Pumped Storage Hydro Protection –

Application Considerations

N. Fischer, D. Finney, R. Chowdhury, D. Taylor, and M. Donolo

Schweitzer Engineering Laboratories, Inc.

T. Foxcroft
Snowy Hydro Limited

Presented at the
14th International Conference on Developments in Power System Protection
Belfast, United Kingdom
March 12–15, 2018
 Pumped storage hydro protection – application considerations
N. Fischer*, D. Finney*, R. Chowdhury*, D. Taylor*, M. Donolo*, T. Foxcroft †
*Schweitzer Engineering Laboratories, Inc., 2350 NE Hopkins Court, Pullman, WA 99163 USA,
normann_fischer@selinc.com
†
Snowy Hydro Limited, Murray 2 Power Station Road, Khancoban, NSW 2642 Australia

Keywords: reversible pumped storage hydro units, phase historically been the only practical method to store and manage
reversal, frequency tracking, digital protection. large amounts of grid energy. Therefore, they play a vital role
in the operation of power systems with a large ingression of
Abstract: renewable energy sources. PSH units can be categorized by
prime mover type and by electric machine type. Three basic
Currently the U.S. has about 20 GW of pumped storage hydro types of prime mover designs have been employed:
with an additional 30 GW of new capacity being proposed for
support of renewable sources. Switching a reversible pumped • Units are configured as either dedicated generator/
storage hydro unit from generator to pumping mode can impact turbine units or dedicated motor/pump units within the
the differential element and elements that use sequence same installation.
components. Furthermore, protecting units that start as • Units are configured with a turbine, pump, and
induction motors requires protection of the damper winding generator/motor mounted on the same shaft. These are
during the starting and acceleration period. Stopping or braking known as ternary units. They can quickly switch from
the unit before reversing its rotation also requires special generator to motor operation without stopping the unit.
protection considerations. This paper discusses the advantages
that digital protective relays have over traditional protective • Units are configured as reversible generator/pump units.
relays when protecting pumped storage hydro units. These units operate in either generating or pumping
mode. Switching from generating to pumping mode
1 Introduction requires the units to be stopped.
In this paper, we focus on fixed-speed reversible
During the last two decades, renewable energy projects have generator/pump units. Additional information on protecting
gained momentum, and at present a large installed base of wind pumped storage hydro installations can be found in [2].
and solar energy sources exists worldwide. These sources are
intermittent, and maintaining grid stability requires bulk Fig. 2 shows a typical PSH protection scheme for a reversible
energy storage. generator/motor configuration using electromechanical (E/M)
relays.
Pumped storage hydro (PSH) units are hydro units that can
operate in generating or pumping mode, moving water either
from the upper reservoir to the lower reservoir or vice versa, as
shown in Fig. 1.

Surge Tank
Upper
Reservoir 87T
87U

Flow Direction 78
Generating Mode G M
Flow Direction
Pumping Mode 46
G
Gen/Motor M 40
G
Lower M
Reservoir 32

21
Turbine/Pump

G M
Fig. 1. Pumped storage hydro scheme.
Machine Neutral
The current round-trip energy efficiency of PSH exceeds 80
percent [1], and primarily for this reason, PSH units have Fig. 2. E/M relays and CT/PT secondary switching.
The primary circuit contains a set of parallel, interlocked (also shown by a T). Since both Breakers G and M employ
switches between the generator breaker and the generator. On dedicated CTs, no CT switch (external or internal) is required.
the blade-side of the switch (that part of the switch facing the The generator relay protection elements (excluding the 87G)
machine) the phasing is swapped. Depending on which switch are denoted by an asterisk (*). The generator relay needs to
is closed, G (generating) or M (motoring), the downstream dynamically change its phase rotation (denoted by a P) based
phasing changes from ABC to ACB. For the remainder of the on a status indication of Breakers G and M in order for the
paper, we call this pair of switches the reversing switch. Note differential element to remain stable and correctly calculate the
that the reversing switch introduces the possibility of a phase- voltage and current sequence quantities.
to-phase fault at the machine terminals for the case that both
Switches G and M close simultaneously.
Note that the reversing switch is included in the overall unit
differential zone (87U). A set of auxiliary contacts in the 87U 87T
secondary wiring replicates the position of the reversing
switch. These switches transpose the secondary wiring in the
same manner as the reversing switch to maintain the correct T
phase relationship for the 87U. A similar situation exists for
the protection elements fed from the machine neutral CT. Some G M
of these elements, for example the machine unbalance element
(ANSI 46), respond to a negative-sequence current component.
Therefore, a second set of auxiliary contacts are required to
T
ensure that the phase sequence of the currents is correct. A third
set of auxiliary contacts ensures the correct phase relationships
between the secondary voltages and currents. 87G

