1 Introduction

Wide area monitoring (WAM) is one of the most significant new developments in modern power systems. Through developments in synchronized measurement technology and the creation of phasor measurement units (PMUs) [1], WAM is able to offer a real time view of the dynamic behavior of a power system that updates once per cycle. This information has proven an invaluable resource for creating new applications that can benefit power system protection and control [26].

Recent blackout reports have identified that failings in protection systems have contributed to several recent blackouts [7, 8]. Therefore, the role that WAM may be able to play in enhancing power system protection has become an area of great interest.

The speed of response required for primary protection is too high for wide area measurements to play a role. Furthermore, the need for wide area measurements as part of primary protection is limited, as it protects a specific element of the power system. However, aspects of power system protection that have lower requirements in terms of the speed of response (e.g. backup protection) and are less selective can be improved by using wide area measurements to supervise their behavior. Furthermore, wide area measurements can be used as the basis for creating adaptive system protection, novel system integrity protection schemes, or even entirely new protection concepts (e.g. real time adaptation of the balance between security and dependability).

Wide area measurements alone are not sufficient to realize these potential enhancements. The introduction of digital relays has provided an unprecedented level of computational power in the substation and this has vastly increased the scope of the functions that can be delivered by any protection system. This enhanced capability is already leading to an increasing amount of intelligence and decision making moving from the control center to the substation [9] and the new protection concepts discussed here are an extension of this.

However, in addition to this increased computational power and the availability of wide area measurements, a key requirement for any wide area application is a suitable communication infrastructure to support it.

The communication needs of different WAP concepts can vary drastically [10]. Some may require measurements to be streamed from multiple locations at a rate of once per cycle (e.g. intelligent controlled islanding [11]) while others may only require binary signals to be streamed at lower rates (e.g. supervision of backup protection [10]).

Furthermore, the requirements imposed on the communication infrastructure extend beyond bandwidth. The latency and jitter may need to be low, so that a reliable, high speed of response is provided, and ensuring cyber security will be very important to prevent WAP from being exploited by malicious third parties that seek to attack the power system. Therefore, proper evaluation of the communication needs should form an essential aspect of the design of any wide area protection scheme [12].

The increasing relevance of WAP is driven by the changing nature of power systems. The three main drivers are: ① The wider range of possible operating conditions, due to the changing generation mix and the introduction of demand side participation; ② the increased interconnection of power systems, larger infeeds from neighboring systems and the reduction in operating margins due to economic pressures; and ③ the increasing complexity and diversity of transmission technology and control (e.g. HVDC, thyristor controlled series compensation, increasing interconnection).

These changes are making it increasingly difficult to select protection settings that will be an appropriate compromise for all credible system conditions and contingencies. Furthermore, modern power systems are more vulnerable to wide area disturbances. Wide area disturbances require a coordinated wide area response across system boundaries that is tailored to the needs of the entire system, not inaccurate, inconsistent local responses that are delivered based on the local observations of each system.

It has been reported [10] that 70 % of wide area disturbances involved relay maloperation during their initiation or evolution. These maloperations can be attributed to either poor relay settings or hidden failures in the protection system. The role of relay maloperation in wide area disturbances must be taken as a significant source of concern, as wide area disturbances have played a key role in several recent blackouts [7, 8] and the management of these wide area disturbances is beyond the scope of most of the existing protection [13].

These factors have motivated the development of new protection concepts that are supported by WAM. The varied nature of the challenges facing protection has meant that these new concepts cover a broad range of complexity and ambition. Examples include novel system integrity protection schemes (SIPS) that can deploy a wide range of far reaching actions to prevent a cascading failure, adaptive system protection (e.g. adaptive under frequency load shedding), supervisory schemes that improve the security of existing backup protection, and methods that do not change the behavior of system protection but do enhance our understanding of it (e.g. alarming system operators to the risk of false penetration of relay characteristics). Recent work has begun to focus not only on developing new concepts but also on the practical realization of these concepts, e.g. work has addressed the use of the IEEE 1588 std for substation synchronization as part of the Guizhou-Duyun WAP project in Guizhou province China [14].

