SE517963C2 - Mains protection system for the protection of the integrity of a total electrical power system, electric power system including a network protection, system protection procedure, system protection terminal and computer software product - Google Patents

Abstract

The present invention discloses a system protection scheme comprising of at least three system protection terminals (18), introduced at suitable locations in an electric power system (1). The system protection terminals (18) are interconnected by a communication system (22), using a substantially dedicated communication resource. At least two of the system protection terminals (18) are equipped to collect measurement signals (72) associated with characteristics of the power system at that particular location. The measurements preferably comprise complex ac quantities and stability indicators. The signals are processed and data related to the measurements are spread on the dedicated communication resource to the other system protection terminals (18). At least two of the system protection terminals (18) are equipped to evaluate the condition of the associated part of the power network and if necessary provide control signals (74) to power system units. The evaluation is based on selected parts of the data available on the communication resource and locally available data.

Description

25 30 517 965 2 the world has led to significantly reduced investments in infrastructure, ie. investments in hardware. A continuously increasing load level in combination with new power directions has led to new operating conditions appearing for the system operators compared with previous operating conditions in well-known electric power systems. New operating situations and rapid production changes as well as associated power ökar fate changes increase the requirements for the operator's tools and equipment to have a continuous overview and control over the electric power system's operational reliability and operating margins. The requirements for models, measurement data and calculation programs will thus increase.

One of the reasons for the currently, in many places, growing interest in stability issues is that an increase in load without a corresponding increase in transmission capacity has resulted in many power systems today being operated closer to their limits. In recent decades, there has been an increase in both generation capacity and the use of electricity in the industrialized countries. One problem is the infrastructure for energy delivery, which is burdened more in the new high-traffic and more competitive electricity industry.

Over the years, the power grids have become more widely interconnected and cover larger geographical areas. The power grids, which were built and expanded in recent decades, were in many cases not planned to handle the large number of transactions that take place in today's deregulated energy markets. As a result, there is probably a significantly increased risk of major system failures (interruptions).

The dependence on a reliable power supply in today's society must not be underestimated. Furthermore, today's and your customers are more and more sensitive to disturbances in the electric power systems. The increased focus on power quality issues (PQ) includes both undesirable variations in power supply in the form of e.g. both voltage failures and voltage drops as well as interruptions in the power supply. Because of this, some of the existing defenses had to be developed from systems designed in the 1960s or 1970s to meet the demands of today's real power systems. Furthermore, from a design point of view, it is not possible to build a power system that can withstand all eventualities that may occur.

In the event of serious faults, combinations of faults or extreme loads or unexpected production changes in the power system, there are grid protection at a number of locations around the world, which try to avoid extensive grid breakdowns and instead limit the consequences and facilitate grid recovery. The area of system protection schemes (SPS) includes a number of different types of systems, where the information-bearing signals can be both control signals and information that certain measured values have exceeded or fallen below their limit values.

Today's protection against serious disturbances is mainly adapted for transient phenomena in the power grid, which occur in the form of frequency deviations as a result of imbalance in active power. These types of network protection mainly refer to load disconnection, but there are also protections that include insulation of the network according to predetermined sections between the areas in extreme operating conditions. This type of guard, which divides the power system into smaller areas and thus has a better opportunity to maintain operations, is installed in a few places in the northwestern United States, France and Belgium.

The French system is described in the article "Major Incidents on the French Electric System: Potentiality and Curative Measurement" by C. Counan et. al., IEEE Transactions on Power Systems, vol. 8, no. 3, August 1993, pages 879-886. The system is built in a hierarchical structure, where detection devices are spread over the network according to a certain configuration.

The detection devices are connected to a central analysis unit that determines the risk of interference. The detection devices detect voltage fluctuations by monitoring the variations in the local voltages. In the event of interference, the network is fragmented at the request of the central analysis unit in isolated islands which have one or more of their detection devices. 10 15 20 25 30 517 9634 The French Defense is also presented in the scientific report “Contingencies System against Loss of Synchronism Based on Phase Angle Measurements” by M. Bidet, Electricité de France (EdF) Report 93NROO009, Direction des Etudes et Recherches, March 1993. The guard is presented as a last line of protection to deal with cases of loss of synchronism, which should only be activated if other protection systems fail to eliminate the interference.

The system is based on synchronized phase angle measurements which are sent to a central point in the network, which sends away e.g. commands for line tripping or load disconnection in case of loss of synchronism detected. The centralized structure is considered a main feature of the proposed Guard.

A problem with existing network protection is that the measured quantities are often insufficient to effectively detect interference. More detailed knowledge of the conditions in different parts of the power system is required in order to achieve a more complete picture of the situation.

A network protection system in southern Sweden against voltage collapse has been designed jointly by Svenska Kraftnät, Vattenfall AB and Sydkraft AB and is described in e.g. "Special Protection Scheme against Voltage Collapse in the South Part of the Swedish Grid", by B. Ingelsson et. al., CIGRE Paper 38-105, Paris, August 1996 or "Wide-Area Protection Against Voltage Collapse" by B.

Ingelsson et. al., IEEE Computer Applications in Power, vol. 10, no. 4, October 1997, pages 30-35. The purpose of the mains protection system is to avoid a voltage collapse after a serious fault in a vulnerable operating situation. The system can be used to increase the power transmission limits from the northern part of Sweden or to increase system security or a combination of both.

A number of indicators such as limiters for low voltage levels, high reactive power generation and generator current such as when limit values are used as input signals to a logical decision-making process that is implemented in Sydkraft's SCADA system ("Supervisory Control And Data Acquisition"). 10 15 20 25 30 517 9635 Local measures, such as switching on shunt reactors and shunt capacitors, starting gas turbines, requesting emergency power from nearby areas, disconnecting low priority loads and finally (non-discriminating) load disconnection, are ordered from the SCADA system.

The network protection system is designed to have both a high level of safety, especially for the (non-discriminating) load disconnection and a high level of operational reliability. A number of indicators are therefore used to derive the criteria for each action. The logic system is designed in such a way that an erroneous indicator can neither cause an unwanted procedure nor an omitted procedure of the network protection system.

A serious disadvantage of the system above is that the response times turned out to be the SCADA communication system used, were in fact data processing and too long and indefinite. Because the usual transmission times for information and the control signals actually depend on the general load of the SCADA system. Unfortunately, the SCADA system is typically particularly heavily loaded in vulnerable situations.

Furthermore, the indicators for some applications were not sufficient to provide a good basis for decision-making, at least with the simple logic used.

