14. Protection Testing, Diagnostics and Life-Cycle Governance

Introduction and Context

Protection systems are often judged by their behaviour during abnormal system conditions, yet their reliability depends on a much broader life cycle. A relay may have an excellent operating characteristic and still fail to protect equipment if its settings are incorrect, its current transformer is saturated, its trip circuit is open, its communication channel is unavailable, or a recent configuration change was not tested. Protection testing therefore cannot be treated as a one-time commissioning activity. It is an evidence-based process extending from design verification to decommissioning.

The modern protection system includes instrument transformers, relays, circuit breakers, auxiliary supplies, wiring, communications, time synchronisation, disturbance recorders, station networks and operating procedures. Testing must establish not only that an individual relay operates, but also that the complete protection function performs correctly under realistic conditions. Diagnostics and event records then provide feedback about actual field performance. Life-cycle governance converts this technical evidence into controlled decisions about maintenance, modification, risk and investment.

This chapter presents a coordinated framework for commissioning, secondary and primary injection, end-to-end testing, model-based validation, event analysis, maintenance, change control and audit. It also considers relevant IEC and IEEE practice, functional safety, cybersecurity, documentation, asset management and economic decision-making.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Distinguish the purposes and limitations of secondary injection, primary injection and end-to-end testing.

2. Develop a commissioning and maintenance test strategy for a protection scheme.

3. Use system models, disturbance records and relay diagnostics to validate protection performance.

4. Apply structured change control, configuration management and documentation practices.

5. Relate protection testing to IEC/IEEE standards, functional safety, cybersecurity and auditability.

6. Evaluate maintenance and replacement decisions using risk, criticality and life-cycle economics.

7. Interpret failures and near misses as organizational as well as technical events.

Protection Testing as a Life-Cycle Process

A protection function can be represented as a chain:

\[

\text{Power-system condition} \rightarrow \text{measurement} \rightarrow \text{logic} \rightarrow \text{communication} \rightarrow \text{trip circuit} \rightarrow \text{breaker action}

\]

Testing is credible only when the required links in this chain are identified. A relay test set can verify measurement algorithms and trip logic, but it cannot by itself prove that a current transformer has the correct polarity, that a breaker will interrupt the fault, or that a permissive signal reaches the remote terminal. Conversely, a primary injection test may establish the behaviour of the current path while leaving sophisticated relay logic insufficiently exercised.

Protection assurance normally has four interacting dimensions:

• Design assurance: settings, logic, application drawings and coordination are technically correct.
• Construction and installation assurance: equipment, wiring, polarity, earthing and communications conform to design.
• Operational assurance: the scheme remains dependable and secure under expected system conditions.
• Governance assurance: changes, results, deviations and responsibilities are controlled and traceable.

The objective is not to perform the maximum number of tests. It is to obtain sufficient evidence for the risk associated with the protected asset and the consequences of incorrect operation.

Important Terminology

A test requirement states what must be demonstrated. A test procedure explains how it will be demonstrated. A test record provides objective evidence of the result. A witness or hold point identifies an activity requiring approval before progression. Dependability is the ability to operate when required; security is the ability to restrain from unwanted operation. Functional testing examines the intended protection function, while diagnostic testing examines the condition of equipment and its supporting systems.

A proof test is a planned test intended to reveal dangerous undetected failures. Baseline testing records the condition of an asset against which later results are compared. Out-of-tolerance means that a measured result lies outside an approved acceptance limit; it does not automatically identify the cause. Nonconformance is a departure from a specified requirement. A near miss is an event in which an incorrect operation was avoided or had no consequence, but which reveals a credible weakness.

From Design Intent to Commissioning Evidence

Commissioning should begin with the approved design basis, not with the test set. The design basis should identify protected zones, instrument-transformer ratios and classes, relay functions, settings, communication channels, breaker interfaces, auxiliary supplies and trip philosophy. The protection engineer should also identify credible failure modes, including open circuits, loss of dc supply, communication delay, current-transformer saturation, breaker failure and incorrect isolation.