This paper describes a number of the proposed concepts and how they can help to address several significant threats to the proper performance of power system protection, including:

  1. 1)

    The role of cascade failures and wide area disturbances in power system blackouts

  2. 2)

    Ensuring the security of backup relays in the more complex operating conditions of modern power systems

  3. 3)

    Limiting the impact of hidden failures that are revealed under stressed conditions

  4. 4)

    The adaptation of system protection actions to the true system state

  5. 5)

    Wide area protection of distribution systems

The paper is structured as follows. Section 2 introduces some basic aspects of WAM and PMUs. Section 3 provides an overview of power system protection and the threats that it faces. Section 4 describes a section of the new protection concepts that are being developed. Finally, Section 5 provides some concluding remarks.

2 Wide area monitoring

WAM collects measurements from remote locations across the power system and combines them in real time into a single snapshot of the power system for a given time. Synchronized measurement technology (SMT) is an essential component of WAM, as it allows the measurements to be accurately time stamped, primarily using timing signals from GPS. These time stamps allow the measurement to be combined easily and phase angle measurements to be made using a common reference.

PMUs were developed in the early 1980s [1] and are the most widely used form of synchronized measurement technology. PMUs measure voltage and current phasors at a rate of once per cycle and the IEEE C37.118 standard describes a required level of measurement performance [15] and a communication protocol [16] for these measurements. It is worth noting that this standard provides the option to include analogue and digital values into the measurement streams. This allows binary status signals and waveform measurements to be streamed using the protocol.

The architecture of a WAMS can be highly complex and [17, 18] provides several examples of how to design a WAMS. The latency, jitter and reliability of the communication network in a WAMS is a vital aspect of ensuring that the WAMS is suitable for supporting protection functions. The communication network must be able to ensure that the measurements supplied by the WAMS to the protection functions are received not only quickly but arrive reliably and with consistent delays to ensure that the quality of the protection is sufficient.

3 Challenges faced by power system protection

3.1 Overview of power system protection

The role of power system protection is to disconnect faulty/overloaded elements to save the element from damage, prevent the fault from degrading security and to protect the surrounding area from serious danger [9].

This equipment protection is primarily delivered through breaker operations and can be broken down into primary and backup equipment protection. Primary protection avoids damage to equipment by isolating the protected equipment from the system. It is highly selective and operates in only 3~4 cycles. The relays used to deliver primary control are usually duplicated one or more times to avoid any failure to clear the fault.

Backup protection is tasked with clearing any faults that are not cleared by the primary protection. As such, it operates more slowly than primary protection, to ensure proper coordination, and is less selective. The setting of backup protection is more challenging, as it protects a larger part of the system, so is more dependent on the operating condition of the system.

The design of protection must balance two key requirements. These are dependability and security. Dependability is defined as ensuring that the protection system operates when it should. Security is defined as ensuring the protection system does not operate when it should not. However, dependability and security are opposing goals and the protection engineer must strike a balance between them.

Any protection operation can be defined according to how correct and appropriate it is. A correct relay operation is one where the relay operates as designed. An appropriate action is one that contributes positively to protecting the security of the power system. From these definitions, any relay operation can be defined according to its correctness and appropriateness [19].

In addition to equipment protection, protection is required that is tasked with preventing the partial or total loss of supply/integrity due to phenomena such as: transient angle instability, small signal instability, frequency instability, voltage instability (short and long term) and cascading outages. This system protection requires actions that go beyond breaker operations and includes actions like under frequency load shedding (UFLS). Like backup protection, system protection operates more slowly than primary protection and its settings are highly dependent on the operating conditions.

Existing protection schemes are self-contained entities that use independent local measurement chains to deliver their functionality. However, the increasing complexity of power systems has given rise to System Integrity Protection Schemes (SIPS), which use wide area measurements to deliver more complex functionality.

The measurements used by each of protection systems will vary significantly in terms of the type of measurement, the acceptable delay, the required reporting rate, the required resolution and the required accuracy.

SIPS are designed to protect the system from this specific set of contingencies [20] using a set of pre-determined actions that are designed based on offline system studies. These actions will be executed when a specific set of input conditions are satisfied [20]. For a scheme to be classed as a SIPS the actions implemented must go beyond simply isolating the faulted elements.

