Testing, Commissioning, Maintenance, and Safety

Introduction

Protection equipment is only as dependable as the complete chain that detects a fault, processes information, issues a trip command, interrupts current, and records the event. A correctly selected relay can fail to protect equipment if a current-transformer (CT) circuit is open, a trip coil is defective, a setting file is incorrect, or a circuit breaker mechanism is poorly maintained. Testing and commissioning therefore verify not merely individual devices, but the functional performance of the protection system as an integrated safety-critical system.

This chapter presents methods for primary and secondary injection testing, relay logic validation, end-to-end testing, calibration, commissioning, condition monitoring, failure investigation, preventive maintenance, and safe isolation. Procedures must always be adapted to the applicable legislation, utility rules, manufacturer instructions, and standards such as IEC 60255, IEC 62271, IEC 61850, IEEE C37 series, and relevant occupational safety regulations.

Learning Objectives

After studying this chapter, the reader should be able to:

• distinguish primary injection, secondary injection, and end-to-end testing;
• plan a protection test using a controlled test philosophy and acceptance criteria;
• validate relay logic, trip paths, interlocks, alarms, and communications;
• commission protection and switchgear safely and document configuration changes;
• apply calibration, condition monitoring, and preventive-maintenance principles;
• investigate protection failures using evidence rather than assumptions; and
• develop safe isolation, earthing, and lockout/tagout (LOTO) procedures.

1. The Protection System as a Tested Chain

A protection system normally contains five functional stages:

1. Primary power system: conductors, transformers, generators, motors, and circuit breakers.
2. Sensing: CTs, voltage transformers (VTs), sensors, and transducers.
3. Protection processing: electromechanical, static, or numerical relays.
4. Control and tripping: auxiliary relays, trip coils, DC supplies, interlocks, and breaker mechanisms.
5. Evidence and communication: event records, oscillography, alarms, disturbance records, and supervisory control and data acquisition (SCADA).

Testing should establish both dependability—the ability to operate when required—and security—the ability to restrain from operating when operation is not required. A test that proves relay pickup but does not prove the trip coil, breaker, DC supply, or logic is incomplete.

Important terminology includes:

• Pickup: the input value at which an element starts to operate.
• Dropout or reset: the value at which an operated element returns to its non-operated state.
• Operating time: time between application of the defined input and relay output operation.
• Trip circuit supervision: monitoring of continuity and availability of the trip path.
• Functional test: a test of the complete intended function, including inputs, logic, outputs, and indication.
• Acceptance test: a test performed against specified criteria before equipment is placed in service.
• Maintenance test: a periodic or condition-based test used to detect deterioration.

2. Test Planning and Documentation

Testing begins with an approved test plan, not with connection of test equipment. The plan should identify the apparatus, protection functions, settings, drawings, wiring diagrams, test points, hazards, isolation boundaries, required instruments, acceptance limits, and restoration steps.

A typical test pack contains:

• approved single-line and schematic diagrams;
• relay setting file and setting-calculation report;
• CT and VT ratios, polarity, class, burden, and grounding details;
• protection logic and communication maps;
• manufacturer manuals and previous test records;
• calibration certificates for test instruments;
• risk assessment, permit-to-work, switching schedule, and LOTO record;
• test sheets with expected and measured results; and
• as-left configuration and defect register.

The test engineer should establish a baseline. For example, the baseline may include relay firmware, setting group, binary input/output map, DC voltage, breaker travel, contact resistance, insulation resistance, and event-record time synchronization. A later change can then be compared with a known condition.

Acceptance limits must be defined before testing. “Pass” should not mean merely that the equipment operated. It should mean that the measured quantity lies within the specified tolerance and that no unsafe or unintended response occurred. If a manufacturer specifies a tolerance, it takes precedence over a generic value.

3. Primary Injection Testing

3.1 Principle

Primary injection passes current or voltage through the actual primary circuit, CTs or VTs, relay inputs, wiring, and often the circuit breaker trip path. It is the most representative electrical test because it verifies the ratio, polarity, continuity, and burden of the primary and secondary circuits together.

