A hotel and gaming facility lost power to the low-voltage switchgear bus that served its most critical loads (IT, security, UPS, and gaming equipment) three times in the same year. Each outage coincided with an ordinary disturbance on the serving utility's system, such as a feeder fault or switching operations. Utility disturbances like these are expected. The facility's electrical system was designed to ride through them, and on a fourth occasion, when a utility feeder was lost outright, it did.
The question was why the system rode through a complete feeder loss but tripped on brief overcurrents.
Simplified Explanation
The main and tie circuit breakers on the critical bus have electronic trip units with a feature called zone-selective interlocking (ZSI, also called zone interlocking). ZSI lets a breaker skip its intentional time delay and trip immediately when it is the breaker closest to a fault. On this switchgear, ZSI is turned off by installing a small jumper wire between two terminals on the trip unit. The jumper had been installed on some breakers but not on others. On the breakers without the jumper, ZSI was active. Short overcurrents that should have been ignored tripped those breakers instantly, and the critical bus lost power.
How it works
A low-voltage power circuit breaker trip unit normally decides to trip on two inputs: how large the current is (pickup) and how long it lasts (delay). The short-time delay is what makes coordination work. A downstream feeder breaker clears its own fault first, and the main breaker waits.
ZSI improves on this during a real fault. Each trip unit that sees a fault sends a restraint signal to the breaker upstream of it. A breaker that sees fault current and also receives a restraint signal waits through its normal delay, because a device downstream is handling the fault. A breaker that sees fault current with no restraint signal assumes the fault is in its own zone and trips with no intentional delay.
That logic depends on the restraint wiring being correct. Where a breaker is not meant to participate in ZSI, the manufacturer provides a way to make it restrain itself, typically a jumper across the restraint-input terminals. If that jumper is missing and no restraint wiring is present, the trip unit never receives a restraint signal. It then treats every overcurrent above its short-time pickup as a fault in its own zone and trips instantaneously.
The failure sequence was:
- A utility disturbance or inrush event produced a brief overcurrent through the main and tie breakers on the critical bus.
- The overcurrent exceeded the short-time pickup setting but would not have lasted long enough to reach the short-time delay.
- Without the self-restraint jumper, ZSI was active and the trip units ignored the short-time delay.
- The main and tie breakers tripped instantaneously and isolated the critical bus.
- The trip unit displays reported a "short-delay" trip, which is how this trip unit family reports a ZSI trip.
Because the generators feed the same switchgear lineup, the tripped breakers would have blocked generator power from reaching the critical bus as well.
What the evidence looked like
- Trip unit indications showed short-delay trips, while the recorded overcurrents were below the magnitude-and-duration combination needed for a short-delay trip at the set values.
- Relay event files and utility switching records lined up in time with each outage. Relay clocks were not synchronized, which made the correlation harder than it should have been.
- Physical inspection found the self-restraint jumper installed on the downstream feeder trip units and missing on the main and tie trip units, which were the breakers that tripped.
- With the jumpers installed on the remaining trip units, the protection system would be expected to operate as designed.
The outages began only after a building expansion added load. One hypothesis is that the added load brought the normal overcurrent excursions up to the short-time pickup and exposed the missing jumpers.
What it means for owners
- It is recommended that owners verify the ZSI state of every trip unit (participating, self-restrained, or disabled) at commissioning and after any trip unit replacement, and confirm that it matches the coordination study.
- Compare the as-found trip unit settings against the protective device coordination study of record. In this facility several downstream settings did not match the study.
- Synchronize relay and trip unit clocks to a common time source (GPS or network time) so that event records from different devices can be compared.
- Configure the power monitoring system to capture and store waveform records (e.g., COMTRADE files) and train site staff to retrieve them.
- Where critical loads are served from a single bus, consider whether the topology and the UPS configuration can ride through the loss of that bus.
- Update the arc flash hazard analysis after protection changes. Disabling ZSI on the mains removes the faster clearing it could have provided, which can raise the calculated incident energy for a fault on the bus. The updated study and labels should reflect that trade-off.
What is commonly misread
A "short-delay" indication does not prove that the short-time settings were exceeded. With ZSI active and unrestrained, the trip unit may report a short-delay trip for an event that never lasted long enough to reach the delay. Read the manufacturer's documentation for how ZSI trips are annunciated before drawing conclusions from the display.
Standards referenced
- IEEE Std. 242 ("Buff Book"), protection and coordination of industrial and commercial power systems
- IEEE Std. 1159, characterization of voltage sags and other power quality events
- NFPA 70E, arc flash hazard analysis and labeling
- Breaker and trip unit manufacturer instruction leaflets for ZSI wiring
Details have been generalized to protect client confidentiality.