23rd International Conference on Electricity Distribution Lyon, 15-18 June 2015

Paper 1431

FRAMEWORK FOR PROCESS BUS RELIABILITY ANALYSIS

Carlos DUTRA Lucas OLIVEIRA Sérgio ZIMATH

Alstom Grid – Brazil Alstom Grid – Brazil Alstom Grid - Brazil
[email protected] [email protected] [email protected]

because power system professionals are not so confident

ABSTRACT about using Ethernet networks to transmit information
Several pilot projects related to the Process Bus are which is critical to the system secure operation. Different
network approaches provide different reliability levels. In
being executed with the main goal to certify the reliability this paper, the reliability of different topologies is
of the network as the mean to transmit information which obtained by using a methodology for creating models
is critical to the integrity of the protection system. This based on the reliability of each element that makes up the
paper presents a methodology to evaluate the process bus structure of the whole network communication, from the
reliability based on the reliability model for various measuring elements (merging unit) up to the command to
network topologies. Considering the MTBF of the the drive (protection relay). Based on the estimation of
elements of the protection system, the reliability level of the MTBF (Mean Time Between Failures) of each
the whole system was determined and the results were element of the network, the reliability of the system is
analyzed. obtained, and it is possible to evaluate the effect of the
redundancy.
INTRODUCTION RELIABILITY
In the power sector the system security is vital to keep the
stability in energy supply to consumers. Traditionally, A widely accepted definition of reliability is that it is the
protection engineers are conservative with respect to probability of a device performing its function properly,
preserving the integrity of all the elements that make up for a certain period of time, under given operating
this system. Depending on the voltage levels in conditions [6]. The use of redundant systems has been
substations, the use of redundancy in protection schemes considered in several situations. According to [7],
is used to mitigate the risks of problems [1]. redundancy is the existence of more than one means to
perform a given function. This consideration is closely
In conventional substations, every device in the relay linked to reliability and suggests an improvement in the
room, such as protective relays and digital fault recorders, conditions of the system being analyzed.
has its own acquisition system. All the cables from the
switchyard (including those from the instrumentation
transformers), are directly connected to the analogue The methodology to provide the reliability level of the
inputs of these devices. IEC 61850 [2] process bus has protection system is based on the creation of reliability
changed this approach. The network is being considered models that relates the individual reliability of all the
as the means of data transportation from the switchyard units that compose it. Considering these models,
to the relay room [3]. Both utilities and system integrators quantitative levels of reliability of the whole system is
recognize the benefits and the economic viability of using obtained. Depending on the complexity of the system,
Ethernet communication network to interconnect different approaches can be used to provide the reliability
Intelligent Electronic Devices (IEDs) inside the
model of the system. Some methods are shown as
substation control house. IEC 61850 considers this level
of communication as the Station Bus. follows.
Block Diagrams
In addition to the Station Bus, IEC 61850 considers
another level of communication, namely, the Process In block diagram models each block represents a unit. In
Bus. The Process Bus is intended to replace most of the the series configuration, all the units must work normally
copper cables used in conventional installations to for the system success. For independent failing units, the
connect field devices, such as instrument transformers, reliability of the m-series system is shown in figure 1a. In
circuit breakers, etc., to IEDs by messages in a fiber optic the parallel configuration, at least one such unit must
communication network. Within this context, current and operate normally for the system success. The m-parallel
the voltage signals are sampled and converted to digital system reliability is shown in figure 1b. Mixed
values, which are then transmitted through the network in
standardized messages known as Sampled Measurement configuration considers the composition of the series and
Values, as described in IEC 61850-9-2 [4] and IEC 61869 the parallel models for creating a specific model.
[5]. This conversion is performed by a device called
Merging Unit (MU). Rs and Rps are the reliability level for the series and
parallel models, respectively and, Ri is the reliability level
The use of Process Bus in power systems has been for the i-th unit of the diagram.
considered the newest wave of technological evolution.
However, it has not been widely adopted yet, probably