For a current transformer, the ideal relationship is:

where I_p is primary current in amperes, I_s is secondary current in amperes, and n = N_p/N_s is the CT ratio, with N_p and N_s denoting primary and secondary turns. The relationship assumes an ideal transformer. Actual current includes ratio error, phase displacement, excitation current, and the effect of connected burden.

A primary injection test can verify:

• CT ratio and polarity;
• phase identification and phase sequence;
• continuity from primary conductor to relay input;
• relay measurement and pickup;
• trip circuit operation;
• circuit-breaker opening; and
• associated indications and alarms.

3.2 Method and limitations

The test source must be capable of supplying the required current or voltage safely. Connections are made with the equipment isolated and earthed according to the approved procedure. Current is increased gradually while monitoring the test set, relay quantities, trip outputs, and breaker condition.

Primary injection is particularly valuable after installation, cable termination, CT replacement, or major rewiring. Its limitations are high test-current requirements, heating, mechanical stress, longer preparation time, and difficulty testing some high-voltage circuits. It may also be impractical for testing a relay characteristic at many operating points.

3.3 Worked example: CT ratio check

An installed CT is rated 800/1 A. A primary injection of 400 A produces a measured relay input of 0.496 A. The ideal secondary current is:

The percentage ratio error, using the measured secondary current as the reference for this practical check, is:

The result is acceptable only if it lies within the CT, test-equipment, and project tolerances. The negative sign indicates that the measured secondary current is lower than the ideal value. Polarity must be checked separately; a correct magnitude does not prove correct polarity.

4. Secondary Injection Testing

Secondary injection applies controlled current and voltage directly to the relay inputs. It is efficient for testing relay characteristics, timing, directional elements, distance zones, differential restraint, under/overvoltage, frequency, autoreclose, and programmable logic.

A secondary test generally involves:

1. isolating the relay from live CT and VT circuits using approved test blocks;
2. confirming that CT circuits are never left open while primary current may flow;
3. connecting a calibrated relay test set;
4. loading the approved setting file or manually entering settings;
5. testing each protection element below pickup, at pickup, and above pickup;
6. recording pickup, dropout, operating time, and output contacts;
7. testing logic, binary inputs, LEDs, alarms, communications, and event records; and
8. restoring the operational wiring and independently checking the final state.

For an inverse-time overcurrent relay, a commonly used IEC characteristic form is:

where t is operating time in seconds, TMS is the time multiplier setting, I is fault current, I_s is pickup current, and k and α are constants specified by the selected characteristic. This equation applies only to the corresponding standardized curve and valid operating range; it must not be substituted for the manufacturer’s exact curve definition.

For the IEC standard inverse curve, k = 0.14 and α = 0.02. If I/I_s = 5 and TMS = 0.10, then:

The result is an ideal characteristic time. Actual measured time may differ within the relay’s specified accuracy and includes output-contact and test-system timing effects. The test report must state whether measured time is compared with the relay characteristic alone or with a complete trip time.

Secondary injection cannot prove the CT primary ratio, CT polarity through the primary conductor, primary wiring integrity, breaker interrupting performance, or mechanical operation unless those functions are tested separately.

5. Relay Logic and Functional Validation

Modern numerical relays combine protection, control, measurement, recording, and communication. Logic validation must therefore examine the intended sequence, not only individual elements.

A useful approach is to write each protection function as a cause-and-effect statement:

Cause: phase overcurrent pickup and breaker closed status.

Logic: pickup persists for the configured delay and no blocking input is active.

Effect: trip output operates, breaker opens, trip indication appears, event is recorded, and the appropriate alarm is transmitted.

Test both positive and negative cases. A positive case proves that a genuine operating condition produces the intended response. A negative case proves security—for example, that a blocked element does not trip, that a healthy phase does not operate a ground element, and that an interlock prevents an unsafe close command.

