Return to Session Directory

Authors Name

Name of the Paper

Session

DYNAMIC POSITIONING CONFERENCE

October 12-13, 2010

NEW APPLICATIONS SESSION

DP Power Plant
Open Bus Redundancy With Reliable Closed Bus Operation
By Saurabh Shah and Kamal Garg
Schweitzer Engineering Laboratories, Inc., Pullman, Washington, USA

Saurabh Shah

New Applications Session

Abstract
Closed bus-tie operation of power plants
provides superior tolerance for dynamic
positioning (DP) power plant faults. However, a
vessel operating with closed bus-tie breakers is not
guaranteed to retain thrusters during certain types
of power system failures. In these situations, rapid
recovery of equipment is critical for meeting DP2
and DP3 minimum requirements of stationkeeping. Open bus ties are often used when rapid
recovery is inadequate to meet operational needs
and retention of thrusters is necessary. Operating
with open bus ties reduces overall power plant
reliability but maintains availability of thrusters
during any equipment fault.
This paper presents a design that can provide the
desired reliability of closed bus-tie operation while
providing nearly the same thruster retention
capability as open bus-tie operation. Using
advanced fault detection and plant management
techniques, faults that would typically result in the
loss of all thrusters on a closed bus-tie power plant
can now be handled such that sufficient thrusters
remain operational to continue DP operations even
after the fault.
Power plant reliability is critical for the
operation of DP vessels. DP vessel power plants
are islanded power systems with four to eight
generators operating in droop modes with total load
demands commonly exceeding 50 MW. There are
several common failure modes of the engine,
synchronous machine, governor, and exciter
systems that cause a complete blackout of the
onboard power system. In the past, the offshore
drilling industry has experienced single undesirable
electrical system outages (blackouts) that have
resulted in revenue losses of millions of dollars.
This makes a reliable electrical power system
protection and control package critically important
for offshore vessels.
This paper explains several critical protection
areas for offshore vessels and the failure modes
currently affecting these vessels, including failure
or misoperation of generator exciters and
governors, islanding of defective generators, and
fast fault detection and clearing in electrical
machinery. The criticality of designing complete
systems for simplicity, robustness, maintainability,
testability, local support, ease of commissioning,
longevity, and availability is also explained.
DP Conference Houston

DP Power Plant

This paper concludes with a design discussion of

a protection and control system for offshore vessels
using the latest technology and development in the
area of protection and control. This includes a
detailed design discussion of a proposed system for
a DP vessel. A discussion of improving the
reliability of a power plant, including an overview
of the communications architecture, hardware
designs, and visualization system, is also provided.
Additionally, the paper discusses the enhancement
of the system design and many additional
technological
enhancements
previously
unavailable, such as real-time system monitoring,
harmonic analysis, advanced visualization, ultrahigh-speed protection, IEC 61131 programming,
synchrophasors,
IEC 61850,
and
modern
communications protocols. This paper also
addresses the importance of reliability.
Index
TermsOffshore
vessel,
power
management system (PMS), load shedding,
common-mode
failure, harmonic
analysis,
advanced generator protection, IEC 61850, Generic
Object-Oriented Substation Event (GOOSE),
exciter, governor, automatic transfer, black start,
synchrophasor, arc flash, automatic synchronizer,
decoupling, real-time digital simulations.

I. Offshore Platforms and History

An offshore platform is often referred to as an
oil platform or oil rig that houses workers and
machinery needed to drill wells in ocean beds to
extract oil, natural gas, or both. Around 1891, the
first submerged oil well platforms were built in the
fresh water of Grand Lake St Marys in Ohio. In the
early 1930s, the Texas Company developed the
first mobile steel barges for drilling.
The two main types of drilling platforms are
fixed and floating. Floating platforms have various
degrees of compliancy. Neutrally buoyant
structures (i.e., semisubmersibles, spars, and
drilling ships) are dynamically unrestrained and
can have six degrees of freedom (heavy, surge,
sway, pitch, roll, and yaw). Positively buoyant
structures, such as tension leg platforms and
tethered buoyant towers or buoyant leg structures,
are tethered to the sea bed and are heavily
restrained [1].

