The U.S. Army Corps of Engineers relies on experience gleaned from its dozens of hydro projects to improve its practices in implementing protection systems for its generators.
By Ty Nguyen
The vast majority of the generators in the U.S. Army Corps of Engineers’ 75 powerhouses have had their protection systems upgraded from electromechanical to digital multifunction relays that contain new elements and customized logic. This article describes how the Hydroelectric Design Center (HDC), USACE’s National Center of Expertise for hydroelectric power and flood control pumping plant engineering and design, uses national guidance and lessons learned to set main unit protective relays, ensuring USACE assets are properly protected.
HDC relay settings guidelines found in this article are based on experience and lessons learned and evolve over time. HDC’s original design recommendation for protective systems in 2003 was for redundant relays with identical settings. This was controversial at the time, given many in the industry believed redundant relays should not be identical due to concerns regarding a single point of failure. In the years since, however, identical relays seem to have gained acceptance as their use simplifies operations, reliability and maintenance of the protection system. While this has happened, HDC has changed our official recommendation to not having redundant generator protection, but instead having only redundant relays for transformers where the failure of a protective relay would result in multiple units being out of service.
This official stance is evaluated on every project because redundant relays can be seen as low-cost insurance against a forced outage. While the total outage time with a single relay may be about the same as with a redundant pair, the outage can be scheduled with the redundant relays. On the other hand, it is obvious that redundant relays add to the amount of time required for design, installation and testing.
All new protective relay projects designed by HDC make liberal use of test switches to isolate circuits for testing. At a minimum, these switches should be used in the CT, PT and Trip circuits. Test switches make testing relays more convenient and facilitate troubleshooting problems later. Also, when performing a relay replacement design, HDC evaluates all related equipment, such as lockout relays, circuit breakers, fuse blocks, aux relays and auxiliary/isolation transformers. If feasible, these related items are added to the scope of work.
Main unit generator protection
The protective elements listed below are what HDC believes should be implemented to adequately protect a main unit generator. Some elements are indicated to alarm only.
Distance backup (Function 21)
The three recognized system backup schemes are distance backup (21), voltage controlled overcurrent or voltage restrained overcurrent (both referred to as 51V). Only one should be implemented at any given time.
The purpose is to provide backup protection for the generator if the primary generator protection, transformer or line relaying fails to activate in a timely manner. Two zones of protection using different time delays
Zone 1 is set to provide backup protection for internal powerhouse faults. Zone 2 is set to provide backup protection for close-in system faults that aren’t cleared by the bulk power distribution network’s protective relaying.
This element must be coordinated with the utility prior to implementation to ensure compliance and proper coordination with the utility’s protection scheme.
Volts/Hertz/overexcitation (Function 24)
The V/Hz relay function provides protection for over-excitation conditions, which cause excessive flux density in the generator or transformer. Excessive flux density can destroy the generator core in less than a minute and requires complete core replacement to make the generator usable again. This function must be used in concert with the overvoltage function because the V/Hz function will not be useful in overspeed conditions common to hydro units. The frequency, as well as the voltage increases and the V/Hz ratio, remains below the trip threshold. V/Hz protection is most important during startup, shutdown and manual operation, especially on “unit connected” configurations, because the speed may be less than rated speed. When the unit is connected to the bulk power distribution system, the frequency will be that of
Reliability standard PRC-019-2 requires that the 24G setting be coordinated with the 24T and excitation V/Hz limiters and protection where installed. Evidence of this coordination may be performed graphically or verified in the field during commissioning.
HDC recommends using a composite inverse/definite-time characteristic, which is a best fit for all recommended time delays found in industry publications. Our characteristic provides the following response:
• 108% V/Hz – no trip, minimum pickup
• 108.1% V/Hz – 1080 second delay until trip
• 110% V/Hz – 54 second delay until trip
• 120% V/Hz – 9.0 second delay until trip
• 150% V/Hz – 2.6 second delay until trip
• >=175% V/Hz – 0.1 second delay until trip
The chosen pickup value is secure against a device error of 1% and a PT error of 1% and provides a security margin of 1%.
It is recommended to set the alarm element to pick up at the same point as the trip element. This allows time to correct the abnormal V/Hz condition before tripping.
Synchronism check (Function 25)
A synchronism checking relay is used to verify that the generator (incoming bus) and system (running bus) frequency, voltage magnitude and phase angle match before allowing the generator breaker to be closed.
Most USACE powerhouses have not historically used this function and were unsupervised, operator-only designs. The synchronism check feature allows prevents gross out-of-phase closure.
Generally, HDC recommends adding synch checking for generator breakers that do not have this feature.
If the synch check function is to control both auto and manual closures, ensure the window is made wide enough to not interfere with either.
