achieve reliability and flexibility. The configurations consist of different bus and circuit breaker schemes which, when switched, provide alternate network paths.10 The bus configurations could have a significant impact on maintaining reliability in the event of a malicious attack on the power system, especially if a transformer, circuit breaker, instrument transformer, or bus work fails violently. For example, a buswork or circuit breaker failure can cause complete substation outage with one bus configuration, but no loss of connectivity with another. Appendix F compares four common bus configurations and indicates their relative advantages and disadvantages. Older, usually lower-voltage, configurations and protection schemes tend to be less reliable.11

Whether it is caused by a terrorist attack or some natural cause, once a transmission or substation short circuit has occurred, circuit breakers must interrupt tens of thousands of amperes to isolate the faulty equipment and protect equipment that is not yet damaged. If the circuit breaker fails, additional breakers may be required to open, and, depending on bus configuration, may cause outage of multiple additional lines and transformers. Furthermore, a circuit breaker failure may be explosive, damaging nearby equipment and causing a fire. Breaker failure protective relaying is often nonredundant or may not be installed, potentially resulting in even larger disruption and possible cascading blackout. Breaker failures have initiated large-scale power interruptions.

Modern circuit breaker technologies are available to replace underrated or unreliable breakers.12 Prioritization of breaker replacements is relatively straightforward, and, as budgets permit, power companies replace underrated breakers. Prioritization is based on breaker type and reliability, interrupting rating relative to short circuit currents, bus configuration, and the potential system impact of a failure. Difficulties with cost recovery must be overcome in order for such modernization to occur.

For major new transmission line construction, it may be preferable to construct new substations rather than enlarging existing substations to a size that jeopardizes reliability if those substations completely shut down. Likewise, bypassing substations in a hopscotch fashion along a multi-line transmission path reduces the effect of a complete substation shutdown, and reduces choke points.

Power System Protective Relaying

The electric power system consists of expensive generators, apparatus, and lines that can quickly be damaged or destroyed as a result of short circuits (faults), thermal overload, or other abnormal conditions. Protection systems are designed to automatically detect and isolate lines and apparatus following electrical faults or disturbances in order to protect equipment from damage due to voltage, current, or frequency excursions outside the design limits. Primary protection devices include relays, reclosers, fuses, circuit breakers, and switches. In response to short circuits, protective relays detect abnormal electrical signals and open circuit breakers to isolate faulty equipment.13

Protection systems are critical to ensuring safe and reliable operation of interconnected transmission networks and should have the characteristics shown in Figure 6.1. A protection system must be dependable and secure in all its operations. Dependability means that protection devices properly respond when changes in electrical conditions indicate an abnormal or dangerous condition. Security means that protection systems will not mis-operate under normal conditions or for conditions outside the operational design of the protection system. Usually an increase in system dependability means a decrease in security or vice versa. For example, protection system dependability can be enhanced by incorporating device redundancy. Increased redundancy through the use of multiple relays to monitor a transmission line for abnormal conditions improves the probability that an event will be detected and thus improves reliability. However, multiple relays acting in parallel can also decrease security through greater complexity and greater exposure to component failure and mis-operation. Consequently, reliability requires a fine balance between dependable operation and security against inappropriate operations.

Many design issues and approaches can affect the characteristics of protection and control systems, including the following:


10Most switchyards and substations have open-air bus work. At much higher cost, bus work may be placed in pipes insulated with SF6, rather than open air. Switchgear is incorporated in the gas-insulated equipment. The substation is then much more compact and can be installed indoors or underground. Gas-insulated substations are commonly used in urban areas, particularly in Europe and Japan, where land prices are high. Obviously, stations that are indoor or underground can be more secure against attacks.

11As an example, a bus fault at an old 400-kV substation led to a massive cascading power system blackout in Brazil on March 11, 1999. Lack of local bus protection and an unnecessary zone 3 relay operation at another station contributed to the failure. Following the blackout, potential system improvements were prioritized considering risk to the system, cost, and other factors. Many of the changes involved relatively low cost substation configuration improvements, and protection modernization.

12A recent Fitch report states that 60 percent of circuit breakers in the bulk power system are now more than 30 years old (Anderson et al., 2006). Many may be underrated or marginally rated for present day short-circuit currents. Modern circuit breakers are technically superior and much more reliable, and are available at about the same cost as old circuit breakers, despite general inflation.

13In the August 14, 2003, blackout event, lines sagging into trees caused a short-circuit current that was detected by relays and cleared by proper operation of breakers. The transmission line remained undamaged and capable of being placed into service. In other words, the protection devices correctly operated in response to faults caused by external factors (i.e., contact with trees). However, in that case, successive loss of multiple lines due to short-circuit or overload conditions resulted in instability and successive protection system operations that ultimately gave rise to a cascading failure and a blackout.

The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement