for substation expansion shall be designed so

that installation will cause minimum station equipment outage and
disruption.
5.2 Man-machine interface shall accomodate the ultimate substation requirements

with minimum additional equipment and modifications.
Use of additional modular parts such as memory, processors, or CRTs in such

accomodation, where the additional parts are not delivered with smaller
systems, is not precluded.
5.3 The substation computer shall have sufficient capacity to handle the ulti
mate substation requirements with minimum additional equipment and
rewiring.
Use of additional modular parts such as memory, processors, or peripheral

devices in such accomodation, where the additional parts are not delivered
with smaller systems, is not precluded.
5.4 Design of control software shall be modular to allow easy addition,

deletion, or modification of functions.
5.5 Control equipment shall be of modular design and shall utilize plug-in con
nections to simplify equipment additions or removals with minimum rewiring.
5.6 Maximum use of the distributed processor approach shall be made. Any
control operation or data processing shall be performed at the lowest prac
tical level of hierarchy consistent with sound engineering design prin
ciples to minimize dependence on communication channels and to improve
response time.
5.7 Addition and checkout of functions shall be made on an off-line software

development facility by a programmer/engineer. Installation of new rege
nerated software system shall be accomplished in steps without turning off
the system.
5.8 Initialization or modification of selected parameters already included in

the software can be made by a person with minimal programming skills.
1-6
6. DESIGN
6.1 All control equipment shall be designed to operate from the station battery
source. Battery voltage may vary from 84% to 116% of nominal value. The
contractor shall specify the battery drain current of each subsystem
supplied. Initial design shall be for 125 Vdc nominal. 48 Vdc and 250 Vdc
are also frequently encountered.
6.2 Any filtering and surge protection required to meet environmental specifi
cation above shall be the responsibility of the contractor. Filtering with
capacitors in excess of 1 microfarad is not acceptable on continuously
grounded equipment.
6.3 Contractor's control equipment shall be designed to maintain isolation bet

ween equipment chassis ground and dc supply (+) and (-) leads.
6.4 Contractor's equipment shall be supplied with fuse or circuit breaker pro
tection and an on/off switch for each module or subsystem to completely
isolate the equipment from the dc supply. Loss of power or functionality
shall be alarmed.
6.5 A grounding bus shall be available on all control equipment, racks, or

cabinets.
6.6 Control equipment connections to the substation apparatus shall be designed

to interface to conventional ct's, pt's, contacts, and coils as well as new
digital ct's and transducers.
6.7 The analog input subsystems shall accept and digitize voltage samples of up
to 2.5 p.u., and current samples of at least 40 p.u. Values in excess of
these full-scale limits shall not cause erratic program outputs or misop
eration of functions.
6.8 Voltage input channels should be able to interface to an electronic poten

tial transducer when it becomes available.
6.9 Current-input channels shall be designed to accept signals from iron-cored

relaying and metering ct's. A design shall also be produced for an inter
face to the EPRI/Westinghouse electronic ct (RP-560). Design shall allow
for connection of linear couplers as well.
6.10 Current-setting and current-influenced specifications in the function docu

ments have been given in terms of current transformer secondaries having 1
per unit loading equal to 5 A. Design shall recognize the possibility that
other types of ct's using different current magnitudes or output formats
may be used in future installations. Appropriate input channels, and means
of entering or reviewing settings, must both be described.
6.11 A means shall be provided to mask input relay bounce on opening, closing,
or both. Bounce on closing shall be masked by providing a time-delayed
dropout of adjustable period after the contact closes. Bounce on opening
shall be masked by providing a time-delayed pickup of adjustable period
after the contact opens. Dropout or pickup delay shall be adjustable 0 to
30 ms.
6.12 Contact input voltage supply may be different than battery voltage to
system.
1-7
6.13 Tripping outputs shall carry up to 30A for Is. Output drivers shall reset
automatically in 12 ms after fault disappears.
6.14 Low level control outputs (e.g. BFI, Reclose initiate, etc.), shall carry
3A continuously and shall be capable of interrupting 0.5A inductive at 125
Vdc. Fault-related outputs shall automatically reset after fault
disappears.
6.15 Relay inputs and outputs shall be available to other subsystems.
6.16 Protection of equipment against telephone-line overvoltage and surges shall

be provided by the user, unless supplier is specifically requested to pro
vide it.
6.17 Equipment should meet all relevant industry standards in effect at time of
manufacture.
6.18 The design shall be made as fail-safe as is practical. This means that the
supplier shall approach the hardware and software design in such a way that
the more probable or foreseeable failure modes produce passive or secure
behavior of control and data outputs. However, specific outputs in
response to particular failures may be called for elsewhere in this
document, or by the user at time of system specification.
6.19 Redundant equipment shall be physically and electrically segregated as much

as practical so as to achieve independent operation.
6.20 The design shall minimize the probability of a single component failure
causing a cascading component failure or subsystem misoperation.
6.21 No unintended output or equipment failure shall result in the event of

short circuits and grounds on the communications circuits or power supply
leads.
6.22 Control equipment shall not issue spurious outputs in the event of power
failure. The equipment shall execute an orderly restart upon restoration
of power.
6.23 No failure in one hardware subsystem shall cause a failure in another hard
ware subsystem.
6.24 When a redundant or failover system is supplied, critical functions shall

be designed in such a manner that no such function shall be lost as a con
sequence of a single failure. Critical functions shall include:
A. Line Protection
B. Bus Protection
C. Transformer Protection
D. Breaker Failure and Ground Fault Protection
E. Shunt Reactor Protection
6.25 Facilities for manual switchover to and from the secondary system shall be
provided.
6.26 A backup A/D system if used shall be tested periodically on a scheduled

basis (by software) to assure that it is functional.
1-8
6.27 Communications links between primary and backup may be provided for redun
dancy of input sources and control outputs depending on equipment con
figuration design.
6.28 Equipment furnished by the contractor shall be fabricated of non

combustion-supporting materials . Electrical conductor insulation shall be
self-extinguishing.
6.29 All equipment markings, nameplates, and labels shall be resistant

to handling, aging, and fading.
6.30 Contractor shall minimize the use of special function hardware. Special
functions should be performed by software whenever possible.
6.31 Hardware shall be functionally modularized to promote commonlity of hard

ware modules among various subsystems.
6.32 No electromechanical devices shall be used for mass storage.
6.33 Isolating test switches shall be supervised through the use of covers or
supervisory interlocking blades.
6.34 Type of terminal blocks shall be an option to be specified by each utility

ordering a system.
6.35 Hardware to be used on energized power circuit parts may be specified by

the user when ordering.
6.36 Sufficient space and support shall be provided at the external connection
points to accomodate wires and cables which enter the equipment from the
top and/or bottom.
6.37 Cables should be segregated according to function; (e.g., controls, power

supply, etc) .
6.38 Discrete components and integrated circuits shall be "off the shelf" items
supplied by more than one manufacturer.
6.39 All processor control memories shall be equipped with failure detection
means (e.g. check sum on control ROMs).
1-9
7. DOCUMENTATION
7.1 All equipment shall be supplied with the following hardware documentation:
A. Mechanical outline drawings.

B. Instruction book with troubleshooting manuals.
C. Detailed input, output and internal wiring diagrams.
D. Component layout diagrams.
E. Schematic diagrams.
F. List of suggested spare parts and test equipment.
G. Installation instructions.
H. Adjustment and calibration instructions.
I. Technical description and theory of operation.
J. Periodic maintenance procedures.
K. Bill of material.
L. Part number cross-reference to original manufacturer's part number and
generic part number.
M. List of system options and descriptions of each.
7.2 All software documentation shall be of high quality, and supplier shall
certify that it corresponds to the software actually shipped. The documen
tation shall include but shall not be limited to the following information:
A. Block diagrams detailing hardware-software interaction.

B. Detailed coding flow charts for all software modules depicting the
sequence of computation and logic.
C. Flow charts shewing interaction of the software modules of (B).
D. Narrative descriptions of all functions.
E. Explanations of algorithms.
F. Program source on buyer-approved medium.
G. Any software manuals the seller receives with the equipment the seller
purchases from others.
H. Coding listings with sufficient comments to describe all logical func
tions being performed.
I. Software maintenance programs (data-base builders, etc).
J. Diagnostic routines.
1-10
8. RELIABILITY
The reliability and availability estimates for the chosen hardware configuration
shall be based on constituent MTBF's derived from one of the following methods:
A. Measured failure rate data of the actual devices used.
B. Failure rates taken by comparison of the devices in the designed modules with
those as in (A) for which measured data exists using suitable multiplier
based on comparative complexity and stress level.
C. Where neither of the above methods are available, calculations shall be made
using the procedures given in MIL-HDBK-217B or 217C.
In all cases, this data shall be extrapolated to the upper temperature limit of
the design specifications.
1-11
SECTION II
FUNCTIONS
LINE FAULT PROTECTION
I. FUNCTION DESCRIPTION
For a fault anywhere along the protected transmission line, initiate high
speed tripping of circuit breakers at each terminal.
For pilot protection, a communications channel between or among terminals

is utilized to precisely fix the protectedrzone boundaries and to facili
tate simultaneous tripping at all of the terminals. Initial implementation
will utilize on-off carrier (or other channel specified for demonstration).
Logic shcemes for other channel types will be allowed for in design.
Applications involving 3 or more terminals including weak-feed terminals
will be allowed for in future designs.
For non-pilot primary protection the program initiates high-speed tripping

of circuit breakers at local line terminal for a fault which appears to be
located along the protected line, based solely on measurements made at the
local terminal. This includes underreaching distance, high-set
overcurrent, and close-in tripping. The two or more functional implemen
tations at each of the line terminals, working independently, should be
capable of simultaneously, or at worst sequentially, clearing all line
faults. Means of adaption of distance measurements to load flow and fault
resistance for more accurate reach may be included.
Remote-backup fault protection is provided to trip the line for distant,

external faults not cleared at high speed due to a failure of remote relays
or breakers. It initiates intentionally time-delayed tripping of the line
circuit breakers for faults which lie within some limit set well beyond the
end of the transmission-line protected zone. Mulitple remote limits, with
independent intentional delays, may be provided to coordinate with primary
protection means.
For the initial design, three-phase tripping will be provided for all
faults. Design shall allow for future addition of phase selection and
single- or selective-pole tripping output.
2-1
LINE FAULT PROTECTION (Cont'd)
II. I/O REQUIREMENTS
Inputs
1.1 Voltage signal samples from three-phase bus and/or line

pt/cvt set.
1.2 Current signal samples from up to 4 three-phase ct sets.
1 .3 Residual current signal samples for each connected ct set.
1 .4 Zero-sequence current value from other mutually coupled lines (if

needed) .
1 .5 Channel receiver logic output state.
1 .6 Loss-of-channel indication.
1.7 Breaker status.
1 .8 Pilot protection cutoff/enable signal.
1 .9 Out-of-step trip blocking or delay.
Outputs
2.1 Tripping outputs for 4 breakers.
Initially, one trip output per breaker. Design will allow for
future addition of independent pole tripping for single-pole
operation (i.e. three outputs for each of the 4 breakers).
2.2 Reclose initiation.
• high-speed unsupervised (pilot trip)

• high-spped supervised (non-pilot trip)
• time-delayed (all primary trip)
• single-pole versus three-pole delays (optional)
Reclosing output is logic signal; design shall allow for optional

contact or solid-state output.
2.3 Breaker-failure initiate for 4 breakers; logic signals. Design

should allow for optional contact or solid-state output.
2.4 Channel transmitter logic-state control output.
2.5 Zero-sequence current value for protection systems of other

mutually-coupled lines.
2.6 Sequence-of-events data.
2.7 Optional local operator indications on host module.
2.8 Setting and tripping^table displays.
2-2
LINE FAULT PROTECTION (Cont’d)
III. FUNCTIONAL REQUIREMENTS
1. Performance
1.1 Logic and Settings
1.1.1 Principal protection means shall be a combined directional-

comparison pilot and underreaching distance non-pilot
(zone 1) scheme using impedance or related computations.
1.1.2 There shall be an option whereby, if zone 1 direct tripping

is not normally used, it shall be enabled upon loss of
pilot protection.
1.1.3 Relay system design shall optionally allow for possible

coordination with existing pilot relay equipment at the
opposite end of the protected line.
1.1.4 Pilot channel equipment and testing means shall

optionally be an integral part of the relay system. This
includes audio tones and/or power-line carrier set.
1 .1 .5 Initial pilot-logic design shall be for two-terminal

lines with strong sources at both ends. Channel logic
shall be compatible with user-specified carrier channel.
Future design shall allow options for:
A. Blocking, using on-off carrier.
B. Unblocking, using FSK carrier.
C. Permissive overreaching transfer trip with FSK audio

tones or equivalent.
D. Permissive or direct underreaching transfer trip with

FSK audio tones or equivalent.
E. Segregated phase comparison of phase and neutral cur

rents or of delta and neutral currents, using special
audio tones or power-line carrier equipment designed
for such systems.
F. Mixed-sequence phase comparison using on-off or FSK

carrier, or FSK audio tones; with optional distance-
relay supervision.
G. Optional logic in directional comparison schemes (A,

B, C, D above) for relaying 3-terminal lines.
H. Optional logic for lines with weak-feed terminals.
1.1.6 Line protection equipment shall have a reach setting range

of .05 to 40 ohms at 45 to 90 degrees line angle.
1.1.7 Relay reach shall be adjustable to within 1% of reach

setting (with no increment less than .001 ohm). Line
angle to be adjustable in 3 degree steps.
2-3
LINE FAULT PROTECTION (Cont’d)
1.1.8 High-set overcurrent tripping shall be provided and

adjustable from 5 to 100 A, in steps of 0.5 A. Accuracy
to be 2% at 100 A.
1.1.9 Optional line-energization overcurrent (close-in)

tripping capability shall be operational after line
closing for a period of time preselected by the user, in
case polarizing-voltage signal is unavailable. Delay
settings range from 1 to 60 cycles in 1-cycle steps.
1.1.10 Overcurrent fault detector function for trip supervision

shall be provided, adjustable from 1 to 12 A.
1.1.11 The relaying logic shall seek to execute phase-distance

or equivalent protection for all faults involving
multiple phases. Ac inputs will consist of line-to-
ground voltages and phase currents only.
1.1.12 Optionally, the design shall allow for the transfer of

residual-current data among line processors protecting
mutually coupled lines, for mutual compensation of ground
distance measurements. Software for each line shall
allow for mutual compensation from two other lines.
1.1.13 For pilot-unblocking schemes, the pilot signal shall be

initiated by the presence of line current. Sensitivity
shall be 0.1 to 10 A, adjustable in 0.1 A steps.
1.1.14 Allow for future optional programs which will analyze

available data to modify remote-backup tripping speed
according to fault type, channel conditions, and local
bus voltage.
1.1.15 As an option, if line protection uses bus-side potential

sources, relays must be able to transfer from one bus to
the other. When line-side sources are used, relay design
shall allow for bus-side polarization when line potential
is unavailable (e.g., on energization).
1.1.16 Optionally, design shall allow for future integration of

transfer-trip function with pilot unblocking relay system
to utilize one channel equipment only (e.g., use guard
signal for continuous carrier relaying, use trip signal
for transfer trip).
1.1.17 Relay system shall optionally include 2nd and 3rd