Undervoltage (Function 27)
While undervoltage is not recommended as a stand-alone tripping function for our hydro units, it has a few ancillary purposes. It has been used for accelerated tripping of loss-of-field, arming the inadvertent energization function, starting the generator’s incomplete sequence element, and for the unit run circuit. For units with synchronous condensing, the undervoltage can be added to seal-in the unit run relay when the wicket gates are closed for condensing mode.
Inadvertent energization (Function inad)
Inadvertent energization doesn’t have an IEEE function number, so Schweitzer Engineering Laboratories’ designation of INAD has been used as an example here. The purpose is to protect the generator from inadvertently being energized due to operating errors, some types of breaker flashovers, or control circuit failures. When a generator is energized from the power system (three-phase source), it will attempt to accelerate like an induction motor. While the machine is accelerating, high currents would be induced in many parts of the rotor, some of them not intended to carry current. This will cause significant damage in a matter of seconds.
Voltage controlled overcurrent and field breaker auxiliary contact supervised overcurrent are two prevalent methods for detecting INAD. Since voltage controlled overcurrent can be applied with no additional wiring and is more sensitive, this method has been used most often.
Reverse power/motoring (Function 32)
Reverse power relays typically were not originally installed in USACE powerhouses. The reverse power element is used to protect the generator against motoring, which can be hard on mechanical equipment and unnecessarily draws power from the grid. A reverse power element was originally added because of a motoring incident at a USACE plant caused by a transducer failure. While transducer failures are rare, other events have occurred where the reverse power feature would have prevented prolonged motoring of units. Since USACE has begun implementing it regularly, it has proven effective, but it must be used cautiously to prevent nuisance trips.
For units where the turbine runners are below the tailwater level, the reverse power can be high. For units where the turbine runners are above the tailwater level, the reverse power may be between 0.2% to 2.0% of rated output (IEEE C37.102). Because the units may motor slightly when initially synchronized to the grid, or when operated close to zero MW, a time delay is used to prevent nuisance tripping. IEEE C37.102 recommends a time delay of up to 60 seconds but notes that 30 seconds is typically used.
Additional factors need to be considered for units where the turbine runners are below the tailwater level and the units are used for condensing. In this case, there is typically a large amount of reverse power as the wicket gates are closed and before the water covering the turbine runner is displaced. As the water is removed from the turbine, the reverse power reduces to values similar to a runner above tailwater.
Loss-of-field / loss-of-excitation
The 40 element is used to detect loss-of-field resulting from loss or failure of excitation system. When a synchronous generator losses its field current, it acts as an induction generator, pulling VARs off the system to induce a field. This causes very high field and stator currents and will damage equipment by overheating. System impedance (Xs) with the unit online, and all other units offline, must be known. This would represent the weakest system and thus the worst-case scenario for the unit.
HDC uses protection scheme 2 as shown in Figure 4.5.1-3 of IEEE C37.102. This scheme emulates the KLF electromechanical relay and uses an impedance unit, a directional unit, and an undervoltage unit applied at the generator terminals (PTs).
NERC reliability standard PRC-019-2 requires that the loss of excitation trip curve be coordinated with the field underexcitation limiter, machine capability curve, steady state limit and exciter minimum field current. Calculations serve to develop starting points but are not final settings. After calculating the settings, settings curves must be plotted on a P-Q and R-X diagram to coordinate them with the machine’s capability curve, steady-state stability limit, UEL and minimum field current limit curve. The resulting coordinated settings can then be used.
HDC selected 0.5 second as the time delay for zone 1. Reference material recommends anywhere from 0.25 to 1.0 depending on the application. The time delay used for the zone 2 fast trip when there is a partial loss of field and depressed generator terminal voltage is normally set to 1.0 second, but some UELs found in some old rotating exciters are very slow acting and allow significant undershoot, which may require the delay to be increased to as much as 3 seconds.
Negative sequence/phase imbalance (Function 46)
The negative sequence is primarily backup protection for unbalanced system faults that are not adequately cleared, extremely unbalanced load conditions, or an open phase occurs. USACE generators are salient pole units, and they typically have connected amortisseur windings.
IEEE C50.12 requires that salient pole units with connected amortisseur windings be capable of operating continuously with 10% negative sequence current, while units with non-connected amortisseur windings be capable of operating continuously with 5% negative sequence current. The standard identifies the I2T capability of these machines to be 40.
The percent alarm pickup may need to be adjusted to a higher pickup value for plants that operate islanded loads since there may be phase imbalance out of our control that could cause nuisance alarms.
Overcurrent (Function 50/51)
The overcurrent element provides annunciation of generator overloading, which causes stator heating. This condition could cause problems if left unaddressed. The pickup of this element has historically been set to 15% above the maximum continuous rating of the generator stator winding. Note that older windings were rated as having a 115% continuous overload capability, therefore the pickup setting would need to account for this.
