60

IEEE power & energy magazine

1540-7977/06/$20.002006 IEEE

september/october 2006

IN RECENT YEARS, WE HAVE SEEN SEVERAL CATASTROPHIC FAILURES OF

power systems throughout the world. The usual scenario of such events is that the power system is in a stressed state, followed by faults on critical facilities, followed by unanticipated
tripping of other facilities, finally leading to system breakup and blackouts. It is well recognized that, in most of these events, protection systemsrelaysplay an important role in that
they operate in an unexpected manner and are often a contributing factor to the cascading phenomena. In many postmortem analyses of such events, relays have been unfairly singled out as
the main culprits, and often draconian measures have been suggested to correct the perceived
faults in the protection system.
This article addresses the broad question of relaying philosophies, modes of operation of
relays under abnormal system conditions, the categories of their failure modes, and advances
made possible by modern technology in computer relays, adaptive relaying, and the use of widearea measurements for improved protection and the ability to mitigate wide-area outages. It is
hoped that this discussion will lead to a dialogue among system planners, relay engineers, and
operating personnel to explore the realities of relay system performance under stressed system
conditions and to adapt solutions made possible by new technological innovations.

An Overview of Relaying Practices

The number of relays on a modern high-voltage transmission system is very high. A very rough
estimate of relays in service in the North American grid is on the order of 5 million. The primary task of relays is to trip associated circuit breakers (i.e., transmission lines, buses, generators, transformers, etc.) in response to faults or other conditions for which the protection system
is designed. All protection systems usually consist of several relays with well-defined conditions
under which they should trip. In most high-voltage networks, there are high-speed relays that
operate in less than three cycles of the fundamental power system frequency. Their main application is in protecting equipment against damage due to faults. These relays are autonomous,
utilizing locally measured signals, often supplemented by remote terminal data over pilot channels. These relays, referred to as primary protection systems, may be duplicated for reliability.
In addition, backup relays are provided, which, in general, operate more slowly and disconnect a
larger portion of the power system.
Traditionally, the relaying philosophy has been biased towards dependability, meaning that if
a fault should occur, the primary relay must operate to clear the fault. This bias is a result of
decades of experience with operating ac power systems where the main threat to the system,
aside from damage to equipment, is a loss of synchronism among generators due to slowly
cleared faults. High-speed fault clearing is considered essential on modern power systems since
operation of backup relaying would increase the probability of system instability and extensive
outages when primary protection fails to clear a fault.
The bias towards high dependability inevitably leads to a reduction in security of the protection system. In other words, by making the protection system highly dependable, the protection
system is also made more prone to false trips when no trips are warranted. For most traditional
power systems, this increased probability of an occasional false trip was considered an acceptable
risk to ensure a dependable high-speed clearing of all faults coupled with the fact that the system
itself must withstand the loss of a single system element. However, as the power systems undergo
fundamental changes, such as those brought on by open access and deregulation, one must reexamine this traditional protection philosophy, especially when the power system is stressed.
DIGITAL VISION

september/october 2006

What Are the Types of Relay Misoperations?

In how many ways can a relay misoperate? Of course, there is a possibility of the failure to trip for
a fault. One could rule out this type of misoperation in light of the multiple tripping relays

IEEE power & energy magazine

61

Time

Zone 3
Zone 2
Zone 1

Zone 2
Zone 1

figure 1. Step distance protection of a transmission

system; zone coverage and time delay coordination.

employed in most modern power systems. This leaves the

mode of failure that could be generically labeled an unanticipated trip. To further understand this phenomenon, consider the
following ways in which the protection system may operate.

Correct and Appropriate

Correct and appropriate is the operation we all desire. The
protection system operates as designed and its operation is
appropriate for the prevailing system condition.