Equipment for measuring complex alternating current quantities (amplitude and phase, phase measurements) and systems for evaluating the risk of instability, based on local measuring quantities, have recently become available. Measurement and collection of time-marked complex quantities, phase quantities, with respect to current and voltage can be performed with a phase measuring unit (PMU). These units include a very accurate time reference, which can be achieved e.g. by using the GPS system (“Global Positioning Satellite”). Such systems are installed in, for example, the northwestern United States for recording power system conditions and are used to subsequently evaluate an emergency situation. See for example "Wide Area Measurements of Power System Dynamics - The North American WAMS Project and its 10 15 20 25 30 517 9636 Applicability to the Nordic Countries "Elforsk Report 99:50, O. Samuelsson, Lund University, January 2000.

However, due to the large amount of data and the complexity of evaluating data from a number of nodes within a limited time, such data has not yet been considered for inclusion in any network protection due to the limitations of prior art configurations.

SUMMARY An object of the present invention is thus to provide a net protection which is more sensitive to disturbances in the power system. An additional purpose is to use time-stamped quantities and quantities derived therefrom as a basis for protection decisions. Another object of the present invention is to provide a network protector which has a rapid response to interference indications. The response time should preferably be independent of external factors. Yet another object is to provide a network protection, which is reliable with respect to communication links.

Arrangements, devices, systems and methods according to the appended claims achieve the above objects. In general terms, a number of, at least three, system protection terminals will be introduced at suitable locations in the electric power system. The system protection terminals are interconnected by a communication system, through the use of a substantially dedicated communication resource.

A number of system protection terminals, and at least two, are equipped for collecting measurement signals associated with the characteristics of the power system at the particular location. The measurements preferably include complex AC quantities and stability indicators. The signals are processed and data related to the measurements are spread on the dedicated communication resource to the other system protection terminals. A number of the system protection terminals, and at least two, are equipped to evaluate the situation in the local part of the power grid and, if necessary, provide control signals to power system units. The evaluation is based on selected parts of the data that is available on the communication resource, locally available data and / or data that is entered from outside.

The system protection terminals preferably have local means for storing data.

The data includes both the latest history of system information and older measurements. The storage means are used e.g. in autonomous operating situations, ie. in situations where communication does not work. The stored data is also preferably used for following up vulnerable situations in a post-analysis.

The storage means are preferably searchable databases.

The essentially dedicated communication resource that connects the system protection terminals is designed with a high capacity. For protection against transient angular instability, transient voltage instability, frequency instability and damping of system-wide power fluctuations, the requirements for the communication time are in the order of parts of a second, e.g. a few hundred milliseconds for transient angular instability and transient voltage instability, while almost one second may be sufficient for frequency instability and attenuation purposes. For protection against prolonged voltage instabilities, communication times of up to five seconds are usually acceptable.

Each system protection terminal preferably has access to at least two links of the communication system, which provides a first degree redundancy with respect to communication errors. Additional redundancy is achieved by providing at least two of the system protection terminals with at least three links to the communication system. Each system protection terminal includes a processor and appropriate means of communication. A local database is preferably provided for each terminal. lO 15 20 25 30 517 963 s Not only the measurements, but also the decisions are hereby performed locally. The relevant data is collected from the communication system and the decision algorithms in each system protection terminal can be adapted to the current local situation, which is not subjected to any comprehensive total analysis. The decentralized evaluation thus reduces the complexity of each algorithm. Communication is ensured by providing the system protection terminals. dedicated communication resources between Additional benefits and examples are understood from the following detailed description.

BRIEF DESCRIPTION OF THE DRAWINGS The invention, together with further objects and advantages thereof, can best be understood by reference to the following description taken in conjunction with the accompanying drawings, in which: FIG. 1 is an exemplary illustration of a power grid with a grid guard according to the present invention; FIG. Fig. 2 is an illustration of a fault with a defective busbar in the power system of Fig. 1; FIG. 3 is another exemplary illustration of a power grid with a grid guard according to the present invention; FIG. 4 is yet another exemplary illustration of a power grid with a grid guard according to the present invention; FIG. 5 is an illustration of a combined net guard, composed of the net guards in Figs. 1, 3 and 4; FIG. 6 is an illustration of the different operating states of an electric power system; FIG. 7 is an embodiment of a network protector comprising substantially identical standardized system protection terminals; FIG. Fig. 8 is a detailed block diagram of a system protection terminal used in the embodiment of Fig. 7; and FIG. 9 is a diagram of a system protection method according to the present invention.

THE ALLEGED DESCRIPTION Power system engineers often distinguish between unit or equipment protection on the one hand and system protection on the other. An obvious requirement to enable a safe and reliable supply of electric power in a power supply is to protect the individual components of a power system against damage, when a fault occurs. This protection, commonly referred to as equipment or unit protection, is typically designed to prevent the current, which is the result of a fault, from causing thermal damage to the components. Such component protection is usually intended to disconnect the faulty transmission line or equipment. A very large number of different component protection equipments and methods exist today, but despite the importance of such devices, the scope of the present invention does not include such component protections.

In addition to component protections, there is also a need to protect the overall integrity of the power grid. The term integrity has to do with the quality or the relationship that "something" is whole or undivided. In this case, it has to do with the fact that all, or at least the absolutely necessary or essential, parts of a power grid are stable and in synchronous operation. This corresponds to the operating state of the power system (described below) being either normal or on standby. This operating state can simply be said to correspond to the effect fl fate equations (algebraic) being fulfilled and that there is no immediate risk of loss of synchronism in the electric power system. The goal is to prevent extensive outages or power outages in larger areas. Secure and reliable electricity supply is of crucial importance and in light of the general technological development, the requirements for safety in power system delivery will continue to increase. Considerable efforts are made to maintain the power supply, not only under normal operating conditions, but also in deviating operating conditions, A mains protection 9 h now; o 10 15 20 25 30 517 963 v .non (eng. SPS) is the common name used when the focus of the protection is the total integrity of the power grid.

A network protection is designed to detect deviating system conditions and to take predetermined emergency action to maintain system integrity and provide acceptable system performance. The measure is therefore only exceptionally a pure isolation of faulty elements, since such measures are usually provided by equipment protection. Network protection measures may instead include measures such as changes in load, generation or system configuration. The purpose of these changes is to maintain system stability and to keep the voltages and fl fates of active and reactive power at acceptable levels.

When defining network protection, the current trend of merging protection and control functions in more and more integrated substation units must be taken into account. A mains guard is mainly a guard that controls the operation of objects in power systems as a preventive measure to cope with general or local deviating operating conditions. The main issue that distinguishes network protection from protection systems for power system elements or objects is how users perceive network protection. The implementation of network protection is not yet standardized with standard ("off the shelf") products according to known technology.

All protection systems must meet high standards of reliability, which can be divided into high reliability and high security. High reliability has to do with a low probability of getting an operating error and high security has to do with a low probability of an unwanted operation. A network protection should, of course, have high reliability and especially if a malfunction or unwanted operation could aggravate the situation or if it involves (non-discriminatory) load disconnection.

A general power grid has different operating conditions, depending on the current situation regarding faults, disturbances, loads and generation demands, etc.