(forward), and 4th (reverse) zones with separate trip
time delays of 0.1 to 3 s 2nd zone, 0.2 to 5 s 3rd zone,
and 0.2 to 5 s 4th zone.
1.1.18 A directional high-set overcurrent function for weak

sources shall be provided as future option. Setting
range shall be from 1 A to 12 A in 1 A steps.
2-4
1.1.19 Optionally, provide a time-overcurrent tripping function

to limit duration of fault-current flow. Stay below
It = 1500 As to 10,000 A primary; I2t = 15 x 10^ A2s
above 10,000 A primary.
1.1.20 Optionally, design shall allow for future inclusion of

special logic which, on loss-of-potential, will fall back
to a sensitive overcurrent measurement which overtrips
but does not trip spontaneously. Setting range shall be
1 A to 12 A in 1 A steps.
1.1.21 For non-pilot trips, reclose intitate (RI) shall be

limited to 1st zone and high-set trip only. This RI
shall be distinct from the pilot-trip RI, to allow dif
ferent reclosing action. Optional RI outputs for zones
2, 3 and 4 to initiate time-delayed reclosure.
1.1.22 The program shall include secure phase-selector capabi

lity for logging and for future single-pole trip
capability. Single-pole tripping logic in the line-
protection subsystems shall be capable of the following;
A. Trip only the faulted phase for SLG faults.
B. Trip all three phases for multiphase faults.
C. Issue distinct RI's for single-pole trips versus

three-pole trips.
D. Convert single-pole trip to 3-pole trip after unsuc

cessful reclosure.
E. Optionally, initiate tripping of one faulted phase

only on phase-phase faults.
1.2 Characteristics
1.2.1 Steady-state accuracy of reach shall be within 1% of

setting; line angle within 3 degrees of setting.
1.2.2 Zone 1 protection shall be able to cover 90% of line

without overreaching; barring extreme power-system
induced errors from mutuals, etc., for which there is
insufficient local data for a reasonable correction.
1.2.3 All non-pilot distance-measurement functions will exhibit

an inverse time-distance operating characteristic beyond
50% - 70% of reach setting (Remote-zone time delays,
however, shall be fixed).
1.2.4 Maximum operating time shall be as follows: For a fault

whose ac signals are contaiminated by harmonics of 15%
third and 7.5% fifth (prefault base), time from fault
inception to trip output shall be 16 ms or less for
2-5
faults at 50% or less of the distance from the relaying

location to a given zone boundary, and 20 ms or less for
faults at 90% or less of the distance to the boundary.
1.2.5 Relay shall be designed to minimize sensitivity to load

flow, power swings, and switching surges. Optionally,
the relay shall ignore effects of series capacitors in
any line on the source side of the relay, including gap
flashing. At least one future design shall function with
capacitors in protected line.
1.2.6 Fault resistance accomodation shall be 100 ohms (primary)

at 230 kV or 250 ohms (primary) at 500 kV, for single
phase-to-ground faults. This specification is subject to
future revision.
1.2.7 Relay shall not initiate trip on loss-of-potential or

loss-of-dc, or on reapplication of either, or on transfer
of I/O between service and test quantities.
1.2.8 Collapsed-voltage faults shall result in trip output long

enough (.25 s) for local backup logic to operate.
2. Operating Personnel
2.1 Pilot Channel on-off control shall be provided.
2.2 Data to sequence-of-events log shall include at least:
A. Fault type/faulted-phase identification.
B. Trip type - pilot; zones 1, 2, 3, 4 as used, high-set;

close-in; reduced overcurrent.
C. Trip output, including trip time.
D. Fault level and duration.
E. Apparent impedance or physical parameters.
F. Adaptive setting values which bear directly on trip.
G. Pilot signal sent.
H. Pilot signal received.
I. Phases tripped (for single-pole trip).
2.3 Optional indicators on the host module shall show trip type.
2-6
3. Maintenance and Testing
3.1 The user must have a convenient way to verify correctness of ac

inputs to the system using load quantities. This may be provided
indirectly through other functions.
3.2 Store the essential results of each calculation (after every new
set of sanples). Following the fault, dump this record as a
testing and optional production feature.
2-7
2. TRANSFORMER FAULT PROTECTION
Initiate high-speed tripping of circuit breakers to isolate transformer or

bank for any fault within the protected zone. The implementation must
discriminate between internal faults requiring tripping, and through faults
or inrush currents requiring restraint. Also, detect overvoltage and
either trip or restrain as desired by the user.
Provisions should be made for future inclusion of V/Hz protection of unit-

connected transformers.
High-set differential overcurrent sensing {unsupervised by harmonic

restraint) is to be included. High-set through overcurrent tripping can be
included.
2-8
TRANSFORMER FAULT PROTECTION (Cont'd)
1. Inputs
1.1 Samples of three-phase current signals at each breaker connected

to transformer, or directly from each bushing ct. Up to 6 sets
must be accomodated.
1.2 Samples of residual (or circulating delta) current signals, if

provided.
1.3 Signals for measurement of voltage magnitude from either or both

sides of transformer. Consider interface to bushing taps.
1.4 Switch-state and/or voltage data to determine energization status

and recent history of transformer.
1.5 Status input(s) for high-speed ground switch initiation, or for

other device external to transformer zone for which transformer
should be isolated.
1.6 Sudden-pressure relay contact.
1.7 Gas analyzer contact or data.
1.8 Partial-discharge detector contact or data.
2. Outputs
2.1 Tripping outputs for up to 6 breakers.
2.2 Initiation for breaker-failure check for up to 6 breakers.
2.3 Lockout of each tripped breaker.
2.4 Transfer-tripping and/or carrier control for up to 4 lines.
2.5 Optional local EM lockout switch energization.
2.6 Recovery-initiation signal to Automatic Switching Sequences

function.
2.8 Optional local operator indication on host module.
2.9 Setting, tripping-table, and lockout-table displays.
2-9
1. Performance
1.1.1 The main protection means shall be variable-percentage

differential measurement with second harmonic restraint.
1.1.2 An instantaneous differential-overcurrent trip capability

shall be provided. Its setting shall be adjustable from
5 to 80 A in steps of 1A.
1 .1 .3 Conventional relay accuracy ct's may be used. Ct's or

groups of ct's need not have consistent ratios; means of
adjusting for ratios of various ct-set inputs shall be
included.
1.1.4 Wye connection of all ct inputs shall be permitted, and

protection function shall deal internally with phase
shifts produced by bank as follows:
• No phase shift (autotransformer bank primary and

secondary; wye-delta connected bank with wye-side ct's
connected in delta as with conventional relays).
• 30° phase shift (wye-delta bank with primary and secon

dary ct's both connected wye).
• ± 30° or i 60° phase shift (zig-zag bank connection

with all ct's connected wye).
• 15° increments (future option for new types of zig'-zag

connections).
1.1.5 No misoperation shall result from ground current flow in

bank neutral for external ground faults.
1.1.6 The relay shall measure circulating current in a delta

tertiary winding or infer it from residual current in
primary and secondary; and shall trip after delay for
circulating overcurrent.
..
2-10
1.1.7 The design shall incorporate logic to optionally combine

and/or supervise tripping for various external on-off
type sensors such as:
A. Sudden-pressure relay.
B. Gas analysis relay.
C. Overtemperature contact.
D. Ground switch closure external to transformer zone.
Each shall be capable of initiating direct trip in 2 to 8

ms if desired by user.
1.1.8 The relay shall have overvoltage protection consisting

of 2 overvoltage thresholds, each settable to between
100% and 130% of normal voltage, and each with its own
settable time delay. One, used for alarm, shall be
adjustable from 1 to 10 minutes. The second, for
tripping, from 0 to 60 s.
1.1.9 Sensitivity of harmonic restraint shall be adjustable

from 5% to 15%.
1.1.10 The design shall allow for optional time-overcurrent

function which can trip for prolonged through faults.
1.1.11 The relay shall optionally adjust its settings to compen

sate for transformer tap changes.
1.1.12 The design shall allow for future addition of V/Hz

protection. The function shall provide the facility for
defining one inverse time vs. volts/hertz curve to match
the user's transformer characteristics. The curve shall
have 5 definable coordinate points. The time delay and
volts/hertz coordinate points shall be programmable at
time of system initialization. The function shall be
programmable for a trip output or alarm.
1.2 Characteristics
1.2.1 The relay sensitivity should meet or exceed the

following:
A. Detect turn-to-turn short circuits for 5% of the

winding.
B. Detect phase-to-ground fault for 95% of winding.
C. Detect a phase-to-phase fault for 95% of either

winding.
In any case, sensitivity to these fault types shall meet

or exceed that or existing relays.
2-11
TRANSFORMER FAULT PROTECTION (Cont’d)
1.2.2 Differential tripping shall operate in no more that 20 ms

from fault inception to trip output. Differential over
current shall trip in 8 ms or less.
1.2.3 The trip delay shall not normally exceed 16 ms when

closing into a faulted transformer (Plus normal trip
time). Users must recognize that very mild faults com
bined with severe inrush distortion will be cleared only
after a longer delay.
1.2.4 The relaying shall not misoperate on through faults, even

if ct's saturate.
1.2.5 The function shall not trip on inrush (unless transformer

is detectably faulted), even if ct's saturate.
A. Fault type/faulted phase identification.
B. Trip type - differential, high-set differential, pressure,

overcurrent, overvoltage, etc.
C. Trip output indication, including trip time.
D. Inrush restraint.
E. Tap position (if available).
F. Adaptive setting values which bear directly on trip.
G. Fault level and duration.
2-12
3. BUS FAULT PROTECTION
Initiate high-speed tripping of circuit breakers to isolate the protected

bus section for any fault within the protected zone. For current signals
from iron-cored current transformers, the implementation must discriminate
against ratio errors resulting from saturation.
Conventional relay-accuracy ct's will be used for demonstraction. Design

should consider use of linear couplers and electronic ct's.
Protection is to be provided by individual phase differential measruements,

with residual-current summing as a backup ground fault detection means.
Optional automatic reclosing is to be considered.
2-13
BUS FAULT PROTECTION (Cont'd)
1. Inputs
1.1 Samples of three-phase current signals from each breaker on the

bus. Up to 12 sets must be accomodated, with design con
sideration of 20 sets.
1.2 Samples of residual current signal from each breaker ct set.
1.3 Status inputs for transfer-bus schemes.
2. Outputs
2.1 Tripping outputs for all breakers on bus (may be 12 to 20).
2.2 Initiation for breaker-failure check (BFI) of each tripped

breaker.
2.3 Lockout of each tripped breaker (except with reclosing).
2.4 Reclose initiate (optional).
2.5 Optional output in control house for EM lockout switch.
2-14
BUS FAULT PROTECTION (Cont'd)
1. Performance
1.1.1 The main protection method shall be instantaneous

percentage-differential measurement.
1.1.2 The protection shall utilize inputs from conventional

relay-accuracy ct's. The ct's should not be required to
have matching ratios or accuracy classes.
1.1.3 The design should allow for future use of linear couplers
and low-energy electronic ct's (ECT's).
1.1.4 Ground overcurrent shall be used as a time-coordinated

backup for phase differential measurements. Delay and
logic shall be used to avoid tripping on external faults
with ct saturation. Delay and pickup must be adjustable.
1.1.5 The design shall provide for optional automatic reclosing

initiation:
A. At high speed, all breakers.
B. With time delay - test bus after adjustable delay of

0 to 50 s from a selectable source. If preferred
source is dead, an alternative source is used.
1.1.6 For utilities who reclose at high speed for bus faults,
single-pole tripping for bus faults may be considered in
the future.
1.2 Characteristics
1.2.1 The relay shall not misoperate on through faults of up to

25 times rated current in any connected line, even though
one or more ct's are saturating.
1.2.2 The maximum operating time shall not exceed 16 ms, unless
a surge arrestor is included in the bus zone. In that
case, operating time may be up to 24 ms.
1.2.3 The relaying shall be able to avoid misoperation on surge

arrester follow-current into the bus zone.
A. Trip output, including trip time.
B. Faulted-phase identification/fault type.
2-15
BUS FAULT PROTECTION (Cont’d)
C. Fault level and duration.
D. Adaptive setting values which bear directly on trip.
E. Trip type - percentage differential, instantaneous

differential, etc.
2-16
4. BREAKER FAILURE AND FAULT PROTECTION
If a breaker trip circuit is energized to clear a fault, interruption of

current flow should occur after a specified time period dependent on the
characteristics of the particular breaker. This function detects that a
fault identified by some relaying system has not been cleared by the pro
tected breaker, and initiates tripping of adjacent, backup breakers to iso
late the fault and malfunctioning breaker.
This breaker-failure protection is to be modeled after the new Westinghouse

