You are on page 1of 18

Voting for Enhanced Security

How Far is Far Enough


Roy Moxley, Siemens
Restricted Siemens AG 2013 All rights reserved.

Unpleasant Facts
About 1500 False trips
in 16 months (NERC)
16 Times more False
Trips than Failure to
Trip
41% of False trips are
during an external fault
Restricted Siemens AG 2013 All rights reserved.

From NERC Report, Jan 2011 April 2012

Restricted Siemens AG 2013 All rights reserved.

From NERC Report, Jan 2011 April 2012

Restricted Siemens AG 2013 All rights reserved.

Pleasant Fact
Cost of Relays has come down
an inflation adjusted 90% since
1980
Restricted Siemens AG 2013 All rights reserved.

Why Do We Apply Redundant


Protection ?

It Costs More

Extra Engineering

Extra Maintenance

Extra Wiring

Restricted Siemens AG 2013 All rights reserved.

Hole Filling

Restricted Siemens AG 2013 All rights reserved.

So what Constitutes a Hole ?


Its only a hole
If you hit it.

Arc Resistance Coverage

Communication Failure Coverage

Power Swing Response

Fuse Failure (loss of potential) Response

Restricted Siemens AG 2013 All rights reserved.

Maintenance Backup

Restricted Siemens AG 2013 All rights reserved.

Relay Failure Backup

Restricted Siemens AG 2013 All rights reserved.

Two of Three Logic Improves


Dependability and Security
Lets Define (A,C,B):
1% chance of False Trip
95% chance of Correct Trip

OR

A+B = 1%2 = .01% Chance of False Trip


(A+B)*(A+C)*(B+C)= 0.03% Chance of False Trip

A+B = 95%2 = 90.25% Chance of Correct Trip


(A+B)*(A+C)*(B+C)= 99.9% Chance of Correct Trip

AND
Restricted Siemens AG 2013 All rights reserved.

AND

AND

Implementing 2 of 3 is Not difficult

C
Details:
On Loss of Relay, Revert to 1/2 or 2/2?
Use Contacts or Logical Derivation?
Use Same or Different Relays?

Restricted Siemens AG 2013 All rights reserved.

Page 12

What Does It
Mean to be
Different ?
Voting Must be
Different to
Count
Restricted Siemens AG 2013 All rights reserved.

Human Error and Training


Considerations
Settings and Calculations
Different Schemes
Operations
Maintenance
Relay Out-of-Service

Restricted Siemens AG 2013 All rights reserved.

Testing Changes

Test of Relay Modifies


Scheme Logic
Voting Logic is Part of
System Test

Restricted Siemens AG 2013 All rights reserved.

Questions to Ask
How Many False Trips per
Year are Acceptable?
What is the System Cost of a
False Trip Coupled with a
Correct Trip? Is This
Condition Modeled
Restricted Siemens AG 2013 All rights reserved.

Conclusions

Two of Three Voting can Reduce False Trips


Significantly
Costs of Voting Schemes are 15% of Dual
Schemes 35 Years Ago

Restricted Siemens AG 2013 All rights reserved.

Sometimes the questions


are complicated and the
answers are simple
Dr. Suess

Restricted Siemens AG 2013 All rights reserved.