The reason why the new system operating conditions can be found in "Operating 10 15 20 25 30 517 96311 vv .vu under Stress and Strain" by L.H. Fink and K. Carlsen, IEEE Spectrum, vol. 15, no. 3, March 1978, pages 48-53. The general basic ideas are briefly discussed below in connection with the intended use of the present invention.

The operating conditions are discussed in connection with Fig. 6, where five operating conditions are shown.

(See Appendix 1 for a more mathematical 'deñnition' for the operating conditions above). In a normal operating condition 40, the power generation is sufficient to supply the existing load requirements. No equipment is currently overloaded.

All conditions on the power system are met. In this normal operating condition 40 there are normal reserve margins, which margins are sufficient to provide a certain level of safety. These margins are normally designed with respect to the loads to which systems may be subjected, both in terms of generation and transmission. A power system is in the normal operating state 40 for most of the time. Any deviation from this condition is an exception, but a serious exception.

If, after all, the conditions change in such a way that the security level provided may be too small, or that the probability of interference may have increased, the system is in a state of readiness 42. In this state of readiness 42, all conditions of the system would still be met from an isolated point of view. , i.e. no object is operated outside its margins. However, the overall system is less secure than in the normal operating condition 40. The available margins for coping with faults can easily be exceeded even by fairly simple and common faults, which could then result in a breach of certain system conditions. Equipment would be more or less severely overloaded, compared to its rated capacity. In the state of readiness 42, preventive measures 52 can be taken to restore the system back to the normal operating state 40. The expression to protect the integrity of a total power system can, as previously discussed, in this context relate to ensuring the operation of the power system in the normal and, during shorter periods, even during emergency operations. u ana; u 10 15 20 25 30 517 963 12 I o apa; o If such preventive measures 52 do not take place before another sufficiently serious disturbance, 54 the system is transferred to an emergency state 44. Here the system conditions are exceeded and the system's safety is breached because there is no level of safety. However, the system is still intact during this state of emergency 44 and emergency control interventions or "heroic measures" could be initiated to restore the system to at least the state of emergency 42. Emergency control intervention should be aimed at sparing as many parts of the system as possible and avoiding a total collapse. Once a system has entered the state of emergency, the carefully considered control decisions and interventions that are appropriate in the normal 40 and even in the state of readiness 42 are no longer sufficient. More immediate action is needed.

If the emergency control measures are too slow or ineffective, the disturbance overloads the system. The system begins to decompose 58 into an “extreme state” 46. In this state, the system conditions are no longer valid and large parts of the system would no longer be intact and most of the system load would be lost. If the collapse is stopped 62 before all parts of the system are lost, some remaining equipment will operate within rated capacity and the system will enter a recovery state 48. Control measures are taken to take up lost loads and reconnect the system, even if the whole system cannot be restored. immediately. From this state, the system could transition 66 to the standby state 42 or return 64 all the way to the normal operating state 40. The actual path depends on the circumstances of the emergency.

The present invention is mainly put into operation in the emergency state 44. The aim of the network guard is to detect and identify situations which normally lead to the "extreme state" 46, to take action and return the system to the standby state 42. Arrow 60 in Fig. 6 thus illustrates the network guard's intervention . If the disturbance encountered is very serious, the transition between operating states can take place without passing through the intermediate stage in Fig. 6. For example, the transition is directly from the normal state 40 to the emergency state 44 if the disturbance encountered is more severe. than the faults described in the design criteria of the power system, and also transitions directly from the state of readiness 42 to the “state of extremity” 46 in the event of a very serious disturbance. Regardless of the exact path taken during the transition between operating conditions, the main goal and purpose of the network defense is still the same.

The purpose of the proposed network protection is consequently to avoid (serious) network disturbances by stopping or limiting the decay of the system, ie. the transition to the "extreme state" 46 through the use of so-called "emergency control measures". Today, automatic load disconnection is the main mechanism in emergency steering. Emergency control measures performed aim to move the operating state from the entered emergency state 44 back to the state of emergency 42, and thus to avoid the transition to “extreme state” 46 and associated power system interruptions.

The proposed network protection focuses on system protection.

Emergency protection devices / guards handle events with a relatively low probability and enormous consequences. The risk, defined as the product of probability and consequence, for such events is therefore difficult to deduce. However, due to the ever-growing dependence, in today's society, on a reliable power supply, the proposed network protection will serve a very important role. Strategies to reduce the risk and effects of major disruptions in the power system are a major concern for energy facilities - both in terms of planning and operational aspects.

A more 'stringent' mathematically based, definition of the operating conditions presented above is given in Appendix l.

The operation of power systems can be characterized by three goals: quality, safety and economy. The overall operational goal for power systems is to reach a satisfactory compromise between the two conflicting goals; security and 10 15 20 25 30 517 963 14 Ivan o economy. In many power systems today, partly due to the ongoing deregulation of power markets, economic considerations have the greatest impact on these two goals.

Based on the presentation of the operating conditions above, it follows that the intentional automatic control measure, which can be taken to save the power system or restore sufficient reserve margins, can be divided into prevention and emergency measures. During normal operation, the focus is on economic aspects for the operation of power systems, and economic operation thus plays the more important role.

While under more stressful emergency operating conditions, such as in a state of emergency, and especially during emergencies, the focus of the control objectives shifts towards safety. The ultimate goal here is to keep as much of the network intact as possible and to keep generators connected to the power line network. The breakdown usually results in one or more serious problems in the power system. The main concern in the emergency is of course system security. In this respect, net defenses form a final line of defense in the event of serious disturbances. The goal of measures taken by the local guard is to provide uninterrupted energy supply through the use of sometimes quite ruthless methods, ie. by taking measures which could be referred to as a last resort (and which would not be used under normal operating conditions). The purpose of the net protection is to maintain the operational safety of the power system.

To clarify the advantages of the present invention, a couple of examples will be discussed. Fig. 1 shows an electric power system network 1 with a network protection according to the present invention. The power net comprises a number of nodes 10 connected by power lines 16. (Only one of each object is provided with a reference number, unless specifically referred to.) The nodes could be connected to generators 12 and / or loads 14.

System protection terminals 18 are provided at selected nodes, connected to the nodes by metering connections. A communication network 22, which has at least one substantially dedicated communication resource, interconnects the system protection terminals. In this example 517 96315, the nodes connected to the loads 14-A, 14-B and 14-C are provided with system protection terminals 18.

The illustrated electric power system 1 has in its left part high capacity generators 12 and in its right part many loads 14. The general transmission situations are therefore usually that the left part generates power, which is transferred to the loads in the right part. Two main power lines connect the right and the left part of the power system.

The node 10-A in Fig. 1 is shown in more detail in Fig. 2. The node is a switchgear system and busbars 24-A, 24-B are used here to connect the various objects 12-A and the power lines 16-A, 16-B and 16-C.