SBF-1. This generally permits the protection to determine if the breaker
is closed without using "a" contacts, i.e., using a very sensitive current
detector, while retaining a high level of security.
In addition to instances where the breaker fails to clear external faults

when requested by other protection functions, this particular function
shall operate for breaker ground faults (where applicable). The breaker-
fault function shall operate without intentional time delay when a breaker
ground ct is available; otherwise, such breaker faults are cleared after
the breaker-failure time delay.
Modules of breaker-failure protection are to be provided and applied on a

basis of one or more per breaker.
Optionally, to back up current as the primary indicator of breaker

condition, an "a" contact input coupled with unbalanced voltage on the bus
activates an additional timer, in case the ct has been destroyed.
2-17
BREAKER FAILURE AND FAULT PROTECTION (Cont’d)
1. Inputs
1.1 Samples of three-phase current signals from protected breaker.
1.2 Samples of residual current signal.
1.3 Ground ct current signal, if used. Three phases are combined.
1.4 Breaker "a" and "b" contact status, consolidated for three inde
pendent poles if used.
1.5 Breaker failure initiate (BFI) inputs from primary and secondary
relaying functions for zones on both sides of the breaker. May
be pre-identified as line, bus, or transformer protection
initiation. Also, an adjacent-breaker failure initiation may be
needed for future cascaded-B.F. applications.
1.6 Three-phase voltage samples or magnitudes (optional).
2. Outputs
2.1 Tripping outputs for adjacent breakers, up to 12.
2.2 Lockout of each adjacent breaker, up to 12.
2.3 Recovery-initiation signal to Automatic Switching Sequences

function.
2.4 Initiate transfer-trip, stop carrier, shift tone, etc.; 2 for

line or transformer isolation protection; 12 to 20 for bus
isolation.
2.5 Protected-breaker retrip on receipt of BFI.
2.6 Optional output in control house for EM lockout switch.
Outputs may be shared with other functions.
2-18
BREAKER FAILURE AND FAULT PROTECTION (Cont'd)
1. Peformance
1.1 Initiation of the function shall be from all functions which are
trying to trip this breaker except manual or supervisory control.
Initiation for breaker failure on other adjacent breakers may be
optionally provided.
1.2 Breaker failure timing shall not be initiated unless armed by a

fault detector within the processing element which performs the
breaker failure protection.
1.3 Once initiated, breaker-failure timing cycles and checks shall be

executed to completion.
1.4 Breaker Failure Function shall optionally discriminate between

single phase and polyphase faults and shall automatically select
one of two independently-set time delays. Each of these is
within the range given below for time delay to operate.
1.5 Optionally, if current is flowing in breaker ground ct circuit,

execute backup tripping measures without time delay.
1.6 User shall have option of using breaker auxiliary contacts to

detect failure for low-level (especially transformer) fault
currents. An independently-settable time delay shall be
available in conjunction with this input.
1.7 As an option, provide logic to monitor "a" contacts in conjunc

tion with unsymmetrically-collapsed bus or line voltage, in
order to execute backup clearing when failed-breaker ct has been
destroyed.
1.8 As an option, this function should immediately reattempt pro

tected breaker trip coil activation when BFI is received.
1.9 Time delay to operate shall be adjustable with a range of 30-350

ms with a minimum accuracy of ± 2 ms.
1.10 A control time delay, with instantaneous pickup and delayed

dropout, shall cut off overcurrent sensing after an interval of
50 to 500 ms.
1.11 Current-sensing pickup threshold on the three phases shall be

adjustable from 0.1 to 16 A with a minimum resolution of 0.1 A
(< 1 A) or 0.5 A (> 1 A).
2.1 Designated operators shall be able to inhibit or enable outputs

to individual breakers. Inhibited outputs shall be treated in
the logic such that no false output is possible on reenabling.
2.2 Designated operators shall be able to block or unblock function

operation. All logic and timing are inhibited on blocking so
2-19
BREAKER FAILURE AND FAULT PROTECTION (Cont'd)
that no subsequent false output is possible at time of

unblocking.
A. Breaker failed to clear fault

B. Breaker ground fault (optional)
C. Lockout initiated
D. Source of initiate
E. Failed pole identification
F. Clearing time (normal or backup)
2.4 Optional indicator on the host module shall show B.F. trip type.
2-20
5. AUTOMATIC SWITCHING SEQUENCES
With some bus configurations, tripping breakers to clear certain line or

bus faults results in the needless isolation of an unfaulted transformer
bank or bus section from the system. When configuration permits, implement
an automatic sequence of breaker and disconnect-switch operations (see
Function #18) which will bring the sound transformer or other apparatus
back into service even though the line or bus section is permanently
faulted.
Automatic switching sequences may also be employed for substation bus or

equipment rearrangement under normal conditions.
Automatic sequences may be initiated either automatically on occurence of

an event (or combination of events) or manually upon demand of designated
operators.
Examples of such switching sequences could be:
A. Bus transfers or sectionalizing.
B. Isolation of faulted transformer or faulted breaker.
C. Isolation of any power equipment unable to perform because of certain

equipment conditions (loss of dielectric strength, etc.).
2-21
AUTOMATIC SWITCHING SEQUENCES (Cont'd)
■-
1. Inputs
1.1 Initiation from automatic operation which requires sequence.
1.2 Manual initiation from designated operators.
1.3 Mode select (automatic, single step, checkout, etc.).
1.4 Single-step initiation.
1.5 Breaker and disconnect-switchstatus.
1.6 Internal logic status (lockout, etc.).
1.7 Currents and voltages.
2. Outputs
2.1 Sequence of automatic breaker and/or disconnect-switch operation

initiations.
2.2 Internal logic status (e.g. lockout, etc.).
2.4 Special displays for checkout or single-step mode.
2-22
AUTOMATIC SWITCHING SEQUENCES (Cont’d)
1. Performance
1.1 Switching sequences shall be preprogrammed. The programming

method shall permit the user to include checks on device opera
tion and status at each step of the procedure. If the execution
of any sequence step is not confirmed, the sequence shall stop
and an alarm shall be given.
1.2 Switching sequences shall be initiated by other functions, or by

designated operators.
1.3 Time delays of individual steps shall be adjustable.
1.4 Any blind spots created by operations in the switching sequence

shall be provided with speical fault protection, as dictated by
appropriate control commands in the sequence itself (e.g. over
current protection at specified ct location on/off).
1.5 There shall be a capability for including one or more steps

where the sequence halts allowing the operator to perform manual
operations. Upon completion of the manual step, the operator
shall notify the system, allowing the automatic sequence to be
resumed.
1.6 There shall be two modes of operation:
A. Automatic sequencing.
B. Single-step. On single-step operation it shall be possible

to either complete the operation and stop, or to print a
simple message describing the action that would have been
taken. Single-step operation may be initiated from local
operator console only.
1.7 Operator-input commands and control outputs shall each be

treated as events for the sequence-of-events log.
2.1 Designated operators shall be able to initiate or inhibit the

switching sequence.
2.2 Any blocking restrictions shall be shown on the operator's

display device.
3.1 Sequence changes, timing changes, or adjustments shall be per

formed by programmer/engineer. Other functions shall not be
affected by changes.
2-23
AUTOMATIC SWITCHING SEQUENCES (Cont’d)
3.2 A single-step switching sequence mode shall be available, using

operator prompts and manual inputs and generating messages of
the actions that would have been taken on the operator's display
device. This mode may be used to test and verify control
sequences. Operator step commands may be treated as events.
2-24
6. LOCAL CONTROL OF VOLTAGE AND VAR FLOW
'■w I. FUNCTION DESCRIPTION
Measure the voltage or VAR flow to be controlled in the substation; or

estimate the voltage at a remote point using local load flow measurements
and kncwledge of intervening line and transformer impedances.
Operate the transformer bank LTC, (adjustment of 1 phase or all phases) or

put LTC in and out of service, or switch capacitor banks, or reactor banks,
or synchronous condensers, to achieve target voltage or VAR flow. Provide
dead-band, delay, and inhibiting logic which suppresses unwanted transient
operation or hunting of the control system.
Operation can be manually initiated. The function should provide a remote

manual control capability. Setpoints for automatic operation shall be
alterable by designated local or remote operators.
v..
2-25
LOCAL CONTROL OF VOLTAGE AND VAR FLOW (Cont'd)
1. Inputs
1.1 Voltage setpoint.
1.2 Tap position.
1.3 Mode of operation (manual, automatic).
1.4 Status of manual operation (local, remote).
1.5 Control parameters (bankwidth, bias and time delays, permitted

deviations, etc.).
1.6 Operation inhibit from relcosing program.
1.7 Controlled voltage measurement.
1.8 Current flow to remote voltage-controlled point.
1.9 VAR loading data for parallel transformer banks.
2. Outputs
2.1 Contact open/close to capacitor or reactor banks.
2.2 Raise/Lower signal to LTC.
2.3 Alarms to designated positions.
2.5 Setting display.

LOCAL CONTROL OF VOLTAGE AND VAR FLOW (Cont'd)
• III. FUNCTION REQUIREMENTS
1. Performance
1.1 Control of parallel-connected tranformer tap changers shall be

used to balance var flows. Any deviation which shall cause
either transformer to exceed its ratings shall be alarmed. Tap
mismatch for equally rated transformers shall also be alarmed.
1.2 Anti-pumping logic and time-delay control lockout shall be

provided.
1.3 Adjustable contact closure time for tap-changer control may be

required for some installations.
1.4 If station has more than one type or size of reactive device, a
priority procedure shall be established for selection of bus
voltage to be adjusted, and reactive device to be used.
1.5 Automatic voltage control is suppressed during fault/reclosing

sequences.
2. Operationg Personnel
2.1 Designated operators shall be able to switch mode of operation

between auto and manual.
2.2 When in manual mode, designated operators shall be able to

switch between local and remote control.
3.1 The following variables shall be adjustable by designated opera

tors from the local operator's console/display device.
A. Control setpoint.
B. Control bandwidth.
C. Control bias & time delay.
D. Load compensation.
E. Transformer ratings for parallel operation and permissable
deviation of loadings.
2-27
7. LOCAL MAN-MACHINE SUBSYSTEM
This function enables the local operator to display and enter data, to per
form manual operations and to initiate and monitor diagnostic and main
tenance test functions. These operations are itemized below:
1. Data Display
Date and time

One-line diagrams with status and numerical information
Alarms
Alarm summaries
Sequence-of-events rcords
Fault records
Trend records
Display of device status
Display of relay settings
Control system configuration display, including out-of-service points
display and signal routing tables.
Logs
Display of control setpoints and settings
2. Data Entry
Operator's code or password

Changes in operator access tables
Relay setting changes
Control setpoint and setting changes
Alarm limits, alarm bypass, substituted limit values
Status of manually operated devices
Scan rates, trend control entries
3. Manual Control Operations
Breaker and disconnect switch operations

Switching sequences
Tap position control
Safety tagging (control inhibit/enable)
Enable/disable relaying functions (pilot prot., reclosing,
out-ot-step, breaker failure)
Configuration control (service/test, transfer, etc.)
Enable/disable control functions
Local/remote control select
Alarm acknowledge
I/O point service/test
4. Diagnostic and Maintenance Functions
Display of failure data logs

Display of error statistics
Initiation of diagnostic tests
Enable/disable functions
Single-step switching sequences
2-28
LOCAL MAN-MACHINE SUBSYSTEM (Cont'd)
V~ II. I/O REQUIREMENTS
1. Inputs
1.1 Present values from data base
1.2 Historical data
1.3 Equipment control mode status
1.4 Operator input requests
2. Outputs
2.1 CRT displays
2.2 Printed reports and logs
2.3 Chart recordings (option)
2.4 Control actions
2.5 Operator messages
2.6 Output to optional mimic-bus display
/-
v.
2-29
III. FUNCTIONAL REQUIREMENTS ■w*’
1. Performance
1.1 The operator's console shall consist of a combination of one or

two CRT's with a keyboard. The CRT shall have at least limited
graphic capability to be able to display one-line diagrams, with
superimposed metered or calculated values and status. Display
device operating restrictions such as lockout or safety tagging.
1.2 Other output devices such as printers, strip chart recorders or

video hard copy devices may be used optionally.
1.3 Initial response to operator's request either for a new page or

screen update should not be delayed more than 1 s. Screen
update on one-line diagrams shall be automatic at a rate of once
per sec.
1.4 CRT shall be capable of displaying a full screen of alphanumeric

characters in less than 3 s.
1.5 All power equipment shall be accessible for control by

designated operators. Local control can be executed either
through CRT cursor control and function pushbutton, or,
optionally, through dedicated control switches or buttons.
1.6 Remote/local selection shall be provided on a per point basis

and for the entire substation.
1.7 All operator actions shall be logged indicating time, type of

operation and source of control (local/remotes).
1.8 Point selection shall be by light pen on CRT display or by a

combination of cursor control and pushbutton operation.
1.9 Select-before-operate control sequence shall be used. Selected

points shall be identified on the CRT screen. Time from execu
tion request to breaker operation (excluding select operation
time) shall not exceed 1 sec.
1.10 Selection of an operation shall produce a flashing symbol on a

one-line diagram; and shall automatically provide the operator
with additional information pertinent to the operation, such as:
A. equipment has an alarm condition or no communications

B. potential on two sides of breaker not in synchronism
C. lockout or any other interlocks
D. equipment is tagged out
2-30
1.11 After the operate command is given, the correct operation shall
be confirmed using checks such as:
A. correct status change.

B. balanced breaker current (no open poles)
C. tap changer reaches a full step
These checks may be included in other functions.
1.12 All station analog data shall be accessible by the local

operator.
1.13 Operator's console shall have the capability of providing a

graphic trend of a selected analog quantity.
1.14 Optionally, locally recorded data which was not sent to the
master and was about to be overwritten.
1.15 Optionally, an analog meter shall be provided with variable

scale description, for displaying selected analog quantities.
1.16 Optionally, a CRT one-line diagram may be replaced by a mimic

bus with status and other indicators on apparatus symbols.
2.1 Operator shall be able to enter status of manually-operated

devices (manually-operated disconnect switches, removable bus
links, etc.). Upon entry the symbol on the CRT one-line diagram
shall change. Manually-entered status shall be shown in a dif
ferent manner from automatically updated status.
2.2 All operator messages shall be written in clear English.
2.3 Optionally, access procedures (such as entry of password) shall

be required for console operation. All local control actions
shall be inhibited until access procedures are satisfied.
2.4 Optionally, access password shall be alterable by designated

operators.
2.5 All attempted console accesses, successful or unsuccessful,

shall be logged. Optionally alarm.
3.1 Optionally, operator's console/display device shall be equipped

with two CRT's. Both CRT's shall be able to display same
information. All connections shall be made with plugs for easy
replacement.
3.2 Operator's console/display device may also serve as a

programmer's console.
2-31
3.3 Operator's console/display device may also be used to support

maintenance and testing of other functions and subsystems.
3.4 System shall permit display os SCADA tables on the local display
device.
8. REVENUE METERING
V,,. I. FUNCTION DESCRIPTION
Sample voltage and current signals and compute real and reactive power.
Integrate these values to obtain kWh, KVARh and demand readings. kVAh
should be provided if needed.
Option of receiving kWh pulses from conventional transducers and meters

shall be provided. These readings are accumulated for telemetry. If the
communication channel fails, the counters should have adequat capacity to
continue acccumulating pulses.
/■
2-33
REVENUE METERING (Cont’d)
1. Inputs
1.1 Instantaneous voltage & current from metering transducers.
1.2 Pulses from at least 10 conventional kWh meters and transducers.
2. Outputs
2.1 kW, kVAR, kVA, kWh, kVARh, )d7Ah and demand records (to be stored
in a non-volatile memory).
2-34
REVENUE METERING (Cont'd)
1. Performance
1.1 Watthours IN and watthours OUT shall be counted separately.
1 .2 Totalized substation IN and OUT watthour accumulators shall

also be provided capable of totalizing several individual
readings, if needed.
1 .3 Present total substation values shall be available to any opera

tor on demand.
1 .4 The kWh pulse accumulators shall each have a capability of

accepting 3600 pulse inputs per hour. The word length shall be
at least 16 bits.
1 .5 If SCADA fails to read, continue accumulating watthours until

65,535 counts are accumulated. If the communication link is not
restored the contents of accumulator shall be logged and accumu
lator reset to zero.
1 .6 A kWh Freeze option shall be included to allow a snapshot to be

taken for later retrieval.
1 .7 Accuracy shall meet or exceed the requirements stated in ANSI