CIRED 2015 1/5

 23rd International Conference on Electricity Distribution Lyon, 15-18 June 2015

Paper 1431

inherently short, these cables were not considered in the

analysis. For simplicity, digital instrument transformers
won’t be considered in this study. As such, both the
conventional approach and process bus share the same
instrument transformers and their reliability is not part of
the models.
a) series configuration
In order to provide the reliability model for the
conventional architecture, the copper cables and the
protective relay were considered. The reliability model is
based on the series block diagram, shown in (1). In some
cases, the redundant protective relays are demanded to
enhance the reliability of the system. Two protection
relays with independent wiring have been considered.
The model considers a composition of series and parallel
b) parallel configuration
block diagrams, such model is shown in (2).
Figure 1 – Block diagrams.

Complex methods RS = RCC1* RRL1 (1)

RSR = [1 - (1 - RCC1* RRL1)*(1 - RCC2* RRL2)] (2)
More complex systems require more specific methods to
provide a reliability model. The fault tree is a deductive Where, RS, RSR, RCC1, RCC2 and RRL are the reliability
system analysis by which the analyst postulates that the level of the protection system without and with
system could fail in a certain way and attempts to find out redundancy, copper cables that connects the switchyard
how the system or its components could contribute to this elements to the relays, and protective relays respectively.
failure. It represents the occurrence of an event by the Thus based on the communication architecture of each
relationship of a set of entities called “gates” and the scenario, a model related to the reliability of the
Boolean algebra between them. protection system in the process bus approach is
established, according to the following:
Another method is based on the Boolean logic tables.
Considering different scenarios, a logic table is created, Scenario 1: One merging unit, one relay and one
the conditions of success are determined, and the switch
probability of the occurrence of these scenarios is It is considered that a merging unit installed in the
calculated to provide the level of reliability of the system. switchyard and close to some field element, such as a
current transformer (CT), is connected to a protective
PROCESS BUS RELIABILITY MODELS relay through a switch. Both protective relay and MU are
The conventional protection systems, from the point of connected to this switch via a fiber optic cable. The relay,
view of interconnection between switchyard equipment the switch and the cable which interconnects them are in
and IEDs, are simple structures that are composed of the the relay room, while the MU is installed in an
protection relay which is installed in the control room and appropriate panel in the switchyard and the cables that
the cables that connect it with the switchyard elements. connect it to the relay room are housed in conduits
Regarding the level of reliability, the protection system is crossing the substation. Figure 2 illustrates this
related to the level of reliability of the wiring, instrument interconnection.
transformers, and protection relays. For the IEC 61850
Process Bus, different topologies for the network can be
created with the final goal of realizing the interconnection
of multiple transmitters and receivers of data information.
For a more practical analysis, some scenarios that tend to
be more common choices for building the process bus are
considered.
Figure 2 – Network topology for a simple process bus.
The purpose of this paper is to analyze the reliability of
the protection system in order to compare the reliability To obtain the model of this topology, which is a very
of different topologies of the process bus and the basic process bus, the block diagram of a series model
conventional approach. For the analysis, the was considered. The reliability model for this scenario is
communication structures and the devices inserted in it shown in (3).
will be evaluated. Because of the length of the cables
from the switchyard elements to the merging units are RSIST=RMU1*RFO1*RSW1*RF02*RRL1 (3)

