International Conference on Developments in Power System Protection ( DPSP 2018 ) Practical risk assessment of the relaxation of LOM protection settings in NIE Networks ' distribution system

This study presents the methodology, experience and practical outcomes of the risk assessment-based revision of loss-of-mains (LOM) protection settings in the NIE Networks' distribution system. An investigative project has been undertaken by the authors to revise the current LOM practice as recommended by the G59/1/NI regulation and to propose the settings which would meet the all-Ireland transmission system stability criteria. It is also important to ensure that any increased personal risk is realistically quantified and satisfies the health and safety requirements. Both aspects (i.e. LOM protection stability and sensitivity) are covered in the study. The results and observations included in the study aim to provide the means and supporting evidence for achieving the best compromise in the revision of LOM protection settings.


Introduction
The loss-of-mains (LOM) protection has been the subject of much debate in recent years.When it was originally introduced, LOM was designed to reliably detect and promptly disconnect any distributed generation (DG) in the islanded part of the network to prevent human safety hazards or damage to generators due to the out-of-phase reclosure.The priority requirements were high detection sensitivity and fast operation.Occasional spurious tripping of LOM protection was not considered an issue due to the low penetration levels of DG.However, the continuing rapid growth of the distribution-connected generation and the decrease of transmission system inertia with consequently higher-frequency dynamics have shifted the perspective on LOM protection dramatically.The spurious operation is no longer acceptable and the adequate levels of LOM protection security need to be maintained to prevent the disconnection of large amounts of DG during system wide-events.Although there are other solutions to address this issue (e.g.direct intertripping), the majority are too costly and/or complex to implement retrospectively.Therefore, the first logical step in addressing this critical problem is to enhance the security of the existing LOM protection by relaxing (i.e.increasing) the settings.
The paper contains three main parts.In the first part, the need for change is presented with a focus on operational experience and theoretical analysis.The LOM protection security is addressed by analysing the rate of change of frequency (ROCOF) and voltage vector shift (VS) protection performance under the worst-case scenario frequency transients derived using dynamic simulations.Moreover, a number of faults records (captured during actual network incidents) are used to provide an additional realistic insight into the LOM protection performance in the vicinity of a fault.The stability performance results presented in the study have been obtained under a variety of setting alternatives to identify viable options for the LOM settings revision.
In the second part, a risk tree-based probability analysis is employed to estimate the potential increase in personal risk as well as the risk of generator damage under the LOM settings established during the stability analysis.This is to ensure that the elevated risk levels due to the relaxation of the settings remain with the health and safety executive's acceptable limits.
Lastly, future practical implications of the presented analysis in terms of recommended LOM settings as well as some other utility operational aspects are included in a separate section.

Need for change
The facilitation of renewables [1] study, published in 2010 by EirGrid and SONI showed that during times of high wind generation following the loss of the single largest credible contingency, the ROCOF values of >0.5 Hz/s could be experienced on the island of Ireland power system.In such a scenario, the LOM protection currently employed by the DG connected to the NIE Networks' distribution system will operate disconnecting a large quantum of generation from the system.In an already turbulent scenario, this would further exacerbate system instability.
Moreover, operational experience has caused NIE Networks to consider the stability of LOM protection, specifically VS.On 22 March 2013, Northern Ireland was exposed to a severe snow storm, which resulted in a significant number of faults on the distribution and transmission system.During three 15 min blocks, 24 wind farms disconnected from the electricity system due to the activation of their LOM protection, totalling ∼316 MW of lost generation from the system over a 15 h period and a total of 171 MW in a single 15 min period.
The post fault analysis concluded that the wind farms, which disconnected from the system, were only those with the VS element of their LOM protection activated, whilst the wind farms with ROCOF protection employed remained stable.
Consequently, NIE Networks decided to commission Strathclyde University to determine appropriate LOM settings to ensure system integrity during major system events.Suitable (stability ensuring) setting values had to be established for ROCOF and VS protection, as well as frequency and voltage protection.
To achieve this, a detailed analysis of the selected worst-case scenario system-wide frequency profiles has been undertaken.Those profiles had been obtained from dynamic simulations and correspond to various critical transmission system incidents in Ireland, as summarised in Table 1.These critical profiles were provided by SONI in digital form as three-phase voltage waveforms sampled at 10 kHz, suitable as an input to a dynamic relay model or hardware injection into a physical device.
Moreover, a few fault records (captured during actual network incidents) were available, which gave an additional real eventbased insight into the LOM protection performance in the vicinity of a fault.A summary of the utilised records is presented in Table 2.

