Protection relay

What it is (precise)

The relay decides; it does not interrupt. Device 52 is the circuit breaker, and the relay reaches it through a trip circuit fed from the site's station DC battery — a separate 110 or 125 V DC system with its own charger, quite distinct from the megawatt-hours behind the fence. That is worth stating plainly on a battery project: a plant built of batteries still needs a small dedicated one to open its breakers, and trip-circuit supervision exists precisely so a broken trip path is found by an alarm rather than by a fault.

Total fault clearing time is the sum of two independent numbers — the relay's own decision time plus the breaker's rated interrupting time, commonly three or five cycles for medium-voltage equipment, which is 50 to 83 ms on a 60 Hz system and 60 to 100 ms at 50 Hz. Where a trip must latch until someone attends, an 86 lockout relay holds the breaker open and blocks reclosing until it is manually reset.

The relay never sees primary quantities. Current transformers and voltage transformers scale thousands of amps and tens of kilovolts down to a few amps and around a hundred volts, so a settings sheet carries every threshold twice — once in primary units, which is what the fault study computes, and once in secondary units, which is what the technician injects at commissioning. The instrument transformers have ratings of their own that bound what the relay can believe.

Under IEEE C57.13 a relaying class of C800 means the CT can develop 800 V at its secondary terminals at twenty times rated secondary current while holding ratio error within 10%; the IEC equivalent, 5P20, holds composite error within 5% at twenty times rated primary current. Push a CT past that and it saturates, and a saturated CT under-reports exactly the current the relay was installed to catch.

Above pickup, the second half of every overcurrent setting is time. Device 50 acts with no intentional delay; device 51 follows an inverse time-current characteristic, so the larger the fault the faster the trip, using the standard curve families of IEC 60255-151 or the equations of IEEE C37.112 with a pickup and a time dial.

Coordination is the discipline of stacking those curves so the device nearest the fault operates first and everything upstream waits. The gap between adjacent curves — a few tenths of a second in normal practice — is not padding: it has to cover the downstream breaker's interrupting time, relay overtravel, and the tolerance stack of both settings, which is why shaving it to look faster on paper is how selectivity gets lost.

The device numbers a BESS reader actually meets

The overcurrent family does the bulk work on the collection system. Phase elements 50 and 51 protect the feeders and the transformer windings; the same numbers with an N suffix work from the residual sum of the three phase CTs, and with a G suffix from a dedicated core-balance CT wrapped around all three conductors, which is the more sensitive arrangement because it is not fighting the ratio errors of three separate cores.

Where fault current can flow either way through a bus, device 67 adds direction to the same measurement so only the faulted side trips. Device 50BF supervises the breaker itself: if current is still flowing a set time after a trip was issued, the breaker has failed and the next device upstream is asked to clear instead.

Voltage and frequency elements are the interconnection's own trip set. Devices 27 and 59 watch for under- and overvoltage at the point of interconnection and on the collection bus, and 81 covers frequency, usually split into 81U and 81O stages with a rate-of-change element alongside.

One voltage function is specific to how the medium-voltage collection is earthed: where the bus takes its ground reference through a grounding transformer and a neutral resistor, earth-fault current is deliberately held small, so a 59N neutral-displacement element detects the fault from the voltage shift rather than waiting for a current a phase-graded element would never see. These are also the elements the grid code's ride-through envelope constrains, which the last section takes up.

Three more show up on nearly every battery single-line. Device 87 is differential protection — 87T across the main and step-up transformers, 87B on a bus — comparing current in against current out over a zone bounded by its CTs, which makes it both fast and selective without needing any coordination margin; on a transformer it must compensate for the winding connection's phase displacement and the CT ratio mismatch, work numerical relays do in software from the vector group entered in the settings.

Device 25, sync-check, supervises closing: it permits the breaker to close only when the voltage difference, slip and phase angle across it sit inside a window the study defines. Device 32 measures directional power, used where an export or import limit has to be enforced at the meter — and here the battery differs from every generator the scheme was invented for, because reverse flow is normal operation.

Charging is not a fault, and any directional element on a BESS has to be set knowing that. Rotation and unbalance functions 47 and 46 round out the set; the phase sequence entry covers what they measure.

Where the settings come from, and who owns them

Settings are an output, not a product choice. The protection and coordination study takes the single-line diagram, the utility's source impedance, transformer impedances, cable data, the grounding scheme and the CT and VT ratios, computes fault currents at every bus, and returns a settings sheet per relay — element by element, pickup in primary and secondary units, curve type, time dial, instantaneous cut-off, plus time-current plots showing the grading that justifies each choice.

The interconnecting utility reviews the sheet for the devices facing its system, and the approved version becomes a compliance artefact attached to the interconnection agreement rather than a tuning parameter. Changing a value later is a restudy and a resubmission, so the settings sheet deserves the same revision control as the drawing it was derived from — and the pairing to record is which SLD revision and which fault study a given file came out of.

Commissioning proves the sheet rather than the catalogue. Secondary injection confirms each element picks up where it should and times as the curve says; CT ratio and polarity are verified physically, because a reversed polarity turns a differential scheme into a device that trips on through-current and a directional element into one that looks the wrong way; end-to-end tests trip real breakers rather than watching a contact close on a bench.