Correct and Inappropriate

In the case of correct and inappropriate, the protection system has operated as designed and set, but its operation was
not appropriate for the prevailing system condition. This type
of misoperation is quite common and can occur for many reasons. For example, when the relays were set, the network
conditions for which the settings should be designed were not
properly identified. In other words, the prevailing network
condition when the relay operated was not anticipated in the
specification stage. Depending on the utility practices, this
may be an oversight on the part of the planning department or
engineering department. We are seeing more and more such
oversights as the number of trained engineering staff in most
electric utility companies is severely depleted. Since loading

patterns on the networks have changed due to open access

and deregulation, the engineers who specify conditions under
which the relays must operate have to revisit their network
contingencies.
Another reason for this type of operation could be a
wrong setting made when the relay was installed or calibrated. The result is that the relay operated as it was designed or
set to do, but the result was not what was intended.

Incorrect and Appropriate

Although, for completeness, we include incorrect and appropriate in this category, we do not believe this is a common
occurrence. One could include those operations in which a
relay operated incorrectly, but in so doing prevented another,
more serious trip and avoided a major cascading failure.

Incorrect and Inappropriate

In the case of incorrect and inappropriate, the relays have
produced an incorrect operation, which has contributed to a
cascading outage. This phenomenon has been investigated
from the point of view of hidden failures in protection systems. Given the very large number of protective devices in
service, it is inevitable that some of these will have failed in a
manner that does not exhibit itself when the power system is
in a normal state. However, when another triggering event
(such as a fault) occurs, the hidden failure causes the offending relay to misoperate. Recent research results on these phenomena, and possible countermeasures against them, have
been published in the technical literature.

Distance Relays

A distance relay is a protective relay in which the response

to the local voltage and current is primarily a function of
the impedance between the relay location and the point of
fault. It is independent of a communication link and is the
most commonly used backup protective system. This is the
most ubiquitous relay found on any power system. In addition to transmission line protection,
it is also used for out-of-step relaying and loss-of-field relaying and is
X
often a component of many remediX
al action schemes.
C
C
Zone 3
Zone 3
In transmission line protection,
which is the principal application of
distance relays, several zones are
B
B
Zone 2
Zone 2
employed in a step-distance configuration, in which each zone is separatZone 1
Zone 1
ed by a difference in operating times.
Figure 1 shows a typical step-disA
R
A
R
tance relay timing arrangement. Zone
1 provides instantaneous protection
(a)
(b)
for 8090% of the line between its
terminals. Zone 2 is applied to protect
the remaining 1020% of the line but
figure 2. Step distance relay characteristics: (a) typical electromechanical relay
with time delay. Zone 2 also provides
characteristic and (b) representative electronic or computer relay characteristics.
62

IEEE power & energy magazine

september/october 2006

some level of backup to the adjacent transmission line. Zone

3 is applied as a remote backup to Zones 1 and 2 of all adjacent lines in the event that the protective systems of those
lines fail to clear a fault. Figure 2 shows the operating characteristics of the separate zones of the step-distance relay protection on an R-X diagram. Circular characteristics shown in
Figure 2(a) are common in electromechanical relays and certain computer relays. More common in modern electronic
and computer relays are the quadrilateral characteristics
shown in Figure 2(b).

X0

Z0

The Liability of Loadability

S0 = (P0 + jQ0 ) = (E2 /R0 )(cos2 + jsin cos ).

It is clear that the loadability limit is a function of both the
voltage and the power factor angle. If the loadability limit at
unity power factor and with the line voltage of 1.0 per unit is
Smax , the loadability limit at a voltage of E per unit and power
factor angle is given by
S0 = Smax E2 cos .
september/october 2006

R0

figure 3. Loadability limit for a simple rectangular

impedance characteristic. The line is exporting active and
reactive power.