Standard Cl 2-1975.
1 .8 Requirements for the response of the function to harmonics shall

be determined in accordance with available standards and test
results for conventional watthour meters.
1 .9 Handling of demand intervals up to 60 minutes in steps of 15

minutes shall be provided.
1.10 Optionally, provide line and transformer losses for compensating

calculation.
1.11 Maintain a heirarchy of peaks recorded (up to 5 in every

15-minute interval, if they vary more than 10%). Time tag each
to the minute for computation of average demand.
1.12 Optionally, digital revenue-metering programs will provide means

for compensating errors in pt's and ct's.
2.1 Change of scale factor shall be easily performed by a designated

operator.
2.2 Local calibrating facilities shall be provided. Test point

connections shall be provided for external calibration
capability.
REVENUE METERING (Cont'd)
2.3 Totalization of bus power flows shall be performed and error

shall be indicated.
2.4 Alarming for failure of the counter or memory shall be provided

to designated operators.
2-36
9. REMOTE SCADA INTERFACE
/'
•v., I. FUNCTION DESCRIPTION
The system must be capable of serving as a SCADA remote terminal. Several

different remote SCADA masters may be interfaced to the station processor
which acts as the slave. This function processes requests received from
the masters and generates responses which are sent back to the masters. If
implemented, it shall meet the following general requirements:
1. Requests from master
1.1 Requests for data retrieval (analog data, pulse accumulators,

status data, sequence-of-events files, etc.).
1.2 Requests for control selection.
1.3 Requests for control activation.
1.4 Reset or Deactivate.
1.5 KWh Freeze signal.
1.6 Special data (master time, access passwords, special control

function parameters, etc.).
2. Responses to master
2.1 Data (analog, pulse accumulators, status, sequence of events,

alarms, operator messages, etc.).
2.2 Reporting of change of status or analog values deviation.
2.3 Acknowledgement of control point selection or activation.
Communication line and interface equipment integrity is monitored,

error statistics are kept and upon detection of failure, the proper
failover action is initiated.
2-37
REMOTE SCADA INTERFACE (Cont'd)
1. Inputs
1.1 Analog, pulse accumulator, status and control signal lists.
1.2 Operator actions and requests.
1.3 Communication Equipment Status.
2. Outputs
2.1 Analog, pulse accumulator and status data transferred to master.
2.2 Acknowledgement of control selection and activation.
2.3 Communication error statistics.
2-38
^ III. FUNCTIONAL REQUIREMENTS
1. Performance
1.1 Communications
1.1.1 Separate communication interfaces shall be provided for

up to three remote masters. Communication speed shall be
selectable up to 2400 bps. Communication shall be either
half duplex or full duplex, and when by telephone, shall
be capable of operating on C-1 conditioned leased lines
(1200 bps on unconditioned).
1.1.2 It shall be possible for the system to have a dial-up

channel to the Protection Engineer as one of the three
remote masters.
1.1.3 Modems required shall optionally be an integral part of

the system.
1.1.4 Remote SCADA interfaces shall be designed in a modular

fashion and shall be adaptable for communicating in
various protocols used by different manufacturers.
1.1.5 Any master, or all masters at once, may interrogate the

control system as often as every 2 s.
1.1.5.1 Error checking shall include at least:
• Error detection check

• Message format and timing
• Address validity
• No response (detected by deadman timer)
• Data overrun
1.1.5.2 Corrective action shall include marking

channel/interface inoperative after n unsuc
cessful retries and switching to an alternate
channel if available.
1 .1 .6 Optionally, monitoring of microwave baseband equipment,

especially signal-to-noise ratio and squelching, shall be
provided, if suitable transducers are available in the
microwave equipment.
1.2 Control Operations
1.2.1 The system shall be capable of receiving control commands

from each of up to 3 SCADA masters. Control commands
fall under the following categories:
a. On-off control. Circuit breakers, disconnect control

(circuit switchers, transrupters, load-break
switches), start-stop of equipment, special system
arming-disarming, transformer tap raise-lower, etc.
■v .
2-39
REMOTE SCADA INTERFACE (Cont’d)
b. Setpoint control. Transformer or synchronous con-

denser voltage setpoint, generator control, etc.
Each function must be tagged with identification of which

master may exercise control over which points, plus
priority data in case two masters attempt conflicting
control actions.
1.2.2 It shall be possible to allocate control points to each

master so that they may be operated from that master
only. Upon failure of a master or its associated com
munication channel, it shall be possible to revert to
control of all points from the other master on command of
that master.
1.2.3 Select-before-operate shall be used for critical

commands. For non-critical commands such as raise/lower,
reset of local indicators, etc., select-and-operate
sequences may be used.
1.2.4 Selecting more than one control circuit at a time, or

sending an operate command inconsistent with the selected
address (e.g. trip command to an analog data address)
shall be rejected.
1.2.5 Disarm a selected circuit automatically if master fails

to send an operate command within n seconds or if it
sends a command other than "operate", n adjustable to
300 s.
1.2.6 During a control command no other control actions shall

be accepted. A control command shall remain in effect
for up to 5 s (adjustable) or until change of status of
device has occurred.
1.2.7 When a control point is in local mode, operation by SCADA

master is inhibited. The status of the device shall be
returned to the master indicating "local control only".
1.3 Data Communications
Capabilities shall be provided for exchanging the following

types of information between the station processor and the SCADA
masters.
1. Data from master to remote.

2. Status data from remote to master.
3. Analog data from remote to master.
4. Information files from remote to master.
1.3.1 Data from master
1.3.1.1 The system shall be capable of receiving from

any master special data such as master time,
access passwords, special control function
2-40
.
parameters, etc. When such information is
received it shall be stored and the appropriate
processing program shall be called.
1.3.2 Status data
1.3.2.1 Status data transmitted to the SCADA masters

shall fall in two categories:
1. Status with memory to record detection of

single bit change from close to open (used
for circuit breakers).
2. Status without memory of previous

operations.
1.3.2.2 Status with memory shall be grouped in two

groups with two change-of-status bits sent to
the masters on every transmission. The status
memory shall hold its information until interro
gated by a master. Up to 3 past statuses can be
deduced (e.g., trip-reclose-trip sequence).
1.3.2.3 Typically, the status of the following devices

and control points shall be kept and transmitted
to the masters:
A. Circuit breakers
B. Disconnect switches
C. Control test point
D. Station Local/Remote plus individual control
point Local/Remote
E. Synchrocheck status
F. Lockout status
G. Alarm indications for station equipment
H. All controlled devices and circuits
I. Selected uncontrolled devices
J. Failure indications from selected station
circuits
K. Failure of supervisory control subsystems
L. Safety tags.
1.3.2.4 Typically, the following digitally-encoded

information shall also be kept and transmitted
to the masters although it is not in single bit
status form:
a. Transformer tap-changer position

b. Phase shifter tap position
c. KWh Pulse accumulators
d. Equipment operation counts
1.3.2.5 All operations of connected equipment shall be

reported (including automatic or uncommanded as
well as remote or local) whether or not reclo
sures are successful.
2-41
1.3.2.6 No change of status shall be indicated in

response to a momentary input change of less
than a value adjustable from 2 to 8 ms.
1.3.3 Analog data
1.3.3.1 Typically, the following analog data shall be

transmitted to the SCADA masters upon request:
A. Bus volts
B. Line watts, vars, amperes
C. Transformer watts, vars, amperes
D. Calibration points (10% or 90% of full
scale)
E. Frequency (optionally)
F. Other analog data such as temperatures, gas
flow, etc.
G. Synchrocheck slip frequency, or voltage and
phase
1.3.3.2 The overall accuracy of the analog input sub

system shall be ± 0.1% ± 1/2 LBS with 99.7%
confidence.
1.3.3.3 For existing transducers, the input signal

ranges shall be "high level" (mA or V) and,
optionally "low level" (nf7) .
1.3.3.4 The group of analog points to be transmitted

shall be selectable by the requesting SCADA
master, which specifies the initial adress and
the number of points.
1.3.3.5 Scaling parameters for conversion from digital

raw data to engineering units shall be easily
changeable by local operators.
1.3.3.6 Points shall be easily taken in and out of ser

vice by local operators.
1.3.4 Information Files
1.3.4.1 The capability shall be provided for the system

to transmit to a requesting SCADA master files
of information stored in the substation
processor. The information shall be grouped
into several categories, each having a specific
code, and shall be transmitted at priority lower
than control or periodic analog or digital data.
2-42
2• Operating Personnel
2.1 Local substation operator shall be able to inhibit all SCADA

control functions by placing station in Local mode. Indication
of this status shall be alarmed to SCADA operators.
2.2 Local substation operator shall be able to inhibit individual

control and data functions for station equipment maintenance,
and to enable those functions.
3.1 A convenient means for adding points to the SCADA function, or

removing them, shall be provided at the local console/display
facility. Any such changes shall bel logged.
3.2 Capabilities shall be provided for loopback testing on com

munication side of interface. Initiation of loopback mode shall
be provided remotely by SCADA masters and locally by external
contact input. Optionally, loopback on the digital side of the
interface shall be provided.
3.3 A local and remote indication shall be given of all failures

detected.
3.4 A test mode shall be provided in which a snapshot of the last N

(N < 32) messages exchanged between substation processor and
master are stored. On demand, these messages shall be displayed
on the local CRT.
3.5 Capability shall be provided to assemble typical master station

messages and feed them into SCADA interface and observe equip
ment response.
3.6 An option of using a portable master simulator for testing of

local system shall be available.
3.7 Maintenance personnel shall have the capability to switch chan

nels between regular and backup lines.
2-43
10. TIE-TRIPPING
I. FUNCTION DESCRIPTION W'
If the local terminal of a transmission tie to a neighboring utility shows

sustained heavy power outflow in conjunction with system frequency a spe
cified amount below normal, trip the tie. Alternatively, tripping can be
based on load flow versus time without frequency supervision.
Optionally, rate of frequency decline measurement can be used to speed up

tripping.
The function may also be used for alarm only, or can alarm as advance
warning before a trip.
2-44
TIE-TRIPPING (Cont'd)
V II. I/O REQUIREMENTS
1. Inputs
1.1 Voltage signal samples from one phase of bus or line, for fre
quency measurement, if used.
1.2 Samples of voltage and current for tie line, to compute direc
tion and magnitude of power flow. Alternatively, load flow may
be obtained from another function which computes it. Current,
if used, from up to 4 three-phase ct sets.
1.3 Setting changes from SCADA interface.
2. Outputs
2.1 Tripping outputs for up to 4 breakers.
2.2 Optional breaker failure initiate for the 4 breakers.
2.3 Alarm outputs for advance warning or after trip.
2.5 Setting display.
V.
2-45
TIE-TRIPPING (Cont’d)
III. FUNCTIONAL REQUIREMENTS J

1. Performance
1.1 Overload-Only Tripping
1.1.1 The function shall monitor power outflow on an intercon

nection and integrate over a user-selected time interval
any power which exceeds the contractual limit. Any
excess over a user-specified percentage shall be alarmed
and presented to the SCADA interface.
1.1.2 Provisions shall be made to dump the interconnection if

the integrated excess reaches a second user-selected
tripping limit.
1.1.3 Changes of contractual limit shall be provided to the

function via a SCADA interface.
1.1.4 Power flow limit shall be settable from 0 secondary watts

to 500 secondary watts in steps of 5 watts.
1.2 Overload-and-Underfrequency Tripping
1.2.1 The function shall monitor power out on the tie in con
junction with below-normal frequency and shall trip if
limits on both are exceeded.
1.2.2 Two pairs of limits shall be provided; one may be used to

alarm and the other to trip.
1.2.3 Underfrequency settings shall be from 60 Hz to 57 Hz, in

steps of 0.05 Hz, and measurement accuracy of t .01 Hz.
1.2.4 Tripping may be delayed with a time delay of 0 to 10 s

with steps of 0.1 s.
1.2.5 Power flow limit shall be settable from 0 secondary watts

to 500 secondary watts in steps of 5 watts.
2-46
11. LOAD SHEDDING
V.- I. FUNCTION DESCRIPTION
Load shedding is used to remove overloads and arrest consequent frequency

deline without disrupting the utility transmission grid. To achieve this,
utilities generally drop from 1 to 5 blocks of load at successively lower
frequencies; the blocks consists of large groups of low-priority distribu
tion feeders uniformly spread around the system. in spite of the latter
requirement, some utilities also have expressed a desire to drop lines
entering a transmission-level substation on underfrequency. The require
ments below attempt to consider both applications although some unusual and
expensive control wiring would be needed to trip distribution feeders from
the transmission station control equipment if there is any distribution
switchgear at the site. Emphasis is on line dropping, if wanted by some
user.
The strategy is to select, in advance, 1 to 5 successively lower frequency

levels for which specified load increments should be dropped, as part of a
coordinated overall shedding plan. When a frequency decline occurs, drop
enough lines or feeders at each frequency level to achieve the target
increment of load shedding, based on actual (measured) feeder or line loads
at that time.
Optionally, the shed loads can be automatically restored after system fre
quency returns to normal.
2-47
LORD SHEDDING (Cont'd)
1. Inputs
1.1 Current and voltage samples from droppable lines, or computed

power flow on those lines; for use in determining strategy for
reaching shedding target.
1.2 Samples of at least one voltage in station for frequency

measurement.
2. Outputs
2.1 Trip outputs for up to 6 lines; up to 4 breakers each.

(Optionally, outputs to 20 distribution feeder breakers).
2.2 Optional close signals to dropped lines (including synch, check)

or feeders (no synch, check).
2.4 Setting and shedding table display.
2-48
LOAD SHEDDING (Cont'd)
V.- III. FUNCTIONAL REQUIREMENTS
1. Performance
1.1 Up to 2 steps of load shedding shall be provided. (Future

option - 5 for distribution).
1.2 Individual predefined blocks of load shall be shed automatically

with declining frequency.
1.3 Function shall have optional capability of identifying lightly-

loaded lines or feeders, and steering load-shedding trips to
other more heavily loaded lines or feeders to achieve a specific
megawatt shedding target for each step.
1.4 The accuracy of frequency measurement shall be ± .01 Hz or

better.
1.5 shedding frequency for each step shall be individually

adjustable over a range of at least 60 Hz to 57 Hz in steps of
.0 5 Hz.
1.6 Time delay to shed shall be adjustable between 0 and 1 s.
1.7 Optional automatic restoration is implemented after return to

60.0 Hz for a time delay settable from 0-20 min. in 1 min.
steps. Restoration of shed loads is staggered in a predeter
mined order, with return to 60 Hz and time delay required after
each restoration step.
1.8 Optionally, provide capability to coordinate with EM (induction

disc) underfrequency relays.
1.9 Optionally, trip decision should also consider rate of decline

to minimize unnecessary overtripping if recovery has begun;
e.g., if frequency decline rate decreases to less than 25% of
maximum, add delay of x seconds to next trip level in case fre
quency stabilizes.
2.1 Provisions shall be made to shed individual load blocks

manually, by designated operators, with normal or abnormal
f requency.
2.2 Operation of each load shedding step shall be alarmed, logged,

and presented to designated operators.
2.3 Manual load restoration after automatic or manual shedding shall

be provided for designated operators.
2.4 Any operator should be able to determine which steps have been
implemented and which lines or feeders have been dropped to meet
target shedding at any point in the sequence.
/-
2-49
12. SHUNT REACTOR PROTECTION (Cont'd)
1. FUNCTION DESCRIPTION
Detect faults in line-connected reactors in order to trip local terminal

and to transfer-trip remote line terminal. Use over-current, differential,
or impedance measurement techniques.
Detect faults in tertiary reactor bank to disconnect from transformer, if

breakers are provided. Detect turn-to-turn faults in any reactor, e.g.,
current-unbalance or impedance-unbalance checks.
2-50
SHUNT REACTOR PROTECTION (Cont'd)
V,, II. I/O REQUIREMENTS
1. Inputs
1.1 Samples of currents from 3-phase bushing ct's for each reactor
bank.
1.2 Samples of current from single neutral ct for each reactor bank.
1.3 Samples of phase voltages from line or bus.
1.4 Sudden-pressure rleay contacts (3 tanks).
2. Outputs
2.1 Trip output to operate transmission line breakers, up to 4.