Stability of ROCOF protection
In the first step, each simulated record (events 1 to 20) was repeatedly processed by the validated dynamic ROCOF relay model [2] at different time delay settings.At each time delay, the ROCOF setting of the relay was gradually increased from a small value to a point where the relay no longer operated.This way the minimum stability settings were established experimentally.To further verify these model-based results, a few selected records have also been injected into the physical relay (MiCOM P341) and the stability limit has been established in the same way.The results related to simulated records (events 1 to 15) are presented in Fig. 1, whereas the results based on the records of actual faults are shown in Fig. 2. It needs to be noted that for clarity purposes the figures only include the highest ROCOF values (across all events) presented as a single characteristic (separately for 'relay model' and 'hardware relay').Any ROCOF setting above these curves guarantees stability under all analysed events, while any setting below the curves may result in spurious tripping of ROCOF protection.Additionally, the figures include a depiction of the existing recommended setting of 0.4 Hz/s (with no additional delay), and four proposed alternative setting recommendations, all of which would ensure stability under the given critical event scenarios.These four alternative settings are suggested for the subsequent risk assessment.
It can be clearly seen that the existing setting (indicated as a red triangle in Fig. 2) cannot guarantee the stability of ROCOF protection under the anticipated system dynamics.Additionally, four alternative ROCOF settings have been proposed for risk assessment analysis (indicated by green diamonds in Fig. 2).

Stability of VS protection
Subsequently, the same 20 events were used to assess the stability of the VS protection using a similar methodology.The minimum angle setting values to ensure VS relay stability are presented in Fig. 3 for simulated records 1-15, and in Fig. 4 for fault recorderbased events 16-20.
It should be noted that the marginal settings for VS stability obtained from the simulated events 1-15 are generally very low, and therefore, do not seem to pose any stability issues.Under the MiCOM P341 relay minimum setting of 2° only record No. 12 resulted in relay tripping.However, the relay did not trip when the setting was changed to 3°.From those results, it would seem that VS relay has a very good immunity to critical system wide events, even to those with very high ROCOF values.
To further investigate the apparent good stability of VS protection, the available fault records (events 16-20) were used.Due to the past experience of spurious tripping of a number of VS relays during storm conditions in Ireland, it was important to verify whether such spurious tripping could have been initiated by transmission system faults.The minimum VS stability settings based on the five available records are presented in Fig. 4, both obtained from the relay model and from hardware injection.These results clearly demonstrate that the VS tripping at the current recommended setting of 6° is very much possible during transmission system faults.On some occasions, relay operation can be expected with settings up to 12°.However, it is understood that VS relay spurious tripping under transmission system faults does not have the same system-wide effect as frequency swings can have on ROCOF protection, and therefore, are less threatening to transmission system integrity.Nevertheless, it is considered important to explore the risk of a possible increase in VS setting to improve security.Thus, two setting options of 6° and 12° are considered in risk analysis.