October 12-13, 2010

Page 1

Saurabh Shah

New Applications Session

DP Power Plant

II. Typical Offshore Platform and

Protection System
A. Electrical System
Fig. 1 shows a typical dynamic positioning (DP)
offshore system one-line diagram of a power plant
on an ultra-deep-water drilling rig. In this example,
the vessel has six main generators rated at
5.37 MW each, six to eight bow or stern thrusters
rated at 2.3 MW each, and variable-frequency
drives to operate the system. There are two main
11 kV buses connected via the bus-tie breakers that
are sometimes operated normally open. Grounding
transformers are provided at both main 11 kV
buses. Each 11 kV main bus supplies power to a
600 V bus for drilling.
Fig. 2

6 5,375 kVA
Grounding
Transformer

11 kV Bus A

11 kV Bus B
11 kV Thruster
Bus B

11 kV Thruster
Bus A
VFD VFD VFD

VFD VFD VFD

Thrusters 3 5,000 hp

Thrusters 3 5,000 hp

Drilling Bus A

600 V

Drilling Bus B

600 V

VFD = variable frequency drive

Fig. 1

Simplified Electrical System Example 1

The thrusters may have dual feeds that can draw

power from both buses. The 11 kV bus is a radial
bus with a bus-tie breaker that is fully insulated to
provide protection against short circuits. However,
for some offshore platforms, generation voltage
can be 4.16 kV. An example of this type of vessel
is shown in Fig. 2.

DP Conference Houston

Simplified Electrical System Example 2

B. DP Vessel Class
A DP vessel is a unit or vessel that automatically
maintains its position (fixed location or
predetermined track) exclusively by means of
thruster force and includes components such as
power systems, thrusters, and DP control systems.
A DP system consists of components and systems
acting together to achieve a sufficiently reliable
position-keeping capability. The necessary
reliability is determined by the consequence of a
loss of position-keeping capability. The larger the
consequence, the more reliable the DP system.
There are four major classes of DP vessels, as
shown in Table I.
TABLE I
DP VESSEL CLASS SUMMARY
Class

(A)
Consequence

(B)
Operator
Impact

(C)
Redundancy

Catastrophic

Immediate

No
redundancy

Critical

Moderate

Reduced
redundancy

Serious

Observational

Redundant

Minor

n/a

n/a

October 12-13, 2010

Page 2

Saurabh Shah

New Applications Session

Different DP vessel classes have different types

of system redundancy in operation. Redundant
components and systems should be immediately
available with such capacity that the DP operation
can continue until the work in progress is
terminated safely. The transfer to a redundant
component or system should be as automatic as
possible, and operator intervention should be kept
to a minimum. The transfer should be smooth and
within acceptable limitations of the operation. For
Equipment Class 1, loss of position may occur in
the event of a single fault. For Equipment Class 2,
a loss of position is not to occur in the event of a
single fault in any active component or system.
Class 2 single-failure criteria include:
Any active component or system
(generators, thrusters, switchboards, or
remote-controlled valves).
Any normally static component (cables,
pipes, or manual valves) that is not properly
documented with respect to protection and
reliability.
For Class 3, a single event may include static
components.
Class 1 Consequence (Catastrophic): A failure
due to major system failure that causes total loss of
DP capability regardless of any limitations put on
the vessel. This means a loss of station-keeping
ability, leading to an excursion, drive off or drift
off from position, and an immediate termination of
the operation.
Class 2 Consequence (Critical): A failure due to
major system failure that causes loss of DP
capability if operational limitations are not adhered
to. This includes loss of redundancy where a
further failure may cause a loss of position.
Class 3 Consequence (Serious): A failure that
affects operational capability but does not result in
termination of the operation.
Class 4 Consequence (Negligible): A failure that
has a negligible effect on the system or subsystem
level, generally at the component level, and results
in a minor unscheduled repair consequence.
C. DP Power Systems
DP power plant systems are different than utility
power systems, which consist of many generators
and transmission lines, shown as the Utility source
and transmission line XL in Fig. 3. The local
generation and load, which are small compared to
Utility, are shown as Local. However, in the case
DP Conference Houston

DP Power Plant

of DP offshore vessels, the power system consists

of local generation and load only. This type of
power system is defined as an islanded power
system when there is no connection to the utility or
grid and local generation is the only power source
for loads.
EB B

E A A

Fig. 3

P=

E A EB
sin ( A B )
XL

Q=

EB
E A cos ( A B ) EB
XL

Simplified Utility Power System

For the utility power system, the power flow

between the Local and Utility sources depends
upon the angle between the two systems and line
impedance, as shown in Fig. 3. Fig. 4 shows that as
load increases, the power flow increases until the
internal angle () difference is 90 degrees (refer to
the power flow curve). The utility system, as
shown in Fig. 3, is more stable in comparison to
the islanded system and can ride through various
system transient conditions because the larger
inertia of a utility system is inherently stable for
small disturbances. However, there may be local or
inter-area oscillations if the local generation is
weak and connected via long lines or a weak
network.
Pe