A useful commissioning sequence is:

1. review drawings, settings, logic diagrams, coordination studies and equipment data;

2. inspect installation quality and verify equipment identity;

3. perform point-to-point and continuity checks;

4. verify instrument-transformer ratio, polarity, phase sequence and earthing;

5. test dc supplies, fuses, supervision and trip circuits;

6. load the approved relay configuration and verify its checksum or equivalent identity;

7. perform secondary injection of individual functions and logic;

8. perform primary injection or other circuit-level tests where required;

9. conduct communication and end-to-end tests;

10. test breaker operation, interlocking, reclosing and breaker-failure logic;

11. verify time synchronisation, records and alarms;

12. resolve deviations and issue a controlled commissioning dossier.

The sequence is not rigid. For example, a high-voltage installation may require primary circuit checks before energisation, whereas a communications-assisted line scheme requires early validation of channel architecture. The governing principle is progressive confidence: each stage should establish prerequisites for the next.

Secondary Injection, Primary Injection and End-to-End Testing

Secondary Injection

Secondary injection applies controlled current and voltage signals directly to relay inputs. It is efficient for verifying pickup values, timing, characteristic curves, directional elements, differential restraint, logic equations, programmable inputs and outputs. It is particularly valuable after setting changes because tests can be repeated with precision and automated reports can be generated.

Its limitation is boundary coverage. Secondary injection normally bypasses the instrument transformers, field wiring and much of the external circuit. A relay may pass a secondary test even though phase conductors are transposed, a test switch is wired incorrectly or a transformer ratio is wrong. The test engineer must therefore state explicitly which part of the protection chain has and has not been tested.

Primary Injection

Primary injection passes current through the primary circuit or a representative high-current path. It can verify current-transformer ratio and polarity, conductor continuity, phase identification, wiring and the relationship between primary current and relay indication. It may also exercise trip circuits under realistic current conditions.

Primary injection is more difficult and costly. High current can create hazards, thermal stress and electromagnetic forces. It may not adequately test voltage-dependent or communication-dependent functions. Its value is greatest where a wiring or measurement error could defeat the scheme and where the protected asset's criticality justifies the effort.

End-to-End Testing

End-to-end testing applies synchronised simulated or recorded conditions at two or more terminals. It is essential for permissive, blocking, direct-transfer-trip, line differential and other communications-assisted schemes. The test verifies local measurement, logic, channel transmission, remote reception, time requirements and trip decisions as an integrated function.

A credible end-to-end test defines the scenario at a system level. It specifies fault type, fault location, source strength, prefault load, channel delay, expected local and remote decisions, breaker times and acceptable margins. Testing only a communication ping or only the relay outputs is not equivalent to testing the protection scheme.

Model-Based Validation and Test Design

Protection settings are derived from a model of the electrical network. The same model can support systematic validation, provided its assumptions are controlled. A model-based test begins with a network condition, calculates expected currents and voltages, and converts those quantities into relay input signals. The resulting relay response is compared with the expected operating time, trip decision and selectivity.

The model should include, as appropriate, source impedance, transformer connections, grounding, line parameters, instrument-transformer ratios, breaker times and communication delays. Uncertainty should not be hidden. Network topology, generation dispatch and fault resistance can materially affect apparent impedance, differential current and directional decisions.

A useful validation matrix includes normal load, external faults, internal faults, evolving faults, high-resistance faults, current-transformer saturation, weak infeed, out-of-zone faults, loss of voltage, communication failure and breaker failure. Each case should identify the expected state of every relevant element. This prevents a test from being declared successful merely because a trip occurred; an incorrect trip can be as serious as a missing trip.

Model validation must also address consistency between engineering tools. Differences between a planning model, relay setting software and a digital simulator can arise from sign conventions, transformer phase shifts, grounding assumptions or rounding. Version-controlled model files and documented conversion rules are therefore part of the test evidence.