LOM protection sensitivity and risk assessment
The risk assessment methodology applied in this work is based on a statistical analysis of potential undetected islanding incidents, and the use of a probability tree depicting the perceived hazards.Those hazards include personal safety (represented by a probability tree in Fig. 5a), and generator damage resulting from out-of-phase reclosure (Fig. 5b).Due to the space limitations of the conference publication this paper reports on one part of the risk assessment study only, related to generation up to 5 MW of installed capacity termed as a smallscale generation (SSG).A similar approach has been used to assess large-scale generation (LSG) (i.e. with installed capacities >5 MW).The key assumptions of this study can be summarised as follows: • Generation output is represented by an example measured generation profile characteristic of a particular generation technology.• Two fundamental islanding scenarios have been considered: S1 -DG islanding through loss of supply to a primary substation and S2 -DG islanding due to the loss of individual 11 kV (or 6.6 kV) feeder.• Based on the NIE Networks' DG protection setting records it was assumed that the usage of ROCOF protection (i.e. the percentage of generators having ROCOF relay installed) is 33, 10 and 12% for the synchronous machine (SM), inverter connected (IC), and induction machine (IM)-based generation, respectively.Regarding VS protection, the assumed percentages were as follows: 67% (SM), 90% (IC) and 88% (IM).• Detailed distribution of DG sizes in each scenario S1 and S2, numbers, predominant groupings, as well as percentage contributions of individual generating technologies within the groups (generation mixes) were obtained from the available NIE Networks DG connection registers.• It is assumed that the generator (or a group of generators) does not continue to supply the system after an out-of-phase autoreclosing operation.• A period of T ARmax = 30 s was assumed as the maximum expected time of operation of the auto-reclosing scheme (i.e.regardless of load/generation balance, undetected stable island will not continue to operate longer than T ARmax due to the impact of out-of-phase reclosure).• The LOM event is simulated as a simple opening of a circuit breaker at the point of common coupling and no initiating fault is simulated prior to islanding (worst-case scenario from the LOM detection perspective).
Various elements of the probability tree in Fig. 5 have been calculated as follows.
The average annual number of loss of grid incidents at an individual islanding point is estimated from the utility network incident records using the following formula: where n LOG is the total number of loss of supply incidents experienced during the period of T LOG in a population of n IP islanding points.The probability P 23 = P 2 ∧ P 3 that the output of an individual DG group is balanced with local load (both P&Q) within the LOM protection non-detection zone (NDZ) for a period longer than T NDZmax is calculated by accumulating the periods of time Δt 1 , …, Δt n when the difference between the daily network demand profile and the DG output remains within the margin of the NDZ (Fig. 6).Ten example recorded load profiles have been used as well as example recorded generation profiles representing wind, biomass, and solar energy generation.The final result is obtained by averaging the outcomes of all utilised load profiles.
The NDZ depends on the islanded generation technology (or a mix of technologies), generator control mode, and LOM protection type and settings.For each identified generation mix (11 mixes were considered based on the DG connection register as indicated in Table 3), for each considered LOM protection option has been established by simulating loss of grid events at various degrees of generation/load imbalance (both P&Q) and testing LOM protection response with predetermined setting (eight LOM setting options were considered as shown in Table 4).
For each generation mix, the expected total annual number of undetected loss of grid incidents is calculated using the following formula: (2) Finally, the fatal personal injury risk IR E and the risk of out-ofphase reclosure N OA are calculated using the following formulas: where P PER, E is the probability of a person being in close proximity to an undetected islanded part of the system and suffering a fatal injury at the same time, and P AR is the probability of an out-ofphase auto-reclosing action following the disconnection of a circuit or a substation.A value of P AR = 0.8 was assumed, while P PER, E was calculated assuming exponential risk distribution following an undetected islanding event of T LOMavr duration The values of the constants in formula (5) were established based on the existing incident statistics.
The resulting risk can be then compared with the general criteria for risk tolerability included in the Health and Safety at Work Act 1974 [3], which adopts the risk management principle often referred to as the 'as low as reasonably practicable (ALARP)' principle.The ALARP region applies for individual risk levels between 10 −6 and 10 −4 .Risks with probabilities below 10 −6 can generally be deemed as tolerable.
The final summary results for the existing and potential future LOM options are included in Table 4.It can be seen that the risk values fall within the ALARP region which calls for additional mitigating measures in an attempt to reduce the perceived risks.Those are discussed in Table 4.

Risk-based decision making
Since the individual risk of electrocution resides within the ALARP region, NIE Networks requested that risk mitigation measures be assessed; namely, the presence of neutral voltage displacement (NVD) protection and the reduction of the associated operating time from 10 s ] [NIE Networks standard NVD operating time for LV connected generation] down to 7 s for SSG.
It was identified that the presence of NVD protection would offer a risk of electrocution reduction of ∼76% for LSG and ∼32% for SSG.Moreover, it was identified that reducing the NVD operating from 10 to 7 s would present a further 3.05% risk reduction for SSG.
With the inclusion of NVD protection, the proposed settings for LSG reside on the ALARP boundary, i.e. 1.36 × 10 −6 .Giving the significant system benefit in amending LOM settings, NIE Networks determined it appropriate to proceed, from a risk perspective, with setting amendments to LSG.
The risk of electrocution associated with SSG is significantly higher than LSG, and therefore, at the time of writing this paper, no decision had been made regarding the amendment of SSG LOM settings.