Pm1

Pm0

Fig. 4 Power Flow Example

Because DP offshore platforms are islanded

power systems, the reliability of power plant

October 12-13, 2010

Page 3

Saurabh Shah

New Applications Session

operation is very important. A single outage can

result in millions of dollars in revenue loss. For DP
vessels, system inertia is relatively small, and even
short system disturbances may result in the system
becoming unstable. Detailed dynamic studies are
required for various system configurations, and
critical clearing time (CCT) should be determined.
In some cases, special protection schemes are
required to island the faulty section or shed load.
D. Closed Bus Operation and Motor Bus Transfer
Closed bus-tie operation of power plants
provides superior tolerance to DP power plant
faults. However, a vessel operating with closed
bus-tie breakers is not guaranteed to retain thrusters
during certain types of power system failures. The
proposed solution discusses DP vessels with a
normally closed bus-tie breaker. The critical load
on DP vessels is the thruster load. High-speed bus
protection detects the fault and islands the faulty
bus section in less than 5 cycles, including the
breaker operating time. For a fault in any other
section or equipment, the respective protection
islands the system as soon as possible. However, it
is possible that depending upon the severity of the
fault, critical loads (i.e., thrusters) may drop out for
the fault. Hence, to improve system reliability, it is
required to reconnect and re-energize the thrusters
as soon as possible in order to restore the system
and critical loads. The following sections discuss
various bus transfer schemes and a proposed
solution for DP vessels.
Motor bus transfer (MBT) schemes are very
popular for power plants. To maintain process
continuity, motor buses may require transfer from a
present source to a new source. The reasons for this
may be fault clearing on the present source,
deliberate transfer from a utility source to an
on-site source during storm periods or for rate
savings (and back to utility power at a later time),
and de-energization of the present source for
maintenance or construction. During the MBT
schemes,
electric
motor-driven
equipment
decelerates because power sources are removed.
The deceleration rate depends upon the inertia of
drives and the synchronizing power flowing
between the motors due to trapped relative flux. As
the motor decelerates, the relative angle between
the power source and internal angle of the motor
increases. The motor flux decay depends upon the
motor time constant and power flow between
DP Conference Houston

DP Power Plant

motors. The decay rate of internal voltage depends

upon motor flux and motor speed, which are
functions of load torque, moment of inertia, and
real power transfer between motors. If the relative
angle is large at the time the breaker is closed, with
significant flux and resultant voltage, an inrush that
is larger than the normal inrush current may result.
These high currents can cause high-winding forces
and transient torques that can damage rotating
equipment.
Motors with adjustable speed drives (ASDs)
have different characteristics during the high-speed
bus transfer compared to motors without ASD.
Large ASDs typically have dc links, source-side
converters, and motor-side inverters. Because of
the pseudo isolation created by the dc links, the
drive system machines are not connected
synchronously to the rest of the system. ASD
machines are not usually subjected to severe
transient torque as a result of the transfer; however,
a detailed transient study should be performed to
verify the design of the fast transfer scheme.
The transfer schemes can be categorized as
follows:
Parallel or closed circuit
Fast simultaneous
Fast sequential
Residual
Long time
1) Parallel or Closed-Circuit Transfer
In a parallel transfer, the new source is
connected to the motor bus before the old source is
tripped. The intent is to transfer sources without
interruption. The phase angle and voltages from the
motor bus and the new source are evaluated prior
to the transfer to ensure that the motor bus and the
new source are in synchronism or the new source
lags or leads the old source by an acceptable
amount. This method is widely acceptable for
routine source transfers because transients on the
motor bus are eliminated. If the two sources are not
derived from the same primary source and a largestanding phase angle is present between them, the
opportunity for a hot parallel transfer is eliminated.
Assuming the two-source phase angle
relationship is acceptable and two sources are
paralleled, currents flowing into and through the
bus may violate the interrupt rating for the circuit
breakers and the short-term withstand ratings of the
source transformers. A fault occurring either on the

October 12-13, 2010

Page 4

Saurabh Shah

New Applications Session

bus or on one of the sources when the sources are

paralleled can overstress the components of the bus
system.
2) Fast Simultaneous Transfer
In a fast simultaneous transfer, a trip command
is issued to the present source breaker and a close
command is issued to the new source breaker at the
same instant. The phase angle and voltages from
the motor bus and the new source are evaluated
prior to the transfer to ensure that the motor bus
and the new source are in synchronism or the new
source lags or leads the old source by an acceptable
amount. The close command is unsupervised. This
is the fastest transfer type that does not parallel the
sources.
3) Fast Sequential Transfer
In a fast sequential transfer, the present source is
tripped, and as soon as the present source breaker
has started to open (typically indicated by an
early b contact), a close command is issued to
the new source breaker. The close command may
be supervised or unsupervised, depending on the
transfer method employed. This is the
second-fastest transfer type that does not parallel
the sources.
In order to make a rapid blocking decision,
specialized synchronism-check equipment should
be employed to make decisions on a moving phase
angle in the shortest time possible, typically 1 to
2 cycles. If the synchronism-check equipment
reacts too slowly, a transfer could be allowed when
the phase angle value is actually in violation of the
settings. An unsupervised fast sequential transfer is
faster than a supervised sequential transfer because
the supervised transfer process must include a
small delay to allow synchronism-check
measurement and possible transfer blocking to
occur.
4) Residual Transfer
In a residual transfer, the motor bus is connected
to the new source after the voltage on the coasting
motor bus falls to less than 0.25 pu. In this manner,
regardless of the phase angle value, the resultant
volts per hertz (V/Hz) will not exceed 1.33 V/Hz.

