Worked Example: Distance Protection Settings for a Transmission Interconnector — The 2003 Italy-Switzerland Blackout

At 03:01 on 28 September 2003, a tree flashover on the 380 kV Lukmanier Pass interconnector between Switzerland and Italy triggered a cascade that blacked out the entire Italian peninsula, affecting 56 million people. The sequence of events reads like a textbook case of protection mis-coordination:

The Lukmanier line had tripped on distance protection Zone 1 — correctly, as the tree flashover was a genuine line-to-ground fault on the protected line. The problem began when the remaining interconnectors between Switzerland and Italy absorbed the redirected 300 MW of power flow. Twenty-four minutes later, the 380 kV San Bernardino interconnector was carrying approximately 110% of its thermal rating. The operators had 24 minutes to reduce load transfer or open the line in a controlled manner, but failed to act.

Then the critical failure: the distance relay on the San Bernardino line interpreted the heavy load current as a distant fault. Zone 3, the backup distance element with the widest reach, saw the apparent impedance (V/I) drop below its operating characteristic as the load current increased. Zone 3 tripped the San Bernardino line — not because there was a fault, but because the relay could not distinguish between a high-current overload and a remote three-phase fault. Within 12 seconds of the San Bernardino trip, all remaining interconnectors overloaded and tripped, completely islanding Italy from the European grid. Italy’s internal generation could not meet demand, frequency collapsed below 49 Hz, and the entire country blacked out within 2.5 minutes.

The root cause was Zone 3 settings on the San Bernardino relay that had not been coordinated with the line’s maximum load transfer capability. The relay’s impedance reach encroached on the load impedance locus, making overload indistinguishable from a distant fault. This single setting error — a few ohms of reach on one relay — caused the largest blackout in European history.

Design distance protection settings for a 380 kV transmission interconnector. Calculate zone reaches, time delays, load encroachment boundaries, and verify coordination with adjacent line protection.

The total positive-sequence impedance of the 120 km line:

Z_L = z₁ × L = (0.015 + j0.30) × 120 — (Eq. 1)

Z_L = 1.80 + j36.0 Ω

|Z_L| = √(1.80² + 36.0²) = 36.04 Ω

θ_L = arctan(36.0 / 1.80) = 87.1°

The line impedance angle of 87.1° is typical for HV transmission lines where inductive reactance dominates (X ≫ R). This angle determines the Mho relay characteristic angle.

Convert to secondary (relay) quantities using the CT and VT ratios:

Z_L,sec = Z_L × (CT ratio / VT ratio) = 36.04 × (2000/1) / (380000/110) — (Eq. 2)

Z_L,sec = 36.04 × 2000 / 3455 = 20.87 Ω (secondary)

Zone 1 is the fastest-operating zone with no intentional time delay. It covers the majority of the protected line but is deliberately set below 100% to avoid overreaching into the adjacent line due to CT/VT errors and transient effects. Per IEC 60255-121, Clause 5.4.2:

Z₁ = 0.80 × Z_L — (Eq. 3)

Z₁ = 0.80 × 36.04 = 28.83 Ω (primary)

Z_1,sec = 0.80 × 20.87 = 16.70 Ω (secondary)

Time delay: 0 ms (instantaneous)

The 80% setting means Zone 1 covers the first 96 km of the 120 km line. Faults in the remaining 24 km (80–100% of line length) are cleared by Zone 2 with a time delay, or by the remote end’s Zone 1.

Zone 2 covers the entire protected line plus a portion of the adjacent line, providing backup for the remote end’s Zone 1. Per IEC 60255-121, Clause 5.4.3:

Z₂ = 1.20 × Z_L — (Eq. 4)

Z₂ = 1.20 × 36.04 = 43.25 Ω (primary)

Z_2,sec = 1.20 × 20.87 = 25.04 Ω (secondary)

Zone 2 must also be checked against the adjacent line’s Zone 1 to ensure it does not overreach beyond what the adjacent relay protects instantaneously:

Z_2,check ≤ Z_L + 0.50 × Z_adjacent

Adjacent line impedance: z₁ × 90 km = (0.015 + j0.30) × 90 = 1.35 + j27.0 = 27.03 Ω

Z_2,check = 36.04 + 0.50 × 27.03 = 36.04 + 13.52 = 49.56 Ω

Since 43.25 Ω < 49.56 Ω, the Zone 2 setting does not overreach beyond 50% of the adjacent line. ✓

Time delay: 350 ms (typical range 300–500 ms per IEC 60255-121)

The 350 ms delay allows the remote end’s Zone 1 (instantaneous) to clear faults in the overlapping region first. Zone 2 only operates if the remote Zone 1 fails to clear.

