In recent years, several accidents have occurred where a single phase of the high-voltage side circuit breaker of the generator transformer unit failed to open, causing single-phase current on the high-voltage side to couple through the transformer, resulting in non-full-phase operation of the generator and generating a large negative sequence current in the generator circuit, leading to severe burnout of the generator rotor. Therefore, regardless of the form of the main electrical wiring of the power plant or the type of high-voltage circuit breaker used in the generator transformer unit, in accordance with the requirements of DL400-91 "Technical Specification for Relay Protection and Automatic Safety Devices" and the principle of dual protection and near-backup protection configuration for generator transformer units, failure protection is configured in the protection of generator transformer units in large unit generators. When the high-voltage side circuit breaker of the generator transformer unit operates in a non-full-phase manner, the failure protection operates, tripping the bus tie (or sectional) circuit breaker and all components or related components on the busbar connected to the high-voltage side circuit breaker of the generator transformer unit, protecting the safety of the generator. 1 Problems with Generator Transformer Unit Failure Protection 1.1 Problems with Composite Voltage Blocking of Failure Protection Early failure protection devices did not have composite voltage blocking, and failure protection frequently malfunctioned. After modification, a composite voltage blocking was added to the failure protection circuit. However, with the increase in the capacity of individual units, the harm of negative sequence current to the generator rotor intensifies. This necessitates the prompt release of the composite voltage blocking when the high-voltage side circuit breaker of the generator-transformer unit is not operating in full-phase mode, and also the release of the logical relationship requirement for the composite voltage blocking of the generator-transformer unit failure protection. This requirement can be easily met in modern microprocessor-based failure protection devices, but it is difficult to meet in early failure protection systems, and modifying early failure protection systems is indeed not an easy task. 1.2 Problems with the Activation Criteria and Logic Relationship of Failure Protection Devices Early failure protection device activation criteria consisted of an AND logic of "circuit breaker protection action" and "phase current." The action involved tripping the bus tie (or sectional) circuit breaker in a short time after a certain delay (the time limit being greater than the sum of the circuit breaker's tripping time and the protection device's return time plus a margin time), followed by tripping all active components on the connected busbar or related components after another time limit. However, according to the "Implementation Rules for Relay Protection of '25 Key Requirements for Preventing Major Accidents in Power Production'" (hereinafter referred to as the "Relay Protection Rules"), after the generator-transformer unit failure protection is activated, the circuit breaker itself should trip once more. Therefore, early failure protection could not meet this countermeasure requirement. 2 Analysis of Generator-Transformer Unit Failure Protection 2.1 Composite Voltage Blocking Components for Failure Protection Composite voltage blocking can prevent maloperation of the generator-transformer unit circuit breaker failure protection. However, in certain types of faults in generator-transformer units, composite voltage operation may not be triggered. For example, if the system bus voltage change is small and the voltage element does not react, or if non-electrical protection operates (such as high winding temperature), composite voltage blocking may not function effectively, leading to failure protection malfunction. Due to improvements in failure protection wiring and the application of microprocessor-based protection devices, the use of bus composite voltage as the fault discrimination element for generator-transformer unit failure protection has been eliminated. Instead, negative sequence current, zero sequence current, or phase current are used as the fault discrimination element. Therefore, for generator-transformer unit failure protection in newly built power plants using microprocessor-based protection devices, it is recommended to eliminate composite voltage blocking for generator-transformer unit failure protection. Simultaneously, a delay should be added to the failure protection output circuit. This delay should be slightly longer than the sum of the circuit breaker tripping time, the protection device return time, and the margin time to prevent maloperation of the failure protection in certain situations. If the composite voltage circuit cannot be eliminated, regardless of whether the high-voltage circuit breaker of the generator-transformer unit is a three-phase operating mechanism or a phase-by-phase operating mechanism, it should be implemented in accordance with the generator-transformer unit failure protection logic requirements of the "Relay Protection Rules" through software or hardware modifications using a microcomputer protection device. If rectification cannot be achieved using a microcomputer device, specific and effective measures should be taken to prevent protection maloperation or failure to operate. If the composite voltage blocking is installed in the output trip circuit of each component, it is easy to remove the composite voltage blocking of the generator-transformer unit failure protection; only the generator-transformer unit output circuit needs to be modified. However, if the composite voltage blocking is installed in the failure protection control circuit, it is very difficult to remove the composite voltage blocking, and protection modification or upgrades need to be carried out during the entire scheduled maintenance time of the failure protection to solve this problem. 2.2 Failure Protection Judgment Element Early generator-transformer unit circuit breaker failure protection judgment elements mostly used phase current elements, making it difficult to select appropriate setting values ​​for the current elements. A high setting value may not guarantee the operation of the current element in certain faults, such as inter-turn short circuits. That is, if the circuit breaker fails in three phases, the discrimination circuit will not activate, and the failure protection will fail to operate. Lowering the setting value, however, still does not guarantee sensitivity under any fault conditions. If the generator-transformer circuit breaker uses a phase-operated circuit breaker and employs a zero-sequence current relay as the discrimination element, the sensitivity of the zero-sequence current relay is not a problem, ensuring reliable activation of the failure protection. However, if the phase-operated circuit breaker fails in all three phases, the zero-sequence current discrimination circuit will fail to activate, and the failure protection will fail to operate. Therefore, regardless of whether the early generator-transformer circuit breaker uses a three-phase or phase-operated mechanism, and regardless of the type of failure protection discrimination element used, the logic requirements for generator-transformer failure protection should be modified according to the "Detailed Rules for Relay Protection". Early failure protection discrimination elements lacked circuit breaker incomplete phase discrimination elements. The generator-transformer unit failure protection logic added circuit breaker incomplete phase discrimination elements. These elements consist of three circuit breaker closing position relays (HWJa, HWJb, HWJC) connected in parallel and three tripping position relays (TWJa, TWJb, TWJc) connected in parallel and then in series. For generator-transformer unit circuit breakers using phase-by-phase operation, generator-transformer unit protection includes circuit breaker incomplete phase protection. Incomplete phase protection and failure protection can share a single set of incomplete phase discrimination elements. 