DP Conference Houston

DP Power Plant

This is the third-fastest transfer type that does not

parallel the sources. However, this transfer type
may not be fast enough to maintain process
continuity, because certain motor loads that cause
rapid stalling may necessitate a restart of the
motors on the bus.
5) Long-Time Transfer
In a long-time transfer, the motor bus is
connected to the new source after a time delay that
reflects that the voltage on the coasting motor bus
has fallen to less than 0.25 pu. In this manner,
regardless of the phase angle size, the resultant
V/Hz will not exceed 1.33 V/Hz. This is the
fourth-fastest transfer type that does not parallel the
sources. However, this transfer type may not be
fast enough to maintain process continuity, because
certain motor loads that cause rapid stalling may
necessitate a restart of the motors on the bus.

III. Proposed Solution

Fig. 5 shows the conceptual block diagram for a
DP offshore power management system (PMS)
protection scheme. The proposed scheme is dual
redundant, and two independent sets of local
protection are included to improve system
reliability [2]. Generator protection is included in
the local protection block, which communicates
with the generator control block. Local protection
devices communicate via direct fiber relay to relay
or via IEC 61850 protocol using Ethernet in the
system protection block. System Protection 1 and 2
are the hub of all the decisions for PMS control and
data exchange. The system protection processes all
of the relevant information from local protection
and provides control and decisions for the PMS. By
properly collecting, manipulating, and presenting
power system data as usable information, the
system enables operations, maintenance, and
engineering staff to diagnose system events, predict
equipment failures, and minimize unnecessary
maintenance. The proposed solution also guides
operators in making decisions, such as controlling
black start, manual override, and load shedding.
The solution includes a human-machine interface
(HMI) screen for system overview and control.

October 12-13, 2010

Page 5

Saurabh Shah

New Applications Session

DP Power Plant

GPS Satellite
System
Protection 2

Real-Time
Automation Controller

Synchrophasor
Vector Processor

Satellite Clock
Secure Remote
Access

HMI

Real-Time
Automation Controller

Power Management and

Control System

Synchrophasor
Vector Processor

Ethernet
Security Gateway
System
Protection 1

Control and
Status
Local
Protection 1

Generator
Protection
Relays

3
3

3
Relay

Relay

3
Relay

Relay

3
Relay

Relay

3
Relay

Relay

3
Relay

Relay

Relay

Relay

Local
Protection 2
11 kV Bus

Fig. 5 Proposed SolutionRedundant Protection

The fast sequential MBT scheme is proposed for

DP vessels using high-speed breakers and
technology to minimize deceleration to a level that
limits the motor inrush current to an acceptable
level. Because the bus-tie breaker will be operated
in the closed position, 11 kV Bus A and Bus B will
have the same angle (refer to Fig. 1). Considering
the scenario that the fault occurred in Bus
Section B, protection will operate and island Bus B
for this fault in 3 to 5 cycles. It is quite possible
that thruster motors may also drop for this fault or
variable frequency drive (VFD) operation may be
blocked due to the VFD algorithm. A stability
study will determine a three-phase bus fault CCT
[3]. If generators can withstand a 3-to-5-cycle,
three-phase bus fault, then the generators can run
for this fault and re-energize the thrusters using the
high-speed bus transfer. Synchrophasor technology
will also be applied to detect the system conditions
and decide the appropriate closing conditions. The
protection system includes voltage and angle of
both systems (ES and EM). Using the slip
calculations, an appropriate command to
re-energize the islanded thruster can be issued for a
DP Conference Houston

direct online (DOL) motor start. Fig. 6 shows the

importance of the correct closing angle in order to
perform a successful transfer.

Fig. 6

High-Speed Motor Transfer (Resultant Voltage)

In Fig. 6:
ES = system equivalent V/Hz; system voltage
in per unit of motor-rated voltage divided by
the system frequency in per unit of rated
frequency.
EM = motor residual V/Hz; motor terminal
voltage in per unit of motor-rated voltage
divided by the motor speed in per unit of
synchronous speed.
ER = resultant vectorial voltage in per-unit
V/Hz on the motor-rated voltage and frequency
base.

