CC BY
27
Дискусії
УДК 316
V. Gurevich
PROBLEMS IN TESTING DIGITAL PROTECTIVE RELAY FOR IMMUNITY TO INTENTIONAL DESTRUCTIVE ELECTROMAGNETIC IMPACTS. CONTINUATION OF THE THEME
The article is the continuation of the theme highlighted in the previous article with same title. The new article evaluates the results of digital protective relays (DPR) testing for immunity to the E1 component of High-altitude Electromagnetic Pulse (HEMP) and to Intentional Electromagnetic Interferences (IEMI) impacts, conducted by some independent American organizations; discusses the features of relay protection devices as well as clarifies and supplements the procedure for testing these devices. Due to methodology errors during the DPR tests conducted by mentioned organizations earlier, they cannot be considered as satisfactory and their results as meaningful. At the moment there are no reliable data on the level of DPR immunity to IDEI, which suggests that the test should be conducted further. References 7, figures 6.
Key words: high power electromagnetic threats, high-altitude electromagnetic pulse, intentional destructive electromagnetic impacts, digital protective relays.
Статья является продолжением темы, рассмотренной в предыдущей статье с таким же названием. В новой статье оцениваются результаты испытаний микропроцессорных устройств релейной защиты (МУРЗ) на устойчивость к компоненту E1 электромагнитного импульса высотного ядерного взрыва (ЭМИ ЯВ) и к преднамеренным дистанционным электромагнитным воздействиям (ПДДВ), приводимые некоторыми независимыми американскими организациями; обсуждаются особенности методики их испытаний. Показано, что из-за ошибок в методологии испытаний, результаты, полученные упомянутыми выше организациями нельзя считать достоверными. В настоящее время нет никаких надежных данных об уровне устойчивости МУРЗ к ПДДВ, что указывает на необходимость проведения дополнительных испытаний. Библ. 7, рис. 6.
Ключевые слова: электромагнитный импульс высотного ядерного взрыва, преднамеренные деструктивные электромагнитные воздействия, микропроцессорные устройства релейной защиты.
Introduction. In my previous article on this theme [1] I presented a substantial analysis of the regulatory documents related to the problem of Intentional Destructive Electromagnetic Impacts (IDEI) on Digital Protective Relays (DPR). I justified the choice of test methods, articulated the requirements to parameters of test impacts and included a review of technical aids that facilitate these tests. However, my communication with technical staff responsible for these tests, which is provided in [1], was not enough for the correct planning and conduction of experiments. Analysis of findings of earlier tests revealed that the methods used for trials, criteria of operation quality and parameters of testing impact are rarely selected correctly resulting in the fact that the findings of the tests do not allow making an unambiguous judgment about DPR's resistance to IDEI. This requires conducting further investigations of the issue and developing additional recommendations.
Use of performance criterion during the electromagnetic compatibility (EMC) test of electronic equipment. The response of an object under test (OUT) to electromagnetic impacts (EI) can be variable. For example, the OUT can be fully inoperative due to a breakdown of internal electronic components, while on the other hand it can be temporarily non-operative only during the impact of either the impulse or electromagnetic field. Another possibility is a short-term fault in the software operation as affected by the impulse voltage supplied to the OUT, which may require (or not) from the operator to reset the internal program of the OUT. There are many types of responses of the OUT to EI. The acceptable response of this type of OUT to electromagnetic impact under some type of trial is called «performance criterion» (PC). The performance criterion is an extremely important indicator in the tests for EMC. When properly
selected it allows reaching a conclusion whether a specific device has passed the specific test or not. However, the EMC standards do not contain (and they are unlikely to contain) the methods of the correct selection of these criteria. As a rule everything is limited by a sentence like: «Selection of the strictness degree for performance criterion is performed by people who develop and approve performance specifications and technical conditions» and a chart from which a specific PC can be selected out of 3-4 criterions offered by the specific standard. This is obvious, since the correct choice depends on the specific type of OUT and specific modes and conditions of its operation. Moreover, a different PC can be selected for the same type of OUT depending on its operation mode, connection diagram, purpose for use, working environment, etc. Thus, the understanding of specific features of each single OUT is very important, since the choice of one or another performance criterion allows making a decision of whether this specific OUT fits (or doesn't fit) specific working environment based on the trial results.