Zone 3 provides remote backup protection for faults on the adjacent line that the adjacent line’s own protection fails to clear. Per IEC 60255-121, Clause 5.4.4:

Z₃ = 1.20 × (Z_L + Z_adjacent) — (Eq. 5)

Z₃ = 1.20 × (36.04 + 27.03) = 1.20 × 63.07

Z₃ = 75.68 Ω (primary)

Z_3,sec = 75.68 × 2000 / 3455 = 43.80 Ω (secondary)

Time delay: 800 ms (must coordinate with the adjacent line’s Zone 2 at 350 ms, plus a grading margin of 350–450 ms)

To verify that Zone 3 does not operate during maximum load, calculate the minimum load impedance as seen by the relay:

Z_load = V_phase / I_load = (V_LL / √3) / I_max — (Eq. 6)

Maximum load current:

I_max = S_max / (√3 × V) = 1,800,000,000 / (√3 × 380,000) = 2,735 A

Phase voltage:

V_phase = 380,000 / √3 = 219,393 V

Load impedance magnitude:

|Z_load| = 219,393 / 2,735 = 80.2 Ω — (Eq. 7)

At minimum power factor of 0.85 lagging, the load impedance angle is:

φ_load = arccos(0.85) = 31.8°

So the load impedance on the R-X diagram is at:

R_load = 80.2 × cos(31.8°) = 68.1 Ω

X_load = 80.2 × sin(31.8°) = 42.3 Ω

In secondary quantities:

|Z_load,sec| = 80.2 × 2000 / 3455 = 46.4 Ω

The Mho characteristic for Zone 3 is a circle on the impedance (R-X) plane that passes through the origin with its diameter along the line impedance angle (87.1°). The reach is 75.68 Ω along this angle.

Check: does the load impedance point (68.1 + j42.3 Ω) fall inside the Zone 3 Mho circle?

The distance from the origin to the load point is:

|Z_load| = 80.2 Ω

The Zone 3 Mho circle has a diameter of 75.68 Ω along 87.1°. At the load impedance angle of 31.8°, the Mho circle’s reach (the chord length at that angle) is:

Z_Mho,reach(φ) = Z₃ × cos(θ_L − φ_load) — (Eq. 8)

Z_Mho,reach = 75.68 × cos(87.1° − 31.8°) = 75.68 × cos(55.3°)

Z_Mho,reach = 75.68 × 0.571 = 43.2 Ω

The load impedance at maximum transfer is 80.2 Ω, and the Mho circle reach at the load angle is 43.2 Ω. The margin is:

Margin = |Z_load| / Z_Mho,reach = 80.2 / 43.2 = 1.86 — (Eq. 9)

The 2003 scenario: On the San Bernardino line, the combination of (1) Zone 3 reach set too aggressively, (2) maximum load transfer exceeding the studied value, and (3) depressed voltage due to reactive power deficit reduced the margin below 1.0 — the load impedance fell inside the Zone 3 characteristic, and the relay tripped.

Modern distance relays include a load encroachment function that carves out the load impedance region from the Mho characteristic, preventing Zone 3 from operating for load current. Per IEC 60255-121, Clause 5.7:

The load encroachment boundary is defined by two straight lines (blinders) on the R-X diagram, parallel to the line impedance angle, restricting the Mho circle along the R-axis:

R_{forward,blinder} = Z_load,min × cos(φ_load,max) × k_safety — (Eq. 10)

Where k_safety = 0.80 (20% safety margin below minimum load impedance):

R_{forward,blinder} = 80.2 × cos(31.8°) × 0.80 = 68.1 × 0.80 = 54.5 Ω

In secondary quantities:

R_{forward,blinder,sec} = 54.5 × 2000 / 3455 = 31.5 Ω (secondary)

The blinder restricts Zone 3 operation: any apparent impedance with a resistive component exceeding 54.5 Ω is blocked from tripping, even if it falls inside the Mho circle. This prevents the relay from tripping on heavy load while still allowing it to detect high-resistance faults (which have large R but also large X).

The reverse blinder protects against reverse power flow (export conditions):

R_{reverse,blinder} = −54.5 Ω (primary) / −31.5 Ω (secondary)

During a system disturbance (such as the loss of a major interconnector), the remaining lines experience power oscillations as generators swing against each other to find a new equilibrium. The apparent impedance seen by a distance relay during a power swing traces a trajectory across the R-X diagram that can cross the Mho zone boundaries. Without power swing blocking (PSB), the relay would trip during the swing — disconnecting a healthy line and worsening the disturbance.