Event Records, Diagnostics and Fault Analysis

Digital relays commonly provide oscillography, sequence-of-events records, self-supervision alarms, measurements and communications statistics. These records are valuable only when retrieved promptly, time-synchronised and interpreted in context. A disciplined analysis asks four questions:

1. What was the actual system disturbance?

2. What did each protection device measure and decide?

3. Did the circuit breaker and associated equipment respond as commanded?

4. What evidence supports the conclusion, and what remains uncertain?

Event records should be aligned using a reliable time reference. Analysts compare relay pickup, trip output, breaker auxiliary contacts, current interruption, communication messages and dc voltage. The distinction between relay operating time, output-contact time, breaker opening time and fault-clearing time must be maintained.

A relay target is not a complete explanation. An element may have operated correctly while a trip was blocked by an interlock, or a breaker may have failed mechanically after a valid trip command. Similarly, an apparent relay failure may be caused by incorrect CT saturation, a recording trigger problem or an inaccurate time stamp.

Diagnostics include watchdog alarms, memory errors, internal temperature, binary-input state, contact wear indications, battery condition, time-synchronisation status, communication quality and configuration mismatch. Diagnostic alarms should be classified by consequence. A loss of an auxiliary measurement may degrade one function, whereas loss of a redundant dc supply or protection communication channel may require immediate operational action.

Root-cause analysis should go beyond the failed component. Methods such as fault-tree analysis, barrier analysis and the five-whys technique can reveal weaknesses in design review, procurement, training, maintenance or change control. The purpose is learning and risk reduction, not allocation of blame.

Maintenance, Proof Testing and Asset Management

Maintenance intervals should be based on risk and evidence rather than habit alone. A useful risk expression is:

\[

R_i = P_i \times C_i

\]

where \(P_i\) is the probability of a dangerous failure for asset or function \(i\), and \(C_i\) is its consequence. Consequence may include personnel safety, equipment damage, system instability, regulatory exposure, customer interruption and environmental impact.

Criticality assessment should consider protection zone, redundancy, fault-clearing time, replacement lead time, operating environment and availability of on-line diagnostics. A non-critical feeder relay with strong redundancy may justify condition-based testing, while a protection channel for a major transformer may require more frequent proof testing and a defined contingency plan.

Maintenance activities can include visual inspection, relay functional testing, trip-circuit supervision checks, breaker timing, battery testing, communications verification, thermography, secondary injection and review of event records. Testing should be designed to detect dangerous failures that on-line diagnostics cannot detect. Excessive intrusive testing can itself introduce risk through wiring disturbance, incorrect restoration or inadvertent trip.

Life-cycle decisions should compare total cost of ownership rather than purchase price. A simplified economic comparison is:

\[

LCC = C_0 + \sum_{t=1}^{n}\frac{C_{m,t}+C_{f,t}+C_{o,t}}{(1+r)^t} - \frac{S_n}{(1+r)^n}

\]

where \(C_0\) is acquisition and installation cost, \(C_{m,t}\) maintenance cost, \(C_{f,t}\) expected failure consequence, \(C_{o,t}\) operating cost, \(S_n\) residual value and \(r\) the discount rate. Monetary estimates should be accompanied by qualitative safety and resilience considerations; not every consequence can be reliably monetised.

Change Control, Configuration and Documentation

Protection systems are configuration-controlled systems. A change to a relay setting, firmware version, communication address, logic equation, CT ratio, network topology or test procedure may alter protection performance. A robust change process includes a documented request, technical justification, risk assessment, independent review, approval, implementation plan, rollback plan, testing, updated documentation and post-change monitoring.

The approved configuration should have a unique identity. Where possible, retain the setting file, software version, firmware, device serial number, checksum, date, author, reviewer and test report. Field devices should not be modified from an uncontrolled laptop file. Temporary settings used during commissioning or maintenance require explicit authorization, time limits and restoration checks.

Documentation should permit a competent engineer to reconstruct the protection function. It normally includes single-line diagrams, ac and dc schematics, wiring schedules, terminal plans, logic diagrams, settings, coordination studies, communication maps, test procedures, test results, event records, nonconformance reports and maintenance history. Records must be legible, retrievable and protected against unauthorized alteration.