CIRED 2015 2/5

 23rd International Conference on Electricity Distribution Lyon, 15-18 June 2015

Paper 1431

Scenario 5: Two merging units (redundant

Where, RSIST, RMU1, RFO1, RF02, RSW1, and RRL1 are the acquisition) and two relays (redundant
reliability level of the protection system, merging unit, protection) with redundant Ethernet ports, two
optical fibers 1 and 2, switch and protective relay, switches
respectively.
Depending on the voltage level of the power line and the
Scenario 4: Two merging units (redundant element that is being protected, it is mandatory that the
acquisition) and one relay with redundant protection system consider a double measurement of
Ethernet ports, two switches voltage and current, so that there is a relay for primary
Performing the integration of the topology of Scenarios 2 protection and a backup in case of failure of the primary
and 3, one obtains a system that considers the redundancy one [1].
of MUs and communication structure. In this context, a Typically, in the conventional system, two independent
topology where the most vulnerable parts in the system sets of cables from the CT and the VT are taken to the
are duplicated in order to mitigate the risk of failure is relay room to be connected to each protective relay. An
presented. Two MUs measuring the same switchyard equivalent process bus topology considers the use of two
signals are interconnected to two switches installed in the MUs with redundant network ports connected to the
control room by a redundant link. A protective relay with switches by fiber optic cables. Protection relays with
redundant network ports and able to manage the redundant network ports are also connected to the
information from two merging units is connected to these switches and execute the protection functions by
switches. This topology is shown below. considering the concept of the primary and backup
protection scheme. Figure 6 shows this topology.

Figure 3 – Process bus with redundant acquisition and

redundant network architecture. Figure 4 – Process bus with acquisition and protection
redundancy.
In order to model this system the FTA method was used
considering a fault in the protection system as the event By using the FTA method, the reliability model of the
to be mapped. A fault tree consists of several levels of protection system was obtained considering the failure of
events connected by AND and OR logic gates. The the system as the event to be mapped. The resulting
resulting model was obtained by describing logically the model is show in (7).
set of possibilities of failure for all the units that are part
of the protection system being analyzed (MUs, network RSIST =
structure and relay). [1 - [1 - [[1 - ((1 - RFO1)*(1 - RFO3))]*[1 - ((1 - RFO5)*(1 -
RFO7))]*RSW1]] *
After substituting the logic gates diagram by [1 - [[1 - ((1 - RFO2)*(1 - RFO4))]*[1 - ((1 - RFO6)*(1 -
mathematical expressions, the result is the reliability RFO8))]*RSW2]]] *
model shown in (6). From this model it is possible to [1 - [(1 - RMU1)*(1 - RMU2)]] * [1 - [(1 - RRL1)*(1 -
obtain quantitatively the rate of failure of the protection RRL2)]]*
system described in this topology. [1 - [(1 - RFO1)*(1 - RFO2)*(1 - RMU2)]] *[1 - [(1 -
RFO3)*(1 - RFO4)*(1 - RMU1)]] (7)
RSIST=
[1 - [1 - [1 - ((1 - RFO1)*(1 - RFO3)*RFO5* RSW1)]*[1 - ((1 - Where, RSIST, RMU1, RMU2, RFO1, RF02, RF03, RF04, RFO5,
RFO2)*(1 - RFO4)*RFO6*RSW2)]]] * RF06, RSW1, RSW2, RRL1, and RRL2 are the reliability level
[1 - [(1 - RMU1)*(1 - RMU2)]] * of the protection system, merging units 1 and 2, optical
[1 - [(1 - RFO1)*(1 - RFO2)*(1 - RMU2)]] * fibers 1, 2, 3, 4, 5 and 6, switches 1 and 2, and protective
[1 - [(1 - RFO3)*(1 - RFO4)*(1 - RMU1)]] * RRL1 (6) relay 1 and 2, respectively.
Scenario 6: Ring network topology
Where, RSIST, RMU1, RMU2, RFO1, RF02, RF03, RF04, RSW1,
RSW2, and RRL1 are the reliability levels of the protection In the ring topology, the connection between different
system, merging units 1 and 2, optical fibers 1, 2, 3 and 4, IEDs is performed by direct and sequential links between
switches 1 and 2, and protective relay, respectively. devices, providing a connection in series and forming a
ring. In this topology there is no need to use a switch,