The power lines and objects are connected to the respective busbars 24-A, 24-B via circuit breakers 28. A circuit breaker 28-A is also provided at the connection 26 between busbars 24-A, 24-B.

Assume a busbar error. The circuit breaker 28-A has become unusable, e.g. as a result of corrosion. During normal operation, the power system will not notice this insufficiency in power dissipation, and operation continues according to normal routines. Assume now that the lower busbar 24-A is suddenly connected to ground, as illustrated by the arrow 30. The lower rail must be disconnected immediately, which is managed by the typical actions of the object protection arrangements. Such an arrangement will open the lower circuit breakers 28 to separate the power lines 16-A, 16-B and 16-C and the generator 12-A from the faulty lower sampling rail 24-A. The circuit breaker 28-A is also ordered to open. However, due to the corrosion, this circuit breaker 28-A cannot be opened, so that the upper busbar 24-B is also earthed. The connections 16-A, 16-B and 16-C and the line to the generator 12-A must be cut, e.g. by action of the upper circuit breakers.

Returning now to Fig. 1, the power system 1 has lost the generator 12-A and the power lines 16-A, 16-B and 16-C. The power generated may be compensated by other generators in the power system, but all power n nova q 10 15 20 25 30 517 96316 must now be transmitted by the single power line 16-D. The power system undergoes an entry into a state of voltage instability and perhaps an overload of line 16-D. However, the system equipment could still be within the permitted limit values and no additional object / equipment protection would be activated. However, voltage stability problems can cause a general breakdown of the electric power system 1 in a period of less than one minute, due to the low voltage level in the load range, load recovery, further voltage reduction, switching off of overloaded equipment, and so on. A chain of events will thus lead to a collapse.

The system protection terminals 18 according to the present invention now come into operation and save the power grid. In this example, the system protection terminals are provided with means for obtaining time-marked voltage values, which correspond to the respective node. These time-stamped voltage values are processed to give so-called complex alternating current quantities. These complex AC quantities are communicated in the communication network 22 to spread the information within the system protection arrangement. In this example, each system protection terminal 18 is also provided with control signal providing means, which in turn comprise means for detecting serious risk of voltage instability. This detection means detects the risk of instability in the electric power system and provides control signals in response to the risk of instability, e.g. when two of the present voltage values of the nodes are below 90% of the nominal values.

The control signals are sent to the respective nodes to order a reduction in the size of each of the loads 14-A, 14-B and 14-C.

In this case, lead 16-D could be the critical one. In order to maintain the integrity of the system, it is very important not to disconnect this line.

Load disconnection of part of the total load in the load area (preferably low priority load) could be sufficient to save the entire system. If no action is taken, the entire right part of the power system, ie. cargo area, likely to experience an interruption. Fig. 3 shows a power grid similar to that illustrated in Fig. 1. Here, five system protection terminals 18 are connected mainly to nodes in the left part, with high generation capacity, of the electric power system 1. A system protection terminal 18 is also present in the right, cargo area.

Assume the same error scenario as in the example above. The switchgear in node 10-A breaks down and power lines and a generator are lost. Due to the long transmission lines and the asymmetric load and the power generation, power oscillations are induced in the electric power system 1. These oscillations are not effectively attenuated and continue for a relatively long period of time. The power system is in an unstable state and the risk of collapse is great. In this example, each system protection terminal comprises a phase measuring unit (PMU unit), which characterizes the dynamic development of the state in each node. The phase quantities acquired from the PMU units are transmitted to the communication system 22 to be available for the other connected system protection terminals. The system protection terminals connected to nodes controlling a generator 12-B, 12-C, 12-D, 12-E, and 12-F are further equipped with means for sensing power fluctuations. This sensing means uses the data available on the communication system to detect an effect oscillation and to determine that the oscillation in this case is poorly attenuated. provides suitable control signals to the generators' power system stabilizers (PSS) of the standard type. Especially for the single unit in the right system, it may be necessary to use more powerful damping means, such as regulator gain or switch resistors, to achieve satisfactory damping of the oscillations.

Fig. 4 illustrates a similar power system. Here, seven system protection terminals will be introduced at locations throughout the power system.

The system protection terminals are connected to a communication system 22, which in this example is masked to provide compensation possibilities for technical faults in certain 10 15 20 25 30 51 7 96318 n o o a | g o: en communication links. Let us assume the same busbar error as above, but for such initial load fl conditions that we end up with transient angular instability problems over the remaining line 16-D that interconnects the two parts of the system. Through a combination of generator reinforcement and load disconnection in the load area, the developing angular instability situation could be counteracted and the two parts of the system could be kept together - at the cost of a relatively small amount of load disconnection. The best measurement criterion is probably based on the phase angle difference in voltage between the two ends of the remaining transmission line lö-D, which connects the two areas.

The three examples above include system protection terminals in different configurations. To provide better overall protection, the configurations of system protection terminals can be combined. Fig. 5 shows only the system protection arrangement, which comprises terminals corresponding to the three examples above. A common communication network 22 interconnects all system protection terminals. In one embodiment, each of the three examples above is provided as more or less separate systems, in that the communication of the measured properties of the power system is mediated in each resource, over the common communication system. In another embodiment, the communication resources have such a capacity that the data from all examples can be distributed within a certain satisfactory predetermined time. In such a case, the system protection terminals select which data is of interest for its own purposes. The network protection can therefore be built up in a very modular way, which allows future adaptations to new operating conditions or to newly installed network-characterizing equipment. The motherboard of the system, which is not affected by the changes, can also remain unchanged in the network protection, and only the relevant parts need to be upgraded. 10 15 20 25 30 517 963 f: = "= z. = - ~ 19 - = = - Furthermore, by letting the local units make the necessary decisions, the process requirements for each mode of protection are reduced, since only relevant data is picked up from the communication system and In addition, as decisions are made closer to the actual location of the emergency measure, the requirements for control signaling equipment are reduced.An advantage is that beslut your decision-making processes can be active in parallel, and there is no need to prioritize different decision-making processes, as in the case of a central decision-making structure.

Since the communication system is one of the most important components of the present invention, it is preferable to provide a communication system that is as secure and reliable as possible. One way to provide reliability is to provide redundancy in the communication system. Centralized defenses are typically based on communication systems, built in a star-like or radial way, where the central unit communicates with the various peripheral units. For a centralized configuration, such designs are easy to implement.

In the present invention, it is preferred to have as masked a communication network as possible, at least within an economically defensible framework. It is thus a desire to provide at least three of the system security terminals with at least two communication links each.

In such a way, a broken communication link can be compensated by sending the data in another way in the communication system. If all terminals are arranged in a ring structure, a broken communication link can be handled. A second error, however, will split the communication system into two parts. The more communication links that are available and the more masked they are, the more alternative communication paths there are. It is thus preferable if at least two terminals have at least three communication links each.

