![](images/blank.gif) |
high availability electrical power distribution |
|
1. INTRODUCTION |
Operating dependability is a fundamental characteristic of all systems, installations and products. It is determined by design and use. Dependability describes the aptitude of a system to ¡ìoperate properly¡í throughout its service life. Proper operation implies: ¡á not breaking down (reliability), ¡á not experiencing dangerous failures (safety), ¡á being in good operating condition as often as possible (availability), ¡á being quickly repairable (maintainability). Whatever the system and the efforts implemented in its design and use, the level of dependability is a concrete reality. It must be: ¡á taken into account starting at the design phase, ¡á observed a posteriori: by counting the operating hazards that occur during installation operation.
Electricity, a modern source of energy, contributes to the level of dependability through the fact that it is needed for operation. Its availability, or rather its unavailability, has increasingly important consequences on companies¡¯ competitiveness: ¡á in industry, lack of power causes production losses, ¡á in the service sector, lack of power causes computer blockages and utility shutdowns (lighting, heating, lifts...).
The more complex the systems, the higher the risk that even a brief power failure will have major consequences.
Safety and availability have been particularly well developed and mastered in previous years in fields such as nuclear, military and space. Nowadays, energy availability is a definite concern with regard to intelligence, monitoring of the most widely varied systems and, to an increasing extent, with regard to the power supply of those same systems. Electrical power installations, especially those containing sensitive feeders, must be designed so as to limit the occurrence and consequences of failures in the public distribution network (referred hereafter in the booklet as the ¡ìmains¡í). |
|
2. designing a dependability system |
Beginning with a simple, minimal system, the design approach that has been adopted highlights the strong points and weak points of an electrical supply system, sometimes called a power station. The weak points are then reinforced: ¡á increased sturdiness and quality of constituents, ¡á redundancy of equipment (duplication, ¡ìtriplication¡í...). The design is therefore optimized with a view to chieving the required level of dependability: the effort employed in design concern only the weak points of the system. This approach necessitates the use of a rigourous design methodology together with dependability techniques. The design phase (cf. fig. 1) takes place in three stages: |
![](http://ground.co.kr/board/images/pds_tec/76_img_01.gif) |
¡á specifying, ¡á designing/constructing, ¡á demonstrating. The dependability of a system, based on specifications, is well illustrated by the very definition of dependability as used by task forces specialized in operating ependability, IFIP at the world level and EWICS at the European level: the Quality of the service supplied is such that the user has justified confidence in it. The design of a dependability system therefore requires that the expected service be specified (knowing the need), that this service be constructed (quality of design), and that it be demonstrated that the solution complies with the dependability specification (justified confidence). |
|
specifying |
Specification of dependability constraints enables the ¡ìtarget¡í to be identified and the right amount of effort to then be devoted to design. This stage has a decisive effect on the system. Specification can be based on: ¡á the history of ¡ìmalfunctions¡í in similar installations (existing power stations), ¡á standards (e.g. MIL) or recommendations, ¡á economic analyses establishing the cost of installation down time (direct and indirect consequences) as a result of failures, ¡á identification of the most dreaded events. Dependability is a generic concept encompassing four criteria: ¡á reliability, ¡á safety, ¡á availability, ¡á maintainability. Cahier Technique n¡Æ 144 ¡ìIntroduction to dependability design¡í gives, among other things, a precise, official definition of these terms.
Using these criteria, the ¡ìspecifier¡í establishes the dependability characteristics for his installation, based on these four criteria which are naturally quantifiable. Through dialogue with the customer, the most dreaded events are determined, together with the acceptable probability of the occurrence of such events according to the seriousness of the consequences thereof. |
constructing |
Once the dependability objectives have been established, the dependability system (¡ìhow to prevent the occurrence of failures¡í and how to master them) is ¡ìconstructed¡í. The means of doing so are listed below.
¡á quality: a dependability system is above all a quality system (failure avoidance) Quality must be taken into account at two levels: ¡à quality of design, so as to guard against design errors (project team, quality assurance manual, audits...), ¡à quality of constituents, so as to guard against failures (sturdiness, qualification).
¡á surviving failures (failure tolerance) The sturdiness and quality of the system are not sufficient criteria to guarantee its dependability. Certain functions are critical with respect to the assignment to be accomplished: the failure of a single component can bring about a loss of the power supply. The system must therefore be designed so as to respect dependability objectives in spite of the failures that may occur, this being generally achieved through redundancy or the use of special technology (example: failure-oriented logic in electronics). In order to survive failures, it is essential to detect the faulty function. It is then necessary to:
¡à orient the failures so that they do not affect the assignment (technological barriers), and then ¡à mask the failures through the parallel operation of several units (even though only one would suffice), thereby enabling operation to continue with equivalent (standby) equipment. In order to employ the right amount of effort in terms of failure avoidance and/ or failure tolerance, measurements or calculations of the efficiency of such arrangements are carried out to directly evaluate the design and adapt the system architecture to best fit the cost.