The conditions required to trigger a SIPS and cause it to operate can include events (e.g. the loss of a line), the system response (e.g. the measured frequency being below a threshold), or a combination thereof. Furthermore, most SIPS are armed by one condition and then triggered by another condition. The use of SIPS is now a worldwide practice [21] and an ever increasing number of these schemes are being designed and implemented.

The compatibility and coordination of protection in neighboring systems is essential, especially as it becomes more complex, far reaching and adaptive. This serves to prevent undesirable interactions [22] that may create hidden failure modes or even directly cause maloperation.

3.2 Cascade failures

Cascade failures can be described as a sequence of failures in the power system that occur one after another and each failure occurs because of the consequences of the previous failures, e.g. a sequence of line trips due to violation of thermal limits. During post-mortem analysis the initiating event of a cascade can usually be identified with ease; however, it is important to bear in mind that during operation it is harder to clearly recognize an event that will eventually initiate a cascade.

Cascade failures can occur very quickly after the initiating event and have contributed to several recent blackouts [7, 8] and the fast, adaptive actions required for the prevention of these cascades are beyond the scope of most of the existing power system protection [23].

Local protection uses only local information and cannot consider the whole system, either its state or its needs. Therefore, it is attractive to explore the opportunity to use wide area information and real time measurements to create protection actions that are designed to protect power system security from wide area disturbances. This protection must identify the stressed conditions that may leave the system vulnerable to a cascade and the possible initiating events that exist within the system.

For example, a thermal overload can be relieved by local protection and through this the asset is protected. However, this local protection cannot assess the severity of the overload relative to the importance of the asset to system security. Removing this asset immediately may initiate a cascade of thermal overloads. In contrast, by using wide area measurements to develop an accurate view of the system state and the evolving threat to security, a wide area protection scheme could identify the importance of the asset to system security and exploit short term thermal ratings (possibly complemented with dynamic thermal line ratings [24]) to delay the local protection action and provide more time to relieve the overload by alternative means and preserve system security. Thus, wide area protection can be used to realize protection actions that adapt to the system’s needs, in terms of security, and protect against wide area disturbances and cascading failures.

Finally, the complexity of the mechanisms behind wide area disturbances and the short time frame over which they can cause system collapse may mean that their proper management is beyond a human operator, however skilled they may be [10]. In this context, automatic actions will be needed to preserve system security and wide area protection offers the opportunity to deliver these actions.

3.3 Correct but inappropriate operation of relays

The incorrect operation of protection relays has contributed to a number of cascades failures and blackouts [7, 8]. Existing protection relays primarily use fixed characteristics that do not adapt to the true system conditions. This means that it is possible for this protection to operate correctly but inappropriately.

This problem has been exacerbated by changes in the operating practices of power systems, e.g. a greater emphasis on commercial and environmental factors. These changes have led to an increasing variety of generation mixes and load flow patterns. Therefore, the fault level and load flow pattern of the system can change quickly and the range of possible operating conditions is becoming increasingly broad. This has made the proper setting of protection far more challenging, as it is harder to determine the settings that will be applicable for all of the likely operating conditions and contingencies. This has contributed to the correct but inappropriate operation of protection relays; particularly backup protection relays [9].

3.4 Hidden failures

Despite the challenges faced by modern power system protection and the increasing complexity of protection, modern protection performs very well and almost all relay operations are correct and appropriate [22]. However, incorrect protection actions have played a role in the initiation and propagation of several major blackouts [7],[8]. A common theme in these events is the presence of hidden failures that caused a relay to operate incorrectly immediately after another protection action had been taken in their local area. A hidden failure is defined as a permanent, undetected defect in a protection relay that causes a relay to operate incorrectly and remove elements of the system as a consequence of another switching event in the system [25]. Hidden failures are random events that are not indicative of bad relay design. They do not immediately lead to an incorrect operation but will cause one when another event occurs in their local area.

Hidden failures only include those failures that cause a relay to operate incorrectly. Failures that cause the relay to not operate are not hidden failures, as they should be accommodated by redundant protection. Equally, failures that cannot be monitored are not hidden failures, they are faulty design, and temporary failures that occur, e.g. during switching, are not hidden failures.