Important logic tests include:

• trip initiation and seal-in circuits;
• breaker auxiliary contacts 52a and 52b;
• lockout relay operation and reset;
• autoreclose dead time and reclaim time;
• synchrocheck and permissive closing;
• intertrips and transfer trips;
• breaker failure initiation and escalation;
• VT-failure and CT-supervision blocking;
• local/remote control selection;
• redundant DC supplies; and
• SCADA indications, timestamps, and command feedback.

The final test should verify that the relay is in the correct setting group, time source, communication state, and control mode. Configuration files should be version-controlled, access-controlled, and backed up.

6. End-to-End Testing

End-to-end testing applies coordinated signals at two or more protection terminals to reproduce a system event. It is essential for line differential, permissive overreach transfer trip (POTT), directional comparison, phase-comparison, and teleprotection schemes.

The test plan should specify:

• simulated fault type and location;
• prefault, fault, and postfault quantities;
• source impedance and phase relationships;
• expected relay decisions at each terminal;
• communication channel delay, loss, and blocking behavior;
• breaker trip sequence and clearing times; and
• event-record alignment and time synchronization.

GPS or Precision Time Protocol synchronization may be used, but the test must verify time quality and not simply assume that timestamps are correct. End-to-end testing is stronger than separate local tests because it reveals mismatched CT ratios, incorrect polarity, phase rotation errors, channel mapping errors, and inconsistent logic at different substations.

A complete test sequence commonly includes a healthy prefault state, fault inception, fault clearing, and recovery. The recorded waveforms from both terminals are then compared. A relay that trips locally but fails to exchange the required permissive or differential data has not passed the scheme test.

7. Commissioning Sequence

Commissioning is a controlled transition from installed equipment to operational service. A practical sequence is:

1. Document review: verify approved drawings, settings, firmware, nameplates, and certificates.
2. Mechanical inspection: inspect busbars, connections, shutters, interlocks, breaker mechanism, earthing switches, and enclosure integrity.
3. Electrical prechecks: verify insulation resistance where appropriate, continuity, polarity, phase sequence, DC polarity, fuse ratings, and CT circuit integrity.
4. Relay testing: perform secondary injection and logic tests.
5. Primary-system testing: perform primary injection, breaker tests, and end-to-end tests as applicable.
6. Control and communication tests: verify local, remote, alarm, SCADA, time synchronization, and cybersecurity controls.
7. Energization: follow an approved switching program with defined hold points and personnel communications.
8. Post-energization checks: inspect measurements, load current, phasors, alarms, temperatures, and event logs.
9. Handover: issue test records, as-built drawings, settings, backups, defect status, and maintenance baseline.

A commissioning hold point should exist before energization. Outstanding defects must be classified as acceptable, conditionally acceptable with compensating measures, or unacceptable. Informal acceptance is unsafe and difficult to audit.

8. Calibration and Instrument Control

Calibration establishes the relationship between an instrument indication and a reference standard. Test equipment should be traceable to a recognized national or international standard and used within its rated accuracy, output range, and environmental limits.

Calibration does not automatically prove that a relay is healthy. It verifies the test instrument or a measurement channel. Relay testing additionally requires correct wiring, settings, timing, logic, and interpretation.

Good practice includes:

• checking calibration status before use;
• inspecting leads, plugs, fuses, and protective earth connections;
• recording instrument serial numbers and software versions;
• allowing equipment to reach specified operating conditions;
• avoiding measurements near the instrument’s limits where possible; and
• quarantining instruments that have been overloaded, dropped, or exposed to abnormal conditions.

Measurement uncertainty matters when a measured value is close to an acceptance boundary. If a relay pickup is specified as 1.000 A ±1% and the measured value is 1.012 A, the result cannot be interpreted without considering the test-set uncertainty and the project’s decision rule.

9. Maintenance and Condition Monitoring

Maintenance may be corrective, preventive, predictive, or reliability-centred. A fixed interval is simple but may not reflect actual condition. Condition-based maintenance uses evidence such as operating count, mechanism travel, contact wear, temperature, partial discharge, gas analysis, battery impedance, event records, and trip-circuit supervision.

