RELIABILITY OF MICROPROCESSOR-BASED PROTECTIVE DEVICES – REVISITED

1. Тиховод, С. М. Программа для компьютерного моделирования электрических процессов в тиристорных цепях / С. М. Тиховод, Т. М. Корнус // Електротехніка та електроенергетика. – 2002. – No 1. 2. Ортега, Дж. Введение в численные методы решения дифференциальных уравнений / Дж. Ортега, У. Пулл. – М. : Наука, 1986. – 288 с. 3. Тиховод, С. М. Разработка компьютерной программы моделирования магнитоэлектрических цепей, содержащих тиристоры / С. М. Тиховод, И. О. Афанасьева, Т. М. Корнус // Технічна електродинаміка. – 2009. – No 3. – С. 9–13.


INTRODUCTION
In previous publications the author has already analyzed the transition from electromechanical to a microprocessor-based protective relays, and considered the prospects and problems of microprocessor relays applications [1][2][3][4].The rather sharp reaction of the readers, often arising after these publication, on the one hand, and the author's detailed answers to the criticism of opponents on the other show that among the specialists in this area there is no common opinion about the prospects of microprocessor protection, there is no unequivocal understanding that, as any other complex device, the microprocessor protection not only possesses obvious advantages but also has serious weaknesses.
One of the widely widespread fables [5] justifying the inevitability of transition to microprocessor relay protection is the myth that electromechanical protective relays do not provide the performance of the technical requirements for relay protection and the continuing existence of electric power industry of today is not possible without microprocessor protection devices (MPD).
Actually, no new functions in relaying MPD have been introduced.The parameters and facilities of the highquality electromechanical and semi-conductor, that is the static analog devices constructed on the basis of discrete solid-state elements and integrated microcircuits, completely provide all relay protection requirements.In relaying there are no actual problems that could not be solved by means of electromechanical or static relays (note: recording emergency modes is not relay protection function).Confirmation of this is the fact that branched and complex electrical networks and systems exist and successfully function all over the world, and have for more than hundred years; whereas microprocessor-based relay protection has appeared in use in not very appreciable numbers just 10-15 years ago.Thus, with the beginning of the use of MPD the functioning logic of an electric power system has not changed, the number of operations that are carried out by an electric power system has not increased, the quantity of the produced electric power has not changed, principles of transmission and distribution of the electric power have not changed.