Figure 1 presents a comparison of a hidden failure and a non-hidden failure for a three zone step distance relay that was presented in [26]. A failure of the contacts of T3 that causes them to be permanently closed will create a hidden failure. This is because the failure of T3 does not cause an immediate maloperation, as Z3 must also be closed. However, in the event of a fault the line will be immediately tripped without delay when Z3 closes in the presence of any fault in Zones 1-3.

Fig. 1
figure 1

Example of a hidden failure (HF) and a non-hidden failure (NHF) for a three zone step distance relay-repeated from [26]

In contrast, a failure of the contacts of Z1 that causes them to be permanently closed will not create a hidden failure. This is because at the instant of the failure the line will be tripped. Whilst this is a maloperation, it is not a hidden failure, as immediately caused the line trip.

Possible hidden failures include: relay contacts that are always open or closed, timers that operate instantaneously regardless of the set delay, outdated settings, settings that are unsuitable for the prevailing conditions, and human error in relay coordination [26].

Hidden failures are a particular threat because they require another event in the local area to reveal them. This means that a hidden failure and its triggering event represent two related failures, which is a far more severe threat than two random, unrelated failures. Furthermore, the triggering event itself is usually a sign that the power system is experiencing stressed conditions. These factors mean that hidden failures inherently threaten to contribute to a cascade of failures in their local area.

This local area was more strictly defined as a region of vulnerability in [25] and will vary significantly for different modes of hidden failure in different elements.

The design of any protection scheme will directly influence the likelihood of it experiencing hidden failures [26]. The nature of wide area protection schemes may mean that their region of vulnerability could be significantly larger than those seen for existing protection. As such, the hidden failure modes and region of vulnerability of a wide area protection scheme should be rigorously assessed to ensure that their presence does not weaken the protection of the system as a whole [27].

The greater complexity of SIPS and WAP, compared to traditional protection, will mean that the task of analyzing them for hidden failures will be more challenging. A particular challenge involved in analyzing WAP will be the analysis of the wide area monitoring and communication networks on which they depend. These networks can be highly complex and depend on a wide variety of multi-vendor hardware and technologies. Furthermore, the broader scope of actions available to a SIPS and WAP (e.g. system separation) will mean that the impact of any hidden failure modes may be far greater than it would be for other protection elements.

Bearing in mind the increased complexity of analyzing SIPS and WAP to identify hidden failures and the greater consequences of their maloperation; it is particularly important that they are designed with the minimization of hidden failure modes in mind alongside the ability to self-diagnose failures and adapt to them. These considerations should extend beyond the original design to include the development of maintenance procedures.

Hidden failures can only be detected when they cause an incorrect operation or when the faulty element is tested. Ongoing maintenance, calibration and review of protection could identify existing hidden failures and correct them [19] and recent work has presented a number of such methods [28]. However, given the number of protection elements, this ongoing task may be difficult to deliver with the resources available. Therefore, it may be attractive to develop more methods for exploiting the ability of digital relays to self-diagnose the presence of failure modes. Furthermore, WAMS based concepts for detecting these failures, like those proposed in [29] that can identify such failures may be necessary.

However, it is known that maintenance is a source of hidden failures. Therefore, it is important to develop WAP concepts that can help to limit the impact of hidden failures when they are revealed. Furthermore, recent work, e.g. [30, 31] has incorporated hidden failures into the statistical modelling of power system reliability using expert systems, importance sampling, neural networks and fuzzy logic. A review of this work is provided in [29].

4 Enhancing protection with wide area monitoring

The overall objective of using wide area monitoring to enhance protection is to create new protection concepts that will make blackouts less likely to occur and less intense when they do occur. The key areas in which WAM can contribute to power system protection are as follows.

  1. 1)

    Avoiding inappropriate relay settings for the prevailing system conditions

  2. 2)

    Managing wide area disturbances

  3. 3)

    Mitigating the impact of hidden failures

  4. 4)

    Ensuring a suitable balance between the security and dependability of protection

The goal of protection is to protect individual elements of the power system from damage and to protect the security of the power system itself.

In the case of primary equipment protection there is very little role for the use of wide area monitoring. This is because primary protection must reliably deliver a very fast response for any fault on the element that it protects. However, the slower speed of response required for backup protection and the fact that it protects a zone of the system means that wide area monitoring can be a useful tool for improving its performance.