Standards, Functional Safety and Governance

IEC and IEEE standards provide recognized principles for protection performance, instrument transformers, testing, functional safety, communication and asset management. The exact standard set depends on the installation and jurisdiction. Examples include IEC 60255 for measuring relays and protection equipment, IEC 61850 for substation automation and communications, IEC 61508 for functional safety principles, IEC 62443 for industrial automation cybersecurity and IEEE guidance for protective relaying, testing and power-system practice.

Standards do not replace engineering judgment. An organization must define which editions and clauses apply, how conflicts are resolved and what constitutes acceptance. Regulatory codes, grid codes and manufacturer instructions may impose additional requirements.

Functional safety emphasizes the complete safety-related function, including sensors, logic solver, final element, proof-test interval, diagnostic coverage and common-cause failure. Although not every protection function is a safety-instrumented function, the concepts of independence, failure analysis, systematic capability, proof testing and management of change are highly relevant.

Governance requires separation of duties where practical. The person implementing a setting change should not be the sole person approving it. Audits should examine evidence rather than merely the existence of procedures. Useful audit questions include: Can the organization identify the active setting at the time of an event? Are overdue tests risk-assessed? Are temporary bypasses tracked? Are event records retained? Can a failed test be linked to corrective action and closure?

Cybersecurity is inseparable from digital protection governance. Remote access, engineering workstations, portable media and time-synchronisation systems must be controlled. Security measures should not prevent emergency restoration or obscure accountability. Access should be least-privilege, authenticated and logged, with tested backup and recovery arrangements.

Illustrative Case Study: Misoperation of a Line Differential Scheme

Background

A fictional 220 kV transmission line used line-differential protection over a redundant communications path. Both terminals had numerical relays, GPS-based time synchronisation and breaker-failure protection. The scheme had operated reliably for several years.

Situation

During maintenance at one terminal, a relay firmware upgrade and a communication-interface replacement were performed. The line was returned to service after successful local secondary injection. Two days later, an external fault on an adjacent line caused an unwanted trip at one terminal, followed by a breaker-failure operation that disconnected additional circuits.

Analysis

The event records showed that the local relay measured a substantial differential current for a short interval, while the remote relay did not issue a corresponding trip. The communication log indicated intermittent frame loss. Investigation found that the replacement interface used a different time-stamping mode. The local relay and remote relay therefore aligned samples incorrectly during the external fault. The local secondary test had not included the communication interface, synchronisation mode or an external through-fault scenario. The approved drawing had been updated, but the end-to-end test plan had not.

Approach and Solution

The utility isolated the affected scheme, reviewed the protection coordination and temporarily enabled an independent backup arrangement under an approved risk assessment. Engineers restored compatible firmware and interface settings, verified time synchronisation, and performed end-to-end tests using internal and external faults, communication interruption and delayed frames. Breaker-failure timing was separately tested. The organization then revised its change process to require a communications impact assessment, configuration comparison and witnessed end-to-end test after any interface or firmware change.

Outcome

No equipment damage occurred, but the event exposed a credible common failure pathway. The revised process increased commissioning effort while reducing the probability of a repeat misoperation. The case illustrates that a successful relay test is not equivalent to successful scheme validation.

Learning Points

The principal lessons are that interfaces are part of the protection function, external-fault security must be demonstrated, configuration identity must include firmware and communications parameters, and near misses should trigger system-level corrective action.

Challenges and Common Mistakes

Common weaknesses include testing only nominal pickup points, ignoring tolerances and instrument-transformer errors, accepting unexplained deviations, failing to test restoration after maintenance, and treating a passed automated report as proof of correct application. Other errors include using unsynchronised event records, confusing relay trip time with fault-clearing time, omitting breaker auxiliary contacts, and allowing temporary settings to remain active.

Resource constraints create a genuine strategic dilemma. Reducing testing may lower short-term cost but increase latent failure exposure. Conversely, indiscriminate testing can consume outage time and create human-error risk. The appropriate response is a documented, risk-based program with clear acceptance criteria and escalation rules.

Ethically, engineers have a duty to report failed tests, uncertain conclusions and unsafe conditions accurately. Suppressing a nonconformance to meet an outage deadline compromises public safety and professional integrity. Test personnel must also control hazards associated with high current, live circuits, induced voltages, stored energy and inadvertent tripping.