CIRED 2015 3/5

 23rd International Conference on Electricity Distribution Lyon, 15-18 June 2015

Paper 1431

because each device in the ring has two Ethernet ports RELIABILITY ANALYSIS
that behave equivalently to a switch, transferring packets
from one port to another, so that the data is going through Based on the previous section, different network
the ring according to the criteria established by the topologies imply different models of reliability. The
network protocol. To ensure the zero recovery time in reliability for the whole protection system depends on
case of failure of one element of the ring, the HSR each one of the elements that compose it. Each element
protocol (High-availability Seamless Redundancy) [8] is has a probability of failure which is a function of the
the alternative. characteristics of the project and the components that it is
based on.
For the study of reliability of the ring topology, a 6-IED
ring was assessed illustrating a protection system with The reliability of products is closely related to the MTBF
several devices connected in a single ring. This case (Mean Time Between Failure). This value depends on the
study considered the ring with three merging units and number of units analyzed and the time when these
three protective relays, forming a protection system for devices are in operation. Based on this information, it is
three bays as shown in Figure 7. possible to estimate the rate of failures of a piece of
equipment within a given period of time and, therefore,
the probability of failure or, in other words, its reliability
level [7]. The reliability of some electronic equipment
can be estimated according to (10).

R = e(-t/MTBF) (10)

Where, R, t and MTBF are the reliability level of the

equipment, the time interval for the analysis and the mean
time between failures for the equipment, respectively. For
a comparison of the reliability between different
architectures, the MTBF of each network element was
obtained in [9] and by surveying the manufacturers.
Based on that, the reliability level of each element was
established as shown in Table 1.
Element MTBF (yrs) Reliability
Protection relay 300 0,9967
Figure 5 – Three relays and three MUs in a ring topology. Merging unit 300 0,9967
Switch 100 0,9900
The methodology used for determining the reliability Copper cables 100 0,9900
model consists of mapping scenarios that identify the FO cables in the relay room 100 0,9900
behavior of the protection system considering that at least FO cables in the switchyard 100 0,9900
one merging unit can communicate with a protective Table 1 – Reliability for each element of the protection
relay. For this case study, a combinatorial analysis of the system.
elements that compose the protection system was
performed, the scenarios were mapped and the failure Considering the reliability of each element of the
hypothesis were evaluated. Equation (8) shows the model protection system and the topology model, the reliability
of reliability for the ring topology. of the entire system can be calculated. The MTBF can
vary from manufacturer to manufacturer and, therefore,
RSIST= [(RFO)6 * (RMU)3 * (RRL)3] + 6 * [(RRL)3 * (RMU)3 the reliability level used in the analysis. By using the
* (RFO)5 * (1 - RFO)] + methodology presented in this paper, new levels of
2 * [(RFO)6 * (RMU)3 * (RRL)2 * (1 - RRL)] + 2 * [ (RFO)6 * reliability can be verified.
(RRL)3 * (RMU)2 * (1 - RMU)] (8)
Protection systems based on conventional approach,
Where, RSIST, RMU, RFO, and RRL are the reliability level considering their models of reliability can provide the
of the protection system, merging units, optical fibers, reliability levels as shown in Table 2.
and protective relay, respectively. Performing similar Architecture Reliability
analysis considering a ring of three elements (two MUs No redundancy 0,9867
and one relay), the model of reliability is shown in (9). Primary and backup protection 0,9998
Table 2 – Reliability of conventional protection systems
RSIST=
[(RFO)3 * (RMU)2 * (RRL)] + 3 * [(RRL) * (RMU)2 * (RFO)2 * Considering the process bus approach, based on the
(1 - RFO)] + [(RFO)3 * (RRL) * (RMU) * (1 - RMU)] (9) reliability of each element of the network and the models