Overvoltage (Function 59)
The overvoltage element is used to protect the generator stator from high voltages due to voltage regulator failure, load rejection overspeed, or other incidents. IEEE C50.12 requires salient pole machines to be capable of operating continuously at 105% rated voltage. During a load rejection, the 24 (V/Hz) element should not pickup due to the overspeed but the magnitude of the voltage may exceed “permissible” limits.
NERC Standard PRC-019-2 requires that the over and under voltage trip settings be coordinated with any exciter over/under voltage protection, limiters, and generator limits. Also, NERC Standard PRC-024 Requirement 2 requires that the 59 settings allow voltage ride-through operation within a “no-trip-zone”. HDC’s recommended settings consisting of a six second time delay when generator terminal voltage exceeds 110% is longer than the standard’s required minimum time delay and thus complies with the standard. Our instantaneous trip at 140% terminal voltage is well above the instantaneous tripping threshold set forth by NERC.
As of the time of writing, DMFRs do not have an inverse time characteristic like the old electromechanical relays. It is therefore possible to operate in the 105%-110% indefinitely depending on exciter operation.
The SEL-300G relay has a frequency tracking range from 20-70Hz. Line trips or load rejection can cause the unit frequency to go above 70Hz, which will latch in the timed overvoltage element until the frequency comes back below 70Hz. So, assuming that if the frequency is near 70Hz the chance of the event being a load rejection is high, therefore we use an overfrequency element to block the timed overvoltage trip while the instantaneous element is left enabled.
Breaker failure (Function 50bf)
HDC has been replacing any existing breaker failure relays by using a 50BF scheme in the DMFR relay. When a breaker trip condition occurs, a timer starts. The phase currents measured by the breaker CT’s must drop below a preset value within the TD provided. For relay functions that do not require current above the pre-set value (these can include 24, 32, 64G, & 64F), then the breaker ‘52a’ contact must open within the TD provided. If not, the breaker failure trips and initiates a backup trip.
This element only applies to trips initiated by the DFMR. To trip for external conditions, the designer should connect the initiating external devices to a relay input and add that to the logic. Careful consideration needs to be given to adding external items to the breaker failure logic.
A breaker local-remote control switch, or TOC (truck-operated contact) switch, has been used to automatically disable breaker failure tripping, but adding things to the logic should be carefully considered.
Breaker pole disagreement (Function 61)
A pole disagreement occurs when one breaker pole is not in the same position as the others, or there is a flashover when the breaker is open. We have not noted a DMFR that has a distinct pole disagreement element, but the custom logic functions in the DMFRs can be used to construct one. HDC only recommends using this element in applications where the unit breaker has wood or micarta (textolite) operating rods which are more likely to experience individual pole failures.
Stator ground (Function 64)
This element is used to detect a ground anywhere on the 13.8kV delta bus connected to the generator, and is the primary protection for phase-to-ground faults. With the exception of some station service and other small units, most USACE units have high resistance grounding. When a ground fault occurs, the neutral to ground voltage will rise to a level proportional to the distance of the fault from the neutral. For a fault at the generator terminals, normal phase-to-ground voltage appears at the neutral. Voltage drops proportionally as the fault location moves toward the neutral.
For units that share a connection to the same delta bus, a staggered tripping scheme was typically implemented where one unit will trip first and the second unit will trip with a longer delay. Where additional connections were made to the delta bus, such as to station service transformer, those breakers were typically set to trip before the generator(s).
Typically the generator breaker was set to trip 2 to 4 seconds before tripping the 86 lockout relay which would then shutdown the generator. This was done so that the operator would know whether the fault was on the generator or line side of the breaker by whether or not the generator was at speed-no-load or shutdown by the 86. If all connected generators had been found at speed-no-load, the operator would then have to manually trip the line to clear the fault. With the availability of internal logic equations, the generator relay can now automatically trip the line if the fault clears with the opening of the last generator breaker.
Methods using third harmonic voltages to detect grounds on remaining 3-5% of winding near the neutral have been used. These schemes should be avoided for units that are connected in parallel due to the effect that loading changes have on the harmonic voltages. But using these schemes on unit connected generators has proven to be reliable.
The existing time delays between actions in the selective tripping scheme are usually 4 seconds, but delays as short as one second between actions have been used with success. The amount of current that the HRG grounding resistor allows is based on the amount of capacitive charging current on the system. If the generator is connected to an extensive station service system that requires the HRG to allow a significant amount of ground current to flow, then reduced time delays should be used to reduce damage during a fault. Reductions in the time delay between actions should be evaluated further.