Digital Tools and Emerging Practice

Automated relay test platforms can execute large test matrices, compare measured curves with tolerances and produce standardized reports. Digital substations add sampled values, virtualized logic and network time dependence, making network traffic capture and cybersecurity testing increasingly important. Digital twins can connect planning models, asset data and event records, but their conclusions remain dependent on model quality.

Analytics can identify drift in operating times, recurring alarms, increasing breaker travel time or communication degradation. Machine learning may assist event classification and anomaly detection, but it should support—not replace—engineering review. Explainability, training-data quality, false alarms and cybersecurity must be considered before automated recommendations influence operational decisions.

Emerging governance practice includes immutable audit trails, electronic permit integration, continuous configuration monitoring and risk-based test optimization. These developments are valuable only when organizational roles, data ownership and response procedures are clearly defined.

Best-Practice Framework

A mature organization should:

• define protection functions and boundaries before selecting tests;
• maintain a controlled design and configuration baseline;
• combine secondary, primary and end-to-end testing according to risk;
• use realistic system scenarios, including non-operation cases;
• synchronize and preserve event records;
• distinguish test evidence from engineering interpretation;
• investigate failures and near misses through root-cause analysis;
• set maintenance intervals using criticality, failure evidence and diagnostics;
• require independent review of significant changes;
• integrate safety, cybersecurity and emergency restoration into procedures;
• audit the effectiveness of the system, not merely procedural compliance.

Chapter Summary

Protection testing is a life-cycle assurance activity covering design, installation, commissioning, operation, maintenance, modification and retirement. Secondary injection efficiently verifies relay functions, while primary injection examines the measurement path and end-to-end testing validates complete communications-assisted schemes. Model-based validation connects protection settings to system conditions and should include both operation and security cases.

Event records and diagnostics provide evidence for fault analysis, but interpretation must distinguish relay decisions, communications, breaker operation and actual fault clearing. Maintenance should be risk-based and supported by proof testing, condition information and asset criticality. Change control, configuration management and accurate documentation are essential because small changes can alter system-wide protection behaviour. Standards, functional safety, cybersecurity, ethical reporting and independent audit provide the governance framework. Strategic decisions should balance safety, reliability, outage risk and life-cycle cost rather than focusing only on immediate expenditure.

Key Terms

Secondary injection: Application of controlled electrical signals directly to relay inputs to test relay functions.

Primary injection: Application of current through the primary circuit to test measurement paths and associated wiring.

End-to-end testing: Coordinated testing of protection terminals, communications and outputs as an integrated scheme.

Dependability: Ability of protection to operate when operation is required.

Security: Ability of protection to remain stable when operation is not required.

Proof test: Planned test intended to reveal dangerous undetected failures.

Baseline: Approved reference condition used for later comparison.

Event record: Time-stamped record of measured quantities, logic states and protection actions during a disturbance.

Configuration management: Control of device settings, software, firmware, drawings and related identities throughout the life cycle.

Nonconformance: Departure from an approved technical or procedural requirement.

Functional safety: Management of risks arising from failure of safety-related functions.

Criticality: Relative importance of an asset or function based on consequences of failure.

Root-cause analysis: Systematic investigation of underlying technical and organizational causes.

Trip circuit supervision: Monitoring intended to reveal discontinuity or abnormality in the trip path.

Model-based validation: Use of an electrical-system model to generate and assess protection test conditions.

Change control: Formal authorization, evaluation, implementation and verification of a modification.

Life-cycle cost: Total discounted cost of acquisition, operation, maintenance, failure and disposal.

Near miss: An event exposing a credible failure mechanism without producing the full potential consequence.