WHY HAS A MICROPROCESSOR-BASED PROTECTIVE DEVICE BECOME SO POPULAR?
In spite of absence of any principal problems in electromechanical relays in providing reliable protection of power devices, the progress in the development of electromechanical relays completely stopped 30-35 years ago since the efforts of developers have been directed first to the creation of electronic, and then to microprocessorbased protection.The matter is that the production expense of a completely robotized (down to automatic testing) MPD manufacturing process using cheap highintegrated electronic components is far less than the expenses of manufacture and manual assembly precision mechanical elements of electromechanical relays; therefore it is to the manufacturer interest to push MPDs.For example, the ordinary electronic component mounting machine, CM402-M/L, can install 60,000 components an hour.Yes, 60 thousand components an hour!It is abundantly clear that with such high-efficiency fully automatic manufacture of printed-circuit-boards, of which one is the MPD, brings to manufacturers fabulous profits in comparison to manufacture of mechanical relays.In the manufacturing sphere we see that the most important Fig. 1.Protective relays design life expectancy [10].
advantage MPD has are enormous profits for the manufacturers.Apologists for the widespread use of MPD often bring up such reasons in favour of the MPD as the ability to record emergency modes which is absent in electromechanical relays, the ability interchanging information between the relay units, etc.But all these are advertising gimmicks which have no connection with the reality.Today in the market there are hundreds of versions of microprocessor recorders of the emergency modes capable of transmitting data over Ethernet networks, which records emergency modes much better and more fully than MPD.There are information transfer systems, such as SCADA, that have worked well for many years with electromechanical relays.Unlike the relay of protection, microprocessorbased recorders are not capable of affecting the reliability of power supply and initiating collapses in a network at failures.In many electric power systems electromechanical relays until now reliably protect many crucial power installations of all voltage classes and other utilities equipment.Sometimes electromechanical protective relays include working in parallel with microprocessor-based relays for maintaining greater reliability of the important electric installations and especially crucial equipment.
Thus often it appears (especially in cases of complex damages with transition of one kind of short circuit to another) that electromechanical protection works noticeably more quickly than microprocessor-based.
In many electric power systems normalized employing electromechanical relays for a long time already are coming to the end of their lifespan, many of them are in rather pitiable condition and the operational personnel see in the transition to MPD as the only alternative for maintaining the working capability of relaying because of the dictatorship of the manufacturers (see above).Today in the world market there simply are no electromechanical protection relays being developed using modern materials and technologies, and all leading world protection relay manufacturers have gone over to exclusively manufacturing MPDs.At the same time, progress in the field of new materials, components and technologies allow constructing the protective relays on completely new principles in which it is possible to construct, for example, hybrid relays [6].Unfortunately, today's MPD manufacturers, faced by the increasing functional complication of their products with no significant means to decrease MPD manufacturing costs, are not interested in investing in any alternative kinds of the relays to compete with the profitability of the MPD.And, profitability of the MPD stems not only from the wide difference between the production price and sale price, but also from use of the new production technology (surface mounting of super miniaturized elements and high integrated microcircuits on the multilayered printed-circuit-board) that presupposes no repairing of MPD modules.It is now common to throw out failed MPD modules made using this technology and replacing it by a new one.Such approach is advertised by MPD manufacturers as high maintainability of their products.But considering that the whole MPD costs 10-15 thousand US dollars consisting 4-5 such modules (separate printed-circuit-boards), it becomes clear what the meaning such "maintainability" is to the consumer (that is to electric power systems).The ageing and service life of protection devices are directly connected with MPD reliability and their costs.For MPD (as well as for electromechanical relays) in many countries the normal life expectation is 20-25 years [8].Actually, many electromechanical relays are in service about 30 and even 40 years while the computer based devices age much more quickly.
Keep in mind the physical ageing of electronic components, such as electrolytic capacitors (the service life of which does not exceed 7-10 years) and others, and especially the software.So, according to [10] the life expectancy of designed obsolescence (Fig. 1) has sharply decreased from 30 years, for the traditional electromechanical relays to, approximately, 5 years for modern MPD.This means, that MPD users have to spend much greater sums in the future for updating of relaying (both hardware and software) and much more often than they had to earlier when using electromechanical protection.
Despite the problems noted above, the tendencies in relay protection development are such that widespread and increasing use of MPD is made inevitable.The MPD expansion is connected not only with necessity of replacing the old electromechanical relays with finished normative terms, but also with installing in-service new power elements, the last 10-15 years all over the world has seen the gradual transition to relaying of the new generation based on microprocessors.To "push" MPD on the market the manufacturers of these devices, and their numerous sales representatives, have engaged in a strong advertising campaigns in eulogizing MPD every possible way while belittling the advantages of the relay of other types.The basic thesis of these advertising campaigns is the statement that MPD provide very high reliability relaying unlike the old and worn out electromechanical relays which are approaching their age limit.At the same time, it is abundantly clear that MPD is a complex technical system consisting of many thousand of components.Like any other complex electronic systems, they should  3 Yearly intensity of failures is ratio of average numbers of relative yearly failures of different kinds of relays to same parameter of electromechanical relays (defined as 1).have failures and cannot possess absolute reliability, especially if one is to consider the "hothouse" operating conditions in power electrical networks.This being so, one would expect there should be many publications in the technical literature considering the technical problems of microprocessor relays.How many such articles considering MPD problems have you read?It is a significant fact that the overwhelming majority of publications in the technical journals devoted MPD is written by engineers of the MPD manufacturing companies.Naturally enough these publications represent the direct or veiled advertising, and not serious analysis of problems with reliability or other quite real MPD problems which exist in MPD.Since the MPD manufacturers are the advertisers generously paying for significant areas of journal pages, the journals are extremely reluctant to accept articles devoted to the criticism of MPD, and sometimes are not hesitate in declaring this.One gets the feeling that there is a certain taboo imposed on discussion on this theme.If an author happens to break by chance through this "Iron Curtain" [1][2][3][4], there is a squall of criticism including personal attacks and even charges of attempts to bring to a stop the technical progress.