Typical maintenance activities include:

• visual inspection for contamination, moisture, corrosion, and loose hardware;
• cleaning and controlled tightening according to manufacturer torque values;
• circuit-breaker timing, travel, contact resistance, and mechanism inspection;
• insulation and dielectric tests where suitable for the equipment;
• battery voltage, capacity, electrolyte or impedance checks as applicable;
• relay self-test, binary I/O, trip-circuit, and communication checks;
• thermal imaging under suitable load and safe conditions;
• review of operations, alarms, near misses, and disturbance records; and
• verification that labels, barriers, interlocks, and earthing points remain legible and functional.

Maintenance intervals should consider environment, fault duty, switching frequency, equipment age, manufacturer guidance, criticality, and previous failure history. Excessive testing can itself create risk, especially if CT circuits are disturbed or equipment is repeatedly switched.

10. Failure Investigation

A protection failure may be a failure to trip, an unwanted trip, delayed operation, incorrect fault location, failure of indication, or failure of the breaker to interrupt. Investigation should preserve evidence before resetting or modifying equipment.

A disciplined investigation proceeds as follows:

1. make the plant safe and establish the event timeline;
2. preserve relay records, SCADA logs, disturbance records, breaker counters, and communications data;
3. obtain operator statements and switching records;
4. compare expected protection behavior with actual quantities and settings;
5. test CTs, VTs, DC supplies, relay inputs, logic, trip circuits, and breaker operation;
6. distinguish initiating cause from contributing causes; and
7. issue corrective actions with owners, deadlines, and verification tests.

Event records should be analyzed using synchronized time, phasors, digital status signals, and breaker contact timing. A relay that did not trip may have correctly identified a blocked condition; therefore, “relay failure” must not be assumed before checking the protection design and logic.

Root-cause categories include design error, incorrect settings, wiring error, component degradation, maintenance error, communication failure, human factors, environmental stress, and inadequate procedure. The investigation should address latent organizational causes as well as the immediate technical defect.

11. Safe Isolation, Earthing, and Lockout/Tagout

Protection testing involves lethal energy, induced voltages, stored mechanical energy, and hazardous CT and VT circuits. Safety controls take priority over test speed.

A safe isolation procedure normally includes:

1. identify all sources, including backfeed, auxiliary supplies, generators, capacitors, and remote-control paths;
2. obtain authorization and issue the correct permit;
3. open the designated isolating devices;
4. secure them against operation using locks and tags;
5. prove the voltage detector on a known source;
6. test for absence of voltage on all relevant conductors;
7. re-prove the detector;
8. discharge stored energy and apply protective earths where required; and
9. establish the test boundary and control access.

The “prove-test-prove” sequence confirms that the detector itself was functioning. A control switch or relay indication is not proof of isolation. Earthing must be applied at the correct location and rated for the prospective fault current and duration. Temporary earths must be visible, secure, and removed only under an authorized restoration procedure.

LOTO must be personal and accountable. Each worker applies an individual lock where the rules require it; group isolation requires a controlled group-locking system. A tag without an effective lock is not an adequate substitute where physical locking is practicable. Before re-energization, remove tools, temporary links, test leads, earths, and personnel; restore covers and barriers; verify protection settings and trip circuits; cancel permits; and communicate the switching action.

Special caution is required for CT secondary circuits. An energized CT secondary must not be opened because dangerous voltage can develop. Use approved shorting links or test blocks and confirm the shorting arrangement before disconnecting relay leads. VT circuits may require fused isolation and attention to ferroresonance or stored charge.

12. Safety, Governance, and Contemporary Practice

Testing organizations should use competence assessment, authorized-person lists, independent verification for critical changes, near-miss reporting, and periodic procedure review. Cybersecurity is increasingly part of commissioning: engineering access should be controlled, firmware and setting files authenticated, unnecessary services disabled, and changes logged.

Digital substations introduce sampled values, process-bus networks, merging units, and IEC 61850 GOOSE messages. Testing must therefore include network configuration, VLAN and redundancy behavior, message supervision, time synchronization, and cyber-secure test access. A protection test that ignores the communication layer is incomplete in a digital substation.