October 12-13, 2010

Page 6

Saurabh Shah

New Applications Session

DP Power Plant

An important value used to decide the viability

of MBT is the resultant V/Hz derived from the
V/Hz vectors of the motor bus and the new source
at the instant just prior to connection. This value
should not exceed 1.33 V/Hz [4].
A. Local Protection
The local protection block includes generator
protection relays. For the existing scheme, only one
relay per generator is proposed. However, when
redundancy is required, more than one generator
protection relay is installed per generator. The
proposed generator protection relay includes the
protection elements shown in Fig. 7. The following
additional optional generator protection elements
can also be programmed:
Field ground (64G)
Compensator distance (21C)
Out of step (78)

Fig. 7

Standard Features of Generator Protection Relay

The generator protection relay provides exciter

and governor control, in addition to automatic
synchronization. An example of automatic
synchronization is shown in Fig. 8, and the report
is shown in Fig. 9. Generator protection is also
involved in the common-mode protection of the
generators.

DP Conference Houston

Fig. 8

Automatic Synchronization

Fig. 9

Example Automatic Synchronization Report

B. System Protection and the PMS

System protection provides the function of a
data concentrator and includes all of the control for
the PMS. Based on the overall DP system
protection review, any additional protection, such
as feeder, bus, motor, and transformer protection, is
included as part of the system protection. The PMS
also provides the following functions:
Load-dependent start and stop
Generator running order selection
Load shedding
Heavy-consumer start block
Blackout start capability
Diesel engine control

October 12-13, 2010

Page 7

Saurabh Shah

New Applications Session

The PMS provides the control for generator start

and stop based on the loads and priority of the
generator to start the assigned units in the sequence
as required [5] [6]. Local generation can support
100 percent load during normal operation;
however, during the outage of some units, a loadshedding scheme is enabled. Algorithms
(i.e., priority loads to shed) must be designed into
the system in order to react properly. The system
remains operational and dynamically recalculates
control set points under all system bus
configurations. The PMS provides the control and
start and stop of all generators.
The PMS includes protective relay front panels
that automatically provide text and status point
displays that serve as a backup interface to the data
acquisition and monitoring system. The relays are
configured so the front-panel direct action
pushbuttons operate as a backup control interface.
The relay control interface includes a lock function
that prevents accidental operations.

DP Power Plant

sample rate is selected based on proper testing and

design. Additionally, the proposed system is
capable of providing a secure communications
gateway via standard protocols, such as Modbus
and DNP3. Fig. 10 shows an example of a blackstart generator using the PMS.

C. Communication and Integration to the PMS

Fig. 5 shows the complete system with

communications and PMS integration. The
proposed scheme uses fiber optics and MIRRORED
BITS communications to communicate between
various components [7]. These communications are
self-monitored. The user is automatically notified
of any communications failure. Alternatively, the
system can be designed using IEC 61850 protocol
and Generic Object-Oriented Substation Event
(GOOSE) messaging. As an option, systems can be
designed
using
both
IEC
61850
and
MIRRORED BITS communications. The system
protection block collects all of the information
from the local protection block, and the correct

DP Conference Houston

Fig. 10 Example Black-Start Generation Fault

D. Engineering Diagnostics and Analysis Tools

The proposed solution includes various built-in
tools for system analysis and self-diagnostics. All
of the relays and protection functions are selfmonitoring and record any system discrepancy.
Operators receive visual alarms. Using the PMS,
the HMI continuously displays the operating
parameters and custom screens with alarm details.
A separate screen is developed for each system
component. The proposed system is programmed
to send important information to key personnel for
critical alarms.

October 12-13, 2010

Page 8

Saurabh Shah

New Applications Session

The proposed PMS solution automatically

archives sequence of events (SOE) records from all
of the relays. SOE records generate commaseparated value (CSV) files with accurate satellite
clock time stamps. The event report is archived in
the PMS. This information can be used for the
analysis of any system operation. Fig. 11 displays
an example event report, where for the three-phase
fault, phase angle, reverse overcurrent (OC) and
undervoltage protection pick up and clear the fault.

Digitals

P6401 Q6401 S2) GPICC

S2) GPICB

S2) GPICA

10

S2) GPICA

S2) GPICB

S2) GPICC

P6401

Q6401

10.832 cycles

0
-10
10
0
-10
10
0
-10
100
0

DP Power Plant

perimeters, such as firewalls or serial

communication between systems, strong product
security features, malware detection, elimination of
Microsoft operating systems, and active
overlapping zones of product failure detection [8]
[9].
F. Additional Features
In addition to the functions of the PMS and
generator protection, the proposed scheme includes
the following features:
Synchrophasors
Feeder protection and arc-flash detection
Transformer protection
Bus protection
Motor protection
Common-mode generator protection

