A generator set has two groups of protections: the engine's (oil pressure, temperature, coolant level, speed, failure to start) and the generator's (overcurrent, voltage, frequency, reverse power). The set controller runs them and decides what is an alarm and what is a trip. A set that runs in parallel with the grid, or at medium voltage, may also need a generator relay.
Two groups of protections
A generator set is a combustion engine driving a generator. Each part has its own protections. The set controller runs them: it starts and stops the engine, measures the generator and decides whether a condition is an alarm or a trip. On this point, read Woodward HighPROTEC MCDG relay.
The guide on the emergency diesel plant describes the parts of the set. Here we explain the protections.
Engine protections
These look after the thermal machine. Controllers from Cummins, Caterpillar, DEIF, Deep Sea and SmartGen include them:
| Protection | What it detects |
|---|---|
| Oil pressure | Insufficient lubrication |
| Coolant temperature and level | Overheating or loss of coolant |
| Overspeed | Speed above the permitted value |
| Failure to start | The engine does not start after the programmed attempts |
| Start lockout | Prevents cranking an engine that is already running |
| Sensor failure | Lost measurement from one of the protections |
| Starting battery | Low charge that would prevent the next start |
Manufacturer controllers also communicate with the engine electronics and read its alarms. A set that “starts and stops” has usually shut down on low oil pressure, high temperature, overspeed or failure to start. The guide on the diesel plant describes it.
Generator protections
These look after the electrical side. Depending on the controller variant they are:
- Overcurrent. Detects overload and short circuit.
- Overvoltage and undervoltage. Voltage outside the permitted range.
- High and low frequency. Frequency outside the permitted range.
- Reverse power. Protects the engine when the generator, in parallel with the grid or other sets, starts to run as a motor; see reverse power 32. This is complemented by generator reverse power (32) trip.
These controller functions do not replace a generator relay when the study requires one. DEIF controllers and SELCO generator relays are described in DEIF and SELCO generator relays.
Which function covers which fault in any generator is summarized in Generator protection: which function covers which fault.
The short circuit and the backup
The current a generator supplies into an external short circuit drops over time: it goes from the subtransient value to the transient one and then to the steady-state value. The latter depends on the synchronous reactance and the excitation, and can fall below rated current. A plain overcurrent element set above the load would not see the fault. That is what voltage-restrained overcurrent 51V is for: it becomes more sensitive as the voltage falls.
Alarm or trip
The controller assigns each protection to one of two actions. The assignment decides whether the set keeps running with a warning or shuts down:
- Does continued operation damage the machine in a short time?
- Yes: Is it an electrical fault of the generator?
- Yes: Trip the generator breaker and stop the engine
- No: Engine shutdown by its own protection (oil, temperature, speed)
- No: Alarm to the operator and event record
- Yes: Is it an electrical fault of the generator?
A badly assigned alarm lets the set be damaged. A badly assigned trip takes out of service an emergency plant that should have kept running.
The analysis of a trip, with the event record, is covered in Fault analysis in generators. Function numbers can be looked up in the free ANSI table tool.
With the transfer switch and with the grid
The emergency set operates together with the automatic transfer switch: on a grid failure the controller starts the engine and the transfer switch moves the load. If the set runs in parallel with the grid, additional requirements appear: synchronization, anti-islanding protection and utility permits. They are explained in the guide on generator in parallel with the grid.
What the grid requires of a set that connects in parallel
When the set runs in parallel with a utility grid, the utility sets the minimum protection functions for synchronous generators, and the design and settings are adapted to the local code and the utility’s requirements. A typical list includes synchronism check (25), phase and ground overcurrent with the voltage-controlled element (51V), negative sequence (46), overvoltage (59), frequency (81) and anti-islanding protection. Loss of field (40) and out-of-step (78) may be treated differently on small machines. Against a list like that, the controller functions are only enough if the variant includes all of them. A protection coordination study is normally part of the connection process.
What is tested at commissioning
Commissioning a set includes five tests: automatic start on a real grid outage, the times to take load, the load steps, the load bank and the alternator protections. During that test, check that each protection does what was assigned: that an alarm does not stop the engine and that a trip does. The guide on the emergency diesel plant details the tests and maintenance.
Declared power and protection
The power of a set is declared under ISO 8528-1 as emergency standby power (ESP), limited-time prime power (LTP), prime power (PRP) or continuous power (COP). Each has a limit on operating hours per year and on average load. The overcurrent and overload settings must respect the power the manufacturer declares for the real use of the set. An emergency set that runs as a prime unit leaves its rating, and the protections do not warn about it.
Common mistakes
- Leaving factory settings without adapting them to the real load.
- Not testing the engine protections because “the set always starts”.
- Assigning a trip to a condition that should only have been an alarm.
- Not reviewing the reverse power protection on a set that goes in parallel.
- Replacing the controller without carrying over the settings.
How we help
At Tiza Group we configure and test your generator set protection: controller or generator relay settings through our remote relay configuration, and on-site tests with secondary injection. If your set runs in parallel with the grid, we quote the coordination study. Write to us.
Related guides
- Emergency diesel plant
- Generator in parallel with the grid
- Generator protection scheme
- Generator protection: which function covers which fault
- Fault analysis in generators
- Woodward HighPROTEC MCDG Generator Protection Relay
- Generator Reverse Power (32) Trip: Causes and Fixes
References
- ISO 8528: reciprocating internal combustion engine driven alternating current generating sets.
- IEEE C37.102: guide for AC generator protection.
- IEEE C37.2: device function numbers.
Frequently asked questions
What is the difference between an alarm and a trip on a generator set?
An alarm warns of a condition that still allows operation, such as a rising temperature. A trip stops the engine or opens the generator breaker because continuing to run damages the machine. The controller assigns each protection to one or the other according to its configuration.
Why is generator overcurrent not enough to detect a short circuit?
Because the current a generator supplies into a short circuit decays over time, and the sustained value can end up below rated current. That is why voltage-restrained overcurrent 51V or distance protection is used as backup.
Does an emergency set need a protective relay in addition to the controller?
On small sets the controller functions are usually enough. When the set is medium voltage, runs in parallel with the grid or serves a critical load, the protection study may call for a generator relay.