Protection coordination and grading — why a correct relay can still be wrong

Protection has two jobs that pull against each other. It must clear a fault quickly enough to limit damage and danger, and it must clear only the part of the system the fault is on. The second job is coordination, or grading, and getting it right means deliberately making some devices slower than they could be.

That trade is why protection is an integrity problem rather than a design problem that was solved once. The settings that achieve it are correct for a particular system, and the system does not stay still.

A protection relay withdrawn from its case and standing on a workshop bench with its circuit boards exposed, a secondary injection test set beside it with test leads made off, and a clipped sheaf of settings sheets held down on the bench. — The relay is the easy part. What makes the scheme correct is the paper beside it, and whether that paper still describes the plant outside.

What grading actually is

Every protection device has a time-current characteristic: the bigger the current, the faster it operates. Grading means arranging the characteristics so that for any fault, the device nearest the fault operates first, with enough time in hand that the one above it has not started to operate.

Two time-current plots on logarithmic axes. In the first, the downstream device curve sits below the upstream one with a clear vertical grading margin at the prospective fault current, so the downstream device clears first and only its circuit is lost. In the second, the same two curves are shown after the supply transformer has been uprated, the fault current has moved to the right, and at that higher current the curves have converged so the margin has gone and both devices operate together. A panel lists four routine changes that invalidate a grading study without any relay being touched. — Nothing on either relay changed between the two plots. The system did.

The vertical gap between the two curves at the fault current is the grading margin, and it is not spare time. It has to contain:

the downstream breaker’s own clearing time, typically 50 to 100 ms;
the upstream relay’s overshoot — it continues to move for a short time after the current has gone;
the combined errors of both relays and both sets of current transformers;
a safety allowance on top.

Typical margins of 0.3 to 0.4 s between devices come out of adding those up, not out of tradition. When a scheme is trimmed to look faster, the error allowance is what gets spent.

Why the curves are inverse

A standard inverse, very inverse or extremely inverse characteristic from IEC 60255 has two useful properties. It is fast at high current, where damage happens quickly, and slow at low current, where an overload may clear itself. It also keeps curves apart over a range of currents, which a fixed definite-time scheme does not.

The extremely inverse curve exists mainly to grade against fuses and against the thermal curve of a transformer. The practical rule is that devices grade most reliably against each other when they share a curve shape, and that mixing shapes in a chain — a fuse, then an extremely inverse relay, then a standard inverse one — is where the coordination gets difficult and where plotting rather than arithmetic becomes necessary.

The four changes that quietly break it

A grading study is calculated at a prospective fault current. Change that current, or change a device, and the study is about a system that no longer exists.

A larger or stiffer supply. Replacing a transformer with a higher-rated or lower-impedance one raises the fault level. Both operating points move right, into the flatter part of the curves where the separation is smallest.

A new source. A generator installed for backup, or a large motor added to a board, contributes to the fault. The contribution during the first cycles is substantial, and on a plant where the generator can run in parallel it changes the whole picture.

A lower-impedance route. A cable replaced with a larger section, or a run shortened during a modification, raises the fault current at the downstream board. This one is almost never recognised as an electrical change at all — it goes through as a cabling job.

A device replaced. A numerical relay set to the identical published curve does not behave identically to the electromechanical one it replaced, because overshoot, reset characteristic and accuracy at low multiples of setting differ. At two or three times setting those differences are a real fraction of the margin.

Grading, arc flash and the direction of the trade

Incident energy in an arc flash is roughly proportional to the duration of the arc, which is the clearing time that the grading has set. So the two studies are the same calculation read for different purposes, and they want opposite things.

Improving selectivity means slowing the upstream device. Slowing the upstream device raises the incident energy at the board it protects, which shows up as a higher PPE category on the label and, at the extreme, as equipment that cannot be worked on live at all.

That tension is resolved with engineering rather than by choosing a side — zone interlocking, a maintenance setting switch that temporarily removes the grading delay while someone is working at the board, differential protection that is inherently selective without a time delay, or current limiting devices. What it cannot be resolved by is each study being produced by a different consultant and filed in a different place. See arc flash and electrical safety.

Earth fault grading is the harder half

On a resistance-earthed industrial system the earth fault current is deliberately limited, often to a few hundred amperes, specifically to limit damage at the fault. The consequence for grading is that the ratio between the smallest earth fault worth detecting and the largest possible one is small, so inverse curves have very little room to separate.

Sensitivity then runs into standing unbalance and cable charging current, which is why earth fault settings end up as a compromise, and why schemes on larger systems move to directional or differential methods rather than trying to grade sensitivity alone.

What an integrity check on protection looks like

The verification that matters is short, and it is mostly a documentation exercise:

Does the single line diagram match the plant? Everything else depends on this, and on a plant twenty years old it is usually the weakest document. See distribution and the single line diagram.
Does each relay’s actual setting match the current study? Read them from the relays, not from the study. Where they differ, find out which is right before changing either.
What has changed since the study was issued? Transformers, generators, large motors, cable replacements, relay replacements. The date on the study against the dates of the modifications is the whole question.
Has each relay been injection tested against its setting, and has the chain been primary injected? A relay that is set correctly and wired through a reversed CT is not protection. See switchgear, transformers and protection testing.
Is the arc flash study built on the same clearing times? If the two documents disagree, one of them is being relied on by somebody.

Where this goes next

Switchgear, transformers and protection testing — proving the chain the settings act through.
Arc flash and electrical safety — the other half of the clearing time calculation.
Distribution and the single line diagram — the document the study is built on.
Transformer condition monitoring — the asset that most often changes and invalidates the study.