Logic can and has been used to trip the line after verifying that the ground is between the unit breaker and the GSU. The need for this logic is up to the designer, and should be coordinated with operations.
Field ground (Function 64f)
Since the field circuit of a generator is ungrounded, a single ground fault will not affect operation or damage the unit. It is important to note that the first fault, which doesn’t cause immediate machine damage beyond rupturing the field winding insulation, causes the field winding to be exposed to additional electrical stress, which increases the probability of the second fault, which would be very damaging to the generator. A second ground will result in shorting a section of the field winding, producing an unbalanced air gap flux in the generator. The unbalanced air gap flux produces unbalanced magnetic forces which result in severe machine vibration and damage. Loss of a section of the field also causes substantial current in the rotor iron and unbalanced stator currents. The current in the rotor iron causes rotor iron heating which can lead to rotor distortion. Usually, the rotor contacts the stator iron resulting in severe damage.
HDC recommends tripping on detection of a field ground. Typically, plants that have not experienced a generator field ground event do not want to trip, citing unscheduled loss of generator availability. However, plants that have experienced a severe 64F event are very happy to trip upon the first indication of a field ground.
10kOhm alarm and 5kOhm trip setpoints are recommended starting points for these settings. In older units where the insulation may have degraded over time, the setpoint may be set to a lower resistance if the 64F trips but field winding insulation resistance testing doesn’t confirm insulation failure.
The field ground relay should be disabled during field flashing. The exciter typically has a 10 second window for field flash to occur. A 10 sec delay on the field ground element should give enough time for field flash to occur without any nuisance alarms. If there is an available output from the exciter for field flash monitoring, it can be used as an input to the DMFR to disable the 64F protection during field flashing which would allow a smaller time delay to be used.
HDC uses a 60 second delay between the alarm and trip elements.
out-of-step (Function 78)
This element is used to detect the loss of synchronism between the generator and the system, and has not historically seen widespread use across USACE plants. An out-of- step condition causes high peak currents, winding stresses, and high shaft torques; all of this can damage the generator, and could also damage the GSU. HDC uses a single blinder scheme as shown in IEEE C37.102, which may be more secure than the double blinder scheme since the apparent ohms must enter from one direction and exit toward the opposite, whereas the double blinder scheme will trip once the apparent ohms crosses the inner blinder and exits out of the outer blinder in either direction.
Frequency (Function 81)
The 81 element is recommended to be used only to block the overvoltage element for a load rejection over frequency condition. We do not trip hydro units on frequency.
Differential (Function 87)
The differential relay provides the primary protection for phase-to-phase faults, and can also detect turn- to-turn faults in multi-turn coils when used with a split-phase winding / ct configuration.
Digital relays do not employ an inverse time versus operate current characteristic as the electromechanical relays did. Therefore, the setting for the digital relays needs to be less sensitive to prevent inadvertent operation during external faults and transformer inrush events. This was noted when reviewing a number of 87G operations in the past. It was determined that these events were caused by energizing the GSU from the low-side, simulating a blackstart, which saturated the breaker CTs and caused the relay to see a differential. One factor complicating the investigation of these events was the presence of mismatched CT accuracy classes at one of the plants. However, another plant had a similar event occur without the mismatched CT’s. In response to these events, HDC put together a set of standard 87 settings using a higher minimum pickup than was typically done with electromechanical relays, a dual slope, and harmonic restraint/blocking.
Very high slopes have been recommended to accommodate possible current transformer (CT) mismatch and saturation, but we do not believe they are needed. “Loosening” the 87 slope settings would provide more security against false trips, but would have the side effect of covering up problems that should be known. Usually the only way to cause a properly rated generator CT to saturate is for the system contribution of the available fault current to pass through the CT’s primary, and if this happens, the fault is within the generator’s differential zone of protection anyway, so an 87G trip is expected.
Many USACE projects have already upgraded, or are in the process of upgrading, their generator protective relays. Care must be taken into consideration when performing settings. Proper communication with the utility must be done prior to implementing settings related to zone pick up and time coordination. Care must also be taken into consideration when wiring the digital relays. Polarity and connections need to be verified during field testing. Relay settings is an art; using experience as well as lessons learned, we can improve how we implement digital multifunctional relays.
1Nguyen, Ty, “ Main Unit Hydropower Generator Protective Relay Guidance and Lessons Learned,” Proceedings of HydroVision International 2017, PennWell Corp., Tulsa, Okla., 2017.
Ty Nguyen is a professional engineer working at the U.S. Army Corps of Engineers’ Hydroelectric Design Center.
Peer Reviewed — This article has been evaluated and edited in accordance with reviews conducted by two or more professionals who have relevant expertise. These peer reviewers judge manuscripts for technical accuracy, usefulness, and overall importance within the hydroelectric industry.