The most effective means for ensuring that the system will survive extreme conditions and wide area disturbances is a high degree of built in redundancy and strength [32]. However, this over engineering of the system is not compatible with the economic and environmental demands placed upon modern power systems. Therefore, a significant role for wide area monitoring enhanced protection may be to enable system operators to deliver the existing level of security and reliability in these new operating conditions.

Wide area measurements offer the potential to create supervisory schemes for backup protection, more advanced forms of system protection and entirely new protection concepts. Examples of these protection functions include [32]:

  1. 1)

    Adaptive relays that update their settings as the system state changes

  2. 2)

    Improved protection of multi terminal lines

  3. 3)

    Adaptive end of line protection that monitors the remote breaker, if it is open the under reaching Zone 1 is replaced with an instantaneous characteristic

  4. 4)

    Temporarily adapt relay settings to prevent maloperation during cold load pickup

  5. 5)

    Use the ability of digital relays to self-monitor to identify hidden failures and use the hot swap functionality offered by IEC 61850 to remove them

  6. 6)

    Intelligent controlled islanding that preempts an uncontrolled system separation by implementing an adaptive controlled separation

The remainder of this section discusses some of the opportunities for wide area monitoring enhanced protection in more detail.

4.1 Alarming against the risk of relay characteristic penetration

The objective of this application is to detect when the impedance observed by a relay approaches the relay characteristic under non-faulty conditions. This information is then used to alarm protection engineers to a relay setting that is potentially unsuitable [32].

This concept does not directly improve the performance of protection or use wide area measurements. However, it does use the communication network that is necessary for wide area monitoring to generate valuable information that will help protection engineers to improve the security and reliability of protection. This method could be applied to critical relays that are vulnerable to load encroachment and/or power swings or to relays that will have more severe consequences in the event of any maloperation.

4.2 Preventing load encroachment

The loadability of an impedance relay is the maximum load that can be distinguished from a fault. This is highly dependent on voltage at the bus and reactive power flows, which can vary dramatically during stressed conditions and power swings. Heavily loaded lines may encroach on the settings of relays and cause an incorrect and inappropriate tripping operation. This load encroachment of impedance relays played a role in recent blackouts [7, 8] and arises because the relay setting is a compromise between the desired setting level and the maximum anticipated load at the relay locations. This compromise must accommodate a wide range of possible system conditions, loadings and contingencies.

This compromise is vulnerable to unforeseen conditions, as it is based on offline simulations of the credible operating conditions and contingencies. As such, the relay setting would only be suitable provided that the assumptions made when it was set hold true. With the more variable nature of modern power systems and the introduction of significant intermittent generation, it is likely that this compromise would become ever more inefficient, as the variation between the maximum loading and the normal loading would become more significant and variable [33]. With the computational power of digital relays this can be overcome by using real time measurements of the load to prevent load encroachment by compensating the relay input for the load current [32].

4.3 Adjusting the balance between the security and dependability of protection

Balancing the demands of dependability and security is one of the greatest challenges during the design of protection. Existing protection is designed to favor dependability [34]. This preference for dependability is attractive during healthy operation when the threat of an uncleared fault is severe and the system can easily survive the loss of a single element, due to the inherently high level of redundancy in a healthy power system.

However, during a wide area disturbance, this preference for dependability can result in incorrect and inappropriate tripping operations. This is a major threat to a stressed system, as the loss of a single element can accelerate the systems descent into a cascade failure and even blackout.

Therefore, it would attractive to shift the balance of this compromise toward security during stressed conditions, i.e. when the conditions encountered (e.g. power swings) can increase the likelihood of maloperations and reveal hidden failures. The highly redundant nature of power system protection means that there are many different possible ways of combining the outputs of the various relays to select the balance between dependency and security.

Wide area measurements could be used to detect that the system has entered a stressed condition and then adjust the protection philosophy to shift the balance away from dependability and toward security. In Fig. 2, this is achieved by swapping between an OR operation, majority voting and an AND operation. The supervisory signal selects the logical combination used to determine the breaker trip signal from each individual relays trip signals. Adapted from [35].