(May be shared with line protection).
2.2 Transfer-trip initiation of remote-breaker tripping.
2.3 Lockout of tripped breakers.
2.6 Setting, tripping table, and lockout table display.
V,.-
2-51
SHUNT REACTOR PROTECTION (Cont'd)
1. Performance
1.1 Instantaneous overcurrent tripping shall be provided with pickup

adjustment.
1.2 Time-overcurrent tripping shall be provided with pickup and time

delay adjustments.
1.3 Distance protection shall be provided with adjustable reach and

angle.
1.4 Sudden change-in-impedance in one phase may optionally be used

for sensitive turn-to-turn fault sensing.
1.5 Differential protection shall be provided.
1.6 Current-unbalance protection shall be provided with unbalance

setting.
1.7 Sudden-pressure relay operation shall be factored into protec

tion logic. If not supervised by other slower inputs, the
sudden-pressure trip shall occur in 2 to 8 ms after contact
closure.
13. TRANSFER TRIPPING
V, I. FUNCTION DESCRIPTION
Remote-tripping functions shall interface to transfer-trip schemes using

FSK tones over telephone or microwave, using a dedicated FSK carrier, using
a 3-state carrier shared with pilot relaying, or using the stopping of a
blocking carrier provided for pilot relaying.
Provide a common control facility for all functions which transfer-trip to

a specific remote location.
Optionally, supervise received transfer-trip signals with change detection,

current-magnitude detection, or distance measurement (or any combination).
Compare outputs of dual-channel schemes and alarm for certain

inconsistencies.
Monitor false outputs (unaccompanied by supervisory signal, or outputs on

one channel of a dual-channel scheme.
Back up transfer tripping by closing ground switch.
2-53
TRANSFER TRIPPING (Cont'd)
1. Inputs
1.1 Initiating inputs from local protection functions to transfer-

trip logic.
1.2 Inputs to system from transfer-trip receiver outputs (up to 2

per line).
1.3 Supervising signals from local relaying.
1.4 Current signal for clearing check and/or arming.
1.5 Inputs to system from carrier receiver outputs, if used for

transfer-tripping.
1.6 Channel status inputs - loss of signal, noise clamp, etc.
2. Outputs
2.1 Keying outputs to transfer-trip transmitters - up to 2 per line.
2.2 Channel-malfunction or false-operation alarm.
2.3 Power-operated high-speed grounding switch control output - one

per line, 1 or 2 poles normally controlled.
2.4 Outputs to carrier transmitter and/or pilot relaying logic, if

used for transfer-tripping.
2.5 Tripping to local breakers, up to 4 per channel, on receipt of

transfer-trip signals from remote terminals.
2.6 Breaker-failure initiation for the 4 locally-tripped breakers.
2.7 Setting, tripping-table, and lockout table displays.
2-54
TRANSFER TRIPPING (Cont’d)
V- III. FUNCTIONAL REQUIREMENTS
1. Performance
1.1 Transfer tripping may be initiated for any specified function,

such as a bus fault, transformer fault, or adjacent-line fault
with certain breaker failures (breaker-and-a-half or ring-bus
configurations); for transformer faults for which there is no
local primary side breaker to interrupt fault current; or for
shunt reactor faults.
1.2 Regardless of initiating source dropout, transfer-trip signal

transmission shall be sustained at least 200 ms once started.
1.3 On dual-channel systems, alarm for trip signal from one receiver
only. On loss of one channel, alarm and enable tripping on
receipt of trip signal from the other channel. Optional disable
feature for latter function.
1.4 User shall have the following supervision options for received
transfer-trip command:
A. No supervision
B. Enabling for 500 ms after a sudden current or voltage change
C. Residual overcurrent
D. Overreaching distance relaying function
E. Any combination of B, C, and D
1.5 Monitor current flow in local ct from remote source after

transfer-trip signal is sent. If flow does not cease in 10 to
100 ms, close local ground switch. Delay settable in 10 ms
steps.
1.6 Provide for optional closing of ground switch as primary means

of transfer tripping (no channel). As another option, the
ground switch is closed simultaneously with transmission of trip
signal.
2.1 For dual-channel systems, designated operators shall be able to

select single-channel operation using either channel.
2.2 The system shall be capable of logging and/or alarming momentary

trip outputs of less than 2 to 10 ms from transfer-trip receiver
at the discretion of selected operators.
2-55
14. PILOT AND TRANSFER-TRIP CHANNEL MONITORING
:
The line protection processor shall be capable of initiating manual and/or

automatic checkback tests of the pilot protection channel.
1. For on-off (blocking) carrier channels, the line pilot-relaying pro

cessors at the two line terminals should periodically perform auto
mated handshaking or checkback tests on the channel. For example, one
processor initiates a test keying of the channel consisting of a
sequence of marks and spaces, each having pre-specified durations.
The remote processor is then able to spot failures or intermittent
dropouts in the local to remote channel link. After a prearranged
delay, the remote processor returns the same sequence over the remote-
to-local channel link; the bidirectional process is repeated periodi
cally thereafter. Each processor can thus determine the status of the
incoming communications link, and/or the remote processor. Any unu
sual delays in pickup or dropout, or carrier holes, can be detected
and alarmed.
The blocking-type relaying used with this channel will not suffer a
reduction in security from frequent channel testing. Since the
relaying processor performs the testing it can abort the test sequence
at any sign of a disturbance requiring possible relay action.
Therefore, dependability is not degraded either.
The software shall also be capable of initiating or responding to on-

off carrier checkback tests of the thpe provided by existing EM or
static checkback timers.
2. Fore FSK tone channels, a checkback test may be executed by turning

off the local transmitter guard signal for over 150 ms, and then
bringing it back on in the trip state. This sequence blocks remote
tripping. The remote channel can then return the same test sequence.
Dead time and subsequent trip-signal duration are carefully measured
by the processor at each end; the signal is also monitored for holes.
The logic can be arranged so that the test is carried to completion

before the channel is declared failed; so that if a fault occurs
during a test, the test sequence is aborted, the guard is returned,
and then shifted to trip. This, tripping is delayed but not
prevented.
The above test can be executed periodically, say once a day, automati
cally by the processor; or it can be manually initiated.
3. For FSK carrier channels, there may be logic at the receiving end
which enables tripping (permissive) for 150 ms on loss-of-channel.
The security hazard is thus slightly increased, in that an external
(Zone 2) fault occurring in this 150 ms window may lead to false
tripping. Utilities must evaluate their concern about experiencing
such a trip. New, more secure schemes will be sought, if possible.
2-56
PILOT AND TRANSFER-TRIP CHANNEL MONITORING (Cont'd)
II. Inputs
1.1 Manual test request
1.2 Channel receiver trip output
1.3 Channel receiver guard output
1.4 Channel receiver low signal output
1.5 Channel receiver noise clamp output
1.6 Channel level monitor
2. Outputs
2.1 Transmitter key - guard/trip or off/on
2.2 Guard on-off control - FSK channels
2.3 Local pilot protection enable/disable, based on status of received

signal
2.4 Failure alarm outputs for each channel
2.5 Sequence-of-events data
2-57
1. Performance
1.1 General
1.1.1 Design shall allow for inclusion of testing means com

patible with those commonly in use; for both on-off and
frequency shift channels. Test and verify instantaneous
report checkback schemes, time-delay repeat schemes, and
three-state channels.
1.1.2 Test and verify both pilot and transfer-trip channels.
1 .1 .3 For automatic test, processors at the two (or multiple)

ends alternate (or rotate) initiation of the testing
sequence.
1.1.4 If no test signals are received in the programmed automa

tic testing interval, alarm and optionally disable local
pilot tripping.
1.1 .5 If test signals initiated by remote processors are

received, but no response is received to locally ini
tiated test signals, alarm for failure of local outgoing
channel but do not disable local pilot tripping.
1.1.6 Optionally, disable pilot protection after channel down 5

minutes, restore after channel up 10 minutes.
1.1 .7 Allow for future option of computing overall availability

by comparing squelch time to available time.
1.1.8 If pilot channel fails, user shall have option of

enabling Zone 1 coverage of line if Zone 1 is not nor
mally used.
1.1.9 Monitoring logic shall be limited to that which can be

executed with presently available status outputs from
channel receivers.
1.2 On-Off Channels
1.2.1 For conventional test, transmit carrier for 3 to 6 s,

then cease and listen for return signal lasting 4 to 5 s.
Repeat sequence every 1 to 8 hours.
1 .2.2 For processor-based test, a signal sequence should be

sent which verifies the ability of the channel to pick up
and drop out in expected times; and to stay picked up
without holes.
1.2.3 Alarm for any holes in test sequence which appear at

receiver output, or for any receiver output not asso
ciated with a test or a fault.
*>
2-58
1.2.4 Repeat processor-based test every 1-5 s or every 8 to 24

hours for compatibility with conventional test.
1.2.5 Alarm for excessive noise indication.
1.3 Frequency-Shift Channels
1.3.1 Provide automatic testing based on security of guard loss

- return in trip sequence logic found in many FSK
receivers. Repeat test periodically for FSK unblocking
carrier, for single-channel direct transfer trip, or for
dual-channel transfer trip (test only one channel at a
time) .
1.3.2 Provide optional testing for 3-state

(unblock/transfer-trip) carrier channel or other 3-state
channels.
1.3.3 If guard signal is not received for a period in excess of

30 to 500 ms, disable local pilot tripping and alarm,
both at user's option.
1.3.4 If unexpected frequency shift is received in permissive

or dual-channel arrangements, alarm. Disable channel-
related tripping after 500 ms in permissive schemes;
switch to single-channel operation in dual-channel
schemes.
1.3.5 Try to test channel to verify frequency shifts with

acceptable delays.
1.3.6 Alarm for any holes, or for momentary shifts back to

guard during trip/unblock shift.
2.1 Provide for manual initiation of channel test by designated

operators.
15. INDICATION AND SEQUENCE-OF-EVENTS RECORDING
I. FUNCTIONAL DESCRIPTION
This function shall record and indicate sequence-of-events data from the
protection systems, from substation apparatus, from control functions, and
from local and remote operators. All such events are time-tagged and
stored. Upon request from an operator or automatically on occurrence of
fault, the sequence-of-events files are displayed or printed locally and/or
transferred to SCADA master or any other remote data terminal which inter
faces to the substation control system.
The event descriptions include identification of the event, classification

of reason of device operation, initial time indicators, and high-resolution
relative-time count; plus supplementary data such as identification of
affected phases or values of adapted settings. Operator actions shall be
included in the records.
A list of events which may be logged is developed in advance for each pro
tection function.
In addition to generating entries for the events list, this function shall
update limited panel indications provided on protection processors, if
desired by a particular user.
2-60
INDICATION AND SEQUENCE-OF-EVENTS RECORDING (Cont'd)
1. Inputs
1.1 Software events data from protection functions
1.2 Software events data from control functions
1.3 Status of breakers and disconnect switches
1.4 Operator control action indications
1.5 System clock and high-resolution timing information
1.6 Any alarm-type inputs, including analog value out-of-limits
1.7 Any status or digital inputs designated by user
2. Outputs
2.1 Tables of data for transfer to data base, for logging or

transmission to remote point
2.2 Indications as specified on panel of individual protection

processors.
2-61
1. Performance
1.1 The digital events to be recorded include at least the

following:
A. Circuit breaker status and operations

B. Pilot channel receive and transmit signals
C. Faulted phases
D. Fault clearing
E. Pole disagreement
F. Local trip or arming functions
G. Local block function
H. Trip decisions fron each relaying function
I. Trip current flow interval
J. Breaker open time
K. Alarm status points
L. Any input status changes selected by user
M. Any analog values outside limits specified by user
1.2 An input shall be interpreted as an event upon:
• Status change from normal to abnormal, return to normal or

both
• Analog value exceeding limits, high or low, or returning to

within limits
1.3 Enough storage shall be provided for storing up to 100 events

per processor and up to 10.N.X. total events in the substation
computer, where N is the total number of processors, and X is a
fraction less than one.
1.4 When relay settings which are dynamically adjusted (adaptive

settings) bear on a relay or control action, values shall be
recorded and made available as part of the sequence-of-events
log. Also, any manual changes of settings, locally or remotely
made, should be similarly displayed. Optionally, adaptive set
tings may be logged whenever they change as a diagnostic tool.
1.5 It shall be possible to selectively route each event point or

group to each operator location.
1.6 Locally-printed hard copy of events shall be provided as an

option in the design of the system.
1.7 The event storage and operator indication facilities shall each
offer the options of being reset by the local operator, or over
a telemetering interface, or automatically after hard-copy
logging or sequence-of-events, or after a preset time delay.
1.8 If a new fault occurs before old local indication is cleared,

the indication shall optionally assume states related to the new
fault.
•*'•'**
2-62
1.9 Events shall optionally be sorted according to time interval of

occurrence, zone of protection, and destination of message, and
combinations of these. Lists shall optionally be automatically
sent to each destination.
1.10 Beginning of the fault condition shall be tagged with date and
time with a resolution of 1 ms. The time differences among all
analog wave forms and digital events ultimately displayed on
user's display or recording device, shall not be more than 1 ms
from actual time relationship.
1.11 Synchronize to utility's master time or WW receiver (if

available) to allow comparison to events at other stations.
1.12 If master time signal is unavailable, or is sent only periodi

cally for local correction, the time-of-day clock shall run in
synchronism with 60 Hz. If ac is lost, the clock shall not
drift more than 100 ms in 1 hour.
2.1 On demand, all the data of an individual fault shall be made

available to local or remote operators.
2.2 Inhibiting and enabling or changes in routing of operations to

be recorded shall be performed by designated operators.
2.3 Provisions shall be made for adjustment of the clock by