CIRED 2015 4/5

 23rd International Conference on Electricity Distribution Lyon, 15-18 June 2015

Paper 1431

of reliability for each topology, the reliability for the

protection system considering the scenarios presented in Assessing all topologies presented, it is observed that the
the previous section is shown in Table 3. higher the level of redundancy, the greater the reliability
Scenario Network topology Reliability level of the system. The redundancy in the network
1 1 MU, 1 RL, 1 SW 0,9639 structure makes the system more reliable, because it
4 2 MU & 1 RL (red Eth), 2 SW 0,9965 allows multiple paths for data transfer. The redundancy
5 2 MU, 2 R, 2 SW 0,9999 of devices makes the system less dependent of the
Ring with 6 IEDs 0,9911 integrity of the pieces of equipment that compose it.
6
Ring with 3 IEDs 0,9930
Table 3 – Reliability levels for the protection system Because of the characteristics of the IEC 61850-based
considering process bus approach protocols, the use of Process Bus naturally allows an
easier and continuous monitoring of the status of the
CONCLUSIONS devices in the network. Additionally, the replacement of
the devices becomes simpler because there are fewer
Compared to the process bus, a conventional protection cables connected to them. Another very important factor
system uses a smaller number of elements, such as the to be considered is the drastic increase in safety, since
protective relay and the copper cables that connect it to only the merging unit receives signals from a CT. This
the elements of the switchyard. Therefore the level of means the control room environment is not subject to the
reliability is intrinsically high. When considering the dangers of CT circuit interruption. Considering the results
protection scheme with redundant relays, the level of of the reliability levels and the non-quantifiable aspects
reliability is even higher. of the process bus, its use is very encouraging.

When the process bus approach is applied, the protection REFERENCES

system as a whole becomes more dependent on electronic
devices and their communication links. With a larger [1] S. Ward, et al, “Redundancy Considerations for
number of elements, naturally more vulnerable points Protective Relaying Systems”, IEEE PSRC, WG I
appear in the system and the level of reliability may 19 (2010)
decrease when compared with conventional architectures. [2] “IEC61850-SER ed1.0: Communication networks
It is clear however, that by including different kinds of and systems in substations - ALL PARTS” (2013)
redundancy in the system the level of reliability increases
drastically, ultimately surpassing the conventional [3] L. Hossenlopp, D. Chatrefou, D. Tholomier, D. P.
approach. Bui. "Process bus: Experience and impact on future
system architectures", CIGRE, paper B5-104
Scenario 1 shows the most basic architecture of process (2008).
bus. Since the reliability depends on all elements and [4] “IEC 61850-9-2 ed. 2.0: Communication networks
there is no redundant elements, this topology has the and systems for power utility automation - Part 9-2:
lowest level of reliability. In Scenario 4, both merging Specific communication service mapping (SCSM) -
units and protective relay support the redundancy Sampled values over ISO/IEC 8802-3” (2011)
protocol. Since each device is connected to two switches, [5] “IEC 61869-1 ed. 1.0: Instrument transformers -
there is a complete parallel way to provide data Part 1: General requirements” (2007)
communication between the IEDs, which makes the [6] R. Billinton, R. N. Allan, “Reliability Evaluation
structure of the network more robust, and, consequently, of Engineering Systems: Concepts and
increases the level of reliability of the protection system. Techniques”, Springer (1992)
The use of Process Bus considering redundancy of [7] A. Birolini, “Reliability Engineering, Theory and
measurements and network structure combined with Practice”, Fifth edition, Springer (2007)
redundant relays, as shown in the Scenario 5, provides [8] “IEC 61439-3 ed2.0: Industrial communication
the highest level of reliability, surpassing even the networks - High availability automation networks -
reliability of the conventional architecture with primary Part 3: Parallel Redundancy Protocol (PRP) and
and backup protection schemes. High-availability Seamless Redundancy (HSR)”
(2012)
The ring topology shown in the Scenario 6 for both 3 and [9] U. B. Anombem, H. Li, P. Crossley, R. Zhang and
6 IEDs presented high levels of reliability with fewer C. McTaggart, “Process bus architectures for
devices required, proving as a valid alternative to the PRP substation automation with life cycle cost
approach. It comes however at the cost of limiting the consideration”, 10th IET Int. Conf. on
amount of elements in that comprise the network and Developments in Power System Protection, 2010
may impose difficulties in scalability, being therefore
more suitable for small applications.

CIRED 2015 5/5