Interlocks, the lockout and the trip-circuit supervision get functional checks of their own. On transmission-connected ties the utility often requires two independent protection groups — separate relays, separate DC supplies, separate trip coils — so no single component failure leaves a fault uncleared.

Ownership questions belong in the contract, not in the field. Which party owns and maintains the relays at the boundary, who holds the passwords on numerical relays and may alter a setting, how event records and fault oscillography are retrieved and shared after a trip, what spares and test equipment the site keeps, and what cyber obligations apply where the plant falls under a bulk-system regime — all of these are cheaper to write down than to negotiate the week the utility asks for a trip report.

Relay event files are also the best forensic record a plant has, so the requirement that they be time-synchronised and retrievable is worth specifying alongside the SCADA scope.

Coordinating around a source that barely feeds a fault

The assumption underneath classical overcurrent grading is that a fault produces current several times larger than load. A synchronous machine obliges, feeding on the order of 5 to 7 times its rated current; an inverter does not.

Power conversion systems are current-limited by design, contributing roughly 1.1 to 1.2 times rated current in grid-following control and up to about 1.5 times transiently in grid-forming, and during a deep sag the controls prioritise reactive current over real, so what current there is may not be where a phase element expects it. For a fault inside the plant fed only from the battery side, an overcurrent element graded on utility-style multiples can sit there and never pick up.

So the scheme leans on functions that do not need a large current to be certain. Differential protection compares what enters a zone with what leaves it and is indifferent to how small either is, which is why 87 covers the transformers and buses that matter. Voltage-restrained or voltage-supervised overcurrent lets a modest current trip when it is accompanied by a collapsed voltage.

Undervoltage and neutral-displacement elements detect conditions that current alone would miss, and on the DC side of the plant the work belongs to fuses and contactors coordinated inside the rack rather than to any relay. Ground-fault sensitivity has a floor set elsewhere: the grounding study fixes how much earth-fault current the neutral impedance permits, and the relay has to detect a fault at the far end of the longest feeder within that budget — the grounding system entry owns that choice, and the medium-voltage switchgear entry owns the breaker duty on the other side of it.

Every one of those settings encodes assumptions about the sources present, and those assumptions age. Adding PCS blocks, augmenting with new battery capacity, changing a neutral impedance, or repowering with a converter whose fault contribution differs all move the numbers the study was built on.

The consequence is asymmetric and easy to miss: nothing misbehaves in normal operation, and the gap only appears when a fault arrives and either a breaker is asked for more than its duty or an element that should have seen the fault was desensitised by a change nobody restudied. Treat a change in plant sources as a restudy trigger in the same way a change in grounding is.

Anti-islanding against ride-through

Two obligations pull the same voltage and frequency elements in opposite directions, and the protection relay is where they collide. On one side, the plant must not energise a de-energised utility system: IEEE 1547-2018 requires a distribution-connected resource in North America to detect an unintentional island and cease to energise within 2 seconds, and many utilities add direct transfer trip as a backstop — a hardwired or communications-borne signal from the substation that opens the plant breaker when the upstream breaker opens, independent of anything the plant can measure locally.

On the other side, grid codes forbid tripping inside a voltage-and-time envelope during remote faults. In the United States that constraint is written directly against protection settings: NERC PRC-024, being superseded for inverter-based resources by PRC-029 under FERC Order 901, bounds the voltage and frequency points at which bulk-system generation may be set to trip. The ride-through entry owns the envelope itself; the relay is where the envelope becomes a ceiling on how sensitive a setting is allowed to be.

In practice the two jobs are separated by speed and by device. Fast island detection lives in the converter — certified in North America under UL 1741 SB against IEEE 1547-2018 — and in transfer trip, both of which act on evidence a site relay cannot get by watching a voltage magnitude. The relay's own 27, 59 and 81 elements are then set outside the no-trip envelope, with deliberate time delays, so they serve as backstops for conditions that are genuinely abnormal rather than as a device racing a curve it is forbidden to cross.

Reconnection is equally deliberate: after a trip the plant waits for voltage and frequency to sit inside range for a defined period — IEEE 1547-2018 carries a default enter-service delay of 300 seconds, adjustable — and closes under 25 sync-check supervision rather than the moment the numbers look acceptable.

The recurring failures are all coordination failures between documents. Nobody plots the relay settings and the ride-through curve on the same axes, and the overlap is discovered by the first remote fault. Station-service and auxiliary protection is set by a different discipline and trips on a sag the main relays rode through perfectly, taking the plant off seconds after a textbook ride-through.

A directional or reverse-power element is set as though the plant only ever generates, and the first charging window looks like a fault to it. Settings drift from the approved sheet after a relay firmware upgrade or a capacity addition, and no one re-issues the study. And the whole chain still terminates in a trip coil fed from a station DC system: if the battery charger has been failed for a month and the supervision alarm was acknowledged rather than fixed, the relay makes a perfectly correct decision into an open circuit.