Fig. 2
figure 2

The use of WAM to vary the balance between dependability and security

This approach would slightly increase the likelihood of a fault not being cleared. However, with the existing protection approach, the probability of a fault not being cleared is very low. Therefore, this small increase in the probability of not clearing a fault is acceptable, as it offers a significant reduction in the likelihood of inappropriate protection action from exacerbating stressed conditions and driving the system closer to a blackout [22].

This form of adaptive protection based on wide area measurements could be an effective solution to the challenge posed by hidden failures. By requiring multiple relays to approve any tripping, it would prevent a single hidden failure in any one of these relays from causing an incorrect and inappropriate tripping operation. However, as hidden failures can appear in any element of a protection scheme, any increase in the complexity of protection must be thoroughly assessed in terms of their own modes of failure, both hidden and non-hidden.

4.4 Supervision of back-up zones

The maloperation of zone 3 relays was identified as a significant contributing factor to recent blackouts [7][36]. The unusual load currents and power swings observed during wide area disturbances can cause these relays to operate undesirably. Examples of the system behavior that can cause maloperation of a relay are shown in Fig. 3.

Fig. 3
figure 3

Examples of dynamic conditions that can cause maloperation of distance relays [32]

This vulnerability has led to some calls for zone 3 to be abandoned; but most authors agree that this is too extreme and instead wide area measurements should be used to improve the performance of backup protection [10].

An example of how this can be achieved is the supervision of backup protection using pick up signals from remote PMUs [35]. An example of this is depicted in Fig. 4. Furthermore, measurements of negative sequence currents may be used to further improve this concept.

Fig. 4
figure 4

Supervision of backup relay operation using remote PMUs to check for a fault in Zone 3 [35]

The remote PMUs are installed within the protection zone of the backup relay and monitor the current at these remote locations. These devices implement a simple pick up characteristic and communicate a binary pick up signal to the backup relay. If the backup relay characteristic is violated but none of the remote devices have picked up, then it can be concluded that no fault has occurred and the backup relay operation can be blocked. This prevents load swings during extreme conditions from being misinterpreted as faults and helps prevent the maloperation of backup relays from allowing a wide area disturbance to spread through the system.

The enhancement of backup protection has been a particular focus of recent work and methods based on wide area impedances and current indices [37], net current injection into predefined zones [38], and voltage measurements [39], have been proposed. Furthermore, recent work [40] has presented a scheme that is designed for the specific and challenging case of series compensated lines. These methods can either supervise or substitute existing zone 3 relays, although further work is required in the area of communication redundancy [39]. The majority of these recent methods are WAP based; however, some are not and [41] use an energy function derived from three phase measurements and the local phase angle to block zone 3 operation.

4.5 Intelligent under frequency load shedding

Load shedding is the traditional last line of defense against extreme under frequency conditions. Current practice is mostly for this shedding to be delivered using a sequence of stages of shedding that are triggered when a certain frequency threshold is violated [42]. Shedding load more quickly after a loss of infeed is recognized as an effective means for limiting the frequency deviation with a reduced amount of load shedding [43]. However, balancing the benefits of an increased speed of response against the risk of unnecessary shedding is a challenge.

In isolated power systems frequency control is becoming an increasing area of concern. The displacement of traditional synchronous generation with asynchronous generation is reducing system inertia and allowing larger, faster frequency deviations to occur [44, 45].

Extensive research has been undertaken to create more advanced load shedding schemes that use wide area measurements to reduce the amount of load shed by:

  1. 1)

    Adapting the amount of load shed to the prevailing system conditions, e.g. inertia

  2. 2)

    Initiating the load shedding more quickly

Initiating the load shedding more quickly can be achieved by using event based signals (e.g. the loss of a major interconnector or generator) or by using more complex triggering signals (e.g. triggering based on rate of change of frequency). Furthermore, the amount of load shed can be adapted to the size of the disturbance and system inertia using wide area measurements.

Examples of this work include the adaption of shedding based on measurements of rate of change of frequency (RoCoF) immediately after the disturbance [46] and [47]. However, accurately measuring the RoCoF quickly is a challenge and [48] identifies a number of potential threats to its successful use in adaptive load shedding. Other work addresses load shedding as an optimisation problem that can be solved using genetic algorithms [49] and neural networks [50]. Recent work has incorporated aspects of dynamic security assessment and prediction of the frequency response [51]. Furthermore, some authors have attempted to reflect the impact of UFLS on the system as a whole, e.g. the changes in voltage, reactive flows [52] and line loading [53].