2.3 Failure Protection Starting Elements Failure protection is initiated by the protection action contacts of the faulty element. Its starting method can be divided into phase-by-phase starting and three-phase starting. The generator-transformer unit protection starts with three-phase starting. Failure starting protection in generator-transformer unit protection generally falls into the following three categories. 2.3.1 All protections that initiate full trip also activate failure protection. Full trip refers to tripping the high-voltage side circuit breaker of the generator-transformer unit, the branch circuit breaker of the plant transformer, and the demagnetizing circuit breaker. Full trip protections include differential protection, inter-turn protection, loss-of-magnetization protection, and stator grounding protection for generator-transformer units (generator and transformer). When manually tripping the high-voltage side circuit breaker of the generator-transformer unit in the event of a single-phase failure, the failure protection can be activated by relying on the main transformer zero-sequence protection or the generator stator negative-sequence protection. In the event of a single-phase ground fault, the failure protection can be activated by relying on differential protection and the main transformer zero-sequence protection. In the event of a two-phase short circuit, the failure protection can be activated by relying on the generator stator negative-sequence protection. Simultaneously, it is necessary to prevent malfunctions of the failure protection due to unreasonable coordination between the failure protection and other protections, or unreasonable switch tripping timing logic, under certain fault conditions. Activating failure protection in all protections that initiate full trip can compensate for the deficiencies of insufficient sensitivity of relevant protection components and failure protection failure in some cases. When the three-phase circuit breaker on the high-voltage side of the generator transformer unit fails due to manual tripping, the accident can be handled by switching the busbar. 2.3.2 Partial protection activation of failure protection, gas protection not activation of failure protection. According to technical regulations, gas protection activation of failure protection is not allowed. To ensure that the transformer gas protection does not activate failure protection, the transformer gas protection can be activated by a separate output intermediate relay connected to the manual trip terminal of the control box, while the manual trip does not activate the failure protection. When the gas protection has not yet been separated into a separate output, if the circuit breaker failure protection uses a microprocessor-based device (such as the WMH-800 series designed by Xuchang Relay Factory), the current discrimination and failure timing are all in one device (newly designed 3/2 connection substations generally use this type of device). Since they are not connected by contacts, there is no problem of current relay contact sticking, and the safety of the failure protection is still guaranteed. In fact, now protection devices all use microprocessor-based failure protection devices, so it is advisable to consider allowing the transformer gas protection to activate failure protection. If an electromagnetic current relay is used as the discrimination element, and the gas protection is not separated (such as the PFH series designed by Aji Factory), it is very easy to falsely activate the failure protection. Therefore, electromagnetic current relays cannot be used as the discrimination element to activate the failure protection. 2.3.3 Thermal protection (such as water cut-off protection) Activation of failure protection alone or through reverse power protection When the high-voltage side circuit breaker of the generator transformer unit is a phase-operated circuit breaker, the thermal protection can directly activate the failure protection, or it can be activated by the reverse power protection. The failure protection discrimination circuit uses two zero-sequence current relays connected in series to form and release the voltage blocking. The zero-sequence current is set to avoid the unbalanced current during normal operation. When the high-voltage side circuit breaker of the generator transformer unit is a three-phase operated circuit breaker, the thermal protection should not directly activate the failure protection; it is better to activate the failure protection by the reverse power protection. In this case, the failure protection discrimination circuit consists of two sets of phase current elements. Each phase uses two independent static current relays, whose contacts are connected in series, and the three phases are connected in parallel as the discrimination element. When using a microprocessor-based failure start device, only one set of current elements can be used, and the setting value of the phase current element can be set to a lower value to improve sensitivity. 2.4 Failure Protection Tripping Action For failure protection with one and a half circuit breaker connections, after the failure protection is started, it first instantaneously retrips the circuit breaker once, then, after being judged by the current element, after a delay, it finally trips the adjacent circuit breaker, and then trips the circuit breaker again once for all three phases. For sectional single busbars and double busbars, the early generator-transformer set failure protection action first tripped the sectional or bus tie circuit breaker and blocked the parallel line protection that might malfunction, and then disconnected other related circuit breakers; the time to trip the sectional or bus tie circuit breaker was generally 0.15s, and the time to disconnect other related circuit breakers was generally 0.3s, which does not meet the tripping logic requirements of the generator-transformer set failure protection action in the "Relay Protection Rules". If modifications are made, requiring the failure protection to trip the circuit breaker instantaneously once after activation, this can be achieved by drawing a trip circuit from the generator-transformer failure protection output circuit for instantaneous tripping. 2.5 Other points to note: For failure protection with double busbar connections, the activation and tripping circuits of the generator-transformer failure protection should be controlled by voltage switching relay contacts. The current transformer connected to the phase current element should not be connected in parallel with other current transformers; otherwise, the influence of the current drawn from the parallel current transformers should be prevented. When the failure protection trips the circuit breaker, the busbar reclosing should be blocked. The failure protection should be configured as a circuit breaker.