designated operators.
2.4 A list of operator indications to be provided on each relaying

processor is to be developed for that protection function.
2-63
16. LOAD MONITORING AND OUT-OF-STEP PROTECTION
Monitor the apparent impedance associated with load flow, as measured at

the line terminal, looking into the line. Maintain data on load impedance
locus variation during the day. Provide a means of comparing the load
impedance locus with impedance-relay operating zones into which the load
may encroach.
When machines on the power system are slipping out of synchronism, imple
ment a splitting or islanding of the system which separates out-of-step
machines and which balances the load and generation as closely as possible
within each island. The out-of-step protection function at a given line
terminal must determine that the electrical center of a swing has fallen
within a zone around the line-impedance locus; it then implements one of
the control strategies given below. Distinguish between symmetric and
unbalanced conditions to facilitate continued unbalanced-fault protection
during swings.
Also, monitor and alarm for detection of line current overload.
2-64
LOAD MONITORING AND OUT-OF-STEP PROTECTION (Cont'd)
1. Inputs
1.1 Three-phase voltage and current samples from monitored line, or

rms magnitude and phase values from another program.
1.2 Out-of-step protection on-off control request.
2. Outputs
2.1 Tripping for up to 4 breakers for each line having out-of-step

protection.
2.2 Block-tripping signal for all breakers on the line.
2.3 Reclose-blocking signal for all breakers on the line.
2.4 Optional trip output to local generator or transfer-trip to

remote generator.
2.5 Line-overload alarm.
2.6 Line-overload trip.
2.7 Line-impedance alarm.
2.8 Saved load impedance value(s) in tabular form
2.9 Sequence of events data.
2.11 Setting display and tables of tripping, blocking, and lockout.
2-65
1. Performance
1.1 Impedance Monitoring
1.1.1 The impedance-monitoring function shall save the value

which most closely approached relay characteristic since
last dump or check, with date and time tag.
1.1.2 The function shall optionally be capable of saving 7 such

approach values and dumping cyclically. Similarly, sud
den load impedance changes in excess of 20% shall be
saved (excluding faults and local breaker trips, which
are saved elsewhere) .
1.1.3 Alarm whenever load impedance approaches within a prede

termined distance of relay setting.
1.2 Out-of-Step Protection
1.2.1 When an out-of-step condition is detected, the available

strategies shall be as follows:
A. Trip the line at high speed, as for a fault.

B. Trip, but only after swing locus has passed through
line section and machines have slipped back into
phase; this protects breakers from recovery-
overvoltage damage. Trip at current minimum.
C. Trip on way out of second swing.
D. A decision is made at the time of the swing to trip
either without delay or after waiting for machines to
slip into phase, depending on the slip speed.
Decision-threshold slip speed is entered as a
setting.
E. Trip on the way in for slow slips where breaker can
interrupt before angle exceeds 60°.
F. Block tripping.
G. Block reclosing in conjunctions with (A), (B), (C),
(D), or (E).
H. Trip local generation if node (electrical center) is
close-in, leaving transmission system intact.
Each line shall be capable of implementing a different

option.
1.2.2 The out-of-step detection program shall have a setting

for the maximum slip speed for which it will respond.
This may be set up to 5 Hz.
1.2.3 The detection program shall respond to slips at least as

slow as 0.1 Hz. A lower-limit setting shall be provided.
2-66
1.2.4 Out-of-step responses (trip blocking, etc.) shall reset

as soon as slippage is determined to no longer be
present, as governed by the slip speed setting limits.
1.2.5 Behavior of out-of-step detection program shall coor

dinate with that of impedance-based line fault relaying
programs.
1.2.6 Settings shall be provided to control overreach of out-

of-step protection, if needed.
1.2.7 Detection by out-of-step program shall provide proper

coverage for parallel-line installations, up to 3 lines.
1.2.8 Optionally, protection of the line-loss, generation-drop

type should be provided. Monitor total power flow, and
when an acceptable stability limit for loss of a line is
reached, alarm a local or remote operator. If he chooses
to operate above the limit, trip local selected generator
breakers on loss of one of a selected group of lines, or
provide a keying output to transfer-trip a selected
generator.
1.2.9 Output data for display of swing loci. Display or plot

to be produced away from substation.
2-67
LOAD MONITORING AND OUT-QF-STEP PROTECTION (Cont’d)
1.3 Line Overload Monitoring (Optional)
1.3.1 Inverse time-overcurrent functions shall be allowed for

in design to alarm and to trip for operation of lines at
emergency current levels.
1.3.2 Typical points for curves are as follows:

(Percentages are total line current as percent of rating)
a. Alarm for 125% of limit for 30 min, 160% for 15 min,

175% for 2 min.
b. Trip for 135% for 30 min, 185% for 15 min, 200% for 2
min.
1.3.3 The pickup (100%) values corresponding to curves in 3.2

shall be settable by designated operators.
1.3.4 In establishing emergency rating, any load limitations

imposed by the line protection function shall be
considered.
1.3.5 On lines with tapped loads, one end may be preferred over
the other when trip becomes necessary, so interface to
other substation control system through master, or
through conventional transfer-trip channel. Back up
channel failure with local trip.
1.3.6 Optionally, the line temperature may be estimated using

more precise modeling which assumes solar heating, and
measures ambient temperature. Conventional relays exist
which can be used as an example or starting point for
modeling program.
2.1 Easy inhibiting and enabling of the out-of-step function shall

be provided. Use standard control point.
2.2 Local or remote operator shall be able to determine how much

time is left before tripping at present current magnitude.
2-68
17. AUTOMATIC RECLOSING
The majority of faults on transmission lines are temporary and will dissi
pate if the line is deenergized for 0.25 - 0.5 s. Logic is thus provided
to execute a delay after high-speed clearing of line faults, to initiate
reclosing of the breaker, and finally to limit the number of unsuccessful
reclosing attempts.
The logic must also be capable of selectively incorporating additional

supervising checks, such as live-bus/dead-line or synchronism, depending on
the protective function which last tripped the line breakers and the number
of reclosing attempts which have been made for the particular fault.
Options are to include reclosing logic for single-pole tripping

applications, and reclosing capability for bus faults.
2-69
AUTOMATIC RECLOSING (Cont'd)
1. Inputs
1.1 Reclose initiate (RI) signals:
A. Pilot trip
B. Zone 1 trip; high-set trip
C. Zone 2 trip
D. Single- versus multi-pole trip, pilot
E. Bus trip; single- versus multi-pole trip
1.2 Breaker status via auxiliary contacts (ganged or independent-

pole as required) from up to 4 breakers feeding line or from 12
to 20 breakers feeding bus.
1.3 Line voltage indication(s).
1.4 Bus voltage indication, or voltage indication from source side

of each line breaker.
1.5 Synchronism-checking output for each breaker on the line.
1.6 Breaker requested status (i.e., local or remote operator or

automatic control calling for breaker to be in tripped or closed
state) .
1.7 Transfer-trip indication from remote end of transmission line.
1.8 Reclosing inhibit/enable control request from local or remote

operator.
1 .9 Reclosing inhibit/enable flag for breaker failure, transfer

tripping from remote end, transformer fault, or out-of-step
condition.
2. Outputs
2.1 Close signals for up to 4 breakers (line) or 12 to 20 breakers

(bus reclosing).
2.2 LTC lockout signal issued during reclosing sequence.
2.3 End-of-Sequence (EOS) alarm following unsuccessful reclosing

sequence.
2.4 Optional cumulative EOS alarm.
2.7 Settings display.
2-70
1. Performance
1.1 Reclosing steps shall be selectable and adjustable and shall

allow operations from a single shot to a maximum of 3
reclosures.
1.2 Each reclosure shall have a programmable delay from no inten

tional delay to a maximum of 10 s delay in 0.1 s steps for the
first (high speed) reclosure and to 60 s in 1 s steps for each
successive reclosure.
1.3 Reclosing logic shall allow choice of sequence which depends on

type of reclose initiation (II, 1.1 above):
A. Pilot trip - high-speed, unsupervised or dead-line check?

plus time-delayed shots as desired.
B. Zone 1/high-set trip - high-speed with dead-line check plus

time-delayed shots as desired.
C. Zone 2 - time-delayed shots as desired, up to two.
D. Single-pole trip - high-speed shot with prolonged dead time?

and shorter dead time for three-phase trips. Subsequent
3-pole time-delayed reclosures as desired, up to two.
E. Bus faults - high speed, plus time delayed shots as desired,

up to two. Prolonged dead time on first reclosure for
single-pole trip.
All unwanted reclosing actions must be easily disabled by the

user.
1.4 User shall be able to select supervising conditions for each

closure:
A. Live-bus, dead-line
B. Dead-bus, live-line
C. Synchrocheck (live line and bus)
1.5 For time-delayed reclosures, user must be able to designate

separate test and follow breakers within a given substation
(both line and bus faults), and to change that designation as a
setting. Optionally, if normal test source is dead, use alter
nate test source.
1.6 Test and folow breakers at a given station will require dif
ferent supervising checks and time-delay sequences. Each
breaker shall be subject to an individually selected sequence.
2-71
1.7 The reclosing function shall always become active in the

End-of-Sequence (EOS) state (equivalent to lockout in conven
tional reclosing relay), whenever the host processor is
energized or whenever the function is enabled.
1.8 A reset time delay shall be provided which is adjustable from 1

s to 60 s in 1 s steps.
1.9 When the line remains continuously energized with the reclosing
enabled for a time period in excess of the reset time delay,
then the logic shall proceed from the EOS state to a ready-for-
reclosing (normal) state. No other means of leaving the EOS
state shall be provided. If an automatic trip occurs while the
logic is still in EOS state, no automatic reclosing shall
follow.
1.10 If a breaker trip occurs unaccompanied by any reclose-initiate

signal, the logic shall enter the EOS state. This includes
local or remote manual trips, and automatic trips requiring
lockout.
1.11 If disabled or inhibited, reclosing function shall enter the EOS

state.
1.12 If reclosing sequence is executed without success, reclosing

logic enters EOS state. Success is defined as reclosed breaker
remaining closed for reset time delay. Also, enter EOS for
breaker malfunction such as low air pressure.
1.13 EOS state implies only that no automatic reclosing can occur.
All closing initiation from outside the reclosing function,
including local or remote manual closing, shall still be
possible when automatic reclosing is in EOS.
1.14 Optionally adapt dead time after single-pole trip to experience

factor. In other words, shorten dead time for 100% success
rate, or lengthen it for low success rate.
1.15 An optional feature shall be allowed for in design, in which a

local trip initiated by a remote transfer-trip transmitter shall
be followed by a supervised reclosure when the transfer-trip
signal reverts to the guard state.
1.16 There shall be an optional pre-EOS state in which the function

waits for synchronism to occur for a prolonged period. An
optional timer will terminate the pre-EOS state after a long
user-designated delay; logic then proceeds to EOS. If breaker
retrips before reset delay expires following pre-EOS synch,
closure, processed to EOS.
1.17 Optionally, alarm for EOS following unsuccessful reclosing.
2-72
AUTOMATIC RECLOSING (Cont’d)
1.18 There shall be an optional accumulator which forces function to

EOS after fixed total number of reclosures from multiple faults
(cumulative EOS). Accumulator is cleared only by an operator.
Alarm for cumulative EOS.
1.19 Operation of all automatic voltage control programs for LTC's

etc., in the substation shall be inhibited during any automatic
reclosing sequence (i.e., whenever any reclosing module is in a
state other than normal or EOS).
2.1 Designated operators shall be able to inhibit or enable

reclosing or a particular breaker or line (or bus) through a
control point.
2.2 All operations of breaker reclosing function including EOS shall

be time-tagged and stored for the Indication and
Sequence-of-Events function.
2-73
18. MONITORING AND CONTROL OF BREAKERS AND SWITCHES
Monitor and display position of all circuit breakers, circuit switchers,

disconnect switches, etc. via auxiliary contact data; confirm via current-
flow and voltage data. Check for timing problems or lagging poles on
opening and closing of each device.
Check for sustained pole disagreement and flashover of open devices using
auxiliary contacts, currents, and phase or residual voltages. Optionally
execute controlled-breaker or backup-breaker tripping for certain pole
disagreements and flashovers. Provide logic and delays for single-pole
tripping applications.
Operate breakers, disconnect switches, and circuit switchers locally,

remotely, or under local automatic control. Arbitrate conflicting requests
(manual vs automatic) using trip-free and anti-pump logic. Supervise
closing with voltage or synchronism checks. Confirm opening and closing
using current and voltage data along with auxiliary contacts.
Provide a secure and nonvolatile means of locking out or rendering circuit-

breaker or other switching-device controls inoperable, either manually or
automatically. This is used to prevent energization of apparatus which is
faulty or is undergoing maintenance. The controls are unlocked only by the
execution of some nontrivial control procedure by an operator or main
tenance person. Breakers and switches may be placed in the lockout state
either manually or by automatic control and relaying programs. Each
controlled switching device (three-phase) shall have its own lockout
capability.
2-74
MONITORING AND CONTROL OF BREAKERS AND SWITCHES (Cont'd)
II. I/O REQUIRMENTS
1. Inputs
1.1 Trip and close commands from operators.
1.2 Lockout and remove-lockout signals from operators.
1.3 Trip and close commands from automatic control devices and
programs (relaying, reclosing,etc.).
1.4 Lockout signals from automatic control programs or from safety

tagging programs in operator's console.
1.5 Current flow data as available for each controlled and/or moni
tored switching device (including raw samples or phase-position
data for zero-crossing trip option).
1.6 Available voltage signals for monitoring of component isolation.
1.7 Auxiliary "a" and "b" contacts; separately from each pole if
available.
1.8 Device status contacts such as low air pressure, low gas
pressure, etc.
1.9 Synchrocheck signals
2. Outputs
2.1 Trip and close signals to controlled breakers.
2.2 Status indications to operators.
2.3 Abnormal-condition alarms.
2.4 Sequence-of-events data for logging.
2.5 Setting and backup tripping-table displays.
2-75
1. Performance
1.1 Trip or open commands shall predominate over close commands. A

manual trip operation shall supercede and cancel any other
request for breaker operation, unless tripping is blocked
because of breaker trouble.
1.2 Reason(s) for trip-free operation shall be made available

through sequence-of-events log.
1.3 Optionally check that disconnects are opened immediately after

automatic breaker trip unless reclosing is called for.
1.4 Provide adjustable time of circuit closure for breaker control.
1.5 Include momentary change-detection logic to ensure catching a

close and immediate re-trip, and vice versa. This action must
be indicated to operators so that repeated attempts will not
ensue, with the false assumption that the control circuit has
failed. Up to 3 past statuses should be stored.
1.6 Closing of a particular breaker shall be temporarily blocked if

more than a set number of closures occur in a specified period.
Optionally, device may be locked out after this many closures in
this time period.
1.7 Device-incapacity indications shall result in blocking all

closing and tripping of that device such indications include:
A. low air pressure

B. low interrupting gas pressure
C. pole disagreement
D. open trip or close circuit
E. others depending on breaker type
Optionally, automatic and/or manual trips are steered to backup

devices. Alarm is given. Steering tables are entered by
programmer/engineer.
1.8 Optionally certain device failures shall lead to

tripping/opening of adjacent devices to isolate faulty device.
These failures include:
A. degradation of insulation (SFg pressure, etc.)