-100
CB3REV - OC
CB2REV - OC
PHANG
UV
FLOC3

-5

10

15
Cycles

20

25

30

35

Fig. 11 Example Fault Analysis for the Three-Phase Fault

E. System Security
Security of the PMS is critical so that no
unauthorized actions are allowed. The proposed
solution includes various layers of security from
the relay all the way to the HMI. The HMI has a
minimum of four different types of access levels
that allow certain types of control or operation
(operator,
maintenance,
supervisor,
and
administrator). Additional levels can be added as
necessary. All Ethernet communication within the
PMS is isolated from all other Ethernet networks.
Products used have the following security features:
Strong password capability, requiring
uppercase and lowercase letters, numbers,
and special characters.
Six-character passwords using a
90-character alphabet, yielding 68 billion
possible passwords.
Multilevel access control, giving personnel
access only to the functions that they
require.
Real-time access monitoring and alarms,
which inform of access attempts.
Defense in depth strategies are employed for
the security of the entire system. This strategy is to
provide multiple layers of defensive mechanisms
implanted in the products and the system as a
whole. This can include electronic security
DP Conference Houston

1) Synchrophasors
A definition of real-time (synchronized) phasors
is provided in IEEE 1344-1995. Applying
synchrophasors improves performance for critical
applications. As stated earlier, each machine state
is based on highly accurate Global Positioning
System (GPS) satellite clock signals and
synchrophasor data [10]. Fig. 12 shows the phasor
measurement of multiple machines. The logical
comparison of the synchrophasor variables is
performed using system protection.

t1, VR1

t1, VR4
t1, VR3

t1, VR2

Fig. 12 Synchrophasor Measurement

Synchrophasors can be applied to visualize the

overall system performance with reference to the
same time frame, and the data can be automatically
archived for future analysis. Using modal analysis
(included in system protection), it is also possible
to calculate the resonance and oscillation
frequencies. This information is critical for
advanced generator protection design. Existing DP
vessel common-mode generator protection cannot
detect the resonance and oscillation frequency
accurately.

October 12-13, 2010

Page 9

Saurabh Shah

New Applications Session

2) Feeder Protection and Arc-Flash Detection

Arc-flash detection is important for the safety of
the personnel working on a DP vessel. Fast,
reliable operation of an arc-flash protective relay
improves safety and reliability. The proposed
solution provides feeder protection and arc-flash
detection. Using advanced technology, faults can
be detected in 2 to 3 milliseconds, limiting the arcflash damage to switchgear. Feeder protection and
arc-flash detection are included in the same relay.
The feeder relay includes the following protection
functions:
Phase and neutral overcurrent
Under-/overvoltage
Under-/overfrequency
Breaker failure
Arc-flash detection
Rate of change of frequency (df/dt)
A detailed arc-flash study, appropriate personal
protective equipment (PPE) selection, system
design, field commissioning, and product support
are also included. Fig. 13 shows a solution for arcflash detection.

DP Power Plant

arc-flash category are determined, and appropriate

warning labels are posted at various switchgear
locations to instruct people to use appropriate PPE.
This defines the working boundary for qualified
personnel.
Fig. 14 shows the arc-flash labels to be installed
at each major panel and switchgear location to
allow only personnel with appropriate PPE to work
in the area identified by arc-flash labels.

Fig. 14 Example Arc-Flash Label

Relay
Area Light
Sensor
Bus

Point Light
Sensor
Relay

Fig. 13

Relay

High-Speed Arc-Flash Detection

Up to four sensors, point and loop, are installed

in this solution, and all of the switchgear sections
are protected using selective tripping. As part of an
arc-flash study, possible ways to reduce the

DP Conference Houston

3) Other System Protection

In addition to the protection discussed, other
overall system protection, such as motor
protection, bus protection, and transformer
protection, is also provided as part of this solution.
The proposed solution uses the same relay for
transformer and bus protection. The bus and
transformer protective relay is capable of handling
five three-phase current transformer (CT) inputs
and three single-phase CT inputs for restricted
earth fault (REF) protection. The proposed relay is
based upon low-impedance bus protection. Lowimpedance bus protection is faster at detecting a
fault compared to high-impedance bus protection,
in addition to other advantages [11]. A motor
protection relay includes all of the protection
functions required for the motor, including the
thermal model.