Artificial intelligence can assist with anomaly detection, waveform classification, and maintenance prioritization, but it should not replace deterministic protection logic or competent engineering judgment. Any AI-assisted decision must be traceable, validated against representative data, and subject to human approval, especially where it could influence a safety or trip decision.

Illustrative Case Study: Incorrect CT Polarity After Transformer Replacement

Background. A 33/11 kV transformer was replaced during a planned outage. Differential protection passed separate secondary-injection tests at both relay terminals.

Problem. On energization, the transformer differential relay issued an unwanted trip at modest load current.

Analysis. Relay records showed balanced load currents with a differential component inconsistent with the expected through-current restraint. The relay settings and internal logic were correct. Phasor comparison indicated that one CT polarity was reversed on the 33 kV side.

Approach. The team isolated and earthed the transformer, applied LOTO, and performed primary injection through the installed CT circuit. The measured phase sequence and polarity were compared with the approved vector-group diagram. The polarity error was corrected, followed by insulation, continuity, primary injection, secondary relay, differential stability, trip-circuit, and SCADA tests.

Outcome. The transformer was re-energized without differential current under normal load. A controlled fault simulation confirmed operation for an internal fault and restraint for an external fault.

Learning points. Separate relay tests cannot prove the complete CT-primary relationship. Vector group, CT polarity, phase sequence, and primary injection are essential after transformer work. The test procedure was revised to require independent polarity verification and a commissioning hold point before energization.

Challenges and Limitations

No single test proves all protection behavior. Secondary injection is efficient but may omit primary wiring and CT behavior. Primary injection is realistic but resource-intensive. End-to-end tests depend on accurate models, time synchronization, and communications access. Maintenance can introduce defects if test links are mishandled or restoration is incomplete. Acceptance criteria may also be unclear when equipment is old or documentation is missing.

Engineering judgment is required when results are borderline. Repeating a test until it passes is not a valid substitute for investigating the cause of variation. Changes to settings, firmware, logic, or wiring should trigger a documented impact assessment and regression testing.

Chapter Summary

Protection commissioning verifies a complete functional chain from the primary system to the relay, trip circuit, breaker, indication, and communication system. Primary injection tests the installed primary-to-relay path; secondary injection efficiently tests relay characteristics and logic; and end-to-end testing validates coordinated schemes and communications. Reliable commissioning requires approved drawings, calibrated instruments, defined acceptance criteria, controlled settings, and documented restoration. Maintenance should combine inspection, periodic testing, and condition monitoring according to equipment criticality and condition. Failure investigations must preserve evidence and distinguish design, equipment, human, and organizational causes. Safe isolation requires identification of all sources, LOTO, prove-test-prove voltage testing, correct earthing, controlled access, and disciplined restoration. Digital substations and cybersecurity expand the scope of commissioning, while AI may support analysis but cannot replace deterministic protection and competent safety decisions.

Key Terms

Protection test: A controlled procedure used to verify protection performance.

Primary injection: Application of current or voltage through the installed primary circuit.

Secondary injection: Application of test quantities directly to relay inputs.

End-to-end test: Coordinated test of protection terminals and communication channels.

Pickup: Input level at which a relay element starts to operate.

Dropout: Input level at which an operated element resets.

Dependability: Ability to operate correctly when required.

Security: Ability to remain stable when operation is not required.

Trip circuit supervision: Monitoring of trip-path availability.

Acceptance test: Test against specified criteria before service entry.

Commissioning: Controlled process of placing equipment into operational service.

Calibration: Comparison or adjustment against a traceable reference.

Condition monitoring: Assessment of equipment health using measured evidence.

Lockout/tagout: Isolation system preventing unintended energization.

Protective earthing: Connection that limits dangerous touch voltage and carries fault current.

CT polarity: Directional relationship between primary and secondary current references.

Breaker failure: Failure of a circuit breaker to interrupt after a trip command.

Setting group: Selected collection of relay configuration parameters.

GOOSE: IEC 61850 event-message service used for fast substation communication.