1.0

E =1.0 pu
E =0.8 pu
S0/Smax

Loadability of a relay is the maximum load that may be carried on the protected line such that a load greater than the
loadability limit will be indistinguishable from a fault to the
relay and will lead to a trip of the line. The loadability of a
relay is affected by the prevailing voltage at the line terminal
and also by the load power factor. When the power system is
stressed, the reactive power flows may become unusual.
When the power system is undergoing electromechanical
swings, the voltages near the electrical center of the system
may get depressed significantly. When system contingencies
are specified to confirm the appropriateness of relay characteristic settings, it is imperative that these effects on loadability be taken into account.
Loadability problems of overreaching zones of protection
have been recognized since the early days of protection.
Where a third zone as a remote backup zone is deemed to be
necessary, certain technical innovations are available to alter
its loadability limit. These innovations are more readily
implemented in modern computer relays. However, even the
electromechanical relays do have limited ability to improve
their loadability.
If the voltage and current phasors at the line terminal are
such that the loadability limit is reached, the apparent impedance seen by a distance relay must be on the relay characteristic. For simplicity of analysis, consider a rectangular
characteristic of a line relay (such as a Zone 3 setting since it
has the lowest loadability limit), where the line has negligible
resistance. If the line is exporting both active and reactive
power at a power factor angle , the apparent impedance at
this loadability lies in the first quadrant of the R-X diagram as
shown in Figure 3. For the rectangular characteristic considered here, let the intercept on the R-axis be R0 . The loadability limit S0 is given by (per unit)

0.5

E =0.6 pu
E =0.4 pu
0

30
60
Power Factor Angle ()

90

figure 4. Loadability limit of a rectangular zone shape.

Note the dependence on power factor angle and the line
terminal voltage.

The dependence of loadability on line voltage and power

factor is shown on Figure 4. The break in the curves is due
to the corner of the rectangle, which is assumed to occur at
a power factor angle of 60 . It should be clear that the loadability dependence on voltage and power factor angle is
strongly influenced by the shape of the relay characteristic
and must be evaluated for the characteristic actually in use.
Note also that the ordinate of Figure 4 shows the megavoltampere loadability; the megawatt loadability is
obtained by multiplying the MVA loadability by the appropriate power factor.
IEEE power & energy magazine

63

When Is a Third Zone Needed?

Zone 3 of a distance relay is used to provide remote backup
protection if the primary protection system should fail.
Although in common usage a protection system may mean
only the relays, the actual protection system consists of many
other subsystems that contribute to the detection and removal
of faults. Each of these subsystems may fail, making the primary protection inoperative. Figure 5 shows the basic elements of the protection system. In the following discussion,
we examine all of the protective elements in a substation with
regard to the application of Zone 3 to provide backup.

Batteries
If only one battery is available at the substation, a system control, alarm, and data acquisition system (SCADA) alerts the
engineering or operating department to take corrective action
if the battery becomes defective. At the higher transmission
voltage levels, it is not uncommon to provide two batteries, in
which case providing backup protection for battery failure
may not be necessary. However, if only one battery is available, even with a SCADA warning it may be advisable to add
Zone 3 at the remote stations(s) if the failed battery is at a
location that is not easily reached and if maintenance personnel may not have the time to correct the problem quickly.

Relays
To cover any single relay failure, it is common practice to use
multiple relays covering the phase and ground faults. At the
higher voltages or at more critical stations, there would be

Circuit Breaker

Relay
Transducers

Battery

figure 5. Elements of a protection system.

64

IEEE power & energy magazine

two sets of relays including pilot protection. One may therefore conclude that remote backup protection may be unnecessary, but care must be taken to be sure that no common-mode
failures exist within the circuitry of multiple relay sets.

Transducers
At the lower voltage levels, the transducers, current transformers (CTs) and potential transformers (PTs) are not normally duplicated, and a failure of the potential or current
transformers could go unnoticed and result in a failure to trip.
In this instance, a Zone 3 remote backup would be desirable.
At the higher voltage levels, the current transformer secondary windings are duplicated, each serving a separate set of
relays. The potential transformers or devices are also duplicated or fused separately to maintain voltage integrity to each
set of relays.