4.6 Adaptive out-of-step relaying

Out of step conditions and system separation are key precursors to system collapse and blackouts. As the formation of an electrical center approaches the system will experience extreme power swings that will further exacerbate stressed conditions and drive the system closer to collapse. Therefore, it is imperative that any potential out of step condition is quickly recognized and prevented; this is the role of out of step relays.

Predicting out of step conditions with local measurements is a challenging task that depends upon settings that are selected using transient simulation of various contingencies and system conditions [35].

Based on these simulations two zones are defined for impedance relays that are installed close to the anticipated electrical center and any violation of the inner zone denotes an out of step condition [35].

However, this is only a reliable approach for simple systems that can be characterized as two areas that are swinging against one another, e.g. the system in operation for the Florida—Georgia Interconnection [54].

In more complex systems the power flows and synchronizing coefficients vary too much for the assumed characteristics to remain accurate for long. Therefore, the relay characteristic will become either too sensitive, allowing inappropriate operation, or insensitive, preventing the relay from ever operating. Although the relay setting could be updated as conditions vary, ongoing adjustment of protection in this way is undesirable; as it will likely serve as a source of hidden failures (as any maintenance of protection schemes can be).

A wide area protection scheme could be developed that monitors the positive sequence voltages across the system. These synchronized real time measurements can be used to predict if regions of the system are approaching an out of step condition [35]. This prediction could be used to initiate a controlled separation of the areas that are losing synchronism [10] or, if the prediction is available sufficiently in advance, actions could be taken to prevent the out of step condition from occurring and avoid system separation entirely. The challenge faced when developing such a scheme would be selecting the measurement locations and developing the algorithms for achieving robust real time coherency determination when the coherent generator groups are variable.

4.7 System integrity protection schemes (SIPSs)

SIPS protect power system security from extreme contingencies or wide area disturbances that are beyond the scope of traditional protection. The increasing availability and maturity of real time wide area measurements has enabled the creation of more advanced SIPS that are able to protect power systems from wide area disturbances for a wide range of operating conditions.

The stages involved in the execution of a SIPS are: ① Identification and prediction of stressed conditions, ②Classification of the threat to system security, ③ Decisions and actions, ④ Coordination, and ⑤ Correction.

Examples of SIPS include [55]: generator rejection, load rejection, under frequency and voltage load shedding, system separation, dynamic braking, and turbine valve control. In [10] several operational SIPS are described.

The actions available to a SIPS include [56]: load shedding, generation start up/rejection, switching of shunt reactors, line tripping, tap changes, adjusting controller set points, tap blocking, controlled islanding, HVDC control and switching of braking resistors.

SIPSs, like all protection, take corrective actions in an attempt to protect the power system from the consequences of contingencies. However, the increasing attraction toward SIPS is because of their ability, through the availability of real time wide area measurements, to identify complex emerging threats to the power system and respond to them quickly and decisively in a way that protection other cannot. For example, event based SIPS can respond immediately after a severe contingency, or combination of contingencies, rather than waiting for the inevitable degradation of the system state. In contrast, response based SIPS can use real time measurements of the system state after a contingency to assess the need for a response and adapt the nature of any response to the true system state. Furthermore, event based and response based decision making can be combined to create complex SIPS that can deliver fast and adaptive protection actions for a wide range of system conditions and contingencies.

However, the severity of the contingencies that SIPS are designed to protect against and the highly intrusive nature of many of the actions available to them mean that SIPS face onerous requirements in terms of both dependability and security [56]. For example, a failure to operate could result in a wide area disturbance going unchecked, most probably leading to a blackout, and operating unnecessarily could cause a blackout when the system was operating in a healthy condition.

The complexity of novel SIPS and their proliferation makes the proper coordination of the various SIPS in a power system a significant task. This is vital because the maloperation of a SIPS could have far reaching consequences. Furthermore, the wide area nature of certain SIPS will mean that the SIPS of neighboring systems must also be coordinated.