Features of performance criterion during the IDEI immunity test of DPR. The North American Electric Reliability Council (NERC) has established a list of equipment, which needs to be tested for immunity to High Altitude Electromagnetic Pulse (HEMP) upon the request of special commission: Congressional «Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack». The list includes, in particular, digital protective relays (DPR) and SCADA (Supervisory Control and Data Acquisition - a general name for software and hardware measures of different types, which ensure real-time data collection from numerous detectors, processing, archiving, displaying and transferring information about objects under monitoring as well as the
© V. Gurevich
66
ISSN 2074-272X. Електротехніка і Електромеханіка. 2015. №6
transfer of operator commands to remote sites - foundation of Substation Control System - SCS) system. Metatech Company conducted tests of SEL-311L DPR (Differential Line Protection) and SEL-2032 controller of SCADA system (fig. 1) under a shortening test program. The test was performed only for immunity to the E1 component of HEMP. The results of these tests are presented in the Meta-R-320 [2] report. As indicated in the report evaluation of the correctness of operation and lack of damages after each test was selected as PC in the DPR and SCADA controller tests. During the tests short-time (5/50 nsec) high-voltage impulses with an amplitude of up to 8 kV were applied to different terminals of devices.
Fig. 1. SEL-311L DPR and SEL-2032 controller for SCADA system produced by Schweitzer Engineering Laboratories (USA) subject to testing for HEMP immunity
The report also mentioned that application of impulses with an amplitude of up to 3.2 kV to the serial port resulted in spontaneous DPR switch-off, but then it returned to normal operation mode. Some other ports (e.g., IRIG - Inter-Range Instrumentation Group time code -time synchronization port) were damaged at as low as 600V. The Ethernet communication module of the SCADA controller was damaged at 1.2 kV. The report also suggests that the record of oscillographic tests of current and voltage rates supplied to the relay's terminals were selected as one of the additional parameters of PC. It is mentioned in the report that abnormalities in the record were not revealed during testing.
Criticism of the DPR testing method used in [2]
1. I think it is incorrect to use the PC based on the DPR damages check after it is subjected to interference. This does not allow making a definite conclusion about the immunity of DPR to this interference. This is due to the fact that DPR possesses several specific features reviewed in [3, 4] as compared to the SCADA system. With all the importance and responsibility of the SCADA system it is designed in first and foremost for automatic collection, processing and displaying information. Despite the fact that the system includes the so-called Remote Terminal Units (RTU) - remotely controlled actuating units, they cannot work under the automatic mode and are only intended for performance of operator commands from a remote control center. The majority of modern substations work in the automatic mode without any operator. Manual control of breaker status on these substations (i.e., literally control of power system configuration) is performed by an operator sitting in a remote control center through the SCADA system, which is susceptible to IDEI impacts. This is why, in case of IDEI impact, the remote control of
a substation from the control center will likely be lost and the configuration of the power system will only be determined by the relay protection system - the only system that can automatically control the breaker status. At the same time, the DPRs, which comprise the foundation of the modern relay protection, are constantly sharing information and commands in the automatic mode via communication channels susceptible to IDEI (unlike the SCADA system, where critical control commands are delivered to breakers spearheaded by a dispatcher). In the event of incorrect actions of automatic operating relay protection, where the dispatcher cannot intrude, such as unnecessary operation subject to IDEI impact, the electric power system and then the whole energy system can fully collapse. This is one of the reasons why the digital protection relay should be tested for IDEI impacts during operation and not be checked for damages after the impact of interference.
2. There are different paths of the entering of electromagnetic interference (represented by impulses supplied to protected terminals) and high-voltage electromagnetic waves (which enter directly into internal high-sensitive electronic components or through unprotected termi-nals/ports of electronic units as well as though multiple cables connected to DPR and functioning as antennas absorbing electromagnetic energy) to DPR. Moreover, the IDEI is not limited to HEMP only. It includes directed ultra-broadband high-frequency emissions of special sources with power ratings of several Gigawatts and is intended for remote destruction of electronic equipment [4]. Unfortunately, the danger is caused not only by special purpose devices intended for affecting electronic equipment, but also by emissions of ordinary powerful radars. For instance, in 1999 there was an officially registered event of devastating failure of the SCADA system at the San Diego County Water Authority Company, which supplies water to San Diego, CA. The reason for the failure was an emission of marine radar located 25 miles away from the city. In 1980 a similar case was registered on a gas supply line located 1.5 km away from Den Helder port in the Netherlands. The latter case of SCADA system damage by a marine radar resulted in a powerful gas explosion. This is why testing of DPR immunity to IDEI should not be limited by applying high-voltage impulses to certain terminals only. It should by accompanied by exposure of the OUT to electromagnetic emission from a directional antenna as stipulated by corresponding standards [1].