2 Impact of the reversing switch on protection P *

functions
From Section 1, we see that the reversing switch can change
the phase relationship within the 87U zone and the phase Fig. 3. Individual breakers and CTs.
sequence of the protection elements supplied by the machine
neutral CTs. The phase relationship change can be addressed An alternative strategy to provide protection for PSH is shown
by inserting auxiliary contacts that transpose the secondary CT in Fig. 4. In this instance, a digital relay provides protection for
wiring. However, most protection engineers would prefer to both the generator and the generator step-up transformer
avoid inserting auxiliary devices within the CT secondary (GSU). The digital relay has the capability to transpose each
circuit since it introduces complexity and a point of potential current and voltage input in the relay. In this sense, it is
failure in the scheme. Furthermore, failure of the auxiliary analogous to the E/M scheme shown in Fig. 2. The pumped
device could result in the CTs open circuiting and creating a storage logic in a particular digital relay uses several settings
safety hazard for personnel. to configure the logic. These settings specify:

Using the following examples, we show how using digital • The terminal current and voltage inputs to be transposed.
protective relays addresses the above problems and concerns The current and voltage terminals that require transposi-
without switching the secondary wiring of the CTs and PTs. tion are downstream from the reversing switch.
• The phase pair to be transposed AB, BC, or CA. This
A typical digital relay has the following capabilities: setting transposes the corresponding voltage and current
1. The differential zone can be dynamically phase pair in software. The software phase transposition
reconfigured to add and remove an input (terminal) occurs early in the data acquisition sequence so that the
to the zone. transposition is transparent to the differential element and
2. The phase-rotation setting of the relay can be sequence calculations. This setting obsoletes the dynamic
changed dynamically from ABC to ACB. (This phase-rotation setting.
setting determines how sequence quantities are • When to transpose the current and voltage inputs. This
calculated internally.) setting is driven from a digital input, which in turn is
driven from the reversing switch.
The example shown in Fig. 3 uses separate breakers to operate
the machine as a generator or a motor (see [2] for other Both the E/M and digital schemes make use of the reversing
configurations). The primary phasing downstream of Breaker switch status to adapt the protection for each mode of
G is transposed, as denoted with a T. The transformer operation. Therefore, the security of the entire protection
differential element (87T) is secure since transposition occurs scheme depends on the integrity of the status indication.
outside of its zone; however, transposition of the secondary Consequently, we recommend, at a minimum, that dual status
wiring of the generator differential element (87G) is required indications be used to derive the operating mode. Since the
operating mode cannot change when the unit is online, machine − Allow the differential and other sequence elements
current can be used to further secure the element. to trip the machine in the event that the incorrect
operating mode is selected and the machine begins
Generator Relay
to draw current.
− Block the differential and other sequence element.
Pumped Once the phase current increases above 0.05 pu of
Storage
Logic the rated machine current, calculate the positive- (I1)
87T
and negative- (I2) sequence current magnitudes. If
|I1| >> |I2|, then the selected or present mode of
87G operation is correct and the differential and other
sequence elements can be re-enabled. If |I2| >> |I1|,
M
G
then the selected mode of operation is incorrect. In
this situation, the protective relay can select the
correct operating mode and re-enable the differential
T and sequence elements, or the differential elements
and sequence elements can remain blocked until the
T * discrepancy is corrected by maintenance personnel.