In one embodiment of the present invention, the system protection terminals are provided as more or less identical protection units, which may be interconnected by a communication network to operate anywhere in a power network as part of a composite network protection. Such an embodiment is illustrated in Fig. 7. The system security terminals 18 are illustrated here as interchangeable units which comprise identical means and which are distinguishable only by the configuration of the software in each terminal. In Fig. 7, an electric power system 1 comprises six system protection terminals 18, which are interconnected by a communication network 22. Each system protection terminal 18 is connected to a control system 70 for input data 72 of measured power system properties and for output 74 of control information to power network objects. The system protection terminals 18 in this embodiment are further equipped with a GPS interface 76 and an operator interface 78.

The illustration of the communication network 22 in Fig. 7 should be construed as a general representation of a communication network of any configuration. As mentioned above, the network can in practice be made as e.g. a loop or a masked structure.

A more detailed illustration of a system protection terminal 18 according to the embodiment of Fig. 7 is shown in Fig. 8. Input 72 of measured power system quantities is received in the substation control system 70 by means of power system converters and measuring devices 80. The measuring signals are transmitted to internal measuring signals in a measuring signal unit 82. signals are transmitted to an input interface 88 of the system protection terminal 18. A GPS time synchronizing device 90 uses GPS signals 76 to create a time reference for the measured data. This time reference is connected to the input interface 88 to create a time mark of the received measurements. The time-stamped measurements are further provided to a variable database 93 for the power system. The variable database 93 for the power system is in turn bi-directionally connected to a high speed communication interface 96, which handles the communication on the communication network 22 to other system protection terminals 18.

The data in the Variable Database 93 for the power system will in this way contain information, not only about power network variables for units connected directly to the communication network 22 even if the power network variables associated with the system protection terminal 18 in question, but through other system protection terminals. The power system variable database 93 may therefore have, for its own purposes, a complete set of updated power system information. This information is available to a decision making logic unit 92, which is also provided with an appropriate time reference from the GPS time synchronizing unit 90. The decision making logic unit 92 forms the core of the local part of the network. The decision-making logic unit 92 interprets the available data and decides whether any emergency measures need to be taken. If such measures are necessary, the decision making logic unit 92 uses an output interface 91 to send internal control signals to a control signal unit 86 in the control system 70. A power system actuator unit 84 transmits the internal control signals to relevant control signals 74 acting on the associated objects in the electric power system 1. This embodiment The basic idea is thus that each system protection terminal 18 is responsible for both measurements and emergency control signals to a number of objects in the power system. Decisions are made locally and can therefore more easily reach a sufficiently short reaction time to instabilities and disturbances. The design with local decisions for measures also improves the overall reliability of the protection system.

A monitoring unit 94 for monitoring, service, maintenance and updating communicates with the variable system 93 for the power system and the decision making logic unit 92. This monitoring unit 94 monitors and evaluates the operation of the system protection terminal 18 based on the information available in the variable database 93 for the power system. Preferably, the monitoring unit 94 includes or is connected to a database of historical information about the state of the power system. Such a database can be used for post-analysis of strained situations or as a temporary source of local control information if communication with other system protection terminals is interrupted. The monitoring unit 94 is bi-directionally connected to a low speed communication interface 97, to enable communication with an operator via an operator interface 78.

The operator is thus allowed to monitor and influence the operation of the system protection terminal 18. Such an interaction is intended to be used with caution and is not usually used for emergencies as such.

The low speed communication interface 97 is also connected to a parameter setting database 95, which in turn is readable by the decision making logic unit 92. The parameter setting database 95 includes parameters used by the decision making logic unit 92 in its operation. The operator thus has an opportunity to manually set the decision logics during operation, ie. without taking the network protection out of service.

In some cases, the system protection terminal 18 may be necessary for emergency control of certain power system objects, but no corresponding measurements are required.

The system protection terminal 18 may in such cases lack the units for measurement input data, ie. units 80, 82 and 88. In such cases, the complete information on which the decisions are based is received through the communication network 22 from other system protection terminals 18. However, the decision on emergency control measures is taken locally.

In other cases, no emergency control measures are at all relevant to the power system objects associated with the system protection terminal 18. In such cases, the system protection terminal 18 functions as an administrative system for measurement data, and decision logics and associated units can be omitted.

In a system that includes all of the above variants, some terminals contain only measurement-related equipment, some terminals contain only emergency control-related equipment, and some terminals contain both. From a general point of view, the network protection includes a set of system protection terminals. A first subset of terminals includes means for measuring handling. This first subset can contain all terminals in the set or fewer. However, the first subset should include at least two terminals, as otherwise the overall system concept would be incomprehensible. A second subset of terminals includes emergency control means. This second subset can contain all terminals in the whole set or less. It may also be identical to the first subset, if all terminals include both the functions, or have a number of common terminals. According to the same reasoning as for the first subset, the second subset should include at least two terminals. A second subset with only one terminal would correspond to a centralized decision structure, which is one of the features which the present invention intends to avoid, due to the obvious disadvantages.

In some cases, where control measures are extremely simple and the probability of such measures is highly unlikely, the current decision-making logical unit may be considered unnecessary. A nearby terminal can then perform the operation of such emergency control, by providing a connection between the output interface 91 and the high speed communication interface 96. In a first terminal, the decision making logic unit 92 not only influences the decisions that have to do with its own associated power system objects, but also with power system objects associated with a nearby terminal. If a control measure on such a nearby object is provided, the internal communication interface 96 at high speed for forwarding to it is determined, the control signal to the nearby terminal. In the nearby terminal, which basically lacks the decision logic, the control signal is received at the high speed communication interface 96 and forwarded directly to the output interface 91. However, such solutions are not suitable when the time aspects are critical, as it involves additional communication steps.

Fig. 9 shows a fate diagram for a general method, for system protection according to the present invention. The process begins in step 200. In step 202, measurement signals corresponding to power system characteristics are collected in terminals, which are included in a first subset of terminals. Data associated with the measurements is transmitted to terminals, which are included in a second subset of terminals in step 204. The transmission takes place via a substantially dedicated communication resource. In step 206, the terminals of the second subset process the available data to evaluate system stability and interference situation. In step 208, it is determined if there is any need for emergency measures for system protection. If no emergency protection measures are necessary, the process proceeds to step 212. If emergency protection measures are necessary, the process proceeds to step 210, where control signals for driving such protection measures are provided. The process ends in step 212.

The method of the present invention can be implemented as software, hardware or a combination thereof. A computer program product that implements the method or a portion thereof includes software or a computer program running on a general or specially adapted computer, processor or microprocessor. The software comprises code elements for computer programs or code parts for software which cause the computer to perform the method using at least one of the steps previously described in Fig. 9. The program may be stored in whole or in part on or in one or more suitable computer readable media or data memory means such as a magnetic disk. CD-ROM or DVD disc, hard disk, magneto-optical memory device, in RAM or volatile memory, in ROM or memory memory, as firmware, or on a data server.