B. pole disagreements under centain unfavorable station or
system conditions
1 .9 All closing operations routed through this function shall be

supervised by permissive indication from synchrocheck function.
Manual override of supervision by operators shall be provided.
Manual override shall be logged along with closure request log.
2-76
1.10 Pole-disagreement detection shall be provided for all devices.

Inputs shall be records of issued control commands, auxiliary-
contact positions (independent from each pole if available), and
current flow data for each phase; plus phase or residual voltage
data as available and applicable. Disagreements shall lead to
alarm, operation of monitored device to place 3 phases in the
same state, trip and close steering, or backup-device tripping,
all as dictated by specifics of the failure and user
requirements. The disagreement shall be indicated on the one-
line station display.
1.11 Flashover detection shall be provided for open breakers and

switches. Failure shall be isolated using the steering tables
for tripping.
1.12 Devices shall be timed with regard to issuance of control

command, operations of auxiliary contacts, and change of primary
or signal states. Lagging poles, maladjusted contacts, or
slower-than-normal devices shall be alarmed.
1.13 As a option, lockout interlocks are provided which are not

resettable by operator command to the system, but require a
manual reset action at the lockout device itself.
1.14 Lockout interlocks shall be:
A. Nonvolatile
B. Non self-resetting
C. Electrically resettable by operators unconditionally, or
only if certain predetermined conditions are satisfied.
1.15 Each breaker and motor-operated switch shall have its own indi
vidual lockout and lockout reset capability. Protection func
tions which gang-trip shall lockout breakers as desired via
tripping and lockout tables. Lockouts shall be individually
cleared before reclosing of each device.
1.16 Lockout function shall engage in 30 ms or faster after ini

tiation by protection relay. This relay is not to be in series
with breaker tripping; it operates in parallel with clearing of
fault.
1.17 When a requested breaker or disconnect operation is blocked due

to a lockout condition, the reason(s) for blocking shall be
entered in the sequence-of-events log.
1.18 Optionally, accumulate time-fault duty history for breaker (as a

whole or for individual poles) .
1.19 As a future option, designers shall investigate facilities

needed for monitoring and control for components of compressed-
gas insulated (CGI) substations.
2-77
19. SYNCHRONISM CHECKING AND SYNCHRONIZER CLOSING
Measure the magnitude, phase angle, and frequency differences between

voltage sources on opposite sides of any open circuit breaker. Implement
criteria for judging what instants of time, if any, are suitable for safe
closure of the breaker. Display results of checks to operators.
Also, provide a dead-bus, dead-line tripping option which will automati

cally trip selected breakers to sectionalize the system when a major outage
occurs.
As an optional feature, provide an automatic breaker-closing

(synchronizer-closing) function which does the following:
A. Accepts a single initiating signal from a designated operator.
B. Evaluates slip frequency across the open breaker contacts versus a pre
set limit to determine safety of closing.
C. Evaluates voltage magnitude difference across open contacts versus a

preset limit to determine safety of closing.
D. Considers slip frequency, phase position, and breaker-contact closing

time in order to initiate breaker closing so that contacts make just as
phasing voltage passes through minimum.
E. If a tap changer under control of the substation computer can be used

to adjust the voltage on eigher side of the open breaker, operate the
tap changer so as to minimize the voltage magnitude difference across
the breaker. Allow for control of exciters, governors, phase-angle
regulators (PAR's).
F. Aborts the closing attempt after a preset time limit, with message or
alarm to designated operators.
G. Aborts the closing attempt on command from designated operators.
2-78
SYNCHRONISM CHECKING AND SYNCHRONIZER CLOSING (Cont'd)
1. Inputs
1.1 Voltage samples, or computed voltage magnitude and phase from

both sides of open breaker. Data must be time-synchronized so
as to meet accuracy specifications.
1.2 Initiating and abort signals from local or remote operator, for
synchronizer closing.
2. Outputs
2.1 Permissive close indication for manual or automatic reclosing.
2.2 Slip-frequency or phase difference indication to local or remote

operators.
2.3 Closing signal to breaker, for synchronizer closing.
2.4 Self-abort message to operator for synchronizer closing.
2.5 Controls to LTC, PAR, exciter, governor for adjustment of

voltage and phase by synchronizer function.
2-79
SYNCHRONISM CHECKING AND SYNCHRONIZER CLOSING (Cont'd)
1. Performance
1.1 Synchroncheck function shall provide no permissive output if one

synchrocheck voltage is zero or differs in magnitude more than a
set amount from the other.
1.2 Synchrocheck function shall provide no permissive output if fre

quency difference between two synchrocheck voltages is more than
an adjustable slip frequency, up to 0.3 Hz.
1.3 The difference in phase between the two synchrocheck voltages to

permit breaker closure shall be adjustable up to ± 60 degrees.
1.4 Phase angle measurement and adjustment accuracy shall be ± 2

degrees.
1.5 Synchrocheck function output shall also be available to

operators. Display shall be given as phase-angle difference for
very slow slips, or slip frequency for faster slips. Breakover
point is settable at SYSGEN, independently for local and SCADA
display, according to the scan time for each facility.
1.6 Synchronism checking shall respond quickly enough to meet all

reclosing requirements.
1.7 For automatic synchronizer function, breaker times from close

circuit energization to main contact make are between 20 ms to
350 ms.
1.8 Synchronizer function shall be capable of operating local LTC or

generator exciter, and PAR or governor, to bring voltage
magnitude, phase, and frequency differences within limits for
closing.
2.1 Provisions shall be made to expand limits or override

synchrocheck function by designated operators.
2.2 Means shall be provided for setting of voltage, phase, and slip-
frequency tolerances, plus breaker closing delay.
2.3 Designated operators shall optionally have access to controls of

(1.8) above.
2-80
20. OSCILLOGRAPHY
Programs and memory space are to be provided to store raw pcwer-system ac

signal samples collected during faults. The stored data is delivered to
functions which will record or log it, or pass it to an external interface.
The data is equalized and plotted as a smooth curve on some separate com
puter system, or optionally at the substation using the station computer or
a dedicated processor.
2-81
OSCILLOGRAPHY (Cont'd)
1. Inputs
1.1 Raw data samples of preselected ac quantities.
1.2 Storage triggering functions - relaying fault detectors, spe

cified digital events, changes in signals.
2. Outputs
2.1 Fault data sample tables to higher-level processor.
2.2 Optional data tables to remote processor via dial-up link.
2.3 From off-line programs, plots of fault waveforms.
2.4 Optional waveform display on local CRT.
2-82
OSCILLOGRAPHY (Cont'd)
1. performance
1.1 At least 1 full cycle of prefault data will be saved.
1.2 Total storage capacity at first-line storage level (relaying

processor or dedicated oscillography storage processor) shall be
30 cycles.
1.3 The first-line storage area shall be cleared via transmission of

data to a higher level, as soon as possible after each fault.
1.4 As a minimum, all of the waveforms input by the processor which

trips for the fault are saved. Optionally, all waveforms in the
station are saved.
1.5 The user shall have, via programming, options for first-level
storage use:
A. Fill the entire 30 cycle store for each fault.
B. Fill the store until each fault is confirmed clear; the

remainder is available for subsequent faults.
C. Divide the store into N segments for N faults.
D. Save 1 cycle before and 6 cycles after each change in a

saved waveform or digital triggering event. Examples of
triggering events are sudden voltage changes; di/dt; carrier
start, stop, or shift; breaker trip; negative-sequence
current; etc.
E. Store whenever any waveform is not a sinusoid.
1.6 All saved tables of data are time-tagged for correlation with
SOE log (1 ms resolution).
1.7 Storage of overlapping samples is to be avoided at both the pro

cessor and station computer levels.
1.8 If storage is full and another fault occurs before data can be
transferred to high-level processor, the user shall have the
option at SYSGEN of;
A. overwriting the oldest segment with new data
B. keeping the old data until released by an operator.
C. keeping the old data for a preselected time period and then
releasing the store for new data.
2-83
OSCILLOGRAPHY (Cont’d)
'"V
1.9 Optionally, programs shall be provided to equalize the data with
respect to data-acquisition unit input filters, and to plot it
off-line, on some suitable host facililty. Also optionally,
this may be done at the substation by the substation computer.
1.10 Equalized oscillograms will be flat to within ± 1 db from 30 Hz

to an upper limit of 300 to 480 Hz depending on relaying
sampling rate used. Accuracy at 60 Hz will be much closer, as
determined by relaying and metering specifications given in
other functions.
1.11 Minimum accuracy of raw digital samples of analog data shall

conform to specifications for analog input subsystem (see Remote
SCADA Interface function, R.1.3.3.2).
1.12 Saved data at the second level of storage shall be available for
local dump or for telemetering to remote location, if not
locally processed.
1.13 Design shall provide as an option the possibility for display of

oscillograph waveforms on the station CRT or display of raw
samples on CRT.
1.14 Off-line program shall find RMS (symmetrical) and

peak(asymmetrical) waveform values at selectable intervals
throughout the socillography data including at moment of
interruption.
2.1 It shall be possible for user to designate remote locations to

which oscillography data is automatically sent, so local storage
can be cleared.
2-84
21. LINE FAULT LOCATION ESTIMATION
Utilize raw voltage and current signal data, stored during line faults by
the oscillography function, to calculate apparent physical distance from
relaying location to the fault. Location data is thus provided for tem
porary as well as permanent faults. Calculation is performed after the
fault by programs in the station computer or another host machine which
receives oscillography data.
Estimation methods to be used are either highly-refined versions of

relaying-type distance calculations incorporating all available and rele
vant data, or more recently proposed parameter-solution methods.
2-85
LINE FAULT LOCATION ESTIMATION (Cont'd)
1. Inputs
1.1 Samples of voltages and currents, stored by the oscillography

function, from the faulted line.
1.2 Residual current data during fault for all mutually-coupled

lines radiating from the station (or from remote stations, if
such data can be obtained).
1.3 Prefault load-flow conditions.
2. Outputs
2.1 Estimate of distance from station to fault; on station display

or logger, SCADA or other remote terminal, or at output of host
computer, depending on user requirements.
LINE FAULT LOCATION ESTIMATION (Cont'd)
1. Performance
1.1 Minimum accuracy of fault location of a two-terminal line shall

be within ± 10% of line length, or within one mile from actual
fault location for lines under 10 miles, or better if possible.
1 .2 Design of programs should allow for optional input of data from

remote terminal(s), if such data is available. The program then
considers all the data concurrently to minimize error. For
lines of 3 or more terminals, such data is essential.
1 .3 Distance-calculation based technique shall consider at least:
A. Phase voltage and current data.
B. Residual effects; complex compensation.
C. Load flow effects.
D. Fault resistance effects.
E. Mutual effects from parallel lines.
1.4 Distance estimation shall be tagged with date and time; and
shall be made available to local or remote interfaces as desired
by user (unless executed on host machine).
2.1 It shall be possible to observe performance of program using

calibration values.
2-87
22. DATA LOGGING
I. FUNCTION DISCRIPTION
Format and output all information which is to be printed locally (if local
printing option exists) and prepare information to be transmitted to
masters for printout of reports at remote control centers. Because of the
obvious functional similarity, tabular CRT displays are also included in
this function.
2-88
DATA LOGGING (Cont’d)
1. Inputs
1.1 Present and historical measured and calculated values and

status data.
1.2 Log formats.
1.3 Requests for logs.
1.4 Requests for trends.
2. Outputs
2.1 Tabular displays.
2.2 Printed logs.
2.3 Lists of calculated values to be transmitted for remote

logs.
2.4 Trend output on analog recorder, or via CRT graphics if

available.
2-89
DATA LOGGING (Cont'd)
1. Performance
1.1 Historical data shall be collected every 15, 30 or 60 minutes,

time tagged and stored for local display or printout on demand.
At midnight, the data shall be transfered via SCADA interface to
a remote logger. Optionally, a daily log may be printed
locally, especially if data cannot be sent to master.
1 .2 The following types of historical and calculated data may be

included for this function:
A. Data required by EPRI Distribution Automation project.
B. Data required by the protection engineer.
C. Counts of equipment operations.
D. Breaker fault interruption cumulative readings of fault

current and count of trip operations.
E. Transformer loss-of-live data.
F. Transmission line MW, MVAR, transformer MW, MVAR, bus

voltages. Hourly and daily minimum and maximum values
time-tagged to the minute.
G. Individual load MW and MVAR with daily peak and minimum,

time-tagged to the minute.
H. Trends, averages, integrations, and other computations on

selected analog points.
I. Logs of control operations, including rejected or blocked

operations.
J. Logs of setting and/or setpoint changes.
1.3 Optionally, a local CRT hard-copy device or other logging equip

ment shall be provided at the substation.
2.1 Provisions shall be made for any operator to request any

available log.
2.2 Designated operators shall be able to change the logging rate or

suspend logging of any point; any operator may display list of
suspended points.
2.3 Designated operators shall be able to select any point for trend
computation.
2.4 It shall not be possible for any operator to delete any item in
an existing log or record (i.e., no cleanup of logs).
w ■*
2-90
DATA LOGGING (Conf d)
3.1 A special pre-formatted log shall be provided on which the

operator can select the points to be logged or displayed at spe
cified columns.
3.2 Modification of log formats shall be done by a

programmer/engineer using an off-line software development
system.
2-91
23. ALARMING
Periodically, as data is received from subsystems, perform checks against

high and low limits. Use deadband logic to avoid chattering. Apply digi
tal filtering to the data as needed.
On detection of an alarm condition, print the alarm and also store it in a

chronological alarm list for display purposes. Provide a mechanism for
display and modification of alarm limits. Provide alarm enable as well as
inhibit logic. Alarm all unauthorized changes of status. For sequence-of-
events status changes {breakers and disconnects), put in sequence-of-events
files also. Time-tag all alarm inceptions and resets. Limit-check alarms
shall also be available for sequence-of-events log.
The alarming program shall be able to route each alarm to the responsible
local or remote operator.
2-92
ALARMING (Cont'd)
1 . Inputs
1.1 Alarm enable and inhibit requests.
1.2 Requests for modification of alarm limits and alarm state.
1.3 Alarm acknowledgements.
1.4 Events to be alarmed.
2. Outputs
2.1 Alarm messages.
2.2 Alarm status lists.
2-93
ALARMING (Cont'd)
1. performance
1.1 All points shall be classified into different categories, and it

shall be possible to display information (instantaneous alarms
and alarm summaries), locally and/or remotely, grouped by above
categories. Obvious categories are critical vs. non-critical
alarms.
1.2 All alarms shall be time-tagged, recorded and routed selectively

to designated operator positions.
1.3 The function shall be able to accept inputs from NO or NC

contacts. It shall be possible to define the alarm state either
as contact open or contact closed.
1 .4 For momentary alarm conditions, the function shall have provi

sions either to reset or to seal in. There shall be an easy way
to change between these two modes. Seal-in alarms shall be
reset upon an operator RESET input.
1 .5 Minimum time for momentary alarms shall be adjustable from 2 to