3 Protection considerations during induction

motor starting
T
One method of starting the synchronous machine when in
Fig. 4. Relay with integrated pumped storage logic. motor mode is as an induction motor. Since the rotor of a PSH
machine is laminated, the damper winding current produces the
One example that can be implemented in a digital relay is starting torque of the machine. In contrast, for solid rotor
shown in Fig. 5. machines (not typically used in PSH applications), the starting
Reversing torque is developed by the eddy currents, induced on the
t
Switch surface of the pole shoes.
0 Discrepancy
Prior to starting, the field winding is short-circuited via an
Reversing Switch in
Generator Mode
external resistor to protect the insulation of the field winding
Generator
(No Contact) S Q
Mode and slip rings from abnormally high voltages that are generated
in the field before the rotor reaches near synchronous speed [3].
Machine Current < 0.05 pu During the machine starting period, the largest portion of the
acceleration torque is developed by the damper winding
Reversing Switch in R Q
Motor (induction motor effect). This torque accelerates the machine
Mode
Motor Mode
(No Contact)
(rotor) to about 95 percent of synchronous speed. At this speed,
NV Latch either the reluctance torque will pull the rotor into
synchronism, or more commonly, the field voltage is applied,
Fig. 5. Operating mode logic. which will then pull the rotor into synchronism.
The logic used to derive the status of the reversing switch In some cases, the supply voltage is reduced during starting.
shown in Fig. 5 allows the machine to be only in either This lowers the starting current, which in turn, reduces the
generator or motor mode. However, should a discrepancy starting torque by the square of the current reduction. This
occur due to a problem with respect to the generator or motor leads to a longer machine starting time. The decrease in the
breaker auxiliary contacts, it may be possible for both the set starting current also results in a reduction of the voltage dip in
(S) and reset (R) inputs of the flip-flop to assert the power system during starting. The voltage reduction is
simultaneously. If this should occur, the logic shown in Fig. 5 achieved by a specifically designed GSU.
issues a reversing switch discrepancy alarm. This alarm can be
used to take the following corrective actions depending on the The damper winding is designed to have a high resistance and
magnitude of the machine current. a low reluctance to obtain the highest ratio of torque to
• If the machine current is above 0.05 pu, the output of the apparent power (MVA) [4]. Not only do the damper windings
flip-flop will not change state. As such, simply notifying produce the highest torque during starting, they also experience
maintenance personnel of the issue is sufficient. the greatest thermal increase. Should starting last too long, the
damper windings will experience thermal damage. Normally,
• If the machine current is below 0.05 pu, the output of the
no water exists in the turbine during starting, but if this is not
flip-flop may toggle—one input typically has priority
the case, the load torque could be quite substantial. Therefore,
over the other in the event that both inputs assert
it is important to protect the damper windings of the machine
simultaneously. Therefore, the case may exist where the
during the starting period. The stator current is relied upon to
wrong operating mode is selected. In this event, the
mimic the heating effect in the damper windings since it’s not
following can be done:
possible to directly measure the current in the damper ∆𝑡𝑡 𝐼𝐼 2 [𝑘𝑘] ∙ 𝑅𝑅𝑟𝑟 (𝑠𝑠[𝑘𝑘])
windings. ∆𝑇𝑇𝑇𝑇𝑇𝑇[𝑘𝑘] = 100 ∙ ∙ (4)
𝐿𝐿𝐿𝐿𝐿𝐿2 ∙ 𝐿𝐿𝐿𝐿𝐿𝐿 𝑅𝑅𝑟𝑟 (1)
When E/M relays were applied to PSH units, starting
protection was provided either by using a timer interrupted by where Rr is a function of s and, Rr (s) is given by:
a speed switch or an overcurrent element with a long timing 𝑅𝑅𝑟𝑟 (𝑠𝑠) = 𝑅𝑅1 𝑠𝑠 + 𝑅𝑅0 (1 − 𝑠𝑠) (5)
characteristic [5]. The motor thermal model implemented in
digital relays has several advantages over these earlier where:
methods. The thermal model provides thermal protection for 𝑅𝑅1 = 𝑅𝑅𝑟𝑟 when 𝑠𝑠 = 1
both the rotor windings during the starting mode and the stator 𝑅𝑅0 = 𝑅𝑅𝑟𝑟 when 𝑠𝑠 = 0
windings when in the running mode. The thermal model can be 𝑅𝑅1 ≥ 𝑅𝑅0 and 𝑠𝑠[𝑘𝑘] ∈ [0,1]
configured to account for both the heating and cooling
characteristics of the machine. Advanced thermal models Substituting (5) into (4), we obtain (6).
derive the slip (s) from the terminal measurements. Using the
slip of the machine provides a more accurate heat calculation 100 ∙ ∆𝑡𝑡 𝐼𝐼 2 [𝑘𝑘] ∙ �𝑅𝑅1 𝑠𝑠[𝑘𝑘]+𝑅𝑅0 (1 − 𝑠𝑠[𝑘𝑘])�
∆𝑇𝑇𝑇𝑇𝑇𝑇[𝑘𝑘] = ∙ (6)
for high-inertia systems. 𝐿𝐿𝐿𝐿𝐿𝐿2 ∙ 𝐿𝐿𝐿𝐿𝐿𝐿 𝑅𝑅1