THE ACTUAL PROBLEM WITH RELIABILITY OF MICROPROCESSOR-BASED PROTECTIVE DEVICE
In [4] we already considered, in detail, problems with the reliability of each of the basic functional units of MPD and have shown, through concrete examples, that the so-called "self-diagnosis" by which 80 % of MPD units are captured ostensibly, is, by and large, an advertising gimmick and a widespread myth.While it is true that self-diagnosis in MPD can reveal some internal damages, for example, such as failure of the internal power supply or the central processor unit (CPU), how it is possible to speak seriously about this as about a great "advantage" of MPD against of electromechanical relays if in the electromechanical relays there are no internal power supplies and CPUs, that is, there is simply nothing to "self-diagnose"?!As brought out in [4] the analog input modules (current and voltage transformers), digital inputs, output relays are not captured by a self-diagnosis in MPD.In addition, as shown in [4], the system of a self-diagnosis is constructed on microprocessors and memory elements, so it is an additional source for malfunctions of MPD.Actually the self-diagnostics is not an advantage of MPD against It is absolutely clear that without self-diagnostics it would be impossible to admit such combined protection device on a gun shot to protection of electrical power installations.So, the self-diagnostics in MPD is a forced measure, and not so beautiful application; therefore to advertise it as a great achievement in relaying is absolutely not justified.
Strangely enough, but opponents of the author's position have not denied the our position on the problems of the MPD units, rather they have concentrated only on criticism of some general opinions and reasons about MPD reliability, borrowed by the author (with corresponding numerous references) from others who have investigated the problem.We decided to carry out our own research by putting to use statistical data on protective relay malfunctions for 2007-2008 of one of the electrical power companies (from ethical reasons we do not publish the name of this company).
Initial statistical data on relay protection failures and calculations are given in Tables 1 and 2.
It is possible to come to two important conclusions (which can seem paradoxical to some) resulting from our calculations: 1. Yearly intensity of failures for microprocessor-based protective relays is much more than electromechanical.2. Yearly intensity of failures of protective relays significant increased over the past few years in connection with usage of new kinds of protective relays.That is, for the past few years the tendency of decrease in MPD reliability, Fig. 3, has taken place.Actually, there is nothing unusual in these conclusions.According to other statistic data, presented in [11], it is quite visible that electronic (static) relays have three times greater damageability than electromechanical, and microprocessor-based relays have 50 times greater damageability, Table 3.
However, as has been noted, insofar as one microprocessor protection incorporates the functions of several relays, this should be taken into account when making a comparative estimation of reliability.For example, if one MPD carries out protective functions of 10 single electromechanical relays, the difference between them in damageability will be only 5 times, not 50.At first sight, such an approach is quite logical; however, it does not consider the fact that MPD contains such common units as power supplies, CPUs, input analogue electronic circuits, etc, faults of which lead to failure at once of all these 10 virtual relays.That is to say, that weight factor of a single fault in a multifunction MPD is more (in our instance: 10 times) than in the single-functional electromechanical relay.For this reason it is possible for us, in order not to complicate the business, to continue to compare the failure rate of microprocessor-based and electromechanical relays without taking into account the difference in number of functions carried out by them.
Important factors, such as mistakes of the personnel (that is, so-called "the human factor"), were not considered in programming the MPD and in working with it.Modern multifunction MPD contain hundreds parameters and set points, tens of inputs and outputs, and can generate thousands of various messages.According to [10] "traditional methods of assessing relays by hardware inspection and testing are no longer adequate, since up to 80 % of the engineering design content of contemporary digital relays in the software area".It has therefore become increasingly important for the new generation of relay engineers to have basic knowledge in computers, software, and programming.Absence of such knowledge leads to repeatedly increasing the number of the mistakes related to the "human factor".According to [7] in 2000 the share of guilt of the operational personnel in wrong actions of relay protection in Russia is 61.6 %.Also the explanation of the reasons for this is bright: "Insufficient qualification of the personnel of the power enterprises for service of the equipment on new element base".
An additional aggravation of the condition is the presence in single power system of many types MPDs of different manufacturers with very essential differences from each other of the program interface, programming principles, and testing.All this leads to further complication of the process of transition from electromechanical to microprocessor-based protection.In [12] this is directly underscored: "the situation becomes complicated also that the purpose of such transition -substantial increase of efficiency of relay functioning -as a rule, is not attained" and further: "The percent of wrong acts of modern relay panels and cabinets often appears much more than for the old electromechanical relays".This is confirmed in [13]: "the statistics shows, that use of digital protective relays (DPR), despite of its essentially best technical characteristics in comparison with previous generations of protective devices, has not increased, and in many cases even has decreases number of correct acts of relaying of power equipment".
In attempting to carry out a similar analysis on failures of relaying in Russia, we have run into an unforeseen problem: it appears that in Russia a base parameter of a reliability assessment in relaying is the percent of correct (or not correct, ie, faulty) operations [12], instead of the number of relay damages, as in the case considered above.So, for example, in [14] it is noted that in the most advanced Russian power company "Mosenergo" (Moscow) at the end of 2001 there were already 2332 MPD units of 4 different firms in service and during 4 years only 8 cases faulty operation of MPD have been registered.On this basis authors conclude that "it specifies their high reliability and high service characteristics".In [7] it is also marked that the percent of their correct operations is accepted as the basic reliability index for MPD.
But why is the reliability of the devices and systems is estimated by the frequency of their faulty operations instead of by the number of damages of their basic internal elements thereby making impossible proper functioning of the device or system?If the signal about damage of its internal power supply (meaning the incapability of the MPD to perform its functions) from MPD installed in protection system has been received, but there were no emergency mode in a power network controllable by this MPD (that is, there were no faulty actions of the relaying), this event should not be fixed as failure of MPD and not to be considered in the analysis of MPD reliability.Only if the internal damage of the MPD coincides with the time of the emergency mode in a protected network will this damage be considered in a reliability assessment; and if does not coincide, it will not be.
A well known definition for Reliability and Failure [15] is: Reliability: the ability of an item to perform a required function under stated conditions for a stated period of time.Failure: refers to the state or condition of not meeting a desirable or intended objective, and may be viewed as the opposite of success.Failure Rate: the number of failures experienced or expected for a device divided by the total equipment operating time.
However, an accident in a power system is the RE-SULT of relay protection failure, yet the Reliability and Failure definition does not even take into account the RE-SULT stemming from low reliability or high failure rate.It is just not clear why the failure of a single protective unit is taken into consideration only in the case that it is the RESULT of the accident in the power system without any consideration of the accident itself.
It is difficult to see the logic in such approach.Such an approach simply does not lead to the proper analysis of the protective relays failures, similar to the analysis that we have used above.
In our opinion, in the estimation of the relay of protection it is necessary to consider three types of events: 1.The damages (D) of the relay which have been not connected with faulty actions of the relaying, but require repair or replacement of the failed elements, unit and modules.2. Faulty actions (FA) of a relay that is improper operations in the absence of emergency mode or inability to operate (or faulty operation also) in the emergency mode.
3. Personnel mistakes (PM) connected with operation, testing or programming of the relay.Keeping in mind the personal actions that have an influence on the relay functioning properly, but detected before relay improper action occurs.All these components should be taking into account, in our opinion, when calculating the generalized normalized criterion of failures F Σ of relaying where F Di , F F Ai , F P Mi -number of failures of each type for the relay i kind for the considered period of time; N i -number of the relay i kind, being in operation during the considered period of time.
The suggested parameter could serve as the tool for an estimation of the quality of the relay protection when analyzing a situation and decision-making.