3. It should be taken into consideration that a case of HEMP it will affect not only high-sensitive electronic equipment (DPR, hardware of SCADA system), but also power facilities of energy systems, such as linear insulators, transformers and power generators. It should be noted that this equipment will be affected by not only the E1 component of HEMP (modeled during trials [2]) under these circumstances, but also by the other two components, i.e., Е2 and Е3 [1]. Previous research [2] conducted in the Soviet Union and the USA shows that the affect of all components of HEMP can result in the damage of power high-voltage equipment, such as break down of linear insulators, saturation and burning of power transformers, punctures of power generator insulation, etc. In
ISSN 2074-272X. Електротехніка і Електромеханіка. 2015. №6
67
other words, the moment of impact of a powerful electromagnetic interference on DPR matches in time with the moment of changing of internal state of DPR elements, which is due to emerging of emergency rates of controlled current and voltage at its terminals. How will DPR behave under this mode? Will the IDEI affected relay protection be able to disconnect the saturating transformer or damaged part of aerial line of punctured cable? Won't the common directional operation of different DPR be a cause of full disintegration and collapse of the energy system?
The research conducted in [2] does not provide answers to these questions. «We have produced designs so complicated that we cannot possibly anticipate all the possible interactions of the inevitable failures; we add safety devices that are deceived or avoided or defeated by hidden paths in the systems» - wrote the famous specialist on reliability and susceptibility of complex systems Charles Perrow [5]. Perrow calls this problem «incompre-hensibility» since even the ordinary incident can trigger interactions, which are «not only unexpected, but also unpredictable for a certain critical period of time». In most accidents nobody could expect that certain «interac-tion algorithms» will trigger others. Thus, nobody could predict what happened. This has a relation to modern rather complicated and branched relay protection system the behavior of which is difficult to predict under the IDEI impact.
Analysis of the result of the second independent trial of the same type of DPR. Another test of the same type of DPR (by an odd coincidence) is reported in a promotional presentation of the producer of these devices - Schweitzer Engineering Laboratories Company - SEL [6]. The presentation covers the results of testing of SEL-311 DPR samples on the test-benches of US Army’s Pi-catinny Arsenal in New Jersey for HEMP and electromagnetic impact (fig. 2).
Fig. 2. SEL-311 DPR test for IDEI impact on Picatinny Arsenal test-benches in New Jersey [6]
The promotional presentation suggests that all tests were successful. At the same time the deeper analysis of
the material reveals several odd things. For instance, the advertisement depicted in fig. 3 suggests that SEL-311 was tested at field strength varied from 25 to 1000 V/m whereas the military standard MIL-STD-461 requires only 50 V/m.
The specialists of the renowned SEL Company demonstrate a rather odd ignorance in their report. The fact is that according to the MIL-STD-461 the units of measure of the field strength under IDEI impact are kilovolts, while they report volts and the figure «50» is presented as 50 kV/m instead of 50 V/m.
SEL-311C Tested at US Army’s Picatinny Arsenal in New Jersey
RF from 100 MHz to 4 GHz at power levels from 25 to 1000 volts per meter (Mil-Std 461 ask for 50V/m only)
Fig. 3. The text from the promotional brochure of SEL Company [6]
The bar diagram illustrated in fig. 4 is even odder. It shows that in reality the field strength of 1000 V/m was implemented for testing at 1000-1500 MHz frequencies, while at another of frequencies it was almost two times lower. Another thing is that the dependence of amplitude on the frequency does not correspond to MIL-STD-461.
Fig. 4. Parameters of electromagnetic emission during SEL-311 DPR testing [6]
It is obvious from the diagram that the levels of field strength are limited by the beginning of the instability of relay functioning (yellow areas on the tops of the bars). In other words the diagram shows the area of steady operation of a separately installed (outside the relay protection system) SEL terminal. This implies that the relay doesn't allow for steady operation outside the area of values represented in this diagram with its extremely low levels of electromagnetic field strength.