In the absence of thermal parameters for the machine, the The ratio of 𝑅𝑅1 𝑠𝑠[𝑘𝑘] + 𝑅𝑅0 (1 − 𝑠𝑠[𝑘𝑘]) to 𝑅𝑅1 is 1 when s = 1, and
settings from the existing overcurrent element can be translated 𝑅𝑅
0 < 0 ≤ 1 when s = 0. The result now includes the
into settings for the thermal model. Should the machine’s 𝑅𝑅1

locked rotor current (LRA) and locked rotor time (LRT) be dependence of Rr on s. This allows for a longer starting time
available, we can use these parameters. In this case, the thermal than (3), which does not account for the dependence of Rr on
limit can be described by (1). s. In Fig. 6, we use data from a 20 MW synchronous motor.
Note that while the I2t model would trip the motor at about
7 seconds, the slip-dependent TCU only reaches a value of
� 𝐼𝐼 2 𝑑𝑑𝑑𝑑 = 𝐿𝐿𝐿𝐿𝐿𝐿2 ∙ 𝐿𝐿𝐿𝐿𝐿𝐿 (1)
85 percent.
120
3.1 Rotor thermal model
100
The rotor thermal model integrates the motor starting current
over time to estimate the thermal capacity used (TCU). For
80
Percentage (%)

each processing interval (k), a digital relay computes the rotor

TCU using (2). 60

𝑇𝑇𝑇𝑇𝑇𝑇[𝑘𝑘] = 𝑇𝑇𝑇𝑇𝑇𝑇[𝑘𝑘 − 1] + ∆𝑇𝑇𝑇𝑇𝑇𝑇[𝑘𝑘] (2) 40

Start Current
where: Slip
20
∆𝑡𝑡 ∙ 𝐼𝐼 2 [𝑘𝑘] TCU I²t
∆𝑇𝑇𝑇𝑇𝑇𝑇[𝑘𝑘] = 100 ∙ TCU Slip Dependent
𝐿𝐿𝐿𝐿𝐿𝐿2 ∙ 𝐿𝐿𝐿𝐿𝐿𝐿 0
𝑘𝑘 = present processing interval 0 2 4 6 8 10 12
Time (s)
𝑘𝑘 − 1 = previous processing interval
∆𝑡𝑡 = time between two consecutive processing intervals Fig. 6. Slip-dependent vs I2t thermal model.