SUMMARY
In summary, it is desirable to cite the well known expert in the field of MPD, former leading expert of All-Russian Relay Research, Design & Technology Institute (VNIIR), who worked for a long time at Siemens, Doctor of Science (DSc), prof.M. Shneerson who in the monograph [16] on p. 491 writes: "In itself increasing technological level of protective relays not necessarily leads to increase of efficiency in reaction on incipient faults.So, for example, become out-of-date electromechanical and partly electronic static protective relays at a correct choice of protective functions and setting will certainly provide more effective protection of a network, than microprocessor based without enough proved choice of the specified parameters" And further, on p. 508: "As shows a practice, the percent of the wrong actions at usage of digital protective relays, at an initial stage essentially does not decrease, and in some cases even increases".And in summary, on p. 522: "Despite of essentially higher technical perfection of the digital protective relays their real operational efficiency, especially at initial stages, appears below, than at protection devices of the previous generation".

Table 1 .
Failure rate of a protective relays of various kinds Relative failures is relation of failure numbers for some relay kinds to total number of relays of same kind 2 Average relative yearly failures is average number of relative failures for two years(2007 and 2008)

Table 2 .
Increasing of relay protection failures at usage of new kinds of relays

Table 3 .
[11]cture of the microprocessor-based system M-3430 type (Beckwith Electric Co.) for complete protection of power generator.Typical failure rates of protective relays (according to[11])