Sepam - HV/MV Protection and control units (ENG) - Trinet

General characteristicsDependabilityThis chapter presents the main definitionsof dependability and how it is taken into considerationin Sepam 2000, an analysis of the experience gainedfrom feedback on the installed equipment baseand the maintenance of Sepam 2000.DefinitionsThe definitions which follow are the main definitionsof dependability applied to protective devices:c The reliability of a protective device is its capabilityof performing its function (or functions) over a givenperiod of time in the operating conditions specified bythe manufacturer, i.e. mainly the capability of trippingwhen required and the capability of not tripping whenunwanted.c The maintainability of a protective device is mainlyits capability of being easily repaired whenmaintenance personnel dispose of the meansprescribed by the manufacturer.c The availability of a protective device is itscapability of being in a state to perform its function (orfunctions) at a given point in time in the operatingconditions specified by the manufacturer.These values do not necessarily have the samemeanings, depending on whether they are consideredfrom the viewpoint of the protective device or theelectrical installation.The availability and maintainability of the protectivedevice contribute to the safety of people andequipment. The reliability of the protective devicecontributes to the uninterrupted availability of thepower supply.Dependability needs:a trade-off betweentwo unwanted eventsThe mission of protection systems used with circuitbreakers is to guarantee the safety of the installationwhile, at the same time, ensuring the best levelof interrupted power supply.For Sepam 2000, this mission is conveyed by twoevents, the target occurrence of which should bezero.c First unwanted event:unwanted tripping of the protective device.An uninterrupted power supply is essential for bothindustrialists and utilities. Unwanted tripping dueto the protective device is liable to generatesubstantial financial losses. This event can beavoided by improving the reliability of the protectivedevice.c Second unwanted event:failure of the protective device to trip.The consequences of a fault that is not cleared areliable to be disastrous. For the sake of operatingsafety, the protective equipment must detect powersystem faults selectively and as quickly as possible.This event can be avoided by improving theavailability of the protective device.Consideration of dependabilityin Sepam 2000By the same token as electromagnetic compatibility, dependability is taken intoconsideration right from the start of the development of Sepam 2000.A Preliminary Risk Analysis (PRA) is used to list the unwanted events linked to thedifferent functions performed by Sepam. Quantified dependability targets are setin accordance with the main unwanted events revealed by the PRA.Specialized dependability assessment and modeling techniques are used tointerpret the targets in terms of design requirements.c The predicted reliability analysis determines the failure rate of each Sepam 2000component in use-related conditions. Compendiums of reliability data such as theMilitary Handbook 217 (MIL HDBK 217) and the CNET RDF93 are used for this.c The Failure Modes, Effects and Criticality Analysis (FMECA) analysis is used toanalyze the effects of a simple component failure on the Sepam 2000 functionsand to list the means available to detect them. The FMECA makes it possible tocorrect certain risks of malfunctions and specify the self-monitoring functions.c The unwanted events are modeled to calculate the probability of their occurrenceand to check that the dependability targets are being met.A large share of the functions of digital protective equipment devices areperformed by the software. It is therefore essential to master the quality of thesoftware in order to attain the overall dependability targets. Software quality ismastered by the implementation of a rigorous development method.This method is derived from the recommendations set by the French (AFCIQ) andinternational (IEEE) quality authorities. It stipulates:c the breakdown of development into a series of phases,c the use of design and encoding rules and methods aimed at achieving a highlevel of software structuring,c the use of software configuration management tools which allow all the softwarecomponent parts to be managed.Self-monitoring functionsand fail-safe positionSepam 2000 units are equipped with self-monitoring functions (self-tests),which detect internal failures. The failures are classified in two categories:major failures and minor failures.c A major failure affects the system’s common hardware resources(e.g. program memory and working memory).Sepam 2000 is no longer operational. This type of failure may or may not lead toMV fault tripping or unwanted tripping, in which case Sepam 2000 must reactquickly and go into the fail-safe position.The fail-safe position is characterized by:v lockout in neutral position of the Processing Unit,v an indicator lit up on the front of the device,v a message on the display,v the Watchdog relay in fault position (deactivated),v the relay outputs (logic outputs) in the deactivated position,v a break in the relay output supply for Sepam S46.c Following a minor failure, Sepam 2000 is in downgraded operation.It can continue to carry out all of its protection functions if the functions affectedare peripheral ones (display, communication).This classification of failures makes it possible to obtain a compromise betweenbetween a high level of safety and a high level of availability.The self-tests performed in Sepam 2000 are summarized in the diagramon the next page.3/4D21 - D22 - D31 - Installation - Use - Commissioning