Note, if the current remains at the LRA magnitude for a 4 Dynamic braking
duration of LRT, TCU will reach 100 percent after a time equal
to LRT. Multiplying and dividing (2) by the rotor resistance Dynamic braking is installed to enable rapid deceleration and
(Rr), we obtain (3), the slip-independent thermal model, which stopping of hydro units that are of the generator and motor
we refer to as the I2t model. combination type (reversible unit). A slow deceleration and
stopping of these units results in poor to no lubrication of the
∆𝑡𝑡 ∙ 𝐼𝐼2 [𝑘𝑘] ∙ 𝑅𝑅𝑟𝑟 bearings for a significant time while the unit decelerates. The
∆𝑇𝑇𝑇𝑇𝑇𝑇[𝑘𝑘] = 100 ∙ (3)
𝐿𝐿𝐿𝐿𝐿𝐿2 ∙ 𝐿𝐿𝐿𝐿𝐿𝐿 ∙ 𝑅𝑅𝑟𝑟 rapid deceleration provided by dynamic braking increases
where: bearing longevity. Furthermore, dynamic braking reduces the
wobble time of the unit during deceleration. The advantages of
𝐿𝐿𝐿𝐿𝐿𝐿2 ∙ 𝐿𝐿𝐿𝐿𝐿𝐿 ∙ 𝑅𝑅𝑟𝑟 = the maximum energy that the rotor dynamic braking over friction braking are as follows:
can absorb before experiencing thermal damage.
• Faster decelerating and shorter stopping time,
∆𝑡𝑡 ∙ 𝐼𝐼 2 [𝑘𝑘] ∙ 𝑅𝑅𝑟𝑟 = the amount of incremental energy
• No generation of brake dust that will settle in the stator
accumulated in the rotor during the processing
winding and possibly lead to stator winding short circuits.
interval.
The slip-dependent thermal model takes into account that Rr is Dynamic braking is accomplished by short-circuiting the stator
a function of s. To include the dependence of Rr on s, we windings of the machine once the machine has been isolated
rewrite (3) as follows: from the power grid. The stator windings are shorted via a
normal isolator switch [6]. The rotor circuit is then transferred 10. Rotor current increases according to the L/R time
to a separate dc power supply and excitation maintained until constant of the rotor circuit.
the machine is at a standstill. During dynamic braking, kinetic 11. Stator current begins to flow through the stator winding,
energy is taken from the rotor of the machine and dissipated as generating heat due to the winding resistance. As a
heat in the stator winding, and because the prime mover does result, the mechanical kinetic energy stored in the rotor
not supply energy to the rotor, the rotor begins to slow down. dissipates, and the rotor begins to slow down.
The braking transformer and rectifier are rated to provide
4.2 Protection implications
nominal stator current (1 pu) during the braking or shorting
period. Excitation is maintained until the machine is at a The stator shorting switch creates a three-phase fault within the
standstill. At standstill, there is still flux in the stator winding, generator differential zone. This results in the operation of the
and because the machine is stationary, the stator current begins generator differential protection. Two options generally exist
to decay at a rate determined by the stator L/R ratio. The to avoid the operation of the generator differential under
decaying stator flux generates a voltage that begins to reduce dynamic braking.
the rotor current since there is an opposing voltage to the
applied field voltage. This opposing voltage reduces the 4.2.1 Turn off the generator differential
effective field voltage across the rotor, which in turn reduces With this option, the generator differential protection is turned
the field current until the stator flux has completely decayed. off during dynamic braking. The advantage of this method is
At this time, the field current increases again. Fig. 7 shows a that it is simple. However, it is not wise to turn off the main
typical dynamic braking configuration for a reversible unit. generator protection with rated stator current circulating in the
stator. This is not the preferred option.
GSU a) Electromechanical schemes
In traditional E/M generator differential schemes, the current
inputs short-circuit. In a high-impedance differential scheme,
Generator Stator the bus wires short-circuit; whereas for a low-impedance
Breaker
(open)
Shorting differential generator neutral, the CTs short-circuit.
Switch
b) Digital schemes
Aux
XFMR AVR In a digital generator differential scheme, the operation of
dynamic braking will assert a digital input that will disable the
generator differential protection.
Main Field
Switch
Braking 4.2.2 Add the shorting switch to the differential
XFMR protection
Braking Field Another solution is to add the current in the stator shorting
Braking
Switch
Rectifier
switch to the differential circuit, as shown in Fig. 8