Future proofing
By including both connected and committed to connecting generation within the generation database an element of future proofing was included in the risk analysis.However, it was identified that in some areas of the network where demand and generation balancing is not prevalent the future risk of islanding may increase.To safeguard against this, NIE Networks will reassess the risks in the next regulatory period to determine if a  material change has occurred and will propose mitigation measures at that time.In the interim, NIE Networks will investigate measures to reduce the risk of electrocution and out-of-phase reclosure, with a particular focus on SSG whose risks are significantly higher than LSG.

Cost benefit analysis
Before a decision could be made regarding the amendment of LOM settings a cost benefit analysis (CBA) must be performed showing a net benefit to the customer.NIE Networks anticipate that, upon request, all required generators will have the capability to change the settings in their existing G59 relays to those proposed within this document.This scenario was therefore referred to as the expected scenario.However, it is possible that some relays may not be able to be amended to the recommended settings and therefore require a new relay to be fitted; to reflect this scenario a worst-case scenario contingency has been included which assumes that 50% of LSG and SSG require a new LOM protection relay to be fitted.Based on engagement with industry NIE Networks has estimated the expected scenario costs and worst-case scenario costs to be ∼ €0.56 m and €1.32 m, respectively.
The main benefit of amending LOM settings will be reduced single electricity market (SEM) wholesale costs.It has been identified that if the new ROCOF standard can be implemented on the island of Ireland, SEM wholesale costs may be reduced by €13 m per annum.It can also be seen that an expected 4.4% reduction in wind curtailment levels may be realised in 2020 whilst an additional 1.5% towards the renewable energy sourced electricity (RES-E) target of 40% by 2020 may be achieved [4].
Other, non-quantifiable benefits will be realised through the implementation of the new LOM settings.NIE Networks is aware that under remote fault scenarios the LOM protection of some generators may operate, resulting in the disconnection of the generator from the electricity network.This phenomenon has been referred to as nuisance tripping by industry and results in a loss of revenue to the generator owner.A benefit of implementing the proposed LOM protection amendments will be that LOM protection will be less susceptible to nuisance tripping resulting in less interruption to generator supplies.
It can, therefore, be seen that the cumulative benefits of amending generator LOM protection significantly outweigh the cost of implementation, even in the worst-case scenario.

Conclusions
The study has presented a methodology, experience and practical outcomes of the risk assessment-based revision of LOM protection settings in NIE Networks' distribution system.The LOM protection stability was first considered, providing strong motivation for change, followed by the protection sensitivity analysis and assessment of the resulting risks.The increase in both personal and out-of-phase reclosure risks has been realistically quantified and compared against the health and safety requirements.
As the risk results fell within the ALARP safety margins additional risk mitigating measures were sought, including the application of NVD protection, as well as the NVD operation time reduction.
Furthermore, a CBA performed by NIE Networks has demonstrated a clear financial benefit of the LOM protection settings adjustment.
The results and observations included in the study aim to provide the means and supporting evidence for achieving best compromise settings in the revision of LOM protection.
Although future proofing of the risk assessment outcomes has been considered, it needs to be noted that in the dynamically changing system, including the on-going revision of other DG related recommendation, the risk analysis may need to be revisited at some point to reflect those changes.
Nevertheless, the authors believe that the presented systematic methodology and associated practical results provide a useful analytical framework for tackling various aspects of power system operation, and can be helpful in shaping various aspects of future grid regulation.

Fig. 6
Fig. 6 Assessing probability of load-generation match

Table 1
Simulated records of major system events Event no.

Table 2
Fault records of actual incidents

Table 4
IR E , annual probability related to individual risk (injury or death of a person) from the energised parts of an undetected islanded network; T E , average duration between incidents (injury or death of a person) from the energised parts of an undetected islanded network [in years]; N OA , annual rate of occurrence of any generator being subjected to out-of-phase auto-reclosure during the islanding condition not detected by LOM protection; T OA , average duration between the occurrences of out-of-phase autoreclosure during the islanding condition not detected by LOM protection (in years).1338J.Eng., 2018, Vol.2018 Iss. 15, pp.1335-1339 This is an open access article published by the IET under the Creative Commons Attribution License (http://creativecommons.org/licenses/by/3.0/)