Circuit Breakers
Circuit breakers are not duplicated, and failure of a circuit
breaker to clear a fault must be considered. Circuit breaker
failure tripping schemes are sensitive to system and station
configuration. In some cases, it is sufficient to open all local
breakers that can contribute to the fault upon detecting a
breaker failure. This may not be sufficient to clear a fault, and
a transfer trip scheme is required. This involves expenditures
for communication equipment, which may not be justified,
and a remote Zone 3 would be preferable. It is not our purpose here to catalog all possible bus arrangements, but some
examples are instructive.
As extra-high voltage (EHV) transmission systems
matured, local backup replaced remote backup, and breaker
failure schemes started to evolve as a subset of local backup
protection. At first, a separate set of relays was used to initiate the required tripping, but this quickly was replaced by a
special isolated circuit that employed all of the protective
relays that simultaneously initiated tripping the appropriate
circuit breaker(s) and started a timer. When the timer timed
out, a tripping relay opened all of the breakers that could see
the fault for which the protective relays had operated. The
timer was set just beyond the normal clearing time of the circuit breaker, usually on the order of 710 cycles.
Substations are designed for reliability of service and flexibility of operation and to allow for equipment maintenance
with a minimum interruption of service consistent with an
economic evaluation of the costs involved versus the benefits
derived. Bus arrangements range from a single-bus, singlebreaker scheme common to low-voltage distribution stations
to the breaker-and-a half configuration that is almost universal
for EHV stations. In situations where breaker failure schemes
trip all of the breakers that can sense a fault, including transfer
trip, a Zone 3 application may not have any advantage. However, in the absence of a communication channel for technical
or economic reasons, a Zone 3 setting may be of some advantage. Nonetheless, the Zone 3 setting must encompass all possible infeeds. In the case of tapped loads, it is not always
september/october 2006

The number of relays on a modern high-voltage

transmission system is very high. A very rough estimate of relays
in service in the North American grid is of the order of five million.

possible to set Zone 2 to see the apparent impedance to the

far end fault and not overreach other Zone 2 relays. In such
cases, a possible solution is to set a remote Zone 3 to see the
apparent impedance to the remote location.
As each component failure is identified, a backup scheme
capable of covering that failure must be designed. In general,
in the absence of a communication channel, duplicate transducers or batteries, and for certain bus configurations, remote
Zone 3 provides the most effective backup protection. Of
course, catastrophic physical failures such as earthquakes or
storms that destroy the building, panels, or multiple primary
equipment will also require a remote backup system such as
Zone 3. We may also classify as a catastrophic failure certain
human errors such as incorrect settings or equipment outages
during maintenance.

Countermeasures for Improving

Zone 3 Loadability
One thing to note is that load excursions are balanced phenomena, so that the presence of unbalanced currents (negative sequence) would indicate a fault. Thus, loadability
should not be an issue when negative sequence currents are
present. The third zone characteristic for three-phase faults is
the only one where load conditions could be confused with
remote faults. It is also unlikely that three-phase faults would
have a significant fault resistance, so the third zone shape for
such faults could be considerably modified to reduce the
resistive reach of the relay, thus increasing the loadability of
the relay. These and other improvements are generally available only in computer relays.

Electromechanical Relays
The traditional electromechanical relays have fixed zone
boundaries, and usually they are made up of circular shapes
or straight lines. Directional relays can be applied as blinders
restricting the admittance (mho) circular characteristics of
Zone 3 to high X/R values as opposed to normal load power
factor angles. As indicated above, the presence of negative
sequence current is a good indicator that a fault, not a balanced load condition, exists. Some innovations in electromechanical relays have addressed the loadability problem by
proposing the use of a figure-eight shape (a forward offset
characteristic) to increase the loadability limits of relays. This
offset mho characteristic is easily attainable with electromechanical relays and may offer one of the best and most
inexpensive solutions to the loadablity problem.
september/october 2006

Electronic Relays
Solid-state relays can shape their characteristics or introduce
load encroachment elements that are also attractive solutions.
Quadrilateral characteristics, which shape the protection
zones to any desired shape, are a definite improvement.