October 12-13, 2010

Page 10

New Applications Session

DP Conference Houston

P6401

15.0
12.5
10.0
7.5
5.0
10

Q6401

W6401

4) Common-Mode Faults
Common modes of failure are defined as faults
that affect overall system operation and cause
multiple redundant elements to react adversely. For
normal operating conditions, all of the generators
operate in parallel droop mode. In case of a fault on
one generator exciter and governor or any other
common-mode fault, it is desirable to properly
detect and isolate only the faulty generator from
the system as soon as possible [13]. It is also
necessary to evaluate the response time of controls
(e.g., exciter and governor controls) before making
decisions regarding any system isolation or
islanding. Otherwise, undesirable system operation
may result in additional faults or failures. This
solution will correctly detect and island for all of
the faults discussed below. Common-mode faults
are classified in the following four categories:
Governors
Fuel or actuator
Exciters
Miscellaneous

A. Model Power System Test and Example

The model power system testing laboratory is
the proposed site for complete testing of systems
using the Real Time Digital Simulator (RTDS).
RTDS equipment allows dynamic modeling of a
power system with a simulated small time step to
test all closed-loop controls and protection systems
[11]. The DP power system will be modeled using
RTDS, and system performance will be
benchmarked using the actual field results.
An example of generator parameter verification
using load shedding is shown in Fig. 16. The
RTDS system study helps with relay settings and
verifying the correct protection system operation of
offshore vessels for system contingency conditions,
system dynamics, and transient faults. This
dynamic system model is utilized for the
verification of PMS integration for black-start
operation, load shedding, and fast MBT schemes.
The system performance is also verified during
field installation.

LA6401

Fig. 15 Example Motor Starting Report

DP Power Plant

IV. Other Critical Issues

P6401

Q6401

W6401

LA6401

EF6401Mag IF6401Mag

0
320.0
317.5
315.0
312.5
310.0
0.75
0.50
0.25
0.00

EF6401Mag

An example motor starting report is shown in

Fig. 15 [12]. In addition, one high-speed MBT
relay is installed for each important motor. The
MBT relay is the same as the bus and transformer
protection relay. Selecting the same type of relay to
protect pieces of equipment reduces the
engineering and training time.

IF6401Mag

Saurabh Shah

2.5
2.0
1.5
1.0

2
0

25

Fig. 16

50

75

100

125
Cycles

150

175

200

225

Generator Results Benchmark Using RTDS

October 12-13, 2010

Page 11

Saurabh Shah

New Applications Session

B. Design Verification
The PMS is designed and validated in the
laboratory before it is deployed in the field. Critical
systems such as DP require testing controllers and
associated equipment during factory acceptance
testing. These critical systems need to have their
controls validated and tested in a real-time
simulation environment. Using this type of
validation and testing helps in accurately modeling
governors, turbines, exciters, rotating machinery
inertia, load and electrical characteristics, electrical
component impedances, and magnetic saturation of
electrical components.
Fig. 17 shows an example of RTDS results that
help monitor the system parameters in real time.
T114-P, T114-Q, and T114-TAP show the power
flow and tap position for the T114 transformer.
Similar information is shown for the
T115 transformer. In addition, Fig. 17 shows the
currents (ICB3A, ICB3B, ICB2A, and ICB2B) and
bus voltage (GPIC1A and GPIC1B).

Fig. 17 Example System Results Using RTDS

DP Conference Houston

DP Power Plant

The RTDS testing verifies the system design,

protection settings, and overall system performance
[13]. Thousands of faults and system disturbances
are created and tested in a closed-loop system,
evaluating the system performance even before the
PMS is installed on-site. In addition, the results of
on-site testing are used to revalidate the system
design. Once the standard DP system model is
built, it can be easily applied for future system
expansion and design variation. This tool has been
used for various projects with complicated system
designs where settings are dependent on the system
design parameters. Without detailed testing,
selecting proper protection is not possible.
C. Off-the-Shelf and Complete
Engineering Solutions
The proposed system configuration is shown in
Fig. 5. The system can be designed using
redundant protection or only single protection per
generator. However, the incremental cost of
additional protection is small in comparison to the
overall project cost. System reliability is also
improved by selecting redundant protection. The
proposed design is easily expandable and can be
applied to any type of offshore platform. For this
example project, only six generators are installed;
however, this system is easily expandable for
vessels designed with more than six generators. As
part of this engineering solution, a test bed serves
as a valuable test lab for engineers to evaluate
system performance. The proposed scheme can be
a template for future designs and result in reduced
engineering costs. Once the system is designed and
tested for one vessel, the same design is easily
applied to other vessels. The costs of training,
maintenance, and system operation are also
reduced because of the standard system design.
Detailed documentation and local support are
best provided on location. Deep-water drilling
platforms are located all over the world, so support
and training for these critical projects are required
as needed and when needed. The global
presence of a support company is important to the
acceptance and success of the project.

October 12-13, 2010

Page 12

Saurabh Shah

New Applications Session

[8]

V. Conclusion
This paper discusses the conceptual design of
DP power plant protection, automation, and control
using the latest technology available. It also
discusses the advantages of operating the DP plant
as closed bus and a solution for a high-speed motor
transfer scheme. This proposed solution provides
cutting-edge protection functions for generators
using synchrophasor technology and the
IEC 61850 protocol. In addition, the solution
includes a PMS, arc-flash detection, and automatic
synchronizer. This solution is robust, easily
expandable, and self-diagnostic. It also provides
automatic archiving of SOE and event reports.
Using advanced technology and tools, a reliable
PMS is designed and implemented. This paper also
discusses the importance of detailed design
verification using real-time simulation.