This approach is ¡ìconstructive¡í: the initial architecture is the simplest possible, minimal one (only ¡ìrelevant¡í functions are taken into account); the architecture is then enriched according to the results of the dependability evaluation so as to attain the target set during the specification stage. Two iterations, implementing the study phases described in figure n¡Æ 2, are generally needed to design a system to the dependability requirements.
¡á the first iteration consists of: ¡à consolidating the dependability requirements, ¡à establishing by means of a functional analysis method the simplest possible, minimal initial architecture, ¡à evaluating the degree of dependability of this architecture, ¡à proposing a certain number of corrective measures relative to the design so as to comply with the dependability requirements.
¡á the purpose of the second iteration is to: ¡à reassess the level of dependability of the ¡ìcorrected¡í architecture, ¡à conclude (or not conclude, in which case the process needs to be reiterated) upon the validity of the architecture with respect to the dependability objectives. |
demonstrating |
In order to achieve justified confidence, the customer must be given proof that the dependability level complies with the specified objective. This is done by means of two techniques: ¡á elimination of design-related failures: debugging, tests, environmental testing... ¡á prediction of failures so as to measure the risk (probability) incurred during the system operating life. Breakdown prediction involves dependability studies which, through modelling and evaluation, estimate thepresence, creation and consequences of failures. Predictive dependability studies are carried out using a set of modelling methods (FMECA - Failure Modes Effects and Critically Analysis method, failure tree, Markov graph¡¦). Quantitative evaluation is based on analysis of similar equipment having experienced problems in industrial operation and/or on the results of analyses recorded in reliability reviews (CNET, IEEE...). Dependability studies make it possible to achieve ¡ìjustified confidence¡í in the installation. In the simplest electrical power distribution diagram, with power from the mains (cf. fig. 3), the level of availability of one of the feeders cannot be higher than the network level. |
![](http://ground.co.kr/board/images/pds_tec/76_img_02.gif) |
Considering that a mains failure incorporates the following criteria: ¡á out-of-range voltage, ¡á phase loss, ¡á harmonic distortion (in the case of power supply for sensitive systems such as electronic systems).
The average level of unavailability of the French Electricity Board (EDF) mains is in the vicinity of a cumulative total of 7 to 8 hours per year (i.e. an unavailability rate in the range of 10-2 according to TDF observations), essentially due to the environment (e.g. storms). It is therefore evident that if one wishes (specification) to improve the level of unavailability, to 10-4 for instance, it is necessary to provide for an architecture that is more than a mere radial feeder system, and more like an mprovement on the basic diagram as illustrated in figure n¡Æ 4. |
![](http://ground.co.kr/board/images/pds_tec/76_img_03.gif) |
3. description of a ¡ìbacked-up¡í installation |
distribution circuits (cf. fig. 4) These circuits comprise ssentially: ¡á in Medium Voltage: ¡à protection for the Medium Voltage (MV) incoming feeder, ¡à MV/LV transformer; ¡á in Low Voltage: ¡à a main circuit breaker that protects the switchboard as a whole and eliminates the risk of inadvertent connection of the diesel generator set to the mains, ¡à equipment for the protection of people and property against insulation faults; ¡á feeder group power circuit breakers that distribute power, these breakers: ¡à opening each time there is a power source changeover, ¡à closing simultaneously if supplied by the mains, ¡à closing in sequence if supplied with back-up power by the generator; ¡á a power source changeover (mains/ generator) controlled by the mains/ standby voltage monitoring relay; ¡á power source changeover that switches to the short time back-up source (UPS), generally a static contactor. |
![](http://ground.co.kr/board/images/pds_tec/76_img_04.gif) |
diesel generator set (cf. fig. 5) This equipment includes: ¡á a diesel power motor suited to the power needs of the application. It is equipped with auxiliary circuits: ¡á a starting circuit including one or two starting chains (cf. chap. 4 ¡× ¡ìchoosing technologies¡í); each comprising a starter and a battery with a charger; ¡á a gas oil circuit including: - a so-called ¡ìdaily¡í tank, with a maximum capacity of about 500 litres (depending on the generator power rating), - an outside tank with a capacity calculated according to the maximum required motor autonomy, |
![](http://ground.co.kr/board/images/pds_tec/76_img_05.gif)
| |
- an automatic gas oil pump backed by a hand pump enabling the daily tank to be filled from the outside tank. This pump is not necessary if the daily tank is installed above the motor at a height calculated according to the pressure imposed by the injection circuit; ¡à a pre-lubrication and lubrication circuit fitted with an oil reservoir calculated according to the motor autonomy chosen in order to fulfil special Electricity Board peak consumption compensation tariff requirements; ¡à an air or water cooling circuit depending on the type of motor. In the case of air-cooled generators, the motor is cooled by a fan driven by the motor shaft, either directly or by belts. In the case of water-cooled motors, the inclusion of an exchanger (primary and secondary circuit) and an air cooler entail the use of circulation pumps and a fan.