Computer Relays
Computer relays have the potential for solving many of the
problems that could not be addressed by conventional relays.
Many computer relays now offer multiple groups of settings,
so that Zone 3 settings could be adapted to changing system
configurations and the accompanying in-feed variations. It is
also possible to include a load-encroachment characteristic
which outlines an area within the relay characteristic that prevents operation for a defined load impedance. Computer
relays could also be made to block trip if a balanced condition exists and the power factor of the line current is characteristic of system loading conditions. This approach is indeed
reasonable and should provide security in the case of a heavy
load. However, one should take note of the fact that often
under unusual system conditions where significant amounts
of vars are being transmitted, the power factor may not
always be a sure indicator that a load, rather than a fault,
exists on the line. Under normal system conditions, vars and
watts are tightly coupled through the generator operating
parameters. Under system stress or fault conditions, vars and
watts may be decoupled and the 30 power factor criteria
may not apply (see Figure 3 for the effect of power factor and
voltage on loadability).
If one postulates communication between relays at a station
or with relays at remote stations, it may be possible to design
more effective logic for differentiating between a load and a
fault. Trending observed changes in line currents, correlating
changes seen by different relays, and using information received
from control centers indicative of the state of the power system
could all be integrated in computer relays with a very effective
check on the operation of backup protection systems.

Adaptive Relaying
The intelligent supervision of Zone 3 is an excellent example of adaptive relaying, with its ability to adjust its performance to match the prevailing power system conditions.
The problem of the sensitivity of the Zone 3 characteristic
to emergency load or power system instability can be solved
with the use of adaptive relaying principles. Several solutions using electromechanical or electronic relays have
IEEE power & energy magazine

65

Backup relays are provided which, in general,

operate more slowly and disconnect a larger portion
of the power system.

already been suggested. Each of these solutions is more

readily applied with computer relays. Using computer logic
instead of complex wiring immediately improves the reliability of the relay. Prefault load could be taken into account,
and prevailing stability margins could be introduced into the
relaying algorithms. The overwhelming thrust of the North
American Electric Reliability Council (NERC) rules and
other instructions regarding the application of Zone 3 elements has been to prevent their operation during emergency
conditions. Although this is a desirable goal, it should be
recognized that even with all the intelligence available to
modern computer relays, the problem of distinguishing a
fault from a heavy load in a relatively short time and using
only the current and voltage signals available to the relay
cannot be solved in every single imaginable (and some
unimaginable) power system scenario. If Zone 3 is the protection system of last resort, and if it is incorrectly prevented from operating when it should do so, the consequences
to the power system may be much worse than those resulting from an unwanted Zone 3 trip.

not always the case. Known cases abound where the very act
of maintenance has induced a hidden failure mode that
remains unexposed until cascading failures begin to unfold.
Given the large number of protective devices present on a
power system, it is not possible to rule out the possibility of
hidden failures in some relays. An approach for providing
countermeasures against false trips due to hidden failures is
to identify locations in the network where hidden failures
would be particularly damaging to the power system and then
provide a computer-based relay as a supervisor of the relay
operation. In addition, a voting scheme among all the protection systems can be implemented at such critical sites.

Integrating Protection and Control

Our concern up to this point has been the loadability of backup
protection schemes. In any realistic scenario, the total protection, operation, and control package must be considered as an
integrated system. It is being recognized that the advent of new
technologies has provided two of the most valuable elements
of this total package: system integrity protective schemes
(SIPSs) and wide-area-based protection systems (WAPSs).

Hidden Failures
A vexing problem for protection engineers is that of hidden
failures in the protection system. These are failures that go
undetected when the power system is in a normal state and
that contribute unnecessary trips when the system is disturbed
by faults or severe dynamic conditions. Although increased
maintenance, calibration, and frequent reviews of protective
settings would reduce the likelihood of hidden failures, this is

SIPS
SIPS is an increasingly valuable tool to initiate system corrective actions as opposed to equipment protection. Among the
many system stress scenarios that a SIPS may act upon are
transmission congestion, transient instability, voltage and frequency degradation, and thermal overloading. Many corrective actions are available to respond to these potential system

Initiating Event

Initiating Event

New Control
Elements
(a)

(b)

figure 6. (a) Brittle power system breaks up into synchronous islands when a strong disturbance occurs. (b) By using
high-power electronic devices at optimum locations, the damage due to the initiating event can be confined to a small
region, rendering the power system ductile.
66

IEEE power & energy magazine

september/october 2006

Traditionally, the relaying philosophy has been biased

towards dependability, meaning that if a fault should occur,
the primary relaying must operate to clear the fault.

stresses. An SIPS program can initiate any one or combination

of the following: load or generator rejection or fast valving,
load shedding due to underfreqency or undervoltage, out-ofstep blocking and tripping, system separation, etc. These
measures are normally inactive and are armed automatically
when some system stress condition occurs; alternatively, they
may be armed manually from a control center. The remedial
action schemes (RAS) and system protection schemes (SPS)
that have become popular in recent years are SIPS systems. To
create more intelligent SIPSs, one must rely on the newly
available wide-area measurement systems being deployed in
many power systems.