VI. Acknowledgment
The authors gratefully acknowledge the
contributions
of
Lew
Weingarth,
DP
superintendent of Transocean, for providing
technical support for this paper. Lew has more than
30 years of experience with DP power plants and
offshore vessels.

VI. References
[1]
[2]

[3]

[4]

[5]

[6]

[7]

S. Chakrabarti, Handbook of Offshore Engineering, Elsevier

Ltd., Oxford, UK, 2005.
M. Oens and C. Lange, Improvements in Feeder Protection
Providing a Primary and Backup Relay System Utilizing One
Relay Per Feeder, proceedings of the 33rd Annual Western
Protective Relay Conference, Spokane, WA, October 2006.
A. Jain and K. Garg, System Planning and Protection
EngineeringAn
Overview,
proceedings
of
the
3rd International Conference of Power Systems, Kharagpur,
India, December 2009.
T. S. Sidhu, V. Balamourougan, M. Thakur, and B. Kasztenny,
A Modern Automatic Bus Transfer Scheme, International
Journal of Control, Automation, and Systems, Vol. 3, Issue 2,
June 2005.
B. Cho, H. Kim, M. Almulla, and N. Seeley, The Application of
a Redundant Load-Shedding System for Islanded Power Plants,
proceedings of the 35th Annual Western Protective Relay
Conference, Spokane, WA, October 2008.
D. Miller, R. Schloss, S. Manson, S. Raghupathula, and
T. Maier, PacifiCorps Jim Bridger RAS: A Dual Triple
Modular Redundant Case Study, proceedings of the
11th Annual Western Power Delivery Automation Conference,
Spokane, WA, April 2009.
K. Behrendt and K. Fodero, Implementing MIRRORED BITS
Technology
Over
Various
Communications
Media,
SEL Application
Guide
(AG2001-12),
2007.
Available: http://www.selinc.com.

DP Conference Houston

[9]

[10]

[11]

[12]

[13]

DP Power Plant

D. Anderson and G. Leischner, Cybersecurity as Part of Modern

Substations, proceedings of the 7th Annual Power Systems
Conference, Clemson, SC, March 2008.
D. Dolezilek and T. Tibbals, Communications Technologies
and Practices to Satisfy NERC Critical Infrastructures Protection
(CIP), proceedings of the 5th Annual Power Systems
Conference, Clemson, SC, March 2006.
E. O. Schweitzer, III, D. Whitehead, A. Guzmn, Y. Gong, and
M. Donolo, Advanced Real-Time Synchrophasor Applications,
proceedings of the 35th Annual Western Protective Relay
Conference, Spokane, WA, October 2008.
L. Weingarth, S. Manson, S. Shah, and K. Garg, Power
Management Systems for Offshore Vessels, proceedings of the
Dynamic Positioning Conference, Houston, TX, October 2009.
P. Whatley, M. Lanier, L. Underwood, and S. Zocholl,
Enhanced Motor Protection With the Slip-Dependent Thermal
Model: A Case Study, proceedings of the 34th Annual Western
Protective Relay Conference, Spokane, WA, October 2007.
A. Al-Mulla, K. Garg, S. Manson, and A. El-Hamaky, Case
Study: A Dual-Primary Redundant Automatic Decoupling
System for a Critical Petrochemical Process, proceedings of the
2009 PCIC Europe Technical Conference, Barcelona, Spain,
May 2009.

VII. Biographies
Saurabh Shah is a branch manager in the engineering services
division of Schweitzer Engineering Laboratories, Inc. (SEL).
He received his BS in 1995 and AS in computer systems in
1991 from Lewis-Clark State College. He has a broad range of
experience in the fields of power system operations,
protection, automation, and integrated systems. He has served
nearly 19 years at SEL, where he has worked in relay testing,
sales, business development, and engineering project
management.
Kamal Garg is a project engineer in the engineering services
division of Schweitzer Engineering Laboratories, Inc. (SEL).
He received his MSEE from Florida International University
and India Institute of Technology, Roorkee, India, and a BSEE
from Kamal Nehru Institute of Technology, Avadh University,
India. Kamal worked for Power Grid Corporation of India Ltd.
for about seven years and Black & Veatch for about five years
at various positions before joining SEL in January 2006. He
has experience in protection system design, system planning,
substation design, operation, testing, and maintenance. Kamal
is a licensed professional engineer in five U.S. states.

October 12-13, 2010

2010 Marine Technology Society, Inc.

All rights reserved.
20101006 TP6448

Page 13