Root cause: Fundamental reason an undesired event occurred.

Review Questions

Short Answer Questions

1. What is the principal difference between primary and secondary injection testing?
2. Why must a CT secondary circuit not be opened while the CT is energized?
3. Define protection dependability and security.
4. What is the purpose of the prove-test-prove sequence?
5. List four documents normally included in a commissioning test pack.

Long Answer Questions

1. Explain how a numerical-relay secondary injection test should be planned and documented.
2. Describe the sequence for commissioning a medium-voltage circuit breaker and its protection system.
3. Compare the advantages and limitations of primary injection, secondary injection, and end-to-end testing.
4. Explain how condition monitoring can supplement periodic preventive maintenance.
5. Discuss the technical and safety requirements for testing protection in a digital substation.

Analytical / Application Questions

1. A relay receives 0.248 A during a 200 A injection test on a 800/1 A CT. Calculate the ideal secondary current and percentage deviation, then state what additional checks are needed before acceptance.
2. A line differential scheme trips at one terminal but receives no permissive message from the remote terminal. Propose a structured investigation using relay records, communications checks, and end-to-end testing.
3. After transformer replacement, a differential relay trips on normal load. Develop a safe diagnostic and commissioning plan that addresses CT polarity, vector group, settings, wiring, and restoration.

Multiple Choice Questions with Answers

Question 1

Which test most directly verifies the installed CT primary circuit, CT ratio, relay input, and associated wiring together?

A. Secondary injection

B. Primary injection

C. Insulation resistance measurement only

D. Relay firmware review

Correct Answer: B. Primary injection

Question 2

What is the main reason an energized CT secondary must not be opened?

A. It causes the CT ratio to increase permanently

B. It can produce dangerously high secondary voltage

C. It prevents the circuit breaker from closing mechanically

D. It changes the relay firmware

Correct Answer: B. It can produce dangerously high secondary voltage

Question 3

For an 800/1 A CT carrying 400 A primary current, the ideal secondary current is:

A. 0.05 A

B. 0.25 A

C. 0.50 A

D. 1.25 A

Correct Answer: C. 0.50 A

Question 4

Which test is particularly appropriate for validating coordinated teleprotection operation between substations?

A. End-to-end testing

B. Panel visual inspection

C. Battery float-voltage measurement only

D. Nameplate inspection

Correct Answer: A. End-to-end testing

Question 5

What does the prove-test-prove sequence primarily establish?

A. That the relay has the newest firmware

B. That the voltage detector is functioning before and after the test

C. That the breaker has interrupted a fault

D. That CT polarity is correct

Correct Answer: B. That the voltage detector is functioning before and after the test

Question 6

Which condition represents protection security?

A. The relay trips for every measured current

B. The relay trips when a genuine internal fault occurs

C. The relay remains restrained for a healthy external condition

D. The breaker opens whenever SCADA communicates

Correct Answer: C. The relay remains restrained for a healthy external condition

Question 7

Which document should identify the approved relay parameters and protection configuration?

A. Setting-calculation report and setting file

B. Personnel attendance sheet only

C. Weather forecast

D. Equipment purchase invoice only

Correct Answer: A. Setting-calculation report and setting file

Question 8

A measured CT secondary current is 0.496 A when the ideal value is 0.500 A. Using the ideal value as reference, the deviation is:

A. −0.8%

B. +0.8%

C. −4.0%

D. +4.0%

Correct Answer: A. −0.8%

Question 9

Which activity is most appropriate after an unexplained unwanted trip?

A. Immediately delete the relay event record

B. Reset the relay without preserving evidence

C. Preserve records and reconstruct the event timeline

D. Increase all relay settings without analysis

Correct Answer: C. Preserve records and reconstruct the event timeline

Question 10

Which statement best describes calibration?

A. It proves every protection logic function is correct

B. It establishes instrument performance against a traceable reference

C. It replaces the need for safe isolation

D. It guarantees a circuit breaker will interrupt every fault

Correct Answer: B. It establishes instrument performance against a traceable reference