Suitable primary power system quantities that can be measured and used as input data to the system protection terminals are e.g. voltage, current, status of high voltage equipment in power systems, status of control and protection equipment in power systems, such as start and trip signals, and positions or current values for control functions. The size, phase angle and frequency are the most interesting features when measuring voltages and currents.

High voltage equipment in power systems includes equipment such as transformers, switches, disconnectors, capacitor banks, reactors, and control and protection equipment for power system voltage regulators, turbine regulators, actuators for valves, relays which include e.g. both HVDC and FACTS controllers. Other sizes can also be used.

The quantities are preferably time-marked. From time-stamped measurements, complex alternating current quantities, so-called phase quantities, can be derived. The quantities can be conveyed as measured or can be pre-processed before they are conveyed to other terminals. Based on these quantities, a large number of related quantities can be derived, such as frequency, derivative of the quantities, active and reactive power. Even sums, differences, maximum and minimum values are easily derived. Relation variables such as limit values, "greater than", "less than", etc. can also be calculated and used.

The measurements can be derived from many different sensors in the power system. Non-limited examples are e.g. voltage transformers, current transformers, binary signals from relays, sensors for active and reactive power, sensors for generator speed and temperature sensors. More specific sensors such as phase measuring equipment (PMUs), voltage instability predictors (VIP) as well as converters sensitive to frequency instability, weakly attenuated power fluctuations and transient instabilities can also be used.

A phase measurement unit (PMU unit) provides continuous or sampled phase measurements in real time. Synchronized phase measurements describe e.g. in "Synchronized Phasor Measurements in Power Systems" by A.G. Phadke in IEEE Computer Applications in Power, vol. 6, no. 2, April 1993, pages 10- 15. Such equipment is commercially available from fl your various suppliers, e.g. PMU Model 1690 from Macrodyne, Inc. This PMU has an effective sampling frequency of more than 2 kHz and is time-synchronized, using GSP time, to an accuracy of lps.

The operation of a predictor of voltage instability (VIP) is described e.g. in "Grids Get Smart Protection and Control" by K. Vu et. al., IEEE Computer Application in Power, vol. 10, no. 4, October 1997, pages 40-44. Such predictor units can be designed to act directly on measurements and provide control signals as input to a system protection terminal. The VIP unit then only operates on locally obtained data and is an input device to the system protection terminal. Alternatively, the algorithms of a VIP unit can be used and integrated in the sister protection terminal 10 15 20 25 30 517 963 26 o: nan | decision-making process. The VIP unit will then form part of the decision-making logic unit 92 (Fig. 8).

Predictors sensitive to frequency instability, thermal violations that affect stability properties, slightly attenuated power fluctuations and transient stability can be used in the same way in the network protection. They can be implemented as separate units that only operate on local measurements, or can be implemented as part of the system protection terminals' decision logic.

The emergency control measures are sent as orders to objects in the power system. Suitable but non-limiting examples could be generator regulators, voltage regulators for generators (Automatic Voltage Regulators), regulators for high voltage direct current (HVDC), regulators for static compensators (Static Be Compensatox- 'fl SVC) and FACTS components ("Flexible AC Transmission Systems"), winding couplers on transformers and switches for e.g. load disconnection, generator disconnection, shunt capacitors and shunt reactors. The most conventional controllable objects can be used to perform the necessary emergency control measures in accordance with the decisions made by the system protection terminal.

The communication system is an important part of the present invention.

Since the guardrail operates in an emergency mode for a power system, time is an important factor. Data must be transmitted »between the various system protection terminals in such a fast way that emergency measures can still have the intended effect. The use of ordinary communication systems, which share the communication resources, gives an unacceptable uncertainty in the communication speed.

The communication system of the present invention thus requires a substantially declared communication resource for the communication between the system protection terminals. Such dedication ensures that the transmission time 10 15 20 25 30 27 '' o if q. u within the communication network can be estimated and all data can be available at all terminals within a predetermined time. The value of this time depends on the transmission capacity of the communication resource, the amount of data to be transmitted and the configuration of the communication network. In order to establish protection against transient angular instability, transient voltage instability, frequency instability and damping of system-wide power fluctuations, the requirements for the predetermined maximum communication time are in the order of parts of one second. A couple of hundred milliseconds are needed for transient angular instability and transient voltage instability. Time limits of one second could be sufficient for frequency instability and tracking purposes. For protection against voltage instabilities in a longer time aspect, communication times up to five seconds are usually acceptable.

The capacity of the communication resource must be adapted accordingly, emphasizing the importance of fixed (or at least predictable) delays in the communication system.

The term "communication resource" in this document refers to any limited allocable communication resource. Examples could be time slots or frequency bands in radio transmission communication systems, or even separate physical wires, such as dedicated cables or cables. The important feature is that the resource's capacity is permanently allocated to the network defense and is not affected by competing traffic.

According to conventional technology, the current implementation of the communication system can be carried out in many different ways. Fiber networks, microwave lines or for shorter distances also copper cables are possible solutions, either separately or in combination. Communication using publicly available networks such as the Internet would also be possible if secured. power line carriers can be a well-suited alternative. However, the probability of transmission requirements can Communication based on interruptions in communication increases in connection with instability in the network. It will be appreciated by those skilled in the art that various modifications and changes may be made to the present invention without departing from the scope thereof. , which are defined by the appended claims.

REFERENCES C. Counan et. a1 .: "Major Incidents on the French Electric System: Potentiality and Curative Measurement", IEEE Transactions on Power Systems, vol. 8, no. 3, August 1993, pages 879-886.

M. Bidet: “Contingencies System against Loss of Synchronism based on Phase Angle Measurements”, Electricité de France (EdF) Report 93NR00009, Direction des Etudes et Recherches, March 1993.

B. Ingelsson et. a1 .: "Special Protection Scheme against Voltage Collapse in the South Part of the Swedish Grid", CIGRE Paper 38-105, Paris, August 1996.

B. Ingelsson et. a1 .: "Wide-Area Protection Against Voltage Collapse", IEEE Computer Applications in Power, vol. 10, no. 4, October 1997, pages 30-35.

O. Samuelsson: "Wide Area Measurements of Power System Dynamics - The North American WAMS Project and its Applicability to the Nordic Countries" Elforsk Report 99:50, Lund University, January 2000.

L.H. Fínk and K. Carlsen: "Operating under Stress and Strain", IEEE Spectrum, vol. 15, no. 3, March 1978, pages 48-53.

A.G. Phadke: "Synchronized Phasor Measurements in Power Systems", IEEE Computer Applications in Power, vol. 6, no. 2, April 1993, pages 10-15.