When comparing it with the above mentioned MIL-STD-416 (fig. 5), you can see that the applied parameters of testing impacts are far away from the requirements of this standard. Considering the oddness of parameters selection to test SEL-311 immunity to IDEI who can take seriously about the manufacturer's statement that these relays are resistant to IDEI?
Another problem is the selection of a single DPR terminal as an OUT. As a rule, these terminals are manufactured in metal housings, which effectively weaken the electromagnetic emission. This is why the test results for electromagnetic impact on this single terminal are expected to be positive. In the field conditions DPR is
68
ISSN 2074-272X. Електротехніка і Електромеханіка. 2015. №6
entangled by multiple cables acting as antennas and absorbing electromagnetic energy delivering it to the internal elements of DPR; multiple terminals of DPR are interconnected through corresponding communication instruments susceptible to IDEI impact. Thus, the test should be performed on the whole relay protection system while in operation rather than its single terminal.
An example of the correct approach to testing of complex systems to which relay protection undoubtedly belongs is represented by SCADA system testing described in [7] (fig. 6).
Time і Nanoseconds)
Fig. 5. A diagram from page 138 of MIL-STD-416F to compare with the diagram illustrated in fig. 1 (1 ns corresponds to a frequency of 1 GHz)
Fig. 6. Testing of SCADA system for immunity to HEMP [7].
An antenna system of EMI simulator is seen above. The elements of SCADA system are located in separate boxes and connected with each other via a standard communication system
Thus, the results of two independent tests of the DPR conducted by different manufacturers do not allow coming to any conclusion on its real immunity to IDEI. So, who would need these results?
Conclusions and recommendations:
1. Due to methodology errors during the DPR tests conducted by independent organizations earlier, they cannot be considered as satisfactory and their results as meaningful. At the moment there are no reliable data on the level of DPR immunity to IDEI, which suggests that the test should be conducted further.
2. The kinds and modes of DPR tests should be fully performed and correspond to the standards as described in [1].
3. The PC should be represented by a criterion, which allows for controlling DPR operation under normal and emergency modes of the object under protection when it is affected by an electromagnetic interference instead of a criterion that is based exclusively on checking the DPR condition when the impact of interference is over.
4. Testing should be performed on both the separate unit of DPR and the full relay protection system consisting of several DPR units connected with each other by several meters of cables via a corresponding communication device. At the same time electromagnetic energy should affect the relay protection system, while impulse tests for applied voltage should be performed on both separate DPR units/communication devices and several DPR units connected together with communication devices simultaneously.
5. During the test several steps of test impulse amplitude and electric field strength should be selected: from minimum to maximum value within the ranges described in the standards. The obtained data can be used during the evaluation of immunity of the DPR installed in specific cabinets and buildings, which possess a certain index of electric field weakening. They can also be used in the process of elaboration of requirements to further weakening of this field, if it is revealed that the current conditions do not ensure the required immunity of DPR to IDEI.
REFERENCES
1. Gurevich V. Problems in testing digital protective relays for immunity to intentional destructive electromagnetic impacts. Global Journal of Advanced Research, 2014, vol.1, iss.2, pp. 159-173.
2. Savage E., Gilbert J., Radasky W. The early-time (E1) high-altitude electromagnetic pulse (HEMP) and its impact on the U.S. power grid. Report Meta-R-320 for Oak Ridge National Laboratory, 2010.
3. Gurevich V. Problems of standardization in relay protection. St. Petersburg: DEAN Publ., 2015. 168 p.
4. Gurevich V. Vulnerabilities of digital protective relays. Problems and solutions. Moscow, Infra-Engineering Publ., 2014. 256 p.
5. Perrow C. Normal accidents. Living with high risk technologies. First ed. Princeton, Princeton University Press, 1984.
6. EMP Effects on Protection and Control Systems. Schweitzer Engineering Laboratories, 2014. 31 p.
7. Report of the commission to assess the threat to the United States from electromagnetic pulse (EMP) attack. April 2008.
Received 03.07.2015
Vladimir I. Gurevich, Ph.D, Senior specialist,
Central Electric Laboratory of Israel Electric Corp.
31000, Israel, Haifa, POB 10, e-mail: [email protected]
ISSN 2074-272X. Електротехніка і Електромеханіка. 2015. №6
69