4.8 Application of WAP to distribution networks

The changing nature of power systems and the possible benefits of wide area protection also extend to the protection of the distribution system. The changes faced by distribution networks include the connection of energy storage, electric vehicles, smart meters, demand side participation and the connection of distributed generation (DG). Furthermore, these changes must be faced with an ageing asset base and an increasing total load.

The increasing connection of DG is a particularly significant change, as it has resulted in distribution networks undergoing a radical change from single source, radial systems to more complex multi-source systems. This has introduced a number of threats to distribution system protection including reverse power flows and the contribution of DG to fault currents. The nature of the threat varies with the relative position of the fault, the relay and the DG, but can include false tripping, and a loss of sensitivity or selectivity [57, 58]. Also, high fault levels at the distribution level could allow fault currents to exceed those that can be safely interrupted by the available protection.

These threats have meant that IEEE std 1547 recommends the disconnection of DG during faults. This is an obvious and significant barrier to DG playing a significant role in system operation under stressed conditions. To overcome this barrier new protection concepts are required that offer superior performance. Wide area protection that uses information from multiple locations to quickly and selectively clear the fault in these more complex distribution networks is an attractive solution. The new concepts proposed include:

  1. 1)

    The introduction of directional overcurrent relays to replace the overcurrent relays that are prevalent in existing systems [59];

  2. 2)

    The use of multi agent systems that can monitor multiple locations and make adaptive relaying decisions [60]

  3. 3)

    Enhanced pilot protection [61]

  4. 4)

    Enhanced converter response during faults [62]

  5. 5)

    Thermal protection relays that use an inference engine to combine dynamic ratings and coordination of DG to manage loading [63]; and

  6. 6)

    The use of negative sequence current dot protection (I2DP).

WAP at the distribution level will depend upon similar infrastructure and technology as those systems at the transmission level. However, the smaller angular separation across a distribution network means that measurement of angles on the distribution network is more demanding than it is at the transmission level. A particularly important enabler for these new protection principles are micro-processor relays that can vary their settings easily and the IEC 61850 standard will be essential for fully realizing the capabilities of these devices and delivering the protection needs of future distribution systems [62].

Another motivation for WAP at the distribution level is its role as an enabler for adaptive control, e.g. automatic network reconfiguration that reduces the frequency and length of customer interruptions, manages circuit loading, and limits the fault level [57]. Adaptive control of the distribution network is becoming increasingly necessary to reduce barriers to DG, make best use of the installed DG and through this help to deliver a low carbon future. This adaptive control and other measures form part of a move toward the creation of active distribution networks [64] and existing protection is not compatible with many of these adaptive control measures [57].

Finally, the desire to deliver ever improving quality and security of supply to customers has led to increasing pressure for the design of protection to ensure that any interruption of supply is minimized [65].

The creation of ad-hoc or planned microgrids is an effective means for maintaining supply or more quickly restoring supply after faults in the distribution system [58]. However, the challenges faced by distribution networks are equally, if not more so, relevant for microgrids [58]. A particular challenge is that the protection of microgrids must function correctly for both an autonomous microgrid and a non-autonomous microgrid, which will require a significant degree of adaptation and reconfiguration.

5 Conclusion

WAM offers a wide variety of opportunities for enhancing the backup protection and system protection of modern power systems. These enhancements can contribute to reducing the likelihood of the maloperation of backup relays, limiting the impact of hidden failures and creating new tools for managing wide area disturbances. These benefits indicate that the main role of wide area monitoring as part of protection is improving the resilience of power systems against stressed conditions and wide area disturbances, not the isolation of individual faults. The well-considered deployment of these new concepts should reduce the frequency and intensity of blackouts and enable more rapid service restoration.

The increasing vulnerability of power systems to wide area disturbances and the short time over which these extreme events can cause system collapse may mean that automatic, adaptive actions, like those offered by system integrity protection schemes, may be the only effective means to protect power system security in the future.

However, if these new concepts are to be deployed then significant efforts must be undertaken to understand their potential for hidden failures and unwanted interactions. A particular focus should be on how to coordinate these more complex protections schemes with one another; both within a system and between neighboring systems.

Finally, the performance of the supporting communication infrastructure, in terms of latency, jitter, redundancy and cyber security, will determine the performance of any form of wide area monitoring based protection. As such, the architecture used for delivering this enhanced protection will be an important factor in determining its success.