K. Vu et. al .: "Grids Get Smart Protection and Control", IEEE Computer Application in Power, vol. 10, no. 4, October 1997, pages 40-44. 10 15 20 25 30 517 963 wo va; I i g; . , March 1978, both mathematically and in words.

Note: Underlined symbols (x, y, z, p) and numbers (zero) denote vectors, while uppercase F, G and H are used to denote state equations, similarity and inequality conditions. Derivative of state variables with respect to time is written as "x-dot".

The force system can be modeled with a set of differential equations and a set of algebraic equations, ie. a differential-algebraic system of equations or a DAE model (“Differential-Algebraic system of Equations”). A general form of a UAE model can be written as: l, l |> <|| '11 ß * | * <VU 7 IG ll Bl L * 1%! Vt: with a known set of initial conditions. In the above formulation, 5 is a vector with dynamic system states, sometimes called state variables, X is a vector with algebraic, power flow states (ie system variables associated with the nonlinear algebraic conditions) and B is a vector with parameter values.

A second set of equations representing inequality conditions can be added to the system of differential-algebraic equations above. 10 15 20 25 30 517 963 so n,. o n v o o - | 1 o u a »The inequality conditions can, for example, represent system variables, such as currents and voltages, which must not exceed maximum levels that represent limitations of physical equipment.

,) IO lë <ll ll Q * fi f; g? k * re 'SL Is, l lo V Q f? |% lä: where the last set of equations, the conditions of inequality, if necessary, could be divided into a set of strict differences and a set of differences greater than or equal to zero; i.e. (_)> H dä, Z, p) and (_) 2H2 (5,; _ », p). In most cases, it is possible to rewrite all types of conditions of inequality into strict differences.

The operating conditions can be based on the basic DAE model above extended by a safety margin that gives the distance to the defined unsafe condition.

During normal operation, reserve margins for both transmission and generation must be sufficient to provide an appropriate level of safety with regard to the loads to which the system may be exposed. If a disturbance, which according to the design criteria applicable to the studied power system, would result in a violation of certain conditions of inequality (or even worse conditions of inequality), the margin in this case would be considered insufficient (negative). The equipment would e.g. be overloaded, more or less severely, over its rated capacities.

The dynamic states describe the transition, ie. the path of the state variable set, between equilibrium points, where dx / dt = 0.

The operating conditions to be defined mainly refer to power system operation, ie. in control centers, where the main parts of the studies, today, are carried out in a static or at least quasi-static environment. The dynamics of force system 10 15 20 25 30 517 963 31 "" 'can generally be divided into electromagnetic, electromechanical or long-term phenomena. This division is based on the time scale in which different phenomena exert their main influence.

Both the electromagnetic and electromechanical dynamics of generators as well as all the dynamics of something and loads are considered in the following discussion to be in a steady state, ie. the corresponding state variables are at equilibrium values. This seems to be a reasonable assumption for the division into operating conditions for operating considerations for power systems, while transients must of course be taken into account for both operational and protective considerations.

Note that the relationship above does not indicate whether a found equilibrium point is stable or not, if such points exist at all.

An equilibrium point is asymptotically stable if all nearby solutions not only stay close but also strive for this equilibrium point as time goes towards infinity. For normal operation, it is assumed that the operating point of the studied system of state variables after the last switching procedure, ie. for the ratio after a fault, will be in the region drawn to the equilibrium point after a fault, which is an asymptotically stable equilibrium point, if such a point exists. If this assumption is seriously exceeded, it will also show up in the Equality and Inequality Terms.

Three sets of generic equations, one differential and two algebraic thus regulate the operation of the power system. As described above, the differential set describes the physical laws that govern the dynamic behavior of system components. The two algebraic "conditions of equality" and "conditions of inequality".

The similarity conditions refer to the system's total load and total generation. the sets include The inequality conditions state that certain system variables, such as currents and voltages, may not exceed maximum levels or fall below minimum levels. Maximum levels can e.g. represent limitations due to thermal load on physical equipment. lO 15 20 25 30 517 963 v. , .... . . . . . . z. . .n j: v:: nu n. , 'I Q. o v, 32 "" '' Û I Illv I Based on the discussion above, it seems sufficient to include the systems of equations for conditions of inequality and inequality together with a measure of the margin to define operating conditions used for operational purposes.

The following mathematical formulation could therefore form a basis for the division into operating states. The basis includes the conditions of equality and inequality, ie.

Glæ, l, l | o ll | “<Po 7 9 HW.

V VB together with a “measure” of the safety margin, called M. If M is positive, M> 0, the safety margin is sufficient with regard to design criteria for the power system, ie. sizing rules.

The conditions of equality and inequality are considered either "ok" if they are met or "violated" if they are not met, while the margin is considered "ok" if it is positive and "violated" if it is negative.

The operating conditions defined by Fink and Carlsen could in the mathematical formulation presented above be classified according to the listing below: Normal: G ok ie. G (J_c, X, BF Q H ok ie H (§, X, B) <(_) M ok ie M> 0 Contingency: G ok ie GQ, X, 2): Q H Ok ie. Hx, x, g) <(_) M violated ie. M <0 Nödfaii; G ok i.e. G (¿, y, p) = o lO 15 20 517 963 nu nu; 33 H violated ie. H (_15, y, E)> Q M violated ie. M <0 Extreme: G violated ie. GQ, y, 2): Q H violated ie. H (1¿, y, B)> Q M violated ie. M <0 As shown, the four operating states above can be defined using these three mathematical relations.

During normal operation, both sets of algebraic equations are met and the safety margin is sufficient with respect to applicable design criteria. The transition to the state of emergency takes place when the safety margin is no longer sufficient, ie. M the formulation above. If the situation continues to worsen and conditions of inequality are no longer met, the operating condition changes to the emergency condition. If the operating situation worsens further and conditions of equality are also violated, the operating condition is transferred to the extreme condition, which corresponds to a partial or total interruption in the electric power system.