Fig. 7. Typical configuration of a dynamic braking setup for

a reversible PSH unit. GSU

4.1 Generator stopping and braking sequence

Following is the operating/switching sequence to decelerate Generator Stator
Breaker
and stop a reversible unit using dynamic braking. (open)
Shorting
Switch
1. Unit is unloaded.
Aux 87G
2. Generator breaker opens. XFMR AVR
3. Governor stop valve closes.
4. Main inlet valve begins to close, and the unit begins to
slow down. Main Field
5. Main inlet valve closes completely; this occurs at around Switch
50 percent of rated speed.
6. Main field switch opens.
Braking Field
7. If the excitation system uses a rotating exciter, a wait Switch Braking
period is applied to allow the flux in the machine to Rectifier
decay. If the excitation system is static, the excitation Fig. 8. Dynamic braking differential protection (dynamic
switches off when the unit is taken off line. braking equipment not shown for clarity).
8. With the main field switch and the generator breaker
open, the generator terminal voltage is low; then the This stabilizes the differential circuit during dynamic braking;
stator shorting switch closes. however, it does require a three-input differential scheme with
9. Dynamic braking rectifier turns on, and the dynamic extra CTs.
braking field switch closes.
 a) High-impedance schemes A digital differential relay can provide another option. If the
The addition of an extra CT input in a high-impedance generator breaker closes (52A = 1), a digital input in the relay
differential scheme is simple to implement. The extra is simply asserts, which in turn removes the shorting switch current input
connected to the bus wires. However, most high-impedance from the differential element. Therefore, should the stator
relays use a tuned circuit in the operating element. This results shorting switch close at the same time as the generator breaker,
in a higher operation at lower frequencies and virtually no the differential element will no longer be stable and will trip
operation at very low frequencies. the generator breaker. This is a more elegant solution.
b) Biased differential schemes
E/M biased differential schemes require a three-terminal input 5 Conclusions
relay. Operation at lower frequencies is dependent on the relay Pumped storage hydro reversible units pose a challenge to
design. Digital relays also require a three-terminal input relay. electromechanical protection schemes. The schemes require
The operation at lower frequencies is dependent on the element either auxiliary contacts to transpose the secondary CT leads
design. It may be necessary to disable the generator differential or a multiterminal differential protection device to correctly
element at frequencies lower than 2.5 Hz. address the instance when the primary phases are transposed as
the unit switches from generation into pumping mode.
4.3 Shorting switch and breaker closed Furthermore, when the unit is started, either back-to-back or
With the addition of the generator shorting switch, a possible using a variable-frequency drive, a relay that does not track
new operating problem has been created. Assume the generator frequency cannot adequately protect the unit during the starting
is online and an error causes the stator shorting switch to close. period. Digital protective relays track frequency over a wide
The result is a three-phase short circuit within the generator range, thereby protecting the PSH unit over a wider frequency
protection zone. Therefore, secure and robust interlocking on range. The flexibility and adaptability of digital relays allows
the closure of the shorting switch is required. However, them to be easily adapted to any protection scheme.
shorting switches have closed due to leaks in the pneumatic
system. With a CT monitoring the current through the shorting 6 References
switch, the generator differential protection will remain stable
for such events. To provide protection for the unit for the [1] M. Manwaring, D. Mursch, and K. Tilford, “Challenges
situation in which the generator breaker and the shorting switch and Opportunities for New Pumped Storage
are closed simultaneously, an instantaneous overcurrent Developments,” NHA Pumped Storage Development
element (50) is added to the protection scheme to monitor the Council. Available: http://www.hydro.org/wp-
current through the stator shorting switch, as shown in Fig. 9. content/uploads/2014/01/NHA_PumpedStorage_071212
The pickup of the overcurrent element is typically set at 1.5 b12.pdf.
times the rated current of the generator. During dynamic [2] T. Foxcroft, N. Fischer, D. Finney, R. Chowdhury, M.
braking, the current magnitude does not exceed the rated Donolo, and D. Taylor, “Leveraging Digital Relays for
current of the generator. Protection of Pumped Storage Hydro,” proceedings of the
44th Annual Western Protective Relay Conference,
Spokane, WA, October 2017.
GSU
[3] C. C. Mi, Y. Li, and H. Karmaker, “Modeling of the
Starting Performance of Large Solid-Pole Synchronous
Generator Stator
Motors Using Equivalent Circuit Approach,” IEEE
Breaker Shorting Transactions on Magnetics, Vol. 45. No. 12, December
(closed) Switch 2009, pp. 5399–5404.
ISC 50 87G [4] T. C. McFarland, “Alternating Current Machines,” D.
AVR
Van Nostrand Company, Inc., January 1949.
[5] M. Donolo, V. Yedidi, S. Patel, and P. Donolo,
Main Field “Performance of Synchronous Motors – Loss-of-
Switch Synchronism Protection,” PCIC 2017.
[6] F. Jebali and K. Garg, “High-Inertia Synchronous Motor
Braking Field Protection and Lessons Learned,” proceedings of the 41st
Switch Braking Annual Western Protective Relay Conference, Spokane,
Rectifier
WA, October 2014.
Fig. 9. Dynamic braking overcurrent protection.
For the situation where the generator breaker and stator
shorting switch close simultaneously, the fault current through
© 2017 by Snowy Hydro Limited and
the stator shorting switch will be high enough to operate the Schweitzer Engineering Laboratories, Inc.
overcurrent element (50) and trip the generator breaker. This All rights reserved.
system is the preferred protection option. 20171103 • TP6841