8 ms.
1.6 Options of composite alarms and/or individual alarms shall be

provided.
1.7 The following substation alarms shall be included in the

function:
- Circuit breaker trouble

- Circuit breaker lockout
- Bus potential loss
- Line potential loss
- Station dc failure
- Station ac failure
- Emergency generator trouble
- Control house fire
- Transformer alarms
protection trouble
f ire
loss of oil flow
high oil temperature
low oil level
loss of ac power
hot spot or winding temperature
pressure relief
gas detector
tank vacuum
loading high
out of service
tap changer trouble
emergency loading
2-94
ALARMING (Cont'd)
- Reactor alarms
protection trouble
fire
loss of oil flow
high oil temperature
low oil level
hot spot or winding temperature
pressure relief
gas detector
tank vacuum
out of service
- Line protection trouble
- Bus protection trouble
- Revenue metering trouble
- Line loading high
- Line loss
- Line peak MW and MVAR
- Loss of guard
- Carrier failure
- Automatic control system operation failure
- Unbalanced ac potential
- Synch, closure failure
- Unauthorized penetration of substation property
- Emergency generator running
- Sump level high
- Sewerage ejection pump failure
- Ac transducer trouble
Relevant portions of ISA Standard RP 18.1 on annunciators shall

apply.
2.1 For periods when the substation is manned, an audible alarm is

required. The operator shall be able to silence audible alarm
and make it available for possible subsequent alarms.
2.2 Indication of alarms shall be available to any operator and

automatically given to designated operators. Control shall be
given only to designated operators.
2.3 Designated operators shall be able to acknowledge individual

alarms, and those alarms should show up in alarm table as
acknowledged. Alarms not yet acknowledged shall be indicated.
Designated operators may reset sealed-in alarms.
2.4 Capability for inhibit or enable of intermittent alarms shall

be provided. Inhibited alarms must be listed on request of any
operator.
2-95
ALARMING (Cont1d)
2.5 Designated operators shall be able to change alarm limits of

analog quantities.
2.6 Every operator action related to change of limits, enable, and

inhibit of alarms shall be logged identifying the party respon
sible for the changes.
3.1 Local operator shall be able to inhibit as well as to enable

individual alarm points for testing or equipment maintenance.
Inhibited alarms shall be listed on request.
2-96
24. INFERENTIAL MEASUREMENT CHECK
Confirm that each ac signal transducer (cvt, ct, or other primary connected
device), and its interfaces to the substation control system, are func
tioning correctly and are calibrated. In a centralized data-base system,
look for consistency of readings collected from transducers around the
substation. For example, the instantaneous or rms currents passing to or
from a selected phase of a bus section should sum to zero. If they do not,
an alarm warns the operator that one of the transducers or data links is
malfunctioning. In some cases, it may be possible to identify the par
ticular element by observing unbalanced phase measurements at a give
location.
For voltages, consistency can be checked by confirming the potentials at

two points on the same phase and within the same substation have essen
tially the same voltage readings (referred to a common base), as long as
there is a closed path between them.
2-97
INFERENTIAL MEASUREMENT CHECK (Cont'd)
1. Inputs
1.1 Rms voltages, with relative phase position data from all three
phases of all potential transducers in the station.
1.2 Rms currents, with relative phase position data, from all three
phases of all current transformers in the station.
1 .3 Data from the breaker and switch monitoring function on the sta
tes of all such devices in the station.
1.4 Tap-changer positions.
2. Outputs
1.1 Alarms for inconsistent data.
1 .2 Identification of faulty input device if determinable.
1 .3 Synthesized or inferred data source, for backup, to all affected

functions which can possibly be supplied depending on
configuration.
" ■>
2-98
INFERENTIAL MEASUREMENT CHECK (Cont'd)
1. Performance
1.1 For each current transformer, confirm correctness of data by

adding all other sources for that phase. Alarm for error.
1 .2 For each potential device, seek another device which should be

at the same potential due to closed breakers or switches between
them, and compare readings. Alarm for error.
1.3 In case of error in any data source, attempt to locate or iden

tify faulty transducer or input channel by comparing the three
phases at each location and looking for the unbalanced set.
1.4 If check of (3) fails due to a balanced error (e.g., in data-

input device), attempt to locate by considering data from adja
cent inferential-measurement zones.
1.5 An inferential measurement check shall be performed on substa

tion transformers for consistency of voltages and currents bet
ween windings with respect to tap positions.
1.6 Optionally, if faulty source is identified, calculate correct

values using adjacent transducer data and substitute for erro
neous data in some or all functions using this data, as per
mitted by configuration. «
1.7 If inferential check function has access to raw data samples,

these may be compared directly. Attempt to calculate and
substitute correct samples for faulty ones in relaying programs
or processors, as permitted by configuration.
2-99
25. TRANSFORMER OVERLOAD MONITORING
Monitor temperature and current in the transformer to estimate hot-spot

temperature, or measure hot-spot temperature if transducer is available.
Keep a historical record of "loss of life" so that remaining life can be
estimated.
Calculate the additional loading capability of the transformer, within nor

mal or emergency ratings. Optionally, predict times remaining before
exceeding normal or emergency rating at given operating condition.
Provide hourly peak MW and WAR.
Also, accept inputs from partial discharge detector and gas analyzer.
2-100
TRANSFORMER OVERLOAD MONITORING
1. Inputs
1.1 Rms currents from up to six three-phase ct sets
1.2 Three-phase voltage
1.3 Kwh meter readings
1.4 Detector outputs - gas analyzer, hot-spot, partial discharge,

oil temperature
1.5 Operator-entered emergency rating changes
1.6 Status of fans and oil pumps
2. Outputs
2.1 Alarms
2.2 Life expectancy
2.3 Hot-spot temperature
2.4 Loading capability
2.5 Optional trip outputs for up to 6 breakers (shared with other

functions)
2.6 Processed indications from gas analyzer, hot-spot detector, par

tial discharge detector.
2-101
TRANSFORMER OVERLOAD MONITORING (Cont'd)
1. Performance
1.1 Alarm shall be given any time transformer loading enters

emergency rating.
1.2 Emergency ratings are determined using the following

information:
1. Loss of oil flow

2. Loss of ac to cooling fans
3. Oil temperature
4. Winding or hot spot temperature
5. Transformer maintenance
A. Low oil level
B. Pressure relief
C. Gas detector
D. Tank vacuum
1.3 Loss of oil flow and/or loss of cooling fans should automati
cally change transformer rating.
1.4 Optionally, time left to reach a hot spot temperature for which
transformer life expectancy should be considered, if present
loading continues, shall also be presented to operators.
1 .5 Calculated total life reduction accumulated in all previous

overloads as well as calculated life reduction of present
overload shall be routed to operators when requested.
1.6 Optionally, transformer shall be automatically tripped when nor

mal or emergency rating is exceeded.
1.7 Trips caused by the overload monitoring function shall not cause
lockout, but shall only interrupt load.
1 .8 Monitor apparent MVA losses in transformer.
1.9 Provide detection of excessive circulating current in delta

winding.
2.1 Designated operators shall be able to change emergency ratings

of a transformer.
2-102
26. SELF-CHECKING
The processors in the control system, and especially those dedicated to

relaying, are capable of executing programs which check the integrity of
most of the processor and peripheral hardware. Such programs will sound
alarms and flag most hardware failures before circumstances lead to an
incorrect control or relaying action.
The self-checks fall into two categories. The first group consists of
direct tests on processor hardware, using periodically-executed test
programs and external monitoring devices. These tests form the processor-
oriented self-checking.
The second category of checks consists of those executed on incoming data,

utilizing known characteristics of the data. These tests form the
application-oriented self-checking.
Presently envisioned tests are:
Processor Oriented:
A. Instruction test
B. Memory checksum
C. Output-to-input loopback test
D. Dead-man or processor-bus fault detector
Application Oriented:
A. A/D calibration check using a fixed input reference source on one
channel
B. Voltage-signal limit check, and check for balance among phases
C. Current-signal balance check among phases
D. Phase sequence and polarity check
The goals of the self-checking are to suppress incorrect operation of

affected functions and to identify the faulty component for quick repair.
Problems should be located to the card or module level without executing
off-line diagnostics when practical.
2-103
SELF-CHECKING (Cont'd)
1. Inputs
1.1 Voltage and current samples, or computed phasor values
1.2 A/D Calibration channel values
1 .3 Looped-back outputs
1.4 Dead-man failure indication
2. Outputs
2.1 Alarms
2.2 Block tripping
2.3 Block control actions
2.4 Initiate failover
2.5 Identification of fault location or nature
2.6 Sequence-of-events data
2.7 Optional failure indicators on modules
2-104
SELF-CHECKING (Cont'd)
1. Performance
1.1 The relay system shall contain self-checking facilities which

shall cover:
A. Processor hardware
B. Control software (ROM)
C. Trip output continuity
D. Correctness of input sources
1 .2 Self-check results that indicate degradation of system security

and dependability shall be alarmed.
1 .3 All failures shall be alarmed and logged.
1 .4 For failover schemes, mechanism shall be provided for the backup

processor to monitor correct operation of the primary processor,
and in the event of a failure, to take over.
1 .5 Failover to a relaying backup processor, if used, shall be

accomplished in less than 10 ms including any required
resynchronization. Switchover to a substation backup processor
shall be accomplished in less than 1 s.
1 .6 Failover shall not result in loss of more than 10 ms of essen

tial data.
1 .7 Backup processor should be placed in service on a scheduled

basis (by software) to assure that it is functional.
1 .8 After repairs, return to NORMAL mode of operation shall not

cause any incorrect control or protection operation.
1 .9 If processor can recover from fault, it should alarm function

for which failure occurred.
1.10 Execution of diagnostics within each processor shall be either

on a periodic basis or whenever this processor is free.
1.11 If a failure is detected the related trip functions shall be

blocked. An exception is minor A/C calibration error, which is
alarmed.
1.12 On detection of certain types of failures some settings levels

and limits shall be frozen until the problem is solved or shall
revert to start-up values.
1.13 Optionally, loss of trip-output continuity shall cause steering

of fault trips to backup breakers.
2-105
SELF"CHECKING (Cont'd)
2.1 An operator shall be able to initiate self-checking tests on

devices not currently preoccupied with other functions.
2.2 It shall be possible for designated operators to initiate any

failover.
2-106

Substation Control and Protection Project

Uploaded by

Copyright:

Available Formats

You might also like

Substation Control and Protection Project

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Substation Control and Protection Project

Uploaded by

Copyright:

Available Formats

Substation Control and Protection

^LECTRIC POWER RESEARCH INSTITUTE

Portions of this document may be illegible in

Interim Report, April 1981

WESTINGHOUSE ELECTRIC CORPORATION

Electric Power Research Institute

EPRI Project Manager

BISWBUTinU OF THIS PnCUMENT IS UNLIMITED

This project covers the development of a microprocessor-based control and protec­

When a new technology is introduced it is often necessary to reflect on and

This interim report documents the requirements for a new, microprocessor-based

Stig Nilsson, Project Manager

Pennsylvania Power and Light - Jeff G. Gilbert, Nick P. Marino

Finally, the following individuals within the Westinghouse organization participated

I. GENERAL SYSTEM REQUIREMENTS 1-1

II. FUNCTIONS 2-1

1. LINE FAULT PROTECTION 2-1

GENERAL SYSTEM REQUIREMENTS

PRIMARY LINE PROTECTION

However, some devices of the system will have to be installed in locations

2.1 All control equipment shall be designed to function satisfactorily, without

2.4 Equipment and components shall be protected against corrosion.

3.3 Any operator interaction which directs, influences, or modifies operation

3.8 A physical way of disabling control of equipment for maintenance purposes

3.10 Settings shall be classified into the following categories according to

A. Stored on non-volatile medium and changeable by unequipped personnel,

B. Stored on non-volatile medium and changeable by specially equipped

D. Stored on volatile medium and changeable by unequipped personnel with

E. Stored on volatile medium and changeable automatically by software

Upon loss of power all settings of types D or E are initialized to their

3.12 All changes of Class (D) settings shall be logged.

4.2 Maintenance and testing of all functions shall be performed primarily at

4.3 All maintenance instructions shall be in clear English language.

4.4 Each control equipment interfacing directly to substation apparatus such as

4.7 All communications channels for protective relaying and tranfer-tripping

4.9 Loop-back facilities shall be provided at each communication interface.

4.11 Communication error statistics with channel identification shall be kept,

4.12 The capability of injecting measured ac quantities of voltage, current, and

5.1 Additional control equipment for substation expansion shall be designed so

5.2 Man-machine interface shall accomodate the ultimate substation requirements

Use of additional modular parts such as memory, processors, or CRTs in such

Use of additional modular parts such as memory, processors, or peripheral

5.4 Design of control software shall be modular to allow easy addition,

5.7 Addition and checkout of functions shall be made on an off-line software

5.8 Initialization or modification of selected parameters already included in

6.3 Contractor's control equipment shall be designed to maintain isolation bet­

6.5 A grounding bus shall be available on all control equipment, racks, or

6.6 Control equipment connections to the substation apparatus shall be designed

6.8 Voltage input channels should be able to interface to an electronic poten­

6.9 Current-input channels shall be designed to accept signals from iron-cored

6.10 Current-setting and current-influenced specifications in the function docu­

6.15 Relay inputs and outputs shall be available to other subsystems.

6.16 Protection of equipment against telephone-line overvoltage and surges shall

6.19 Redundant equipment shall be physically and electrically segregated as much

6.21 No unintended output or equipment failure shall result in the event of

6.24 When a redundant or failover system is supplied, critical functions shall

6.26 A backup A/D system if used shall be tested periodically on a scheduled

6.28 Equipment furnished by the contractor shall be fabricated of non­

6.29 All equipment markings, nameplates, and labels shall be resistant

This project covers the development of a microprocessor-based control and protec

6.3 Contractor's control equipment shall be designed to maintain isolation bet

6.8 Voltage input channels should be able to interface to an electronic poten

6.10 Current-setting and current-influenced specifications in the function docu

6.28 Equipment furnished by the contractor shall be fabricated of non

6.31 Hardware shall be functionally modularized to promote commonlity of hard

E. Segregated phase comparison of phase and neutral cur

1.1.22 The program shall include secure phase-selector capabi

D. Convert single-pole trip to 3-pole trip after unsuc