¡á a power alternator suited to the need, fitted with a voltage regulator. The alternator reactance rates should comply with the type of load (reactive, capacitive, electronic system...). For example, an application comprising 50 % of the load in the form of uncoupling battery rectifier-chargers entails the use of an alternator with a subtransient reactance rate of about 8 % in order to limit voltage distortions. |
|
power source changeover devices |
These devices make it possible to ¡ìswitch to¡í the diesel generator set. Aside from mains losses, switching or coupling can prove to be necessary in the two following cases: ¡á failure of the ¡ìshort-term¡í back-up source with the mains on,
¡á detection of a mains anomaly (frequency, wave form, out-of-range rms value). In both cases, temporary coupling to the mains prevents power cuts due to generator takeover time. |
|
¡ìshort-term¡í back-up (UPS) |
This function, comprising the ¡ìUninterrupted Power Supply¡í (UPS), is fulfilled by one or more UPS with unit power of 40 to 800 kVA or more, equipped with a control-monitoring device, a battery and a diagnostic device that communicates via an asynchronous link. These types of UPS can be installed in parallel. Battery autonomy should be sufficient (cf. table in figure n¡Æ 6) to supply power to the application during the time required for the generator to takeover as the long term back-up source. This takeover sequence includes: ¡á mains actually out : 20 s ¡á generator starting taking into account a startup at the last attempt : 50 s ¡á Mains/Standby changeover (load shedding, then changeover) : 20 s ¡á restoring of priority circuit breakers : 210 s for a total sequence time of 5 minutes (100 s for the highest priority feeder). |
|
electronic controlmonitoring system |
This system is a federation of electronic control or monitoring units (CU), each of which runs one of the main installation constituents (generator, source changeover,...). These CU are combined with one or more supervision units (SU) which enable man-process dialogue but donot play a direct active role in the system. |
|
operating criteria |
A distribution system of this type, with a service life of 20 years for example, should ensure the electrical power supply when the following mains faults occur: ¡á mains loss, ¡á out-of-range mains voltage, ¡á out-of-range phase unbalance. Furthermore, it should also fulfil utility tariff constraints such as: ¡á peak consumption compensation, ¡á additional power beyond subscribed power.
The operation of each item of equipment comprising the station is linked to its role in the station and is defined as follows: ¡á out-of-range mains voltage, ¡à the diesel generator set operates as follows: |
- mains failure |
: 200 h/y |
- tariff constraints |
: 400 h/y |
- testing |
: 50 h/y |
|
|
i.e. maximum cumulative operation total : |
650 h/y | |
¡à the low voltage switchboard operates as follows: - standby position : 8 % of the time - mains position : 92 % of the time ¡á the ¡ìshort-term¡í back-up source takes over: ¡à during very brief power cuts (microcuts) that vary in number depending on the power supply network and the environment, ¡à during the phase in which the diesel generator set takes over the power supply, to which must be added low voltage switchboard switching times. 10 minutes¡¯ autonomy is ordinarily required of batteries at the end of their service life, 5 minutes being the minimum, ¡à during battery test cycles. Very brief in duration, these are negligible in relation to the takeover phases.Maintenance time should be provided for. The selected availability guarantee is also linked to repair time. These times and the related means depend on the chosen level of dependability. |
![](http://ground.co.kr/board/images/pds_tec/76_img_06.gif) |
|
search for and identification of weak points |
The minimal basic architecture is analyzed, taking into account: ¡á feedback on experience from various sources, ¡á failure rates established by manufacturers and standardization bodies such as IEEE, MIL and CNET which allow the weak points of this type of installation to be established. The failure probabilities for the main constituents of the installation, expressed in terms of the number of minutes of failure per year, are for example: ¡á MV mains = 450 mn/y, ¡á LV switchboard = 90 mn/y, ¡á diesel generator set = 360 mn/y, ¡á short-term back-up = 150 mn/y. The ¡ìweights¡í that the components of each of the above bear on unavailability are as follows: |
|
¡á main low voltage switchboard |
|
¡à power source changeover : |
65 % |
¡à distribution equipment : |
25 % |
¡à auxiliary and control-monitoring : |
10 % |
|
|
|
100 % | |
¡á diesel generator set |
|
¡à starting chain : |
65 % |
¡à cooling circuit : |
8 % |
¡à fuel circuit (gas oil pump) : |
7 % |
¡à generator load takeover : |
6 % |
¡à generator environment (e.g. temperature) : |
6 % |
¡à auxiliaries + control-monitoring : |
8 % |
|
|
|
100 % | |
¡á short-term back-up |
|
¡à rectifier and frequency converter |
35 % |
¡à batteries |
55 % |
¡à auxiliaries |
10 % |
|
|
|
100 % | |
It is easy to observe that the three ¡ìsensitive constituents¡í are: ¡á the LV switchboard power source changeover, ¡á the generator starting chain, ¡á the short-term back-up battery. |
| | |
|
![](images/blank.gif) |
|