Claims (34)

1. 0 15 20 25 30 517 963 34 u u u ø ø ø n ø Q n. CLAIMS 1. Network protection systems for the protection of the integrity of a total electric power system (1), comprising: a set of at least three system protection terminals (18), and communication systems (22) connecting the system protection terminals (18), which system protection terminals (18) in turn comprises: a processor unit (92-95), and a communication unit (96) connected to the processor unit (92-95) for communication on the communication system (22), characterized in that the system protection terminals (18) in a first subset of the set of system protection terminals comprise means for obtaining measurement signals (88), connected to the processor unit (92-95) for collecting measured characteristics of the electric power system (1), the first subset comprising at least two system protection terminals (18), the system protection terminals (18) in a second subset of the set of system protection terminals means for providing control signals (91), connected to the processor unit (92) - 95) for providing control signals to power system units, the second subset comprising at least two system protection terminals (18), and the communication unit (96) is arranged to transmit data associated with the measurement signals over a substantially dedicated communication resource in the communication system (22). Electric power system (1), comprising a network guard for protecting the integrity of a total electric power system (1), which network guard comprises: a set of at least three system protection terminals (18), and communication systems (22) connecting the system protection terminals (18), which system security terminals (18) in turn comprise: a processor unit (92-95), and a communication unit (96) connected to the processor unit (92-95) for communication on the communication system (22), characterized in that the system protection terminals (18) in a first subset of the set of system protection terminals comprise means for obtaining measurement signals (88), connected to the processor unit (92-95) for collecting measured characteristics of the electric power system (1), the first subset comprising at least two system protection terminals ( ), the system security terminals (18) in a second subset of the set of system security terminals comprise means for providing control signals (91) connected to the processor unit (92-95) for providing control signals to power system units, the second subset comprising at least two system protection terminals (18), and the communication unit (96) being arranged to transmit data associated with the measurement signals over a substantially dedicated communication in the communication system (22). System according to claim 1 or 2, characterized in that the characteristic of the electric power system (1) comprises at least one of: time-marked voltage values: time-marked current maintenance; complex AC quantities, so-called phase quantities; frequency; as well as stability indicators. A system according to any one of claims 1 to 3, characterized in that the processor unit (92-95) of system protection terminals (18) belonging to the second subset comprises decision processing means (92) for power system control. A system according to any one of claims 1 to 4, characterized in that each of the processor units (92-95) of system protection terminals (18) belonging to the second subset comprises at least one of: means for detecting of serious risk of voltage instability; means for detecting serious risk of frequency instability; means for detecting violation of thermal limits, which affect power system stability; means for detecting weakly attenuated power fluctuations; and means for detecting the serious risk of transient angular instability. System according to one of Claims 1 to 5, characterized in that the system protection terminals (18) of the second subset also comprise memory means (93, 95) for storing / retrieving data. System according to one of Claims 1 to 6, characterized in that the communication resource is dimensioned for transmitting data between any two system protection terminals (18) in the set within a predetermined time. System according to claim 7, characterized in that the predetermined time is less than 5 s. System according to claim 8, characterized in that the predetermined time is less than 1 s. System according to one of Claims 1 to 9, characterized in that at least three of the system protection terminals (18) are provided with at least two communication links each. System according to claim 10, characterized in that at least two of the system protection terminals (18) are provided with at least three communication links each. 10 15 20 25 30 517 963 37 System according to one of Claims 1 to 11, characterized in that the data transmitted in the communication system (22) is available for all system protection terminals (18) in the set-up. A system according to any one of claims 1 to 12, characterized in that at least one of the system protection terminals (18) of the set further comprises means for external information exchange (97). System according to one of Claims 1 to 13, characterized in that the system protection terminals (18) are substantially dedicated terminals. A system protection method for protecting the integrity of a total electric power system (1), having a set of at least three system protection terminals (18), comprising the steps of: collecting measurement signals (72) associated with measured characteristics of the electric power system (1) in a the first subset of the set of system terminals (18), the first subset comprising at least two system terminals (18), transmitting data associated with the measurement signals (72) over a substantially dedicated communication resource to a second subset of the set of system terminals (18); comprises at least two system protection terminals (18), in the protection terminals (18) of the second subset, processing the data to determine any need for system protection measures, and if system protection measures are necessary, to provide control signals to units in the electric power system (1). in System protection method according to claim 15, characterized in that the characteristic of the electric power system (1) comprises at least one of: time-marked voltage values: time-marked current values; complex AC quantities, so-called phase quantities; frequency; and 10 15 20 25 30 517 963 38 stability indicators. System protection method according to claim 15 or 16, characterized in that the processing step further comprises at least one of the steps: detecting any occurrence of serious risk of voltage instability; detection of the possible presence of a serious risk of frequency instability; detecting the possible occurrence of violation of thermal limits, which affect power system stability; detecting the possible occurrence of weakly attenuated power fluctuations; and detection of the possible presence of serious risk of transient angular instability. System protection method according to one of Claims 15 to 17, characterized by the further step of storing the data in the sister protection terminals (18) of the second subset. System protection method according to claim 18, characterized in that the processing step comprises the step of retrieving the stored data. System protection method according to one of Claims 15 to 19, characterized in that the communication step is carried out within a predetermined time. System protection method according to claim 20, characterized in that the predetermined time is less than 5 s. System protection method according to claim 21, characterized in that the predetermined time is less than 1 s. 10 15 20 25 30 517 963 39 n coca n The sister protection method according to any one of claims 15 to 22, characterized in that the communication step further comprises the step of making all data available to all system protection terminals (18) in the second subset. - System protection method according to one of Claims 15 to 23, characterized in that the processing step further comprises the step of exchanging external information. System protection terminal (18) for protecting the integrity of an entire electric power system (1), comprising: a processor unit (92-95), and a communication unit (96) connected to the processor unit (92-95), characterized in that the system protection terminal (18) comprises : means for obtaining measurement signals (88), connected to the processor unit (92-95) for collecting measured characteristics of the electric power system (1), and means for providing control signals (91), connected to the processor unit (92-95) for providing control signals to power system units, the communication unit (96) being arranged to transmit data associated with the measurement signals over a substantially dedicated communication resource. System protection terminal according to claim 25, characterized in that the characteristic of the electric power system (1) comprises at least one of: time-marked voltage maintenance: time-marked current values; complex AC quantities, so-called phase quantities; frequency; as well as stability indicators. 10 15 20 25 30 517 963 System protection terminal according to claim 25 or 26, characterized in that the processor unit (92-95) comprises decision processing means (92) for power system control. System protection terminal according to one of Claims 25 to 27, characterized in that the processor unit (92-95) comprises at least one of: means for detecting a serious risk of voltage instability; means for detecting serious risk of frequency instability; means for detecting violation of thermal limits, which affect power system stability; means for detecting weakly attenuated power fluctuations; and means for detecting the serious risk of transient angular instability. System protection terminal according to one of Claims 25 to 28, characterized by memory means (93, 95) for storing data. System protection terminal according to one of Claims 25 to 29, characterized in that the communication unit (96) is arranged for communication on at least two communication links, when using the dedicated communication resource. System protection terminal according to claim 30, characterized in that the communication unit (96) is arranged for communication on at least three communication links, when using the dedicated communication resource. System security terminal according to one of Claims 25 to 31, characterized by means for external information exchange (97). A computer program product comprising computer code means and / or software code portions for causing a processor to perform the steps of any one of claims 15 to 24. 0 n u I! una: n ... 'g: - -' I 2 t:. °; - - - 'z n u oo:: z' z: nn-u. , ° v 1, n. , 517 963 41 A computer program product according to claim 33 contained in, or in, a computer readable medium.