Per IEC 60255-121, Clause 5.8, PSB uses two concentric zones: an outer zone and an inner zone. A genuine fault causes the impedance to jump instantaneously into the inner zone. A power swing causes the impedance to traverse gradually from outside the outer zone, through it, and into the inner zone.

PSB outer zone:

Z_PSB,outer = 1.30 × Z₃ = 1.30 × 75.68 = 98.4 Ω

PSB inner zone:

Z_PSB,inner = 1.10 × Z₃ = 1.10 × 75.68 = 83.2 Ω

PSB timer: If the impedance trajectory takes longer than 40 ms to traverse from the outer boundary to the inner boundary, the relay identifies it as a power swing (not a fault) and blocks Zone 3 tripping. Typical faults cause impedance transitions in < 5 ms, well below the 40 ms threshold.

If the power swing is unstable (impedance crosses through the relay characteristics and exits the other side), the relay may be set to trip after a definite delay to separate the systems in a controlled manner (out-of-step tripping).

The final verification: ensure that our Zone 2 and the adjacent line’s Zone 1 coordinate correctly, and that our Zone 3 coordinates with the adjacent line’s Zone 2.

Adjacent line Zone 1: 0.80 × 27.03 = 21.62 Ω (instantaneous)

Adjacent line Zone 2: 1.20 × 27.03 = 32.44 Ω (350 ms delay)

Coordination check — our Zone 2 vs. adjacent Zone 1:

Our Zone 2 reach beyond the remote bus: 43.25 − 36.04 = 7.21 Ω into the adjacent line.

Adjacent Zone 1 reach: 21.62 Ω. Since 7.21 Ω < 21.62 Ω, our Zone 2 is well within the adjacent Zone 1 coverage. For a fault at our Zone 2 boundary (7.21 Ω into adjacent line), the adjacent line’s Zone 1 sees it and trips instantaneously, while our Zone 2 waits 350 ms. Coordination OK. ✓

Coordination check — our Zone 3 vs. adjacent Zone 2:

Our Zone 3 reach beyond the remote bus: 75.68 − 36.04 = 39.64 Ω into the adjacent line.

Adjacent Zone 2 reach: 32.44 Ω. Our Zone 3 extends 39.64 Ω into the adjacent line, which is beyond the adjacent Zone 2 reach (32.44 Ω). For a fault between 32.44 and 39.64 Ω into the adjacent line, neither the adjacent Zone 1 nor Zone 2 will clear it instantaneously — it requires the adjacent Zone 3. Our Zone 3 (800 ms) must coordinate with the adjacent Zone 3 (~800 ms). Since our Zone 3 provides backup only, the simultaneous trip is acceptable for this rare scenario.

Time grading summary:

All distance protection settings verified. The Zone 3 reach of 75.68 Ω maintains a load encroachment margin of 1.86 at maximum load transfer (1,800 MVA), with a load encroachment blinder at 54.5 Ω resistive reach as additional security. Power swing blocking is configured with a 40 ms rate-of-change timer to prevent tripping during post-disturbance oscillations. These settings, had they been applied on the San Bernardino line in 2003, would have prevented Zone 3 from misoperating during the overload that followed the Lukmanier line trip.

The 2003 Italy-Switzerland blackout was caused by a Zone 3 distance relay that could not distinguish between a heavy load and a distant fault. The protection engineering lessons are now embedded in European grid codes:

• Always verify Zone 3 reach against maximum load transfer — the load encroachment margin must be at least 1.5 (some TSOs now require 2.0) at the maximum credible load transfer, including voltage depression scenarios; this single check would have prevented the San Bernardino trip
• Enable load encroachment (blinder) functions on all Zone 3 elements — modern distance relays include dedicated blinder characteristics that carve the load region out of the Mho circle; these must be set and enabled, not left at factory defaults
• Implement power swing blocking on all transmission distance relays — the cascade following the San Bernardino trip was worsened by other relays tripping on power swings; PSB with a 30–50 ms rate-of-change timer prevents this
• Coordinate protection settings between interconnected TSOs — the Swiss and Italian grid operators had not jointly verified that the San Bernardino relay settings were compatible with the actual cross-border power transfer levels; ENTSO-E now mandates bilateral protection coordination studies
• Consider eliminating Zone 3 on critical interconnectors — after the 2003 event, several TSOs removed Zone 3 from interconnector relays entirely, relying on dedicated backup protection schemes (breaker failure relays, remote backup via teleprotection) instead of a wide-reaching impedance element that risks load encroachment