Review Questions

Short Answer Questions

1. What protection-system boundaries should be considered when planning a test?

2. State one major strength and one limitation of secondary injection.

3. Why is time synchronisation important in event-record analysis?

4. What information should identify an approved relay configuration?

5. Distinguish dependability from security.

Long Answer Questions

1. Explain how a commissioning program should progress from design review to final acceptance.

2. Compare secondary injection, primary injection and end-to-end testing, including their appropriate applications.

3. Discuss the role of model-based validation in testing numerical protection schemes.

4. Explain how maintenance intervals can be established using criticality, diagnostics and proof-test principles.

5. Describe the relationship among standards, functional safety, cybersecurity and change control.

Analytical / Application Questions

1. A relay passes secondary injection, but an external-fault event produces an unwanted trip. Develop an investigation plan using event records, communications evidence and model validation.

2. A utility must choose between replacing an ageing relay and extending its service through enhanced testing. Identify the technical, safety, economic and governance factors that should determine the decision.

3. Design an end-to-end test for a communications-assisted line protection scheme, specifying fault scenarios, expected decisions, timing evidence and acceptance criteria.

22. Multiple Choice Questions with Answers

Question 1

Which test most directly validates a communications-assisted line differential scheme as an integrated function?

A. Relay insulation resistance test

B. Local secondary injection only

C. End-to-end testing with synchronized conditions at both terminals

D. Visual inspection of the relay panel

Correct Answer: C. End-to-end testing with synchronized conditions at both terminals

Question 2

A secondary injection test normally cannot prove which condition?

A. Relay pickup current

B. Relay timing characteristic

C. Programmable relay logic

D. Correct polarity of installed current transformers

Correct Answer: D. Correct polarity of installed current transformers

Question 3

Why should an external through-fault be included when validating differential protection?

A. To prove that the scheme remains secure when it should not trip

B. To increase the relay burden permanently

C. To eliminate the need for primary injection

D. To measure only the breaker opening time

Correct Answer: A. To prove that the scheme remains secure when it should not trip

Question 4

Which evidence is most useful for distinguishing a relay trip command from actual fault clearing?

A. The relay nameplate

B. Relay output, breaker auxiliary contacts and current interruption records

C. The purchase order

D. A single pickup measurement

Correct Answer: B. Relay output, breaker auxiliary contacts and current interruption records

Question 5

A firmware change is made to a relay communication interface. What is the most appropriate governance response?

A. No test is needed if the relay starts normally

B. Repeat only the front-panel display test

C. Perform impact assessment, configuration review and relevant end-to-end testing

D. Delete the previous test records

Correct Answer: C. Perform impact assessment, configuration review and relevant end-to-end testing

Question 6

Which expression best represents the risk-based maintenance principle described in the chapter?

A. Risk equals probability multiplied by consequence

B. Risk equals acquisition cost divided by age

C. Risk equals test duration plus relay rating

D. Risk equals number of alarms minus number of trips

Correct Answer: A. Risk equals probability multiplied by consequence

Question 7

What is the principal purpose of a proof test?

A. To demonstrate that every possible fault has occurred

B. To reveal dangerous failures not detected during normal operation

C. To replace all engineering analysis

D. To increase the nominal relay setting

Correct Answer: B. To reveal dangerous failures not detected during normal operation

Question 8

An event record shows a valid trip command, but the breaker remains closed. Which investigation is most relevant initially?

A. Breaker mechanism, trip circuit and auxiliary-contact evidence

B. Changing the protection pickup without analysis

C. Replacing all communication cables automatically

D. Ignoring the record because the relay operated

Correct Answer: A. Breaker mechanism, trip circuit and auxiliary-contact evidence

Question 9

Which document-control practice provides the strongest configuration traceability?

A. Keeping an unlabelled setting file on a personal laptop

B. Recording only the relay model number

C. Linking settings, firmware, checksum, device identity, approvals and test results

D. Updating drawings only after an incident

Correct Answer: C. Linking settings, firmware, checksum, device identity, approvals and test results

Question 10

Why should economic decisions about protection replacement include expected failure consequences?

A. Purchase price is never relevant

B. Protection failures can impose safety, equipment, interruption and regulatory costs

C. Failure consequences are always identical for all feeders

D. Maintenance has no effect on life-cycle cost

Correct Answer: B. Protection failures can impose safety, equipment, interruption and regulatory costs