Wide-Area Protection Systems (WAPSs)

To implement effective, intelligent SIPS appropriate for the
prevailing power system condition, it is essential that a realtime, fast-acting, system-wide data collection system be available. Wide-area measurement systems (WAMSs) are rapidly
becoming an important element in system operation and control. The use of real-time measurements to determine the state
of the power system goes back to the late 1960s. State estimation, contingency evaluations, and optimization of the operating state have been practiced by most modern power systems.
However, the constraining contingencies for power systems are
usually rooted in the dynamic phenomena. Thus, there has
been a disconnect between what is actually needed in real time
and what could be achieved by the prevailing technology. All
this is changing with the introduction of the global positioning
system (GPS), which can be used to provide synchronized phasor measurements for the entire power system, thus providing
high-quality system data at a very rapid rate (once every few
cycles of the power system frequency). High-speed broadband
communication has also become available so that these measurements could be transferred over great distances with latencies on the order of 50 ms, and progress is being made in
developing analytical techniques that can effectively use these
measurements in real time.

Brittle and Ductile Systems

Modern power systems deliver power to the local load centers efficiently and economically. However, they are brittle in
the sense that they tend to break up through the loss of synchronism when faced with a catastrophic disturbance. The
break up can be compared to the shattering of a brittle structure upon being struck with a heavy blow. A ductile structure,
on the other hand, would deform around the disturbance and
prevent the disturbance from cascading into a total system
september/october 2006

collapse. This is illustrated conceptually in Figure 6. It is possible that the developing stress levels in modern power systems will compel engineers to bring some measure of
ductility to the power systems by judicious use of high-power
electronic devices.

Changing Nature of Power Systems

It is clear that the power systems of today are not what they
were before open access and deregulation were introduced in
many countries. We are witnessing unusual generation and
power flow patterns, unplanned congestion, and the introduction of renewable generation with its associated uncertainties
regarding protection and control. The emphasis on stockholder
good versus public good has transformed the industry culture
from reliability to economy. This change has resulted in a lack
of incentives for infrastructure improvements, restrictions on
information exchange, and, most disturbingly, the lack of signals for technical manpower needs, both present and future. To
meet these challenges, the industry must embrace the latest
technologies, recruit the best and brightest of our graduates,
and increase the exchange of technical concepts and innovation
though industry conferences and literature.

For Further Reading

S.H. Horowitz and A.G. Phadke, Power System Relaying, 2nd
ed. Somerset, England: Research Studies Press, 1995.
S.H. Horowitz and A.G. Phadke, Third zone revisited,
IEEE Trans. Power Syst. Delivery, pp. 2329, Jan. 2006.
S.H. Horowitz, A.G. Phadke, and J.S. Thorp, Adaptive
transmission system relaying, in Proc. IEEE Summer Meeting, 1987 Trans. PWRD, Oct. 1988, pp. 14361445.
S.H. Horowitz and A.G. Phadke, Boosting immunity to
blackouts, IEEE Power Energy Mag., vol. 1, pp. 4753,
Sep./Oct. 2003.

Biographies
S.H. Horowitz received a bachelors degree in electrical engineering from the City College of New York. He is a consultant, author, and lecturer. He is a Life Fellow of the IEEE and
a member of the National Academy of Engineering.
A.G. Phadke received a B.Sc. degree from Agra University, a B.Tech. degree from the Indian Institute of Technology,
an M.S. degree from the Illinois Institute of Technology, and
a Ph.D. from the University of Wisconsin. He is a University
Distinguished Professor (emeritus) at Virginia Tech in
Blacksburg, Virginia. He is a Life Fellow of the IEEE and a
p&e
member of the National Academy of Engineering.
IEEE power & energy magazine

67